From 4602ef5a6041c99573fe16ad0fec9fa60d0b662b Mon Sep 17 00:00:00 2001 From: Eric Ernst Date: Mon, 7 May 2018 07:26:13 -0700 Subject: [PATCH] Clean up architecture .md Remove more references to Clear in the images as well as text. Reworked some sections for grammar/flow. Immediate next steps: 1. At least the delete/kill command section needs to be cleaned up/clarified 2. Move CRI-O UML flow example to its own section, or subection of CRI-O 3. Carve up UML diagram for basic docker example case. 4. Add section describing initrd configuration 5. Add section detailing the gRPC protocol 6. Agent section needs cleaning around gRPC description. Signed-off-by: Eric Ernst --- arch-images/docker-cc.png | Bin 42466 -> 0 bytes arch-images/docker-kata.png | Bin 0 -> 47296 bytes arch-images/qemu.png | Bin 24463 -> 25018 bytes architecture.md | 396 +++++++++++++++++++----------------- 4 files changed, 206 insertions(+), 190 deletions(-) delete mode 100644 arch-images/docker-cc.png create mode 100644 arch-images/docker-kata.png diff --git a/arch-images/docker-cc.png b/arch-images/docker-cc.png deleted file mode 100644 index fb4d3ebd1001adcc1781875461c46d9f651c3607..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 42466 zcmce;cRXC(_ckng7bT(u(K|tq5G`8t=rMvs@1jl+WP}7!qIX8`M6W{pS|~5d#!6-Yt0FLsHsdsNJof)fkC43KtTrs z1M33@2IdWXOyEwP%tJm5jF%WH3UYeSr`FSnp6iV^9(d~s;6-P%{K)%KFf>rS_x-t~ zbQq)H1MZuOdDPvDN*LPkY^W^x+b}1E!Z>pXD;E=vA}Mw5;Bz^7Y)s~N-Rv`%VKX@Q zZ-)$G9G}KsPnb^bxkb>}$JS<+=uu@ekO7JxPF9}FxK z^z|hK7k&94i-o>CfnGshZo$$2V$j&$zqtPQHWy8ZZ!=$9|6j)WyUoP~H|6TZ^?$zW zUv20v{=(A0zqtOH&wpz3_cA!JFCNm^{+Bj?FO?E44-5?A+ZPwyzu)yAw}aqfKQR7l zo4>d0|9o4=g>cCj)2@bR$-l|Z&AlQ0qCvIIZ?47rxSU%ze`I5;+^j7_9qSJ5NJt=$ z{^lI4E1WhqHdfwP`e1WRO_tu`+}oHQl_~T5`(gaDJU1q&K?E zgPf{O6>|b9w&-zZ`t8#OzJ$Df;QAcqdyuj8^ivSQ>G7V!SZVT{1hQtBEs@4n!sO+H zTkv6jRX4Y)(rTFJ(a%J~*>5*+ryll=a@+o_bDI8|Dn6j3v$vUc*Il4_U6|ixD7Pm? z)PY6Jc}i>goZh8n5PAOb6&~!wEbsd5k$EFJ!*A8~@j7{&VZf_*_6X(Zt3gFp7)UuOb zP;g);7rZ$KIT56HItiHd99PVT;1b_fcmtuHu6L<-MQ~=m5Z;>2&Spt35(L#Cg7%NA z2c%iE zC)4H%UwDsKfZ+DL2`=3X*uXs@DP)q z#T{^}?Le&t^5xm+z81nms}O655S;sz&Ne;Mwzj0askoHE|6mqeMm?htdDV4zWAb~D z^b2HGhpI!yv(--od&7MWA*WzF>O0Z$OqGXkL@;jLe(sFepoRA6lKqsgbgnZarINrN&S2 z6gsLfUFYOrXaOtJ^R>0WQrcbWSB{|j8INIC67eE8H+O>Om6uCrI4!e+_qPv_sYozp zTI455$bgfs;8d-{vQ*fI5EUWVT8-VXQYvA=@aTSRWQ`V6<$%}5%w2`9h58xu!hlgv zZ~0t{=!qjggQm$WdA#O8yIuDY*6i00iHK|7|2mMI9>>$rA?~>k=&zM7CQg=Fn?DDG zobkgazHzbd_wv|GafUPfr?(wGk6Gt2zrrK)ilJywBjpaQpPbS@oK;_{))~c~oIbGG0tf0ZoXiFybCF`Fq!2Y^0e(XFyGJ4$4H(u%B zAhWF_laA%oRW5Ull75viYqi)s{cc0V+Os%+e;e}zELGn%+FEX>Nk_l&auXPBp@klM zwi=Bsu?H6xKX)bW0$pxecCGvAbTimR)VJUF_DKcD~H{54r%L0N#q3QE=o2b2pT3QN8C)mnbJAQY@0fze*(4q+!H&UZxFkqDu)`~ zc=3UkNq}QDp{9N{lwDRsm0(!b_vG*j7H-_Q?Ak(D)P9yP_r{|Z;nibbhQV(-j+xiO z?3)j6Kv#)t=pr)%Vn#*!qpxd!DtRh_+%fIe5pfNKda^y-ks1q3dwp2j4BeO{cuNNj zQk<@gwMV`hcQH!c%W!$~tX$`bxQ*dFJ1m}fio)rmORCuY7vF=gtHM!Jzq03V+?!NB z(eZoiYilghPBkT)+Oxlp^BpW?%1|vw+q|hO`3?0LbIr5Ur?;oobZsL2T*PpBRLkX- z{;RB$D!197WjA?AyMY2X5OTdj1a7tRKAmAjUCDP%&#? z!7t82$k=tG*K5@Rq+h5vwZrMfzZ$QUGb4Oq1%!2EbCkD!mKnTPtx;O6nyR40Ccce3 z#Uv7KigUYpec9D>%(-mVL?&I_CByEGp#%~$(?En^i_W&fcVEm-*QpKpAj)wd-3old z{j{oFsH1-*M=3&>Y2}oKAa6FM%z|Jhf0!>c9ecJSQ;d1o4SavoQd}LYEUA#X#+4z( z&#;lWCV0@VS3Cky?lYZE)!7m~e!mfkU^Q*$iG6C(=^Q>;YvdQa-zCtR==pGo?)3F& zdZK63VjZ{3Vx$`REt_=@ohGU~ge9+pl^LgGji1+kB=iu{tSDvN^PJ;N(B#kS)BNa| z_zN5UHM*uM(|@X=!B7UPQUuSF{pVDGB&T+|j~2aNL7i`TqN_+qO>6!2_tKwJIU%}t z9J{EvHVwIiN>^bvwsIsjTc!@4jo**Wt;X&0o}ZTM%zmYS4G4IQ%R7!dwu#zrkpY{G zYzCF7a=yjFl~^UIanR$iv^VrmhvYbnm(P8-lvE)}yH_@+W@f)2^i?+TXGSpp!CIj| z7mRQv-S|gedH4xI6v$tDwqRcLj`)ZZ)`vN#V-w}-XyQF+d195oN0%o`tCXz}(w3v5 z$G9L^;QZ%1%@XUy?O$zjm;6iY8cB0kone@TVpvG^@cO&HF1GGtA917l+k4hiXm{Kz zLFJ>C=6(9jUYrMxHU+|Qb9?E_L}{-bEQ0(E=SDU(@5CFK@qa`~j*2@n{qm6A7;{P8 z8D1KJS>Qp0Djx-l!S}B{m0m69gH=^0e!$b5o(PjXiWZ9B;dS;e>7h!Qz$G%}s@b?iZv(PfUbG91odqU?B^PWa0t{ zmEqr6z}YmLJ3;Tu&m?z}8+1uR7Oz7e z8A&d^UMua#)gOFz=f&aHP@bBT?W7hSreAI*fyg;sp_rJk4hinmF;1I};j1rfFl^Rx@o>1cm2=>aZ<=!uv zXa;Xq9p_XLdwk1p>5aeVY_4P^1UBY!h-^rI*5o|p?-|oPAOxpDP}10@a%Wjv8%)pz zJY-s`jek02WCP8M62t1KFm{7kmsC}L40ofot$iWx+ealg8)G?TnXN>OB8YIa#bP)_ z`r|g0RuZCBpzO3sd*Ui(Vd>}u@fBZ&e2CbdNWg;l>I#Q$e4d{3vnJrIy&gJwhMRt^ z#$jBufKaaBS&$v{Rp(+5t^_A%*FG~U=f~pLT0e2#n}rb4tYv4?jL5;02|RD-J#w!| zJs~XQz6>ho!L?`g=gjtBXmzVoIW3^0^;3SL8$xud@&2dBNBv=?Nf1)MA@hdGaAxN! zJy@ZiHmjF(QnrH6MBtMn?)~jcqb>YuQpD69o5PHTk10J?8cNG zJG!U&gYU+em|{8YRtq+-SJ8@CKksUBY6W?d)R@qE#C~TPmQAh4KfdSk67&RWWm^gc z?@~Hq#?O-wzn*1&GAx0lF0ab)TN>YRTo6lG0e|jmF*%HNZ5M(MX-RVRyd~}Mbumwp z_*OrYUyH42BKleSI|^6Q9Y5{LkI$broc(q;3g!!)@Mml*+0>-o4hMi0YcO%Akj983 z#(iSKR3vq_=4?jNs5C8>Q+lb?!stoR(ye9LH)8M&-7GD7O|5PtY-(}NjI?51#J!Q&$8X3ze%tTTMvz2TKt9mN#m)O<6+#SV?L^yx2}8UQ&#W`CaGSo;+Hylh@13qK%JcVIe>>{Wc8?14 zh{Z15KDjIA)KzCUPs4SbpE~EC_r7n@%d*ki9<BJKl z^!e-lsU=*LR>as}2_8WriIp|F9yGbxR9EK`b>=Z3gg-AkodT)PU*Y8u!xM1&uNA9p^pqcdhpSctR}aV#S?XXQcZXO6Dp-i&b{kTLbc?X*dUh zv`X+SR$U&_OTm9bSJFkR=~)ydcLl_YUXKNbf!UzY$)+Wk;#U8x9eKLmiHsz5;UIl zUV#p6)|QbirL@)?x*HJa>Y`&P+rYj;rvCZUQ>$+xsanswH7Q|ang(q@mhLp!a0c5! zVXH0!EZ5uyoSPnfCa&ox9#mp;pVG2RBQ=<9oR6voj6}d4>DKaZ)5Fa*u~XAkxQADO zBj_8i3d$X`AOG2J|J*4V6w!EN4<&YU)hTIC`;p6us0Ms|5+l`p5u#h%_t~c+sj=&O z$#x2bDynqWZozr=*&*(fl5DLUIJQ!(B%-HPSnA=5R1`=FkW}N4hE22R6+r}l?=53y4t2yk`rnU0w3ep#KC;}1` zSw`l#TaDB7ScaY%U{M)!Hx*4nq^1ioaY6K`GtY5WA%C>l{=?YQtdJx=~qI4VB(aFR6-!{AjC*#*R?jK-a+d+LD1J$EeUZz4RS|JAN z>WM8A&To!F#M@5jP89|=TN9x&kd3e2Ew-E{G_zXok|OHH33GC%Tc`Tp0Ge2LO4fvB z5Dzgig-h&tS^gA;J12xRyLWo~xCF3aIc4r?5*8;x#Da|f)w(`QH#B*cDyDv#-uH=D^ zzMshx))D2J8Oc+_f~6^ar;n}LX2=8iSD=qx(tTLtXKEEr4y$1(lc{rn444jyz>cf! zuS#%8bWGhTlE8M-pvWJ+f9~cO;^|mA8wt{JxT4+AvX*#FKHVSNq?}#CRPtFmzAF*F z0*>lo^v8F6e2?DW>>&29btsB;EbKk{kjnHpcH2J1Y+9%YVXb+-O{}@%H3@4vo~8M zQT_G7Z%7qgj*cG=iqHEWm~4N~QI66n!+1HDT@TQmg%puD?(Xb~E2e^x8fLIFGbX=Z zohMAN?Xx%9pqg_gzbdcxNGUTvzXx54KQS?U-p*kHJlamzeNqOA8oPrt8De^W*AfGM zP>t=}uQZFFX_*Nz?EO-`sppopLu~=S*0scjW&(8QoP5Ub?Yp?2Uzagz^nMq`bY8lD zzI@$eKYbq;Bu~E~f|h_a^WUNEx2j^7*+s zubeZTuN}(dseR=?U6@J85cPk&d{~^JQG2frZkq1vsDJQdqAt>@%dZ(63O1JU&slC` z0{7P)4}}{UgV%p;G;bD~W5~J;8Uq`v$1(4J;xxBBoxvdfy=C{SWPRODJ0^)$!4h%j z<6}7UhU*m!6g3RzgRH!j8v>r?nJU9@ci*L}li8jqO6GLti)dqTa4^0E2DBc*4-lq2 zu@!A+65!z_nFw0LUTnXuZf&EI@fUlehL>%MW#MMewFBqwr};X+Wx88mgWY36n`}Id}Z=y$yJX(Q-we)X5$V<5N&4)G&z}aT2j?7M(wc~FyO{0 zYJk_)zlosVRk|lr$0rx1lNI3DG2AO72fu;=Q*^m<3;vKjuyv(pQHcGMpJvZ1se!w% zP2*dfhx7aM5>0*1aF!E)nN$@no<~}&F`cBvGu68~s^x8FSd=gXOiOz^x-X~gE;RE; zI?YPE{USRFv`DSjs=d?N;r9UvUJ2~VxRHF+Q!Ge+IoBp=#pHXtLo?IEP%g&h((13E zTKiGoP1tyaSsQP8!;c?t1)V3We%>AYkkfu1m;4Hf^;@r0vHcddWTFJr;O=g2q)gJK zqG05dsNGQR{I4bPL=&&c;OnL|9;f&eC>iPan}#JwM7U1Jz0#%($oGEu<~Q_uc(zq#bzn zMn<}kk6sS%x7e@YAFq1Szm7P5tMHyL!f`NL5n%ZMB6_@(+xy{Q{k%VKJRculny7=p z$v$$=dAECkO#Y3a@&8y7LL`8c84>9|AXN{<=feeBGS9xf^!xQQ(M)=?WtZh4oQZa) zE06cz(gxN0cMs>RW11U1_#)VZ$mXqR*~xmt=(CKhCu5NCKp_URv$F{(IcgjychY=hS^RnmCoDjT4||&%Xzk8P{)2Rxg(tRqt=k3;OX12#ghoIZkW=%=zPh z)4eR;z!dWj3-XE9%!ogxfle;qm)5|8#DSe>UMn&-8Q#`zZaV-)z3!FZ(t2bK(DKzb z0~>R&lcVKK!P$Fj1!;ckuWXLm$ltHLpTGN&V}Nwu2>Iyzqr7mH!OhEIU&x)aiG$%G z(U4U>fZ48do^5hzJFR>F{@Kya&-T|O%{yOsPjh92y|*g668Q%1U#c-qV5`_cCFi+b z0yF?Ms2t0oVL#srlgh8LzEeGui8w%f`et$hP{|d9F6BIBJJ~r}$|7b9uXq2@vjwkHU{?Y@@MZMjG(t?~u0%R{j9df7yx0 z3=p|+sd?aBv3|)~?~-BLvHoW<-yIa=R(F?L;y*-yDQ8xD{Jraqm}K?jfIYd&DU;IW zb^xb(CsrQ|S7xx(sEh(-O17sp@F?tZ@v7LTSzU~Y8RBKC#a?S?^Ly1D{-?v&ZT=+- zv*_KPS5c(LlLN)NZY60!c#P_1E!daa@sr5M;4A0p*;XO;X?VU(T%1Vm8=E-z$mxRL z_JVH)dzb3)(9S}$^JL{-O2#0HxJ^UciOzA?ra>QOhKjv*k0|BXPZjU#{4yl?Ej8<< z7GTN^eD(eo4e8QvNw_-R>@t|YOxlAQs>KeV4&b56lH)n zoMAQj-J!OR#J}v$HQrdp7ljJ64&+ilD5W2VTnc~(TgpMP0*|rODsWCpz+Z0a{-wo^ z7ew?X*s$;W$+Ao|P;dL1t>f9*UG6~feRv`#YD2dd`}B-v9*-&S8r46<<|t>Dl1!U8 zV$5>LR2$+f<d3+;+fGzNHpCGC5$ZRfW^vM*NyC-^^`& zd$~LwY(Llf`SaEU0-pi_lQ|U)#mmgV*l7Q3Y2g2sV2*# zHtOwE&GdQyWroYQ0>WNl5^P#-J+V)Qf)Nu!KautSaG1f+fENR>gE29=^M03qxPb_0 zK>--HoPoPXpGF;bTrf(tr)8dJ21aac#!>xibfV$mfazL?(__(s8GYFkv-9Km^E2_w z*%e3}l`7T!N*Q3WmFS6_Pp zUIqc3H|*bB?v*{Z6n~lSGB7B(&f#Fp*ySIVi%xEHM4RQgJ^zodlAHfHVTyrg+Fg;g z8t~1Ag~+4bf9wL}!l>7}DOgIgvixyE9<4`9simbqLqiEj=x!H^+MBldp8|_J3nm&S zBx?JIcSwE#B>(8eoo~qa|3cQ!k1e8xb56&okpT;x5rDtSUtC-Sa>XUh|Lk%@%Ex2A z)sHFQ*Y@Fd06pLl<;kQ_PulRZ>ut~9+}rMW8*sYzhRMId_h6&_4VmueKlAz}7Yzjb zR#sMd`T4DTV=X{CGZ!U(An)gQf~-&EH?H$L*#{z{*YX&@QP|OgJpj`@e)Q<@^L4ZJ ziAoFK+c~G>+Gv3I`Sa((yT5T{vB6kWf*V^(rM&Ey-w^I1Z~tF2{eP+f3fcRTMc&-R z0EPnq{>x`8gE@F|7yyz4kRS$dQZUdU8y77SI2r|G09x{L4imtyfXx4Dg+A?nwZcyS zJq`w-Zy0DSj0I>8fYi|i0)SZsMg`y}den=zZN0bZO$ZMU9~l|Bs~w3gHAN;@`z}2_ zJu_1ago%d9=BCBP%w%Q2N({91EiY?0b?frhE((j zF)!#p;||L|=lB0=sY-Hv^!|=+sB5JV$C`-ESG_j1CSX)56g7ZxckQKZ;Wt$}Kb*Oi z%&8ndwJ=jvi2sx(UC~Chxx1&w0KB8AurMSScn3Fv9|&SNR5Udcbi!{?7}w;Jt#j#5#LbtybysF%}gS)dPkY3SX+_?D#=#JzW*{n7N$y@84nL z{+>=#Pj~mb+u?o^)LG%#J2THR?fE4oQ~&WiSrY8rGrY;!l@p__$05yB0#eh`;)Gm* z8xx{;wa_{8^aWKQqrTPg{11JHqM{H_jc zB?Qi4q9solNQ#aKFXSp$aA_Q{(*x1x{r4~z76k__qMHbO2?FB3Hwi0H6Nonco`@`* z8_)+JQoIN-{~q8XZX`zus~u=2&Uv*T%?;I>lyEXNacrJ$#OLWAhe5X6ido3h5?-Xv zpZThNZ8_0A(M*Ho+XNosPn+jVVV&u#J$adq5s zr7Yw(j<#y2rW5+?{EKvPha}GE+0>iYhlesR7lSnf;h^ znrzu_38*2X@*sFT?O>eYwaUHWlc%>?JZ95KR(JGsa#duVzo#TYU9DBac=#T z&El6(2O^NNN!$qwQnroJ@cCZ7Z-LsZbRqq4^M-KtK}@z^`u=2aHn5SIFA#JUaI!6v zqTr2LZLA8wEnd%X#hal(*H4BwxLpIwM^X2Cm&4n7BPt%`*9Ioo>K+?b)c!=S2x-Fi_>bch zbWe0E$;l~E)*AE=@;z@#V6T-}hc~txyf3%4ofn((E_*hsznpX2!hk`BH*ZO_cuckxQgyj3)RHqY%(Z3dw8wYy} zhBu`fR^*J&U5NqIV*P7I7540O?Sy8E<@DESYm=21CyEht8O2U42sC>EXgMz3Y8X^4 z{1^6MSZ0UpCpcns{IaIC6SNGdL8}O`Tq2uwhLp#dELLQZ;Z(#9$(zES-T$)r+JnI{7{{;g9X%EqXIdr=;ADP}rBDe? zO`5WZC#<6Qg)358<2ZL%^)|Jsk`gRlf6Xj$Yz(g<6-2tkHbsWl@HUF#xCE4W?Qm2~ zt-=Qztzx*QJJmuNJA_TSGqbphCQk<)Og?$HQv9}BPoT^o9Fsuy%6;hxvo9MPJNw1C zQnc;P&nhLgF*h}~r43Zfmyz^7=NoP^I3wcrD&t;d#TxKYlcFd)V1?;R_6}ZGYFYxz z{U0zn`Z}qBuSd?}GfhkbfabSYvyI{G5(dtW!`Vm45sn5kK?TnHb4s(hu6_jbg^+PI zTD;ElFBw&f&R%uPKC0uWjU;CAVws1P(PV9SC#lj?{2U;;5>fl-tMFDQl$_IJvn)ZL z&5)4A35LM>3H1he;0CUufTMR)q#9nfd^KlQf+1Yr-sXi5)3sdPfY9_6=-6P2Gtn_&QSL#OqG7GH z+GlA2Ih3azKY2ZwSHsU`=dC9z^d_}x3$N#?%+L4A!RM!8Boh-0nx_JEP2gFs2Y}hh zZr=oyd{Yx?%i`R|3LUMf^3>e-oHOpOopI5PaXTQw^ii8NPLfdrK=dCEk11EMZu)~L zO{BnI(NA4;6JTooaxXv$q+C>>IobY!^r?r2syKb>B~67d!Tz8!+5NcQEQ+`3^q8W^ zyLTx9);1n|X|_GSMCI9f4mEri_XMVoHjv0#{x|zh)xMz>$6&0>1M$Dz+u!V>(uH^W zo3WEqhF<{C3qWuM_zQqrdC+5w7+e;lej$<})HfSbP1YB{H7+MVc;Kd8mJyT3nP_R!p?Tm>2YSn0V+0BdD#)r(ds z-~D$@z#1={^9T*V%!p}Zirmd`cpGg*=ziRCZ2mY(XJ}~X0qD2WXSqM@uBPcXM}l@@G`wu;_}MZSv#|B?RE&1&-s}+1(Wp z7G4@5Twl(~P6z5St*x!8si|Yq{+t@9eKeF3s8hXQDbcv{0w(@1Fo{+Rpj!8$)gLe^ z3nu`|R{tYf1=^$0D$xEG{2yo)fT$Ok_9g-wC{g{7X!Q>U2Cy+217Eay^#;J}mX?;e z`T1W%-PjO={`keg>+9>ke!Uo?_~V{CTo=2eusi$V^yr1CvBU zN@g7{E-rMjV2|>-|Mo)0n&_#^wmXNeeM2F2Or~o1+Xx|}%)9RS$0kG9{??+`DTcdp zuW(g_ardK)_cVvd=udQ5im8@R-luubGb;*KZGm?H@y?jguaHq1XXkEQ?y(~O3J4KZz8pQ~Z-j~pFR6|MW zb?(#k;Yxffs`%yCCwdN(lav2=-apgmu9o31bC)qbJo`VL7k5B;uA&NghR>-hKx!Hq z?0+CFfFwBuiUm(bAOAT%|MOs?F)a08EH}Oc&L5tK74cVme1VK*|HmO$dGh-R{Ed4r zfc|d``xoQ?djPaXMnIKyCt)4+Qc@g!qAtzff7$ia>rc0mgrDmJXcqANf9F!LrF6bz zk2l?Rn7WC~Om8?c5daW;T%Yz1ms!AD8~5-I%h4|N zAJa)}esIY4jKTS+G0q1-&GIL8La7da-!ssT)09wAHOX=k)L~$B_}&p*GzZtTA{anoSy6?`J-%(tbwzu7 zoPZcci|XAz{2i|P$jP*ngMr;M@p9FLJtLYnovtz(#s#s&C$5&MtSrHT3fMs#Y>!e9 z(hkP4>UgkRF72`Ax!w>8gR&>!Ks>@GgMCwy5l#Dw_1YlQic{PNC~|r;0A6Z0fJY|} zXN7WFzews`ra{P2@55H6V#!PvOl*aDJe^0jMy8$b$ZVNjwQHJvl|69WR3osa84VY& zb<~QY72P_%8aP*L!rR90kkwza8yVSPZXu!x?;>s-go)l+vFG33SLbo^_r4^nl;FLF zOQ$)o*b(T!T~#1D@(1#z8FRJQeo4H72WAL2$^&|>s*)<|^knz^K7P}@p`={BCKuQK zCvpbjm&Q4xVH!gvJ~P5c91*J^kKZ(QyB|5e5a!zMGUV1w z`bbC)jU{1YIMv+#PQ_E4_A)e?Y(4Y~M#T)kG^V=vcX zAQ)`!ie@w&pB6Y$@%9BU;L0~3hWWL@P>^!*6s{i98e%N$8X<*0-doKR~biyCdy`xS)3FCc~6~y^WgNQf0Z{8y4=^S<(r*7 z-~;Z<*ka;B@L(+j{1i~&AZz_NcFB0+`zVG{J>0QB2u3f6)?#DpYu~P?os(Agcw3D1 zfry?Dv)m2wUmR_r&KurJiY2iCeu_ayR1ydLZ+ii~mMTz59g6v=V#w5|5;rqFJMV8i z?9fJ(?yrj&E10W@5VwC`j7&0Z#yb)8%PASFIr8>zGkXS{VI)Murwr-K1Pl5H3R8`^ zh6bbm5h?)|`S1Md1u5`1`GqeL7>OR>KM@INQ~m#QEJh8hr63A9Efp2!e|rnc%qab` zyn=$*55KXHo;WQnZOrRRt*&f_wYB z?Ra($4yx_TH5O>*9?f`Jmj&OI)6e*TC*gcLK&?b)T}2tNsfFPfq6 zgnf1H?}SWr9A=17S3UWNd5IW8Ziw!4@VdRDd!H!50Ots$=3?(mf27l`@C+nA}XlzS?~oN&)fdki}|LyG3vlBUyz4S0LKZ_fLKStE9kaG${%E7o3SbJZ@#mWy=cn;h5&7E4!=aV z#nRZo1lr2xUx~*bVa28EHVIV006OxJ7b+9qe%Fj0i-GyhPLJhb)Jq5ln1JI78$P=2 z11U`0rkF|KhaO5wO7`}vX{z@djg3-=Os#BemY0`Vu`O9Afr&%wZ+F@|gpW~xH)d2A zoz3Wk~`* zJX))0n`;XQs3PyaEldK-6H=lAIM8&NfL5<0P`m8;!-o%{LGSziNr^6o@J^L17Et^! z_XUB4-Ivsl&hW#RGo*YuG}Drjk|tPHX@ty!z8n} z$^~-^mV5NfE$VOS&zFPnzt)&q()k!0(pj80Y!7@^d}1*o5OEe;;Sw{jU+psA3WNpF zjnx`Rf-mE3+jmyTVsMQA#Dw@KwWpey<7Qz8pW`ObS@!GKt|{u>8y*@O>0yx6^1E&Q zW4Drgn%7}IgMLFzb=}UlM6;TZP8BS#qKWw$;~E@)bo9 z{1KJ7ymX&L`K*#M(Vea7$xB@5&i`A zxAwqLtP$i`Cb66W#fP~ajGr6*a>V`20=VbOgGU{25fKs9(uZzq-%T)E_z2|m>s&*m z)N=0l*ek2#i3_{t_;uXRA0KRjhTkK9|xk5wm-k;-_hEZJi&O zd@t~cK@bq}#DpHoQ)Wx}@C=X$Hs+VMe=Jtw0Ok^jp3C&qFwL7o+i)5L!eV2lk$s>s z?FJKag_pK$8&&({YX;RG^{t~KI(%zYRn;Dk4+PqoVU(GIp{781Y#=JkJZ!JK96UEf zV+Rb7@_pjfkDPf~t#jj^;P)dVdV#cgAK83l^P}xXSmPhCn?qIR?fE6JPkOli_Y*VX z+d$iw2z1-Mi?(J%fJu;wqZ(u#E>vEPR?Vdlg69f;?2ygL4Pi`HlG2INV~G!eaQG2$ z;L@?<2uJwjG8QTD02blc94Z7?AnU$Od>a@_CzQr^=sK3htx(2yc9wMizH`$DeMjn| zO(KdtNr8-A5!HQrHQFbaqDX=G_KMmqAvhOzwsO99)ZdFJk@PEIpZA(3Sq9v^AfmZB z@et*_^Ns!%{5w^!_O>28u+{e#r}n0RPZ<$VCoX*J%y3rH1T@wR&@D79hT1v`g1@qF z>sAFDe6FGsPJTUS4&^PO&_W2I5)7cg8l#h1S(#evOkqBD=j%66vjE4Pg~shTxG7Hz zUX?{ZtZVufezlH6;rZV~5e@Ph%Nx96ABG#RR;u!D2aV>|*I)u$6Ddt1(NbQ&<2zq< zhZxm^SACOLj<@eb*_YVkGcoF8nu3+Z;3`{OoOH7)Nli+zu*Rx#epda6ML(VGWE77? ze4dawv^Sa;KuRhOD3^yMIxf)wfC8csmRW-3s<+ZVG}c-UnjKWU1%1Z2vHEY=8d?U% zJ3`OW(zbLTWZx!kCn#VjGW?X48k%fRFa{nEqa`1xFEY6aC_SI z+|js%seCmHr!;kWm!ghmVYQ;Q*T(~Y5!W1r?G+uo8GdCeIY;`bDSStBOMYJn&MBZ; z3UI8T%{$lY?nzm>;Z@*9&^?D4X8|$IY!F*pwLHupfNE%Fu$~*>AysF-)|*)dpt<#_ zCrB~4eUlh(@9~r1uRRc)U4VkE-2wui#$PekVNtPIp5Mb3R#|L6YSckr86ePf1n!1VV@a*77^jFjebecdoE*uPa6Z&fz3*EO5X8>ZIbgy! zXQK`{x~^W{CD*8g5_^slwrpgxb89OG417I8*+!sg5p|usqVBw0P9scsn&01->Xx9E z;z8v)YCS7dqkah&d+}j+Vk2E3Ug{ZWwxa9Wl3%|C*CFVm=xE(|okw~g@RHGnnYZ;T zMV+Gs4X}R&)63Bb9MMsh*krzHPqzVsME^!D=L?S;K8(<{CtNNnv$ixie#W9qL4w zuZl2=CmlrX-qb$7(^u$3AVVvtV)q%uTnTTOX6N6W3&*Q>`8dTyflqW6ylWl!aJo1d-}t0YxCd{qTD`HVwnJDM&kby^}b8WxXXUjQ=C@nzm1%Lk6z zPqq0{@l9=2?@hN+g0#g>$8xJ&@$aZ|W0{Aq*u*zR;B}=a&qVE!X4}xSvNGH$%Dsr6KXX(;|8F3*nxpc8uG_W{a8(tmR$*f=7u6;8Mv%( zYK95q1(4UOw@Q}_J|7{qWWw_M5vm+RkY2-mgjpd1Qu5({%U;vpfj@H7^BQyhd1{$< zqHZ%u&D8QfibnjyrnM~S7JL6((Rb#+71-0SCOvLydfd@WeLFlWK&EP3&SdnsR7Go^ z;<-ZzW{JX{Ky8pAJ070R9{^8`-eR^9L`!P8zWT&Xpq6Lsnnlq~Nyp?nw8F;!R zo4AK)lEp%jXnvF5xCQq#LX8xFFdLGi(ZUgc5No*+}q zOs|6To@X_fv}RuS4*FfgyXB$4uV@V89R`hjfehZM&*P`{pSVJuMrcWjWxMWK^f5>z zI}bIq>UwR)n*l!(>IEnpAb8X_$1W7=#F8YUSL&Jt+i-2K*xnJ2UXtoW+)jzCM)$wAeAbCf; zWfBS@-AyS?t*{oVG5RXz!iYr@A8!ZHNe3LSUQ~)_+#2Z)IOT-ksLH&s3vV}=a=b{eWR;R0uy(ce5~IL z#=96_4E}TJ>v6wH=U>xy2=5Ju{ZfkudZ;4vAd6OQC;j8{V-xo<=5gxXHH0FVP%cCC(16|Dnoz>oX9g_PHIA{h7X{A@J7_S82rLQ0ncD*_UULe0WDY_wWE zbPv-J4?^Rf%}IXAGupSH-l+8rduQq(>F?l^DU^$}Rq>D_D8vL?PEiS@>reMTYZWMi z4X}TfeIpd9BzehiTxwfYt;OOUm)$J6lrKxc zNqRaEf)}=XiA=^>n{vCW+D`uPbMpS#e|xiePCaJ;tw~j3UoDU}EbHT1dddc&5P?q; znB&lv2;TQA-s5~FcDkW7h**vJZa!@ZJkacWODXRy5{b-x>7hs2>!%ua^un%f-p&=X z>o{#pSNDC#Pq*w2+aehi#mQsBWC0igpxfw9H11hTfN%hS#kK%|Fd-1MEz1=IFv34E zQ-^G9D}b5UeEtn#RLlZHAxbJM)jj_U>Ad?3fBg-bA|M?9!f$_}G+9Y@0Fn{kzCd3> zaO_w_)+HpvO+m2(kZe$1g&{p^?TD4Ka3UZ2y$IJ3!BvKCEU7g|_AwJIpt_|3q@}v9U6Zec zTG{}@A`hyldpi&MaovF$*{KM;la3okOrJl_#28TYot>T-x}(Cv!YC*y_eO#6B61G# z(`IjwneBpcu+V3v6fX063E*Vcn=}ZzC7_TwVwLD=)tMJA6Txs)#`7PpNR_1-E=DCk z=jST7%z)zE)u_3WidK-sZJO&ascaMdOrU;6m9FPTZw+&$B}nhp+*o!e;_Xo9qg7cS z;VVs%bO?a57=>L>7Kqp^AkwjaK6MU!ii7d4TP_fpWn`GTaU4HUkBdYUXbRF217Raj zGyQN+S<7q+2v3{&=p(ME2jsB%02z>h3@I)^IW`3y4co)5@A){|U}+doC^KM4F#x10M)WX%!1?IgD>6_) z(%pK)nvRFU$E$DItG5(EAUa{Xqjz?-0O!(4Lrc0?iI3i!6ck*H$p=V0xD7==u6d&p zTGu8O6C2CQ13p-vv;f_5d*E2pw>DK>6LsHyTU|q=Y#WHuY$82EwW9v0z&Sx;%F@!WOm^JGdEL;M<- z)#r|el$4aLi`@5s(sC6ot$-h)oY`FTU6BmUo@)l!w^v`^QWHVC3iB6t2@Xz!MriPq zBe1-8q8>|qkUb9ql1sI#cjLoO?`v5Jfj1r_p9W>_0;S!EQA4xZleer)$mNkDUDjK< zK<$}H%X8Nt8;if#oFUrLcXrw&K57=Fb)7WV(3|f2aAT|=OOS_0CsRD&>{kd9{oRtP z>gu(T*!QcBVwgba0IW>uztbZm7gWlBq(?3~UeF`5>^gtbBUdkYm0ZRv0Ix!!e)A8n zk}`t>@G1~>tbg(<$+&1;Y0bqRy9!uavP;zRjtE;b*v!nHf zmG#w=vDPQ$k1AQXxqH0UzaJhhc61PIZ|kyD*j6ZUaCCNdBt>N0bzcJbqOIom2hPsr znwsVdKYV0wt6c#C&ilySyEF)k+`PP=E02Pus3~{vJ34lNsFBn7nFDuqk4Ath!$5DH zkL!~nZh=Lyn--tQncD7f+d0g)lAF4nppvPWHhCkmd=ek@c5>wbW%fYnVFH1a@3Hv_ ziQ4n^&!+MmoFti=MX2l#JT0!L%KPC+{YD*GAZU*3E>b4;_*o5{j}o@YB7MJOg;p!= z$(j1i^^T69g>rT`r8E4c9;hxdW^g7cDLFJ$n_R+>nuC3hpCK$^=xKmfOkiLjklu{< z7_Ef)oUcS&Ij=^3H{91Q&QYJ7T~79vvY_NqBt*yT6n6o~RQ>|^HGqA4-g%fa!FqsZzUKj25;`me08^;-1SL4*{_{E(gq)REE3BAA0INj@?z^VpHF`ZKkPM3=P5Uo zu}E2U5#S)3RJ;57^x}VUi-`e1d-n4+V+m(awbmkg5~sYES6#L^A2V}tPJwW?2Wb>3 zp7`VMw;#ONay{;)6FlW~L9VD`eaMp=+FJ2QAa@;o-n|&cF7jtD8WJ8_sTMg5e!tqsMZz(NC9(d1 zw>acqEvNw`nSyu<<)#rN1p1-*78=_?71T>o`US--MsDD9Eb4M zrNfGFUtAh*um+7MU?;zPH@L@@fhrB7 zbjg6{=cjV>eig>zu;vD3GGG-=Zf||ohy>b>9z`9RZ@{$r+MlBtB=mVW1wILoGcD-P zTs^cMqb6`~A>0>KpFlnsv+M#JZJv5Z?~L%>8{G%FtkkxI7&wpC6sh)IGeqdl?RCxl zKcu~7SesGPEnEtP0tE^b_hQAJw0P0t6pCwuy9Ad|ihC*U?!`U07k7fYy9OsGeV%jP z>-~Oz`4#SqBzLm+%&b|nX142M4UHlmiCpKn+W%*tI5yP<5aGKOmkUU_|T zJSuTW@REPrI|^nvZM4^tD-13?3>3+sgtji)Z)lXQd2Y1f^IKDt?JpOIIL*7bHMCp_ zAXIL&Ix@aiugdHf8;1!I?BYF`EwW|Vk# zib1iFpH|zp)D8hQ3y-_z8PNMUHKpddeo%Je13~^^e8c_Gu-sF=+tJ|ZeMJI%qy5Cv zY3DA|cQ)tyW~ODTj^R+n{&+jMd+N9u3=o=mz-620tE)D!cy%0lZ~UNkmmkupQcJ47=#( z9)Ur8N;N#8f*=VpsLV>!smL4WS~3flUnPU7kjP3=`<9#N1DQ=3^TawKi{K|J#Zd@i z{cmC{4@4x~<`%vb2FqhhT4$`@w}WRl;3x*%u*1q3Woz@R`x|AStnGs%TfhnBZOZfG zv2o3auEmf(TKhgsBQs3iz`*T)zT5}?aRUH(!R}=W9_SN7UTR$4*mbI(>_pO5%}_Wi zf?W1G4v@66=I&48yB+U&oc=4z2)q5f&uIiFN&xxTrD2_T4{kH@-hmc&e|3MoY*CAu zB}mpOCR69vc0anJI4ZRIR1Cfv?Qv}Fw`aBX7{_iN(Z@ka7bcneUK;CaU-$GhbyD`0 z0%i(bJ{Fm*JRd9HA76c#fqDNREL(U)ETiMlgYtYC-;6DkVp9sS9th7b5QbIjCds2P zwhP#t_Yf(Yul?)~@xaf1b(x%MU*2Oh_;NNq_4SYd0Mj;$AU_LLU}zWfjR*jDmK6Ev zlI3}Eu|30~>0XMh0hpdYxe06J`tCY+G7D~R5OIu6b>sdu){iaT#)2k`2aRcO50U8nLHcQd8E4TF=fN?9GI) zNxHKa_^xwM=e-I(FOi3;WwSg3(KPIbl102)GrbF^PyQIrbMRw%*hx@R0JEpNtqJM> z`_b!q#7gxR{v_)y1PGqSB`3^O?p6ox-&JpJ9MQP(2)ayW${PdA?dMggDpG03*^^wQ zt17*21UVod9*qXs0k-2=>Qe<~x9@bxVxL#p^$$Y)Mimvl2`~YDD%$SvbnROoCgtOG z!eo;W^z7vQLKh-9sC+rbhW-_O>JSUoK2adoY+v7pPi(OgoFW$v>QF+umB^b9hA(v% zb6*@$<~j%*Dd8w5ijHS`e)YrF-Cl_D9VeVVJoMToo(_c8^=JOSphSeL4^y2lqoIU58YTRyQuEIS)KKu)yj8lR}br`rxl#H zPy07BuvklG7Z}>de+Uy%NR~du~im_B7R z4?ge&Oju{RrJog{y(}_SA|6xG>@n6LM*%d~JXN`mi zFoZx776LZ^tn>d~`bQ%g|HDlGxo_hvM>Z6E1Qh8LQ{yyv_n&Kayh;!{BI0S$YJp3{@3>~S15PZbe+w7b)b=kIHynB0S+RiEoi%n zZuOM%x}ppZo$%Y*-d+!4NkctHmY&o`U{poVM&SR-M&c{oP7P*cR+Ez05a~#Tsdidi zUhdv%yJ%;`iV-0J0YbQOP+H@8gP>K)4yI&+eFvFaIKR$p41BIO z8}i@O(9rr{_sEQ(RziPk^Gyg{0CJpf@2;VS6?aA=&+gM`HO{w9(m(GGN-GXZgL`|W zPDw&WR+A7ci$-Ht1eIvp7M;nNJ7hS84Us)%MEq|=o>y2{szDhRI!~NlZfdq)X{xF^ zi6B~Dn|(u5Gc1|1KJLie+{oej0cVcP82gWAM5M9ngJ;`hO(R+cJj9@;KrS-|^#9Fg z5Y1EE-nR}Qwy%H-fFRcdw5HG%+#5!KQbULW+8s^D5xLDu56HVZAYkJfKAtl7*88vW zm$Q>m*2>Cip!kd4OCQ&ftJ$&PLy}EFkN=g8lmvMX*S!f34^JQ|VtKgosK0V*Qn`%k zG3x8X8xDIlt|V?Feuvlvg+2W;HXfg7)|IQO(DNB75kyeu&sTG+a^LT-_7jjp{rh>~ z)eCa)#MyrMI!FA6SO0KxXd1!-HD~^2>I-vt;E4k_dS2JFE;M}amw7;NVYFv4>?=mt zEX(U5*gKAgil;~vC3|G6{qjx(~V3!yzSQEJi7vi!253I8Tpmr z(a>t08yv;~^KHB7n0pk3!x-7cdFSQ9OoA#fu3A*~!8$)L)1VvY?tRF`8n-Mf!W_x>OWo1!O z(X?&qvPj9#U_|j`=Gda0GywK+;zuh=3 z#eOulU5DG;!?xLa)kKAbET1~hKRp;|RohOZ9X?;36436jgAWYDGdwOg+lO_33!QFO zfry@cp1Trv*phfp{fjS&hQ00Am#*@uOnj=HZC4JI-ToxbtkfHK&yE3Xo}If3T9g~? zp6(ANrV%CmuC}dUVFc(hpOwo3GHadRSCY3~bu_WN0Z(T?B+$K6(a+-iRksaZw0eX3$V_mGKZ zWYLd5R3^wT(~9ZB@e>ASN+Cre48$BHUeOx(RWiPjYRfr$t_+QfDUgxv>R8>!IschQ%kGS5DRqroQ?-s#)ELsIeXwiTG8r{=i80P+Vl;{@gc2vkVj;z zjDL)_tR5dj-S{G86tUlx6*DGG=d(w(WgsS$C)G!b%|ryxJFWU|kJeMi728XnY&{+{ zxdqxGTN#>D&5BQ1{iUbrcegtxj4E(IJN4KV+bac*<|iKn=!$16Q$pD zYX9kByUcLqb~%ns#^CvCFHX5V6SBP*H_{sm^?8~sdD_%CQZQ)okhB`jt(l}sx^V5f z{ZwUa7)~L~W;VTbLfiLr63y|3_ps(Yg&eNq|@Rn&)A>dYo2v(yg{F7cY*1vL!;@=SJHF9&v} z(^_so{64h;_Fqp5hxonQ-rIY@5^OWQAwDC8iy+a(n1^}Tb*4|-evPdMVhtYWcM*Ts z_K&7}-5fuaRGuy7*qhqP`HW0#5~<~+BHEvKF4LQ#cJuXCQ-zr}b7`$2_PzHl5p`sQ zX1i?-?{8Lzpl!)jJ9WLKg+4822fweUxGxQKGj94OukG1&0USIx>G5Q%BlA~aSl_Ep zWRp-Eo%-jRqmf0Z&2s$1ol-ix{X(19RJbx*j@vg1DD(%hDSK z{iohIz6ZmR5xB4Q4IFgbMq+)_me70?dHt}e)qWaT=VdT7&u@H}upj1dU!o~Gm;zg` z_60ZE%mydJQxiThvTc^t(x0;G{Z4_MqhS*Hw3zG#H9tEG0ffGEHsAMmv(ff~n`U`xyHk3~`k_3ikZm;m zch!0PHXcOTkOLPI3D;>`L0|ToPZiN?-QTR!O|Y9|&emJ|A~OTlK}HhY+UmKLW9vJx@F1@AoXO+* zY&j5>O=U}RHp}P;*ITl^c%bMXY2F^IDJS82f@6Daw|wRRc$uhf`l*o#^IwVvjaXkL z29}{JdRoi!U;p%DZ#SK9xx0g|$hmK)XW*|qK84#mdpXXY!k^8SSWbl>XT#PpFQv_F zd>M>)iy|m|N9SO>^otpW)waWvw!Zpp*53Q*s|Z)?I+y@V-&GuDd(?%kz*kqi#AIT& zE!%c^NpP7UC7y-N=B}`#G=QMs)5>V-@yWpfGsbCT3+JmqG;~@TG4U0_Ux{L`Y3R0E zl~3d4PI*j!$*dq|2^G1~267CJFJHQ%+_+ur6@BeI*18{LU6jUptj`%6%O%aN&@jgM! zIW|Y2vj`rf3i?xYVe$EHLTDLq2T_wUCHlLqk>_-nb8$$Qt{*d4rLr!q>i)G3X~`;! zfcO_W7RczsMl*IKD7xdvAM$2Hfw%elQL1jsnr_15&b<~8W4`qBlqeKiuipjq+EZ~k zmI_~?j6)@=Jp{#F)e4_2l|q?=X$SKvCqd!Wm|^dj`L056{5#jP=e)zz1x|-)2aET_ zjht6SJ_scKZBv?X4^4Sg*KcslJ;eIzhE#zpO;mgUDLnR3;d(4G!#gEy_~R03PANjt zR(gOk+9$`x7w<85w4%Jm1dsqx+9pUkx_rF;?f&oi#Pc%jff6 z&9@brY;u}7hY8Vf?5QjaSo0KKP8mmI)sdYIM>Z&a(~DkH4y@=i$fXW2$kThcA(@ywtwx@BY#SmZt-tWm*=Atkaif zljsr#r(n6www4lPZBuCyolAw0i8ptl&gc6I=Ycl+@h`8jbn-!txea;UhAR|BN9Y=` zfFiH1S|7K%r-^NUM?SRy#qa^!QjSz6*%8chK75?Phf^zom%Z0^-$o+ew3(7054S$5 z;U*V~t0^sky{8{KaWg*z|Jthx9dKdZiCysQ*K0EvHq}#@X-PI&`nA{^edTPgbocCB z_O)bCNYRm3-TQt1mI5gp7<6Wp(G_*ylfJrDv4^dC6KILn<=9UZ!AcdzOa<2Zgl7nd zU22KD3Q7u(J}dyT1n0UQO}|^xi&C9Z;H+#Y?jt) z=+6B9@SDX!s33a3H!#Y5wVm>vK6DAS0`qDy`qz1AmDfNr8s;Hb`p2xjR4L&|fN??2 zSGD5}<)^d3@4Y?t%hfSPxP;lL>%{1q-;uf^4Q%{VJ$k73IVg%Hi6EVIHp4MiYn}WK z1vE4ltMjYovg-!uZ^nK7(9~x>nmP@~@rceSX!Eh?bG_=NBJLctG+rMETU}-xRr?HF zNXP;&O(v>%2a;KfP0PE2^bUH;ZerbDS)z##p*~5L*=@jdmkJXxT0`j=RCc7{I6UtQ<8pm z`fLR)lccnwZ}>;w?L^=8|CSpqz$~k#tCu3xH1NqP0knA2RXfprnK&*yav|bf{5>>Q zARpZe!pi-y_!1;~qXbWv85I3U=WRx1zxGSod64JqJ1`~;e&hKCI=&}>_e(*DSjq6@QEp=>-~gm0%>XEkgt$rt}aO;on)d!cT1G+E}}md>YeMx@IGF z@0Y9k>Cvb#8~QQ$h2MdnRW44sCRdm7pAFZ0;ly2cE^iOjd?9`u6qjbCA7eudjtm1a zlu(5NmSH&l87m^I0ZW-szFD&6@bYsc&&7@DS>^1Jgq7IpDe0gWl;Q98;(c21krp!-tBp>rPK~u3o zfwJ%!8fn#;7ysQW0|V!C5oyc&2UN{g5CWd--%YM0CO}%V{&LQhD9#M7cI9@0Ct9c{ z;&+GXKJ-iCpzaJ(3#f1@v+sy?ipLjWVxcGCrte!+qJXH4T?304(E=>bg5hRF12N3& zE`CV&t%x}xE{eISuY*?$ldCUsBCGFRd88Ul7|29>UdWHeN@(ZH)WpG^F4uj}|9;lT z

EfW#~Pz;#9#!m5)I)wJ3UrrS=vX`oRu%hWV?XNyn-t2qxuP5@l#mSsVRc0~M{BT5PCC9);s0 z6%3}1zy9~LQz}<8RN-SiqkaReR()@(Y0vT9{tGrLc$wn6iKf@*+qojWMSy4vL&?|i zxk_|&T44feuRr7UWCZB!zR%FhVWGhM{j?%dO^j+moCW{+R~246N*ihQ_vqFm#$%%5JjQ`wqM6vfKyRokM^3bAw6n#7tV~tK?L^uw z!4E(1t@?dnzV52$b(Xm@*@5uX2T|Q&b)H`GmE_+FNe2mFRRy*67wl$ngoa6{Ut+#s zO(eEY#G?1mz2vfW;#9_FFX+eQI^BOZ*7f)#XaN5OC-jW0gr}R6eRKG)KLwW z^P9LN7ZZVj{W`)o>Lu89%Kbm-lH9mK;2J-2~wSAiuw>9d{|aMQ(4lL*jo1$X0REyUP6h zQ30kWYyF4{a0<;1GhB%6aNw>S?Md6eFXtk7>}c1=iBHt*K79EEqct%zV~8G@$CLGN zdp*mZ%De+BC~`wPYjgU$bRrKQ6me|!nqX+A;{n4Dkros_*#~Jh*}IaN7`Hc(D>)A` zx`WMdjX!DqPnCQ`JL=Jq1S9vkS3gD*v=Es@Q^($$$gI>$+KMj)e*;)J#LS&gC~p@ z>yil}5zm<*_RdB) z;@V`V6P3?Tqbet3@1~Mg!^8JEdeVyA%`rkO(Rx^A>|SumW7%B3zH#YcsR;GZys67q z8|xSsz*Bi2pQda=On3v&!cL*bpRXxAY3sara((W+x)-^NxT64E?B{88KLXJHUd5l>Py_Pe_$V?8tt9)HiPwAwUr@D^ z_g=IO`dxpANfj{?iMo=M+_u_gRkvUm5Fw1r_(w)My<-?)c>pZ$ib+xa_}O5rt+tvC zsYzF8UpMUn7VrUXlUXD9t!*IpZ-A&piH`e@TsMX< zW7PCyORQqzTapjrM^VI}5AT1x@Zq7VQV?(Xgz%-!Y)c2kOkX=F5XQHfIXkP-?tHP5 zc0nc5-fq-$EGTKk2XrOlg1GiFHLMca;SfBVY`(e4+Mv8@#FgPF`y>uBU|

D63+$TX)lMN8<2q$9aq_#j z&4yo|i8TsGMfDArT+4vez00pV_wB{XZ$j!0e1YgqYdTaGPK4)T&S67X(qv9`HRP5}Gh>Hhcw5tCIU{VPd7cU}j zGWfBu_1-|}ZPtWJZ)OEr35(H>An*ehHvrK80rzSC@cc%1X{UN#xHu)9W-y(-$?GRU z>Tztn*F;-w=f(Gg!|->&B-~s{97*B z!TO;qOIQZvYoD{omn>qNX$m6T`LNvIVgQ}vu&WgM{_w;I0(10f2#fivT`9>8Dv%(B zg@U|jA;q`Zk=~oXvs)d*C`5)8N1Jqo!}&ku*?~q@cXTbzAxVhPzx}Ao*g9K(Inm9I zx{?OyK?$-;S8A+~@GEP_Q>$et$c~hUuR*x3%*WbF|CF@cQlC<{9zUSZedDu7nI8JE zj5|EPA-%98wYu?nWkYG<;PXmq7MJEo>!U3GIm)dp&vB~0&fBcbfVug%)8P_lKw1%@ zM?(BZY&`Ud?APACYD&LQ+-6emzWjIr%6as8JvKo^xqd4~Ohu)fU0E+xv#M`sN!VFA zADcC|-#@>V)VhplX(`)6%ulbNP-W|(wU3aPfAjopp#jo2IWabRi?7dw!hxNWnTiU) zc#SJJ%#MQ|>rbrsI-aKf(_FmsbVJgfWarQP#bbYG<^Q`a+ACFZRD9M+FS#v=iwPCg z!}}01-&>c?z7z-4EI-=zS9R^uOZ*+R*U@WrTM+vkMfUv82xnqMs#PM)EM8}lA&Pz` ziGZJ2bwOdf=2j6CLV!8HWv}!R2%9g$Cpb4UI(d_0i%lcxw?L4C^d1p%PsLXMN{k6j zu3mL@czXn8d?hU-G$2BlK2NpxjlR9Ty%wR1Ov@QX;ca{knnhXjritz&M!maALz9{- z>TCW_M8|L5*<$S^y_Qk%JKduSGGZnbj{EwZmC~m)g?GaxN4h>qldCg5>Xy*o$zijO zyvsiJ=RW2SiizdxF?sUBK;;B&tRlsgZqvJ7NHg}C9B{8|43=*Wg{A8o`>M5?^v<{{bd5iooS?U(#Q2#L5072NC zYD42YI}oG&P0mpm9`WR&0^O#2Tg+IJs?Lbhf#R)%J?h>ahjDmSEK(99+PP8A3L>0K zI~UOS;pO-sVdU_9`SclY%loC1Fj_0Eq+pa zLY!*B8wSgU+g;mppbgTY^RKHR-A~ODCaFT<3UWaT??Bf2#%jI8+0&}VookD3+_Ewv zf+s&esl9bWEgCs1KacdL)3bG;CBlsP?t16`qb(s)i=GDDTSQBO`TM9Ihq*KWiS+)s z|8Lhu&X@eB)~DsVD{mF<%l2G(K)&d5I@H9e;xRSCK>p(Pyw>&7D@DSOd@5_>$skYo z`G^h1Bq+RR*la@b`%qEK7R{+N%G^zB(wt*zN10BYEXHbN=2n6^n%Nu-8b)f3k6e0> z|6`_^r_y?!>?gr3AI95k0A|eM`z=p)&kLH3p>93mBDCe{Lpw`LrWSTiv37vJKe8LB zXc0JPKOfxWiF@kN%jC8~cyy6Ut^;xRQpinxl6Imj>FAfU@XACGtwh$5XUxZ z`LJR70P;(cFJPuNdrJOemK*2v$n1DvXjdi5_)gEWt9{J$T z(e1Vp;ppod34i!5t;^2icFf_k34WWiDA(m?rTq9C>daj;&wImUusL9!x$0Jt0cQ>h z_t^~esKjll>+ehZkc3Zw9tU)NWs!wa1w9qZ441LxJ}1LE4u9rK+9!JVhHazU$jXX2 zdIWypdVjN9kZfe*_S?z)mvf=@^9l7lVemIjNE?K(VJ!N(PQR;7rdpWE%E);w7-tKb zF=h*hf+jJUoiB53A^=;^IokM77XhuHmEoyVF>^$eQSlWy z5bLwU#1=r+_}2LX>j`FT;^_D}hw15QWIS<9yh^2lIJCfxu-1FOa{*Vw<3qWRufio& zt0^2fR{LdNM3>k0s`2uRXC}SJh4@KF=rjy}fXy6)#y(Mi!w4nmFNHC(IF>@&&9*D8 zb^tQRT!lhgW;C6Veh?n6R0Z+MH%%GA_vrj{1n-evzPx?jLX5bxUlRv7FbSMcJ)mgR zaEifSMMOpQz2j_`23Ic!Hw^{10lrmDCAJ>c8-)vc z$Yi-U3z}+%0L_zL`2HzyzEClH^?@XsPBS$oHPRxTT6%Nj-ElQn1KPY#%IlZ4$Ry`L z+-2gPQW7%CZ$J&EJ$(wNPZXkm9Yv7r3j$cM%89aQfb!a9Zk}IZ0nDyzKn%bpP|ks?J5EsI6=8|C@!d4yC?=M{ zp7kEaf-MFKPofWB5O2YBBITOtsXM&K*q9WfvxNbsM0LBY5mN~4jC{$f;GbTe#Vj@qp>2(Rk2k#Ek-}W@97BKeMQ=hhOvpJllvv`d%%TQr2{;DV|nF@LL}li zWBQnK+E!#(IC`dFV_hPG|8l9X=I)8{(kqI?^6|yQFt57`(DbfC$aY4>(>{bS zhVOk5r(i;Pn`KX!)zI6xh#JPOiPsp89~xFas{*nun?z8I zQ39e)mvFy61ZJAaNRGflN<{CO!Kd_mau%y(#m}IK`z+wXADg=wTF2>{b`fuUmqCdN zB5L+G!;y7_SrcS;NgR|}fF*XCxg8**@z-`dWKD>l#Ax7Jzl)2@8KmRI(@I2SbpJcf zHf+WUl5zIgwcT@d-Re|W!Az=1kx0yp8^7XyR;qcxcj+okC!?uhVf>Lcy;IKlHv5Cz_vBMZ8;s%n`zQx!EaVeK3Fai zzvvapWiOQ>kfH?+S@{vJ4Y6S-rn7l~*>asCODOlfuWd|ntNZ(^H3^qF#}?`B)WWj4 ziHR`9htvK2`ZuAgv6^)ZYj!(pQC;QfQpe4}L2OBNN~L{)-;*w9E3su@dM|&vof{Wv zx4H)j6X|t~STC!ofUxesvS3V|s9m>oHe#Xl#Y;tttmL)Anpt|Z#Uo}ZJA;eY4>UvB5T??kr1r9!O%ft+I= zK{t(c<>%n_Eh=E9&8W>%`jmxt#fFyj*j?9z{cl}GT6MG&2L*q5?Au8gibKOElOvd! zz2g|NwE3WoXp-8stx^NMZC@DorJ{HsO&z5#0BwaY<9YfFV@JG8S?d6q*DSV)x z$H-50njZ&=Ye4}2lysF4kD{oEXtUAWLSI;~CVLf}hoqxza3}M?c?rl|wJ$di_*Gt` zP%aQV;mn`APg>mn$V!&HM9-_Yl`sIV4oz6>VevUv+lX8Tp5cOCGQTjV}oaS z+C`j@U6@cVv0bt^0O7jk?`c#wuJv+=h^lC5o?mY1uzMa%po)q-dvh*sm9C>lMn?X3 zyDBI|^#6Q8q0z`6_nE+=Tt}dXYB59gsV>t&`CIFE@BWOULf^B5=K)Pu-dwokXwt;y zs4>YC5k~*02@D)N?IhH6t@nK9FcPal}+z~|A>qEIMv=stBrnzq|ytVLz541RL28?cMBPZmAg64e~RTtV6ZIKIn zW4OPg_C#os|NY>@R8Z{jV&3!7mMfQK{4&&{5tWEXwQgM;?;Pc=TJr=yQOLf#ptrs{ z?U<*RSDE+*Y)4(>^l(2Txj5lXAbvAdB1K5KNE*KbuQBn5dO*p-$MQR^zF)H9&^9zh zhUmp;IycgO{-fv;?nrxqn0e!bB?s!(g^)=bJ?`5_9Sfp1&kiYU{}&^uEbli4X3;G0 zUXK^qvTtxK7$xF#VXc27cm0Hgscu_4a!)1FBs;(~{$AwG&dyE}uy^;?M;^iZ2dW8P zrto`!I+u7om#Rby?m&jU?M)Xrg|H0vB$QdVk7YOSEy;&R?0@S-)AOf~kk#fXB-3k< z(3jj4S`N>SPHgBKzs=(Ke)4V0Q>4>Bu!*OtlqA4`z$!g(CBdc<`(c8M0hm zB(@2%=49Xxw8%)sGl*FG(`!U~$Sr^qqIPJ@4(XRbz&g@XBN+J&8v9clgIB0k1)J+4_W5VF!N>||xI z_GCnOCK>@S#(B=k9>c$yW4O|f(lE5<=2HA8RS~RKP>K>|2KrEFoSE^M&irvdb8w0z zFy6;AzQY6UV}NE;xSd!*J)GsnUhX4MzwM5s`asR60mJKUiZVy>!_hC>iL%NOF5wk? zYG*{nHggwPuDT%xBho@mNh}~XF=L|Nm7Lcc<$3rgC9lo#Lm8>wyU7C##%Lg0s7sN_ zX=!>5K&778Im6(cc8TFUQWhWG13b_+252Qk0JVB8d#=7LTip^8}29)m+`M=NMzQ6>%e8W z_lwyi7dj(fUwD4yZ6ebBw)Lw>S;bW|enVE$RxMsTspLkbgEqZ!xa|o_$h7o%dR7jP z;sJkz{pwBDxr)tZXRvx|E}!nD&KrW7TiU+aXW9iRpC7KDg+K0Hd%w#|)1?+8qVWT6 z)GgK3IHFW)WrRsoR}O@yS-g$0cNR0+7n#=^g)hzhLu z7(Zy+Uw2foy^DnG5X-yB$4{HnJXQKl76zhpQ&SsdSoj=xB$=a8)17Q_~ahW;KH&}5wi99OG3_CxG&I6L1 z{4de9DkB`|G0`>O@8V6URkb&k(kz(Z+tW!4$)%;F=(GbFR6XvkwiLMna|!XaAEaci>HgJ<_Lc(or-8CgDVE1sZ%_{l zQrRA6KhFXVo#?#wbX)2tlMl&0ceN;($CCxb*x-Qf*l>h(QYyU7;tGC$6%}F;8+cDh z>q<9Wfg=1s+?3KrqoCCC`(ALj-&p|b-`45sB3CZIi(Tw)*eOVM8s)56V$R1SUd~S= z6jUuV4!e2)sjc#5G`N4ebNRDV8dum{u`}R5%DrU_>rCc^Z?*V!BDw1u{Q%qJbVWP7<2IyRcR$`o zD=n1s?A{AwJoec>?ru__(wrMwwJ*@(B2?aXJyHCYoXF=gbR;O{10eCjKr0RLilNq=w>=ekU1E4oRc}~~26$PJ z1g)+r#o6QmnVS_rV}1w=FKbYX?P|8-I-Us!#ZR@szI=|)t1tUw%$sck6L7oZ+dm_i z_|5Mo(9q9Xx)L&FYybhmU{ix)KX%^BEWhQT1Pdk#`tONNpjpsN2q2%YALx4ZCYfS5 z@gd`kC&t1PyCt%-P&|9kYLG|pSe~yCks(pp@mX4AKS5V@Vpem8>#t=Jq{~AFIu};w z)aKxDgPh%D_v{6_oX5Q$uD~{s^q%`WqtFxo6S43Gxkm5wN5neEA=&}==vCHDd&!Mh ze($HVUpM0&l4Z_Ap_u>i7Eauwj;4bZ{?&$Qt=c~Q{&1IYLP(%-i6xKgL+9gye;`&t z3mCIEt=P3wq1jpM2G(~ugcjmw1%n3LqGy=A&H8L1-P$x4smJ=|=L)OX5yn>l>IR0K zo`5Hlt-mOh3mv{PN`Prhf1k{M3yi`RHa1t^X^b!RtM3-Cmr9cD?%ZYFs1-G47fLNM zA#52lUgIV4Z5*zlP3|!QK0;OZVqtw7z49z8QaPmNLT7O;&h{&}*;+amlx_bvb=L|7P$g$lusuKG*M z$WZ>Cvlm6XuRA7D+n;N=gDjdj3TbZkBl>WU1Y>8wAG0U-vNt-618JJOkGz_FD%?87 zelP?u;jVpFdiQut(1;eFON9SALt#25K$K@D`-R}8d$&HDCm(22R#eXMysPUGQYI}8 z97rph78iIhAYKBjOjAH30o3y% z!=Ru(mxs|8z||( zSFuZr00M!KbFxzuQeSXu0XCut9nH-v^iFZ-Sm7;Ph3D1SxM|jfE_b3LF}KdmE|l_p zLlU|SLI+fE%SOZ^x}>1Zg?sh3o}4CtB?fcAXgbH}gQ0BqNg|B~)2%ibhham39>Vpj z2EDzpu(RCcZ8RkAgL=4p_~EzV^_X>H4EuiLb)4`fV1cgCpL9`XGM?|Xl&nQOD8Pg_ zsiixLb(lMlZ7STUZ*wwp-dY@HlPp}ha@RoB&$kkK7LseYjY(EVRt)DwEXw6tdV0!0 zem*{fNDhH7_Iz+ZTlB}efer%~d9!L+T7yiQ=0)P7!ldrie$3~=l;buKnFJ5qlsEh= zl5C?}f;~U`KGq?LmZX)o3y|mcgHqu!2#=AulN7~*V#%I66*Wx3j%0SGr>F z6Z%x-f{MWO^Sj0(Lfj6T(2+iN#|ME~m61?}w|VLi*K*+_O5Y9n#x)~6zT z@G2_zkrwBnpfuO6s8|aW%B(7~Pq+9ue|V}sumNL3=LwC#-dkqReJ_yK#V>-IZ%HgR z)^$q;54N|r5kfUYEuS~JnNk0G3V3jp&NQN9ZgssIV%c*@XCvwt?qR@T_6vpRlJYGN zCec)4^c;cB714`gfMkgSSM5n6wZ_P|8s8}3`&CbW2mhZhjsx6gLY3YjN{!Z^l7vYbrgf!I4fK90^3!|^()YgF zwMIG{{f!fZI38C|X<$_5F>`_stelI?q$qF^x=w$^kJFSEsy`(DQVv0eXcfJw;^-*f zHa5`f@iTeB+`y7d*5Tf)F8SEU<4>EC?%y0gZZB$(v9Ij|v$6EBG;=kxvB`0BuPts! zq*n{3Gs$SDXze~e*=dfGNQ>%Dd4+kru=DpYdf9!~MUQXm`tct4;$Wb|8d^&7q0zza zO%58_78dfNp8pHK&Pcr+v{-jO+gz6*Kb|`(j^LO)fwR;OmVbgo9)PIfSG5Pu#Em2s z2i5`y`=1@Z=B>(;0S||%O!-4-`)q$#Fux?dtW)TQ#=reE!B2*z_LCl^>G$`yIbwgN zuzs2pnKCa#$9mtWx8Pk`1${WXy z1axRU$&DX+Ak;?9?;7U$jhs9&bb5l3wDM9H7w|EPPGny(QV||SZj#s-3y}F*cT?b+8U8>G`$|L#OqYFwsKH!zjCa{M{Su=&__E+WU8eHdjU{`v>&=r5 zf^hWkFtr1J2U=NKIRB}!&&tkM)Hk62W&PLty8{26*_zK(>WbhIGXJZ*lL1y?RuZ&p zyyt?{$!$0C8DylCnP)dm+K>~v9NOLv=6K={Tn^bjz}VJ_;AoFCP6VqdNY);O%M5Hx zA!c|=_j#wLjk?K$(CyI}jdHNEkB)LgD2|BOT61hUJW=MSV=1msq_lF#TeJ7}m(D)` z)Wpi#GZ(&mbWeU;B8C`4b&r-yy7ZS8HRK%1q)YE-McEt|5%^a{rA?*?9p=$4U;|wc ztOQ$sK1=0bV^bU(j#3=Cic%7>v>IAJ^Px1)3>}`sk7?&j`S9XnU zm4%XIgV_tn@T=tdPOK`22DB;-h8_5Tneh4V4+Z5bE{r=1^*w_J%$3viQ82tv-sEA} zSf1h7n!$TZWv+u^3+2uQGgeYAO^)Zs5lgkZt6gfbOiXd_TZ9jITE{|`!I)@30TlqL zSC?>cD@?zGy&ugqew9_wpE|xq93M}GXH;y!0|`xTs$T&Ys1RR$d{TA4I1wyvj?MQ~ zhc-6e#C8MFk%S)C-)K&ve^$*wMyJxDB;T?kC1mZiGckUqFG5t&p=vJy$I+@Vd9}p+po{!y-be1M^lUjZ?d6`(M-y# zC)HT^nbuU23Uz{ibglN3kzp2Y;%>Jndq_t49M8vhkNp7!b+7$>-3tjr9fOq2%+!<& zisU4lgM%DG%%@y@CHEj(Q1}Aum-V+LFRhweo>V5Yg?t~x;Iv9)($`_vLDKIl|Oz*CQiP2KSRdB@b>g|NFmkpg*5v_{JrR?hbvArm>5{TR(joab#?W3&i!Wm zi@LQglJeFi=XJp9)A35x;^wXNV_Ww^e&%BGB>O2XAZrI^@r&G70EfK*n`o+;IK=Wr zPlSqXOHxR<2LmjT8XKYtze_XkUps>kI(T?^;3^AU;!mk5+S;-j3@is+rGCdz4x*=0 zTq7Ul;G>@*o=k}hdr;iwA-v_$(_94uj)q>ar9KLUMd~a|wYuLPvXRSb{p#t+4%zEu z@C0Gm#k~1Hon3WQl-;+M8d6ZYlx8GHT5@QmacBhTp}U6`P{IL`Zt3nE8YyXp8bG95 zrIC<x!a?hph9%0% zL*LtAJU{7mi?rCeO`}Z)s74p%@v?zjmS@C<1O6mWuePQZ=-6SFJ{Ib#`s&7-ijZP8 zzcKfK+)mVTcgN#et{1Lma>?Q=`6lAB_P20PdU95_WgSZk^0C+$Q#k9>y1(PSo*@!G z+ez7}TC;t^f~J-HRpqXB_KrtKOopMpkG?)YqvCgxljn+xw$l*^WOVdhUc#TluC`)* z4JG)iGL946%g>(GFg%8(R;N1RD~V?TA;A|G14&)*dh540)w`p1seh<-DKu|rug;=; zlrTRAMS-f=$~W|u>fj)=_`yi8NhyPLY{K87FUssIbC3JjbImUH8J_(8)Ss1|$&i`F zNc+_OXurbQPX8e1xNyWo-`&vTkgA)YFH`1w&$}o3ZePCqskOXOdUJrGkX5n-{0_jo+qC8dX$H4-ZZq>QvR%j|(WK83V&7CH_AB6Z4#KQc#ULgIY>lF$fkl zW6w$_7V?{eX7Y$EG4B3EhNdZw1?CwgMnsZT+OHiMMqyLH6Hd$9*U_p-BZ$m?e}fc* zQKOgI_k458n9KU2&gAH`gGnph06TQ;B`*XiSJIG zUFT{mnMN?&khakbWM{i$U=;FnctAFvCVNj-v{oHU!LfktI^Zjk{9hgPNKsf}<~ z#26KI?UlH&CO9$*zMpo+&dz|yk}uany$yIpQNwf(%3>4|8Z=5oUf*`Ck_j;e#CdkjZ)Z9$RerIx~IW+n)M z9_D}sy!)p6JmOOOt+389zONmP@2)|9iiKSiV-wqB=@$|BRL@qFkuFj5mI>tfl638q z_HJYQGo2;(7d`HMGX}TsRsj&%ek>Kn<=!d<0h#I3JE%C?ue?T79_Yo|a{eKuz4$@QSl=;rE`j6rHsn<`x$ zeO7}Lc5Z0&#}O*(x>(}0jzDF1nef!titwoD_Vo?#k@?}ViOWx`Y@086XKp(l+^N`Zy|+?-KHvwQ>(i4zQ<7d-aAqOrlymjeW*Py?;N6b{FMX?{LmG*HKz}=X zE%u%kdz!y`5kG`uM4Zuw5B0)y8W3vm3@_Mp^lWG>*U#so;BGQ^5xj=bYo$%DStq1n zXye3XzKMdBra|ibD+><$SBRkg6xwEc_nNx|P|e4Qe6Q^XRr@-b&(7l>cz+=`HTov~ zguG|~e%M9b$-@SldHxe009*!(yWQnpGOc=k9U0j5@l+%JPgTqwkS+Me-`cXR!nL%l zv;D?CmfEC!+T&4yKRI57q9!OsTbz~Xjp4VAT>-yEUC}5cvz9F-67|)KGaaj|m{NOV z+Or^0@QA~9InMtVZ6HcaLPnUMgPTQKh7BZ=3;DKIhv$)JQo&nMS?TKJ@NmS#lp<*J{Qx`;bTmVc^w0gB}c+8rdj*_xp|4vE5Rrcu@_R)vnzV9b!uky zqIyqnQ_?^ZI*Yp0&x)CBw}%R?l}dJShe{UlRvKE@5oZ}gxvr5;T`$3}9P70wGwoA+ zY*VdJ8*TzeBhf6Dvz?C`NH{Z0&>zqxEjf*dEtupp8J1kVO75C+M>~h3Jw|$Z<9Of3 zN~Nsfvi-xmUKqML!bFD?Vi!|HRQ;-VYxJ4P>&NYdvPUI7DkxsPZoXbziyI4%wgA~< z#Lu`L6eHOSe5Q|MBE#Bg+6R}r26qAGEGNpW0-@LG;C-g$hP!>(>=8zQ`num{reU76 zdL^EMTrGm5s;WvzNQlSHc0*z1JcEgz&Ut??81k2LOd}fdx5JTFd& zoQ)%%F*SiE*VGRz@}2MeuFjFay~-uXeeSHHCo2d~k2=QwQ^_UG9C}2CFk0I=3Swaa z84HgvihQh5eTzQaG-E>8`Hu>*i^lcuB`IS>K^r$-Nt+yT&RQQ$(4Q)=x!Uuhs)JV^Z=c%{n&_$RI4{ zzIzy%qnTew{YkDCa7Gh&n%*HVn%n<)%AdSh`z@=%CS6-~86oAHpm1h|@B`vDX^fl0 zA)7wBzL=A8p4XrK*0hZs*=AV26_Z5Ll{A%@+Rp`k~C|Qb&mGv(OVZtBKYtrdpp> zC*R%6W;wu)n9Se7bu&`4mGi151UwdQFxA=rkyW`)yEqu4gF?>XQSV^dYI*bR7>5F| zN#SuVzL#^NjY)cQJgT`-y3Bi}VWH|_T}?xesh`K3?JZ}aj00q4kB9T0Hi`2~iR0 zhT7WJj(Q@#3mnoZD~d!+KHVFR$vn=e75brQ$21NYOszVRNXXeRq0x1G{pnNaw!ad% zZEqvs+jMY4(-4!>Ex4(bROa3ZW-)_|rB40rEPb@BHS)zh;>&GC@Y2HE4DrrRN3hG+ zFg!H%Y4I)?9MRC)8Ubd6S=RfyQJRdm?KDr9OO!Rsm(IEusTxN|eWilDxcV?gy>?f# zs$le8+34?sGklThrQ9u{7m@1x(K_nu$x~O@&96AM*CeO>PVJ5knHcfz6?z`7`TSD? z6+T zQDtTB=LLh3s^^edF@jyWCa?v75-_{hX0QMT$TuyERqlbmUk5_2?wlB29E*TX7zusKC?B+6(66 z;x274=UCObcs+oO=2|PPG7aic8FlzcWuw*4ZCa;0K>dt%0Aiw0UHZwi9$MgNbqfCx zMU(5qE!6qwS^Cq=j0BZ@tPgl#k|dC2sy2f4QDzJWcY1Y4esNb_Q)h^qpNGRvI34_x z??b*IRBH%kn<#0+w2Cz42|L+k1`8${$!gD#n-xx`hi?#Z{&uPi0Kb zqRUK4%u>UqNblch!1KUJevWhly&sy}^;Qd+{3n%wl&#%Q#A=S`Y*YqV*#Iq8A?;tHn)(7o36Kn z$v{iOt-vzlaz36K|D~yAx|l%OcMn?PscgT2?4jPQ!cAd|GDwB!rHW}g->dyUTW z4LwxaU7zVD3Qn4vLum|f@uCd8jBTD536>Ev^MUJa>*-yLk5`#?qHn5C1jpV?xw3#0 z3gwzj-x}qZnPg?8W2Mt{XLeLI+}JmiR}!rzQuEMqKqSoMxu_vAc$7Jz`mFiH{pxv1 z9G~4eRG%MhwGnA3dFut~sJ-+x1Ham2PMqZDeYZ#An{5$#M@HAWy8n{z&U!C>ak1`X zc%?UC*B7cge~` H%I^iOEwr-6~k3UkOE4-BakZB);k2`iuy4s0$sWIb|oRYtz+v ztur&Vv@-XBCPGIimT7sAgnx&-YqP1gmSE@iw*|$?9yhg@THaQ%e^lU#I{exlESyFl zsLT`4mylASDo`%p#49R!f5+d~?Y(qk8IL5fc&m{B0~6oVN7ZV)4p)q-JPB+EYS$yKE~}GNTfH*7fzp8 zgW3jv(U@A@#CyYgmwC-S&OICaoLxNnJ@QmrQgTqrG;VE?k$8rga@~;~25IwJb4r14 zU=A=hzs7=+?!2Ocj-9glMo2yvRhjS_P8MTe4KF6lnbVhccCh>XK&XxE_MG-gP3Y{5 zSWQjMZIlkMcYptGbZMp^x_b;AS=+M<&~i2PRP+C>qqLa#SuB%F3B&Z5@A6+%$1+oK zdKwP0CgxzJ3ML@zKFTk`5n~Fpp5*7_3t8~rwjt`z4)SpcbSMwOP2!Mlf{)vXT%1nF zkf*ZvtR8X(nwZ31@Or8AO%y>Tve4pOUv_%Ghp0GlaN1a;k-3wK9@cB zorr7e!-n{vV!!{^d<1&LNOuYoW#F9r9J1q4$9cYr6Fh=$6=;BTEtvq$^7}bLd zKTE``yk0Tj0X;)6eJoQ{ChlQ}{(#&E^i|3(RnVF9Q<8VU&_+r%I*2=c~gb#`i+RKGU?S!aJc z*o)`)l$8FTnpYx2?-EZb0MNr&VQ+`^hXYpN__3X_sMXrprCt%zYzP)hHV$;r zpMTdqy)t*^;lj_~yGMeF0hsEC@HtVpU%!qmGp02NG3!r;@5ko40`7^7B`}5~^mROj z6491YBu-{>X=Td!_?Pnr<+~Q!p(MB<&WIZoZ-0#-XNuqvL_igHR*&Zywp921#?;2Wym+YD|*CKl*xIhD$soks42Q@b)ii%O?uNVV@JbSdxU@xb1Tu{~%=kF?}j% zg2!@1Ix|V;H>RaANfQ4t{MYQllF{q$U$`rhWW*$@R`zlx$1?_Zpy=gUF*pzfpcR(b zYx#74EV8Clb^hyGS*Sx8L$=<1S_eY!*$CO#SvR(a)K)c=lyx>B3M#59+S{2bIoPg@ z1#u4U2bv1#LCP-}H$d5Fo5>RdB0f$FyZi9hZ`b`j7pI>OV9jfn%@<@O598xDKfK*J zA42p@_D#%wx42RIN!_1XcT$GQAmw28vi65@q3$mPq=kgYL_ z9ML~e!wE0%tneM*GnQ;WMuCnGyI#NKPN1%GWhBA7U==fT74(O(3jI$zT6%Wwnl!bapU13ivJ|BQsm zGCv}~#r}UmSxm9e|2+0@A@g%th5!Dr?7xMNXuq)hXX==#{7XncGWEZ2__q)jVE2#t j{$q~+3tB%py~jcY5!-MmF}VGsWTv8|saP#<{_ej3+yi8M diff --git a/arch-images/docker-kata.png b/arch-images/docker-kata.png new file mode 100644 index 0000000000000000000000000000000000000000..1ee74cbecf76f5ffd44d98ef8126e3caec35343c GIT binary patch literal 47296 zcmce;c|6qZ`!}qJ7E4jqP$VHFTXrhhWtY8>HKy#w7Nv!deG6mXDcjhFDEl^cW*9{n z%ZxBg2+ujXuIqdK?)&%pz3%&YJ+J4l599b8=W-n9alDWBagMh-+A1`sSx=LZkr$+bdH+e z&G!UD_VbhEEDt9rOsJSmY@eT_WR^I=bL>Q@&uGDV>^FL0)`RFvTzmX0C&}qYUN#CP z2`KSA?^KQ@O3FUHUhJ2W{wSdczb45$p>Jj^H&8gUGg_!Wdf|WuOn{8+nSSuuqaPl^ zj**@>kVn5UI~+Zz#f~17tVa)Wt&>O3|54^h?epNP6i1@}y`H~hC`lrp6&XldK}Pn! zjP+k-$Vn0pVW*DfNcQ)9{#%*9mhqDG2H5TYN#;m`+2Qul^Lg-J^Z9G6|8_erABlce z{GViwL?~1KUvDe+3b%|*gRz*Ko7=)bMi2ozsJFlEyScE`kRGr-`IUC9KTW34k&Gu) zyTCH^M!+tiu~D{vMW3!bQe@kj@uy+2Q5(`Lldf&zHNuaW@aq}7y#E6iEhi_Zt>sYx zgM#-lF+)|3!-e|!fjjewj~OOr1ENDei5)-A>~M=mQ~mTEcP3#=bLfoxv)Q`=;Ukwn zeQ9_ydDDqiQ7x09=(eV5&6Ax;`;2Fn8R|Zs?|2=@qt;u`2;c2bk@3c}*nh~ZTUuID z#)U@r^mcbUjg^>mag4Nvo++=L4J)Wt9zN4ReXYfro?Un3LE4l8yA2UP{oxn0!^x~K zJ)NCCEnikAD@8>`1&qr|Oom!^HWzJRjt<8{>|j>EE)VD5zptfLZQ{8+!iUh7q4uCA z58%g}IJ__=ZlfW>E!=JmBel=wz($$e{~1h9C1$a8cX&W%tx*s0EK{QFV|YZY+n$K} zR>;{KNS)samzLj_iW<3P*Ma>K%uO{1o_eh&I8xeseYS1mP6|3#gQm8hC3WOhBvD}LsV7HBN#YUyl zOKt1;=?0$e=sT3*POvlRNV>@YoZ*K&tBoR;GBY?nXW!6NQDb3oF~ft!rIMMZ^lQLe zdxY!sZ00xYN?h&4`r!IdR0!S;ow9>nnW?qxog5uIiA0w#yM-*R%Dyz z2C~Z)rmU?U$ymFMat`2aJfCUZ7Us&FEHslHnUF5$SL6M|L|wgG|GwOXFN!N3E~u)) ztIJkvEXCE0=t9%#WiT!xTpamsWAr@17_z5na>0 zd#@L+`GS%rM`m5D3e}V_*gAHOOHW_lMr^2QiSf?9OwfUUZkOM6R35~_(V-_naQdbb zZfJN|_nztva-4ST)Rg&5n6z-?RsA_bY2Z zciuB)50s$+%6{KlLnY3CecSA;!qu_j>|jsY21I{(Iv^JJeOWB-u{%Zlf{WEl5X;tg_#P~c>5i(HR7t(+|PnpQ`G(sU74&aKbb zP4m)lKJk&K^a7$VSHE58uGY*IqlG$8AsITH3{{%nc2nK$5J#@;VPuUB(*%mjS1V(3 z%hGQTD$v+z>Px4Dj=O?7zoze9qt##_q4nMXRky|#m7g?`=;R3(Kcf*%?IDYw+_f%| zLV7!@E#iJyS;T%1$(yQEx@C$HKUP!LaCT#NjTvVg&C#mQ{@_WnZnvO!vhuXfOq>r0bxQFX*lPTiDS|v(9xTDYH|5@)XWkU6bK1easli?v zxcu(`FFeVc;CI40L^sS$()uwWqPfZ z(q~Ti={)yQdU-z`wY??L7AIzN?>DjEZqZa(Tbum)#jGrjWW4A7THEYKsYhwJ-Q-}G zWNn(q+@X2?NkwaB2mLFH$8%5F-JF_q*_wG5?ftvBG0*p0`Cwe#I_vp0DeP3`Z*^N@ zu+jQ9O^<(4N}Yh2_rbD2m4bvF?Bk1@YU`fGskcw(>$;|HXyR>+DSFX$uC#)XGSnWI zE_>Vw{y=ivROOWKqipM(+?sdyk=H-!WvUu4=Q${3mpKP)hpD|w8_6{J9B$B3LR(^7jj)otH1x*q9FOUC@5-=>S5|PmI-Qe7u&&xKG8m8n|V1 zF~5tPI7UFud*;j7X!CZHg17L9_amdC7j4JL({w0J^Q*>B6jgsreHHB;Zp&H9@=>Am z@rENpYdjIvqm&jb)GK!;m1DB+(&+Z~*sV&o0hv1>tL7Y!7QQB~>=i)mn%d;&lxO55 zXx?*P{Hoi}bvA4#ReG2$Z1nc8cDM-~u`&&R+I43S@8eXTG76%(yO1Imi-V}-##zj8 z=Hs4(rZ!u?-UHN0v1E%%_9iMpF^ljz4Oeg4?!3F60~`J|ucPmH_C46cw=P|jUDC0` z6;VfQUv^V#Fx_?xq3DL^Y<0`LtqFYDne?D!Rt$+3YW7`kw;T8+<@cW{;!rv1`Jlk-b;={=*M7583Io#it|!aPL!HgZk6u z(BqeJAGK$EsH-3Z4P6?KAI|y#ryYjM8RMksx@=%+qLq<|g62tEd&E{(@|!mNh{qyq zDoSd+)AjhCmv2g^r_0F8mEM}ok?~O`1wB)X0yNez<7y|WeT<@kkF!wLYn~HCo9!OY zj&{h$oKg3M-u2v@{qU!EEhOn@BHs9X>>n?vtL!Xr+{70_zTF+U^JY`j+ehVE;bdNgarx82^k1!jk9k-?Zc_k1FS=;b%k$i7{2&HmGs z>AEMT_r%_n&vghTmabGmDJ<+J(#&=2@t9-8LZ+P?F13JIjq;WT>@^L=igf%7YuZY`DjOh{qV%VVDZa$TK} z;Bkm9nrC}tJ|cOptGhF^8{fm(^TRj8<9gB63Ef|=<#pPzzi6sf8mlzUh1P#Gw(Y#s zUA|&%iJ2xgep92V8XK*CUAn^lk*$GsA}M(SF`}D&evAE$9}&M5nZWnN7^Hf)A49f% zq!dhaY$a`mmT!KsM13$zv^a9P6n*=V%~!!x{AFbqtG5ep-KoXSwO&X4EZq@N=d97Ewg;sRg=~cW_9WyqTbzWZ#xh;6= zck$Bm;K(Nj7Q#>7wHRPT+ol=9RV1`d^$~vwX-$7FYBlJY{>UE_oURbmG;X(4*?0iZ zQa0`PH^Yi55o*6FQF}URzjHnP)wQ{;BBN7NR|0Zh)CeQ0A6?-UN19$w_q6dKYYW^j zDC0U$wSs>eea>F9&owZt?TJmCq5>0o?}v84&JV2 z$ColSHN;6w-QL!aK!h47|FQ#^g&`x#M8=#v%2n!O@rIt z4XCTcOSUbI%j=?gEkvjZ&1b+6+)*MJJ?k$ot8B{Vnhk=g&)qZlbUCSS!1TEM zLdCO_HILJ3qVr$ey}wwC(C@T=P%1F!N9?tfG^lnO?ZkD4t13^+gv?4JB|b>H`PZyT zt^E?u{J8G3{odnKP&Zmg)&I-T^#e?zh7b7#v?BTeu5(dx>ejT6kgl!a89$SJ8h>v{ zN=4tjzBChGrete2hpt-jl4x9tr><{kJurV+WY#uganZ{A>B4iPip4^X7Be~*PkhCY zf6-B-7W?p3am93|-o=9-I@50#IcC3lWwwTo`1A!LqjPbhioGGM+BHfwQ!;H!LfK2B z2U^IzU%!pa>wv&K&6_06WNdJL?`5^g1;xd(S66yIz19tLfn_(fe?`En3nFsat7(zE zabx@$RXsG9&QqE?!CuWwy(I>QdkU)5UlR?-x1~rYy1aY2X6}_AwI+B``)mnhg5`|h zf}i~dv>co4!srxom_5(xK&x*W>!8M%H&pP+&FSj;XvHT*w^+px9 zAnTkE%}y32OezZ#X=P=)gJZo#C}B2VcHbPNii9#=QvFAp%YDLy`d2j)Luz_p0ZZ9l zz1vnYbNgLF#N`YCR-DtTGj8^&L}k*sVjrwiS6N(k;Es{SI4d_i1$CZs7i4MWJEbU3BgC*zfuTk8!qjHU}As>LO{b zhMkA(YEC0l7t*#n_B}oqvN^bn^`9Ver>MUaI>RmC4|bo)SYmdP3l=op8OXu&Rq+c^ zP|0AGH=FDAy(L*Osh^n%UEUq`qeX^IGu_*c4hEUdglXE)v)||Einor;YTfV}d{-}GBpKf-2dGplv=NCl0$q3GY*eJlbbouroYwl~j z)}@sm$heT=sU2Q>$O;QKH7S zXu0^)gC&MJs{@E*KZ2O#DWzp(WZW!ruWp3uJ`dK``(ea;?}q2HLE6txLlDoJA~LR#qAjC!ACXo=psT=t2IbCAU~pW3!Kt5#xpobGI`N z7iQ4kY}T4lr_d>;=l9CKyrwgwC^7zA!?N?u;?c0@EmWLD!QAL&2j>`3LB>5}Tbt|I zf}PVS-C|r-+DJ2IKD+%!yN8ypyEB#0+aJ%)o@6ij&5)fL+lJ7%%s<2^C9xDgdRS6Y z(z@K7ClgR<{QX{c-r9%#Z!hScNH*@DL`C-Bw5UxX>z>^6sQ$Pq)_%|v?C6ZjlL_K^ zg?i)Hp&cy-svZid=)vgr!d$P9A{2KyOwVB7Yi(AW1bDdwFQoJq;gHst@UY*%{ZCk# zrX(jXdW-;lot z%KQ8%C@yQ-oedW*Gp$Cg>)~GKK2$dxAQUM)Se=-eDc^e$VXy`1ZqQnb={PK1KK%J2 zwD_LM{?~d`5WDii$8$SDdxXy|FJ=aXkCU|wqc3OQv$8-yZ)0(Wdk~ zq=|n$JXkx#@9Z7^c0Djl%sKz`?ScE-fZ89w;uvD}Bkv>QG$Qw(sfF3UT}zbuRA8^q z*TIX**N7BemcKYNwvMZX5VhA`SN0%;--mk^m8J4B-k1)*gR*SyHnOv4BRS-DClCGQ z?GMcO5-n3yp?fRFhd&3?2O=*@-3|l8ceQ^1@_ObFeHiexy=3lY%317#_WjvGqWtfk zaVyTNBpppV3#oJmYbtbo9|D$g6R*Z#7PQl9=3dY>AM84(^HETXT{#2zm8ta>tE-wB zzG~JY3*W6=1J(w>67M39UAlA;>?wloP+;QSM!z=y!HrhkyMR!=)*=)PCBeqoJdN?)!tN&JjWM%ojy+#c$MvDwdnbw>fYr zI=KodPI4Mx@SEgm%_}dSHTw`|zjE1caGTYv0sjMuh_FqRV`qHZT0q5#`Or*$BrHL` ze^6UEJh%MpWHd~H@H4?5oDqs%Mb4Fv*EEgq6v4T9wI&-~WGGp0Am5u)LeUvB0|Bi`_=GJuO&$PVGpO(KsOP6t0~vUy?D}^*AAW1 zA!%HSBDxF9H+h=Pf92dh(IE+Ow(z$OGi$*SKb_*{{7@kk1jZpd{us9DjmVJkga+$s zUqS>toc*E2?C@Ff&JYVWt)U&5&}pz1n-yLInQ3wu%mOUwSh>|z&k^1sfR2QS4#)zq4+TBRp5e zvQ?s-y5#(}Ww%E3OHHebEE=}sjV)QKkDYuUoc;^B;Iaew)ssoVLfDVjdKDMv=O+gg z)F2swyGvuGX0LBUDmxTv9aki%#U8>g*HIJ3hzGKE8{DIjhX$*31$w#N?=RmmDl^}S z3i>^V%)B$hVY9!x1;%vs+3XW{8c_waXN_<&)JSqtHu(vR{GtPT7j!AkULr@hES8Dr z=XKMmjG|j!P?bOU)LIN@lX$``YS$}B!$xTWc^#EnyKZqb@+37OQXwi3`<Y&5%Uar_;#f+Ir+Et!%ia&6z&L+Q10 zH8T{QqZa#`Gw_zM@Bm@EVXY}P4zasj>^<#id}GVY2mdm{*K81kwL5MsSa0vu-efTz zj(ANqHOKL?X#i}Rc9#Xr_6zgVW2UI|kW1%|J-@_?{XoST*+FIH*2UxK=-9kBz1H-5 zL&I!;DL+G~grVM_MZ)Vh<CCdP2k+7nbbob#lZOA}#x>R?RWCPg~m^3J2@^#F^%weUfPy`Ga3`ZllLW z&?O>uY#SKmqu68zgRe15eQ#-vTQ4dutH;-`K(|+SW)Amfto+wQ3G1nlrk&;Da^PSG zo!n7V9>ZFO$Gbj?%t??&6C+2=A)*;L`Fj;pG27U|xlv=QX*eXq7?Q7@2HotF?C`?O zw;=~@B%gHMAr03B{JCbWlS4s`%P0D^O^`v|&(<^fTB+Mzycw#DQ5V}taozdLo4fuK;Ebd!$_RM7C z3B(DYHZd4e;j;Jh)7%+Rq(;K^WN>EEyfI5FH~I91u5Ym3IZeS1a^x{l(mIvF9I;5|w-+|bam=#fXb5y$y+YuN+RI;UnuGEwa+Jxt)a^HJ5 zQE5M5ANq653}Oh*us=n>S5?x^`A|wLID5FRf53w}QDL7j%nTJcv=D;IJpD!PEa{4g z!W^e$jp3G4hV~gO!!UYd={KY(_`82jNvF)+EVULmlC5cTF6e9SR$ZbS__TKE$7{4n;vmr z!IA<=N^n!q2zHhQI{`Io4&0x0*&gZYWo@$ia_{IAbWwX?8t!l~dn(PJp?}+(`DNUd z6vjV;z~XX;qqETe(d|?C=X-eozg}=kJqD<~oH2eDi&KO)DXRFJ71VlKxHx+ErAvL5c@b(F6$_ zgkVgJQh6Zp5{z>hEO zV;6&($9ypg0W%QJX;XTFp|c1G)F2K$>Pa{NDucDJAaJ8WpS#765?2KaHX`*VC5^oB zC+wtxen=$PvWLL)&A?|;cx#4G01C?=ASjPAvJg4Kb*{aMNFy!ua*;!TR~~vWcMGl= zx-%6Uv{M&)a<^ODnUof;ks|^(7n;ba*d>u~f$P~3%sxTI|2FNHcKKvtTIz!-wDHk! z&w+(f_iSmeKg~LImnhHDWBlkS{n^3BA=qgJ(H3eCqI`gHiD|^2xkaSzQg>?JAfGPv z&X^bYOZYKtys5IuxcOl53ga|%%cRNa!Wz#BlJ&hMo~%woo@?53E#c(k{DjTw=>LWn z+5_+2QHUamgjGW%cgP>@G;*T5JW0WLRQ6)Ug`+J3fk1p^Y#N=v7DXQ}MBKi1)`J8@ zx)jUJnwwN+nr@~6kdxLh)8Mgl`tJn0T)k3H#K%6QG!1Eb(gr>zqv%#F53t`yAoi{R z?IWdoL-Rc%r2eL@DAKuMYt>LB_}5?*zgK-e`V+^wKQA;7Ba9)*{lKLnE!IpbsQ;Qb z!VWA1YNUDnPXq!;tKPeQYc*Mw(lp0=sor+-=27qgkZ3eT++qy@S3EHwza4e$mq*QF zP{&n{RNYSx7v3ITJbY@cwKwo-r>4pN)Sm4M`^@J_iS=KM1M+)&S{zm-vu{g{J!ZUX z>|56dcqI1G7!_WZx)WZca#I|V8&k95xy4cDvE$X zYf?mZpoDsYzTYW37`n!pIF_Z175synHZBODyjPP*W+fdI7z;MO*vRwfWslUVs?Z~U zp=ZT}Ke-t;(6ZC_D#Ae)0WHm=u>o@0sPe+m_bF-|VV2KeWE={9UyM90Wp|-9)GCv- zoj-0OdlL3#1#!Ki{j%Krp_)SE{j#BUECD`cRBG0|v(Q@J zbW{~}*}@Wq%*M7C6%@EXy@$DLoFfI=#PSEa$Vbl>l7WkR!=1JkQXzp`qsB*bDx@Y1 zNw}b|0@V5EMD!~PL-sZ^c$0!%0j4{1gXG=7!WxNrHEO`5f=WREg8UVY{C!hvT)-k{ zMl0q+PW+Jt)7MB4a!f->w@?!-1lL+YmOxSyD&~9i&^cfj*Js9O{zhRjJf)_*Dd3}V z3;Ltu*rO#%woaX^`!_t0C!gaw#W!}ovt?o)lmc9X`K=B zo$NUXT_LY)qU79T9(w;~L>`?_eiD!YWe0I-cyG0GK$}^7{L_@*8p3(JOxHaWoQJ0b zueo*_7M1`3qmm?$kiadH(PCrvTTjW3qW>9{$cw&*`@{^N*|*?!#axJbd>|p4(~w#e z6uNCV_#xp_2M5qcq~(;?3V%LW+@ozbCDjOapzl)7zmpM8)^k7*txakIO zz;RXD$%%ONCIOI6$9n5Vqw=1D9RbUm?&H6+F@LzJaJUI7`xtAolaZK%InG1X8;F44 z>&c+`{|6{e@NIxwDWKo6R0_vH=OPsP&xoQ9L(ed|PSrjeNSB-O-=yg}K}M*l+S(qz zukZ)Vb~J+mACwUsx1N6698gH44WzfLI+P9zI@rvR=DIg`j0_r%IsOoq>G62K!N#A> zZuRVYH!?-YpxOTs<#Fm5MKX(f0zJ42MPLLsk+zTB=P+`TJn#dO z)*~sB)+4D*pC@ha_3z2c``)qQGE{kxx++-=O75gMzs?)YazW8=NKya zl&;CWS{!qg!Po|LSDqQg>sbJ$r%8e2T99~i_TgO2yNqpS_>Zm2hnUd}`hp6G#zLIq z7w0@iF?hh$Ua4PO=lBH`v0F8~q&=r(ZPkpLno;K)qKc5Obs<}3nW*^Qr$i$YWtdly z*OxnV{G}O$DoP2M0tDbUCRMKaVzcc8a|2;Uh(h%!|K%hm-5Q-oq@hYosk zn)*3L@5o(EHrvDe)$TM$bD!%z8}Dk89aqh>;;kF}&q|%`5RK+THv$%(8r;15`0Ljv zk6rL+UxSBagoF^%qPkPm?h9Z0wNudXIx{Adfv~txntPla20u?qh&p5Md{#XvBSr1S|Ts=uarOer7O6)X71FVA_L2Ce{pJM%pF9+D3@&0ngX!?>}) z_(!uQ4~c~7|1(9!BeDOgc@P+%j64FS58UZ5=MK?U0*?2W!DG%6&}dOOV-Pi|< z@hsjP0m5?zFZqh?_X{T@)OD8XtIC$9?;A79j~7j#M>w1m&i$k5ycQB%IzxV|=SQH% zjg~MqMqi+#V#=nzm&(0Ag{l=hJM$EHj0!6pqKXA3wV^#li6}Rft_q>5TE3cGs>xbQ1oUz@MZ~IdIW3N)SYf8eCG;XA10E4?{I0zy7un(vZN5}g+ zqsN6p-?qy8-f3JiGpli?bQI z1Ux0K1oRa5Ui4dOA4e^j=>>Vko88h@vf6GiC@mANkQ=<`C5&5Ms9yq8{Pj?m3HPoq zjc6Orl!qy!vvOU{eVb9bBro2e+k-9}5!uBX^d|?Zm{uT2U~` zhi>y>^~AI!IqQCfj?okIB=c3pa^Km12uz6^6wFiLX-VPf8nzc)z2I@mL4DL+tcP-E zGVh76AZ$J(ZG(Y#(uj4ecwu-r_H_Mrvs-Q@LD`AlZCA1Y`lwAnuV1dQw7gn!G0i;> z*BEEogRL!TK~h#{>|P2O{|c=Zib-+SH=Pi)`EsoKgg8AaB%yA5Sv@8YgdBAvh!!zN z_Nqx`hon>?Cgm?yr@KfY{2+!j@xO@~xK1SWH+E0W~xm zYWVh-5;8t`hQFNHt*b7S7UyT$z7esYZkX2P)pn}hIndnMHsA(|v+yIj z8Rzn<9Qon^Hzs<1lp%X-A+;-Ta-`YJUA0_bf`>Vn?xd8!ZaKd#BaL>XnM-%^fPN*L znsOSZ=tCGr8tua6IE`)_HpA7tEs~%wgy-L^J*w&Bs$m-CT1c%`%j9SIsh&P&GosoG zTBg5SvV;HwW`a+!1|EDRe9Ot=$JY_fI?YPLNLbCEIQ zWbH)5b3x9xe1$HRK6KSdum*)RmQN&yh5$f~2U#7}XZ24eNAg`?Q zYx`-xHFEWXURPpZm9<6G<<{U3J?N|^{qopP=YEY|{W`N9Ynwa6>kGhO)%5UAO0|irr4#Jda z3GHca`Z@h=^4?u{(qX#;>AQs#^nxf)x<^9k}t%$G~rYXI4szwEyVR zaeWu$CLh9~rxdhMJ^C-qz-nR0jlFzXl9wcWa-4>EC;EJab7xzI>)LTF*;ev733_$QdX#J$L66ioejse1mgvLo2i;{%K z{|&(bW+y@LBPkLD|06|__J4=*e}3HBzYolL*y~(u-)q9U%%w!PcUe{vf{WQ|*j}B! zUrj-RWk(R`R%GB_+TBLAa+TZ{afx}64 zCJ`GI&E7nUOagPdSp&`|c8hO7$e=;P^B?H@d-QkYL6pYLK$Oi?%=qiye#SxSu^5&-rc@!3e&2xFT*+a`n+7PzRErV@HLRb%l|>jkNemJ zHh5_E??v9dcE_OpafIGjLdlHs3Ch1geo6AyhMU?K;D5SZXX8QH5?}qloT{sG2-vs9 zY!1#>>aVns8L9Auf5Csz*-zu=2=7nt0uL^1n~oN$C*nf2R01!2h>qQseVstY zon%~U6F#&M4zl+95735H@50A55YY}y7%3&4CDevZJq5``t#Hodfu3dN?a(3piO#I@ z2E^cF;NVyCG2M3(C-H{Ozx_#`_8iuMZWD-z)JH0q4O`%MUMO3Dlkgk^h~b2Jc7-FJ zkG=u0lCc-VlrjLSt5EFbrzREjK?x;=|8qm?ex&U^meQE+4 zeneHkU;_bJzAsja3~sdp5Rf9ePb=xXn3@LQ_9#n!MxF`4pmz5hk`jna?tf5CA4prlEDXq$Y2-F+tZdiL6nkW~8ZAY27x?sjO74Zc51=>cn2}ra!N`XEA|{*UDrxa@kq6E46CLpwsa~^Pz-XK4jrf- zI`3j0q#j!R%tdRcJVJv&2U%HRBX==NSao`V+NjhIw5~DBNb?)3AN$~-|DwUFoP7mT zlh8MMcl>>)9Qu|*K>1a>tr7^8wcuHRDCf)IyHD^tInY$St&92ag;wsZu@SQ(XZrjI z0C{Q_*vQ!pA!!INXt7D?Qt3i>i3X%^7~Y6e*BXh@h8P|d##C@4$|LQEa$9YchsJyuZXc}tqi!eR`nXSgWpxl-bv?QKf&eb& zDCCYfoobY1$Q^XmuZeZ*buGJVt`AC+r}`tmLE^r23z`a0Nd_hb9a#z=n`0}4>p?Ow zPBNy7Mlwagkt1fjnY)(&ir`O9neKGyCX9LdHAEcY)Vqv?i1O;#vbtwXc*{&%W7D;* zk}_3$Hgn^)E^niOT}<7ONq$VU%|@eB*?`^y!H4B~VPZ(vZ?7RIr!n48AD8-ut)(ky z3edqVcHk9n+k2T6iEni82e1IvOOSwAzV7t4O2RDP8Id>5z|i6Y5#D9J#6oQ8xS|X< ze%LH|NmYDI-r3q~hAnHkG$5L&{)b6Rfi>Tp>uu!p8iR+mBQ@9LnI8GnjXVuD?x zLzYP2%|C-z2fISu)z_&B1l@>f(NIw7 zbbUhwAhK8;%x;#NcnYoxV9dfWGbfRfB-Z-@xG7iU5?t$jzmWooY|Oo;Rbsw$o$ZtH6(xoD<7Q^D_SGtsh%@I$713vD zXUtuUoLujhsGNq5fT0GjlHhj)W>;*OAhCRjDwc2UY^46685_9;xG4u+VQW2S2En~O zKckU%MEcx51(l_%_VGmS-e{z&{$POgZkps<{%9AV3xXW@0#dO9aYS|^0YO(iajQ{P z37+|yg?;5$J?7758P;*ln`dCuCwsY6mT};I9YAs3qoMek2LGoTCT6v-S~Lm|MwIR9K^1L#KR3oiZbhZZi0>6F)jg~$2!YTH2*4e$(|Ca6H7IjE4*#1Yl@203s&)nPNO=nwb6C3DjcP-mH| zh^>PxqeswU8q}BYUE?zLBN7?*-;hmz5*vx^`Wq3P^#F74D8Em^Hw*sB?{VUglFmdi0-F?lJhg6}47Z92x?+?2 zU$6D0BldV`Jcr$g&8cs7US+LX%6+`_7{~d0p;PxiV)KfNx&!XUA|6Br71?d+|3I6K zN7G}?>X)2qI7swp=i|>k;RAGnsz%E%r!(-`%g6ub2VFG}an{2GmMFS8jP;G4#nhV} z3bMBy^?VZ)h}AS)tYw2MP-QhBOr6pm=Eh#1+*3A$Kn0g95-kcPv)FN9iO2{xWH6W8*}z z_bQ-9yH7pGWWkRLD|Mz*|Gxp|{|`v%gp~~-Txb$Pb&9l|C0I_&S&_G&}YA1 z({$JcAZLcJ%NBryFO1St;a*+47NAa1K^8`g+=JyEgZ6YiXt$qz&57etVa9SkC7{;~ ztWpV3gBYbuo!RT+`n-hX8}>c@Q91)RDh|JWFKjj$`Gs*Du{|A1Z(j#ce7e79?g;s* zHgHuLAmD=A5BePZ2VU;oi((NGkx9z!`1t|l62+DXKz-aA-9uULpn3?XjK*CKbsqe< z1Q_r7Svpk$V=3B1As`Glao;bJQ`XDix$|5S%B6#vC|&*+a}=2T*jWK z(VL>#b<~7!$y>ggtp3^~RnNYcIM$6+{anG-!o)4-{cqOL&UDpct1l<0Xt!SxM~08# zuGca|%X`fv^gbQ6h^I5A6{C}zpA1zxxe(dxZx?WRs6&Tx^T8K$%a-4uap1)u@oun^ z45fTh(*8xzKtxIcpyEHg3%~wcP)LD6bvL|4o)wO^5$&hZr%}aSL zSAv~PU2l$y5fWmfW6zOWq)$v_>sbAstQ4WpW;o?7_%p@MEfw7gV^nf8_-VUSHk#Ej}D5hq*XbR#ow(C36EM1{AMI1ASG zItfG-oiTe^`RgJ@Ywnw4^u6yXW3k7?BU0{hsBx(Qi5KUh5b3I;-XI=Ph~~6hfhuZc z=S8c;sM3od4Xmiez$eeKy2G8^zE|EdI}{0zCO)K>i#tC^653FuSL32gS=P8Ag1p9; zrJ}_h^&|R9%w1|RAY~2H)r0*@C>(r6h(QjP_XyU-t@cM3WeU&*%Oh$3_a};k0>>ZG zvVZgd1;TRch34*z8e^(Dn?jl5OP~#Z{ozu zgU3$!0WSTPKq*AODEC>JhSnX3T2?<(#!Wx)^}F&n0hW8LZ^NCIfnXd|8uo^j3b*3sObNBVa7u z1Em1%mG5KIzf2omN+Qd9Yehl5X^C^D!w2sF&Ntho*a!9Rf@bp_cSE}<$SlhE)N974 z+-FxS^?j)4j(WSTS@7>#Ssn+Vfbo!5;@f0(=rauKGjZZnUCobu>jb@~zg6}a&yG9g8#6nQCsj&xpq zPPnwVXU)?e%ntj`Wu3;vsI?r(XiOy&axn#Ohl$qDs%xsJmrU_j9>) zNH+=N#8O!Nb&Oz?IHe82nW}Qot{Jkb8FYKptL5gR%i#UHsOwrO#U5C~h@-P{(M{%P zIFF}vs)9%~JY7Z*GVO0V?exa8;{9D}k5dL#mDkIpO*`JDFf_zkv;Np(ak?PZCT+wm zt~xqC{dGh+XZ(`s{#e|v4!4*6ia{R>!X+=&e@w7k`9Y-AU;cL6c6rV4G~`BT!&&&N zy5-OdI6($fg@=+Etq-S@ZoJq=S@CUBhjUmx<9BkdP_JS`yPmSPslEZ+!s)zb+gTp1 zehG9{Cz>h`H7lJtI@>K(2Q8>e;i5810y*6)HO6N6yrhu+V$(q!B0DeMhhuXwU!bP! z{@_w+VOFl%Vr^IXLdwaBJ2JXkV~@2`vK2so#KvT-UcI=8!kb=w&NfbJTm4gtu0_>E zs^oPo={<9e{4ss~xb6Z<)5iu}Ot<3G;%5s^FYorc zs^4Q}U8_A)9J0NtoI~j=7%sTvk!l|quTp`PLGV&yQ+AJxHCdRnGAG!+^Zs^sh@#75yd{j{jVb(c7?7St1&01w|9 z&@zqw5@#sl&tzQW=kyNT!NtU)mUFyQn*u4EOx5OfX=11EJsmXCGZ(OP+@M{4uP{bx zHnSK)*g)4bVZ^k_e!S!iw|Ru|1MPb&{6;Ui_g)EV;TP`z;65EqiJE+DHiUl1xHT%! zDNnikW4=%gK8fXGV-*T$0tJ~ z=v`gEZ!_+BI`70;avC19;f)2)B+!DTq1Z6JM(y!N=w;3Y{3-3&zMN6CPR2VxS)~p) z2S+@2<8}{w1hZ+3q9>0C7W%%t2jYFWl>-i8A#}J{B+P2CD!Fm(Bgh=C+Nf7aHn2J0 zmHhGWTG!ibcV7m-iYap3R%cve!K?Qw16TF0uNcu_={wkd*Usp|n?iJDYsXxD7mCwUm0D~!Q%QhGahAh0~mt(l4 zL*-m9=>($vJ1}Uex!om`Ag!r^sg6bJT;5r^N0KxTjHg!8?l6*D4*mobLP<;n`)j z(&#y4-xOd5B8LHo=l^XxLc_-Sn=d#@e z;3a8>EY$^jwS?w(WL-rv#0~Wlw~TfrZxjG12Jou>f$#nWxAd|8^eGZ}eDcK>09lax zFChFc)-%j5Zd1_@kUm#Xl86Q{<$s`EXAdavN8S7s*XhT90ZnBeOnNkOI#f$?587zj zSO8WPw~+#+62_4&$+;r|um?5E|>1oTciIdCbqEB)Cy;JC4(Dlr@Gl6vas%@OcZVz_dU261cwNr-|nY9k9wyv@>Z1;%i?j+aiz1Dv{@J9~m}C zheer}N_=3UFD?xp>%g}2=uVxxl(!S-uL--TTAMi?onL9Y`Ua`u()U>{tW;0cDa3<3 z1uK42R62@~p>G7i{hcY}>!fA%kXy};d`((ywGJQMIJ>po0QM&V9{(|$w?Q!+{q&gc zn)ju!8tfLVfziN9Rg`D$eN@L01@Ekkp0at0X}cX`LJQ{gY*r_csIQA#dL zP+B0IP{)l6keeQVgY2PHAP|Xn5m^uGR#K&ZSx|a^8Uyj)I67??Wb!XE{E}f)&;A+@riLV0H!O?l*z4(eS1m* zuyZ}c`{TS;+@qUs++lVtj(!@3*Ea>jCwS2?+tQXAdrpA27Fl2-{FM{n&y20J|K3bU zxGpl}kk|1?y0gI$5Y(yEQ#}v&D7xqHZZ( zfPN44XdAPP*nD{coth+|>3|xmU)vpsOD+MjnKj5mh%;S2p=~EI0XMb%^e#AF`gFon^_%R(Qz1BhaUnFQ~B0 z_s@LCeWOw@`VfN8*V_GVLh`kNCkNPSH4y##!8xVymy816g@?gN1NbZg4hl$kkpCJY;{tb-M(|HVqkY~_gGOG|j1rH4q%isMP0YUy5mEl$ zkv96Pf59Pv?5lqaKT;tg%PrBRfc|5c)`b1nkQ?`}Ar6-Ua7RQGOY#_rSJ9;A*?=Ju z21t%36!dRHM5DdCtd{CGPpPwNV=1+D5@ARhN)S(5_yUl>crf3bWr>+y^3M|q6a(_X zIE$cY+MTPO0ZaI$T!qQ^}fuvuHW+J>}7wUE*TX-f`Ju zYJw7rt`|=Etf}+BCq!UnNLcy%N~eEw7m{e_i>G})7-*`%k9ZAcgvBcbH}BWA0w&ME zZ1SkOmLwR?dnc2J16Y#VIyXjRV!Q=W-1*&)nQyZE99Dp^J5$QVLX?N0``B2Pxy$tc zaRSF%{SnKXuKq)p#VD5NjIW|M())OT7d6b5iKq0t8E%p>$>}oDR8hO6GOsWJa&0k9 zF;QyeZ28fYIcx&;x=4kwvvq@lwxhHW{&ppCYVC{O%cYP5U*<%qy8WRj{rme(SN_7c z|9rfFcrcE0vB8x|u*=KmQbUHqe%#tb5g^#UxhQopb=E@pR$B?vgd1bL0c3CkU#ImV7ts)t-!fkUzgRo_Zf9mb`+Rj4nL*81gcdIdvrMu}<>Jem zQvw0YG#wu>4wJEf#14f|0u2;IdP9ct4%43~E5mC~eQ4fy3K0SE{rv5ExiMUqa}|L) zihShpKP$oEy0}_!&algx-$R+H1wC#SZ&PjKhVNw*4iWk@P(lVEPw<{7Z%E>~&Y{r$Gha zA0Si7=7v!8f{a?ezxMcH06_Vl!~n!$gOQq(TLXB8@vl|IH$dTH2M%HNh6}|3GX)y? z><2&x`+E*`P4aa#;Kz|xogky^P%5;vfRo%9Ffi8vjsAmh$gLwtz6mM)ZSo(9?dKO9 zuHJCcI4~9ffFrG51F#Etl7dcpKu`++tk$$J0Q7{MVUOndkn(i4M|BZaz3M+dGSr&- zTco(y)%PeukXv<8pT~mz^8azayjkYu4rv2yf{d?>2he2RF@Dco-q^_0AYz4Kc@rwqr zkzXK&Xn$7y#S+T4rorfR7X`?}#@Yy*-miY6n*~Zcs;9?o%6|qHJ52QWr6%ukOFlUI zj-2ayCsAF*d(mdm^I{@FT}in$JhJ^_25i^9B(fJ6Moi&2DW{b$d9llR^t0Pcr_OV1 zuhPzY-sHe?`qm|!SlTdKm#x;Wk*?L%<{RCp!5};m*r8nNT&!#cZ1ue5Y0ef85xLm2 zvV}Ie_$`*GB2jEV0-LL4K7}DUUIIIM9TqIGru?|=e1F|+J-ucbVaXdy%iXyw6p6O^ ztxzmp>?3I-JxOo#o zHTCyOHQ(LdTbd%0ETu z@>ytqoP;q%PYTS04(FlXU-?=Z?d9 zBH&F$NSJ8!Wg!!_$UWgup2%N6?#rkssh6$d$MK25o4YyRQ zuqG_caEeMwhB{#n<(Y?V4xTM3l&6UdkTNMG@R6$xXs*4)PU zg_zW);<8@t0zYf?ZBjqbCyG>y_t%Cjl|Z_UPm@SLc3fY-&_YKj@I!NdB(K>vbl7NC zDp`vvF*$xyaWNtmd=UCRx`b9sPtd?4L3F0e)pJ*0pQ_%0s8AG`BAopxV=?vM`9mRO zWE9PA(S2vBMh%%Ql&xMv@_*ghbxgOQFXHFkmX&&GQo((-ZZj=A?9}PhCM@^^xfz?u z%RIC*JPQkA**&Fcj?K~KPxA6A$mMwyi$AL&1kwIUl4`B>qC{^s?RDelvK;@IW%)L_ z9S6&W`gsGOPXVZ(saqewquZcSo>8kXlVms8I?Wp-Zd2<7ouSE}QDiavg4@v0Xe^QE z*2k-OMz#prJG1kgh8E_n-_#kdvlwOh&pcYuG^pQ}sal83M&F3qT3P-oZys$p)?cce zje|!WS5dql%A+hBT(8rrdEX|qaN>!4IJ6dm_atFuvg{)F#bZjR{P2{t+kK~2n5a;w zq4|WMoHP}jb>iqTWh=3%$T+z*iw;kj^H6~~OB|MfJf>1NntT%(Sxg^b@a-M_a+A*s z8|V3_-L~E7V zfwrKnx(a;$9(d&MxVT)5MKceR<=-sAp4NNQ;Z)mfyD=;S-j2LH$C1Sg-oii1lZpc=2$$Y7hE(p8~sirQ2Nu}djju`tZ8 z5^dSR#gO#<8Fib`ZrHB}3;3_oZCrO_Dx#DpM{=yQE4yQU_k2%+6L`cWZIGmo+6>$B|#*5aTI#o69A zp^~lyBVh6DJoO%p>N&b;ak5GA_YfIrJ^$?#fA+d-0>iZ4X;eBh1Y-o`RoG*cU7zGe zggSy#huSXxaNF{Yh8?GFsrQ0s?ww`T2J>{+Jj)tT15N77XKSx=ov5_kvr!S<+Op1> zCQI^ijpamgMJw(#b{Jgq8~2qA{Tnv*K>67H4MmQ+Hs5 zdYo;0T@NRNRYU)I>0j}HQ=D#$UztS+-Ii(00cW#x?>*Af)tD}Cickk%MZ-(Ws(`gQ zqbhT(SIQ_`hBoENVO;VxuBknabF7q*QFfqpwn^jEf-3*fu)OaL=TWO~{fwoR{)n}L z2Htt|8l>n!IXu&6mb-n=tNT(~PFJRw=%O>M0l&WU@{;U5sa6+Ia!(hI);tpZe#YNj zrt9~uIu#L$9hI3&xwZyXt1H-}Wd&@eLFG4D+VwvXZ@bgIvUYGV>CQnKA`)!vc?fYT-6`@pb_K&+lb2z5PE()CN=*<+IoT(6W2KueUggl<#dr^9O?FxCH(i5Mvkx)S)sqJYF@BV zotpwT-t*uEP&0$OHNw}3*>Y~C#k*P&?`sCv*||l7(pY7RO0-4c#d83#95z3^a~rz; zf!pBX*xdJc9_hd{ce;J4R1Oq)Z6>I4!}#gr?z0jZdVY!Kr7&@7Zf9ig(XzAqDM?VD z>Oc-73CyDNLnzItq3_q~*cz|^4er_uwyN4zlJ*W!iPYv`R0PiOy3*}?O#S)k|55;v z=FI$JCbw{GFi-7jQ!$f|*`rRpR;bAg3qXzAi#|p;#vGY;^QYYrIQ$K1iA;Ydb_Y)p z&0eQ5A>~r$ZCK|$P<2XRuMC(2f5) zKmZ5X?M=%hg6mJ(&~Tk`O)C{5mO)Imz>=+TknUvMSs&I~F>ckz4$I+$&Ac{7Mlj~u zh&Z_Ta;uIDdE{EYffkF_^O{{WAAIsro3uU3kE=YGW6NKPOfGVXF6>nEvJ(L@E%dHg zRH+LcXYm+nH>=BWf&Ix-~|GRxJP&r&71;)4bB>ojSpqz*@J>;q%vzSN9mSivH~2y!iCvDEuO zei_Y2G`9e)Y9#J{XCqGX=^6tyQhxDM$-NkywBj=+-N#Eon`MY1}ckrHT z#3+K{Jexx1vunT+4cFPFwBm)LSsU0-&9&c73t7?>rhxZapM3zvx|jn?^DR*HC%h%E zwOqXtaCsfu?pu)!EuG53R;C4L)scEay{6{N@(RCJQS4+O7U&QY617hSpUCUm7d%qo zDpS{cT0p@gy<*sfs_f37_u4vvW?F#{~rtl zASDJZKr%oNKx7@&e|{xI4e%DZ^RH+We@W4czdY$5MHgmZ)bjSf z!%*}a#<8k07bX_ac!-l&P z#{$rae_Db9DT~mWNfT267WC=wgu+VX%otBvk?$6Q?))$L_ciWjd}YN{a?~!D5K!e4 z(AMm`e^sExA05dUkp(&G_jddrJoNs{j@m|^SxD>`Hx{{t$Vq=-(=TCwCQ_&D5X+qb zt46E1{zAi9P!;%Sw1HnB22gmqa7miUoexqaf#y!*Kj(!rpfa5DMUbM=MDwq+r=IDQ9x9^zo~%baPD z&w5SwzeF92i~ISdvjE=L&g7yclgAxe#0T1tbDhQMzk2NolddoRaMW4=)$lW;K;mIQ zVB-Z+b0`$3k|vHilU?sOI3w%^F2xsH*V4-STn;Xt=DhHV8ft`=uFAPhcG79=-PFe* zsm+^9yjF6{i*|>t86~AUCTlMTR;-gbNdp~TLDHSL46Gdq$o!GwVn7%{K{fsSTj@@{ z7njfHdRd#Tp{32}V>dIJJXKYZ?X6dKeqK*w^L>Mh`>rvKh^`NbtkLLFW_CiiR@o~T zu64Z&CzZ=lJQ{+A2j5Y*+lx&%lXYlPAq=nYx7s_#c1XpjGt#?;HcaFoTT#bD}E<)%@=T|2|NK5czM5zXyo3+5hJRa0L>VDdInk{p(td zuf6}%I&c6R_Mb+c@-JT2BK)rdDI&~*$PZQ3Irq5O6aUNXwvsX`@x&eIlVx5W9<^Du zt*tGF!U8Y@eK5H14&2)mBGoL_D+s3d0vDo7(FaR01ozSR($n`b6w=cdcDRiWkFqi| z19dDbDl6Nu7Ak$cZmyoL_5E%HiHEBZ9(ec8QrI}3YJXn6biya(;bH$`)3jFC)U+VT zr?3duo&T*k4l60Li{-5g+e`CE#7z%FGxZQw)ybl(puw_SlavdsxpbBUC)I^A+x!?L zKV?drpDssLWl0}2)w3xr$`OYzXfKWHPfqL4a>C{~VH1LLzXf3ni_7rE zMNu|BE&&l9VZqwEy1Ito-h;@kZPeVmna{lR%%G=>?K7SE=_b zC?d-pb0L@%kd!K(CF!)3%!tv^*7*JwDzPT=I0weJ2ae`5k>lVQf;7EDX*9(DE{XYVWZ+V zy%#xtnLVPF`|Od_oh#r?qP}&9HL_nj-@M=HcPUPN-_tG?yd`f!hcw-i3pSB!Es{gD z1q7OjiHWORJCV*Af(Yoe5lm)yXOfeW3(bK2Fbrs5sXH`q6I$@%ZHP8HcoD6yIhfuP z4SW|Yg)Su(($@>_WsvIY?PH+tyc#q5l`!(Ok5~Clxg$I=F|qOHrg&$kI&>hmI<#~A z1Ri^mIX;kCz2jfKlT$qqdooZRS{z!uGqAHGeeA=@xpLR}!NbMH#%OZziNo|AiRJc_ z$HNWY-dI-P)6>M@>2;5Uy1cx&jFpLQUR{&FzM{Iyct^1olX1CwpL28M0Jq?(b975_O&S>2UKz+nh42wL4z z!@GMXiB9?htE-77xwK+w@ zo33%2zWVxe@Csu7>GS3RN!S77?pY$vwKO`CaiD+LAA?^X-8Z&tZ|8p|C0<8e{2ax# zr*kdqgI4x%4U3dh;i{hBB-RUXGBIl z%h}q(DKnGCWS8?UEmhT~EX~zbRr`x76SN^xf0@ztFbR73R;!t5!K-A^YgYhBwD%+z zXo3L$1e>&gGWUYbcei&TU@$@h%y96Q;#UH->v`~M*XoC>6$2kLI~yx?7bmcZlb45b z^N+Utx)Oh7#j%80#U7W`t_5Q;n}8xl&6%Xvc68F@j1$2^WcJOC3YtmpDlCbo>OVo6 z-U;6BHK9{@qCq--0DS|;OJWzNd~myc$W1;Q9RyBT*Slz5Eo5ulXwv!$k{vEIer+}zdH)y2lf2HC}dQnqJI|8std2s#VP`}!;AA&SKw zZn@mS+Zvl}BV?E=7ZS|m6M6hMT+Fx`S`V`YY?$KuNW@^necCfM7j3b80%sS>+yYxo zY^7>gv0Ev%E|HfWnqexvdT1GRP1v;Ie<-sCp&sw0s$$a$n{SMRY)YBL{ zpd_ueaYd_D%Sx1SVmwpn$$AoH$s$tcGB^l8-Hz64$NBC+Vi`Y#x=|Z&lrI)5`sGWY4Wr~LqKRNC0 z$sZoib@iW|Kd5ku@pQ>kDlv@1x>IrsnH68;aV2S{b*!4b2!CsG`av=yyCT1(zObYm zT9BVtQ=DJZ&{k5=kYA5G%q=)IoD_ArA{(a2eBi0Enbti{!Ef9 zlEl}O5|2|83YO9+86?shJup7Z^IYa#QDRNUyw%{+f1sn?0F^gEGU{_}1Fi}5Cya@Sp*FnU3;PqzD@7-Qx z(nU{y)7p=NlbRWK3z>kQ?3wz6`bw!Cs`%mS7TDUBtQ)P8Qvt!BgU|Rq#N@Qvng!6zscf-^8phk zCDV9h?Q>P5&Q+1+Ra1GjjlJynAa)+HzGyKq^|Vo%DT@gEC9Y z@-i!gY%5C(T^*gSv`yuOy7E$*br-lVb(+a>7!=uV?VumhVl%gHGuwC4V9|GWc~o?A z;*eEjY~#8tkG^d)+q;>M?W-K0YoiG#ts#Gl@gv*UM7qOJp*&S(9;m83_R|#ENSrnL$8Aj& zBz0RQ(ZKpm+3)qm!x>lUbRX+XJ6A9*7emVylr4y~iZ?uqPn{T7!zCUQrzRjf0fMwU z4=v<-0mOY1pLuW1%+_NB69MMupq?K;ykwiG-$)MpUojoO$17r6a zP|VNC+Mk_C%#F#zjTaH8KK7d%2&;6AIG4qyu znwfOM5O2Hc_CnLgOhea9<6vvjhUU%iUykS!$SKCNrlhoKeCQLsyKaz8CcRgTk}4 zs6bVyfJOUpM>MxoLr|ILCR%O4eVKp{6yct<`XE`Q9UG?HHW(-y5N!bEC#yEWmsP@4 z<5Kl12;(L?C4B6A=pfJ}nqkxU`nX-8qpEF|7+1-V?q$a=soqvlt}&Td{?%^gPgLfQ zdPYG)Wo+ByuaqAhuXD|?9ZgS7N${~he5_e#$gPU9)&;lZG9c49$OXb(`lEe1 zvdRZ2Kjihx-!uM76Y;yBy~=uXiG!c;oQZtD|HH7;7r*DmlEL0X_%iR{@(7}|op>Ls zki!kcyYG@74m0hF%aE){m_dGAfxElARCME@SH4VNeM?f1Ov!)s4#{66{z{m9rH4&F zy`$U5QOZ5>VoNEg-2?w5UmVRCg4;a)+K=ibZScdl?z{HUo5A%N63xrzeMIGExXrF zHF<^a*Wb{CjXVp(R65BOZ~J+kc%lX7D;%JlG`QN^aHEP?eaLg+=nTj8deJ5FO94c- zIzq!o@|EiQSCO5Lpo}>bh){scxGlvy!?F8ByuJ>amw)}D?NJ0e=X?<0-)?T*hD3So zUTawvq88~DWip-qiK#t>@eVJ%->*(S5OG`Q^i?}So#p=f4=p!eEn=vtPYGWg>da|p zTlT3`(~2XmE{oz6TkiA#J@388Qag!rRX9^ z{KVM+89#~5uP*KsNzLutzl|{rW7T+pwONN10^0KRV@GAa#lHIz|M9H`PIlnWo@?x)B8hCPj-=~(HXkR}WI{eHEyfd!kZ!Qtu*l=H|BtXoo! zIi@Gq@>(ak73vMyVh2L0TIHkr5X_}xc%9&HeX#GWco~2kzA`Lj zZH`i@M1;+;K1@$q_@+TN0H}!#gYPenKF+OOWP#_%N%zk_4=WUM`DskMBcHR{AOM9T z8k~0?0JPI{c*p)q<+bmJo;;M{neQ^Mv6}A4f)K`SH}sMRDc=}o6qb=I9|QfE>aND! z@C6rGAr^j5Y{y7Et_c5C9n%?DDZBopNT#gaN60XNsBWni}G;FM*aRA%mQTUBO<1d zmCbo|ds`b?qLcMAZRkelTfKPJT1th~luPVKT()}tV<=6s8*H?W?j06Ir*4%z()u1W z=10i#^+@8)XVfYm5$mx4o1H33!qZhT9+m#)7c~W|Egr`*)o3#Gg^llAtSSw%=` zMDSp^xOix^W|VSFPsNJ#sNcoK3Ym2IB`pNk)$Q57=c#g>W>yz#Ouna7Zl#n(5I=oR ziJC!!%|7HGNE^eCiG@#N+IS6m?)@IwHwBr$26INGrTtpIw_-Z7T%+6j6QrRYD!{OD zKee7eH@f&sd0y_V9nB}vuh7zkZ$2BHZ|hz*B|j5Z!730C5moE%RJfb}1BzzvRZOHM*!ml@z0J@BpG-Y|_wmnbBk z@`TXW2t4tQe4Kz~$2RG?1op1S!~KRxte_5VGH@HY()dRf-h<2 zfvV5T?GmN#`wyV^+p1}r2>f<8G$IHXJF(u?hCJ~moP#zlk{B)ZlK?ZOB1z>D#ZbTEW- zyBl!Q)iI6bdOea?%NhB`2>M?==NXd3ritEuTFKSai|D%T1VGiG;U}^6J zHye+9+``mZ6Ze@HULQv1-0!WlN>#3VID$`_Xocf1hyi#Rg|eyk;uQr6Z7`MTDw3o- zCjl!cs2viOV!V=prBYrT)4sjf%vwLfqS5Rf)+8Xf6z|lTyItr$L^i+5(tKoJ76J5)*fm~Zvv0 z+ST73u;8^p$1y1A(sdCm426YmRjE65-6wYJPEIuX@tmGqO70zGDXGMhA1b z+F;^mw@0mjW|6*tiMK=Cw~($CsZPH?Yx%(J_!>Wt#mOP_*EOUX7RcNm8K|NB1mT?= z9ik2da6@QlC?AK@6XB(HY41XuN%?AM-guWdYngD;&RvGZatgyCl*Z3WZi*>mP9&`U zrq-^QJUOaF$DV#}{21UXudGp}SMGLz`JLMI&;2)ppf^$yEllXuue#d;Xz+fMYgJKh z%dZ}Q{QN+k@SN)!x6=mmbMu7lY)+@>IH(tM+>~|Aw9ZHBF75Jw%!7E6(b#fFUL$q) z8)Cbog4GYk+ASAveLJ;Ft1+$7Zy&U@v<%OF=`V`vPvj``R5IwR z!sWRy_9jigo6y6<0-%N6t{y0pTrF7`NQeuyFP>t8Y?D(8y416B+)gwn@n?~A?>b7- z$p6tgt1)hK{0!LG5?$G9u1D&#y~Sm?+yZ7i*U9`UDJ&|5hoO`{TW2!X0{}z2I{AzBU z>YR0cOFMf6GL=;Jc0^~EF;z&iY-&^Pp?`Q(-Lxs&w8WP8?DIrHs{52I)j1n>O0i#` zrK4qEO5@3W$Soijb@mV@BqgJ@{bX>_&ERxrF5bI1Z0Y2r3av(DsJd^XAj&Q}aPIIx?ycu4VC9?$kQ z>1^E~2nc*$(h_1SIGQmq1RokSmU^!jok{C{7e53&&<&1A?}R|S?EHxmUkvL>a)=U9% zpm?W+2YMD!D+Cmcg$D8mT`fsTbdklT5Dg%XKwmaB>J>YX93YFr0EnN=s9bu{<~ z7xBpk7yDj;`f_b{%hzqbYK+Z!zFhQwj6rB^QK3zEgmV~k3TLg1Jc{J5HYXJ1?TnCj zZkUDo@H!QaGB{hJ%gDQLSa~>o=2MLNS$mbrK;>-gZ3f8^vzRe;&HPl_7&GI>X$Swx zb~Imx@er3f+Go;SWoJzViCeeK4U!u6bP*@~PYiKfBqa4zL0 zppuz4t(JFxe6z)-p3JJq;{Fj;52eG8{d#EuVmiJ|&9jMNrs9zfS>b__3TGQgs_u2X z)Vt4iY0{vPgl>o_JWSFy*EHY-#&8S5@Na%Zav#nQ+Rb7H_b0!5NxZxUw>IdQ1W*I} z2!rk(u%`B%@EWV}ezIK(PF#w-DV|q;mhHESWn>Z{g`NtxGxms@H`ZrA%Edd$He@vK;pA`G0nx_%`go! z@0Nuv;Qp^k=|u44#)f~4W4E7u@^P~Mq*fO$1uV^Yo{2B(Mnv{in`SvMna3_uq^O-t ze9eg6_ET5Pb5-OU%9yl8V>SIa^TdU_9DB1K|J4u8I}8{~w*;MCynVC@FzIe| zU%>|UT8c+{Xo<6zD>o8146FCAHvJ*!Z*$y4!)NQlww{^Q`>pj0;A@mqP5ZpbeUKjw zSk~IyW4P3RJrYp4&4BxxR(|;-brb%wgGj}OXK&1F6RGzVQk+uWLW)62&tbMzu2Nig zOq9yo&oSG;U5lIsf&#{}JvW#q1!Pr%N8#w2U(cFlC;tq|e^IX}p;Mg>_MU!_HZmfd zVFlzSbAKWy2_EqSb{ozj3u(0}RBWw#O%|=b0k%;wyInE$%`YUk?4pR*D>3M9mBKe) z)dzgF2Vd(yiupxVn5)H$y1dIDWOKWBHf*J8l#8D!r_q8bm*t{^*RMceTl{nlK5Pzn ztiMq1b6F+(oJ9P7?@p}W2gWfsuztr4#+Ps3d_~Qbua2$n9v&Wk#uI-&C~GsHR^YA) z{+XRI>+vR`by-+@B-Rra>o_HEZ!jb~hiyfYH)5!RNCF*obzaWnB6E z*~58Ksit`H$A>M)raH!hg#c-gs?WeG^tJ4D8I5&chqm%7bOFOyWNqaWDxvK!&-T>< zIEOmD?EjR?KR0@_uN;=LaSs98ek65`STf6PylG7T0H=cXlvgwA3e%;`BB}dk-Nvs5 z!q<^)%fzGB*ZfxlSv|llGVNXoJ{?fm5rMm^_Kzdq3K-JHlbEUG;+Atp(?d%qX`q&I zg3du_+jA&RJbp?SKVEkxg+a4dD7UL@sQ%c#6H!3(M>qiFL14VO#VNo%lJJ@Ps|2?K z%H6cV=rgQYZ(`K4HrTFEmEr3wt$Pw0h${zev+mmW8I&I3(8n(E$3+jpV(P+m8#ohu zx9TptdlvKaJ_|g62bG_>49iE>FdWLUEmao>{g8M!U*#5>Q@{4CFMqS16rbwx`O)p}%xJY*v5P?&V;*v#!FCp$RM|H9Al`4e2Th-}e^ z3;3&?LF)B8Zi;D|sd!hb~5CnmA(Nk5~axKrH>K@M#*zOr4 zvN|VN9t<@{Nys=hwD5HL{FD7zGuzdoF_oh!)v=-Z_(Gk9jh4m5ve~nxVMucO+7X<7v9m1a1AL?F=-9+NB}fzlw|U5{o-9RErm!zhfh5yM_d!Vh&VazC z1pm6kqL~;9qkWd3WIVheakd~<%ZuL#_O;qQT*yb@bIzzauo6^eQ>RGVe`z;0O_>-5 zkx`|PF)wm(l5!I|4z-)@ant#KuXRn}cYF)Ivj4pG$NuId=3Q$L zeDb7~;X}z~lYP`}!ftS)RZxHQU7`hAXg#%zi(%>K_=Pd!dfnmO)-+*9{=6$$rB*ey z)&>JC1y%i~^8+J#=NUv?7;&S4R1k~fD<-UGDBI|?{pIen;so#vY~4_ah`2A*h<|)H z+nY^=!y~%zPdvAiVHBS14mB5o{9J%T-%gGt8bcZteC}u0j-ijQi zR&I0)?|c$n9aXFSB)H$DpK+G#1~=66hEwa1dFNc)IRyR`O1blDB-hf^2tZn43y4c8lu zK@^3Oob3}ly^BgPGgoTGKVav%l<#dqzqle-biN{&?{xm6C=^Skar3Z$KBN<1aUZxc zH_B?wW{7zE-VnwabEANkqpPWprsiKto?aXn>f*KZDJq!9QsU|*uGM3F_{x~AiP`sV zk_iT`+@>*FJiW2ZpC9(o-36#;J%ydt1uRqq3qAIQG?0AjYfd z8vQin&Vmjk{ob=ioo^ngZ5dVr>6$D0p0kP|W*xRcDpo#Xz1x;<6c zlgaG^NeY>+>l?|F3E7N*Hg!{hc3abI>!D$a%G8_wZa>$pGAYnkDpFDe#M_T*7izll z4LM9&)6AJ71iB6!Etk%x$MXs7<#U;9IrUnK2WFvpTI{WTU0Pgu0`h$q=2BeLc*QfJ zmW`nO=};>^>9XnUdP_%e!dEHe^UOY+dor)NsL)LM%?^oSr{g4J{Omt>^D$N@B&PFx z&^PyqZ`YqaKVe+-dH(?YOcpvYSK1;<$imF3&=?>(FS=MlK9rzpbh!WLe8w(=KSX@D z^P|x7@kcY>KSu|Rh4E0$&v9^q_?gM+O4}j=G`A-%XdXks=c?kjgOs;rm>%cWSRcoP(F4fa&WZ(2f8Kx$9Zwsh%88U32`UE!#txpYTxXwCxSMmLJL`mrm zu!xVE$Yp-M@W+dN>f+M+S37iw;SJwD-N=!{v0rPB7(|vCA_l=BDWlU^ltP zaoC@l9QE<#UUq-`3~lDCcS_| z9-}{0F4x`*Kh&I$a#ninTHhgTccA;ZCi`sAk4No^ywtedDpYcr52&$hxp+f_pB>x1 zEIuk5;D83t3>C`lc8hZmQ-USq%RiD7>@<7JxGkX}-ZH|$Rf|IE(;VGGE1LR#qJLd8 zH8s_oV~=8anAby_uY?-iz4s?xD|GV8t<^8fYqRZ&rgU%P;W0)n)(l;qGM4I(9_ zbT>nHH-aKH0+Pc}f`HT@9W#IkNO#xJ-9ry`=Kp=?;#=#i^WE%=cdg(1{x06w``ORl z5Au@RKUQCT+a#b|&f+JsyY1|E4*}ZsXa(UqTm#|X8!bPv&iiWgEvx_#EjV9Cj%Ja& z%i3xK@rrLx^C}qk;Wy?-&kvCz_cf}ulURz*?&~KmNtTzQ-t?xpH!H>>*1XHW3e#`y z5)2&^6nrkhCb#A7s};6KGsdrzY#5F-xrXBi=W1W12%obdUY90?GT6#T(-Ax+u6-(I z?H@>~px@kE*#i~Wjf#pggrULSb!uTrG6i7xwpNf0;8!A{I7WOt4#u?Rbbe8c=;{a4eMFJI`LUgz8M;ADdDi@|JU^QxO- zWc$$KI)wUuQ{I%VQfh1Gpkrl8+VVS)GfrxcL1(ezgf_R8vxULuFQSIYBsE!e8T$`$ z%|7O|pCEm>LU)n5J%LTNL`n1nf*M~Bc3#PKri&*9lVHjCa{U2s7vOc9f;wnR)t z`IA136lUIqypE0;QHWQIPtZQiqi0@z37P+k1Dbr_+2w>Gv0mZl?UfOzJ%`5C#C{R9 zXmPiLQbSWFLpa=bre<|rvPm?^zJ(AslfP0beIq#!jQEEaYgK3)X+m;j{(2blwO!*g zpYqXL_o|V%>gxxc*7EK>^P4FFl47)4+;^9X5r}^as)rjHaM$*{DHo;GhbE1WXoYI$ zLU`I;W}}4SJ#2DVfuYC*UN8Sdm={jhOrmz8j}*-(3`cLZ7thdM^@^*d?ZM(5-8Ap< z@+Wh14j!`5b+ksjcT>Hcngp2QlGV-h(`?3^Wu|0^bnCXdORLi7>sc~{s#82V1+z`B z{E(M6SSUF<>_hjeIgrK3x6Jgi8B;1=tX!OzQHYC!HXcb5|oI+rfl*HYJ$tiBL zUijZzOiaUK@o#mGyhOiu2(R~T=ou>oeH4Y64Y_VktJr0+-=rlK5z1qZpMKy@ zsk1>V@ul_pKH~&|)%)t%wj7I;^{Ym*{14P#0Gea71fjkN_)UyF>3Jx5Z^+Xi&ApVL z=M_aoMfA>FKCH1fUU)$;@G{i}&gkcQX_h~O=X-MtH?pE<&6qY9UP{Mf4y%%b2c5_5 z*Zt~{Ltr|bU&s>zCV93CR*R39sRdd8ED0Ci=4rGlz?X@}X8cW2H-O7+k5`ey@kHv6X9yit^z{|>;G^9gB>MJIS^uL1s zol!w?k<-+7%e3#p3K^rcI+%~K8fRFvI9&I){nZ0cfuKwb1!vsBDU$>{1=N~G|9NxM ze2OZ*^xR%zJZC<4Az15>bc5y3lKP*ytqwn)E)MEY;=Otfcrd0<9(J>*p4=pi=AJmQ z=wyj}BRX6H+yaNgy@x`S3c{%}&-8`(yjnsX?)ISao>$p;?()q9k^04iXEO1G_!tW+5;z!<_gwK2#jKH6fsQ*U^h+F z*EHt~qt8SmX%{N|ylQt~X8Fci<>p`cKKn9b z^NsO`(1%$*-yE>|8&IinZX=9V%Y-*lQLw#Zz@Q~rwZ!pap#kwwl6NI*@Q<*Xf*zQ4@t0L! zn|j%KG;?!HipptylYW9mJeLLFGrsTH+eXrZwcoSM;Zp^b%MXvHO+qIG>i4v|dkPiz z2HnmnYL5AJGK3-)!cPx@5`wS1@z-?a_!r!YP0T-zeG@zjv^Ri#G~BzSDuti+iyeNi zF0Y`Z)hu+iipQ*9f9p2`9z;j^qM(Y`7jRA2j)Wu0OCh-k#98JyTnA;!BTf7Vk{04> z>U<^}W`rnlNZjoBv#aq&zkGM8`+1&xXf=^dmpy6zw!L?Jz;a+w`@Y@r{MyaLTpCex zQ8Er%fM=pIyQ6$}sbqamgt@4PWk7RG^3UQOwCq&;G`l~UJAjWjNVo)tnjT__yd-1s z|9+bID~XN5(~^Wob;mU$Y=^cmX~29;Ja9s2Huia5@4_jEpc)|cR1<+@=j9Hh?bdJN z3JlikGXVh*erS40KZf*Y9azK_mD}lbHAY(w;n!3aF&o6jq0KWFb!>PMrB`}J#_#CB zD*YJ)$)KRM8b_kjpWIrtiPAPsNwk{rROmyqqi)dVs|0xfgPLAjrN;^3i4Oemj%y4-^F0j=75S%Wsgr=WJlRiM@njvY*8|lbShe&(6tFNVGQAvXOdnq5aqs zT=}q_Von5UD2gHi_gV6~d-r-JN0RiDnu5~V(NlxMM<(6Kqmta}tv*|{P@v?jy5Q{x zpHtY7DPFG(zy!^dnf&RWJ?JK-cr?mMGeO3;+nW(qCdg(n!Fdpx2%i2k2sZ%c)^n!6 zH<;1)9}KzfBnAM6{F%Kq#}<4koP#2M$Rb}Hf;dbJe6fXSz9{TfU{)4*nvE4eLtOV0 zdzTqJ&x_*GKKBV#_A6ydhD;lUF9(@1A~=5AYapFh{PObxmfTz&k#T6WnYfvudi#f# zy%yDf{2rlNAtN04J=0`f8BL+kRaUNpCYk~(1v|BMgZYhRwvk7;DQZ<;lIgA27C5GL zW-#&j;L*6J<1~A$z#LT~p1OaJ6C3$-u!E+Xx$KM%UGv?&U&RBT1S(sHku>aH#M00* z2EXTg^RoM14v~B9f#90J`08L|V-px?7v|~cNlBc%54RG4hz0JG#y$P zK%#4Ti4CJjgz*a=d6ofm$|fx;JgIr1-gX9b&G)wJ>CPf*D-IQXadDC3v~^->$a`y8 zV`$M`n60Oj7_jBsc!inhY@313vw8J6+6+`gJ|v_M3&aEeG2q z#Y%Y^7@?HMDLkUs?v`9`J%X^y`gF!A@AmE>ct=`TBJw|6*QLpGU7GS82i-BW2J)k6 z{*$>DpU)l#uh+W25T>jKmnKP4sgK8mQ$NU48jJW@uMeq~4J%$Rbn%4*oOJSBSD0zW zdOTaGysHzXXJEi*r=n9My{8C(m38mU`<~!;v>#BoYs9!Crxp7aECsA1k^0&?jSX$l zB12yr^0oIz#L&fE8R?W;!0n#m;^63L0vzqfouB(qCOp9XB$n#lO-@OX<)4Bc@`4ep zA7Z{zkEaPIf^vD*R}ZK-f{j#S+1^hHvA@MEx}!CJ+jO`oa`{i_Ed`bpJ92#^{CkM4 zm!cc_{NhpI9FR04qby1O8cjB|Wi&T6FN3-#^uJnoSCmIQAjM#oujnobFbXQnEV!Z~ z*V!m%=Nv+3QJ9tmXJ1i^YDB?tJ_l3Bn<&%LqSR;2b)hHOyu9$}? z>)4y#(%Mxu7&Xb>bf3$9*u|&>WZ&z&q6qI+Gm2w-t8Y6CR`^}O3^kqQp%omEH;qri z19J`2J^jp(JHOGY#y|M1bZ!o#(YvMpN zmCsDzhu6&k<+(G_vcMBcL}cGU=C8F@P^0`?Hh0G9y85c)$-e#L^dB9B^$iUTO?6Tt zLXv_qW77PKi(_n6W!tLcfu@LBVWdLhD}c_z{Z&r8XRM@BYAzrLW1mgB8!fuBl86=s zrY(7y(=K?faKMSJRud;*5LYEPm4zZ$7uL&Qp8bJQGo({(FaL?ugJ}i1{n!(g|NXzY zBxDk&C=_aM9<{ip9qcbAlDBy({LrFxPU61iS+L==o0%J;N_$wb&uE~YTuH|+_Ld!V zDr5KC3O`fjm27f;kS z^Tr@3O}|p1R9ew_jE7+?ji+$?IxOiE?Yx~(IN?wEnLBj;AwgR%LTNEhkH;~_o5V#! zaZm;Oq|}kC0}RS6CNUNN4D&Q@kmsHa8{fuld5+QYWit)Y!9>~E%O|+nU~&HO>YBx~ zs6O&=sbE675Y-Grva*`^ZS;y-)+E|S*phaKkPYGq%$ zl>I=J+v1dw~9HfI3 zrP$zy8%Ex&dLxZ}P{Npn;|y?T`5S;gSDYO! zEr9bYl`0-SKETNE$kjP9zc?Gij}hMapyNjTH!n12cn)q)tmD49Y(6a|8f%P}x5?Y;VZ_FqrB^u})#^9?_0*nVW7P(H+=@NEYDBrrs~Xxi^G^iyyL@Yg*v^ zvSK14LT^OJM#pkY{&>g6w6BnQjWXS>)M9B2|8d;qLS0r63k#JnjMYZMuhE2BTjXE$ zp0~5DDmaxFTn_Pp7`l^|H*jTll`r%0l$vLaQn(p%oQ8JiMAigAKkun^ay3 z>pB1|mMXm0rZHBz!$}VI2Bj$wVZ(cgNF(XFEaV;NqLI4kM|U1df&YnUKtisbzu5C? zW-_V3vMpN*SV$xb#8UpFC)Wp&5&1>@Ib^`H+f7uqPg7ijd77~ zZdO(fK6ROV$i$fDy_MiUgXo+{ZHo-lDSNs8_JE}q6yH|ZllkL>pQSav^B8dkQgmk%T|)XT_hBy@m|Re!%gW6~RvTz{ zV`^nC??{xAGPGekPVgs9X@GreoJ_DUxofa@@?i9{uF2!c+0{WJjd6(U!F8qmUhLre z`x;K^o3bFc30dQR>sX&*4Dl}>NxPV+1PI^NX*?VkX0(Zi?iV*lU8UF?orf6dxtiGf zKmJ+i>caNhmY~cJ&piaEP1WCg>5kpq?Le!^wsrh#&{WijlG9H%&?QYz0=gV~_V-#J zOK-bNf7b%)=2ED)auipzet9=O#R8rhwKIt1hMXk*bV|xc8bVR8&N7rZ%Vg{VBq`5h z%JzCYzNVomQmpU3U1x;3ZoCndKAX#IZfU{&yS#BeI650(uxuHs1~dFPM50oI6#sO( ztHk@TM@%=x6MBWR%k76s>xfqJSxo7;MYJvrR?zHxC+Mih$Skd~15WcD{VYR0%~w{R z<<*+X1%+2cgnn_b>(98Fa_t$*aohr`+6D&t0^O`^t!w-}eihZ0K#N)npsJ?kon(C+ zJemP6HAS#xv>LiMFH;L9CrSWEVpsbjdtN8O4}fTb`fU0>5vvPG34hx6RU?=A+s)_O zIW#lAt4h5)y4bqsbLe%Fj*NAR+HbbbZ{$FNInQIL-a1@#s{9Ds9=Aiv;6gw0 zeT3l@^A#0_&k!7}k%83e-+^b4;9*o_WWggVFPX*LWB5K!3XA$* zU1+Imdcc@>WWkrKtOm-6|h^Flml%lEWSuwINj2KHKwIJKwc zdamvYgIdSC8g5-&oYSX%;xV7v<8p8Kh;knftA&i0X|Jzw2S-N2D1p$SVLl>|M#I(R zOnt+E^IlpSXCRYBKgXKR+#;cI7-=kJifUL^?)ro9LwbFDbaGKv_1Vm2^4GP1mTsGc zp-K56Q|WBIFN?^p7;QtnF=jGo2$Yd05{nfUQH06%3)~o`H#~PF6Lv2~W1wX&e4 zTL3qnU_m+egLLRypVSYz*6g)tmqxO@ph}ISR>b0hy<_nR#sLH0eFZKwd$|V zXBz6F5Zx)g&2Js8NusZ@^AS@<621I1sx1kT>yt;7)kwoa8R@yHLU!+aw!-y>&t_tlnO`CQPwx(ug z;`Kn`N{HbhKB7boKX_Ur&SC=mZbJhB+z7xx%)?hImueNNBN_|ck@_t`tT5c>O}rcU zhHJMUf*B1pFNEIVt{lcX7xU(Zp~FK%?~p}HQws}IntR`UAdaZ=LZ> zPxEzc8=0!m2`~!)c%{E)ret)kYRPs5dpbI6fxwMoL0RvKSi}z0v6=8*6GT6D zvHA>{sAwQw6(r2J=TvgJLT3m3?W|?IsPG+*7hjNp;U<)ysUtDou!N+|pNa1Fq5W`1 z+H0#ATsbh&g-w*WjF=LVk`NUac^(!$VyXB`*xNI}2VP%WQULwPQMG}NOk!u@u0X*w zAXjWswnDrHiy~{0tm^Pdyr$q8;aIzU_|9-)6=TpbK|z@gL`y9KJfN)8Pcre#><2|t zl3*ksRaokm#S>lFwOh7?Y$)iTCvi-5_ zc+JHGq56a>&)93d9F?^DVQKni#xG6UZ9c=-Gs@2%-DvJ$v<*%M>Lb*V*N5PwRNcRP zy9Wo@IUdg!z}FRGtx7$w=UalfJ7!b$PTq}Y=-C)!Cf2n&sSn}ZbH#p+RT19Zy*LGXliN>jf~h#T#mFL^pSqG8nT&#A~km=N{RAFC3+c(}I-jVQ=)HD@s{PSqay1nJ- z^@flAvZa|ftqS0+5t{)A=SCDEpuihjSd-IO-HJTY9P+?i1LrAbwbwy!&;lXvydvN{ z-d8h$TFIax+r%Fi$At8{^$B4`Hs>ZFHM|j1n5~P|;Z|OzDlabhSHllIFvNa)OU@FN zJzDGd+VF+XCDEiveIJ+efGx$s;Kmc7j(}k-;5b59NE||wrx}!8bhu3_c{|3+-Ter zrFt?X{niIB$g8E?{a0I2VL`)3U32smhH)G5i4a;NRwL)WVY@{E=Q%9mdX8;CbDjBD zy-3hzymm240aSS~vRpqJWLX8Yy}jiozBFqs@je^|=y*$t<;Bcy+!bgm`YI>{+t2)2 z*}2AkdZacmfJR{wo}90d25l?(KYmacC@&M(29;Hl`p80Qo{V;L%Twhfuah!(c8;HR ziKMtc2Ru4#oD;aNTkI{~fc|ZUq6~(Y!W_0X=oJUKR-SE6`3~inMX^|xMP|TPrFZWIShuwU>+-q^%y^JRVdNSfu^Z zQFm+0pk|kcG)e4*%khndFpWdE7jtDqlABra(iL^k$uf>)tEN=0^8Y+5^R4 zZwKt`j|}}2CQGwimC(&X;QLv=A=|X1voTsY2G-~wWvc>{+bRfko}$ufZW8LvryT}L z$3wCWGHOP;lyg=l-&#S%zU@fWf_JPLx>J)PjSc=62?<(*d_2&D4ZV6ng(^OtO7+3P z=ifAaE}!2&9xgfR(9Ti(J3Y>xxxqeTF4fg&c<%&Hbk)Z+e&L|3;;@YKmO$kxD--6t z7-3)Y5|$9dNY`e-m&Yny2CXz{9p76-$w;g6lFBFAKHEkXZ6!Rh#W1jJxqf59>i2E| z`}xVlf(t~9XwX0Qv%Q%)SFexEzK3Ire-mY;Z}tmIw5SNb|3-eb+t}8C2o`O687{R| zTC!##hA4=gLBNuQyv2;U82^&=Ns~g)@=9M2v3tuut0@ul_CuQTd~bM_a|ldyhGB^I zJpZ;Q-az*5-Xi>NbtD{hmBN^JcQ>-_ow!AaG@#UgAT3gMTPPCxC+E3SfoAK^%+^Od z&$I(gWZXh(;P(T|4=0j=v>L4FSJ%y)OjAI1tZ0%k0_>2;;d2|c)vb8*v(1F#UrlhE z!{4Lly-Eg13+Pr&ce7=~2*ecyt_ynu$TM)(Z|vM{lYIg=ijeU^HS>j{p zuW>hX81VQj{|x861OnR&*b0)E%Hmx5bTBdrvAc}_@sphQS&!fB+R3he25czRVE#%X zmk-P^QYmc`w4feX(}a2_qC=Rt{oLLEv(kRHqs^F0%3jaG$@`YWF747KYx(y-QI6sK zD9!NC{kK;W1}HLcp|>7R1O6t9Z(Uw*K&L0n;CZpck+DHksq!CK)J^>GWVjgV8e;>rZd0F)w_#@y$rC8RLCI5v`?CCp@)qX*!kM>9!*E5l5Bdu2ryU%t? z#s-YtZPS1L8!{-L-gaVmKjyvtOBL56@B%E)<(QIy7~$T^D5tEfYIHR8&vY@NWoTEX z7!7WI+w7(5oRgFIkE|^FcCXl3YWF<4#JWOS{hI^Gb^XRA@jn+uz@j)0{ z%|jb(!)Sd7oLt{etBx)~HEvQ+^Qm>h3$10&bQ-KRHzCztrp`XWQ3Gmwl_NQgQ+#QS z%2zDz?bQSl!Od}#P1?JcxKU@CS50Fabo%4LIN_|jCtqxx>sofr=R5#Lt^@iI2_V9! zVm8~EsIjlP{^+t#1Q~7J5nv2_TUy~3Pj#pn&Y!7XEG46Yd2d9JAtu;&KJ(R4If9+~ z-j}Z9*Ai7-Q)@Ixa)`VTp9jr)Oz%Y9+sm}o-=7tCZ>23Xd7_%=9F^6VSsiRZJ&%x;a zU24Sz&g?u)kYNfn!Jx`BgykFkP-)UjChVmt9|`(zN{4O+);qtAbioX#g`rl`dh&du5o>d6*Gwnhs+nTKvAvO9^a1$}1V#i=ZO#!{Y=jEpOodGk%6 zS`9e&60bAfybAH%wa*jS{zBE>E(5+hH#VYDH=MfehY`L69>??c?R2Ywv5GV(RC`F( z8oWu8bIh%0Gu;SU8t8!MBng@*rFg<-%5y~3(wrLd&D+~4V&)nnfiQ#6&9OaGQ-2<4 zxzH|7twtD29?r!Pkw}8tz9=|OKVxQ>0N1+I)=$=ghjB)0gsz4@+!CgD7pKH~4o{ zUut1hRZ`=jR$Al2@sJ60m&&Y68)JVtoq!K;kP!A0T+8c%2B65 zt7gqsai2=13ev1jK5AiQ65a@A4)j6n_O?Mi3{{V|>>llxiL&V19g2V103qH}M}p$g zH5SXWNM~Pf!S91dTWV?R#HQV_XNH22N*Q}&!kDqtD zA|m>#>uX9GLX5OsIWLksQWM8kKjv^IYHbF*VTdac+M_k=0ih!(7TWAppP(C$f;*=M z7~~Q+v~P4zRpB51_xUtf;rx7agI&|~!LSHKAxxxMiZXGgp>=)nSzu@N2WA!>u@c-W z#JG8EKBH#R@5LYX$FK41P$_5`3@YPl$NCa zjZJ6})!L9jB-e{i&b(H(un>2L-G@1+H*OM-nB2M|wiwU{seFMobYC(JgE2wr{s&L} zs!H5etm%nbr3-NEqg=S8&gC$bRCH&xQ*kzWXSz+R$HJaim8O|V%HM$4U(UsrSnn>m zwCQpgl-EzBPj{roLUT>SPR4{5(oNfvyQ{txNiLyEgC4{E+R5MlvLW5p99>=TbjabP z)(RIUQMJ=8$>py=qmDbQj>=y zhV99z?wd4?P2_En!UaHA#AlC^BYYF#FMDz-U()hV$Cqb`v2J)lxjx$E(FU9?`#lpU z#{wru^2KS-_c2}3R*O{p{hgm?9-N=GyAi)Q@@U5YH4Iw*0YT};4RTW?D$!B@f+v6sjgp+v0#bsFR zDSaySMbY=GmL3b}lb>>y_$ZxVP`1~s-8137q0cFD1}WcPpnX;NHL>Ov-a-7P=g61cC{TP>-pJF)+{lH${ z1wU+>JkVvh^C9R5rVrg=#@&N%!Q>6$(7jz@V$eM%0(9?xf34X_6T0{3#sB+jvwLR;yX2YH2k1d zFP<}iy<998g$S^Eh?VfERR~%lcqdFOgvKCJ%@?@*)=YP8e!}=QdB|oEQC1I)ZfD+l zBjhp9f8Ln((S``Uc#aEqFG&@8{FAIV?9Za^<7|GCLpQJ}6fNc4gGLLxk*_aUSXe6Z z9GYVLd19VDW6m)#F>&k`R`S%eq4k#=#dT+y@sy<_wI!LYU-yk{bNg_MrKDGPlJYI} zF$cw^J$-ED3aNM*<;r4pJTws~ic)ykL0qNh32`Wzh` z#tP6^CeHGR8|=_k!JDWncz&v{cPs2G^;pOe3%2q6z*13<`}7Uz7V}hr_o_=q+`Pi! z!-u`$*$Lg*m?@Hwzp;zU+r-QqEByFOV~ixVS5Hrm!_sGNyc3gc(jHeIEn;Y3&=q&< zt>4M2V=}6j38r_~^YSD2@bN9@6a!hTrs)cFqv>pO|@!~~GOUv&sw{PEG(FiC0l5Y51S67khccw6#?`jAa zp+a=(%m-9^x<03XLPu9xt!}`XB2#K#X|Brls`4uTualby8=t$MxqI{ot}34WmF;LO$I+%@IKSL*!A`BGD&%L zj`B^E;^mNEW?vswJ#|+o785Z_jZaKUvLPkz!wn4$&5=n}L8iCWsT z%TPJWneU&%@4|}OMA`pN5H9wMiX1c~e|Y|UA6beETS(v0Q#dY{Q?(BrqmUzhly12f zQB>_vhn||<&qg`v)H{Gp;vuqZm zHDk6pC+i-Y0~?I%?d?4s-MKw$CUf=RT{gqyXsK9Mil}x}&v66A1^fOoFAVN#70*&!BgX{useVLj$g9y+wNyk zdFIWE546Zkp?QI20$01V5OowFh==#fvVE>g2R za%Bb*(3$ZRJ!+V>@JyJ~~H8f%mYO*ti(!US+zXA566^!}Hp5;ptCk zsgeL85~40DFJ94OzU4=rBERn6!_5T*zxHYeg}91CVAdqLLh9NBbxpj>8HLhM)eiH9 z%wo1dzQaF%E?RpW#Jq=PYs~iRo!e6)+CP)O(*A{c5^F|Gda(SoRqe{ugyoHH?pt4x zhEhgKkVS@5yybGsLghtrhkW6}C^kno{owNt<9$#ZQ^ck33X+EYq{3 z2z0M1==y9j*2%aqC~mMQ=;mm`&O6LXPIwB84s36wREdNl$%s|uBeBSK;nki!dwSqw zGq7ylNef4D+qVaBp-R)ae5i0zWS_|8YSj~8h-?cOS;nK`aNZ^*9xxdoIc6f?>9h6U~B8hMhuL&JK54N_vl5L!6Qr%aVK#2%#k)6R_ zN%bN-a>9QT^6I=y(Zh#3mfHLb$RbSZyw%##!iVmr{cu!Rd1GgZ@j3I=^WMFC)d3aa zEOc&hbqDiR-zkn~FM=~npGH@C9NM#p?$wj*TRIZNll)r4mhO+NyFGO@DH_QaQO!c@ z7pmr+jNVBm3uE$1Dh;`~*#Y|p*Pg|)SKs^f6~0!hK|Vh+X*t=e!+@63AAwBz!+C$$0O4lsek{?OxB2Ub5KK8hL$;fX(Yy^gaN!uR zreL%R4r&bTGPhBvZ&|2qK9$0KX3Z)ip(q;X=g};WoQTOX1qhEJ58*{Y3#eU3e_b2l z-dKIZu^^+V+84JVvhbS6;b$S$8f?w7 z&ln>Zt553%{U~m@Qo1{_aw_NP{Tt5Z$0*oyd^nb~@gyOo^8RX363;&I#3P<8s=`@K zr!@*J4C8XzX2({10Lw#;=@T+8ADbJ%%k(9w%m*C4UNqG?oZya>y|dHFrlp}_df?MS zSwEMX5cOfgj?1By_db%wbmpy%Rih)U^#JHt!0vlwojG3~&ASwQmVv?E)WKgK9p2tw zn49%0`;b7z*Z)G=k*tu>`!*V`T5(IXUj+yMe;{e*#`a*Jpy}tmxjh7jYSl`2fb)0l zs`(PYv_#vv1!%>$Kr*-im;c`}tp0yq{nx}l@mhZnHcWmx;qdcnK_>5lMg< zAe0S_00k=yn+5&{5zOWoP+;>v9{AV$Dgp!Q!8t1@TW!xa6F3Akg9PLpFKVP5GmyO; zB8qTMxvNt%u(2FkbNyI~JLNVfu4?;{(8KIQ^xeaXC&I*-2s^fgZ6ln80s^@6HiRa^ z`4Ef~cMm4ta~(#}ooc3jws)+#t`!HD-^FP z4x)AN;#eH?0JL)OGUZZ3Gm%vQteOeh#{YdaU`QBxZecLPrm~1fGZV8ln(mP_UN&Pz~H;Y()qgM#{IZ z_xaE^gL8{5J!M|{i-wVkJ;689k}zT6 zGgKFOFjjk+@6T@4+qndn^#(1@DX4>ZlY*e*r>a#IuidN{LvFrj9lGXAeyQq5+mU~& ztrWJkZTbr_MK=-mhcDK2>F|F@`tJ>G`!}N~g&dS{R_@qm&jeM_Z1bI80hINd>`Cs1 z{gD+|#hK;=RYi(~#G5-;d1XO%0pbdScz~Dx{PTx4U=!N_c>hhmt?5$ucTl8NF#{St z145~M8{Y4;+yXE9$k<&SCCDW`Qc0bqd=AjFSt;`825$q3BN%J0^{SldiYn1cbnSH- z5wf?|$F6E@+Z&u%zButsGV0j7P|6FD6H^b=15`cmxq0VWD_1gdm&R?k|6TzkJA)^x z*Jf`Xj9yDWH??2Qhs>I5cX!M}JG9!^~59zs)`Y-?kqIUXbZEbB!Ty-n|_ zxFM;`OO!zbl}h?6Z}NQsR@otcAEjtj@k*b8fu(bJKLq9FHs=&wZie7u(^EG-?e*X< zxZW|N5#I4j5q+JQg=L**+M<1!x|{vyWp4BN7s}Tg6o1JdIv+9Vi>+5jY$+6MIZL0k zI2@*ooxw1*U)Y}-D_osSo{UpKu@Fclw4-CHnA?#VHX+=QqC@hO>3XWvF6a!g{f&IV z`Hj^Si#8`X#gl7Oo%a-n(N?~2SP2JkJUQRLXk6ExTQds}%Q+aP?*GeHN2eiKE5g>M zIjgM9zdlMRkaJT+Yp?%BPx3YV;N&m=qb|&4Dk|iMGR#T~)*OIy^MAz(*%-<%CUk#7 z^z{6P3xW&kYi8ZwX5nZ~xcunNoI&Hy9I#DloTtH4cP)QAnoWDjj&ozfWoDex8slo^fO4senzO`)aLOU|YxneoI%uZmf)8*q>h> zzt)R$bcpO(UUt6`%x~Ws)L!4OF?r7=TKJUz&foR{2yv<)q0J{GB!px?v|jCTaF055 znrtH-95UU*S}3a1qX0x4)AQaHeUqrIneH|Lt|{1@E~gFiIl1iKB3a?~{a>=G6&sC>flYxqWffY^9; ze}0R7t$hCc}na;uZAlh20+@DwNI4Rk9-Q_4NyP>f-GJ?Q6 z!_$*p;6l)f=x2yDWIRWt1Ys{Pf7`WR76zQ+rdA7Ohgnw#2bh?25sTg6=w@cLaTN@> zPKGgoql=g--l^Z^8avO1Tl(t^B<7+5gm5QpaO=b9Mm%QmmMoh3<+F{G%xas=RnJ1L z(aCSIwSrkhEvh(VI9@XR6P#kCX)(!};M)1F)343qbS^TGnmyX}HvYJWM}6{av3YJp zcU-AZ?{XcAyFykr(xVS&*M5w(X#Ud5c8Dt&``UL|SszM$ss7k0nQWhWwB(Yl>+lKs zqA7=Dnd7&3o?-+m<`ft7EHE*4tQ474Q=Pi)e*FS;7*%<+BT8>Fy=g!s*sSYf^S~7n z#=JzY9n&92{N9NSyrYaOjyNr%1eSYpC*iY2#$P1Q+adSu$Gefd8y-&WXRhnqdVk)y_ z`)-Go3H>hy0ogPohT_>mdzV7iOeP)|c9pJv)O(3{*%v;eF{y;EZr;}wO7)KTz#`rE z+LymNZ}yGTOL>pfNarQ1X!ktPE_2F&dFkZd-Lx{(me?k(uN5V|2Z)ZD^JC`9M{5v2w`WH zi%MvcDbM?1Bzu&D@J)@i;+-`NfG!xi7_K5cwXmFxX>Rrl+S_>7{KyGn97&n5oGa6J z(8+iDwRGC3itofk!Fy?&WHh6xwGFpj*4-o<9lD+889Gbp@PnuOOJdMyJ=*?j3x^@PsJ7^N*oj&&Ryx2aktVNmQVBXL8 zA2-m_HMkD}Rrn&z(?mtJ(4?*og@M@88U+RM!lx$fjb8bYMfRk%j$(<@;v)UAkYa}^ zt-N?Q)}mYUFJ?E5UW_NdDo@_RUjo_0431m0i~Kjk_>SWpYCM5PUVKq4A!x1HN2mO( zHkxdD7!c&3kF4D2SYTTCM7v;tahiP-L|P)MO{EJO76v%wb{#n!dFT{_W0d5+ zYA}AsSI24+Q_;!SA7`!kpb3Z;9aUcY{gw@;I<%vpzztPx5kJ>L$-6g%v2Y>zWqkA_ z)Nn$crd646zVm+Gm5M6B=-2p}fhS&O5*67(w38$3Z)wkqEHe+&?&f;1YrD5UxNSc5 zbElc5q+qXF<|)n4jipl-KBINh=7)Ux;wp44e7arP7Ussg@+CU9IZNAdG2DdJi?G<| z6CK%8pWKg9PXrpXX_DJkzTJlrvnJJQ6A*3$qb~z;L!$AV-h+pmd1z&&E8(*Ep&yvP zu9dpBuh}V1+UA+{W7-s7r~*FIniLN4xUnb>*TT*H-VOioCWvbXrAYfvUDYb>Jfl^9 z49RoVyx4FmcI}qxB~Dyx+SEG6eWiW{IoWHv4F^)r)%$myCOg0BJh3dkk{+rQ&+jwf zW#gCKFSv)0QfSs&2h7~$fuiOgY|KS@v?{k!hg$ll71f~JlX%&98Q*XOLmyUsP3DZIJg&I}}zDQ^o3R7|1nJR7rMoy7*expm_W4lDA2pEz|mz@9ZU1 z`*9NYaIDzlbY>N;)jw~^k)rydGznm)c)Az!FV1Xf)m1EahA1)*`e z5S~fXR0zir*Y74Lc_!EKKIf^-0U)nE>m!*1?CN(TU_}W%GUA0sK+8*k-s9($=XtIQ zuxuGd=$V0zLM8zo@>_RYz7-rBs zu$%rp=UFeEXrVRr1Qp-mR{2-<+Wu!7$wD`|iu?%)bp29ipjASS^KD&z%tXc4XIsOM zXn0R|1NH20q7gjm-MeKC<2$>8oyH-A;0~A08|Rh$9P1aX;$w?{!kxZN*j8Oj^FfP( zQ-!wf$Fi(vbCTzYPmEZKvfoBJvyk)R1#qpu|Zn(Q* zG+|@5$s)j%_P9`iQpu&dgdWP=UBz1C5Qv|^wZAQvkj`J2jal%z_XCf5vk^$<8&hRp z2U;~L9geajAFNGR?*j(4$dO9o?HC}4X8C3<#3Q2OhXPHaALKI)C*Ocg~!I2|8O0UWHe!73Y&)bfN0+mm1_h zjewx=Sy%--9Es+`AjD0t?j-oB6?`DMkE(G*BsiJ(7v1~f5>TU2^DV}Ayo)ZP$LaVk=dk@Nuh_ArXMLnC<^tcw|Ftssjpj+b8 z8UR+&zE@tUb!AZOdZv~S3mkc!>s6Q33^9Oaz)QGNfTDox9JRbTh)YY;N0<>Qq_Psu zyz8K-8CrgZBO|P04t8=lKkhKl5FaDb@65J%{3JE(U2M2(S~@mn(zWhy$S<83m|MKR zjn*7B3^z}mHokW=x{1TN^eGY7?ARr;oAy zIka`}A4CTrKp=NSrX?V?W)R;u#<_XxV_x+l5s_OijLOv|?jx0}{@yk%{WUsd9 zP33v%iv*yDWOfKbR_r+H--NcjAUQJ7;v<29+!HSyiled*Ox+(q-KOS7Mj`|Ar-pVE ze@d`3|6AX6;A_HU06=n+sUNA;d_U*fcV~MrcVp0IeQ1k${hE1HZ=@pyycXJy48ICeGj_6tOx@2c?w z)C2MGVvc=fZGbFIP>+ffZbYMgCigO3>(#az1G4WNCSC(w+$O@Oh- zEGF(udqvvETT9(|kY}yQfj56M$3lNEN@y!A5j3jFnaq^dYc)5D_g3kya=vGU2O35# zMBxwQCbbt<@4@*Re|V-&gl7xh2^%@}JE?X4@WWkt)h^#=k3+G%P@)g+wVj!flER2? zKBw&c$4{ul6h-lIV&`lGrC^`*bJu(LY_?1{2NPCjm%g{%aFt7~>Y7e;!>(ZvfAkmM zDv0fIQBkO&hsgwSKNXQqOwBGI`jJwy5c1he^+_|Z0Kj^xbU1gN^y_G=^_QQiOQ|a5 zN&tZs-Hf?tSHL$qyh7?Dzww++c!9t4JNB$Io>djTS5R(aRoQ&^-|1w>D{DG&PkfI@ zBm^71qGxfCTn>VoU8KJ@V3_%5MX&26L;a|VyE(=7eIR;rR#kqH;LmdqWMW}hSJ7nh z*AFa7L*MQSn9ZtB&JrLkXr;xo0fM?el@}wC&5p&Gyl#E*G|=syW#6=^bmMG(HZC5| z8=Qg38E#P6$3_vwJB{6{rX$VNV+W`O^h);;9N@nB8?_=%ejJ3MWmZ}gkfDf8KcUib z0sFI@7LEFxx=Zndu#EGdU1kE)DCJA@%TF138zzGI{)nb|GRVhmJd8f*!W?a@ z$ebbC@9tZW-dIjA8uLK)!EtU}xY}Q*2&jE_hc7FRmRS#|aMjbOcaG0ZG^RgD=kB?p z0A`n-F!0rmv+^E%JWzhrABUG3L4rKbk(1`YL_9Ke)s|#L^Ch9WQLe)0gp0tu!Few)y>bM;?YsD)jgf+|^amGpQTx0GH| z*=nDL2#iqu(~%k;S#56$qx@PuGBso)eaa_3wsd%BM5J#9>1i(umy0@`{kLeLC?P|! zWF=?y+2mTE9r0@s@vLgfBMo~$UTOtTKo(3a$)GVGrVdr@|tLMy*>5L*RP4y%X5C}Y^{jaK?DU5^{1nN5uXP$0k$j^WxtXn{7Ris7^_3(i6UVDGrK|FzA0~Hg?k1`-A2}+c))(4e7@xtUsjY&G zleI~Vi7CcViMstG*i`Mt09%j;tDib`+;^tdZk=f}YbJN=;p2czx_j%j>cq|WGE;8# z8lub;StdxobQ-YkC1|IH2hID?*io0G9nO4E=W`85Kef zI-%s~1!X*~+mpUnT{*UG(WH@(bZE)weD<|dqKB&IAlks4>o)iiB4*=s!M+y&P^kQX zV}E`B01l66MQ|Bcq%<}*iaiXn)%g%E7@fl$JiSGz^^@w- zB%Z~4e|`M{Bkba&yi?-L>n6x0K9?V~8_`NyUv!=w0tDcb{gTP9#( z%Wu+PAicXgQuw5lN81z|7cLnDtHRv*y9KR&gnqt@qlgRksxp-FXP zA%uU zj?)_kY*m#b?(jbg2hh*}8*Vm|Fpy4%*CsGoFXW{ax>5U}y+UGp0aL#;4*% z$qmg4fumCY8Rnmo?bh6zT!270V~tzbpE1@ZTK>N>4l45gM&!RG2v`$&21~XIw+!xV z$vN0G6mD&a5Bjk0s>p^>;NqJ|AONg?)B!xEbr{Nc6zM0i{QK&^UuI|yWWBZ`kAGI8 zeH2%te06!*!*tjXOIiO`dxuN7C;DA!ayTnwFQ)RRJ=}w-;2&R*okHpYmvX^NO`lS63Iz%LtA3!&EN9 ztFBMeBSgMFiofjs{9&`3c=T7n3co3*t?|L{2qBz}1^#;fbG!O^4Ni;NW&*ck^btwP zO$*G}gUUnLTIbCtgZsnRXEFl9PVT7xXvQsNt+W@CPKI_OD94!S4_aFS98YsybQ^eJ`bV3#iImN@|K2COhi|NPo_WPzk_yURLn8bC z`~I@F@LEvQ-&t1FF^YSCW~9TgKY{8|tx_`fIm55-BuB(ylIOX<$IB_r_p*P)3-(My)e}ZU3Ff1? zGSOf3&u2x0q%NrVKoKJ--EZ16-JKx!v(dB8!dsc$B_$a+^9-Xk5%HYUyDi&g!Jq>B zZ$hDm5h@@nUX3nH@k0qFd0R9A;M}2dIdf5L!t`NLX3@*o?i_5C#RjMXfgF5}EYiUW zq%9^0^U|P#(sl2xO*bl~ujN%oAN~x8K0#=epY6asfpe=0l3X7jDG4H873C&ly}^AFD~SE_;Yu+|MsUL1 zrH8clh=st*+aUuO5Vk>?^M>&yEi@I>9p*0R5aKG3Ai{=kY1B7_bF$gWcVG`yG~*Mi zoPK_3m`pod=O9p!9(&>I%|-Q+(3?^dL*5{Heg+xfCw)Aq+}&fc{R!aP*ZPkYe&HaT z>&d^da>B<})rz!Eyhf(oYvLjh)%-3JW79A-k0n4kam!F))58?h;w`a-FRJ49>Wf?w z#vxi=#o>Od#vG#qIITXk_>*=PJ7Scbsx?TT4O@}91p0>SBKesU5uXl{%G~3bW?48}CI(&?=SW+6d)$=}Y%3J<;JYoyTGGA^D%4PO6h^F0n@QsB zW{+S{f+8RX&@ZJqdIJNc(EuZsV93HuY@x0oj>U`m(4*&-BXs(PQHFLJWP6a}&qW7G zaZtl}&_sLY2@)6l)_aE3BI}lUML~6yLufc5aJJ4Ou~@YN*7kk z2NQTwta!VyeS1D2BjC^p(%(rR(g&AE>zzuz!{1 zn9F0sOluV;QY-OYb)d947xKJB$W}p zoQx#HE6}FZ2|WfYsX}?}JudfzPHRZu=I*-hzB~0sd5d|FnYmQ!KCY%%i0dx~C)h*P z4Yf>r-^Q^RWxsVpRu=?4umfU!<*kq$-z^{x`3s`#>C0ENZ08bPT2!M#iwRiVz4iES z8fNp&f;}yGjlM3mG}+=^1G$1zV#cak6DB1r)C?(F`i-6}x2b0+PNZ)1$An{NC)`Gd zt_y6z14ce+@gTg3T%FoI6ZkqP?%x_AbU182gmzCT5_C(v0vQX2E#Kl8f^t9<)O$~$ zps+%H1cSR$8+(4pLPtM$7&hW6(i~EuR4X65@o6{HAB) z*#r$+@CX8Rn^-AjH{o?ebj4PNaZ?^aaLpYju<2tMDEhazNOcnI+du~{tNn2R!0~c` zPK0f%L*EYphd1;~oMj=h1v*If8#t&~!qy1kqVv?}_l#=6pA9ooI(vv)X~l+cu&TRaE9 z2brAbR^J^CczXT>kID|R`g1u)I_SY@UGKa2kMkq;Jr>n=GzbL&&5c&?re*_ zT)CW(Rf27%YlW_>(@8O{Qq2LLXmes%2wH(({ur{q=hbLp5UokJX2(-g7HG-8kv$`^ zyLku&y7(I@LBF@82(S=3=eNm1hELzRBbUNUK(;%T!~YH5L?yP4z(IiP|9BIEwTwYF zW2HCe5rGqUj~#-~iIq#naW)}lg_8C`bCt85* zy@G;*TRF;}-!-jNuYY1Ydx5b*O49lHHBqEljc7r$g~K5jv6H`FM0b8!B%gedrgsr{9<$fS^h zTIo}H9;N%ThY_sl%P^rmc+@^zGZ~LTah`gUMFzqQ$7Qk-KIY%;Pt$qoQM1-6d5&ky#lbOoG~zFRLr)t{GP`3)7@RmyDUmkR)k>`raoGu1iO5p&#D4F zo&DnZ^Ea8Bfete+ls|e@ziaAqZ=o=EAabxNvywGglFNAs6u-Nd9lfNi}rB%HU z5;BkiGe6rEeQjfXt%{>&ZQjDn>;y*7J>e#T6+AmhEY>pxXR;XqDKG&W^6rUsA|*9E zbRu9yyGQ#-bFK=frXg5u{AaM(xvm?fOu(X0Twz5*XL4+6s+)aFOmeNWlkgddfsL#b zQyXlj;sg7Se{WAIdH-7!VQcLdQ1NNx2M0}d+BrDOV!}r>CxfL_f}FerdrB?(0$e{x zL7eQ|LFp}Yn#gcpni)pv#K~9%r(v|;#>>0>NcikE;M>h9s6;S<8l#|SWqmKMDubvb zfz!Uh#T$yPO_*(&82a?drp!!mmfdl6(XiHLZ9BC8lZc9eZ`PV)`%3c(?eJIj{eB#p;;2sym-{ z1L@G(jCD2o^Z{IiL;vj1)J$_O3vs|8hZUsZmcPQ0Qi*CoB{Ca7_STfqDkg#@{mIT0 zM=yD|uCEDNe+0`0#NswJ>%(z2BL?>3a|$lr4L@~;8o98E&lfq?x`KV$m)j9VcbHcn z{5>(s`*qRl<8X2-!t~L=-0;IOBWz!9Su(+o&y}GzoX(w<0kdgof5pcfx37B$lG$d0 zjwnCe)?~!co#rMb<$QPo(ouC;w%dG3?#Y)Ke|7gk6Z=9HeZf+BJfV0?Ep&m zc;P@1-~9n|>0d*i0N&h2$Y7;3JPlp769n`Q`N1Wqw3CT&-svXZtk9A4heR7E#U8f4 z#isl$(YfLs!9}IcGQ}`YlCJMtPOVJBI$p*>oeSo(Kjc8i2Wzr#xA_ryH`cQOct2(J zRUKAb0FPZ7Y`GAKy2z|LcA43FLe-QGsFQP8Sy_3Dsl!nk?xEVYRXLr-DV`7by1z6& zL3OUr&-;Z9clKlk+H74rnmkpLc`yb(7X%OIv{r}$vn~U zwC=Pbu*smIk74RB`~KS&|3AIJ|B}u4CvN&bvlIWxC_uRjFe@WH02NsF+p#!P!v+4G z)L7mFTPxjIu=)43ij*)JwctIQo(K$hat}ezhLongYedU%4s_GL8W?1uKRYMTN^ALR zL2z!dt$Tlr5-E7Yz5|MMFLP4k)@G_|M)vR67Jm70a*fXN<>8nYFB&{<0Jpv;EuUpV zbnPHG`h1`AYvQuu7?UX7`J3CjS`$YSf8wJf0v;&YkqsB<;QhOjXpIf?M=G8a*~>7B zawd6DAg~Q&XxNjKH&6B-ibz}<^c*5<@zQ;-r5Sl#3#n(aO zY=(Y3Ul60=;I6C5&}hw3RK+)x^M`0T#ezhPUSi0S8Z>J5P<`}XKECv{v<~&l;JESJ zVaSu6Jy}7)iHC{3Lw}}`s#L|rGwf>b5HDQ6e*N_6(`II7zQhEmIfVZ6^3HQGT+PP% z3TR6PR(7lev}}PsD=7(yw~ly-9=8%tv8UXHqfsanC|t|Q$(17eOq%_m4YCE!9Jzal zn{fN~ZO~r(@ZLQgJ-xmnm-gwQdPYD4$iR%#@&z~pGvfib}9;xrf^4WCdYvtOMuv*}65ry0sS6d0Pub{Ay`rgOe z+Z&M8#l_`h-ygExR>ie`YW_WtFw5m;CORMuI`h+~PwhT(3?9K=YM;JZ2&)3DDJv^` z{``4SQPJE)w}>ic2SXGg__zEQFE4Lzguh-J=!^#Km+B#_N>JkjNYLDa(RGL=NDI(L zUd!Wf>H2m7kAs+$XhkS&E$?gl9mfd?`!jK7|0d&RoOtLwGKM7Gsx2b_WO zUyLO&R0#S@4N6=vv;Yzk$gTc<5ss6%1+VfRZk#`;r?1cQANqUy_<*MC(Xv;M9^oSY z0*&8sK=Fegu}^0o-aK#tr);n|%RVl3?@fsmRPuaZZCUPpI83a%c=G@R)IkC%88q3Z zx}7%My!2a+p#}XGd#L>pG8!=XXeLdg4uttxF0b@aaF8B!9fNnE8-N4=v5l`x)o57! zk$0HB0%=hCiTa$tqV`F@AdT9Ut{T1bO%WK!JCH$HE?x7t7 z=$is2Cb6hKz+KS3f6~3j6G-#szMwGSG_l;r$=%)k;>EAyotd2NFJ8PLwtTwB^N&WZ zfkpu_adEt%L4H@3S#3PqCe6Tcva}yRegJdADx=XktA&895;HDf&)JhqgmdT4Nro4@ zw2N8cLDw;Rbq3>rKL~(R54_tI*3#UZ&6_n(?VBLd>GYnSYyaAehA*A+4e{Zqq-1-s zc9fumwDcdQgBg#;cYB%8wwSW>_DNi{h(@*Thg0B$sujoT9Gs7u`2xkcl`0xOx9Q5eNLG~I1OhD%^zEb+OQpcp)U9s@X69iA7+vpi( z2G9iEtKR&DSQS(n%Zzoq#Z5R!52jNtQ!hF?IvN;6(LM%srt^%Ee0`7v(zfIXTh*u7 z6d<;&C{O6C6Q{{R5|GXcvuxIB43Jz!%rBli*)1X>!o!o=1h9Blai(eR{JVwsHxbp5 z@!<|8Ry5F0?lbNnuHyakg0p4>p-`R-Vs7gBD_5?7?@ScE!~pW!W3uz&K|r*Y<$K7^ zJiapy*vyK1GL*~C<={|Ao^@3q5ht9Uqpz>;yTAc-dG^Sr9-&6C^5Isd=GeqzOi@+t8#pG!`UDa**Ts4=f0ac<%Uuh{;~2MkKac1qyfc)3=k?kQgladDQS z_xvIvvYf52l-oJlXJE+sFe;&-gJ$6bOslz!e9&ItnNEs{)y)%NNRxR~muh>h!gW19 zscW{Z@2UiV2TZ*R*@(^kFvfRI?h4Azd8dTyY)Mc>{?G+6Ken?00s%aZB_J7SZ?~%7=C(3V-R7)V1rFpY1V{8709G34Fr$)U)X7wl zmq%cw+~W~<)j4zK3~;#muMfhgRfC|5-hH`16(w!$rbAdbV4lHFDJqh;;_`ap0@*d~ z(~y*gr8hD&d|YqS^`vm$nErmepU2x$2zZzWm~$?lJ_;<|T(veKU3Q{|sH}7Ze#)2dWFXZYe;)y(I!Zrmt z+tk^?Q0+g|`Y<%}wQ*JM7XRbPtwY#)ndm?xCMXZeO9d6Q$iVB(vMXxSlNHV22vzvD zZJ*p1;Zu>@Ya0q_dnf1kDN7j$?+N zFzh6NLpAG7exa<;5NuEmR<{*8NwsSq=o40te2n*`e%EPbtb&!pjCALQmjLxbPj9s}99Xr!v&;rXVG)(sW#Iib5LA_OaK zjkS2il3NI9?pDwKxQ*3z*&0v~zMCRQVC7nS4YqiL@$!pkst9kfeo_D^YViowfFo`b z3t(-;yXm46z=5|GIZUYg+b++33Hty#fOYq8s9z^VB!x71=pRaP-bR1FT{0BEgau<= z-RLQCn0VH}5k!{DwwltB#;cF7XTS2gqh;uLrBx?kMZclpMdAD~XLa=LcdnYP=1YO= zavn1lPwyUi2_Hax$IdL_C$@K`m4(l zT81N02SvNM8XNVRX(XS1PCxbK8y{R3)W_a!qi1?}h#U(!Tyqlab3dVbK5%j(w+1G^ zpeX8zW4VikYMn5O;e!QG9RIwzt)h^}w*1>t ziS$#RJv<);>*F&+FHXf_?OSzDpp6mBnc;`K=URqJ#emE@9@`glOn9FWA$PRaW=D9T zQ!~M;Ej=UB!;XH1o71msMTYH6#y(|ltgXMzW*87 zH; zO(@-<6V>${6m?EyaO>NeNsZJAN=98P)}^n->epj0o0dxP6{qlS&wU#tdqIZc?t)RA ztb6-saw=^i{c{#NgtSJmk2l+Q&rTB%f-0e*<2)h*C#UBW5J{7Y7@dadR?Qpw!qnx9 z0ZzXz{NfjG$B8f?lS)5a&2dDphN7X3ibBap?9)o}UrUEC?W+)r<{J9)a7v)Fr`Nj24Llrt3f)X~N6`c~|AT_#3h9RmF5a?yYZ#Yj!}f3tAqr9G5V)VfOXh&9l|No{VH0 zo!4nCcI_OW`?dUDVE&6)pBE(<-;c91@+%iZ1b%%go2DOp&^2m0WAC0)ffE9na=}AO zH&e9`%h5p?P|W~Py*W%6G`igFcc34g`iK{=Ouh{oHTGt`9v$Sk75r=P^)#{%9omyE zLO+JlN1!wD>7>$MhTrH0%>q}PV9s|ug4HKUd{$zy8Kb%zkD$-7G2?2zxQdPl#`QGg z(~MW>b*6{MZ|w!iIhnK@GMyKi2WCJoOR;nOyW8rT6JiP4YCfQ^5%fQvmzK=D92Qj& zFfJM!%;Ps|4}0mQTc{KQj2L6oR1reL9obW*23CI0&6sjPlbpigTGiXBr)$&m713?R zps~aw;e_tqqMzdmYE?!`+lE8mH0`w^o+*hc&%5_1;kbuv*hs=ln95NnFUvW%4KGSO ztNzA(D=WjpMTKa_KUdu$lP3%M3di;0d8vpZ&8%Tej30Xh0^RQB(V2&61-yEeW>KOC zPO|W8c0V!`gifisOoH!Lpn>sk?%jEp>J55m>94Kk;lz8&M{tK7$>?#5_8A8+5IUvq zAQTcyyL;sPJqd21KBEaGAM5b6z-qm{R)kP3k6)dMYQ@C+&-Pe#IZ{XXr_$5!ly!bo zrR8;E(qG@MmHPi0JNI~|+cto24pBlPo(T0QDj|Et|gqd|{uZ{$Il1^HsB7NxC|JzIZBTdCL{8nADI++*Q%_fI4;wiGrKKYP0&-h} zA|woGll90Ne;+@;z;-g;(4!jfR60-Kg$2I}otuH95;4uMyv+w4hL7hKS|cRLKfV*M zYGGt9GOF!CB5mON%7)ru1P~f!h|cr_vNG|4r4VxrAKu5-E^nZZBOZCKFa484n9FCf z-hH11>)66{b1Zn}Tt#M|nyw?_i1!PIT#dF_^PzhHiLBu}59s4mRD*e(%Jp4G+emte3~~5c1G;jd&pQSh~-nyiS|AlrYdfZm7p)<&vDjejp&y81i3r z%K&0+DrHGZvpF!oz-ti$2`=soZWpX2Q-Se3bSf#wPzm>TcAcVyBD8?s382Qbh57vu zPlfaI5a(AZ%2OlgY336EB*KCVM(4yLf!B(n2X5g-N=a{P4H9UmHq#i%WP z#jVRWP0ZT1dj^N`ybqy6d_j3LhxYi^w%9$;c;@XUuu|g}aFYzQPk9xlZ}}8@5#U!&A~aGmVQ*V!{@A_7r8>B5@b9zF#4Mp3*#`Y|IuZ?N2CoT&c_00J(bfy;>$9ZIHJLm9iF1>(+ z<-AF7Cq$mzhYKw@O>x^-C9O=YaIzT(rTm}?np*zm&8N2-wt@(NrIBR=h3u-(+#5IA zI1g9V$%C2$9s66xLRG$`HR#l**NnFY5^5MZV1NGndlmy=%Rcm%0X2R3U1d)F*`1#O z(bovzt=%;n+J+%Q9=#su7x#&8D}+-0e9fJOqm?4~9_0LsoaD>QCi@$F43sgJuuV4m z&)P(mSB$uLBzQu1H>pG6UT}^ufdk5_RsNGVHvIz<%Jpg>^j|&T98laZdOkJA#ngeH zKn2`k1vkSt2fQ8_AmqY!*Z?vwG_Er`$fBk3DG8rh>4dC%|4eOdzF@EVQhaO^?mBmv zie~L@7`U5fP}u5w{${7Q6WX*KeW}ndq2MEwBA=CYuIr3a-x6Eyho*4No=SlPICtqJ!q}G3# z4w;aT#1N8rFHBC3q$jBOJY_e<(HF=q06pI8p4I$=I9NMA?56J8w~u{1G3%okCB3^P zkZP;sH!#o8e0A{#f5v?xH&u6s^Af9N%_R=gSD6Nqjh>Dz%^FK?68NotJVM)l5W03_ zV8fM>7(R**@K`ikm18?R6E7}|EkE-)2>ocfhYB!i3VJHxROQe9WzAC(Y{gI~Z0+oH zQ$0W9i<(J@I2*~K_DX{W1=#FmzJWv}MQgQ#957=?m@qj9F`vx#c-UwxukopViU+dY z!^{m5%;O{Ooyr=#n<5cNPl{3e96sCF!`}+GZ@Is4!DPMG)5yOHlZt^g12W79Cb-T( zG#L`vs=6F+G3`&S{tYG)x=@n>q?Q=VM2i{&~1PY1nmK&}LfYRU*6xEwT5%kvIip&ASVzU!xpmb|8|KKh-s75+4d0b+V zF3))7RM$+!X4M-S;*zd%u`)tiWkMm&0nBr;tZGb$_OgvZu~W+8JKV3Yw4<7}`|>T1 z=3|X&7R(cva%|NK-t_A|y03kh`F2)5+sJvqLZK*iplKqBzSTrW7;weuw(jyaxEF9c5j&bPZH^J&o53d%Xy5g92;ebR8;HoZ?U(99;T6LP#qtww? ztp>ZZ06bqjY$xM^XgF`Z-BkZ$+ttuP<)l!}HQJEf^;m{}MkD9WNUg7@f2e`;e8Vnmq__i!Ttsg?S#RanL&(XppjAd1 zb{&5~JHY~4G6nI<*H{~Woig%x9~l#keA1*&nt`410%jysIa!z82`F#yQtkgxF`Uzt z5XQkl#JPNT-u7ytX1RF%R4U;$@BDi7LB}&-ThiX87ye?5NC6sv)JJg7CoXXcVm9<( z%nF~b=-(ukGu3xj#+cq-M}_4RBkt34YiAS5Cbd8WhC%3JDuS_^7Fm{`K9kLO6kO9k zlvsxnxrf>u8Es@^2odh{%7kaocL{y@DkawKQs1ksUbgh(ZTRu)tj<*em2x*Fd8(2}yAN5TY) zR-YnGGCt7{7yINnJFfPH!V8KcKIQvmfX)Vh$pyP4(;tw0YRUaJG9HiX4{PM;dK_S< zBy5h8VKcOO>RS?RN3&HwVJ@aAfq$|*X{;$!?mxP6%`l=5NIBTr5{dR*Kns0TN*s|n z8&dRXh%>Tee0NflH24c{=8p7-e%0%W=|FQXh`9If_{=alpd5{JhexX@_02ro^`pV~ z`CA8;bSMz3lQ=gbWz+EVDW_(})DBz5Eqkq)8!5@HdOC$wEKgFp98 zCyV0$;)H<~C|tm+GnT$23-`y^!9`gKwlQ6uaP=GGfWAbS=bgIZZqVC9aBTcnj}NM8 zAg(NQA=ul5k(2b}2y8qM=OcEV)xs~dU%NFLJ$H@k92B#0MGt4>$GkMt1GN7L9MT0P zdbOBw^RzS$_J~iXvkF8(7GLN)fS@`_xX-`dBN!RnMp{(+ z**h=urxf0Ee{{;LYd&16OdW+^q$X^wVm7sx+g=ntDG0pDJi>5-and7WXt8I;9l7nL zp<^Z9tR|I*GKidM{&d^Msz8mYCLT|YokFB~pPyc1X$d__p-W{i7U`TmmxvxrL9bus zP}e<@E6$;Q6py5y(TJQvKC;_vX-e39U5#O#+^D0z48p!m%YHpTDx>+uT8U?NMjU;R zt3-3I-nrfKLZ)(dkwUOixTFL1$hY^G$!Bd5#Qoi;#IeY*OPo4#+xQ#ODH3bMq@o{= zhOW<{7N+O&+I$~N?a-F79yxy*Ar%OL>fpo|QKuOh+e4lkaCJASZtLwIx{GAhR9e=^ zAwCk_r_X6W@Nw);e0j(e-6-OY5S0vsnp2WOu74oFCx=?xxH12{P_PLdd4^G>h$tfv z7HgPW{{D7T$(S&9v9XIze&@H&z3sMZ#WK-e6{@m1p6lc$R07e4Eh+0iL#8t03Zo-C6O z2cv?z8NQF_`(4-A$amqk>oAM2?Ftp$m2DULq?{OXVCuUl7gZ?&7@d~wc41GB<8QW1 z!^DaNvkm&iz3P5B&M_OYmT=laPv6}J`^M8Bc_lh$&XMG|uKRO8j`T;|g6plz##gIi z(~_I=@yAXqYe3C+od^@GA-SXt`o@gx5eRtmp^Ei0CPT-s(L8<_DI04ZD1E&e0+rs6 z6UVzbS1i;1nRq#&YU_jZQJ?7u&{ZoW7>jHgOa+Tb1{x$#TrR05gicMBn;hk30_UtT zQ~r`_S%?A!0=_C%I{ih(_v$NcXAbaf6*qdWO^xo+mV%?cw~Q4Olxt~C)aODhW!OdX zHxnwnoQ?hEE}ty>F_ClZoY$C1Hb$B?6|{QfUcbJM2x zg2a?+{nX1=0i#b^;2K;+U}kyR*JfKUL(PaN9<4)?ij0jSm6qyN+%SUP*+*&DCiM0d zW*GU)3CtEZh!>BD-!H1gPK+BSS0{e%_!v9tsovpk5%SN)<#hzIsRDKU`*ob z%iygc1sfAfCNCPq(%eRwomCSztojn3c9kkg+uge#uJm9u`TSRuzH_4=olIMk&y1T( z45+!}I$IGQwKces?oyg`nX7@n|7IuCT4Oh}A&MWfbz4>5d|pie7@TOBoJUytX&6 z&7At>%c%+wu|*5jm8qdu_^5mf?;Db&ud_kSTg&vGp1y+M7KO@&{WvI8!0cEyx~oD% z1{&1d<_7k(zaPD0MN<6$+aX+{qK;0?-8s&~3luQHdhoekz+~DEDc$Oc*UwP0M2L#S z<7lQ82OFzad(UwR1_lir-oCJ3RE|23R!1ioSW9yW;a!%;uUK);)|^Nu9VQ>4yLh0V z3leR(wW$s-pZzl(A5SDl;d`k@dTw1^^(mcV@Eszaw^vU*(YhSWJpB7>SQIV$=cnhHx%9$(h&7l5 z#l}-xO{~9NY>jIFeb8L6FgW@niH;i?IaO_~VV#QUH@C4##kgA7OylffJJ9loi0m}P zHUA-eBc_Hv9>YnX4{j{S z9Zi%3QH6-;|8BISiDpg`?u6Dx9TXQAXZ?_Dmejn9Qt8pIx2kG$p;^uI=g+@=`}W(t z(t!x9i0;}AkfmY7_ngliQjU#BV}ssj%8d9J^p&_5$CuE%uCakA;< zp6GkaFX12TezYgEU%d0UJU797d9=o`ML<9RDe1L>E6`|(5k5Y0%gAU@>6C1(exAXc z@chpt4n_aUajNz2AA=?*CzX?5*Vf7>OY8-D=6Z80%1 zc6tT|205?Pzqrk`#-kGRf8jqo(l}jBAucAixioAT>YNc)|Mo30@)$%E@TvzT=Sh)@I2-2wz4015OZ*s=vF?SCC8R?(Z^KVl|XOrHPXBS{^B}YWXnU6dX)i zutnwW;el>d78<=>v|gc=swn2Fs*2^I%rq@=EZwaxIlFCzp;}K<4y8JN9OgK5&QC;0 zD9^2}i?YYOF_e~eL!+q)p@GV*$FoX5k#)w&?|dDhjP>7|?^UyZ9u{UMiLjvJT`)&7 z`)w^_@Wh-s8?q<%%*FO)w_`(+l}Xtk-Xq12y}zUu@A5rsVBof+82u$=jK|!MnYKhs z?^L%gv$!xn*23&--}`Ybdx%X$*VfjQIaR5@ZH$MWKIYW5W4Bj_*dY$Vy{=KqCg#km zBf|^Y#;C()VXO!${BvC+qq(UL#gc1b%w#E~J6~&U&}C(}+UDzh zk(+5WI5;TvSg;H=xgIY4ZPan9_i0#|xZ7%Y+%Yak5{B8pz`ze@e2j_~eSUubsJI=5 zd0dfozY}r4j?t;>0(taYu4JPs*oB!3zFT&%gmMs*Q; zvH0gVUvm?j7xj$g?|dL~GfiE;VVCJtlF6o9X*@&)>vQy=?r?#WrKs}+K(&c)r$!YekLaTc7#c8T=* z`1~Y=M}zR)>ox*{g1Iw#Q^v1dhHR!7Wc*(aZ=}aqHCN{VF8G0V8_w;xF^295RJ3ie zE*$s#piPYNSTI13RJqyM8!@e$Uru`^;CaY=AoU?{O~PC(abo12To_o?lz z^X714A%!gAfn+W@?em2FQ?&nAnX)eZhs44P8`dtj_n$1D1IIjFWz;6OXc+Wz+v%*t zfz;<;^L5S_hikw1s~KmFO@DgE=#*#mxYC*8C3nbV-tmenb`~o|@7$(8bqZk_R4kZ7 zb5-x!|8Ba+Q&QHB)8C~ad^@hbSFZ`?x8uan;S-w(|*ODl7FV=`U2z%N2Y|rQP z=%pdF+e`uN=++oh@+C8_>Kk=<&vS}r&U_p$u__-hRMC}&R52W-Tw>QNxI$NCW$GfaDPOG2T=_7a!X8K=5!4`;}H+hG{lSBynXvN ziP`?LD8`3P6IEY*G51G_^sy7C?)Z^0+19+$_P8K~nxSulr|Kojo)AEL#VDu^{M=i? zE!p#No;P>B;Kjuj3Lh4oD7$UJ<)8goC_rk&-iQPLdwqH;k4{G1^K@E9ce@*Q&gcr_ zKJF^b3LoRbhYJ)1>zWa>1>c!w>3ObS^?P6BQ+G1l?MM5dgn#a0^rJ0ibJK4gSa~`> z`<(zXVrs~^6PqzcP{!+Rkd=Mcs zK_B~T(f(?EU9ICDLp7vl(_)EOYm-0i`QkJupYgfw?4Yc$ucDbjFV#_*pCim36eHT+v(^MrmCg1S zrE1pkJ{stM^?}jp%3RkKcj^IZpXFgSM@2Dq=W^!@<;`M&{;yIcw9rUg0-0>j76uNj z6IVmKk+zV&wPX*Ynb$3L=2k4NINm#B^2gkWUQt(nk#Cq~budwM86_?*p4sl=;<9|~ zLMq$@G1kh(r;s+oR5*TF&{aBiE8ng}7K7f=!bEzstYb?Ay-O9=n( zQ9Sc{55+x08EkhZ&J=lUJ;7^M_HI#I4*xhM7@#n#GQ%JZ{4QCL|qF>c$5Cb2jxhi$L6>dI{5L1yFr05+G$jlebN1(GM4GuwQJ1- z%)-X!HadM1d)ukghg!KJ+O=s1?BT?YjhT2cMldp?Ei`gVlV8J9MsowE+t=Gs+IHVJ z=T$3%4Dpg_YT!_3Nt^rlex7zH@m_DmoNRfK$f?8%O^Z~A>q=&)@EW6ALTW#-EP`e? zs*@IDJp|yJ&a7t5zBOTr!(@bwpaiJgt*kOh4Xf#Xi~1SGO8KnG;@9UUo3_;@Z(Z)4 zVlAN)CP&<_Xf;W^bw*ny!)fT`e4!-ki}LElz_vu#umtCoC#`|4P&aCG@-S&ue0O4YW($uc>6}B{* zSg^d(kaHBcUPtaYKhar-w;LZmesnfZWaW@wUY!;d5Ew+;$4;U1^IvF%wj6`>AopuG zV*4vN`Bf8tnB3}rgIfO*NXOHC1;7W-2|;C2S2zm!h#Zo3y07%MsIh+_I8W+I$~Nmo zz~@K~dF-se*c=}<>jsMToMHT2??cVlLY&u0^stU0h?M-Pa+}fe%E3+h1c2B8fE1x z3y<3}0&tfi4}S4FYHkh=-TC-E)nj;fH&QVSQ1>nq5i%>Agc}PsLrnb`&VvQpg1(T@ zy`Z-Ry9Ly15Ttvt5EK!?z>f_H30Ze1{0de^(F8s85)PgwBDDn5Ag>cf2j3G?Xx0xW z2E!?E&X$5Z=?wm%v-Oq5+JF-QPeb4T$J2mxftQZf0l!Ta_^bEF*Ec+?Ga89fOiWCi zvhGh)XpR<1^f4}lhOi-uJTN^N48eS~Smb|Zhb~}kz)raHiRoTI6d)sI0~CN?1iL0& zXb}AWHWHRJ=+`^F?3*`l0yM9G>z4a0_RPO_Hkt5R;ni+TL&KGS|HvndC8y!=-sm;l zh}_6mK@ms|(N8q|!cE6{{sp5~herWXNSwIM_d0Y7pc=SkVJrm@4FWSO8(cSw6Y0hM4;KufzTT4*T!`p;O1+*tq~CDp((S zbln}*aTZGiP63W;OwSfSPJZ|t=Q4-FG$4E1m79CDA&nI3naiR8cE`nBE1 zYRw*;6zOEv1#Bw`FwD?lhKf2bDO_}!UksiSXm*2TDbzTxhNW8PZ{PdY(i@d$;Xc!C z7^7v1U#^S~v5e474M_Vr)f`D`Nmw_uQ5u%qygU}g8os;!_+Z|e*Zmix=3I<~bos5g z6pSxlr1|!SM`fxlQOXg>gsl54odPEtV`~Ev;!K{#?v!jRB?ZrKdM{w1ZmI~o;ejbt zm2i%0KpwCecentt9=~S`zq`@QEA&O(D5`k>WCYtjO|qE4T9{}Z9NYzn1hE!(zPb3m z{SUwNFIvsFcX)k=xNoj5dbqKOKqC=B?Ed(@Z(9T`g1;@Ua^37x*~ci4XiNV4%q;cF z|KYZI$?t6yI4$+Wm(f!B5#@_Ps;u#VTHW38AtVGbxhwf1u5|WuPtw__vX9ZK@oSqa zV_FxT&MGAPpa?QcXVCc6g;AWp;5X@M$A{CuY{vY@Ls%%9UciqSdcN1%{T@RFt<X!fS#r6WNw)pr<9^W!5HWvYN0ud!m2!u1fNPG@A zG&C$StC8Zd)NNjgwQP#j`G)heZYt}^W@)2t%3>T|`8LS&io( zJz(zV*WS`%vfHy*n#%OHA=YevyP`oj&qkv|eW#_92jV=Sd&rPZr#{}^TwK*Ve*8GQ zkycT?k+iw*TxPag>A}Wl!E?XAsr_0w&X@hNC`bA^Byx}8dO&{gY+LKT3FLUp7A{fN zYPG7vq5-jhP0O~?l=WFX2Z;<3v@H7BCMjYwGcyItrWXey=1(^I9E~EC5FX>l|4x4$ z#qOy^d;eg6&#hGa*C;*?WqIYM?zL-Vr4NDHJe;jshjJb8+V7oy=E<539jTM|_cqbO zcT*aJj`Zu*2kgB$Q?n6sELr~1g?~L}-`Bmcp!EBz6DIn}FKVhoMFFXs8K5`lfpkFH zn%1|z6iIs4mM7U60C3OfV^U*X z_Fh@t&#;La+rCDNgN3rP(ZT*ZWTX2i%vW7{!+!os9nqMQOO=;qUZ$}Xi6jghl^xs)@ujC9$aTM(q56`BG{9RLV+ zDTnhwPYVd7W%uX7X;1f<>{ZydefprW7vP#Gh4?*l!Gf>pW3pQ=trAP_Wk*4Teag8? zDPqKgcFIsu=53RfG@P-<+z0=ah3M5rXHn^ciYtdOWj>l}JvgxbW)yEeE_yO$C&Op$ z=`eo3%iPxuWtC&R{2QZ)-%ie9e_Ob6uGFD-bKzhU$Kj^6*ujtQ3gi7Grsf!Z@0)Gr zXX8GRG@2QFVzo-SU0#KOp247he?pf5XPmq~mxGDbaJhb{&B|LUyUQMna*qu?10=m- z=f8T9(CP}CNQL40V^&U=ww8Y@-O#NMk!mjJtrHwDJYH2oqr7sDJipu4;v7IezRK|- z%EqkpowX+Jp(v9UHRf+l$?nU-37tY&dZo^+KfAe@cHA(kEGEbG$Z0DZ%X0_IKKVIX zFuEwWl(&>@H_DByeYPy50T^VO|p?%RpE6q@SDZ61Gn@pL}YGZf6g5Pn0%0AMpPu$q`b>I5X#S+q?Tas3{ z>W6xw60dtzxvYgvqLb=>>Il5c-};m$->K#_c`qN(BY(^#J%Q!I)TmO7a z*;RVVVxNb<>|fcB>36&^(6bx69!o-2ZI)=@f~jFHh|h^>>ns(YNLH}_qUeRo-BPG@ z)5Im+^?m0B^MWD!mVa$+wW=dNgp)(ihzMDyi$3E;S&{KDkhO*FfBvJbeTAys& zT^ng&1>=3neC`v_IfE@uot)>!aQ{3gT`LHAx6Be%7YW&H5EzLiF6b(649N9fYQW;E7p&j^;1z$A1nVFOwAC_{YNhxdESi zSN~q1p>!Jgk#QtX?bf(7Q@kDUUY=Yvd)hjf!FC1iOik=4hZi&n(Ju7_%99P|pcy)Q zJ9aUrsk>j_SkKO22mhScJP}UY=Bw~9MX@IOy-DhsHw8o0#g1ODH`%L9?JRUSn_a#q z=FTo4sbA(H5WsMjl0c?FyCdr|0CVGf1jWwc*i^Y=U${A*SQ_YC&I^;9-q6o6LU}pI zCy3=*0H!QuU4NlXyku|GmH;tgZ3oMc4HOH*piq%8B(1NXWKx*FJ zMfSCPML2Jbn)uF{iTHX=1~F2#Wsqk%zyG+%X6+<}^z<3Vow<)m9u=D7wDu$yu<8#V zJ7_Md^_$xXGBtJ0CwcAJzv`*ZnLTPg=LEkB)_PY2YqMW+_Uzj#wNQ$lh2J}VPJTYF z$;aJ2uh;TgpOf!`Ik#VIUeC3;Zcz@;qu1YLQY)uXhTH@Q(MmCZRgM9Lc;APnPIW}Y z1f_3`UP4)|v^rU??w^{U6Lx8w$th9q+4+0l8F&A@`ie8Cpm!t9`B6&svt{ck0d=*$Sko2EN7m z`{btf<>s|EeH-4n&KlwPfrzuWx((BS6_*P7!b|CHHCJje=G9q~2Mgl~7*CHqg9Uc{ zxcX1+QoM%)+uX&Iws_#Gz;8Rs6FbiPPqr!e3mUN_Jxg!jKK8y}qs^jbgY}+qK9z6S zOdC(2Vn24K?REGt!h7gi?)=Q)dwItGsPIou{0iP_6DOBU8(CJXkDIfF8c>T447+S^~$ofs%%AF}IE+Cq>Jc;y1tRU@&vu=f7l zJHGDf72#P`B#(yDt?q{b+w_p>T%X9^WCZC@Qz=F-U{)AE;gDh`8-&&7w%3V!IcB|jboXKSz%q>_ksE4x{TA}aw zRSmOx1WVB-+s^}IFJg2S1dSgTw*=D&Vm)8?p^`}*ZvtjxCyUh@uI-O_AUpzLsax!_ zW}7u8_o7ep%XfJV?vCqfB?cFQ18C2sT~4xG>tnjWWwbjqxt2wJ z3xQeJls62551(T%dDttn<%9IRWxo*fvNQaeJzvwtvfY}5eOo5g`m!*HzoLND*N~LX zZ7x0&JTy4&3RGp8r*FV9tS3ck3>TKl8=CX#drDvrJ}wD`px^Y<%lJ9g_A&Lw&fTn; z?Cv{Oz9J-Mn78|(a`yv_Epkg`IJaUAHce|d=JR>R6c`?Gs5Wi)6f;yHHWyU3j6MF^ItX>?`fdx&j<=FUB(zz%+g4uK0#a4 zs`TJL#PsGHuW{9$9N`@Jc^NbMCXarJOX4!wp(!aOL1vjY1_G#za3mXwwj_`FT{~#l zjxg75;dkzzk$I~5v8Xm_yM>B#U|J!c{qUhIZY;IjDJXrKk#WBxMFGSjjZxVa8py1R z5L!NTW4u3B=I1+1RZPvybaeyA;~em>39dWj}1~bc3Wj8sW0<91=Qa{%}TANJJUcy9!X?6?DE7fJgHM z`ocXs#z8L*(JtXp;JJz-omdCYf+JqG>P&d1+W`TfzI+p@>-L+NU%@fFMF0;-?Zf~O zAUKA$6EiGmw)kyZ6sKvdUAlUw2*g7}Y3Ch1h{=qt<-cbun6?00>kj~^*9p6up(p7( zNA!PAYb|gOkI_ws3)(cj25N^uRj?CqW)$w0bhBx{iggNjIuPb}M7tSQqJ2FVu}vl) z&A++m>$T*iunNPXOYMy8%W#xs7YvA#qc`sWM26wPT6c(j5B$tSqJrAclgkyb_kqw) zy1A@eEaO7vW^dm_KUc>oulh~>pmGoUySe7y7J=Ex74!bUnKg7MRKP``P-_|z1zBZ^ zCXK78MmJ^}_B)=10&YwG-5bW1#utiXs0T@jV9o-3Z z#QdqD9+dL1w?YC z&5N3`nj#vmLn*1FnB-HB-<`<*Z5t#sD6};_HAVM=63n`BeCMh`jmgXt{o~OM zX(1m;mVcs?qBl|cIf}ccz-V|*qJrxHfCpR0x&|@YT8~2!(%GL>d2*f@aVZ{h5b3dU z#rJe|>4MnmBS*68+WTqlZh&cc+pOPunxym%Xyri||5z@Dx6rFU=8dqaAi%N18o}8u zv0im^_)XYV)lVd3#);L}yndoN0s^%3rPpGaq%xn>>|k$#-Sc5r_u-{myq@B;P}m^2 zm;08!KCjl-8-DvdQDy%`^B?yFswpvmyt})o3ZD1X!Vxc%SlG^xK8=p)98YOkD%I8Z z9AuF^UY5w+@lwK%Y$$7gpje)sJbR5Gp3 ze;e&tcDhbRt-N4Mx25DEXQ?AEIU&YvCoGo6qNuR{jH&VgNgT#$?_Io`TYsUM8VKEm zK7+6LO;S?kXy6tZ(lt~;9m6-}Nz0`y_+C%RU@5O^UY)|Z&whSyx8g74GIkfF_w2fF zy9(6I*W9%fzENayz5IR5>k>fQ0OVvt>Z7Ae-n)uC##JJY|Wy!Im6ey{T5I*U>~I^T94gj1|ry;m?> zP@oY~zlR~wC!G5F`YW|-?QR{ysY!~wXD+#%GnH!!*GPzo-<}8)T^_4fk|$50Y@)8n z=D}_NOSs=vnQ@iC-zdtE-lk8Wjz)$O@`27`zaJMTf#32vl|kE{@~VAAS0!9;|6x{(Zn-;X?Be>|I+|RdEtC)Is@N* zbwWh7zW5a&xW_}tF_2axi$T7}ONh&e13VWS9bKg*4}(>_*;vQ_rhTNZ-y605Oa*80 ze5KFP=b$Zn#!4#Ye%CT}7f%q*CHqCoxE=h7*oNi23052F(adB^2--nQF zp__f8Vr`w}_D(1L`kT*4kmFI-F*1^Y?fjD5?q&_GTdhisRgC_%7!kj5$x4pkVgZ&j ztFPU{`60E=oe2ZjCA5;}|Cy$K-!_%qs1m}kE(A3lv zDU}4YBn6DM=ZZh#rtkd3cH~xF@z48nt|`U3iD!O*SY^HaLZnuE!tYP(&ra9Y6znT< z5{?QO&_b2Pae>Q6ld1!n)qHj?^mh7KCh*RZLFH928*6NowB=B61B)xo;;@buNyp2Y zLn4MA7p?tyCC65UnH(H3ITW1)$&KCG%^~}uM=iVCYaZnr-R8@KrJ-vA7vw36PRdG-@1!P9xC`zD)ctAx7A^yvQJxpM25FL@|E)xN_JhtEM zKk?@Y2x^@o{0ydsa1`>GZ3clkpn&zox~7l6|3|dzPnL~B;$!99rn~hx(V-7RMw)O( zUF*laW6+-f?1ATxT|bQV6B1-lqN|^oATktr!TJ#R$R;tJthYYQIZ#1QXpw{b9+YLf z%LG;f(r-tpzULs)ew3XcpudlCcT8U?BpXRThSGl^C5MEP166T{*+8H;7+)YkX7!NJ zJXkDu;IAsTA0WB4xj3kI>sFb4zlg7_1YaCfW(4R4;YqVCU?^Vh#(*T4)IlSTuJ`I~Aw1`Y#c zQV6*&DBS_2BmYIqBA1K%UzGNBK*slO;}cLC12Phw{}~86NOA)8g7qP`0?E=pTS&Nb z;%`dr8VU*B_~#NE1-KE_K@2&xhs^N58RNe%!Eav!!^8i_7=(=7-{C=q0a{1mor{WI z%ch{PG)2J=6qbTS<+Z%|j1WE|@hW z;Mp^aL)+FK9+HQ85O6)IY`z~pg|j~XwV3B;@ovQ-^lVS+TF0aE)x5|&0mIVSBty^XlC4wfQq zR>uL=jesOQSVCONBWhCPI{VEBAh*J8<~g5qX?Y)@TL--wsR9E9@#-g8QZxJ>!0D3A z zs6P7z;JGaNO+Evje$Kl%Cr)&e`|j=-mEULg=TB|x9QGe#I{O-KVcwX_BKz3%!xu(9 zKq^RI8=cel2C-bLF9-chi2!cW0w&)@09|euJCI_wu6rD>NH9l`oFjok>NkvsIik9? zg%~Uf-e|?vNp`?cLU}O_H{S$FMaOs-i8~kR4x`Yl4?j-4!KsRuHBq|%NG$AMjjzvt z$W)dtcq4ywnex@ThspFb-&V#$Q0wtWpVa#jkFIhNr&z$fUtYrg!>v1ee_Va}Oi08pu^c(FBJ*+*?+$A>fe@?LRrc#15Qn$}-Xl5O=Ec zyx+@*l``Nwxim{^yyWMl0+q~xx((vdj3AdI1S ze*zD_WFCY>aN~}>Z=OQAJ&op97+T%!pKV56PWG2o-ln^%+^Z0-=C7?Jb%MF5_%t_E z;>^&_*ndD3*P$K;vJWutwLl@uO+J%6_eJb=T^u}s=g(z=nyuz)nPK@-ll|8Fw1Twr z5S*Z1j}#sFz8MR$qczvOo<6lz^w(a=FC&MNXu3)E2ltu(>(**Y$}(P)jzp=8z-gWp zfo&c%JNmdi+2&Gz`Y%3#RR7Cz0wf?DF!VPR%_5i$Xt_`@=r9xpeIY~godrnph#LrY z11M@BA4fLC@&d490s;??vhaTmOK@=K0sbCS3S0R!FrnF+%>-miFa>yHU4S?q?cv`Z z$9AX2rECr&t-S39Vn}LI%xk^r!N5lricUlU(cRJ#Q0mDH#^DW^TLhJ_1g(E)QW`R| zPb>J|zw&LMG_~NWexq1``J=nMT+?xLaZQtJonHa)k33oWc70hTb)4d*yx)F~` zJ^O6PV=l2F3ce{F7NQw zZ_yQFkNirV9}Jf-WvE6@b>n1NSy?NBX9_BCx}1AuvAG=UFDE7@$~*?%-^EEO?X7oz zNXTWhVHmi6fBfZ@CwDeA1snna2UU>uV241@@xL?Yf0?=81O61VnD6mu~!u#S>ZG~|DWLlVp9a4;vVfR zA=5wK`xr<@6)(b?zDX=BVA!guuDuP8#CJYt5(+E~n2t6~ zg6Dmi)4B}8Hwekoh;^NUiv6$GC=So^0I@t$bvY={W#SX1&%n%+nJ_J-mhF>ICPrSnOOx?fq*_7tKmZ-CnDaX zuK)d6^yEolgv@yaeqD#`^Bw-0h5n)gJtBjTLfAaRqD?Co^#qA#rz=;0S*uG>7} ziF>uPIqYn&0lan-OUx?hKB~JA4wdoN{T;+kW=2L#E1H)5UyJOJ;#XK^ntxfl+^BQ3qdBSuMDD{>Jtn^(Pq0h1 z?y2?P@3)@+sdMYr6r-)MU#YYM1|0;^QPQs(kE*MKs4gO;%-OwhITbEyRPxC~e}`>% zcdg^dMW!e_2&h3a8p=4h+Oof`%itgk!obJ~s5E}Ox3Fz*XDgIp7Ucy4@&!O)gs-oG zLCk_}Oms2e6cq8^Ty|>p1sad>r%x#oX}KVB&WuA4nEk5OL3ir@RGBvxb=h&ad_%)zZYf$M zOj&YtH1sbGslSAC>Ya}s1(O;TnSb*Y5)|YDToIz~r#)yzu|6iM{y4J__(ippu{dqV z^d6*M$GmsheyGy!8GsYkqqp48FfI4Ii^QYrVzaWc@a4XKnN}{d_62r@rd14o*1s3m z;JJd^TdEk7%4~0ITLPzf|9-~jTQF_}E3xCj1%pYz7?f6-X-!=3L6blySye*s(Lu{2M50Mo#~-llo$T)###PgcP*<$X?L6!@OG!g z?gWdNaiTeoq-5{bxd!bxi5=1*zBe21-otK%8Jhd>o;}+jZ?cd%wp4T5LzSVx$YGcHr?k z;%a^7x-z@QK-u%+NY&a33qzJl$n_2VAL*|YU0asNJ{nIZ2N{U6T)6!mu>}}`pO0^- z<~Zx_d~Y86Rd2{Are4S^@g3_cFd>0$`&#Mfyy^2k7|kd!ZoEcuR7B|#&LI===8aC{ z)lLl#plwH_|LSiBf=jNzNeEwnULz)R4jzfqEZ6%0dRgTF{i}=_^3?l-L3l(K zS(uyq_V5Wf&)u#JRi1y?I6;v5(b@R?j=VBq~U>!Bj-wCr&am3r^Glwf?Uk&n77%WG`LPp@+%IC6hiQgyN5BzbM_+)zwSwgK-I3q|opVyKAWjNf+-1HZ0}nq!aGZp(?w& znIK~zegRbT6WO|-WMT2Mu|Er9g#@t$^P~8zTjR#B+5r`L-v#Q+BKQJC!BbGF9&VBQ zU$=5ghp~v#_|GsyaYG0yK~?>i--l+ChFl20-Vq~g(pO|*;f@3~tFBidYYTSxILwk( zi;~KSgJ6pR%zB&(APozmMNdm1^J!k{=IY+o*pFR8A`%)dmd*u0*FxmP#61E;(Ay%zR1J>7ngj{um!-Pn_4cn~nOdkFgS=vhu(yz>Dxs6l=+(c`BeKE{oG z^sS|(w4`LH!nx===);IiO|>vG@}Ue50lOr0006Y72pUd7Qz~T3oq-VpBN*!FxXAq1 zJ?+iS&z?TLp{52*@EDT}^M4jVYFq<;QUn!oXU^Q+S|0t;kxFoU0EPk?paf~q-3ep` zG{K_%KnrbYX({b#MG&9@o{FNMUVxpo&CKXNuFB$&n8i-54Q42%G1SkYyAvRFV>pWa8Ja>!HAtrD{Jea52dv- zN=gTyZ42#jfpCbB2lRyREY@(Mjj$33OjB#9q1IMc7mEeLn1!J}jcK_*WPJ=*)}xyp zt?~Nu>C;t^o;!EW0iZC@UU9r%@|l^M`tR@h5ZDb!6xaa$Y}lP` zET9tzy(0inTGD`i{Rf0837c34tyr(fv~_ffokpwwAvt#S>Q(pU5mv%2Pb;AnQmn&3 zgj}NL)PE7K9y%;P(PM08zC#dd6}(_zrQ~?GXsOZ%q-7CzJ>NA!Gx63 z)zvMlS=?UTSNyNvfsCtPzy74hXBL}QTwDyAJZoMk(f^AVub^nTjT45N+uQ$Z9h;!Yo{@#+M@rI!F_*0S`6F76o{X3CDrB7PP~3UJ7zp1vFDj}8 z`pUoiIzd1m?9}NkDEyE`f^O|eAeo9##r`o%pe}~0f$~sWf_6#tN09a;Wn^U90z2yi z0vt7N-psX1{I7+Arf|fCQ=sj4$k@zmN$nLxMCe&=EH;Bo_I$*Qv9;5`HZP1+1S`3G z`Eq-GWK`5iPR@c5sP`K4neIp=Y|9`i0n&VpwqcuKH8 z1cEeXQkDtY+`k{!axcl7npDFx#ed`^CTRLL;?=3Ms|RyR-2a?Bga^B#R(Brv{$W9aJ} zkkKKW4f56ID%p@9?HC|Tk^~4?eSZ88$=S1K9Ymjb=fEV9%iz@vkD9)GS;#IMh~0DW zkaET?npN3$o-HVAo>{cTh_4UQ1C`xd@Fuo~#}sWB?VKmR2u|`)xe~0xL(s`7expdD z|2j%5NxBoF(iM*LU(P~rDu7<@ke`Z^U3D%{2LZ`n7u{#IVQ(FXIlaqpA01Zca|OEb zAC75&UWdQDR5?V904BGxQkvbcaQwA8%BpO0wKZORwAy1W(|L{dJA9x@_q5>-`IJoTBN_Y&wAXulSINb?G( z4D1WA7{V{`;^U=mjP7V>Rkm1A zXSfSE9Z8*_PoN#7#sK*mVJyD>{<}CL2eId%%ly$$B(Y<77|_K-W{_uFzB&J6*W5U_F^4MF2W z<`>fDbye7)d;7+INM>+${c7>W?@C{?CZ-H21jHmSj`qWXO@rWxD>omaRSS1}Lr&7S zyzCnu^zXpWEz{TDLY5!fIBp!YDKyKw2J!J9B>KpN`uVhB4$N2OKBCwFyZ{6jx~=Ls zovv%cXyn-2u)X#J{XNmOz2F4i|FRd6qT=pPWk=UgVE3zlv<W<3ZR)pd1e;Bu5NK$10a&J~FL~)8r=JufnM!d8<%p@>Z6G-RwDPJc zXlQMR%qp;nbhg#vkco$X0*#Ba?cmsW+EWyE_IFl_%rW?P*(nK%2s~&CRUsylP+0GG z{uU)rYTagB=f4d&7g*d7Xp4{GJKKw;9Vw6S4?e%Bt*r$B`n2>zRBi1pNKyxoKhFA= zS5%h^z_i9suYQYqaPVDST?&4i`KDE3l9C%>7Q1y#Lb{E@-4TF8U(j#{?(ke5d1sXY zfr8Tjb_V=zJe{SHSbp#Ga{xA>APR}Z1Eiws)K@SG6Ss~HFva%Q1NcEyCNVzVXLU*y zQk;+Z1ff>Q8yXsW--BqMh5=yHA2D{YzZJ=^2P9%UzfLp&ZPK4_r00&z%@w=_uoAE^FF|;uIR*5m!MRBR{t*Kqwnp&|dFA)O zn4%~t*Socp_G-rV!s#f$;L|#0X35FPX1cmpYN6`@q=J{x03U0kKb3HUl^(F{%S(S#%h|j+-uEK{yq>TZVh_A5fjo-k{qvc|H98 z4tvancqO0JGMC9F-g7U4Wv}pyBNhjY-n|n_^`?*Q|&N`A#nn@?cs{N!mH;cAbuhq|M6Uh`%^4of-aI)B3^9o4`-5eZ@IM}ctNGhb)U_?koz^Mm&^}|0z zZp*uLMP0J|0$YAyyK!9eMoXNeA8rV3ucoHfsp5V2W1#S4)0v`i?e)v~KC6Ja30ML& z&zhmUb|2Yv{qC7!?a*u$(zGy2DV_-v5H*BNytR0^`YoL?6%k;!98=b;cQQEqv{Lw0 zDXT1A{?j)!ubVff)rvpbt?jw>pW%#A$IXq!MI4{hR=KFTQCsb=7DV!CG^8bpsZvso zD4ycWl;E{;y?2&i%^>AAE`%-GTYi~Q2IBJ;QbvB|t5a(xOwWIQ zo&04&^hwKK-}t27E>G z31XK>qOTrivZR4=GtlU&QJ)tW~{A4cOm~Tw_sh{hILpzM*nbrkv&8yJn$Rnm)g@+}zf{ zTcLm}a#$>VxS~C0E8D&W(C0#BswB9DA?H7t#l&^`_3pjZ)spXCtB6Ehv5SaC&@@8< z-q0}p0(9kz>^V;Ue!luCaJSzgfb%d5bQl0RFaTW-_Bi=_BW|g``@FV4B09Ykr9J1q zfIu_5l$!~b({DqoWLj#eW*y*u;i$(rUe} zx>f6yfpQ0^nx5e6K|V9m$$?mSFPe1NwZo6`+?Vo2##ykn%WfzQ6o1jaZZzmKsFoel zu_s>9z6#v^W5U>ujg=x@DJN5GLA~GXnY{OFZ&b=puw{_#YAWDOhmKAaeq=NoR7aB``wIFE_WzcZW&vW;J7Kw zbMM}jrPcA-&cdO-k3oM*NAPT42SKZ6zTv^ScWYj6ogQ{OnMS~~i}IpEXm32~?1j2D zm$>ZM9ss@Jbf0)>(dSNoVSt8eXF?DqWx4fI5bYDYrBQmG{Ero<5k34^See6vB~oTR zH;8nAe#p8QSE-ALpq?uG6{MH^>k0NNptmG<8?+66izN|0zS4s!npRz~i9J2?BXNub zS%~Olp5rb= zJizvST_}tM-apX)Koze`GTO?-kQ#sVzP0QJ-qCZKI;pSL=PKy!dR8(l!ME~Cr{Aj@ zFpt7A>lqKH-ttD!!TYd)v>I3(pal%qjC?(ISdETtM^~i3LQQVrB@!YzQiwUfrRbZ7 zzv}mGUQUgS2rT#1TjA4zrKLvoW_kC+R26% z2=ue#Wr`GDp|(8I&3DgZ+fzU<32U57nq=13juAiSJ9;L^s8@Ma<&aWpGzp*YIu&eD zyCDlB!$1TUB0gVzITu-Vbu~WO3l|SC*bQ2+F3K>a_cH1uYzXmAF9uj>vzc<%R;A6= z`Y+7$HP7?Xi)0m6G_-ZBU=^sk`5XcL@V)I%7Hy-MlK6Yw=&cVx!bVA4*zl?}Fr??E z{QlPu#$wO>p4)h9aRvAti#Cq#qQ;gLKE}M*|V1S{>~r4?Cvp^nq$`8tyMM% zom$Q*a(V?qqUA8SNBvB~n)?M>x)RyE(x1ak-s=?EkcafCG_@#7KE#v`uS?nEaJl`S zXH)h|c5xs2H^8&QS)WS3isU5b@o5Kk_hFs{UVQ_M_I3hqz`1S_g&_|o=2+v{M1s7U zME6E!iiwmnHO@Eqk206-G8{%bk!;R8^#lw9?;sE0Ibl7blXxt4EY#y*DF^Tyg7O^QOD8N zHh`tV0!-|j*YhjytM1}n5MJu=P{+b_a06#Qz%)7x)Ybt%kI8@PRT0pCUaxETQHz&X zwfSDyN9Os-SB4PnaZXg_$r7JmKc99TY#$rb=PxP^-4@45*^Y&?zh@yPr4fvHgQQW6 z1Z*to$O#B^<=Eo*ozoEQvbS#sdn4wmCuA!EZ{27UGzi3X_SWoqic)_YG@y4YGH)(w z9$Njao{SUDjIU$NKq>ew_#lIaUr+aZV@5fLT_plGA_8eOHj{RRY{2f)Qn(rNq)u&b zB<=}YXxHMw-sULK@E##FK&uiUNuGI>ctYWHh0*TIXmRPsraoY9jwBmWoZqsK=rmEk&O{yUESR z&HW@pvlqJ~Wh1`RrPZ0IhQ~!n9ZgvhRLWyfk06=v-q|~Kjb=dFK%gg@ zecfZa7v7sIMWNBa?)9C7UeR9#{&@1a+@fi>J8~{U*>aU3aVGV3b$uXSbX{1otGsDW zR2j@CV%@|c9&zS$1)s(1{OwqGGsUwfmTIP%{RLg{Vs{`>hg4yqm$Pd-D>Vc z48Hh_u3{zZBD=(x@11iK>5I4&iyt4t1#(k|7=r9XFzQ@0#InsbJUg~PW zwZdWf8d@4IL1O)Dl}kcR;6V^9cFJqko@n3V`&D4`9Dr?JB!%GBDWUz5}-wD&F)lG5SiXFTAbh)Lga}+{TDuuzxr?j|fR{bW(SHlj} z!R!7*ONG_+@+(b>Jyp5iUmxuZ7b^(zNV4e+{s#~Ng90@T6+=5OSO4#_ZjX$bk=#~& z2n^&dm|w+l0b#>&bHJruf;0wDnZtfdUWI#O_|JTRJVq}X_KMhc;xb6&cIRpsU*}hqliykDABg zZ*METMjph1xb?ExG?un0srJR~QfsP=HFq)ug&YW>(l>`q4QpsM3W(+vggqpaL^2GW z%_CS*)wulip3h*I_a6!=Dg+W(xl%E^Ksn=$W7bnol4rJST>_15UR8Kb2}}(K^+=XR z!7FHHJkD>V3UICsR|2D=^S^9f{iKZ~TDemKb8=r;j@Ae^x<8MCe{OWM<6BE!XL{5l=0?O1@TjcPTf`acXgZs(m@a_l zAZqOZ0k7mS)rS}NIWmj^9M>d!kplKx%R%}Bu@pjsd&H-R_T&69f zQuc2!3JwL-*s-sh;-h}G4~^U}MsD_Um`v!uevM96fWq`uy;~3Wgl;q~{WR+2m}T<7 z_LyKq5csAQ7zXQYa&5?+&|S2j1PDBtbUFvo?_eS&0E~j}86@f;khh{lgnVTm7<6vP z?%c0gZ{O%f`&C@(f%)YR*$QwtTn;7}Hw485S88iEMLQyVr6+aqtyfkmp9A;Njr8#8 zTUH{FuRS}h&rS2HjXkd)3^+8~noDwu+#9w{<+;cIeov6G`Ui+mkMd3K;!|H;7AZj| z?Ux*BpxhNX_tMpjzj7B9QpoGMgsj;}y%cmyl>pwZ2l;K@< zo&GCnhIPsNj-xrpsj#cSrI5@v%1r)omvDJZ!g(CbjGsi2GVSQ%Pc3OYR%c?DS(xhn z+2rKpdT-_K?rs!bmO-a$?%pM|m2%~Gq$r<-M$l*CC%iDt3lYKBq>yK{1CnNh|uk#k6W zGEfhK$SHpkf|;3lm9Txp#a6JBnVHH@u`iy+}b(N|7 zW?%)QOj8pR-Pm22(%M=|t8b3F6l<5GDwQ|28YwB9>Chkvxtk8`<*d;aQ1L5mKSWNF zMR7Sr)FF3nsen)m9@J1Oj2(Z@j(z7p=qR z0Vvs^_06J9DQ(=4?fwJ9-WqAPvI(GZNF)-2Gk*{q-4+@YblT9cmy+m|?_9#>U4dFY z{wSPPgsQ}agp^fQx~l(phSUN+BO^E8C7KIPdFoSJn}LA=xYIago8wYL5@IHU?6{PN z_it8}mR>qV^u9Z_c?Ycgsus#~I?Tvvmn3+BmBAYVj@}g$0~FSUfFLFC*8lT|_xw*B Y_WiEiNRg#rft2J$ONR@uf4*_=zf|7x3jhEB diff --git a/architecture.md b/architecture.md index 39e751d1ba..64b0149b41 100644 --- a/architecture.md +++ b/architecture.md @@ -41,11 +41,11 @@ and therefore works seamlessly with the [Docker\* Engine](https://www.docker.com/products/docker-engine) pluggable runtime architecture. It also supports the [Kubernetes\* Container Runtime Interface (CRI)](https://github.com/kubernetes/kubernetes/tree/master/pkg/kubelet/apis/cri/v1alpha1/runtime) through the [CRI-O\*](https://github.com/kubernetes-incubator/cri-o) and -[CRI-containerd\*](url here) implementation. In other words, you can transparently +[CRI-containerd\*](https://github.com/containerd/cri) implementation. In other words, you can transparently select between the [default Docker and CRI shim runtime (runc)](https://github.com/opencontainers/runc) and `kata-runtime`. -![Docker and Kata Containers](arch-images/docker-cc.png) +![Docker and Kata Containers](arch-images/docker-kata.png) `kata-runtime` creates a QEMU\*/KVM virtual machine for each container or pod the Docker engine or Kubernetes' `kubelet` creates. @@ -86,8 +86,6 @@ configured, virtio-scsi will be used. In all other cases a 9pfs virtio mount poi will be used. `kata-agent` uses this mount point as the root filesystem for the container processes. -![Overall architecture](arch-images/overall-architecture.png) - ## Hypervisor Kata Containers is designed to support multiple hypervisors. For the 1.0 release, @@ -96,70 +94,74 @@ to create virtual machines where containers will run: ![QEMU/KVM](arch-images/qemu.png) -Although Kata Containers can run with any recent QEMU release, Kata Containers -boot time and memory footprint are significantly optimized by using a specific QEMU -version called [`qemu-lite`](https://github.com/kata-containers/qemu/tree/qemu-lite-2.11.0). -Kata Containers supports various machine types, including `pc`, `pc-lite` and `q35`. -Kata Containers defaults to using the `pc` machine type. In the past -`pc-lite` was utilized which provided the following improvements: -- Removed many of the legacy hardware devices support so that the guest kernel - does not waste time initializing devices of no use for containers. -- Skipped the guest BIOS/firmware and jumped straight to the Clear Containers - kernel. +### QEMU/KVM -### Assets +Depending of the host architecture, Kata Containers support various machine types, +for example `pc` and `q35` on x86 systems and `virt` on ARM systems. Kata Containers' +default machine type is `pc`. The default machine type and its [`Machine accelerators`](#Machine-accelerators) can +be changed by editing the runtime [`configuration`](#Configuration) file. -## Hypervisor - -Kata Containers are designed to support multiple hypervisors. For the 1.0 release, Kata Containers use just [QEMU](http://www.qemu-project.org/)/[KVM](http://www.linux-kvm.org/page/Main_Page) to create virtual machines where containers will run: - -![QEMU/KVM](arch-images/qemu.png) - -Depending of the host architecture, Kata Containers support various machine types, for example `pc` and `q35` on x86 systems and `virt` on ARM systems. Kata Containers default to use the `pc` machine type on x86 systems and `virt` on ARM systems, the default machine type and its [`Machine accelerators`](#Machine-accelerators) can be changed by editing the runtime [`configuration`](#Configuration) file. - -Next QEMU features are used in Kata Containers to manage resource constraints, improve boot time and reduce memory footprint: +The follow QEMU features are used in Kata Containers to manage resource constraints, improve +boot time and reduce memory footprint: - Machine accelerators. - Hot plug devices. Each feature is documented below. -### Machine accelerators +#### Machine accelerators -Machine accelerators are architecture specific and can used to improve the performance and enable specific features of the machine types. Next machine accelerators are used in Kata Containers: +Machine accelerators are architecture specific and can used to improve the performance +and enable specific features of the machine types. The following machine accelerators +are used in Kata Containers: -- nvdimm: This machine accelerator is x86 specific and only supported by `pc` and `q35` machine types. `nvdimm` is used to provide the root filesystem as persistent memory device to the Virtual Machine. +- nvdimm: This machine accelerator is x86 specific and only supported by `pc` and +`q35` machine types. `nvdimm` is used to provide the root filesystem as persistent +memory device to the Virtual Machine. Although Kata Containers can run with any recent QEMU release, Kata Containers -boot time, memory footprint and 9p IO are significantly optimized by using a specific QEMU version called [`qemu-lite`](https://github.com/kata-containers/qemu/tree/qemu-lite-2.11.0) and custom machine accelerators that are not available in the upstream version of QEMU. These custom machine accelerators are described below. +boot time, memory footprint and 9p IO are significantly optimized by using a specific +QEMU version called [`qemu-lite`](https://github.com/kata-containers/qemu/tree/qemu-lite-2.11.0) and +custom machine accelerators that are not available in the upstream version of QEMU. +These custom machine accelerators are described below. -- nofw: this machine accelerator is x86 specific and only supported by `pc` and `q35` machine types. `nofw` is used to boot an ELF format kernel by skipping the BIOS/firmware in the guest. This custom machine accelerator improves the boot time significantly. -- static-prt: this machine accelerator is x86 specific and only supported by `pc` and `q35` machine types. `static-prt` is used to reduce the interpretation burden for guest ACPI component. +- nofw: this machine accelerator is x86 specific and only supported by `pc` and `q35` +machine types. `nofw` is used to boot an ELF format kernel by skipping the BIOS/firmware +in the guest. This custom machine accelerator improves boot time significantly. +- static-prt: this machine accelerator is x86 specific and only supported by `pc` +and `q35` machine types. `static-prt` is used to reduce the interpretation burden +for guest ACPI component. -### Hot plug devices - -In order to improve boot time, reduce memory footprint and since running containers can be updated at any time, Kata Containers start with minimum amount of resources to attach devices when is needed. One example of this behavior is when a CPU constraint is specified, CPUs can be hot added or removed depending of the constraint specified. -Currently Kata Containers have support for hot adding next devices: +#### Hot plug devices +The Kata Containers VM starts with a minimum amount of resources, allowing for faster boot time and a reduction in memory footprint. As the container launch progresses, devices are hotplugged to the VM. For example, when a CPU constraint is specified which includes additional CPUs, they can be hot added. Kata Containers has support for hot-adding the following devices: - Virtio block - Virtio SCSI - VFIO - CPU +### Assets + +The hypervisor will launch a virtual machine which includes a minimal guest kernel +and a guest image. + #### Guest kernel The guest kernel is passed to the hypervisor and used to boot the virtual -machine. It is highly optimized for kernel boot time and minimal memory -footprint, providing only those services required by a container workload. +machine. The default kernel provided in Kata Containers is highly optimized for +kernel boot time and minimal memory footprint, providing only those services +required by a container workload. This is based on a very current upstream Linux +kernel. -#### Root filesystem image +#### Guest image -The root filesystem image, sometimes referred to as the "mini O/S", is a -highly optimised container bootstrap system based on [Clear Linux](https://clearlinux.org/). -It provides an extremely minimal environment and has a highly optimised boot -path. +Kata Containers supports both an `initrd` and `rootfs` based minimal guest image. -TODO: enter section here about using initrd, and also about the customization.. +##### Root filesystem image + +The default root filesystem image, sometimes referred to as the "mini O/S", is a +highly optimized container bootstrap system based on [Clear Linux](https://clearlinux.org/). It provides an extremely minimal environment and +has a highly optimized boot path. The only services running in the context of the mini O/S are the init daemon (`systemd`) and the [Agent](#agent). The real workload the user wishes to run @@ -175,26 +177,29 @@ For example, when `docker run -ti ubuntu date` is run: (`date` in this example). - The agent will then execute the command (`date` in this example) inside this new context, first setting the root filesystem to the expected Ubuntu* root - filesystem. <--talk more about how we are like a lightweight/stripped down runc here. + filesystem. + +##### Initrd image + +placeholder ## Agent -[`kata-agent`](https://github.com/kata-containers/agent) is a daemon running in the +[`kata-agent`](https://github.com/kata-containers/agent) is a process running in the guest as a supervisor for managing containers and processes running within those containers. -The `kata-agent` execution unit is the sandbox. A `kata-agent` sandbox is a container sandbox -defined by a set of namespaces (NS, UTS, IPC and PID). `kata-runtime` can run several -containers per pod to support container engines that require multiple containers -running inside a single VM. In the case of docker, `kata-runtime` creates a single -container per pod. +The `kata-agent` execution unit is the sandbox. A `kata-agent` sandbox is a container sandbox defined by a set of namespaces (NS, UTS, IPC and PID). `kata-runtime` can +run several containers per VM to support container engines that require multiple +containers running inside a pod. In the case of docker, `kata-runtime` creates a +single container per pod. -`kata-agent` uses a gRPC communication protocol defined at some URL. It also runs -a [`yamux`](https://github.com/hashicorp/yamux) server on the same URL. +`kata-agent` communicates with the other Kata components over gRPC. +It also runs a [`yamux`](https://github.com/hashicorp/yamux) server on the same gRPC +URL (FIXME). -The `kata-agent` API consists of: -* list Here -* more stuff +placeholder for Kata Agent API description: we should consider moving this to +its own section and/or document. The `kata-agent` makes use of [`libcontainer`](https://github.com/opencontainers/runc/tree/master/libcontainer) to manage the lifecycle of the container. This way the `kata-agent` reuses most @@ -229,96 +234,113 @@ some url to documentation on how to enable debug). ### Significant OCI commands -Here we will describe how `kata-runtime` handles the most important OCI commands. +Here we describe how `kata-runtime` handles the most important OCI commands. #### [`create`](https://github.com/kata-containers/runtime/blob/master/cli/create.go) When handling the OCI `create` command, `kata-runtime` goes through the following steps: 1. Create the network namespace where we will spawn VM and shims processes. -2. Call into the pre-start hooks. One of them should be responsible for creating the `veth` network pair between the host network namespace and the network namespace freshly created. -3. Scan the network from the new network namespace, and create the MACVTAP connection between the `veth` interface and a `tap` interface that we create. -4. Start the VM inside the network namespace by providing the `tap` interface previously created. -5. Wait for the VM to be ready, otherwise the next step spawning the proxy might fail by not being able to connect the VM. -6. Start `kata-proxy`, and it will take care of connecting to the VM. This process will take care of proxying all communications with the VM. We rely on an architecture model with one proxy per VM. -7. Communicate with `kata-agent` (connecting the proxy) to configure the sandbox inside the VM. -8. Communicate with `kata-agent` (connecting the proxy) to create the container, and relying on the OCI configuration file `config.json` initially provided to `kata-runtime`. This actually spawns the container process inside the VM, leveraging the `libcontainer` package. -9. Start `kata-shim`, which will connect to the gRPC server socket, the `kata-proxy` socket in this case. It will spawn a few Go routines to parallelize blocking calls `ReadStdout()` , `ReadStderr()` and `WaitProcess()`. Both `ReadStdout()` and `ReadStderr()` are run through infinite loops since `kata-shim` wants the output of those until the container process terminates. `WaitProcess()` is a unique call which returns the exit code of the container process when it terminates inside the VM. Note that `kata-shim` is started inside the network namespace, to allow upper layers to determine which network namespace has been created and by checking the `kata-shim` process. It also creates a new PID namespace by entering into it. This ensures that all `kata-shim` processes belonging to the same container will get killed when the `kata-shim` representing the container process terminates. +2. Call into the pre-start hooks. One of them should be responsible for creating +the `veth` network pair between the host network namespace and the network namespace +freshly created. +3. Scan the network from the new network namespace, and create a MACVTAP connection + between the `veth` interface and a `tap` interface into the VM. +4. Start the VM inside the network namespace by providing the `tap` interface + previously created. +5. Wait for the VM to be ready. +6. Start `kata-proxy`, which will connect to the created VM. The `kata-proxy` process +will take care of proxying all communications with the VM. Kata has a single proxy +per VM. +7. Communicate with `kata-agent` (through the proxy) to configure the sandbox + inside the VM. +8. Communicate with `kata-agent` to create the container, relying on the OCI +configuration file `config.json` initially provided to `kata-runtime`. This +spawns the container process inside the VM, leveraging the `libcontainer` package. +9. Start `kata-shim`, which will connect to the gRPC server socket provided by the `kata-proxy`. `kata-shim` will spawn a few Go routines to parallelize blocking calls `ReadStdout()` , `ReadStderr()` and `WaitProcess()`. Both `ReadStdout()` and `ReadStderr()` are run through infinite loops since `kata-shim` wants the output of those until the container process terminates. `WaitProcess()` is a unique call which returns the exit code of the container process when it terminates inside the VM. Note that `kata-shim` is started inside the network namespace, to allow upper layers to determine which network namespace has been created and by checking the `kata-shim` process. It also creates a new PID namespace by entering into it. This ensures that all `kata-shim` processes belonging to the same container will get killed when the `kata-shim` representing the container process terminates. -At this point, the VM is running and `kata-shim` process represents the container process running inside the VM. It is seen as the container process from an OCI perspective. +At this point the container process is running inside of the VM, and it is represented +on the host system by the `kata-shim` process. #### [`start`](https://github.com/kata-containers/runtime/blob/master/cli/start.go) -With namespaced containers, `start` launches a traditional Linux container process -in its own set of namespaces. With Kata Containers, the main task of `kata-runtime` -is to ask [`kata-agent`](#agent) to start the container workload inside the virtual machine. -In practice, this means `kata-runtime` will run through the following steps: +With traditional containers, `start` launches a container process in its own set of namespaces. With Kata Containers, the main task of `kata-runtime` is to ask [`kata-agent`](#agent) to start the container workload inside the virtual machine. `kata-runtime` will run through the following steps: -1. Communicate with `kata-agent` (connecting the proxy) to start the container workload inside the VM. For instance, if the command to execute is `top`, pending `kata-shim` call into `ReadStdout()` will start returning some outputs. And `WaitProcess()` will continue to block as long as this process runs. -2. Call into the post-start hooks. Usually, this is a no-op since nothing is provided. +1. Communicate with `kata-agent` (through the proxy) to start the container workload + inside the VM. If, for example, the command to execute inside of the container is `top`, + the `kata-shim`'s `ReadStdOut()` will start returning text output for top, and + `WaitProcess()` will continue to block as long as the `top` process runs. +2. Call into the post-start hooks. Usually, this is a no-op since nothing is provided + (this needs clarification) #### [`exec`](https://github.com/kata-containers/runtime/blob/master/cli/exec.go) OCI `exec` allows you to run an additional command within an already running -container through the following steps: +container. In Kata Containers, this is handled as follows: -1. Communicate with `kata-agent` (connecting the proxy) to start a new process inside an existing container running inside the VM. -2. Start a new `kata-shim` inside the same network and PID namespaces as the `kata-shim` representing the container process. +1. A request is sent to the `kata agent` (through the proxy) to start a new process + inside an existing container running within the VM. +2. A new `kata-shim` is created within the same network and PID namespaces as the + original `kata-shim` representing the container process. This new `kata-shim` is + used for the new exec process. -Now the `exec`'ed process is running in the VM, sharing `uts`, `pid`, `mnt` and `ipc` namespaces with the container process. +Now the `exec`'ed process is running within the VM, sharing `uts`, `pid`, `mnt` and `ipc` namespaces with the container process. #### [`kill`](https://github.com/kata-containers/runtime/blob/master/cli/kill.go) -When sending the OCI `kill` command, container runtime should send a [UNIX signal](https://en.wikipedia.org/wiki/Unix_signal) to the container process. But a `kill` sending a termination signal such as `SIGKILL` or `SIGTERM`, is expected to actually terminate the container process, which means stopping the container from a nameespaced container perspective. -Applying this to Kata Containers translates into stopping the container and the VM associated with it. +When sending the OCI `kill` command, the container runtime should send a +[UNIX signal](https://en.wikipedia.org/wiki/Unix_signal) to the container process. +A `kill` sending a termination signal such as `SIGKILL` or `SIGTERM` is expected +to terminate the container process. In the context of a traditional container, +this means stopping the container. For `kata-runtime`, this translates to stopping +the container and the VM associated with it. -1. Communicate with `kata-agent` (connecting the proxy) to signal the container process inside the VM. -2. If the signal was not a termination signal (`SIGTERM` or `SIGKILL`), nothing else needs to be done. -3. Wait for `kata-shim` process to exit. -4. Force kill the container process if `kata-shim` process didn't return after a timeout. This is done by communicating with `kata-agent` (connecting the proxy), sending `SIGKILL` signal to the container process inside the VM. -5. Wait for `kata-shim` process to exit, and return an error if we reach the timeout again. -6. Communicate with `kata-agent` (connecting the proxy) to remove the container configuration from the VM. -7. Communicate with `kata-agent` (connecting the proxy) to destroy the sandbox configuration from the VM. -8. Stop the VM. This is not waiting for the end of the VM in order to save some time. -9. Remove all the network configuration inside the network namespace and delete it. -10. Execute post-stop hooks. Usually a no-op. +1. Send a request to kill the container process to the `kata-agent` (through the proxy). + else needs to be done. +2. Wait for `kata-shim` process to exit. +3. Force kill the container process if `kata-shim` process didn't return after a + timeout. This is done by communicating with `kata-agent` (connecting the proxy), + sending `SIGKILL` signal to the container process inside the VM. +4. Wait for `kata-shim` process to exit, and return an error if we reach the + timeout again. +5. Communicate with `kata-agent` (through the proxy) to remove the container + configuration from the VM. +6. Communicate with `kata-agent` (through the proxy) to destroy the sandbox + configuration from the VM. +7. Stop the VM. +8. Remove all network configurations inside the network namespace and delete the + namespace. +9. Execute post-stop hooks. -If `kill` was invoked with a non-termination signal, this simply signalled the container process. -Otherwise, everything has been torn down, and the VM has been shut down. +If `kill` was invoked with a non-termination signal, this simply signals the container process. Otherwise, everything has been torn down, and the VM has been removed. #### [`delete`](https://github.com/kata-containers/runtime/blob/master/cli/delete.go) -`delete` is about deleting all internal resources related to a container. -A running container cannot be deleted unless the OCI runtime is explicitly being -asked to, by using `--force` flag. +`delete` removes all internal resources related to a container. A running container +cannot be deleted unless the OCI runtime is explicitly being asked to, by using +`--force` flag. -If the sandbox is not stopped, which could happen if `kill` was not called, but the process would have returned on his own instead, it would first go through most of the steps `kill` would go for a termination signal. - -1. Wait for `kata-shim` process to exit. -2. Force kill the container process if `kata-shim` process didn't return after a timeout. This is done by communicating with `kata-agent` (connecting the proxy), sending `SIGKILL` signal to the container process inside the VM. -3. Wait for `kata-shim` process to exit, and return an error if we reach the timeout again. -4. Communicate with `kata-agent` (connecting the proxy) to remove the container configuration from the VM. -5. Communicate with `kata-agent` (connecting the proxy) to destroy the sandbox configuration from the VM. -6. Stop the VM. This is not waiting for the end of the VM in order to save some time. -7. Remove all the network configuration inside the network namespace and delete it. -8. Execute post-stop hooks. Usually a no-op. -9. Remove container resources. Every file kept under `/var/{lib,run}/virtcontainers/sandboxes//`. -10. Remove sandbox resources. Every file kept under `/var/{lib,run}/virtcontainers/sandboxes/`. - -If the sandbox was already stopped, then it is very simple: +If the sandbox is not stopped, but the particular container process returned on +its own already, the `kata-runtime` will first go through most of the steps a `kill` +would go through for a termination signal. After this (or simply this if the sandboxIDwas already stopped), then `kata-runtime` will: If the sandbox was already stoppedfollowed by: 1. Remove container resources. Every file kept under `/var/{lib,run}/virtcontainers/sandboxes//`. 2. Remove sandbox resources. Every file kept under `/var/{lib,run}/virtcontainers/sandboxes/`. -At this point, everything related to the container should have been removed from the host system, and no related process should be running anymore. +At this point, everything related to the container should have been removed from the host system, and no related process should be running. #### [`state`](https://github.com/kata-containers/runtime/blob/master/cli/state.go) -`state` returns the status of the container. In Kata Containers context, this means being able to detect if the container is still running by looking at the state of `kata-shim` process representing this container process. +`state` returns the status of the container. For `kata-runtime`, this means being +able to detect if the container is still running by looking at the state of `kata-shim` +process representing this container process. -1. Ask the container status by checking information stored on disk. +1. Ask the container status by checking information stored on disk. (clarification needed) 2. Check `kata-shim` process representing the container. -3. In case the container status on disk was supposed to be `ready` or `running`, and the `kata-shim` process is not around, this involves the detection of a stopped container. This means that before returning the container status, the container has to be properly stopped. Here are the steps involved by this detection: +3. In case the container status on disk was supposed to be `ready` or `running`, + and the `kata-shim` process no longer exists, this involves the detection of a + stopped container. This means that before returning the container status, + the container has to be properly stopped. Here are the steps involved in this detection: 1. Wait for `kata-shim` process to exit. 2. Force kill the container process if `kata-shim` process didn't return after a timeout. This is done by communicating with `kata-agent` (connecting the proxy), sending `SIGKILL` signal to the container process inside the VM. 3. Wait for `kata-shim` process to exit, and return an error if we reach the timeout again. @@ -330,7 +352,11 @@ At this point, everything related to the container should have been removed from ## Proxy -make sure we discuss that this is optional, and also describe no proxy operation +Communication with the VM can be achieved by either `virtio-serial` or, if the host +kernel is newer than v4.8, a virtual socket, `vsock` can be used. The default is `virtio-serial`. + +The VM will likely be running multiple container processes. In the event `virtio-serial` +is used, the I/O streams associated with each process needs to be multiplexed and demultiplexed on the host. On systems with `vsock` support, this component becomes optional. `kata-proxy` is a process offering access to the VM [`kata-agent`](https://github.com/kata-containers/agent) to multiple `kata-shim` and `kata-runtime` clients associated with the VM. Its @@ -338,7 +364,7 @@ main role is to route the I/O streams and signals between each `kata-shim` instance and the `kata-agent`. `kata-proxy` connects to `kata-agent` on a unix domain socket that `kata-runtime` provides while spawning `kata-proxy`. -`kata-proxy` uses [`yamux`](https://github.com/hashicorp/yamux) to multplex gRPC +`kata-proxy` uses [`yamux`](https://github.com/hashicorp/yamux) to multiplex gRPC requests on its connection to the `kata-agent`. When proxy type is configured as "proxyBuiltIn", we do not spawn a separate @@ -384,20 +410,19 @@ which is shared between containers In order to do so, container engines will usually add one end of a `virtual ethernet (veth)` pair into the container networking namespace. The other end of the `veth` -pair -is added to the container network. +pair is added to the container network. -This is a very namespace-centric approach as QEMU cannot handle `veth` interfaces. -Instead it typically creates `TAP` interfaces for adding connectivity to a virtual -machine. +This is a very namespace-centric approach as many hypervisors (in particular QEMU) +cannot handle `veth` interfaces. Typically, `TAP` interfaces are created for VM +connectivity. -To overcome that incompatibility between typical container engines expectations -and virtual machines, `cc-runtime` networking transparently bridges `veth` -interfaces with `TAP` ones: +To overcome incompatibility between typical container engines expectations +and virtual machines, `kata-runtime` networking transparently connects `veth` +interfaces with `TAP` ones using MACVTAP: -![Clear Containers networking](arch-images/network.png) +![Kata Containers networking](arch-images/network.png) -Clear Containers supports both + Kata Containers supports both [CNM](https://github.com/docker/libnetwork/blob/master/docs/design.md#the-container-network-model) and [CNI](https://github.com/containernetworking/cni) for networking management. @@ -470,11 +495,11 @@ __Runtime network setup with CNI__ ## Storage Container workloads are shared with the virtualized environment through [9pfs](https://www.kernel.org/doc/Documentation/filesystems/9p.txt). The devicemapper storage driver is a special case. The driver uses dedicated block -devices rather than formatted filesystems, and operates at the block level rather than the file -level. This knowledge is used to directly use the underlying block device -instead of the overlay file system for the container root file system. The block -device maps to the top read-write layer for the overlay. This approach gives much -better I/O performance compared to using 9pfs to share the container file system. +devices rather than formatted filesystems, and operates at the block level rather +than the file level. This knowledge is used to directly use the underlying block +device instead of the overlay file system for the container root file system. The +block device maps to the top read-write layer for the overlay. This approach gives +much better I/O performance compared to using 9pfs to share the container file system. The approach above does introduce a limitation in terms of dynamic file copy in/out of the container using the `docker cp` operations. The copy operation from @@ -490,7 +515,7 @@ docker cp [OPTIONS] CONTAINER:SRC_PATH HOST:DEST_PATH docker cp [OPTIONS] HOST:SRC_PATH CONTAINER:DEST_PATH ``` -Clear Containers has the ability to hotplug and remove block devices, which makes it +Kata Containers has the ability to hotplug and remove block devices, which makes it possible to use block devices for containers started after the VM has been launched. Users can check to see if the container uses the devicemapper block device as its @@ -518,14 +543,12 @@ based [Container Runtime Interface (CRI)](https://github.com/kubernetes/communit In other words, a kubelet is a CRI client and expects a CRI implementation to handle the server side of the interface. -[CRI-O\*](https://github.com/kubernetes-incubator/cri-o) is a CRI implementation -that relies on [OCI](https://github.com/opencontainers/runtime-spec) compatible -runtimes for managing container instances. +[CRI-O\*](https://github.com/kubernetes-incubator/cri-o) and CRI-containerd\* are CRI implementationn that rely on [OCI](https://github.com/opencontainers/runtime-spec) +compatible runtimes for managing container instances. -Clear Containers is an officially supported CRI-O runtime. It is OCI compatible and -therefore aligns with CRI-O architecture and requirements. +Kata Containers is an officially supported CRI-O and CRI-containerd runtime. It is OCI compatible and therefore aligns with each projects' architecture and requirements. However, due to the fact that Kubernetes execution units are sets of containers (also -known as pods) rather than single containers, the Clear Containers runtime needs to +known as pods) rather than single containers, the Kata Containers runtime needs to get extra information to seamlessly integrate with Kubernetes. ### Problem statement @@ -535,22 +558,22 @@ such as namespaces, groups, hardware resources, security contents, *etc* shared the containers within that pod. By default the kubelet will send a container creation request to its CRI runtime for each pod and container creation. Without additional metadata from the CRI runtime, -the Clear Containers runtime will thus create one virtual machine for each pod and for +the Kata Containers runtime will thus create one virtual machine for each pod and for each containers within a pod. However the task of providing the Kubernetes pod semantics when creating one virtual machine for each container within the same pod is complex given the resources of these virtual machines (such as networking or PID) need to be shared. -The challenge with Clear Containers when working as a Kubernetes\* runtime is thus to know +The challenge with Kata Containers when working as a Kubernetes\* runtime is thus to know when to create a full virtual machine (for pods) and when to create a new container inside a previously created virtual machine. In both cases it will get called with very similar arguments, so it needs the help of the Kubernetes CRI runtime to be able to distinguish a pod creation request from a container one. -### OCI annotations +### CRI-O -#### CRI-O +#### OCI annotations -In order for the Clear Containers runtime (or any virtual machine based OCI compatible +In order for the Kata Containers runtime (or any virtual machine based OCI compatible runtime) to be able to understand if it needs to create a full virtual machine or if it has to create a new container inside an existing pod's virtual machine, CRI-O adds specific annotations to the OCI configuration file (`config.json`) which is passed to @@ -559,7 +582,7 @@ the OCI compatible runtime. Before calling its runtime, CRI-O will always add a `io.kubernetes.cri-o.ContainerType` annotation to the `config.json` configuration file it produces from the kubelet CRI request. The `io.kubernetes.cri-o.ContainerType` annotation can either be set to `sandbox` -or `container`. Clear Containers will then use this annotation to decide if it needs to +or `container`. Kata Containers will then use this annotation to decide if it needs to respectively create a virtual machine or a container inside a virtual machine associated with a Kubernetes pod: @@ -584,64 +607,57 @@ with a Kubernetes pod: ``` -#### CRI-containerd +### Mixing VM based and namespace based runtimes + +One interesting evolution of the CRI-O support for `kata-runtime` is the ability +to run virtual machine based pods alongside namespace ones. With CRI-O and Kata +Containers, one can introduce the concept of workload trust inside a Kubernetes +cluster. + +A cluster operator can now tag (through Kubernetes annotations) container workloads +as `trusted` or `untrusted`. The former labels known to be safe workloads while +the latter describes potentially malicious or misbehaving workloads that need the +highest degree of isolation. In a software development context, an example of a `trusted` workload would be a containerized continuous integration engine whereas all +developers applications would be `untrusted` by default. Developers workloads can +be buggy, unstable or even include malicious code and thus from a security perspective +it makes sense to tag them as `untrusted`. A CRI-O and Kata Containers based +Kubernetes cluster handles this use case transparently as long as the deployed +containers are properly tagged. All `untrusted` containers will be handled by kata Containers and thus run in a hardware virtualized secure sandbox while `runc`, for +example, could handle the `trusted` ones. + +CRI-O's default behavior is to trust all pods, except when they're annotated with +`io.kubernetes.cri-o.TrustedSandbox` set to `false`. The default CRI-O trust level +is set through its `configuration.toml` configuration file. Generally speaking, +the CRI-O runtime selection between its trusted runtime (typically `runc`) and its untrusted one (`kata-runtime`) is a function of the pod `Privileged` setting, the `io.kubernetes.cri-o.TrustedSandbox` annotation value, and the default CRI-O trust +level. When a pod is `Privileged`, the runtime will always be `runc`. However, when +a pod is **not** `Privileged` the runtime selection is done as follows: + +| | `io.kubernetes.cri-o.TrustedSandbox` not set | `io.kubernetes.cri-o.TrustedSandbox` = `true` | `io.kubernetes.cri-o.TrustedSandbox` = `false` | +| :--- | :---: | :---: | :---: | +| Default CRI-O trust level: `trusted` | runc | runc | Kata Containers | +| Default CRI-O trust level: `untrusted` | Kata Containers | Kata Containers | Kata Containers | + + +### CRI-containerd We need to add a comparable section to detail how this is handled in containerd. If it is indentical then we should make the annotations section more generic. looking for help from Carlos here. -### Generalization +#### Mixing VM based and namespace based runtimes -The Kata Containers runtime is based on the `virtcontainers` package whose API is -inspired by the Kubernetes CRI one. `virtcontainers` execution units are sandboxes, -an equivalent of pods and it does not create or manage any container outside of -an existing sandbox context, and thus so does the Kata Containers runtime. -To create a Docker container it will first create a pod which will represent the container -hardware virtualized context and then start an actual container inside that virtual machine. -Both the pod and its container have the same identifier and name. - -### Mixing VM based and namespace based runtimes - -**We will need to update this section in order to generalize how it is handled in -CRI-O as well as in containerd.** - -One interesting evolution of the CRI-O support for the Clear Containers runtime is the ability -to run virtual machine based pods alongside namespace ones. With CRI-O and Clear Containers, -one can introduce the concept of workload trust inside a Kubernetes cluster. - -A cluster operator can now tag (through Kubernetes annotations) container workloads as `trusted` -or `untrusted`. The former labels known to be safe workloads while the latter describes -potentially malicious or misbehaving workloads that need the highest degree of isolation. -In a software development context, an example of a `trusted` workload would be a containerized -continuous integration engine whereas all developers applications would be `untrusted` by default. -Developers workloads can be buggy, unstable or even include malicious code and thus from a -security perspective it makes sense to tag them as `untrusted`. A CRI-O and Clear Containers -based Kubernetes cluster handles this use case transparently as long as the deployed containers -are properly tagged. All `untrusted` containers will be handled by Clear Containers and thus run -in a hardware virtualized secure sandbox whilst `runc`, for example, could handle the -`trusted` ones. - -CRI-O's default behaviour is to trust all pods, except when they're annotated with -`io.kubernetes.cri-o.TrustedSandbox` set to `false`. The default CRI-O trust level is -set through its `configuration.toml` configuration file. Generally speaking, the CRI-O -runtime selection between its trusted runtime (typically `runc`) and its untrusted one -(Clear Containers) is a function of the pod `Privileged` setting, the `io.kubernetes.cri-o.TrustedSandbox` -annotation value, and the default CRI-O trust level. When a pod is `Privileged`, the -runtime will always be `runc`. However, when a pod is **not** `Privileged` the runtime -selection is done as follows: - -| | `io.kubernetes.cri-o.TrustedSandbox` not set | `io.kubernetes.cri-o.TrustedSandbox` = `true` | `io.kubernetes.cri-o.TrustedSandbox` = `false` | -| :--- | :---: | :---: | :---: | -| Default CRI-O trust level: `trusted` | runc | runc | Clear Containers | -| Default CRI-O trust level: `untrusted` | Clear Containers | Clear Containers | Clear Containers | +placeholder: we'll want to refactor this section and make a more general 'mixed' +section describing CRI-O and cri-containerd, assuming that only the actual annotation +names are changed, and concept is otherwise identical. Should also start to consider +a description of secure sandbox... # Appendices ## DAX -Clear Containers utilises the Linux kernel DAX [(Direct Access filesystem)](https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/Documentation/filesystems/dax.txt) +Kata Containers utilizes the Linux kernel DAX [(Direct Access filesystem)](https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/Documentation/filesystems/dax.txt) feature to efficiently map some host-side files into the guest VM space. -In particular, Clear Containers uses the QEMU nvdimm feature to provide a +In particular, Kata Containers uses the QEMU nvdimm feature to provide a memory-mapped virtual device that can be used to DAX map the virtual machine's root filesystem into the guest memory address space. @@ -650,15 +666,15 @@ file and device mapping mechanisms: - Mapping as a direct access devices allows the guest to directly access the host memory pages (such as via eXicute In Place (XIP)), bypassing the guest - page cache. This provides both time and space optimisations. + page cache. This provides both time and space optimizations. - Mapping as a direct access device inside the VM allows pages from the host to be demand loaded using page faults, rather than having to make requests - via a virtualised device (causing expensive VM exits/hypercalls), thus providing -a speed optimisation. -- Utilising `MAP_SHARED` shared memory on the host allows the host to efficiently + via a virtualized device (causing expensive VM exits/hypercalls), thus providing + a speed optimization. +- Utilizing `MAP_SHARED` shared memory on the host allows the host to efficiently share pages. -Clear Containers uses the following steps to set up the DAX mappings: +Kata Containers uses the following steps to set up the DAX mappings: 1. QEMU is configured with an nvdimm memory device, with a memory file backend to map in the host-side file into the virtual nvdimm space. 2. The guest kernel command line mounts this nvdimm device with the DAX