From bf88c024d9ab1b41d3592bce3f682e84e9f500e6 Mon Sep 17 00:00:00 2001 From: Ram <1331672+chukka@users.noreply.github.com> Date: Tue, 30 Jul 2024 09:41:29 +0530 Subject: [PATCH 01/30] [artifactory] 7.90.5 release --- stable/artifactory-cpp-ce/CHANGELOG.md | 2 +- stable/artifactory-cpp-ce/Chart.yaml | 6 +- stable/artifactory-cpp-ce/logo/conan.png | Bin 3745 -> 370655 bytes stable/artifactory-cpp-ce/values.yaml | 4 +- stable/artifactory-ha/CHANGELOG.md | 38 +- stable/artifactory-ha/Chart.yaml | 6 +- stable/artifactory-ha/ci/test-values.yaml | 2 +- .../files/nginx-artifactory-conf.yaml | 98 ++ .../artifactory-ha/files/nginx-main-conf.yaml | 83 ++ stable/artifactory-ha/files/system.yaml | 28 +- .../artifactory-ha/logo/artifactory-logo.png | Bin 12876 -> 82419 bytes .../artifactory-2xlarge-extra-config.yaml | 4 + .../sizing/artifactory-2xlarge.yaml | 11 +- .../artifactory-large-extra-config.yaml | 4 + .../sizing/artifactory-large.yaml | 11 +- .../artifactory-medium-extra-config.yaml | 5 + .../sizing/artifactory-medium.yaml | 11 +- .../artifactory-small-extra-config.yaml | 5 +- .../sizing/artifactory-small.yaml | 11 +- .../artifactory-xlarge-extra-config.yaml | 5 +- .../sizing/artifactory-xlarge.yaml | 11 +- .../artifactory-xsmall-extra-config.yaml | 5 +- .../sizing/artifactory-xsmall.yaml | 11 +- stable/artifactory-ha/templates/NOTES.txt | 9 +- stable/artifactory-ha/templates/_helpers.tpl | 60 ++ .../templates/artifactory-license-secret.yaml | 2 +- .../artifactory-node-statefulset.yaml | 279 ++++++ .../artifactory-primary-statefulset.yaml | 274 +++++ .../templates/nginx-artifactory-conf.yaml | 4 + .../artifactory-ha/templates/nginx-conf.yaml | 4 + stable/artifactory-ha/values.yaml | 945 ++++++++---------- stable/artifactory-jcr/CHANGELOG.md | 2 +- stable/artifactory-jcr/Chart.yaml | 6 +- stable/artifactory-jcr/logo/jcr-logo.png | Bin 3134 -> 77047 bytes stable/artifactory-jcr/values.yaml | 4 +- stable/artifactory-oss/CHANGELOG.md | 2 +- stable/artifactory-oss/Chart.yaml | 6 +- stable/artifactory-oss/values.yaml | 4 +- stable/artifactory/CHANGELOG.md | 36 +- stable/artifactory/Chart.yaml | 4 +- stable/artifactory/ci/test-values.yaml | 2 +- .../files/nginx-artifactory-conf.yaml | 98 ++ stable/artifactory/files/nginx-main-conf.yaml | 83 ++ stable/artifactory/files/system.yaml | 28 +- stable/artifactory/logo/artifactory-logo.png | Bin 12876 -> 82419 bytes .../artifactory-2xlarge-extra-config.yaml | 5 +- .../sizing/artifactory-2xlarge.yaml | 11 +- .../artifactory-large-extra-config.yaml | 5 +- .../artifactory/sizing/artifactory-large.yaml | 11 +- .../artifactory-medium-extra-config.yaml | 5 +- .../sizing/artifactory-medium.yaml | 11 +- .../artifactory-small-extra-config.yaml | 5 +- .../artifactory/sizing/artifactory-small.yaml | 13 +- .../artifactory-xlarge-extra-config.yaml | 5 +- .../sizing/artifactory-xlarge.yaml | 11 +- .../artifactory-xsmall-extra-config.yaml | 5 +- .../sizing/artifactory-xsmall.yaml | 13 +- stable/artifactory/templates/NOTES.txt | 7 + stable/artifactory/templates/_helpers.tpl | 60 ++ .../templates/artifactory-license-secret.yaml | 2 +- .../templates/artifactory-statefulset.yaml | 233 +++++ .../templates/nginx-artifactory-conf.yaml | 4 + stable/artifactory/templates/nginx-conf.yaml | 4 + stable/artifactory/values.yaml | 876 ++++++++-------- 64 files changed, 2442 insertions(+), 1057 deletions(-) create mode 100644 stable/artifactory-ha/files/nginx-artifactory-conf.yaml create mode 100644 stable/artifactory-ha/files/nginx-main-conf.yaml create mode 100644 stable/artifactory/files/nginx-artifactory-conf.yaml create mode 100644 stable/artifactory/files/nginx-main-conf.yaml diff --git a/stable/artifactory-cpp-ce/CHANGELOG.md b/stable/artifactory-cpp-ce/CHANGELOG.md index 041c14fed..82181cc3a 100644 --- a/stable/artifactory-cpp-ce/CHANGELOG.md +++ b/stable/artifactory-cpp-ce/CHANGELOG.md @@ -1,7 +1,7 @@ # JFrog Artifactory CE for C++ Chart Changelog All changes to this chart will be documented in this file -## [107.84.17] - Feb 20, 2024 +## [107.90.5] - Feb 20, 2024 * Updated `artifactory.installerInfo` content ## [107.80.0] - Feb 1, 2024 diff --git a/stable/artifactory-cpp-ce/Chart.yaml b/stable/artifactory-cpp-ce/Chart.yaml index 1ee14c32e..19962ca30 100644 --- a/stable/artifactory-cpp-ce/Chart.yaml +++ b/stable/artifactory-cpp-ce/Chart.yaml @@ -1,9 +1,9 @@ apiVersion: v2 -appVersion: 7.84.17 +appVersion: 7.90.5 dependencies: - name: artifactory repository: file://charts/artifactory - version: 107.84.17 + version: 107.90.5 description: JFrog Artifactory CE for C++ home: https://www.jfrog.com/artifactory/ icon: https://raw.githubusercontent.com/jfrog/charts/master/stable/artifactory-cpp-ce/logo/conan.png @@ -21,4 +21,4 @@ name: artifactory-cpp-ce sources: - https://github.com/jfrog/charts type: application -version: 107.84.17 +version: 107.90.5 diff --git a/stable/artifactory-cpp-ce/logo/conan.png b/stable/artifactory-cpp-ce/logo/conan.png index 5da5117aeb7c7427be2c61a3d916b3ed7278e1b6..b8a584c49f2c25a9843f48993573195ce64d9059 100644 GIT binary patch literal 370655 zcmeEvdpMMN|9_|5YV4JE+fpfNdn7qkL_@`9H|1DK&W8?+(@--q&XeuIwid0^gc-6z z2ssSKv9pE@A;LJ68AFVT!5G8L?{g0`dA4?+=lkdHx?FRWaUVYSeZN2N!|VNezdyHI zXH4{A+hHqKtbm<9_0zc(E7li)uO;hNfi0MT5*_ek{nb-e=oKqe_CWtu`ex|(tXOel z#p$1ZJny@5wDZSrSFBjK>PH^#g^Z^A>I=ct9V=I@S+{YQ?u`{+{PNo>i*MvMeQ}rg zEN7Vcs(&0LX;pjkphLzFe|HgRq(|FxR{ztDtW*E$L0V(2!Owqlqr$tnarpdN@ojzS ziwn$BFBu#E+m|19@eKF-8~$D(;F#v`ABJfN_HX`2skEQj`L{xau5(wx5r*WO@Bc@^ zJxJ5~Cz;*QHG8zZYcBWvKMKxL@A^NU96`8;SYE6TE>EMt@} zV6tT}`vt>T2D6`g&}BtgRurNCSWb^WccaVc@fQ;NWkp$5lx4#0bHi9B+`d4sE-T8i zqCje~OyPflhhL`fKQBHkE6TE>EEfeoF9R$W1;0=)T2_>0MG>mSa+|>ytYf*&;B)I( zR+ME$S?)*qybQ41xb%fGz_Ow&D~eDpmfH-zU>(c-D4$!$vZ5?2%5p!-=k>AW=IYPO z04tXjWm!>#YO&mA@CEBwZZr7YI+hh>Sy7hT43^srgk{s^>hW^*czLDZ7pmpUOG-aC zjAcbxRuo}1Y`G}7Tohbhd;EnW=%M||qrxbpFXXU27SgnO)-Cv(Eg$I+-k2Jc{f2cP(y zgzp@mqrFmAroAc&jp@{|HXrPEF;8@tfEOc=BQhJ~Z9R%((ZPY&PN*m~#>Lq*aAXGN z-Uc5~vC(u(k0CujOL_8sA41(;$;x&+=T!*>l^sO^WyibXVSOSuWk-A zL7pV0kzkS61gul}CoWTKb>Tlt`}fqAtq{}54^!5Zq>Z?G`8^O5IJiA`VML9REq`{M zao5X(F;yf9wqtfLNIlrthp%+>hE*h$1@%`Zo-`l9m`mslJn3rgwQgzfgJ0kIi5D6< zuPa?)g29Iyi}J&VmsTS0Yn+$vIu_>%zdhRKY87ae;A|~jK|PB$thC6SdRgtn9Hc#^ zy&#!M-As^(>n;calTQFOFbcU4Cx>U(}&5xLlnE&07hx#YV)mDPFR~ZDLxFRKB5u)a=vN z0QX}Sm9+UT|FmhBPt29A`AX!FIsN*8SUep!9!csP@=+>c*Dj7Kv{a$w5F zr-$tfh}&9iLtm6*Lr?~ONt~2{dBprZGlSP#TgkwH0zx@QrasJvpEr3O);{Y=to5Ov z?o4*mlQ_-INYP?;q|)OyPZDCI2?0ITv)zs&eG3_}(v|i<#tP~-S=6_3nXeLDuNxdb zpIQB0uE4S-?1k3rssrjToG!W;v7a<=wUO2$u2YcOM>NRRAf{FKy`GWUK({$Ma$XwT zr~5JJ5FDDZ_78oFc1@wdpMvQ3JP0W|EOMDrY?NE~K5M zTSHcWI`$0Ms6+BP^HbV*Fu{`e16kQdN#W+`Sq^iEV< za&GfhcfE!XG!Gj-lEfQx=;Cv3B$(BA{E~paY^~DlFye|Fx@td&T>r^6rrgjd(SN^2 zEX#}Q+pPcO{G1{&ubN-=r`Zb$!=AS5D7J($!ZXd7^6Eq~UP1zi(y~bPV)y($Xd_P_ z$Aw1EyB6$tAg`nxh1QA~yu>l$dsZGPJAZn9n0E8LN#$J2CByjVUg{7f);%9JEMYU$zBdTutP5lFXev zoontLUvE*nNxSS!%5L1j>L+U-*5~5n=Qvpehn6{s%2D5=p0UMUs^?SYFy%gphQuB` zQW^1qE-z@bB$MWA6=O}U=qlFahL281nukvx#Z#VF?+3 zT3Fgoclg`CgXOzjbg?Z5dxp1nMB>i=9G@FkYi8k>10ztq^J&yz;D6)ZjJ0g8^2RZm z-Le$R*GldFbiMDv_0CM+V~Qz3-_;=#+e#o$Utyd9O!xxToApL8k&3b!>kkusu9y4-In1h?jBrtd7U`FrTVJ8O^((f4fK^>!+h%_*eJ z;e6aGvtf3RH4otO+bUO!v~lICjz4Z_Oloy?YQ!%Zz||mFoJPrxuQf8+Oqf};dbjqp z$Bsx1glCO${fT5NCl#d49=d64%oD`eAfvL(#0H?}Wm9rDBGz-*3-K zDj(+l`dssI!tWJ*u*w5{6;{@FSog5u+_*6Uu5Mzsr1r;H)8RfxWp{~RhuyxKeHNP< zJKtd18;ZN;>9?XMU{rPX750Y<8Zyc%b_N{HyK^T3vD^FZ9+gv;`V+X$_*pdYypH_H z%BpcU2h)b?2h$%K?1G7=ttc+tv&B{HGS+;(ACzf^qKH=FO<2V<$8U~de<*;x32XOx zctIZwnE{J*Rlru5yQrrVAP@n!%IwkZ2+I#{v{4A^{kJPNHU3bM5f4}UJJ3Y)y}jug zC37uyFDAVlE?$@w&{Zz@6HntRpCG31CHsgcWkpB`2+C_q^^hCH^R#(i>W}Vv=t8Lh z>(G<8&Rsa0$Mr@U};h~}>57N)XU_XEFqE6=M)_mq~|$t*B&awnjPyP)45mLL9Al2chtV(ZwZlhR!_ zs>ePE-Z2U9Pm#PPf0#a*tU+)7_?l&Qx7H_h;d)}@(y1(F~q29oU z8cpx`hSR($T8_yuhX75yufn(WW5+qU))TiZ`f2kN)IsH@mWh8kFzF3%E?Wmj@LD_D zQ5De$Dlc(P-<5=BNOfgA=r?`ec6idF+z4CG*{P~@J?fba&Mkj>{nc$aRn@ZqFq0JT zBuHB_y}#o0{~(^gHDLe^@1)d}$cZ;Kz~Y*IC8iPe70g|X3fwkt*X%9u0f=TWbBm!_ zld`#)LjIOyjS`zM3MRKX7`N?>^RRYS9HFau_MURn$BFL=T`38fvc?ZBAuG19o4=KDVb3_0>}kzL(*bQPG|(@tEec$1?Qhz5lq8sq>!lYhTv zKURAJ`lYccJpT8F5i^p(|7oQ06VmaMHRGObNTU&p_s>tLCudCfhxSlx3|OXbbb(%WhsCoS#(J-;1+ zJdet6q~nq3SafD11CIoX*>%DM&H|8+2ws#k^QA5qn)P?iME|H4z zTB8T|tG|HqNr1Gqz)v(twVJJewLiH!so+moHKot(ZJ;QohPc}Rw2WlQMn{R%qyIMm zWxJZ&t%6XHVZ(_C3n4KVp>$($SKmMXiSgxkh_wz^0j-m`t?kifR3(aer|!8_=I(~YCzB3 zoh^KKiG^sPuPfbUx3#kb03xk(05AyuvnSwe%M3*LOt;_q`{pqFh=Avp#eaFN+<#Ss z;eh?go=bPJAryrHMV^)Q4u^|wmGJ#*e_bl~Rx2SrG z9iS$jm)>sGhK;ZBH&FW40KIT zilSdOf$UcZ{-qIAxc1lvWJAWhHFj`rEV^h>M01BP)$ z*}JLYjA|+a2XwaLa%)@cAuh%qgh^FeRg3-5V1|XYd;t-Mrj)e85#5O~63jr#bDx8V zwv%!ZNW59FzI|!}w*8>zlw~D74mH#>_J-&5(Ia`-*|XHxKp+v{pfGPf!;R~eeK-ET zobG+(P-9;d?j+JY8>_)4%sU>HAu65@QXl9lO?aMeHtjGhN~pp(uJ!|1-uzIURB?6? zgC=1_x{lZ+Mxa|0K#a8HwYH11Z=+3?gJ!-+7eIp8erP)M24Kb1M3QhbZP62Pkwp3+Vdt#SafpdBk2D?Jc+hq@I9*a~&oy_zo|;Hm=X3fJRC zp1-p%qAuG)`PbhcA}?E}L1_dhT!Y6jg`5ZdNZCO`U^IRDvbE=KXvo}SMxM6Ep>I9l zDkbPU)H{RV%MoY`9b8U$HgvfLaJkvCI_!M%>Sro!T%ppWV%>A5DL}jd`|R}Vm7DH5 zrCc@Dn8-*w_$Dl&^c<9-I_$BIis(+Aj*dz; zwHjnSgbZX1rP^sCK6BT@y}+stU-aH1HmZ@6j)|u4z}1x`mBU{so9WkIhfH$uKk9XM z5i3NT;%{{6I%6vSvxgxghK{a7oNOZx zJ?}@BEz@b_z8`9U%c~qeJMq$8A3cU0eur;5E^s7=*YLyPf`O*vG3-A6n=mpbn~@z11{3 zv=Y4}dR{e_878`_wI0%J-Ro4^$cWQf)t4Ft;Wnj6^p;A+A1_<;H@@+DH!3r&LCM3? z>t(C6Tlsq|licA0p`|%SLC@%`uFJUy9P7;NlN$c;ve5qTCVHmg(c#pZ&K^YBaNv9| z@31cCkW;MT`tezH^R$EQVNj%i(g|R3ct986px6Tf2V{VN^ZdeIDD!=7xJYvX?&b(! zJ;%(`&PLhid^%?__9TH38J{j78u80}q077L@$9Z}_0H!!<$EXUc+cwuZ890w`2}3Y z*W4T=zk-eOsei%<)0ddy__cDCJ3#YxdPbUJVDxaq8Uv~FK{Moiq4T(}p|1K(`U5qh!1%Ta*4H- z?#Qi+`IaLA22izgfR02@YQ|X8A)6jMlv>g@oDyCdg93qOFlI2O zhufht_$nn?F)?);W3sk7KTz6^^yvNQIr6K~K#F2SmbPn_!|NkX$Y$IU0+dCf)R`}kdJQNaTZf;5`L@o7~wpZf>a zeu6D22&6Ri3X0)6*I1?rRe}`RCO=k>P6B%@y0(B86Xc zVro75UUGeSxiPE~1lr!CiBZ*Nzt4|U9mlo?@%W8T1GSr}Ts4TT8!OvmD!A}^0>hqCa=K5SFT#Uu{msmqkNZ$Lwj_0O@-4?V8J&8WX#}CPNMQcSw)qiCGY6}oyY8HA@ ztt;=u<^QvVi3}Vd!@ry>GXG6E%}3mYh!m=Uh>lm-6JR&k28bL8N{-3SPGGQ!uESmp z5~qy{hO(d>DSxQlPMqxCc;vsSIV`{I*x-JXB2zjtP!NyEbC23BpO)d-)+jd6`ppvY+ zq-7+;bjOaHrM$~X7pqzB?8=>>q9UUN;3;{2!Hu{uf535{0!p^`7cpMhxb*>mFb^x+ z!$keC?b*6z--v>!|0osW#%zVCC#3pqo!a#pW3Y5b0ltS;sPB{0bPIIR{W z_W0yvGF(R|S*^JI463G)1}uooHQ{-ZicrXHZ17AbR;$k`HyzO%X$RB{$+d-hlOq@K%*LJW>tL=(1HU=60VnRZVG1bRURmaZVV1azFm}E!HLqnj@*NXL79t z6F!0{)kak!8$RHZA3M$+f2O3|2(n*ig9K~p^Nf-U8ihJ`gKu7aBA`GS1yJvk6I9y> zaT<2$t6ApYvqRqbSgz+btq%!l;~^MUR^Yl`FGWxfJF&Fh2>FEnEKNdt+rvzt+9Xtr zG+&J7Ucj<3nrX1e;zd^i#c#+JK^09v^1+jG{v&3Kyuv?&g1_ut65u&G&HMC;X$0Zj zwuepI=Mcm}Q@4LVh=2t@4g|O8*{efcV=IG@T_pp+re?Az-_+w~t;}l3U`yQ6s3bZkI)adt@Vj7X}rQzF#y^ z<+TmanSB)v=Yel8Jj(anufL#i-5k`>{t&M13V2CAkNWP>kS%23CrN9)kR zobFn)36_A?feIdOQyrX}T&-g^aXFP=h_4(2A+$8QFM&-l?fC;eg78!&(R*#s8?e(? zDQUb7xE)o3tD0*id$9^U*|!cw188kjXuPvF^k_pT z+8aymy}TARy+iu|yfR9*JZAKW-`y(>z+#e3m;tfH@1CXLBjq{y$ofH#W26Gwqr%nj z@aRz%?T`6zc?O#&i9vn*$f)$|Z+;hNGp3C*FZPo=X=>(YG`*vu2E2nNJ-qT%U2!PY8KT^UM5lKqwh zYl=%YAm5#6YbCK=5f}ZOlC%gu0ZTC20Y~6%Z(#C`MQM?3#H#8;-f1>rQ3caCMK)lv zd3z(2!~#3G|1(s|U&Oeg{ldbe8~~$bBJu?@vsY+6#Jm#&?e%-(79n&NEYjHU;O8MVH=|9HWN)TiHUBOTdPXP2^47yz)mX7>HOmnaHJuhty`;WTm(!l&5 zaTmIurGr2>3>{D?gyQ3uYCGpF&NWaan>SocbnZL-iS*!3hFT(RQDiqk*+2>r$Q@+}aj zwZKn66z3p4t$M%ug$NU#km67LXHEIW%rTo+{B~ZU@5J`j3GT=Hk%ko2MtYU^_!~Tf zQhR>l$rE>YR`+u}YHRnMgv;;v*Ln6Pf_1SDUVZi4C!-w(GJ#{KC|E&PIGW$Hr`CR= z={PR}F6c)K4lts4tbHVUYZ-k0>?z5UkgFa`XUAj*QM*@~zbYm7Ui-7&%4rLs58SosSVE;c~Y;f<3--Q_=9V zs5j0}$vZcp*x5)q){#Ou11Yb09d(J_Z6IRpbx6a5Sw4f*$+l^e6zVlIGEE{5o!S*V zu!-Q|8yG-Ns4Jz7`g*uiD0Mz@qwrEiMBlAraGvR?D%|`18H%#JBqQ#!YMr;KW`Hc! zjQyylT7fs#rwLy>rhOaTP_Tv0uIZ_4$Pu3tE6){|+U_AQN7iE4%5*pHI7XVQ~P^ zI~0tAPeJ7!$eU=jadwo7BfH~9ps7EOo|G1qm&>8<9+45d>uCc+BtVs5BMagIbrlF0 z`wIJbg#SGO9X;+uz{*Z^HB(y7x$Cj|aEtaO2EKo1fL}a-0xoB}1+?BQh0aSy7*qKs z^7@~ICC+8WtK()=OMlCgX3Kw7yo#7}1Fb*}s{c*Q5PhZGuxQJmFM*hrvGGlq1}IGT zZSGVNgW%2UT=Xn%(0=$2s4ncq7y(cMNYuq%#ySV8c|g8eR&*Yy4#xrr<=@p^Dyj}2 zShvv3lmn|CChx>ewD|~Uqr!-8)qZnucvr9F+jXB#R|E`l{>J*}V!+UT@~(H{!JQcF zmP#FVb!z8WlPw3)#cPv7dk0V+>q{o=&_WqfLh3fq zcO3OEADmHMYqkMjP8@7Qu02yOFc`eGpFP$ zQ>nP(ky|}-+OmD|#q+c%ys~^5&f|EYGU92Wax9vCD=)X+SiUSDsd2O>FIK+PG!*8+lcPPe;YEJv`b>RI zx<}v@G&wU|li?BQVn#{O2ge;N+JmV3g8(kx9a}sy)Qj(_n~ooa*XS@F6+VSyb_6+q zY#!@Hc^ANX)rsZg$%P*e)~66s10Bdb)_gV|8`!5q=ElqO?Z^e#DIG@Okg84+yMK6( zoP!%Sj@>xj0q=8FjXT<5Uk@1bGZO{@aELvm4Et2z)Us?$7^@HoCLKyC@Yq9rTTmyF z=fCUQoK*Zu;%dIehW1*7p5!D7ske^j0UIS_#My_|W`I1h zw0oUJlzZ=fkueckvP^O>Ltbi|3xEe^i|vP?K_Nc9J*>vu>n2rIl$}1Z*?kulq}bLY zzqqAe3&eOauP@^Uv2;;!0Xu8eiawR-E$l#1>dmd5m7-yEKb-`+ZgwbHKuoyT=HEpv zXKU6y$OAb6@>tJy(J7B|zIxG<8amc=pHtkWeFq7GNGZdh=1t1*V5b++kjtKyl8aV7 zN?`wiIG(~*j25_&O?!C7a8?Bmq>sHp`s9>o*;k$XTgMJ_MmtlAIPA6P4YHN#v}t*u z%F{0?_@aHvncdN2Nw@Q&nJS%=FQf3uGF{fFr#At`lmd*BP6HXMx0?fHu#SWC@V_MZ zw?}ZG7daD(&kco4IQ>a-G;3d{_ocdjdmJI9Um3_Io9|H5?)7%)mKKc znec8?Pi$;4{cXbGSM38f7RgN0(GRroW8EF7#)t2Xd)d zCAwbi>eI_MhMs{}%qTEPuUDPdP+sKx*tIC1)FXF_8E?~)^f!!=0gzAe^a*mtQpQYW zUUkkswv(&WDbZn+M)$_EH>L8jW3cnI0@@tKVcwpCP@!6&+=j_`K-R|xW(BEc?Xcp+ zPg|4SnI4o*pW_VM$}^}mP4kGDXYy-a?L2Zz zq-LL&q92-k1^BXZ5RoVAn_s(Wsx6v=(4auw{YxD65*rhR>ZN%t&~r;^>w1ci&!(@+ z`1QBpe}h`;evtMGP0+BiGZl*HVAlc_KDXB*?Hb12GW3OU9x%@a5Y1gqc9Z}^9k~D% zULf_&4Vv=t`xHFf_W}+^%|P=f5q7`o2ZH>$U)}T?&WS;@JfOFV>jAn>@F~`L6K2m0 zJ`Y+@fdRCK+4lx~-SMgVb9EayyFnMdS#*UEB8W}^0fWj~S94K&u?|tgn+U~HA=!lF zI+EPEIb)^b*tO0U4MuSH#QExqlGYJpVE~>&B)aMGrVyaVI0rUWomQjS#tF0c@=Epi zWVH1FEi0CNqBTP_^&AU%#a)$EZ+U)$lg03Auk}HLuM^YZwNrJq1U5UB7aGF}oY6=3 za@S($RKKQ5H<>^dL4kKX;9+d|2Ihz}Yy2kRsNYpDP3@Gf*y8cFQheFY>Ovap_(Un* zSiY1Fvd!Ep-Pt{Gy5eTc(ZX8ry&7&~!c^!CL}4h}Q65dCcZEBvN2}fy#-&$!o+6FE z9ZT92;2AgoC@oWRSe?(HhgMPbm4?gOTJQ>V!!wWLHHwIaTRpi3FRXm3#%W{Z&Z}-1 z6Vg?|V-Kvi4JBW{w2Iux{Wyrv=G5?B=fMM_JQ_NAZ>M8|^f5GmbaQE8Yc;$l`Uj=Y zdHTD!lf(2&86HO~_Q;s!+b-A1>XB^#CoUqetRS)7DXzX?Z5uUR;1Z0<>= zp{LF@eM$AUbLY%FG{Y$u_ZAvsOoG5hvi3Kl&Dv)7`cf*DsR7L>Wu zWKF45PChLXjBiHDqCxv)>B>fVNRgqQgodwXIS^xQs=TLTZWXY{ z@wVCJlXDQ(=;-Bg3HwroJITNTOe$kYzgOQ7;mOxxL#7c>%=)bQ`LFX>nyTmJe z;oK#Am&E0&R}vSq)eJkW02lzx?f(rse4__i6NDKulst>lTrtYdxbQkG0l;RcpY!^k zo1}mNXZa+~12)NUH2=ic2t1jQcE!6?!H0q(S04)C5;HUpyOANyGz>RHiGVR*1=#d_s0XfSe-DU#Z z2z^C|(36x-JWmCER^`PBJacuwFf@JjQEoCN9=i9@6M2ng`C ztXjYs&+|~zGVt5QQ?KphG>=t)+&H@T`~)Yu_YQm7OcNmN$rmw^4%BvXHjGQ-C+<)=+4r2{-v{n!|* zX2Pym8akFgQ)55vft@>7itjQn;?gMiWK-Zihi6J-q@$4(Ki+sUT0<~SiAk<0g)^8A zRd5FDSg;;BdPnVU`Mw#+7n(c!@MeO0J34Df$vgFZ7^6D=yBN)dHU^%@d;;X7tJ&>w zHZr6 zH&Kh}Rs4zm{aO)}X-D&k7lo<`dPEbr<*r@&_M7r2PI8J8vP{c)WwZyb-9A&Y=Ycn% zf{Yw0m37TOdnlNxV3=}OsOR_2E6BbC(e!hE?=NUuL~7rk zMv@aJdIzUm1@lcbvkI2;D{)}{S{dB_0kN%x?x_@gzs*LqyL zF^9*B1Ckfk_4LGAMEHR0TqzcjSrxU!e8_YDOKWSy;~wU|4zK6P?k zPy%4)V7$b_D`?WzDY37`0>pD7aoWi8O{86W=weaZdo#qBCy3f>poSX;)csQaeee9V z^+L7}6%1WjvIH?vcXcxW7Z%@k7z-1N5O=fwq7P-7M}0pe7e>1Cel3`5&qT80`<|BA zi1UP@jDiiypzo!Xf(v_r`PHXZ9k{s~b@fcJ$e~tU{RP($Fc{G9&=;`&$gG}H^^JGu z_#v;L2cTUbs+B8tV~QY=$iGwnmCzGDn*DwVTVC?k+JtM65!i0?1=-2)u64 zBtGzCvTQv!LtkJ{i4LO4#*Ok=;iwIL*Z^`(_y*&bDd8L591V0dtse`Qq>Tn%aUe(O zb3j8{kvwALa;0H?P7&X`wUD`~XnbZm2K9~)%b$pIimK{z2%2$DId@?Y39raXp1mP4 zV{^Q^>%u&Y>T?A{iQ1!G*;zesO33(K*5ZCJQ$3R}(~6R!ucA}^d489%2gZ_Z$qMtw zEIsqEA-xLP7F_r8iUyp{D!S=UMqbAY4lyr?U`s)4_{*!%(@%Klv8kMG6{McuD z4Fj=V)%Bz0^jDGA>DEJnF*m^MhJh?#R9PY;(EY0`_)ZOe}Xe;NS(fJm;VNzG~M1dug!uSBrQR}rKa6e-15E}7I<%s_{pcin4 z`-NqO&ngyW2h`hxz*0kJR_~|s_M;@I_=azTEjS~0LkPGKHH7_qAZ@z#x>rM4SriO&3u;8_N#?@+Y24(h!ma<%6Q4K#7t>D?m_> z%ckSb+2?ahYOiPP9L?*o9a#Nl+OrP`KxbEZ%bV0#Y(ax8Kx0tC23D=O^K~vA)fM3( zYf#MWIM<34!mbeaGk5#K5>#QzeKA%PrfEY*)O6N-fKpb;AqS>6l{c4zKPO{`l^)bb zo_n8rymGkrNgE5M+>sK=f*C9HA0&)qVnZU*xp;|mHoSPCSZ=`Qc-D>z&#@=Zli0;* zg<>fLYEWNIt{ADo2-LQixD;@Z(alW6XGwu-L?J8q2ZogC9EzeWORB!YW+59o$N%Vo zvjS)A2y_5hA`fhk!e1URsIxS<`jRIB?tMyTEuOd}wQ2zkw;lneB ztUcg)RUIE{4*Sn5k}DmG>}$V2wjn>jxh9sB(N4aUJmP#YjSkj~QG83|OCrY2M|F&X z_e{=T<0ed(U+D~U|7cegF3zSOIsobIi+5cIpgAF_y~7pJyV$Ag7==MFE()P)w=x-=vqs?>cshA&A9{>J1N$$|&4YK=Zd090jKa4-MCBR}%r zywCWGk>O*jBoYcNeJRiZ4Y@!Mg!c*-UkUE@3a8-e6a=T6d$r$B&0gpm5Ld)4Zvk3M z&R}tIT6>|c>kq`Vg0jc4pmTNYYo-jq|2-ye|3LjmH!DMk>cK96`Z>31ZJ^OYYHk3V z08MCh0>6PY5vg|pTAEv(=q|kVkn5lWPT4L~qa@hXB{0%uwgvP8sDh-5+X6Wkp6mnd zP{@n4gH>3<<=|_f!gJ$iJT)+lG z{7J#M;NRmPMG|udkj~D=v}~cCpARq*2=9Z%0pGuM%6SS{>M4E+Hkuxn%dbuwXxG|S zc8zQ#?NHy+5{e&hu~lUcWEeur$CZ?bN!M(A2VSX`#$2*2&oseVRl+fz8uYojVSMpG zs~n@d6E6Xnszi`8WK3V8SUA_%qM96n_A^#H%;(`#`IAivb3?~iO(bS4Xj+>~>~@o> zVqUEe3E#l*sPwWR!&1BM6f<9@#N>{jt?Y)nZ9?2n^$$_<6f}=j6<&e(@=BS$)MDN( zJ-Kd(Je+))hKF%vl{!(ZJh(K!{|qI~bk34&s`F6-UOPL3RpP!(4N?c4(RHXAxBwxi zTE;+Ah>3U!WE!qhf_aXjZ2vMbQQP5A5`pZBW*<%mT|j}Gex%%w-0OU;4VAFP`m~J; zA+EqlmGPp4?L3|ou$Hw_ocBG*2D)Pm?^$RtET3L8YiB*&YtRXnvF7)tPO}Q}e=bZ$ zT3CN!kIXk zPZ|D;^V0szdBiP!k-__p0CVsnR0k{=g4b_A?=M@=He^pBNV+6{Y*%d^3QBf!U^|1y z?_QD9z47QUP+qVezC8m_&Ieg6p{}=*GG8rteYaH^x7xyj1@}ofU_{}s zge}^v1Eg#HR70rO8|v0xnqz~fR*pnramL4=|HaOr#`5!;ryu10p~(Oun8d{mm>@afSH877OE?RltVCEJK81=Nrr*0 zF0d9*XevWG3bvxox`#C&WQ_y}{3eC&#xX~?)=;shyKT1E_O5NUjxty={cV254&}8P z$y!J!iIWoGH4b3i0&vb#ht&F1oYEQ@N-B{CF9ukuy7TV@Dy7%zM_*kcQ%8>=E(T}+ z%i-9IpUXMs))8vy5%7X2`{8@llWv+#MAqQk&%BeAO~vwt$GM~ODE?C^eh}HTkEaGN z6Fg?ZF}-L6InA^$shCx~R?BbbQBBO{a8Aakj^7bP-FT4P_~vVb2d&W)$2_2DS#BGm zTvv)gp&AlAHB#Q*E`B%j0!mR8I_I8^;gP00>pQ0=nR2`oe+&7#-fC4R)@n?`C?LS_ z)v`xzCsHJ9H5pQ}b5ihH9#Jwba5~YHKG*czi#A7Z!5GwZgS8de)p&FTc%wy!eM6$v zQSio#t14N+jR--2F7AE9k9|j`8r#d2ueWB_{)p$xypa=W%9^krKyp@}QnGU)%)r(d zptrQPIJDLGbCF3p+jmp}gdc5=*0(&{mdoRsVCJ_7b$Z$aaBli|Wl9 zqMpEwkv5_~1%w?D^KhRqm6mfs)BkXi+g; z;H7G~f^F|*M08b06lB4jQZfrG)ywxob#)g8Sgfi2Qzgg?K?O>cReW8@pNC9=ITYGW zJ=V4StO%WHLG)AXPWr_K7}+4aPpI-#Y5xHh9Sg2)aeCp>_G4J1a?!F_$8|txyGMWS zUg%oeyUqxy*U<5+3AFkZf9T!g2SX1~Xp5uJilGP)Sx5j2J@=`&l1XT=a*;y4Fht84 z4xBZy*?~DU7PO=6VcR)MYV{e^^c+YBpNHZ}8Y+p%bkHD{h%X=(Bm_E7o55@OQw|MW zQaHAP*2AI3Lw#RoQH<4?LF#o{54>y#shalaayZIoM<)T@s+VloJKb*#XZd7@fpi5Yx6+{WX!UMJSgcnAmsb~jkES2hcbi=rD~;+6 z25?V1%B!h!;#mluATNm@!ly{Yq4C?hJCcutu(e%0G0f7dC!>4f! zWwZnKGm@D$aMeM-pWdTsRe-BzlQ|LD>({#D_Uw;nwBP3?^XvqjfhXKeDC_@ z_6!lb3$fhwPNZ*9UhHZ7OJMp7z4Kr9E@6A17rsnx=RWKeQnMks|GEqN8^eW0 z1#fVOTI~3O0^mY-H`F>Z{o&OFKd0)kGI$wA-^a*uHIegq3JN?M(6wFrg(~||FN7cd zvseb)cXkegcd69Prb6mv$lOhessyCf9sxlyYXRKaFWfKD%f>DevLa|m#~{!~(NPyX zv2TIuaFU3N_P#gy&r zzFj>0mJ%~H;aXECbkaEahxE7YCMG>48Oe>NReKNvv8y5|peZ0bBI z#=&o*Z*XqRVUB|jaHuJuNu+0?Q;beBp)bk50(!7P$Oc%?=5!#@MV_5! zY~rU!#nz2}zc@K7LRLa6_e<1}um$@`)a8EEmxeGGWEsF!4$*^V#;hUnUyWSn4HYv% zHC5QO_+Je`tjGjt;g9F%gz1tIzL0V)?iDso37e58!hD@rf7&gu5s;b^ptN~7iv4gw zP3aPGl2|Acg8KKNCM0N3Q7=El7>FW|e=#vFnptxawp#Kg(5;)o@~FFxb?-(8zP5XZ zIP6)j1s?qR!`P!g3B~oWbQS%n>_Su4%V<9Gdq`w+XBJ$4J`;PU{P3b!AI*LTbiQDo z{(2!~90m(J20=Cit&*O78r=XBTG{P|7B6oYU-60YVgk6P9qL8s8Pk%)3$@-hU)NR7 zLc5w;X;(RtH}Ng>Ql94;spy(U`l}LB%tWL4Kn4k~kupp_Ai`bAneSo=vJEmuM#Yk}EGMxJ02;auPh|sqLUrz^aG)&N((_KV56)LwIXb z^zNN9TxWt*#_$NZWI@iX!_cVSpu?y;3b~K_$ABiiia8z$*Th~6Ah#EcHFSD=AjrFP zX3NeBRpfO4&@`0M%%V{+$qjt=7pw%?Kt@w*&|_g2$^-q7^Pwk|trr`9 zmLMk)aswF()YKzPS)jhZzj$*|>5>SGL_zE5mhcT<$dQ)p^#xt`cCO%QV#@A*df&`L zPYBfeboliPJ$FCqtNL)AT!Q^rPkztT1@5mzVQ-+Qp;n00asi2!1gZl6b-~Pk^yNb6 zEuJ89!+^$eBD(yaMJufNdH2iJ`P*g=9^AC+R0l=??*V zlI=I4m95ED_sBgEc6hWIxDF_3n(bRND3lz?$45>97GfvUBY9zIc*5p=^r0f06++%e zGg~{Lno3|fmlE-z8P~uI3HBjekEXW1P&;hMu&yt!PEvDIjkk4aqR*N0{K-L0L0Sxf z7T*ii%O00ih0nd_(00s>f~W!(vUElU@WSFNBcSS^Y&!O;)7LG4 zY+P4Hqh1X}Q^M*%D<1bf=&5&jOJGmO+8FSApK3B@dYearZoS>?vp?SifadStPQRVT z6Y4Yo@G3lr=*TvPcbj_KuQ>lBxl;!Dcz>jJLspkU;>>0FMeOUUy7gLFl(;GClh(e@cq}9mo6^FfCpA{YAg%qj!NsZG1A%4a37vZ9A{7{oDRFw{vOjf5M2{&F{atcOviS&2EQt&g7mBwT=M0z)`U<;uf&0D6J?Bx=e_V z;flXGvKV$44qG^>^@97c&2G+Z7XQo8|8UjU``b$E!+Lp`A^)Eio)0{b?)nE8R~4nX zZ>^EBUVQFH6{l`oc~@~HYjeuK1#xpG8t1`Bz1wrkPfZrkA-kmaOB)2A2TNaoxG+mb z@_4Z3ik@csNJg>%?!HIOW~;bW8KJ| z#^T94vr1ZVWoL8bl>e|tym0b#*Hh=$obW5}inihi&d=#cJeI`*e zy{YK_kNHc5x%5KAZb?8&h zO40uw`F(>-XPAdhdHCB(!RnV@GQ2et&qmhX>Y!TDVv_YdE4CL}qJPbWN9Ul|RNuVE z!MTZ^S*Xm`kSN;yk4UAuktw=iD$N_bwO~!S^Y@AOPvo5h zs+)br{cNapDte`x-$!PIuiMnz76+M*?)nm+Rbb@3 zo86RwQGk&bO(z{jOj@|8=ef`>{=c;IGHy0+C@}|G7uWk^u1J@FMd}6sw;{~hSisl>3$u>6 znRa2o@&21681kdDMe={hsND(}!pP`XuZKnUZ^;GY6MDz>vZ zK48_(A0b6+?h@+W2LqBjf482z&}j%CbzjI~BV7$|*wYR@#YJagiCffDlaiTPzdYvA z$x-24K;{R1Mka2Cn;0xnU(P--X93@r$edi<_(;oO*CauaL?6>BOv>F8Z@oFu!FHGD ztHvKJ3L3wiyKea$e)q!lHP6kiN4z|YN%3`>4tUAN$^W6FHL?DEM=Ez+5s&=s51jK~ zpN@3C-JAVQA^oRSBy5q?@P5RvmI~e9zpF@otW5G9uTFefXHoAM_@_dZzL61a)jgdB zIo*xlbgDbUA!N=aVe8R^pTCYmeB0I8HR}8I?(U?0&g&`;Ax+_--o}}$JhETQX=Qzv zE0O21T`}WVUxm=-*7XGs3~?n9xo>XqklAADSn z9LcZ|N>~}c0w|nb<*fyO8qNbpTLbNy9IM^azDG3K!g-_mf!V;M5XQ1a4nKYG!|yoT zdO2fRyQF_x)E@P%ZpuKXBEhe~qnBnsKGO}qvj*nn$9jAwd7Is^<9(RF#^J4Q+U^=9 z@%lB^Z~KO_fi^z01{%=flI^U=;!9f|`(^19g1H6yva@=t)@G4M=trK}%FrZ~ExZV7|j+2PYMPc-N%5B`< z7*9o&QBcF>3u=owEjjdX$t{7nFkDUCFM0^b>>a@EFgZyh+r*}Di&sV9?oa@pyVKqg<9{bqcFpsm{TdCs4Gk0B0hRhKt&J<**9slx&=Nn`Q`w`Kx2^9yX z;nKv1di5VDNy$oN#>mJPljQplAf6MJd1ULEUh_8E0G zUep#n0mkvJ`I)-VU&tRWp>kmp#No}ukNa}Nv!-dKRRzezyG+=qboukU`7{+smW*-b z!zKcEb4g4lGiYliRlQ%jY<~2XrrX|e2eczpcvq+nn9UqEV28{*j!v2^`AjJx?7dGnBRU5sCBUhz|3t;WKd&62V7V7#*%{w`>xA(<| zZf&dQ-13RZBqJniO~L`Q?6Ytu>O4LXM)9GgT0tj4>D^e1x(Z{i-Dg%hcK21KZ>a1#7dWZG zbH!%vq+x}mld`hNepxyuCr?MN<&4~e&~mjc&W9}q(gV8JgMO4rC(T>PEjr!eKSUAC zBCY{uGsl|Ublu^@+82Co6~#8tUAfL0o`@Y=TPgsQ0dc)2c~4R&^f8Q=LjerI?N%M^ z!kw=TS^>{pzm*<+Llw=Br)AjMowRQzYS#PVE_gdWIdXMgeAK-u4a)B~AhHRadog$H*r6(C>4F{31b~y~$zTxn zPJZoF$50g?KIPXst|ikucqPz$I|kZn=+#|8hU0zmR^m6xFVArys>F?63V zgn}49=lj!LMV(_avz+d^(&C`-dKFAuj+_%D5FcWFHQYdFJEc zA$QoR-(vXbTt#X8yFlopzFq?ZFtzT6_m%c>sfte^5E62&&)PYhRp^oOZWIiyuBD)4 zb#$Bqj=g6ic)I=E28CX-Blb1Wu;&vA&K3Yjt?vdAMC5`2N6sXlIhbhFtG;db4;SC! zIh?1TnnMpi05rlsfo|w6N_VKEp9i`z#6mo+ zS}Ki3W$?zB8Kf(SiRjc8PClkOa$52sVr{+tcxDP43sGMXo4;m7-J{mSC@itcAwKSS zpju!kNj}4yG);5!;TatVN8`f0N9DIf6ki#>l-OU5^$xJwE2BYe#-7i!cc55KT-ar5 z@wT8|R&VMHE6+L4>QzWA=~a22l~45^s(R`Uv%SSrIn^`p+@)7|B~3RA(_Y<&ZOasN z^BMkl$IYU*c-q`y*Oc{Heii0SS#9Dxi^dt+>)h-bWEl7y9ccXaQaD-08}sR*!WBE# z+5YqFsY!`&W>#)dkNx~`^ClCTsaK&Sv~9WOr5DKLCR(m@>-VV43N9Z5T7EAw46*fa zWHb71t?LG#U4y{|HX9Oxf$VAABd6q|PbA=b`Kg8~B9w;@*E17mv01a%HTqe9IoW#V zlfV{te(3)ieEowB{9TABNRwy?{_a<}y4&W*PwwW3W{l48<7$a-q~&3iZQuReBtV$& zax#+|edzG=^F4qD(B{{+jK2m@7EZ0QpS9$kywFqGfJ&C@ikP9zPJ8a_C$&soYBzqV z$DwGJ^|Ki)^V?PIdw>^{t$`pfFYyz#cK?w$35;kTKot5va>c6{V206)kJc=Io(UaD zHsCuO*)TWc{iS!YGA157?h6&g_}UK)E>S;=sw)t5DSP{8-*wplq(-_4teG5sq|48b zmDIhrPDkAL2dG+vGr4WSSV6wpm z5@(KHz9B$^3Y zOB1!m0Z-Uls$!5m*gBuPV!K>hnf#=dOLT`JccXhwZo`~^Ssl+ibaUgEO3G-$HY&lJ zQ@VV?fgIExJ(?6Lp{-L{5MTa^_cGaiS!{af3MtokKz5ym`sxcZc4O{=58tcZE|7?N zy?Z4lVZerXiy>B7amV(?7Gi?Q;@bM3R9c-vv)?5#Wx(mDbb+mz)z2;=Oku}Vl ztLFuo*$A6X!lvL8-lwgN~!?qS^_Lh(}iDiWRTixDQ8Dq&$O01oL%yzShq7FrxFG ziVsvOPaB9~#D*!Hdy+sFKm&IAp+eB}Mk9T$Z;`zVSLj_HjCTVH;<}ryEcIX_LeNDL z`v8U*G(P@^^%VaW3xP^_$l>)F;{>SOtfrkkOWv(ErHYw{0bpLD1uqxH?4zTpSq8jM zVM|a}8ur9m$AIfC|KPhHi2h4&&cD5^koE)v-XGnRF>T~4BVbd10WU!Gp*R4fYZPeh z0P1@tpcHQ%B@1lQJ7ESnUP;}S1{U7vp%;gi*}&MGPHP0 zVdFO_hC>sOd}lB;pYsdqE1Aa|~FW;x44^9FAF+FdT`k;=-ch#o^?f7m5^( zFuhWD7Y{`A;<1(NPl2)CuBNJIGza27n{BL!pxK=u&uZCk^iqWpd2-&2 z;>019S4zi_N#q`qKSGJlz4xa#^Y>wU-Ss>$B&v%AlU zyzzP52@hVsN$71T+^?F{cN4BMo@G#ECM+?Z#G%^n!)IFadRDm--ksTrBl7EPD=($l z8)JijD#_wv$9FVg42I8gI7!0R=HD!yo{D^VfWSS4Fxg~1wucOkBE_fe)8(qj(4KHO ziCZZUTz-(DT%BFlU+d3`2sS|^z(rkmol)L)Tnss-T>-BAVVetv9f#)~y}0M=LJ+e4 zYw9CC8t9-~5~I$wUSxY>oJG~)r z`$=La-?j4~@LHdLZjuJpfsi#;`G?(VP1(GwaV22ETCP z2$(@?n5bazQ7R<^t%ReFtvVPQ^AT6!=;wq!tIz4S(!{J;(Jw*UxZcN2FcaH)QBrKi z&*rr%z2L3GUP5^2;|KcA7c3`)x%^`FEX1%clX_IA#5S@^b$JN0N#(6SN#|-iE0e@G z>~^@OxMe*qmafrwCHc1T_=hfw>a`LoyEcK5h;G8#-g(^Rw`F3%gRf*n_h!wIBC50S zLeWZC_d^d>6mPSD}8CDt#V*QkG_!lpB+{3G5-WUI4sg={ky5m0>A2SeB7`L!KND>EOx`W0Fgs zn5@$)G~i$TtyONp#gD-`;_@0}h8-Wnb2cs?p(=IO=PU^s+O5e#0>4l%XC+2{sW1z4 zOQ*akMg7p=YUQV8ZT;nf6Md6QUCAUS(Uyrs`M?2Ir_6$yHF^AcMV{iWTwb#>^S3hO zrZ%fMUP@sO4eO+bIeUMi`?q|?~+!FrP2M)1KwI5qpmTP1J`j+l63kk{% z3g*4Jb0(7VW^`JG`m)`7c2AR^%PT|pHG6R}Z5CV{J(8uX-8v9)`u}p~U9|4b+{rwr&h%`xwV8ww`yV zck=4wF(`hLd8!T>sG^1MZs-Cgw49l0&yy9=tL>uV zG;R^J%0huW8#Psygf%->!k=!@Z4DWt!lt-DORdKerv)&{?b|Cy>{M0Jp}`OF|c1t&2`s9{ULDEZ1CgT#(6z=NQKaAI`t*M zP(xNNrt~pa@U|l(z9JV-S8(5dr1mNnPX6=R)O$9H=W6eC=JSnC7A1*XaO- zk)b!wKP1o4I?n+FJM*Bbk8W<5H+!#i!i0;uu%6~~S>PFr0M?V=sGkT>4s%v z0b3KzO~3J5tV8P_Jp(ya@f8plzNRH*(7JD(B|nKTZk``!W&X7z;C6pAE}<{yb$=d1 z{`_%rp9lTTdW!H0{sJA@zH(hj@(J3Tj-js=M=L8`Laxt@Bh?AHm=1P?j2J}Sc1LR$ zKlRJ)Z!(}bexX)P=*209m6S}REm_4Bb8X_klWZtYF#Y6-V}T;O(2Ucq=Ptt(qozY5 zZsKQ2Sz3b(S}Pd=lX?JLXVA}-@G6tK97BcgiyA4T9Mz=uFy{Kb7G?#3r=h0S?~vl$ zZLZ8B(eM$n`zdDcD5mH_NOG61OIYq*V0|t%?f{dI3ni&juaMi73afE&?n`riODM0j zF7^EKh79uJSL!Pys+-k>6>`Rx$(08+dRV*pJ8&rV+o{h2S=;q1MBLm%rA;VZ9K*O7cz zkOW5SL)Wh>IQ&Dq^7v?plD)~b(FKBR#%&vAMgP_?Udu0ov@V1ka0}}$5U;+RTJ3JV zI@)rLQqnxSbxg|db(+|OEeD5Zk5IJOXR^?c3&h*hWphKK#!Y1O()+W$Mq-AJQGq%| z0XVjce+X4C#1x@y%uTMecs$PI#svrwlmpeeM{g!P<-^;1}Z z^6yX;QU{?dVTf8{VTKQkS8F;GopPiF&1B|)c$F_v!g}J|TeUKwDJ2VZK5_5MitK++ zO#)#0jYim9JcN4SZcKGJU>?w|-XpYG`Hz{H6%OW1W_h?99p>RhL$ErxzJF^qX_8&^dgc9xa9MIefp*vlW6$67JWK1-SE187}m$wb+c^&>#zx?EY z`XyPeBq)y|4BFyoN?&@@rq>9jjgfj%@85vX;Ker}e`3WY_RY=2G7LGvCcNL3K>||0 zViFmKHu>DbC`F)&{1?)UZ`prY@SUXqXNDX&6TsgdJ)ZVX;x%v&`cGHuyS2+DgVJ`6 zg3_DW*)K93CGYnuXHhHc$77#Qb>y{f5r{{V5B@l*GnWCpIj%pRbihO~w>!{D0Swk~ zFh3B6A}x&%i7_yiq7)3eIdmX=Cm;RU3M*)3ZAEud3De5ZJoEc$J|5xQV}broB z_mc71VWiqB$I?yM6ekNRTVC%*Q?ff-$f}YVlujjyRdRoE^J+r8G3k^L?;{h{@xV&5 zJvq}iO?TOz2d3DvJ#pFaoKTBZygF8C7hLSkP4X$S&V(oKd9-MKYQ~5Y4a>Q@N}!eEZq2)K8{GL6^{dt zWsy<}D%2Qv>hc;%|8oImzBn|c8OylC>}hvCQ1w?}_3E*3!K+e3{aNb=pPL60?&+4g zZ<6_GwR4&#*%E{i_qDbYiP%1-Pum*IN;Vqo?N+F%Hi9j5)=8X^r^w4xzF^>@8cr7d z=xnIJA7X4NZF{a=T|X5 zi$1jy$@l-c{}T^|*sp1V4?5?N#lS*#agsxhTxatFNMxKl*Rg_Kd{h`7xW{k7Ns6tg z>3nR4{lT7UU69p=AF!4QNENtD4U!5yAyX@Pf^+AX-=|2->Df9(lQm?ht-SHTftJs~ zFd2+5XZoX+D_i>yNC(D(gOP6xC8S6}!4f4P5fDV6`4D&q|7C8V|Gx3#zAVgu8Ddi<3!Jue^IV4e7C(P*NYyD-%PJ_cchv9m zHx>DEN3GO%J&g=s^?X8Thr@m+P(@G)=ksr1H9a&Q4b6izj+^sJM+=ti%#q<+kL7*8 zHu7x|-$8Ngd5UKigbfuFobT_+2rp~~*7~^(#*QX|Pn-m38u)v7-z~_m=a&7RGyqZX z^9}sG!QLPDMZf_nu}D8`QOn$#zvdZ(COItLl-rGydXw|@=p|sFH7zgkf9s&h)6McY z<>BM8<*BBYu1p>GBG*q-?3C~6O`r3B>a4Gw&fu_pP77{R>^hbgE7@2!Q(Z)EBthr- zi+ITr&x?Ai`5L|CI^Fh_+|i#;YHK$+P11`aCfUc3)#fpB3bmg{auak@4XiL2@P!QRUfog(T70%cODY1PLw^FJ!wM zm>$n(Faz*m68VKg!p@4^A+nVy4c#E-dD_k&9df}yj&bSkRg?Ne&c~hoO0RmvnN{b_ zpSAx0F;&HvyLM)+Y4#4pQRa!dl`UJ}nHjUPu@S8Z)I6TfXKV zxKHMen#?LR`$Fp`>o4-HX#GUs5($$|Uua5@5K`kl-nCp2-?OqeMY}WR&N$y9&_72u z^C~pSlA8{;M?85c&4XLy9+7SrnKy2wI=}Xifaukq_}+CBw})?%maeL&ck{gp4z5h? z9_`(~zTqmwyH8x$<6Sb>vA}Hn>$-&5`9{B1j{K?umwdf7kZQd~#_AUIkXZ;N>qoS} zBtzF9dtQ z`+1QITYEm_G?}cX4HKRYEsB6_CIDWj0c%lzEinf)2-N^UI|Sb|#KQ_~hp_?9HkF93 zZ;$40*9tll3K_0Slz`!CAaphb4q`qiF1n%imuCga~4TF;Qc#?CP21_|DwFz3$Mw36?Y-rvl~!W$$%)~hr^j8 z=RrFYq7ZDZBH0)%q%RXk;uhr{L0dC*myZ{0QD{m72{lxw3&=r8^bIha`&Zg^A>9Vc zarC^nZ>p;CodrkN@g%KP+Nn<$@EKoe=W78thK9ZZ{___0NkA$pfOMW@kS?Gx0PR5y ztl>&plR_`;gpyOHlB_(`(|ci;d=5ITCM&kBl4_2`D!{Z71of85QREG_xAma6u0r3h z87C}0QXXJ}vi~BkVQ3nXx`d9W0RP~jqbk1I;P=MHOl+lM9mL~)bMCaPBTlb?Pem7^ zClyf%A6K=Ho)ud_53`H3q$ZLvgCjEz$iZ->i8(76(a$lEgw9Lc_<3r27*fpcN#4gW z9X_5$MSs%=Q_c7=SD{#{Y1N)#r%?HwzR=@eJ)tLR?WjkF9y%f*iRkb7M9AKt5m9tk zOv^dpnSG{0#R##WOEKpq4h^@5!`#c?3%UZX&3oXmW;TIM^ExL`o~j;C&%2rMbKALa zF0+2j@L=0UMY_hWfv)5N1jmg@}9poNo+WMgx_CzRLbn1x^ zTu$V}6FEc$nf&}{!CqDU+E*B9h)vkMrFRXQPmDHQuQ6 zf}0HC-lp{24{mdz+_#UX9At>djn^4S4U!3=R>_0{hb4&^pZL>BEcOj#?GVkbEvh~` zV`DwtVlB4-KPff-k+^l^$D^9WPofF4!;E2fC3TK@pV+k&;d>$Z4bM)j@Jg-H*atDA z+ypu0G31yO?i5E#Kzy!Y%H49pZjYqr#S87GCT(>bEzSKxrlkbCly;f%c|mquExgf8 zZVEcgnm@J{o9Z^J8Nx4~=D*F9aLhRMta@lo%$Kso%O&4jF10XU;)yC!e@+AIQA(N= zpJ=<*9pa$uNS2SFr9ar_(DPUI@p|Z>y5aIFz;S2wg&WB>#Z?y*yxg^1Jfy0~Mp`Z5 zJYMy?SlRh8b-#J+2*ixe_YXlnp#OSKL?bpUI}a9rweW;nvizVh88TXuu(k7{Fc9)P z6vMJ207}^GI5_lM5|ADZ_?JYaqd7Z3o)B0SjGuIX`W?G>ioW9XR= z1mRv)@9_Dr^<$6=wI`r{3^?MHvI|_I^)uz4PAZf*MC)5FahGV0-m}Yk1D+KG5{x}% zKriO)s=_`GI@|^h1E9t}N&=pw{BN(M;(Bh$YjB}Uw_GW^;~!6eG&Vq1fj;CKtzY&I z1X?o&**bh@5#H&4nx_7VIhce!z{O6Oue7A~@f#58g4isQ^I?Xgq5S+3z zY@U(}DxX!yFKK!o0qZ}O5bp5o$mKLo11Q`()zJyQiU>TMZ+2qiqn~D+BwM5OhasB0 zNqwFc+00@$-e(pSGQemw_N>fL|3Op$eVG>W2}KxV!mF*bxt0e{YCpF11^}O3imeBJ z-P!HHc5QNbx+aFHyOc?`JTo^Y7gprS^Y9IB-Ljrx0q$y&(%`oRPillGZq!3cFHS8X8cGR=FxlOV*J6Q-t6zmmneyhjEWCKpmEV|mB z!&K!qi-1?@Y%?znn(pIoRkS6D?+>jWFo+&3Q=qEcwiIgzcQ-SuDGax8mp5_{DjsV; zyvAm15g{Irau?5I-3SpZ?D~s%`RA{bKfay}J07O*@oW=;*gUZu zh1k>^Yckrk9BDG#Bpg$X-=SIFx#q33tFqKq>m9wxy!1(uUYbsDnQ;tMJut7+dEs|E znseoiHrp8YCK}Xsei1_Mwmp$L@bL&)FXzP;K0l8Zf&eI;{TV ztIvbH4`zA2tew}o&o0H+UBFj;WJ6%h)c@F~b$SfvQ&ev1-rZm4NkzM*uKF}Lx$b5G zl}f0&TUT+*LB*NL;F^I_Mj4^pxgF%EWO(&Ds}tONw*etpxnOv~w4bImKH>T5yCWKR zvnW`73!5yn%+SeL^DZ#l?n!!{voMADQ5NgLYVgJ5+pU^tc^Hjk|EUz?H;MWO0>%UR z87oLZ7^j(dLH4(Y=yxOt5jTwF1&{=aPyg)@)Bq62-9QYQp7WmzLjbeWMoO^DHM0B+GRx!;yq2vz>H74=;4xo2hG(BY%oKyqs$ zCTRqXGr&?#*vL5SxioZ6D~H=-yK=vLiaemGUtsK=P}pwJ4#`q=G%L!##{1-yw@E-P z&9tnastvr9l~hjalAlAAd*GN7?oP6VA7}sm&;fYfga#U$#9M>tTKIM#CGTBHP1wPrcGBJHe3V6wb4p)6A zTX<9-WkM0BKp5dXEP*T=og~;m@hVblC``U9Ge2-%Xvi90O6i3qaPZ#y6 z2Jp`yWDK3SNYdV>p;~+i#xfL}h>hHSW!9P*ZQ74Hry-<;J$CPmMV;B>UT#*WXQ2C8 zh1b2b>14dw!f3MCBFw$(5`W&+?L4I*_oJtXPV<7>+`i7u>o3%m0YO^6XjZC8ajc>o^g}$y~f{XI4{9&J4obFS34tB0C!l-s^D(zU9*c4EZ+Z)LxwJ z>c6K-j{sQfoV?c7`p{@Hhr*0#^WG-ER;~O`TBVeb{39eaC^0Br?-%|b0 zNA^lk4S)rxq&bqBf}*bs3FQ|60w9ohZpjP^6(Ehj|E2@W8AU- z6;>c=`(N^G(~D*?R*>WstC9Fd1rCJvQ|Bxk^I-*9CS+)*&7Xh;O!`YV)S7M{QEU!? zVI+N@4V$2b+$xZHnvL2*Yw@H640u;C&M#&uD8`AUC9<}-((bel0=7_lM?A?n^B7p1 z+;B1Lp{~`aiB}~E%(~MFiGO%nnxVpo!p@ltGc1)otcl4>d@Z3IgljYf2#D5q0B4S= z`UaQyeMS=-N}E6>j#@l9(8Lmsf$Y5nczl;Q8B_6bNJTUu_IK;Fx<6L^c8orPU{%W( zIjJy7zaUV|0e+OhPZ0RYV*iCU^#CRYQBMVmom9(HK!&R)QW3m#1k>`ZfLzA0(>fi9 zAygl$E&yRVe?*@rs8Rab0*!iUPK}jJuhg0)?9t@z zEjTlE+pfaP-fR$Wseh?erQaozs>!f1S;;s9yfb*Y_mfUeT^|Un4r2{S93jpd9aCZQ zv=n?0=$9#M;U5w&Rt^lf9X*rmx)$zMKKx0qK0aAg)3_vUbbK_~f6Z=boRkc>U0h8) zu51mY)ZhiqPF~5I+f*^x8IJqm6W8lwt-2uLG(V_3+g(NB`rrUBkZA7U$}(OW;4p(+ zyH(X)h6i{iR!%fqvKt)0vulJ*DAqz2^-)*9D|@8T|LaY9S!RpIGzDtwyFij|8I5>_ zn{WCpPWQ`(Sz8(u*$f4~>@6A;TwD6@I5}@*>OXs9SkZSj+sRkE*!7IgD@54Su=!~% zkv_++)8|0l#0V#o8SpZ5IET7?i4!-pw`D-sAujBHtq3k3Gn5F`7nKlp8z&jdsoHTJ zX}gvnA?h`Gx7ME?xaSru%TRNJ=a;S*Tb4Bqp{zlIo`l)k>ZyR}E4;kqCsJ<0Va$XA zz;#5LdlNU2u-8e2B_MR_dY0rb%aICqI{T;sUR&+o;2ga=T0DNA^}dWspnTvzZfa8NJ%y zJ=Jz~z$ZmUy|(ZRy!wf%NWku|paj{*;%hjSdWE|5*boP6q0torW3DkEu*bjf8yi-D*aVob+!~{U3Fwj_SZoAF2tm)PN8HT!B(-fdC_p zkea`;Y@8XOI*L-hhzGI*{PvBmK0xyo^J}1`e*?LH^y5!B0nBP0lCX^as(wAJY5n~c zpksiT6eU zt9}YifUdJrzpXljX|{R#uYUZEyns-&Urk>yzXL%swRI%Udfg95ne|51akqV_37<|- z1@t@0!rW_*B;4Z%i`D}UG_T5ELy%8V9#QgNhd^zNQW&YCv;EB%2%hrg>pqlA9SH#Y zF+Q*%(S8v6(m9)QJf{(!J&r8RBq0Qtqg$q=|1b)vIM1{kDJ1zKCjzOey2qF|lUWwn zueu=aMD7e<8YM8c&n1)hVpT3bSluJB5-f?Hd^IlxWYloZlz={Ma!?u-;J_Hf++#?d zy@J#FOSpxfH^3y#pBPk5{WPKKc3@K}UnsE|t2Db?`^L;YFtm*zY{~`ieMYmgm1s|3 zx$VK8TvMVU6Cz&L=|vHl5MeJ0m8^#vHp30bQa#NmY4r2i?AG@u)m#e)=a=i2(~wP7 zn_bn<%@QOOR@$l&rMB>#Qhp?VALWSh2H$d_kpC;N`mfA0*?lsQ$u7y1>M)ShpTkv; zvuD5aa6nqJ$~k?_3$G<7#aVZoxBb1r_@i@0KULb<8qHc7;84ZR{CI%nybMlM|E-bm zvfx+F6R4tooyT74Rlj!JExl(AWen532rn6)XN~vRx-k~SwNJZj6uNh2sUFXZ)^)Ol z2rg8$#IW+SGVbGg+6Ji}(VWDxtPJu;u5gR}vZmSOYTl%_~LJlvOtbmIWQZ0Y`;Am#2`yzZOR4BINJjGLW} z)2m&r)!u^ZSI3&aN&;t?wedg$+7D$tk#i}*)v@ISx+8}a-RxcuW)|5_&x1zK835_6SMN-lgq#fj2& zN~pze`?-_$_@lWLiH4o+KLV{IdKRX;S!mMp2O-0D?|+6dfDFxrTi4TAv1VWNIl2X9 z<Ft@!Ri1qN$VJM#41|o9uZ*`?m8j&~1kmwyo^0tf+tI!nJ zFZc#5iRNnsroGY=_(sj02C$Oy2Z1hg+nJymGPHQIkr9zz@l<%Zl|Numa9yu<-PTHW zyD}VJNZTJ8tYj+*k}}3^W2PxPy%p6vs)O{O-aL;DY@AYI)(nN`+e8+0=UVa9Ns!B1 zJP8*bTFFK_K~{B0<^j1kWLbrc zdER-})>E-~r@q~Jg^1YbOpb_%nj@eqGfr6RaW+F$4?KZ~& zgkh3(f9}iy2nnQmgR0d7e(h4E1OVViY3_BPUMdX)B53(04I|&63&6TsY8d059U&}# zt0T3BN^r52;!w{1Z%KY&GPJI~oo=0U#OhoLYX_z4@+AYH#tZTXL8&w}Pie*_;K{T- zxhH=x@%$f+{?oaLEl&Rr8M%MY*HK|rBIqdKW34;%AX3ExrwavJ`z8qccO4X&d$TvVW8TH=C<}3_b!!CK$P(C+gt8@x0CEh;u7oJuwXq?`fYSTj| z2z2}G&MHwnJg75db`pHD8b`$dYImhEV5zkwQ4H(1evO!7fkZA~QcnfoskL}t()q|X z6+qi^1}$foMM<%yV4%`j$j7a~uh=3aaY2dNt42X+(>aYxJ1eV{%C6r)cHrGB#(@Vp zaNAP;0E#{YqtVuW6w;q)pVfGbUIyv2ce1uNm&CZY{R}g|$Rh`G_kbORSd=oWVBn65 zjW}Oi-(xG$7I~09f&-}}(ecB(hF~*~yy%BS-OU9BiNnch^;`I#_sYUp;rJV>aWrE4 zo*6-#M6AZOdrfapjT0ZFcH1A-n0V93(agbH@wnwCD1?xGQDoJXHHC0`#C}kuG#0(o;p=S>wcBTQ(IV1A}eSMPiqWT}=i!Hh(k;8QTnSJZx)# z4;yV#XFq;ruZ4=DFl3FdT0UVn7IJk&k;{{IYnIU4$76Leht&Pdykws0I=o_s><4PV z@R5vwf0cmJ>~7;36BCPo=<_tkw`=U>EO;cVL(_y|(dV1h8;SedbW-fOpYZ7O^MKO- zK;skgs?5aUWefRBN_PTHu8xz16(&Y6y{gd`9eoZw8-al|BwVJbY7Kf)YE@Ftnr&oa z8ZOGnZ9BOdj@V^e_S+%gp2;S=r6oSUjz>&ubY!&$#RP!e8}#n3O=3pvdt3r2V|OdP zUt;in_^j2>ZRfNFFx(n~|0Goa$L>i=ZWRsN1cD&%l7}EfhxZ-?|fPJSTkbh==MKrr&1hS7Jpd1l^6OaaM_tD$e zd;>4LCz(uU?li-_jdFNnl@3gl-OWkPx%#^N?SG~dr?^WxA^P?WWE-=<#xLtPm(ZdWc)8s1J5U9q?%DE*$0RH(!qKb0kfWIQgmBBf|lkbfFJ73vveF9M`Z}w zcM%R8W$)K2lMLqxXG;x;iC&+YBcCZe7GLu!R(9ZRf@EW>F^AyA^V>iT;z9H<P0`xCyjiw+i#bSu`PMY6c_hy@fkz>p#KfAP+;6V}{FQT&h(UVYMv@%TJ z4#AjRT7+6zTd7UmhCPnlI^8}r@@}Qr&_FD^p^2=^_6OstJ*oH8O1%{#L#k2BpWF6c z!%I0r{`z*jBYBy;U(Zc26_3+A{32k|Sz=B#-EnSSER2qh!wnCJx3r1fw3G9ltt94n zJyh{xn_7N39y14V4`IEF0S<&&+$sz77L6p8BiWpt0j>v4uMW)C$6+JmpJ}+OiXZ8h zc|9-ovL}ho)D-C(c}0{(?g73I(a_lpNnad=S}NgQTKf>jl(02_ASKGTHB)_3c7qX) zCyVqkTb9}vL*&g&@)_@-vTB=$8JWEu9syGsQ*a435mq?foBD}`P z{Jn!VC%)P;ewgQ89^cXmEX`yL5fwB4)4=@q^8Ml`I3AR`glnw*pN+n^QN#?15AJ=A ztNaB#;gCh(cdYiGYV-e3$sLPzZ*o@N0sgk*5~c?+7&L+c+3PQh)!)qNkmGX#|C~jv z9A*y+wec1X<^#&*u(Ld}|%Q>SD5edcXAXnmYsXAKh|Gx8z(0_L`QMpS-^^T?d} z`5LVHHq8_&X;{OUGpNHrt5e-I?tS0U=5cIY31sv9?w9wSsrwhv`hD=#eRqC_D_c3? zmAYSq$M)apP<^!j7+@EGUdS^A1a*~m`qKq~-#}n=)GJkhfQ(b1HU-Tsu{6*UZM8Zy zVu4dPxFt*2kKXPFONA6}!vTPnk{GhYC1VinodwqVxuNad`UTplt@X60IlJpcgo92C zz){?`=tQGxy;{wYH_kJYwC0%w4o^*;Uzh1A%D$#Gw{$r%JV-%4y+254a7l~r?4jSG zyZMJU-6w!(wE9qb5O_$lr)8;Vm5#1^ucHCf#L6q~V3aN~MbI;d>nXS`(-mRtr~ujW z8&k6KAiS!wnk)xDG#peG9FTqwegHh9(G$R0yF)XsAhEt75w*IkhuTXp-17H#S*Me6Qem;A;vq9Iu(9254P)OI~J4Qz%4v3w!CX$229s~nd$pT|eF+GV{KXon3hSSGxMVr9-`O9_P0J+8}qUUL3*glji zy{S!N)l*acIJCo^jv^@2!H!|isH{Ejub-Hv)^wc7N=CBDDEe5&texouCOAoR zO8AjceH$pU2=!_*vv>*7o!JSbk^A!9>d>lwpVQv=k>_1a@Vl3OaGG@eG&Gid$Q8~t zFG1>iC&~UD(G=T+$Ed#OUa*jv;Vo6s6-sD*+kXb7} zN&kR}UDA~c3^gEYW7RI&bZi}+`S5kFW5*sHla~_L_|2;-0X3omCzq~d1U%O4L@Z zV}L<&_3_-6Hq;0(0a=;nbEbkxgyvpQY$d0Gxw+|UO~ujA5n&% zwJrbr^&P=K~#hDFr>4|KZS0E7{P50h&jF&FW@CV_^fjiXMwkV&J!Sd1P6 z2)2-2eUxLhsW(Q3N2`2Jd%#s^X?p!;W4c3E=@u>&2HQ&TQSdX;lEq1NNu8FD{2*sz z%8p_?&Df8(6Yyg)pyuZTT)8kJ+_BctM~HXG%NI@<*Nu<{-h6e*RG3i^WuPbY(bxprcU1#v)#Anu@?iHz4GIyrPc~9NxW~lp<#pDz zu0rmW{RBt~QjR5oOoKB&NObzVbY77wFchaca9B&L+@0?%I638Sk~)pl?I7`}__P?X z&tc*hQ>YfyNHUg7{_5m(2i4UHHvGL8Ha`uW36Dq2*aYfmEoC$ahCR?AvGuX9nP`zx zcIC0s+7Fo7#lLeRXpQP-R+mS)xBBM7Oyjg}G6L)%GwS^{WPLGAE3L+M*Oq)j%F^cQ zroHDrF4!x{aYT0w*X~OL;{oMItWl z(=9z1?m`jK>@slgR-a*7slF0^{Yn6H4Y1vV5@6L!VL0^x<5W4+(^VCpoJBR;*b*1= z`=bL{!c$ceY;?hXM<_9>M!ykvfz10Ft8q@uB8An3WJHXJ4QIW8VUQ!pDPKA_mf90k zz4f&SxxLHuxr%o-D&QchyajQ|`VYAUhbs_BIue3<%M{NrKSvkcW-GSqhVgX?GB2l|lS^0FDFKdE~+ZJ)#fT9Gf4F zaIkBIC+-GS-uo3++!#hI>e=1ANdLw;2*Jk+C<=Jaw<^5??B;UVC{Pf9kppejbwTh| zKu~9jg$SC9cG+zqe5+f}2*G02*?u$aoW9F`%Us)$5r`2%gv93RJxP%b%6W9| zG|`i0xGf6OtI!(1F24f@B4P5c&D78xpNDp|aTd5uYlwmCPNNfJ+!U5JzI_g764!<~ z%Unm?R}d0sDuEjy?(+iK6QhA=DfIFra3HKFn&Bbm>&`Ikhh0sX>E=wCFd;&T#!2U~ z`k^WV?=U&K;LD3%lNt+~U%p-lCmIV4Bks->4ySBls55>n_re%<@eQe5W=@+tw;gR^ zblq`gA(5v5f21~+OmGsdJ>TyVFZb@yU#QgHBs7_>kwwvSRm$l**fR0=Nt<*Uu#ET9 z*xldf2AlKAHNWiSZvD)uLa1Rz`x)WDS=O!Sn8Lk){OT+CLEFH}&(~LhXJsWwuHk?z zdqyYcR*Xraq2%Oz@l?NCrD2)9P1cUQ28BLO#54G$7D;(bkzsdpKd(C>M^?|`yo2cQ z{=YG#>2nhwhQ^Ts&R@)I8l{06#rySftSp<&)tI-*gc`j@3=5nq1*c4$9)^~<-X$*< zb!Ukw*_x@9xW^f@^)*&5wNUQeB8d9$>h~PiN~<3{Bnt0GDDCbOCdgFIRfgz0Oa#>Pb1}^8cAOl1SEaXe zvYCCCI=ulq%K@rGOKmjtJb`WJ>fX|ItjLUsqh zk#>Mz()<$CGIQ-{sh3=yo2{ z8rmE14qbNgwf^;UtXI+SzM*y$v8_21Q&UD(LX*K@MrUP*Gvu94nP@*%0*&J<%UeD%A}j%Fz+PZgae3D4Wr? zbftPpkqo`vbofE5rt!k0=-8*Woq+i-2DN*#17Ty8aV#TE8%!IjfPX|366e-2lX9&x ziuhlX8eGb%4b31T&R4rw0PBJ&Q{>6nF-bEkJbX&t>6TW|Q5Y$A_8MLN<)mm(ZHu}* zMtw!}rPVVTylPqRw8kXQV2W#}g@xSTicum4vyEtH88H}_+O79% z7_qXSpqtf7v*z0aOYd^&SJR5yNdHkbuKl2Jo;k00C<(vQ_ub2EciYcei`j!W?b)jy z?7E4b*rU$8Mcz+C`i|N{(O+hi<8sd|cM|`MeYL)IXEL`CMP0)*O`ci;D_i!nW{DKu zBC+=VB-PaUq;w7775kLn8@qzPM`$=+(_U^b=Gn+-(|8p)Ssx7Q)kNPLpP)dk%yW#~ z+aO(5-k`CY-M%`K}rjeN!N;!H}7489xOr)uM%;Egj^p^YH& za*sk1-DYR4g`4x!4bLJK@;o`y*#ol$kyp$DP1l;LCPs`m@)b{Bdy_WjpcTgbT!Pi{~McA>QAz;G+(J_I508Nfgeh}x#!P6W|rc*iG%++*w)B^bEU%h z3e)yhe9narmT#4Bb+#?xELKM7+={OH{{8K{L62znD@#SZ+k!6S0 zg|fX7y%CzaI8tIbQn&l@LDGdqo%-=6EmiqkkNqPAco^A^(^ONF@Pn7w4HM2L0Z$bf9 z2&_Ta9=A@z_TlaHF6hM}FoOm7c@Zx>;(#+?H|cwlLbuC0n4Uet4-lgO*f2LjVU)>v zf{Eco7rxc@jXt+3;ucu=POu&(T8q1+W%k|r-k=iraNTNjbTJQO^b@Mz=C!yC^2W>Z z@$8frFKM8k)Ddk*^qLI(*4yf9_Y{Jz+9hzJdr*3LIZ_>uJU%>8zjWXNs8%w zlo8L$1|Da1%(cM2{odXZ5Ekou^p~lr;;w_Y?zifFo0~{QjsB$&b*95nQg17z%QFr% z-+iZOvNW+LSQ?B2F`Uw1(0o+IkgfsLd;kIXF#6?kmhOuAkH zZ5!+9aTt_>f+5i!$HABAZi9DQGELHh2ACL5k3VR5r<`1u6l(YO#V4lT6_xf>A_|B$2{6ks|PBtM#dH17H2bkv6%3z>2kxJ#$J~1u}%alNfl4G zMq-T;%O_A}S9TJFgS$OV=Zf0k^7tz0eUGPy+`(6tYo&C#N}R7&h5W% zlWiy-;Y(p-PtATXNWYMoxZi}!eG<(`=+r)=?J~PoLNu-?n&LWJX5 z_BH)Ondqo%7}w1=Ub?r@{Gji|lNCpLv8Qdym0>Jb85X$$p^5x_`Jou7H)I_oTV(+- zS7D~NT8_Z|0G`TL2R#hF00OJt*YefZ>1IHln6Dh<3GzhfE3s^OTo%ht0T+VVI(X2> zd4g(fAfjxI*`dgOqNrs2vt{pt`pFI*G{1_4f_ReLTFM!#av1I|<>Xy$bl&yp&i?d_ zdHy?J;@r>f)7!2%R*#UDJ9-Y25!21^13%jPf1L~L=9{EWEy9`HL>tAz)W81a9&G16nHxSV|J$@rcWW4n}+D*i2%1V*ct76 zrCwE%pkimPphp&L#HyTKfF}6MuivqjvM0>KqIWC(HmKV8KTdR{R?FDKZ;6Qvs|?K0 zixj;BS|VNkz)9+inn_h=z&Myo#Hb8O<(4 zlRjcc&_NC*Eeu2~H!xH379Dgdwg4jrc8~2`*4_~>9S)X#^V8a?IBM<-@=Ju|Y{Yk{N8H`O<5sd&~wX}$=^YV;*u@=suaes}OI>9(8KvPhTtSye^Fs zdIh}oZ17A4dad5uHkG4*EG@*b)ZYG~*ywOu-p}9;0cIx040~6~BzOeO9w*&3mSR#} z7BWcp%bp;P1&{jSPfI9qd|Jq9ts42WK~6M?TjoRBTPecpv#50yBZuh649cS9g7^22jGr6X5t(pI-6h8qh-+&5 z-rJ^|5KXFksXBRq;o>T)f-xi7%PSX2cn~n69d62Ti}XtZr!yrTPn&z`7fE1V88%j# z$!1+K_C3D(!q}U1b+Y3?uSGg)IE-;`#i-@mZirxY)Lg?HOJzji?v^2HxM_pbV@pn8 zybf25+TGlc-|(H6MryL|cAz>A#{9G+jhLFe^Y?r(IqUHkDBT!!%V-*BT3=>x)*~+l zhjuJ02m4wWXn*A+ImzLDjwe*v6O5`J=fA9j$M zvJJRZ4&orNZa`Hj?`h8sw3vG?=Iya33#X)~fLZ|zxAZ6!HozmiTlVpZ%6MS*C!Q<@ zZ_ojV3PO?4$G*3Nhc6yFxp&kAEjf1G!_jpi9oSQXlQ3EE&iOuU`_Q+NG03NL5Idd( z4j~x-PeY~OmEXm)GJD0Jz!rvwyijqgJ8|a>q=8dp4srnN9sI{51YFkH+6sMf=qJP< zbaU}f@+S^>Q~Y#D{_xEW?2_rJfjoJQOq_K{9e*`x5NGW+F`Jn|51B3fv1nMtKoxK3 z&Wo$Uy6W$;mt2)2=>6m1*~~%wS5!1LbgN6?t*RC+-aaRVtte5ceH|B!_s4OlC^p=A z%gLkZ$mix>@W4~`r)%GGX1IGEQP8c

uMNF8U610+pbvbSS{d|4ce|Yuhra6kM(=J?KrZ{jEUbL=LPRqZWI*A zkWH&{n1p}WG3w}J$*{9f`+5BxSGryj)<@_@LW7$;rj zE|uu>Ta<1b#j@q!y13%qY1POZVEs#S;~)+k_NwcL%~?MR>#V)}#h&r1 zO$i((@hf6aMzOJfhJbIc`GdGYbD{)VT3X)3=NU#z>jG{+co~x|Z-|VEz}N?pThYx> zDyZH7P+js}I``}B;jRF9_WuS46s>pM09=qvxhhud=yaJEM&fK7cOsc-W*k(0tmbwga z;StvZR)DyAiPDpx`DmQglWkn-B??IL(Dl-(OKV*DMDB>pRj18=DiyJ^)j zU(rF9i%(E#ljPpih(MUbL+x$>khl%q0w-07_T+|wEJ$EQ!6EW|w@X&QV;)lWAG87z zg16kxOgiM9NKQ`qBva};X<|4z&;zi4NGoAYbE+B$G23M zFev50e-MpEH)9Ezjbs!-s(_fRcI~%zo(4Ijk^!Eo{3g$TrQ< zhLgxBi}mC}0vk+7v@15YGbMXA^I%M-skP<%GpZAUS-|Z!Hj6yVq`P%H}j;0Gz- zJHy6%1-wW~H;N(?PPIN8U|T?$9LiZB%H;2_&`>hNB64W#V`fa3W4}7`Cl+zwX;jL>3$~(! zb?X39{i%qD-PL$B7zkqAua8>!)+TStAOO#DdPWpRwN6hS>=|)Xp*k}FJq&%_Jl1gZ zl(Q0lOE8Us1A$1D+R{}G!*d_Dnm_C*cHGV|tAO_*xXg=7N&n&kMXH#m3UrSU#>9@Q*fL7!4sHw?mE5;g zfWp6ved&4WXLuMV7Xsq;Jdh2A@j*Km$K!zF9}B{9l>~lRd>@VW!m~6)6jgjzNBALh zPWb_C`+^wnG3v#^w z0mwurZ{4i8FTTsISg5e-Za(la>Ug!!r=KWz^;rW=DwEQebLoSgZw1atcTj2XXi%Gz zX@qN$Wx1IuHoBX-u@9*CdEFP7Sc)YVto7Q7MN(gJqMle{pf-_NTHn;(Uj*UTa%TB!SZk>1@c#1dygd7HXb}Tw z$F;Pvzpr2LlF8yiNjMV2ZIPdKtc*DY12BYIjq+7tLGNgj)pgb-VvKe&~%J*t#-^z!^$% zfbx7NJ015M3kq^^D4wt0d{fy)2fj{$tux-f`B$0_(&_l>49SPC%?+F-uUW2v3F_P> zP@wzb)5up%Tx=XUP?h^mnQmqV433Y=&V-_(92(dr{m%H;7AU01odYZPkk8~hP6cK4 z{uOvxootB6jz88OdahbGiHm!=<1aAx-vEPb=+}p^C9~K0HN<)zJ>r?xv}yKfv7|z6KHYR2)yB*tJ6cs^cn`Sgun?HQNYo9N()us4IUqJA$UEn`b6x~ zFXxlp+s~F?p}_-IsBQz25zSX&!Jc6Z0Iu*e&F~qC^w@&LxYwmq%MsdY6l|3VHpmek zr+16Wry~H?M`6H;v?Ft7gWYiLz(e%H0DoHPE6#BQ+=?OaLW$x^W53*La6Nj5FyEf% z>PU??wB>vYHF<6^bTPDt4ep5NBR_NW#qo?L_Ez;Rky!k<(7PkFjqm2-6PJ7Oa?`HF(JOZ$nW=G2J`>UWl*|oACic2Hi3$eit?YWF zRO*LQt942vQ63{ciy3?EIQFK!uLZIV-m6(7Y2IafS3tFZZv2_yN6dFpOqJoQOFjIi zaVmOnYuAKNUPS!@KiMX7D`d*TDSVHWZyeorbx%mddyKPMB*ZT3l6!fNa#K`c!p7oi zS7dzxGN@mv4Dn=SkeH8IAhxSuwbTP<5yE<6H#|KkbZajwDf45@-n}Hr?gYR zqNv5;0QBH!QzsU{mk&=__d( ztNCyx5)?MdUT0(Ly>es;pu`LWCBBW>oDyjL1dx#wLf%0ZI0I;I#a|d1vg2vBnB;fz zhLOP)$c2U9__P>5!|(rq)DQ)C=obE$Gx`^d{~tsn7}ahvnU_R}(s`QxzOGU8T)?G( zP|pf@A5fpfwW;e$2FgK{pJk3#>NCJhYC&f&7M=ZCHai1XXos+>ax6wdt^fL z9Y(($q)p5%^$G?o6ig$@z;P8DgX(k+pFz|){2%-?H-LhzRHt#?ybzR=uQWS_Rd)0y z5^(WlqMfgXVj`E-^HN3QHDYJ^Qn-3;A%e~&@t)%}Car*h!Z`4UNV)H~!KFjGjw?dm z+_@Uq_PT~+9HM(T72MyTb|){MUzF z_waYKnPiIB_p42x^$wus9E+yeEhkG|+#T!vL=t;or#g&;>Mz}WT#i^pGR%3Q1gcgx zkx^H04>7~!$4xe__(lsqWH#b0_A{e(p1mV$(HeRNlgmvGzdWs9{cJWka!n)mwWAYl z`fPAxO&khKCEa}#nak}d=z_+&OFL7JCtEo-R?W_}p$t;WUlgv7iK&fTleOr5Ziouh zWcfUZ`#yxEmi82w(51#5pV+KjOXV?^*}smVwlw~P>9=U9YBS*ZbPPPl$5qjUr}~9Mj{Icb#hxsD6#ydpAwzEo z);J!kWw(kibeSs%%ZQ5L8LekZ{=Vki&J%p)kei5wRoNVc=0P>8P1Dn$e%=Iz45I9! z{dYH87azKrxI=Oc;D?+ht)RxNR7C&;N@45SgagL3UpxF6tegRdQ(uV*Ht`O6rGaQe zHaXrel>#w0D53SO{(_Nug1Z;WWM&a0(8TpQ3M}8 z5ip0yt~u2#QV0$N+``*VTb$o4nt5PPuqXgz35U!%FLT8V>w8OxKLc2uk{G;d&Tiog z&KjTugn``${im)#Y6=cPZ(+4C1ae|muWx~bB!3L}ptf_br||~0jn7Mp#*LGbTG#JX z*>OPdA-Q(6mx++flaNe_gK;$xundLQCeGU3oM3zF4pfe?!Arons1D!NSI3`#9)Lyj zJ1vNE=qgO+k73a=hT_F$qR)&^lE!|6nJ){fO<3nMz2pk>^?MeXy)<355msuVayuPk zKq_o*fthuCz7nLjP(SGP%N#jGJ>SG~+083D)}7^85$?;0iHY=TRE^c9mV>l}fBAOL z5ldjZE#F2JQ1jjAki*$0)eb%*P|t7dN35xvNzT1Z&E4&c?m*lye|?wPvs<`KYuI&T z2$huLA#T|^ZNLLjcfpY`tqtjN2It9oce4ebDWjIG8k{xeVEZFGK=Jw7{NDsj`8neS zi>9e8I_U*13^IG(JyXs%LRoQUbe-kQ))VyB)~tO>9kjumQDKVU9_7P*Q>eV|xXz7t z###vC;!)!_oU}|-D#nhZaWyBqC#n3Rx4XN^8HZA3daE+BUXQPS>u^gt$uv8|mpoJ2 z7pD=yEW2-JgW4)W-A?ew^3wW zL1kF4OAhDE;(S#1j%~RZbsL@SkDmUN+8HDtIC}Dm7#IyXOuT*gGeLqy5E)D}8*iXLgI>&W?SMTiEc7CLvM8k|3JEOMwjvBVJ$s73bTS)xo&W zv6_|DAygsjljotTsocuV%oNIe7K+NiF?4ZhPqi8IZqgHZHdkl3GnRB#>WCo^I*F=h z&zkK;BwMCcdZ~Kp^xG>k3r(x_VV_1HGS|NY@iP?Ihp70^@1`GyR|igicy z^&KFqnK}(NU|rR*z6vE+KY|Yr^B2oC1@p_Cio}~~D9O|=II10wJx%h5Teb;F=i~&+ z%S28i`)^DDlWz7PuCA2jGn?SU}Il)k-}Cku3%CjvG&z%JSH1LNeOzxx*Z&s|P7 zMY7>VApMbl?{Z%3E+01W)PHsf4!y1ThMeHBzC&;0O?qamiKi}@<^3afFWzp|kXDB) zo1w_En$V+-g?BCE@-CTvSAOkV9YZ3V%5TO$z%u@f&%{^XhjA5~&z^-BAyh`qrH8W& z1Tr!)H(a~;@HGVI$3LH#_!fH7~v(^SW zHJLBg4Q`K1!TpxD*tOVpzNVv$2bfWe25FZvL@|Y&sKN~7)oo{xS3lw?9XI;e?^Mk(9nRTxO^LdV#3~q5bx}IR~N+me2h4emL65pj1#F6sn3?RemzGB_QkRQ)UZ%o)p&IkBsTj=9+d)U2qLscKHYC1#^pU+_ZF^` z=%@$Pd*z2vWqwAje7?p2y8Q@opfq(8{2HsGXqRGFv5J` zgP(-4SnF{PP_n2b&U}7jJW4r`*1LJ5S+V`Rd@#4qq@H=UY4hd9jbd z^v8$_Y?zuJZp}?%k2l26dadcvtHrQ7`dYgZr)Zl7o(vmUQFI(UtW+(b>^kNppGiB& zLr5#1mfH!_R#oQVe6hY_E1DjJ4qyIlQtss%2<+ShffK- zmYm~|E`J;g(ep=34)byFTMLD0(H8qd|L{Mu@;XcAeg>$h9xMt9gr(ceM$o$|L6fGh!#%2LHSp)H;J04)!tm&g z8H_k{8BLgFgu=2(I>nO^DlX<{zwz+Oxy`{e(Hh{TDbQ3}hc(~39R%3-z7yO8Fg5=X z4{jhgV)*R3cOU*2+b$w&m5MGy!0*j%A~PY+2$e!@nDOED*QvC0GKlhmGVtU#!Up#& zArJX$ai=603jZ9$M2DsNAAFq?5x{L#Xf`_?gD2wF+Sh!20ytDX&H(m z=dz*gy1jIUt`eTmUvHds>+-_Ci%G0FcDO+QHXe$QfOwp|bkQ1r&1s^<&tdAnY=eIB zxdhc_<}))Ho5QcbZkf4a?%BsV@k>W})VG`ZnhNNqq%hWdJIrXp>o@1ob25e0-Lewb zrjwXHt!cnaOWE1e?4$+#(Ug9}o?ZFpnVwjt#pTh=*lV7yPofgTM^+%i#1Wb;)_d$uX&3oz}2&ukdO*fR4CUvuP2UC3hNUSGCs=9QKH zGC|p*R5Sj5&X({tv-VzobNX1x3>G83ti;oqaZKD5-)?X5PpU?A1>LZoU`FsxaN``# zuF)3jt=;w`+}G>ea_pq%8>^Bji%jB@f1K1Y_}r6wjY8JCm6NjYK3&V>uka#}quhyk z&Kq~%s?i2@H%DtCmnJj(0BKX#g5=~i1%WjC``Ju~Fu>3Aob>Yyu*4*)?AZX^x#li6 zkZ&x#XYg!4uDY3IX}w ztf@~O!pl?u{B>P!{|36y|ECV`?_hjr#D7D5!dJJ&T#mXmc;X4169MX+ax=US5+)KA z#6)OcK@~DE4<~!Tk>QHOHs(e!KZwE!6Hx{+=ul{7lafn!(*Jb0_16;u!%& zb>UvfXzX}k)L*{?bD?=vM}4%!#N-V%%{Yjp5cFOrB9LKNQJ zjCx`AyW*wvT96s{hXO8Ks+vik9y;nBc4C(v|6fI>eBk8zZ}S(e2R(-Yf${XFMnA6+ zj_>;6Z6t*jI)n|1m1*~2*!>)+3k>|l{-Q1)8afRZ5pXXeeYcC3ptFB}k$A1r@4j5F z+0~g))0hg=trJ1MiijSrpCj_FY^$>kdKV^v5Jl7rCR}<&WBa>#>c_dACTUb<<3c7? zRD{V+CRt&(l(c`JueU#l$6B$B0D^N4WQ7Pych}R#c;HT*qm?|lfZe*`<}!p0l&xWQ zp6xj?QN~ss)a7;mgtN)a3Cn|6avt(p*CWooN8L?iRwAgiYL-U^jq+6~_g(Q?P zVk|1<6AJEvIy6d$FXJXoA06#EqZFUa>*2Qwg>5Y`RWB|S?|pFVow49Gow@yqquREFv09P0c;u|Cm12Tm;A?04`<-2I z@0;Cy1MWm|H8lG#(rf2j!z~2_x{OPTPg^#spjLsl;DuqDxBGMxirZH-cpJQw{D8-A zYittE?zg0iqV`!gY6)TA;+Zg~_KsPR8rc(>D2nnqzB;0b(`-2^yDMfn2Y%JGq1)2B z0h@qHg_I-oc;aL4V(cuQ>*R8x9-PlwHi&lX8YVj@+s5P_NImh!fKIo_$qnQjeFLb& z7~~=e9=nDgX~`b+*rPT5Bbn}lcbR)8AJ)D>20!o`=IUDU3g2M>mH8|H1I?y#3Jk^Yv8?cdsJ_FK$R!4{^202H zXbp_0A02U4&y(X(;4K)!_*OmgjRE6){{LSIK>~272(}Zq&SxnLm<6ZrOOAL;uyJT2 zqPJoqJ|B<-Z?<26DhYsJgqq|5P46R{KTaqBemN&6TijHrE+%3NM#Lh9$ug&N@pZFt zKOs<1oT*gVBy9L6LGdLRxD=OP_aN8Nr`0b=?=+eJf*?CR0wQ}|wu`8kh@?8V-KC4- zfds|Olx5ZG+DrW1y$&!#{>d8L0DZ%N(|gg9WbfkA+aBkBll${3`-y{oIGDJ04>!9NvfcPz3kt&??2 zm?oUY&rVb&r&pQgo2L|63Ht5-O4Z(3m~EKbQlXx}2@EQLV%jH>3Wq7JkscM#tl+{^ z#?z-9(XEe-s)eR{j%B*rkaUYn$WN!9uA_>e)(vh77M2(G8n72D1{r|U>P>+O)}~T( zH?`xs$5YEstqx~Gm&gc7>&{?=6@|dhh{|B40Z*{k1|fh zJqlReNKeF58E3K6V5z3vS48s$HfD9TRd7~&j<>$RUKgy+z00V;(0S=@0zej+$G3P^ zZ`Wh=`J^td8n_BM^4@)aUP={EAk7z1&u;PD$}#zLF6J$xA;}eo>Gfv@o&ld2y9%|p zn1YjQg4~B!dh2WTx8kq)_1WGK5_O2rl`l7OMp?BUgqJUp8)tZLd`UHtS!;_j9bWx7 zgv3#^G|ufb8exV*j%&He7BdL1tZTRYhz}N&IxwYmp2~68lG)i>G?9_omcaPP?vuCZ zPDYveB4it1mW3hj8hp{nHfrp#4gOh{mdX$xNwm^|WVWMq%`vr6WH_4rjqk>zDyQ`& z&PSI;q16Ob4S<2t{}6wZ_dN8|Nur&h)Z!-)79AOTP@q6C7NCg#mz3sj2H<~v1+=A7 z8bkPloYjJZ^%fuv>V5wq_o1pFL7x)`g*k`s1DcxnCt(QsNsD=n z-Jp`YT>Qy2b{v2vP=z1l>jgljZ>w|>@CclAZ-vKqG<5y~V2AU%`i&Ny@ZJTx;i+k3 zjZgBXz$u6A!)$TTPaiK01jn$f6O3JO=K?Tw=^HVpgYuX~Z1v#r^TgvpV;&e|=}iXI zK#gm3;pDO*YA7}x#j51V6L{(ZcbjvSfQDi36ePznnCMlOr|^|s+M6y8GD`_)vvMLKwOA}7hwpZ<{d#%jJ-e{SBiZ{S&+Czanj?|rtD%*Gi+(?FNZDkdUaZfT z4c~r_d*al|Z$4r7yb#ff+U^qK`p(%sP+-c;F8?G6VIxYl;Kckbn-jUT+(W2_{V8Ps zOfvQ6%x2T^J}qDj!_CjIz;76f}6`aGGGkA=9BH-1jH1=MACcH*3_AD}kUZHJfaU4Bp z!mxK-BW|$gk=kxm5qSY7(x6gP&g!2XdfyKC@-x!R>Y$=-qX^CqMyLk-nehC#^8*06 zEe9_`J9)|L?|AR zaXLU6z%_pxg60YaX|7BJ-rUBM`AmQ|gJ{0{<&wI2jlo?@pfG3uezr&b(C?m=b5n=h z0}y`MFR&H}jY(N2Sii;B2QDY5edzoW9DL>Q`NDy3;(CRrZk`?L`VYMdy`x^f=wZjo zdAS*oL_s^mv?-nH4LGu`;YpSVWe&ihEuO>+xjBfTAu#rFs0lnoXa~-pumRJ{OL{=# zQ^i^ycZWbgTqk~AgXc$L5f6`c4<&KQ)x<7n>Jr$&Y3WzD37bLh$7!SK#zRu92c%vz z`wHhX5*MjKU<+Reu8M_hn{KCGFy2}iFx!chfnZ{5^`%$CAW(^|`z54k+sf zo>I^bCg;8_Klx%Fcn=`wdBQlKgi$&8%wze$TLkmv$D?TU@=2;}bw{O7;cU#GsG_K~ z5fS>eaH}L);%scr{OUOrtH9hRDz!y4m2?HeY5=#)TpH9^6-JB$;uX|K_49Pz-J{e|rP9@mpyBuDR7NhzUs+Ey%`K#I5V^@v*+H2 z4AM*i;!fVrB-UiaZ%dC-+^m7q?3avq$(+~>g+OfG69ai6-+V=~lTyYyv$aNonX>>yzS3a8iX-J4%d zST5qcE-dcONTWJr)!-cj&Gi%3U&bahUgGU zd>kSI346=69y}Mddr!<@_qLrPwHi<$ONSdRmBvO7XxNC2yjK$q0Y|6wi2# z!8}k#{d0%?bcfM=ZQzL=Vp&F_SP@#~T9=5|d@kQkDn#eDbb^U*Kpx-VsaaAZhNfC? z!SlH&c;A02wX6%78!N8(_x(np85WftQ7aE!BzP&hLwqQK_MLJfg!vpEy3m+Y0?(!!Rb_VJi2!Q->*IN-M$8w3M>)4o$=|4><6ma zPfEKF`@aAx-~SE4xp06bPI4_5+5>I$5mr$`VLuW`ak$$JB_JV=(OpUPyfUbht_}R7 zG1#F>8H(;OKb2*6{WSvJh&4Q{3nJXBiTa)JY&_uOS8}t1@I8W1V-4S&Y7Sni7f=RW z5X1qDxr-ZVIxGnjih?z`&@_BquOjxacsJiJE^m-q0|HZ=ylLRexW6g z!B6&b96RelwQG)ZR4xIs5S!vpr@~O&_M*$?pjiBUeev+lyZ80FyW+`hMuq#j_$-8}yz{rp z7EfPx6&011;nN(nOr`10n$S6Jb*ysFYqCZ$DCrCro1K+QT<4ZC)wME`=+%eU^Rd77 zh=cd%^^32R1odCawBy9Q;?rsLgNJT^X7G)7>OIH)c}~Xjn6S4UyM+m8c0SmGXHKpi z8UI!^0AKXopjYcqmEtL@dcZr8+%b5qd^*7ZK9D-!uqG{gZCbYIRFSg{!-S9SVmkK4 zwUAnP`1W^&)HH9Lac$&wHjZ*Urp?51W)+19OH=>2;vQbCy?T{s(S1+oDr#zb@8{vV z(z*{G^>ts@5(n_8=jA!}6Kk`}qD!M;oT6K|2L=apob@i+s|QsmAI9`U zbo?(s0CQ7!d80wF^AOp)K;|d5<$AIICyAfP!RBwEngR%hvZ)Bi=PX^dT-HE@{J*vCU z$#U(cn0y{jnL^G86x|;m@gag5N)5x>-WIVb06zqMiig)Ognb zJBG~{NE(U(&y3Lb2Ri@W&we`u3Z!S{j6dQla>cIsPPd?t41M&W=PBERrr5&++8;>2h{H3M-@wbtrX)Xo zRRDLjn44(l!Wdcq%XOQLlcV)I6`Y&BiHUdJJ}KR}XrX3p9Z*3dl}I@@18p4nLeoMj50I$WKcQhkz`hyUqGabYz{dm*7B_o7phVh1z1^ zvj(P4crl&I$C`Q~C4VGrdzRrK*s0KsY4vUOGmoL+w0rMYQO{n$v%m6q^O^Qjh>T=r zn{F*94XN9I+$%QEuzH<+h}o`z^2wS+>_F*;UCsyh1)5?Rg;itjciEN2AD-m+zrL$~ z?xRw;tHI}+_H2P8hJL!cUukdalrUwca3PBwP+Lz+jEox3TT=+@NoyvQP=b!XTbOvi z9nO~BT3>;QcBK)`KHS<>%#SUeOh2&PANbgy6^j^`B^ zzRXf`yXug1`H95Rci)y|>Y;$`U->mRwlk{3J@|ZBi(dBdG{>0QwL1YPnVo3bmH6;& zoIKOqsJ>V1^f0szfbl~D?rLLpzGOgxOP)Y1UmjXaS?!%WHMZY!qCzdqK;}JYrh3Hi zM@&7;pZ{OzKY}~xHZ>izWZxXd_5iuQzKCz5XbmT5kmm>HKlB>5z74HQ`v@5C{2gm0 z72U6d%GpynTN0p@D6^mMyZvx+kQ3n(JQx^BZ-sbBp+}@#RIKPv%|viQvm>Xq_PBj` zLCOMk9vq$$m@j_|y^nx~jqyOMxnDy8D1?B}<#)N$7f$T2hZQ5zllgtzUvNWbToRzz zsb1N2!w8JT1ttG~$^e1VFAORYrp6)wgtw!2cBk|Z{sA`JULIJY2Z{-ruA7I5`7D-+ zXy;|Ky@6NhtwAYw3jNeGi>(TQ+B)h(84aBGNYA%*G2zJrm`3PlASHamLq)ZY&kznJ z2fqu54~2=6Rwi$vSpL!@c$mClcdi2mXP#UC|M)zC;8A#dBDqz(DGI#LO0B$YAzsYa z7o0aS_WwBV&9w9eM*VxAZpn3B$~~kYfU~g|c;$u1fFVG`IKRZ86$a8M?3DoesBYYX zgkPJ?)rCdyG6m>U;ec3(Jp1yhxq`D>&*5kZ><~#J?o-V|aiU=wGfH;vE!ITsW|;8c z$Fn~Tzp)mi5O@&a0lnlQFEj-W0XD>~*p6RMlcM->b+aVV&iu;Jp_uxJiO7LLb|yr? z)`yZhQN71G@3GsaRpUx;?!x4=!jyAf=u-$AC)8i+7Xs2EGhfquZLW!S6B*%+EYzmV zo@vXH0y+E~X#G*>SjZf7vEiK{E@KPYCJV%lSO1uHv-6&YU+M@=707_}_Q>@#8*QmUziT^BBo zXH9p&9ly__?pCVZEtF8}qlahTy5OCd`Kb1}k7}_V=<2c$JT*Bn*Lx@)!Uu(GY3US8 zf~G?gg13_DZ-U$&H1jstoZfd!($}G;VU5+VuA)7koTCsoM?C(rI$T0K;iLCLP>1%$ z6_;bePGE@218>@H4c{7ZEJhdz6w=~DD70Jg^ z|FVb@#mTE{*Y_BcWV+Y$0eM|mt$|86pE<~P2eFhdFS#R~7ewHuzW|yz@#u|Mki$Mx z;&6kVXNOo)7A_I@LB-+6wNJW-4B||!&KI}`} z+ru{dL$>Xjf7C^So&PpA1W4*QbnDaQ{~#Uy)fE7;j<(-C0^zuzK#<|{bOArzgcT$M zK*A}X3y3|rA`&wxG(RuYMVMhdmHyp&p2poE%r6C_>!eD2*)ya`yAfBIQP-zfHzS z{HHSipBwyVwg#A9WR4Hv%)W9{iukyUKLsA}ifnvE03hGAO7Yw{DB*Y)3F7h0Wov%m z@Q8uM!a%bR!-e8`P4Pl5X<}iWKkRHFcZ(LUAT19Zle0)+7Ziv0wYYMxdPHqmmFTn?N~qO zxpQJNw7!zVU1tAGi!5%>7R3;6{0Snq#pl&A5?)7(5HgmMH~Q!WTbqd+^Ne_qGz$z) z?&my&({{sWUnZmeSaP%xN7xm(tSNNMuB$buXkVnOKTl_%yx^*!TZ=G9>6bjYt6>RO zbqif_-aRw1D!Y}6s$}((bDP z87Bc+g8xfC1DAEkjy;FDN&r)w1@XAV4xt-jo+MlZC4x%xMaA#&=yd`dwU;HE4WPTU zA&Sp#g?$E2-{6}+A=K-V+vF+cb(s&ZmudV*tIJ`ef&v*UXm5S^>Zk7+ckvi;g)3~d zj?I0c)`j?#8c(G^mFvV8`w7 z*kfRn3+PS}Z!f%is_*zJ)C-fho^mUSkU<}^yY1kLAf(}%Ip{X5WZehd7?UBOo5+(g zlLp+LT;<<(a@87YV*&ewq;jQ`-&P3D=+GsB0>B|Me*ruRFNC4~;Ypw)d1aEr=izsp z1LHx|19?QBbQYdHBiI;l9Z&*B_#{_R%_4XFrSu9GzG5*3xF7CwYcKky6;QBf>xyQ3suSWgzA48Ir^&5L~ z!|O)tY+V~-II>ACFWAh6k}Bh9uU)0dF`1ZQ5EOQcbh31St$Jx5@LR6gdht|7vVLA; zW6pr6z6(1S9)C)&V$}r$ZiJ--ak|y0pV?|Q=&%w%G*%ur4+|4K`f%9+!!iCQ=;>p_ctV2`xx7vRU=Ne5V#T)pDgF4W-u zr6!146}+f8Ph*12ZJ{Aisv$Lh)WN|#QStP&e@a*XNJt&XrOWGDPrL;i0=R11 zr}eJ@1^{eey-THA4_l36kvmgo&lK6WR1t-C4Yfav`5Az}Qiowt^8A_@q^3Ow)xP@9 z{vn+G3gN+=Cx-im&TeLhh>&2ZVB{EKzfcycUyOT6Xhs%-cKWOH8rbPs zuv6yGtCL!P>=fGd#2iADpu9c=PmI6qs~;nCZ57Hc@UT{S0r2sq8^2BV3 zjt_|;Us6J-Z>Hx@i3A!;7AM?fXhn7XqRFtMgA|p%4z;hnw~cFpx5r{rGw1gEi7-Rl zGEe)&U77J9OI#+rPf+ICG$ZrpHO&YUMUBOD+JhLlcN=ppOe15 zG-V3rRA^;uS(-Y9p1V?VN?1tdai8BDe7ss|q0W1&V5HI8axRL8dT-|pMqs`d*(w%T zem}ncUe*1parP&53$CkONKQxE7M(6~LfQ7h8V-Vie&~UyiRS?ME_zN{<%;NsB0}zd z7}A0MP#{)0u?McKQ~x=B`yGn3xzYh4S^`%Vh3OPswB!PMKZ$LM@jBzdsPf%9DZ%=Y z;p=^?7<*K1tOBj%*oD2TW{W_+^KCg7IV7;qNR`a^aV=^wZ7yjrqHlM82sGiXnPM1f z528@cZYesYLXC)|hQKUa*Z0@;^>abL*fW}Y?BXR)boPe)zu_r^3g{)D?zQ{+UMHti zhzm|5HsV<9+GOs5Uf1ak`y?<5Q~eMX{&Nxk$@BhQ(>NB9};{1dU#Krp#eL z^Ul)dc>LEZ*EX(rrx9vCpezI(0a>jSnnmV*n;^zJG+l4vH47amI)WB)SB0?J(QYQl z;En*2`a08Fa9=7O%UvQ%tmY)wEuwZmy1M$@E`=X9soCO+F$2WVeNK!;Qk_~GOP06W ziZd#3q$;^^@e4?-ma9=Ig0)Ll(e~y?Pw(gz*K=>^C~C5N3=f}gpt=IOK2nz`t@56* z)jqXfNN~b+p?T4Mob&S=qeoFtd#8cMx>jk*T-_SWVg^E>8uIVdYS{nLNB5L-((-;fqm5fxSA6va5%(7yC6DLt=JZpNEX5{6;`!wdI! z5^6uOcrI~RZWiE>h5{^&gHEqf0sMV(;g_k&lB11R7CGD?vs5S8__pqTv?rjru~r!z?FdG{nVDr<}JE0mps z)d$-55d}t?xe)*_T|74E@BO-R>ToxCuhkVaH}kBM1a! ze+B}m!GmB>og2QbHq!)LtPj1ce(NcU z9TW__p6G9tq2hQZyH-&}!X4)OO_YAB<)a4frorrN8FRAE$3QDJ^+a4YTMJ}Q`=j+J z!=_E04K>!!bG|zqmP-ZN?ORhE=N(NfbkpGj&XzK|4kMr0)E39s)H-^OS?n&K!F)UA zW9nI!a;y+{O(4_pZIsX!$m0%1cj4}`-s0oV=6+8+W?p2$8Rls$`dUzw&I~*+io-9w zV0e6~BmUD(TTZpan}xAGt*2FaufDU%_%kGe29J1KZ8$MjNv@N5Yz^PT~f8Ra+}fMK9wtVBC1OaDKdy$L*&Ya2ga zX{8TNin7*e(PF4<$yO;smJ)>|WQ-Y0S+nN|m2fHsW6w@x7n7w0F^0il>}~cf`_Aur zhEnIe@B9D%exLJx&g+=RJ@-7%{k^`|^}W9LJt6e6r^E{~kM=v?9O;tQ!=ex6`U6dq zc(5<6x*gZR@h`lsy##3|dRM>IPB`?$Q+9YLGytk~J>>9HW4Xz*bQ=(TEpBMPuvcbl zVG-k`r4O`FB`?CJ=zksJ@-L`^&tqUlVF$b$m_W!FcrOrEph~nKV#vuw#=QmK)0awT z6tS=~&U*_o;2XGpS4-#Y>pz#M^YL?nqKTYu^rN6dHc|bDM>-aj|HPW?*c?+ zOt06GT*(lc)y)}@Taf;F;}?cn-@*&4g&>@n^xl4P<)I=&z%D7N4Ws)KRw%jQyK{c% z^b%EgB^;Y=1P=F&df7vNv+k{wr&#BnL9iP3H#J>6?gMSrFqFFMm8Cu1kxR3rV5j2A zKPoAU?}Od>y$=&3+CBOtTK)T6Tpx}PR^R;S_thh~CQP>b~&|2lEe`+In~;@f2IN}@ZPrVM4QCuB7uj!1jt8wQ=Q zuHZH{jed|(a9JtKXLr$7m3L{!Q9&mH<93wQ9gtLvdyqjDa$<|Gue}^H5829!D?P}{bKquSz{2Enw|2^hqkq#e_xH1d0oH-z!N=^j2}=uum;627+b6D0 zJB3B0l^n{GBKDf(7VqEATYFFM!}}708%IuS41b)q(^zWPSY{qitFSlNTs@_cE9Jt3 z?$KZfVDWQfwH^^4DRoX5)2mF$X*!{-_3nUH0;S;+K7}dx8Tm5UyQ8)gYH>_2z7jy1Wdr|ae2|U8p9IVWXV1{|a-+)@VDfEj(H@@&V zkLx6+DM2f^Jf2V14*w8wBpknZr+4d zLDJ0}KckR5x&d8tX4Q3r6mnmAk}Qz@-7EidAKnMgX@wUmz3gfP)p17= zpdiP4h5o0zw37L8j$HihCb7UxfaL+F96*lMdVeEB8xp-}sWG4O<9v(#eK|s<2J#kPsyCyBVE9fHB#|DSXzxIe!H));oKo_pNOYL>JKgWxXK2lY(eYpW;HJV zb{svQvA&A(ZL6`3v)bR~Q%}71%y^%z(l46f2+o=`IsB>>7rZI7H27dx@*Z@>lfN_y z(>xyyCe@;9*~b2SV5y{xJ3BMm+gBLZ<b&>?>~r z<<6UhsZAbNcf1!!kUtV)fES4VbRww<*){PN&}Ci-s6`&&hj{oCsv(|rx@wg*`&DW}22 z3RW8*e_hj2IQ$wdG6(x@MS1LgKY<4-9c|A7?oF!}TL|}fM)TQ^H{hX)EV%e|rIIc$ zuGj@v)UTaEXPmDp>a)Oion&{(rRUCbAWpy4cHml(^xup*bs=k4_YDIpwJ(~Ik+t%v z6OjTn=quP4{6(;T=(Betl3#uv(S>+l__b+#Z5}1@02@FO0w;<}`?kIc1O&J00R&*Eq8=vZc zR$HRo$}yO$df$mvfxVd`)^WkKmcFtXV73R6vm1>$@w>MKltIc9WoZ2Z*W9E;8 zk@N}DL9V3G4x`_Cl@TOz--0ak+;Qa=I#3c zS*PKe6KXe|xyO?iAD=YI3RWt3VtS{g>G2-)TLdY7wg=kJy_YjRfN861EqeQBolEcR z7rcDd6Bpf+Hz40n9-_mzF?=1*y=Nq(Hi2Z{(fO9-?K{p7;6#d*2G!znvlDDTs2-P@h8?@r z3D)5s8aEiO+m0^XzFBhH{U}U@-&gA}>n>Ubo5Z8%$B5zFihkiARMW0MJ*d4y(fq(B z3mSUMnae&r%9$@4p1t-s@X#FJ(K&wR(qEnPDVIgPJ(`n8@?H5N5|R@N28R3kUFRe6 zj_PPeU%uwrrrUNFen?^TZMllcPCgf-wTm++h4OdIi*qqzyEs#mDT$h%^5#cHkjvpJ z$4w2G%zC)g&f|r1_CXrOR`!b37S{XgHtt=we(RZa8wTV{HpkH@Ci7Q4<@LBlG|d#_ z&%J-ry)uB2T+>j)N3VUzrMIlN-jWmdmYil>zjb2gdaio~gSRaXTg&l_JLVo1+X;?; z8di-buvr@!mHq}4qm5?jj~Pq74CO+&T8tFV+HoK+hy@g{yt8V_<_Ma4bpWw%+4u?l zvZh5!4bP81U+11Ghs;gg3>m(_mRVhD2QoI-xpiCx`-1b?ww{T~+eRy4<3irUD!%Qn zC)vW|?5zt|R9&O_i5N_FS6)v+bm3y|hYqa9@ibqj|Vua8H+a-~@< z^N%!1eWx)H=7pqg?U59ZZkCiVY!;PGY`&XOEahU&Kv?QCAX7X~kZ8>w1O_#}hD%`* zW_u)LqnmBS^G8`eeQ#35*vSYdHjl;?;ypB`P5r_p<0QU+yiD@YhYeA(k&8k2{5WMo zWNeS9cpalM3T4XaOE_e!>CJRRyJ{DE-Yw-yI5OV3xkurVszGew+(EKx!SiqPX7g;R zL-%uNl!ZMnJbpgxhC}KLZ?JqUT?~F+ z)>VX*|8-hOom8H}c$&$)fD_tFluPz->nEp)0k3NR?cbWE#S{BNJ5!sbi_1@* zl1RR0ZA=LD8R$H3xpnrDb%|;Q8_nFk2)SU{q8)P=8 z+tZiHea0?Jcs#w*8%pnf!UhGL94I(phRJ92%~@UENfZpM>C~elSdHk~WLVQ43emcs zhhf34{Z2;{LybQdqX}sE=jF&t#~#W)_kh=PxW08Ry-YuAhUvTOANUIlbO~qf2J6hN zr~O2gEi!}EApun?p7Nndl;gkP41SYxRHQ%k_$A$@^81YN*3kY^=F7Zy2N@R*UV(4Z zi^^04LqY(>K@O}^4WmpyT&TIna6 z)lnNt4UW>sDfQACI91+(0QE3n2i5al2e9~fTHeR?|WPSzz;Zb(cfCf zaj(h29}$N&k=^~v@m+M(8p@^Eh8bBRu_%D8#0x)efP&dwSX~KM`U*01Qj(7FJcz%p zJCI$O71l!Vw0l2hSny)DE;K=O#BE^_Un|?3AmPv*+f8YX!M_!bA$)GWOOn=LAQa`l z9UCO@P$$$_a9)B>wB>93ab-2Cn6he>>+s*W#s*0XPhXZxzB&OWR5@WI!u#=Q?cq?z zGuEG;#t`OZ94f~~1YOQsk2YH4IqFkjA)nPyV^qu1Y7%Jbe@0c(yMp6ao_&?glt#gS zdo}(>xwLUOHKYZvg$+vh%3$ks#xu8G)mU-qurdqo<%6FXWTka%)S7wFqKZ9fUqAbX;wzj*`~|WV(KJK0 zUp^(tG%nsaKPNWh53TIhdC}?^Z)8&L78}!}+qY)G8cXC|KmT!ox#h|sy}Sfi+Rju5 zT{oRdP0Y*xhO6Horx%*PmbJS23cb z{jzqf&?{i(>JxgbKp1x1`uo+v3pK-Z_PqZ`i5Dj;0?I90R|zd?1>TzZRXLrz>Da^b z=4x-FGchuWWYwrsmym%nAP6M$&C+BMfVH~3os?c*B19A>Z+*4G*U$d7|BW;wN*FeeY>B< z5qYw&SuG{!1vZE85?tiMnQtNH+M(MqL%ieO8rOO98pr3@ajiG97w9)@1({bv&U|Jw zSPCJs_3#8{Gs$)}G3xb=n-e33Z%Z@?h}UV78vvG7O#V8qpN*!`4&C2`F3Q(1>rUO^ zr4GJ+-C8Fr{j&LsQ2}x3JM8*Lc?j<(NM`~4=bt5gZ$rRYY&>aFS?GAMy@H(mGQ;hd zf8)(pWVEgkE+$nRNBF{ceFObjG#t9mm^w91>NvY@!?8aOWA8TzYMZ7kXol z-qFfq#PF6QEz{oa75WzT6-e)ANuO(Y8y4!D-J&Jzja$Z)3X-)|d3++1M2VFqN_IT8 zn4!(Hxb#3ye4LGP7Olua@kp9j@)2k0fO$EWZ3^Zr2{ZSGE);}aaTuJ+UBnEPJY(o} z{7ikvXl7kI#_%(8>{U13;OS2s(s^dnBC0}c&lWj7^o*)O{2MK8ik%GTLKh@E2p7JT zSbna6;+yFm6;SJ3USBaI9D{fFc~2;sbyZ%TNJo2=V?tf+_Y1S(-}bq1da_M+H18vQ z9DImg_FTlrB=}=hr59w#J#J&cUGO>bL-3+GTCIjgv0D30&CIiX7ZNIk?57y%kx}bU zc%F|KN$^atY;*)2>C$KmcGwAsfn&6eid13Z`7@$7-_A+>Pr2e6r@3ITQ?D=_$X%kW z=zAde58LjeF%*&&Rl8F!B@XyL z1=2Lf#gL6LZGZ70E1b0#1&g!8v8Y*h>zPkt?k_f92M+Wr^$k&Y>($LBXB3gBvc1#` zee&MWdouu=h&}Nb&*p#TE!`W_3y$t(UAON3I>qy6uL8u#ULiD!`O@R=&-4PTBpFa~ z&G(5uLTb|PFVYaE-B=14>ZC|M-1;WLQ`d4ft!9KY^ct-uO07VgKxR%|z(w$^WJ>@` z(Y@IKHWt>y{gseedR}eYjg*2%9UPi0S1LwjmeyZ#t3b#`S2!$CmXhIt-2O_4I;7ro zX2@<1tcC1XM z>q=X2GesvM&NSA~IHR80)-NIeJZLF~7s=9hs~)T2ofRi6>hEqEB%U(c6VBDJJ&cd~ zyc0D*;SW4JpPpDM<9trzXq*;&s4oE@@Y$$pmuSr(;Z(}?AVsw15tiQQ|Ci<>q z2W?8crB=wKPclnRcr4CjqNV)J4i~s+9c54f4$DCGBfyDS)+XG$LGbH zgX&&%$rtEEXeFDTPC_!jxR4ftBNm6(Xno-{Zij9C>Zrsn`DA9&p9x|V`l#~gslfel zYo#KRrN8SbwL>YM4nL?u)W{OKBCVXz{&%m**SvmtEVkdY!YajD(^|UlW&ZcC<*4F` z^71UH*%BeeLlG?|dm^}MA@@$-e#sY``}K?^%HP3e?!GYwdn4w~iw;R)!#yGG3C(T> z#a+F9F$4{kVzu$vNGWvwvotLG6_t8SE^3M|GTgCl=HZbtr%8Ogju0H6LQ$U%4#rrX!(@VBCE4OqV*WTl=%s<%s?UVF%zKa>>P+96{I4+uM21IEk^ zP(~lkM~S(`Gzx3n8g>zdMSnV&(RXTSw|XI?7%ZR4wdJ$UT@(s6L%FQ{=#`m3S?DVy z;mSjwe=a8^dszZyKy zN2-AILO^cb^msW^6Lf4_0ZN?{ie9cFi1OKdHR#s=(?Hn=k8mAs*|fVU+xX)?)~-$nPzQ-=TRG>3_3dob$`63 zb{*J|I_T_7vAQ!H+iiYB+~(Y?3)rI>_d2c-EqWuGT~($Byi|Q#;uKSP2;5{V12atO zo+eyO3p0DGds2o}jNKm`xcLMH(Ok*e;YgXpJuYUK#`6Rh9(QTHl8&8Koh#~AD!}F! zWyd~B!RXWhZRscxbdPBFA5qkqt+~>J2O3M$zQlw_V=;ra?Mmj#v$k@$B=ZwQ(^S2= zJertBCN26M%l_uG$J%AQU}ay&h5F!Ef-ju}+$Z;|FHG1r1=%=!UvkK3*RIR1I~NhB zRau{umnovlqe5)R=xvF&M4?c2Y1p)cAW`7D*IhwNGw1RAd@~0t-ttdt%bO^OIH9)) zhfB$w}Uw39}1oMVO4UU664m z<+QMKvE^_oYB--2;Y6v7ZZ6FGz``WUqiB)jSvVb*UJh%>5f*M5zg{j#d}b;e^x#~2 zNN|P~gm-bGZ9r?ejgE{yRPD<^FKf8<<%^dkV3&A1BnEMry&ZX z_+c~kpSi0!B04_)DQW`EqTsDsx-MueHn?6d@zPqBFk#t8X@yd?aB(4Pnzi@G^nk1) zd6S{0YJ3!ZxpnzFy}m*UGBlmmR*SAo#Jj=`B%k=Xl*M#N%a^RHdC!67cuUS{e%54UA0>2SfuArv4TNdP zY74^mWRdfjra0+HM~J_TXM^6BXk78xpe_9^4D_o39QI5lzlt<|C<6Grb=8458urClP%0+b^-`Znoy=9r{MQWjgpG zcqED^jJxJ}r_txn&8Hge5@^h-jCd0aR$bW2;8acT$4w;KM^DK;(y})rGLqy7?P@Hh zb}~6lnI_otSx$~0$0EjwBE)WQk@BLkDC3!!X;asM!4a&?@)vEAe(VVDrgD?051bp) zbu>c{r+sC=amF?GRNvf%%%EAf;~!Yl0to~(R_An5YR2VGZ1Iy!g}kZUnRNx+sXoQ( zMX{vr>#%NDOS+?~XJi?dvZqLyt=>n<4N`o}uaVRjKBOp{ZJiZsQ9TwItNA+3L>h&$ zxyWU^A9YF0M-<-%OP?GuEN?`sNna#S-5_D0X`*H*XL}6`w(L;3fOq7n7ZS4{kB}4G zX8!K#vbkU_j55WBdzCIF2VqH^JS;_;LZU&UrPs{6f_C~Dk*QB_%h^ctF1{?lU(r6D zq;>H|Z2SQg;scdg_ZIsEn!Ss>Pw_iY!K3N`34yMT%@QCl9^9~LPYd*wg=`k{D=))Q z!;w?Rkh%|%#kU1#kYlAgRM@M>e6iRFaAZG zW{E7%&8asq8PPy~xj|+^*`8m6kt=EHTh6n9{@@E~5w_;=JX8ZV2k$dB00!v-31D# zu~f96=F2ONk+g;M#;z)hl#UxgPDY|XvUXP5Fx+UMWByO?ZdaQ3NRs%D13vr9&CL?o zqJb-qB1-Bge{efwPLJuAnt^URG%p0-dm?o;bK}oQa5eb83#Y)+crfbj&fEf;Rs0QT ze3VWg5mo1u-`)5d3g?g;8VWbGrAEkU%lfS^>4h~yzA&6wFJrk9J7@wcC53zcj&wDT z3!$dUVGmLTbLoL<;?aKZgZz9FakCRFe3@^;(l8eB2USw*)3Z;TldqU-*DI+oiDlp6 ze(!a9ha)VZ7MN~>t823)ETK&s^vrw5hJ51NDhvxQe{3kV;aBeSif>QSUbr$Lu2Clt ze>*AeKz>J&aY*rrSF=MV%NgjwiF9Kdkaa{Pl8?xStL|z9`c?dU@cipiyW3XBNuIB@ z65|JK<-XQM+n=;@Z9C~`P>crMk{prsJ_5e~`T#?g5&o@@5uqq#AGsvxkU;TVuWWV2apLlFOI6d`m8TD+0W`0KCVtZwGnd=L1M# zMwl0XrP}Sq&cY+`i@-yR-}qQ-FGpne*-osmt$}Wd7a+cM_A(TTRF+RPb$&WB!T=dx z)Q%GY89U+QXG9~P6zN!eiS~ed@{=Z81McTnLBw(-v?U^CXRE1IOhf%Qd0&`7Km42v zKc^&A_!5M>S_ai51)E#aG-Ut(%^c1lp}eK{AXiant`vpYgv5vH01{Z5H(Uv#-Icpm zs2S8*(kPG9P3NMuV4ChR%uiw#w{Z2J?*$yDZ?UEv-pjt}!g|o%fd!=Kw%S)Xi2{LY1gvUNa88643PJW8g1{K^>}ewv_~7ilM%iV}Nlo_E?fDIwnY z2rBTr!UxL+0D_Sbc6p*>;;j9CQB+f%E%{iVCOPP)jJd?ue;gqJetgpM@6XK_Bu z#IEFviQiDhfERPsNEV>2Zh}0Gv(szCjpj!`H!^Zymc4u4y8rXEDev6d{rGEjyU2#g zri3AU>C#r5GKuh|)CuQn?CZ-KlXD`m9Ug|RD}%06Q{FN&?|uKj7I#xG4b{yU2;J;) zxUxT0a1T`#%l^fCc;VvkJDUBS)*_S95_nX$h>pacZpIF}V8O;gHtTFLziju&-!vnr zj2tcZ2LZgru0hT@oJAuH3M4{5K18t83wo6;nwXE5Z6ixhbFnSjTz$;gUQm9Och4HV z^luy!qFA~W79HKiDP9eQ=%Mw1UY+a#f80Y&(q*nvd=iwNK+LGi(HWJSOOgI(i&w+& z)AVTFnpDD~=xs5LoVx*-Wy-y({T6b|MuzZXA&;@9l7e)y2LWk`R z$5vW8BUiywLo1D8CNAuM=V5j(M-FC9vkgCa?93;@KMuRb`5|!TX$#2cm+wd#5)!j1 zH1Be>ls*5V{X#rD6Ygu7jBVZWkr*38%q6Z#w+%-GwA(*Wf-e%JZ=3b%IhGp{A!3s5jmoYH7ikGubida+%LEnwd8Z*%zK2U4Ki?K^6ohM0RfnbetHCAbvQ{i+^%AXl^6E{c+K8db>TIYu9S@$8H+fmFMr%Aa4#O&zWFzo=Ip z;>qFi`SFq2&3!)ve7Gmc=c6!k1IYYEm8Bb$UNDr|Yvr9*QQ0plTF{@W(8qZrQ>Jo);kG(z7SS`t1QUx%UH#zsi z<__RGyMoe)XPUWFGegRMrI`nIP-z?>sfI(ttw`8nfgPlj)U7m=Kj)>8<{kStL`tG( z&srD< z7G=LRnBgHi7dE*<=lQEDM!i7$HiCE=J;nC%_9R;H<+W@!4+8hh_@R#x&{?sBk3JRz zweG~aAF>izh`~s~llK&Jrq3_qZVP58@$%X(wrGkHv%ztabEJ+U4Da^<)bJnxaYWBQmYudcf?k+eW&4d>p=tv*Ou&t=*Ewn_gvUR6y+A`J*Sbb;1V;f>Y~l zqO&lw195z~rB-VWFkF&ET$-$i49+yr66i#;;$oL z%}3p?>W7=E+OBIyX2#5Q+XtC^ulpN4LcK|zp}y{-eJdnn)C}hh&d~_@2eG_7VwaDQRncBiBbfX43SBfYY1z3D=$x&VL98p@%f=@UT6MPyUc7|#d_02zG;pr zx%&D_<|JHSLHDf9h4K7j2`Fz_+v4tC&n=>hJ>@8uplMUPDi$5bHm|7~e_h5VMxHha zH-4zo1w5?hMU0-aLH}i>LFzkYUNmxkm;+@Qiz6(IWaYox{R;oA8-2`_G3LXRmEQA6 zsotqn-K5JyGlF?n>S!FsrMdSfrf9k`y1E$_39%Ul4jCwyrlY(xB1+MYB`y@Pg#22a zecCuUuA1j>lMh?Nt+t2KJ0#3EGNMC|-B@jPth6xKygqb~&hNVHKbw%NxLb7(eCd=D zqxzql__-|CZ3tC}n%N~GM!otRph`BD#}#RSER`#!)B4wMOb^7n_Qr_G2uZGQbQ#Do z32zx}72XwjtnnD9x?Unw0P~q?G<*?mC(B?veuf8c5dnUjGnf)^sw&42BO` zik%P%GaeyAEHvJyBMfcIK8O=y(?8Ccfp{p^SWX-+^Ub>e|ei zhm3^-GFH~&4;umbm21BwgZoY3 z>Y-ATa2KyLH2`?4cFIB>ay=x`m!o_99{);m2Y--UGW0rI_?6(|FIDSx|6&}9n^u|H zwILA3O8r(}sS4$+#QJgGQd7g+1IrJZEW}ZEfgc=oj@DS|)KTl6b$2x?gVO*!}x{IXv%c^ffPvxrcanZD9 zQ7#Tfa_0CK3$mZ`bU?y#9UvLd`2iY=Y$kpt4&OdJk}4jX)vtB_LUc=Z*jH$nPp~kx zh$ob#?QkTTze&=@3Smzt87PK(#pm96|E%S1-#*2J@XVQA=LavC@waDOyOT|Fz#h>y zW18LP0Uf3vMM%__jf5eu_>QF1lcY&iypGNd%}VdTM{cG1USTqCS7mPN%@(x_srh1i zX6RgWBfF*L{s*Ph>^FoooNK_%2Ir}qdOSm9k-qi4v9si12s+_G<)R~nr!dXJ!pY6| zpZ0ZkTzKoHI#FW+?z@EM6S6P+LisYbSAo4rkUN`O+U3UhCzFm>vu*apn0y#?Vnn!~ zYD=|`c`kw;dy!*l!D!+*6syBKe=Ikr7Qa@iq_vJXGPJtx{a8GddHL>B8fVbAX|#RO zyAazUse)1_pY9RmQa5YU)H~b0etFwhy<L2cwo5ru6}!O~;Zt$hdJ>23jcXCY9`v@S_ygae>QV;ZpuA zB&+;{e|UHhm5BtRmJZ_YSrwK;;Tne*a5=`-5JN@uEi-7P`Zg{x*^zj15J%6?k1(LP z4p{Y3el*v2w}Mb74!A32UUTOwsBc=W#a*!7?Hw|ZHx@)#J~!jqpow7QOID=}U_>4< zSb&trPXbe*7?t@s^h8%jjY@!Aai!K3zouzXQfMS6p^?UPi)+`b(KoM4^=oQ~Wg%8h z{VMoy&yq$Mvz<`Gczz|4kK|gWMX7{w8Kc(^mV)H5y}%X3ywK5JiTq+(}dX+Y=3_SMlPavPwcYnfaElc#lY# zXbH#9XH}MGw<&ja-6i|Y8i0u+5pBICmFvz(drg3(cnAN98!qGf@$R#C$wd|K5eo&5 zccJPR3U|a}uSh!#hK7Zv##R*5@}X$)HTS-Fb4n*r| zQ~aS8sMK-hteobL7=1N2?c%f&na?nIrMr86K@T(31bK_(#+#!M)Bt9Q6_?F0ft}sW z;#*&yhdO-6E~^v6N3etQu*HDqY8p_G zEUsj+-Mt@P*BX&9_J?aXte}q&DZl|kp|}rgubQVIP&htB>d|D7yc~5ytMkS`tv0N( zy*s*_HUBvuBsIv0o}IPIh~6bxl_mLe8Q;=e!7*le;eosmC#NVF*H=Rvx1}W-taJpEY_Xix1o-T~)^KNV&(9c;i)F@z1Uhdlc%k>T z*WJ*5W0>Cz0$V&Gepe7rrG{mD9koACWT-LoU=9~S)u{PP6C+u{cm63V@$5LY_+j6ab7umnwhfq_rl-Tt>!4Eeqy&Q%9H2C0x zv_91(>pgy{?*zFu~g7HSO|8&ID6w`BxkmDvkD$xV@0?Y3=Ty|Y1VLiFhlbD3ck zJBE4Z#wTjjW)?9UAOCH?()GW*NPs4!5A%4%x=v^DTZ>z1e;?Q3Vqjn0oU#Ub+uBWO zN}grDzn98ls^y4=HfR2^@LkZ^c9&1=%Ykiz-8^tgbH`t_lTd440Q$@O$oBRtyjaq+Pc<9Wu=*I5Q8!i@jV^w(K+N*HUfI{0Lu#` zp@#->SmZV?Ld$7so2<^n*KW`pX@|_ciRXkptY0&k^;~m?atR8PxAS$~Xt`wyE6KF@ z@~Nu*KS&vBii;&)4*;#bgXs~6#QR14PUkJXqT2}7CGVy|b|XG2{g?<-67zyx0!F8- z5l>|Nj`V0DK&fKF^GDjh}_;N7m2_9hcpce_m_Ze;fgyIK^k#BOH-RDSO zf?Pk!zChj3%{`+B#F84yc2f@h1PnWrxx4!p$O`<)S zC9vG0cyjrXt*`%`-UYC?J}(zx>*+9o!*0%HnOGI0o4}z|(xf2jR8({=%Vf(!B-a;4`ipXdKJx6SF;x5>o-e0uI)shD*27ET4wW^{ z@98Tfyv=uE4?UJ&cDbi<*|xP)x*opnIpi+6I{>=U}>VQ&l3m_uYf8Pa5Trw~R6n z6mHJE=z3K@4jT#-vnbk`v`**L!r1%<=lU0Je_s~YA$d|KJ&lC+=uK+rfojc_Y93v0 z3fi_;Ty3H$*4Nml-Lv^@lWl~fN633g}iK1g*d5%L&5V(d+CLpUcQsk1n0cFReq{aW~s z&z}Mx)bA)=6`RNw_!P=@Twdqg`&?0(b1N138j%0v?wi%DeueXWk)1L*zWFZznJ8Yd zRogS2X3||ZTJ32$9<*l&JJOQ-H;HmujQX--Nb4$win|;=N`!Gl$8Z00V!xArmIsd8 z)?!gV?;q0mnmr5>kk!wE__$y+v&6zQCX1RIhIYP}h@)z{^JyfO_i&XRQ2JGPZ|Fc> zgx;(f7&Us)vJ7pq5O~%D8P1v^Eh-WE-hq)z+kG7mI$@Z`-S!+_5^{lx;QGMww-Dd@ zv7o`BeIbj_p)D-_siZ=0)t~_PeG=#&6|$Q%g%KiAaxc;)Z-qjFyuDdKBT>tBq13QjGr+hpth-af=yFh0suPy|Z+>J0<{5{TltPok| zc6@ALv<6y7#^RLNB&2$9%lXM9=42 z^g0&3$}-<-wgtL_L*E5Pcf)EF-SJWO_z7|N3;L(F@%7eRwaX#I@zV2$pl&D!aX0>) zgvRjDK-cYSR7JZ(`tVKF9iFp#TPF@7J{p;kLD7wlg!_6k(mM0^8~n@x6xjl68zy_|VT%1+%H)17F1d-y)OhnkLVYAYI>Q1dqxySF`e)Lz`i z;N8iEsuN`Qq%A0;EPhd9wZCbHi>tqJPa7{e&BsZEm|&+XF9cR?*<7`8H`zrJUTvYF zT*NJZ0Y&n)0Y0`BDJ40w3w|&S+BDQ+N3=-P@2yXp*S^=#CG>8AZ?^@D!=;-o&^ctW zmpBNPEIW>=7x8P_Fe~lihVXZ4g%b&yGZ~CC9(gQoo;5+Kakulw`a=mpX>a25J6@ZD zrtYgZGcI3XoR3cn>@Ld*=yEJb$`520@PPmmfF*RjreY!-3j%xOrP~#S+mHHpoa)yp zKx<#R23rbo_@+80LQg%5NaVfG#oB(d&X=qQD`E)ypDPF~s*N-}(QC8Z6UIqCDUmyB z)ZqI@K~lqFnfd_2+Us~rJCT|@oo0BwtoMX3MVF+kuUdZ@)gZ{ajP4_e*Xx_6#ikIT zHAfogV=>Dx(02}ZNa1u zUM;KY1ZakI=|W}yF;x#l$dIa)gis;~0Sq@Zg}e&R)cTYvx{ZfJer!iBLgcYA29m(L~YaL+#Ya2ZQT(?2j z2Wo*kjctP>`A9b+tv!{V&LEqBb2{c7L|AEe5Vwv(H4k(aLRD6T59E?i7dTh)=Laj{ zp$8k2N&f^kLS6FiP?ka1oXxIK_L5E^@Hw%*B_Bh%p}JJE>_n z^x@NOe6+B)sF5(gly!Oe0iw`g{hMjCV&f*y_2lnB@yipgB$`nS;kiGE2j6OBZ_j2` zN1CQ3;35|M@AQ>rmI>|Py!N$MBrA3-#h9&}?h(_+K^#d5u}3=gx~WW0op@Tf zR%z(^pFu5aSG#d~@{K1AEhuXkVhtH)_LUECpo0nv%ZvtGeM_j98fkxVh?#)Y` z^$Vw5TE~L=YDCv_6v5geb zcbA;jY@pKFc55Gli?uy;-OTpD&S#0K4=x1R!lgYV>%IZPNE{!gD7?sM_U2qf_m(~) zVIBh1kUx-JTPfh%atj2i&)aR>?YH*FTV__SS{Jl+C6% zA`NR18%l_yre{kYQQqGicwU!DF{^CAE1sI0eMQa)`t2=W+Z{(9Nc{<2I6?4MbQnjO zK?Osb+gSD2`8D%*V_DrAl2&>DKcxip0^|qr|EIrL6CIGNzz(Zs5BUsOya)I~93K3v zmd|Yab}}1JqICVW-TamuykR)9c^I}7ue#6$Vav#>=zyd{|2sCU7VK9&6N|Q72KWd5 zBA^?uR^CUp8l!5t#kJUM`%t+3?fW|6AvXu1?7`^$U_GQdC#hhSwPP* zIv^4G=cdIUF#i!aRyEHQ2pSNRhUDSD=j&Fp79zVZAAzrwNwsILv)OPC7c`zAXeG2j8 zam~?rNdE(N9B0~rf*A1i6qdB?Xje;l?S*6}*mCzeqs_ls=fwys34~sgyVz>1u$a)5 zoZjM2hTGFVXmTH!LSy88Q-3Y2u7!XgCNrg|RcJX|@460EAnqX9r*9J}M#$x?^_Qpf zBJ;eRJt2IZ{Ci$YVI8Ka7UbdCMZ#wjf8DuiUmP@^MF&oQXyN4I;|r_GoL+bxe~Otq ztV93V=e|XJMzb8@eO9?hc@1A4xARO?cODuVgJWcVl--GzP}8?oDMg9eMcPfVT4NuY z?~3X!UCKXJ$m$a`QJD2%>h;XPfZM0fysM!US!%9_))T)c=uHai%&QR3rnLI&nN0MP z#Zj*sJE%95l_5I()tzIbGM-v(FJO`uR_{FK6j`^>W4XjZ@-CYD{LJ}VerMJ~N6>O% zH;dr10?DmlMu8w3wk+hZ)XUP7wXoFH*|gA+#a9bI`Cni9G^U_59xeOYY}VfG&aA5I z2&ou1D;~5Q(mh?YC`r&Sp0OA3=4*c?;kcCEOHEZ6a$n`@Ko##q4s? zl%?qMT*`9Y*i%dAi{nl~%N|`Uf=fNVRc@~*^hJtgmlg1CveVv#<%vPJoP`Q;nN){~ zS$@&_JVEWEmN{#9e#T@HBp(ndeIty;`#rPGlH%}XMY=wX#X%2!rULlmaaglkk*P!% zq81iINYdhkqM)JfT+|rAE70w6^H~TletR7TJf5#W)jX26FfFP0)4;x}Ob#6t`36>6 z|-zp~M2@prlw8>}Zwnj))Nex+iM^ z!WOa2qkpS>;*N?mf@N>YZ^dT_u}bSd1QMh&TV>+pb2i6{O~+_Zc@W_U4aaN8Gyec} zLz(UP-M{D^!K_EoClnzE*PYv4=CNiO)PynxQ3adE`TpvxcHi+ z+#j2IkO_KY2{Igg&Qw2!W86osua)|H(=Y#cZ6#N-pb`bAAuhB5j=M&{9h)e#K5Osl z*x<0$U1Z>MLN;)%7-w^juXQPq(4srzOYq+On^wI)isOQRK?En>GdtEa&Wu+trargr z`VERe{6VsKP_gN(g4(hi*~Ooyemf9fv!rZPeoq}QsYYeEZo8Dz#jIr#9GM{_8oehh zo9V%uaNJ|FudUlJ`D)LZOq?Qv@zbFW!`*1c2{SvfY7G(QfLIYEA^;E%Cs(48Eu;b{tU{ua=M7-kmUCAeK4 zFOeI`Yn%Umg#5II7n-qycS(i*+)dnWGxze^oE8ko8DCjUBxaHp2^wm=O>NT?mr1ne z^CDZ~nK8_Ir@@7@r*0y=-I!ie-b4SnezR!2jOYWc5PW?^{4Sp$l>j0;tg0rU7XIdbXerxG*H+nCcK&9f zJ-#7-yWaJoMMJrN1)sG%hL}Wo?G7XUk6sEeJAF3}oq8!Z9>V;7uT+LY8H2*7jKR5( zW9i!l`fe{YC|i742cVE2QbSU9V~fOXm(6;oWYaU&jvBhf1+)*2TO{j9rJs#}IC9f2 zcm60(R&x|&U(Szn66kw+pn5?fliF1{JmEj>7(jLy{I^u(N1GN&S$+%#7OWXPyf-rl z3u~>I2Jm{Wv_6tr6>XDkX)A}4(Bno49-@nA=Og%By_`ecST`PeyQU@2Q+H19`4%uF zw=u$6AfA0{4%h33-ghbbd?}wEgg{uv@nzq$`I#4jHDJXrOw@66u(w1uD}cYh_1)v* zkxVBLW|e5_OUMB){cIGUL9iZU0wQ=3%lH98eW%+yt1*8ytZI0% ze%5r`{jP}FaDu&lQTdp4J-8x*Sa62~i#s#tE93}onYLtIU7S12pb-;6ieY#bZtW!C z@*MJ&5Jc8^kAKAPhhdhsx@z4S8IkQglT!RDMEiB3!@)v>{AV3iSKP*xB6RvOW}M%~ ztlBemxLOqNre0Qwd0tsR7@K*Z_}oQF{VS&gn+0vn&7DdcbJbtVvH#S!;QsQtJ1*5v z`eA2l3_mA0Guep}G5npu^$R^C&eXAi8fSIuFQ2!Fc*{Cbtv-#)5nK|=MHmvMb;=UT zluw?JFp#kMe82l+vk~4YQX)-al&VNBREx~yetqYhuncI;ZeyUTda@DT_o!j~BBVb{ z*e_sAnWbzmTK6veLH_V2Qpl{A!aU5f4g?)jeZ z)OtT&Zd^fRix77nw~X7eeD_CBjTEKP44%{WSFAr(-6bz2jO1{;4nF9%l%C5IEf$_8 z;>&NkUK%G)1aT6dV6w&Q{_55;smQuPJlHpuTGFpDI)yraOtjL25#=^;8?`YRkuVB- z0;EC0fW#Tm0zy_d^u+5NRY7*3BPy&e9PD5|EaMZy?Y3*)!Gdhe-umT``J+Xp&&lRhh5YTQyKeUy&cfcae+3sPhKP)e5<1Dy?t}obRwAtxJP;X>U3o~WGMN?S z#z#M^XFXD{OFbIguyHSiuG3)|^bm;u2k*o$CBhF}{%)T@&q4boyNc1au%+wpJM6Dy z2HpvslP5&9n*X6?K(OG18Le(SLNp3;8|BN5DkAYVUAQQ9YWl|pBlw_*%KF2u(e2ei z7Qc{-cx|_WWa@RRTNU7^0-Ko-WU4$w!eFT5)$Zya;zRF>GXhGR837fVy0nS~QunmH zu(;855ZMUOI>5Jy=C;-B6f)ZW9%hJ&j6bs;8A|4C7MJUdFYxQttmKT)&vGaYwzlun zxtdkQn3H#zcw24uf}Bw*G?1{ZoXD|A;NYb6OD7Eev2pLGwKS+-K^}JVtZocScUXJj zG2`T2$K4grY~~};X1(2oDb_WtG+ubU^{c~|%b>5|_T3VjkT0-+R)_LBs@47Ah-R&;qdS;wU&5dF;-1wxs zwQman_5l1J(%uCg>iqj3ujr;8wAl!uwvCEm3nRI;DQyW!5tB=VG0Z4L?%5VwLZwE= z{eHjSLN0BK7~_)rxD^@KA;zU~{hjw9?Pouq@8kb?{2!0qN0^!S`#taXd7ale&+|Ob zLlzkJrr{QdW^#Ell*P-h$rSH6yM?lYGI<*M*QXr?#Fnbew2d6mB9HRz|7@CVYNx&u zr9R*M0h6K+=t)5VK7C-%yNT}vK2o2b5nCCa?<6w=s++O$%=($d!4&1?q5)wgrlvHP z`!FwRyRzf8oR!Ikq{C8G;&bi;ugu2^Pf*5vG5cK3b_lZC#BgTO zNPvK(Bab=!PD9VbMtlIgtXEoEtPa49%mvYp*$7B%zU;T|pI8G(;Xwb()#!XnW!54l zQxynV^qaS7H981fNV{|N7A%7G6;y8U6V!^nzHS{54T>VSBlN|Mi;^i$TJ6cA(pP;N z6;Y6aAJbOT@#i@;=agW*`5YS^kGrRQJ1!?hHV_ z=0WMPi`H}|w3L^gyilx{c|l)>xVvR?3@ zb`2A0GxGu@uUu?lH~}lPkkUjlTB_~MQuz86QiFQI<~Iw&f<$mJjk{efY0ch2>9~3T7h%jsfn6d2*k#K`YTU%QVkK|HGc_jXjZOo?pU?Z)=@{F{w9gcD6g?kG= z53vlt3!V9?_D3`ee|~={;8bz^pIxmogP4@QK5bGToi2f%+)-ihtr`zb-8h0$l)t=* z9@9L6DgI(Hxmj8pIx}zsg+v0DR%UmRF`?n{e(EEyhn8J$VIa{3x+yp>3pS4_%HHm9 zau15PDb>swOmPvHk0?&~+0AG?XUyFpD1PMwBIg!q4sB3Uzm(Na^)R(4^+x{P zp0_zLQ`d0<>dLR60Q1Vcej5Ju`hnt7zZ<)aR;3tJwf*Ob!iJ0vIa%utM%OEvqP7c4 z(Y?E&koV*Di)$F^!-}LnQ=wOY z{3tCcQ9yMl=fL9MKTvv|7NNU)mL7mvcIg-3U+Ni4DV}V zm-8aoCU_ggWsM6+3oNwHXfc>(tSW5Km5HN#q7OQoQb>J?I) zMVf2xWUhD3!oh4OW5%O}$ zhafGq8~6YCQYLZrK`DEqSc@Hl%V);q$65;3UC&vTvoiRTr`|tBjl)JU-?$>Df8?yo z1jF$((yMF>4(p}MrH(`J^O85}LLA!Xhivb@tN3gKr_FkowvoiHo21iub$3=fHF) z1Ot{9P}tV_wYXD89?KLk>WFfhGn&Tq+`HvtK3%Isku>^>A#%C)Es;E2<{hOa6LiJf zAj{MEqxi-1IM9OBk=LWrV<%hE%(GK}srxgkQvM0Yp=gwK^4IK}1AATeWt12UEZNz8 zbLW|9JKMMC4_p(|JlrBfchC+bRX6>1QCqV*+Dc%U3f#87x#qSebqZtnJP^+q#HI|T zG$y5~EKY8@fsOc3QxL=+LNcF(3b(Z%Oh1*#_lmy-pcsqbN8Enqz&XFMxA<i79-j{>`X&L%Uqf|V9xYwu#Vjp6Dq5UC zwWiNzBFZxFs6 zT*n(I3pNy}JnDqKr!(}yBkqMaO_vIHyQ#o7{jY>);f&GZb|%Mz9Gk5+cx3-P!1h;AgVyrlL&Y85)u20iJe5rt7= zg&3qGga}4Ey``*wzXxZI zuqr|AR{}Axf)kf6PM<-%t4^O3hx}$wM-Zl**QlNZ$fO+olQGX9QUe-(!{zlFlG-Ii zsR6*1Z*TX+GB=vcO91LY5?9jbhhOhDw+QSAn$Uu3Tppxa%C9aV5II)TZTgncp)22a z%sI@wdyQ2O_p&Mg*#IJKU^;qW*RF`B#lGeRnT2|g@=_1LTK`B@4s#Rob1=reQJ58T zF;|r-HuoW$az(m6x#pSYX7`X-Hfd2Ty|NG&kuydTZaxrFs%ba!ERa~X(qYu5Fq77V z5Y3SUXa+j|q4y9cs$Tq3+;ezaUEcT2^1xyr-Vh z)cn<_{xt}a{&gwub9IJ5QSP-S@pv;xtw_+c$si@sLI;eNIwo)$O7pu&hcyKYV7WJ3 zGj4t-fdqs{MU9P)&`VE6F$;G+BzEWYlaMl%TR;HDePB$|O33MxHj(!Omox>GWbQLy z4aSR;k6k1cJU`;nn>>oQY4Zw^#i#%A#^NfZVJ%2$lE$bpgzM!4Le4leAa87u8xisb zs(^(0DYZAfym@3GAMiLd5CXJkA9nt4-mSq3iB=nI)&J55?~fE@M9x9`;jG@DO8_{q z#Kb}76xk7&(_kqPa{1di*~WhQmLCk6A!GsUfI1f<<%Y-%o2a-jAMRP;^n_2%mZ5#p@u>|tSMc*lO?;e zy4jSt{djv~eK`z)0K&gcyqL46m~h0y?5~UD_spH@TU8YiENGLb?Uvc=AJPG4tdHn6?YK+GpnV)LCBCbwY zUuFcLQpeX(D%O?lxG z^MKH1q9V)8+2P3bk5VuiDC^P@sANb9^ITu`@Ra#-%peeSv*C{dUrv6O_~xacupNNd zL=mczpzs@H$V)6k44FIehl_VP5$vmbuO=H8w9nr#+9KlqYPC3KCHZ*9ZENhDVs(B7;lIhYwbG6Q(SF7#CvEV2V2GH_gEgXT51Nw=&CA|Bp+t=HLQ};2X+_ z^$pS7c7F;#l!gwxQm6 zoJ^LxGk=Fz9kYE3316(AJ=?{_290>-^FQo=#oshW;s=Qqq3p3!IhY(9_p^439o)ny zP^HpvA8{v(mM$fb+7Q(Z+>Nol%3*P_mJ%Yq-Abj$8pY8;C|AksjtF&NfLlugl&8u) zxQqaU2cLSBujz08H*bdKgJzAg`gt2XpTNlR7tky9*R4N`H~dM+#WVkj8TfG+OdQ(X ziI5=fwCx1hnD5Fh8{o$$wE?18AjyHu@ngRr~9@b^%Q_iG7OeRQr{tEXO78 zS)I;$6FdODE0u!z9Q=y#$j`kH|P_dZD%-t9x=jkfylR$%{Tj% ze$hGrRh@nN`twaY9-OZ@|2X78;oteU?>R(|Er$g~SKTkQ_|=8`T<1XL%;J|)myD8G z{W*eFnn169dqa4~$gT5-GEc*!9J%>=ANc&^5Y#MQiiSm!7yze0Y~Z$JHU+m2}-glAgPlZs+@eu4a%w7R2Alb^P%BP5Z!5C=hddCcJc zY1p$65C?Xwq96WtR{6*acj3)GFs1OrS0p4cmy%+gjxAkgG^B9p&o0dvQa;7_$Z*>Q z5)HJAWtMVcoGRxna(34}k*zO(bXQ%epb=#4X~TJ0QEql`enKo+y{JWt$dh<}mJ;(LOd6=+7!T z9VGK|(#eea@UJKeqh-QMBGybz?g*vt?0IcH!VQjjIXM&{3jz5`HaiM z^S&_m1GZ}<3Sx!uo+uXXPk5sj{K!BT1i9@wHzS>2|61utH3kthgcmkWzqW3{aSwZM z)!gRE39%5poY(I>m_;jm10??BaoF2B7uDDJo!g_Y(j0F>^i%?BVk9muGi$7iO<|_} zp7#4-qka}O2VhyFzZDVi%Q6*x-{L_}Kh`zR7Hv1#FUG#Qag60}wR?Cb0m!coRI$n_ zIPxfKe?dUI(dD0Rfo}GC18E@3Hrua&nYOWvHY|7Guk5qN{qT!y_%SI~uf#qH$MdQIG{uzVz6uwV`}ALGVOMzD!iia(U%ro6kS(w56*dOxOH zrcBpvC}i%2s!&$~bI4S`&89DZ?*-uAEzPo%$`f-G6f7`$74NIbv zf`Y_Dk2$KyO26V`KMnChE}P-cJU_s`D+>Ohw<|KftrCI@0Fe3e`frUcKAF7p%@c0& zoE0&~c!2I~*BVO*N^f%rPHl}XuzD%8hnzxIl?KxYGnLjMCpS8nj+z)zsK ziJV(7P>C;^sdZ9?pd!A}98$1zn5uOCTA8^UNy8wQJBhXr zDL8-Md55(u_*sXtEec4l1QYT5R|JHhAmtIA>X=|yXl0vh;4}Sc@)533#3k*XF45R;YVaIuue*Wmtc2I0Wo-z{M z6*yu3Nbo6lfL{o6V&x3@RETCIPf*FTH-_%-Y$d{)6lO>INiIq&o5_L!y-|G1=qT`9 z*-t_{Qb5tMmLh>C>HBTzVCP|MtW!rt?(G2aJx?FhonCOyNs9FID=QMV|o#wIIY1?-e zf&UpS;^noL9|sZ*WOKEA)ud8m@9SMDu1N3SgFo_8de`t{7z{!hc-tn_?Aq5DU?n0< zwUWD!i!iUxIZP5{$fMYD-tk)>MMCd%QDd}y{p4oK`(^_9%i@E0n|w_>#3C zzq8LYu-tsls74x_ifJeqWZTNG7M$N4+@>uPzX2z${ffOfm{&i`yd1kOedOFRy$#vO z-_)fZVRr`EMHT`nr%kZ&*p)rI{_$yu7XSvSQrwdQ(Kl-sFFo=1{2b_&W9!SdZrbE2 z#PYa^V^#cez3TY4N~EVFc>fCT=-=TR2(esuX}``E$1{<#a2S{Vd*-O`X!5xQWn1-J z)~&%gj1_zI3;o#wK_Qa+8usotS#p8wGk36e%O)gmOpH&aSqucBB;$f)JQiZgnszTY zMh>uvD#!9Ergnmh>CpRbDusbV<~4l z9|M(`z;2?Z;8HH_+UYc>BTLP;$HH1(H2rQ~_{KPEmzO?<5KGG%j!7Hz7+12oURL4n zGgCgdDP@CJ=Zrki>sMve4yWIah%*d8)xKl}8c9z4c|~!dMCqWWBf!5rLN;3Ym?15^ zIHE|x1PEt7spWunnm%2b;<8qo;Ru1|$cso~Wv}S@Y*>rZGkl2R@6%((7YuIN$>AJB z>_RWTKNQL{9^j9PL_j<}?Vx|5t9|4i)g zKpK0i;Fb~q+Nc5D-@jnNz@QE64=P+#wf|deAFpKr^Q#d@&TW)p$Hy>d4U7SQgS`9v5vx7%q)lK zH@AWjDg|p*%{CLc#CCZ?nG^eLX8~L(M%`F$MQp&s%7CQ*DdWX)5Lv6N|WUY z(god)Ap>7(>7)?h;ie}_Ic?c??pK;*<>M{gx*L+JqZB~%MqsoTBx+x@Lzg5u$&^?#11y%$*tI=$#1g_3u^o4( zMbuZ?94ra$Bj&qIRWj^){i@;7rURqH-o#m&T-$Ii{1bCCWn6oSWMDCma)Z$V??gHE zW|i*-(89O7Ycs5!8>e*iKio`}#AZJfYIC=*c^R8@{kgg23B9o^k5;CTHluEY*oV(J zI?Cp$@iUaz2X1;3TZ>e;^66{;m+1SSX=~Ou@%!e*M8TBDt(=-nLr;7k_~-e&zo0g@ z9)P~v*-kUL>+*px*^*afs$x-Dr1~`TC)mFOSm?}BRhZBgMdU(EB~PX7^2`SVkU4bv zlwwjA`23UT7ohp|x`tEpmP+STioX|Bzt_N-PStWWFWxk}eg1c9Khi;g-0v`!mdcE< zqw|jG{a`%-B_C5I*s0GEhl_is!UsZpzowyt(zD-bw>RW3CYwfmgL=yIf5@a%^v%Y0 z_wB+3RCzm)whljwvPl(zZRHQ-^CQaR(|d+afI$nnywx+~5yTkn&Jofm3jN=OBJdcn#Zrx5ocC@z| zkz3okg^W8h8mY7Kb2GNbE$b3;pv6#)xH8>b*48yyPA7qx-3ld=j zlOO%p2G)I5+Csq(^#tESq9XITBzH=>)Dp2&8#sNzY(zHAH=2yn1rK$`<@xY|wA{!- z*t)!g!=0DqwKei^MB8J?o-%2qkT||#7>SLn*4mfB`*%pECiFfX=q>sv9{QiGoc4S%iv_e{kT*lE-;gNAUJ)zZgz)3+RcF zbDc($%Nswz+~sXQ7i)0oIfV0rdaS=C6#3<)WjYidO7-)X?7%iVKWeyc72-bXxO-dt z92OjY!IKE3$gCq>_w3(C+xa@zS6`%j;&#;IT&5_J>XlX;i8j~E5}d>!HiDkk4^vy! zEk8XM>3AE1Whl#&?Ag%Gw5QLP?A)XB&esI_d@lz^Mojl`3*#$KN=B(-Prg!29$h`8 z^jUIJY~d>jEC?>>Ek{@^`_g75dy?huyOx>VCj6GO(4nN>D^)DMWcQH2vp|zI#d4#N74oLJ%5WaN~|8;i(+#rvo2!s9X7t z-sXmYBXuyj|JNDSke-|UJh>v0uuDikg4rsXib%My?p0EK;KIPdA+abh7X32;aW;_O zWJZl&peNi_EX!5^4>ZIME?wjP%NwdY?BzG-gtYRs^@x;vle(`>7UJ+tHcPZq=;j_6 zIL&qzYDDWt&&*;Udy2?;6wMTSDjZ%rE}%KxxyFP&L#N=F{w~!wjCa@{VjWYropsEc zEe}Tg&`Yg0{-!E)13wPd0Hie+2%~S+AeFhNQs7<|V1WQLkCA<+C@X}gmSc+`f|1>o zMxdlSMP5{ zP%7-q9-YplolX~UHpX6(l9PUE;q3aGiGy~b!-u_dx$i8%{rEWs|Hi4p6AQ&Lg>zXUK zKe;(4D({+&kddy7>)nM`Le{WA66rW3&A-#)rlrWj9*i<8!UD)uFJBNv_1l3$e4xDa zlI9#{o4Jn+rcCp1Da4nzn`|*xnXA2wRW+{?S7E#(c?PPm$kp#aDd$lV8}V>JPa3n` ztt{OseI8Ga%Z=32xbC;25qC{b+-mX4!=`zZq6@+q+o%=_@^i6ns3HALBvOyAQ?l(-0VBu9iThN)n3(o^w*bCm*y!%O8bBYVx{xm} zQeM$Mau?ucBi^)3g^N01y-QET7Y^H(nGFIHhl(Haj7m~y>Q{O0$&H95dD0pm#gs0q z5Bia8@55BQ+l0SP+MC=ooxLXPlGbBqdo{-ecdcoq;sjaPogpc$oLFX32xWB}R9Re7 z+a=<)6f1sRqD-~5MK1GG;v2Pr=AT+#h|lgm)`F=}vdCRGXSn^{m&?(o3YLq&s#`*> zLR;R18fGtc&#ma#4fb|N1-ssfuyC-wn%&>dN%szI2H{I zceZ>&5dj+B0MUz;fXBV*}naK(tO}$)O>uCBIR3ukY&AP2^!Z1Bi6sY^vsOKuFYj@eOf|GJ4L$Tcm6!cL7$ z!WJH{izh6UI;RW_c}bCUn~so8lCcsJh7HX@L8$6F11r%2gLF|f#ftM1?tJp6%mV!L zUsQ$r!GOu2P0%K=j;%iUA(NwyXi<|lOpjo?7YY_%ZNE2WhMA*E`+=3FfcC#)iMi91 zpQyBO>4XYQs_U_lQvkfY>9DMoYB+z+?(qGTlTEb4MK=_XTRbZIw4))agN@`_c#%BL zEFpOUFBK-6nwdCXv->>BMhsB6UqB1cSmveFH)*1LEw!|huFEXHYyNHEDp4P0Ip&Dc zN6-gD=q9D->4wgDmCwQh-k@v(l8tni;LbMtE2aI}`jYLM!#UhS8O%lf?g^s~8(;9u zidt=kVMRoUKMOwFogHBuzGKTCEH^9zw9}y*yLU|QLDH}0N@wboIuolV2)K!0H4Q@Z zoMzX*8GAXEWipQ^*B(0Trn4M7gf@Fh0O~-G<_)~=dB%s8hf)YUGYQ=$O{OY%W8gp0 zpGqq8aDOvjYZ$}^IN_jT!+ib8nga(LhT*bcG-4;`r$^u8*vK44SOy*Hum)P=5tgLO zs9Ini@=aEs+j^Y_ppI}BYMAcg@;l#|$UwMGd1i}g$DxK`_7Sf#)nyBy`Ftgd1}x2w z*+hMr>&}tHD$U0QVEhl1VWj5&?g2yer*+(O{*5uNEicUmG!nvTnM6xV6<=PCJdAfd zbPI^8%D6Guyr$G z1(eJ8sU2&PnQ3llP8Zj^Drc4y`*V^}`i(JMxWk9c1oL#sZ-& zu-}I$$-5tz>o_tTlP4zoqX;&(h~_$AO|&0(4Yz47jbhfuL^O8I4s@a%YrEqL2cj_2 zf%QU}ce)$WdO1Gx!5yI=`Q?s@0(mTIbM<(k3b8bh8?5jIR6>TPRGh9#YscNA}{LAqAMB zq%T|ih(l&h&l*Y89C9Mhs`#fvFE@TZt@i*@Ze)!WL2|0FIrXZ&-y#}Mho6kAT#>3{ zTm0O^x~(0LIJ)Ocj)y}n=s`JY2PAy8|FtFjU(h4C*aa?bbZ%Jw=^H#da*;ZcOR0qT zKK3Hu%t1=mer3VNS-$=Darn7=(d&KD28w_>1oyZdF!J<^(Z8I4ueOyHT68~0afY*R zp+ne6EzRIi+vZ7FYixoe%r8|sZyaG3a21ekGWckFV=FjWMV9@}cAdMGbTAXqn80|G zL;+lJ2PhTsohB;Gvm302J?)neyB>1>nIiyfxrpUSi(U!{De$sWpMo#tF#3^a=N1Df zZ?1m0c+twgWuwI$&w^#>TY}ylM_dhyLz&-^ztfk^GYtxt-MBslkeiKoK;M3$xWl8u zA{R4qao|eawH9#+Nxd4s=kYIUND)Tv6(<=}J1Jj{F6%2z&jjGMMYPB8k-AO!T%9j7 zQkn{|s%38F&|7c=f&Tbj1!wM7SI4Qwi=b4Rz>pwhSccL%gbapwQ)kyZ<{W&dPP8hp z5Oi>LF5&IBIuxa%<)-rvlO6>x5yR%_tp|cjFpLY5D@g-+_7@qd!_VVL&nuOFY9W(} zx!1_iT9exXhDJd28|0oXXxJb8zbrjj>cbWo*gm?sh>D4Wb9kEod5c=x{YOQQ9N;k zgiF@9HrKdKCuh_P&3KJ$rBv9zor;-eqf7{`6p-c=?*|R2*aKI z>)|7?;>9OsLt206+*(}3o8MY{n=B=*sPq17!}KN9_)5&rqE}vF?k;zr_(EMf(DZa` z-s`%vl_Tnyy0MqI1dHlToOPF_1GHM|$;mTA&95p%#NJft^rW|ilZjRSf$b$W1s(hy zix=WAgjB^(c(wX>PKSjyj49-`eQ>nBEF~=)-ytt$F1PqOmiCZKFso~!OetD!K7h-T z=Yt&iDm~j=ZiOKnuL^+v3#*GcH}N+XgX%n}h z>bW>%<^E@7>YpW2SY#W(I#RU4_gz4Wu&ewUszci9LN>zBiFYPpEmiS>MeVRj{S(~W zXlPo)abPVk4cvWg<>ht`V1^Jx>xJ15@3O+sXFcBwr`9oGOuV7&9@={Y-V z+hV#P+mr?I+yDAvG)tXM(VDPU{Q)zj68i7AR4{Bt6`AHPNwg6{WJ#3S``&#i;K=Cei5eT}_&zBr zikXfSJ)oUxbn>jcd)xe-W>t@xVBz(hIP6?`eq{_r_PuV0*-@o)HvhaT46k`hQOoCi znY!)d{(1We>GfHzt1bexx0%P2#Xrup`@i zlTh~TR&0_$r|a*#52ACsuMO~sbHUY&U?l&6A+vAp%k)Mf&Y*Z@mv*gn7JpcZJUoYWaSML9SJI(XqO>gzCwWzf$!J zNL~5yI$=INuj*~`!owCdl01obW_Z$G)-wOA*pI@lJ&O>k@NxJ(PC zzVUQ8%#%c!NkAEH+apl4bvCOzd<)#SnKa(-P;`RL-b_K$&c=XNhYH3pW1Q;wZ0s@U zPYI?8D`qiy1O52J^$?8hi{muinKUqMN9sdw=c%MFgq3}Qz2w{vHJOhR67UF(XhL> zdZi`_r+4W(#WvaMxZmxh!PAXFbv(-Y-Mx>f#_c5)`KR95UgCeJegD_dndC}`zP_S4 zp2JiV-i#exLcM?T{e8dbJld{|mHX;-g0c`G_~F2P+uD;; zpZ_$+nm3<3shrNIC>PI163*XU%ZYP{Xipms>Bcuc@}2qk=$5afVJVluLXK$_^x9U5 zFfKn4&Uq3bjHzy)eD&^9t24*@KEs^u=M$cWorfrnXBloE{!+5JX=-~`>ZD8(pQ3x@ zb&(4J7FmLL%twNC4*7RZ4Z-}~f@SKa3NzidX+4hC*QA{6o3kf|Ua9sPYmJf}(}Z3r z#STZvrSiQ}vd&sLEF8w)_C#2i5Z;)i<+~JkZY~d)2&Az3S*zvhYDWx#RD3>Xu=zEu zVfq#sZ&awxcqHjjJLRD?<$*O+&%jE=GC(#tGN~CRy6eY1B`ptU^d#RawLAm8ME1%M z1I?9HrXFHS8ZlgO!9urh-OInESqn!lY=ik_SV0JFDmN)D4{P| z{XJgl**f@YM)ntFm*3Fx{NEA^<4%sP*IP}7%4gM^lzU z(v00j(b9%S@_U}Jgi8x6zaxE-8n3OoNW8NZ;_cNESL$5SU{_)3^?*xtKpIQpIo6^c z*q#3GitWhn(1K4|>fkcUGGpukSY)*uvqG;o{AXjIZ8~zqXTq1?C)CSZ54C8$Lbia8 zj_g(Z@;hP#h>_)Kn$6m9DKgcoF0IF@U+SRBxEa#$h8IgdDZuS%?K#yv5 z49@~2O7WKH(Z`S_bzBTb_m-VROADZIK(3%GEm>N{!Vj%$^r5V%i8lrniU6El0MdrT zXL99P6=OWR^@Y`z(+jzoyx{8?R?1A#Iwft{hWP_I%iCxcT-D|m0Q6W(4XiPnS+@ly zjZ}JTRCPG&W;0LP`gU7P4kJ~rx)&i~(%}@S3rDsg6)^ff3pbbN4+IxhTTekv+mZSo8YUiLN!R=*}$&InL0Ik!9zvr?(~DW z(UqOeb(BsIlQ&M=T&;&bm)BmJ*SxGhZ(b!MPrHDU4HIhUTAWT7PaqV^)sHiO^)vWD zb2BPwnu@A-JHz0uUo5170%2U}agxwi9^-xM+2{~{OTM~MZWNQ}wUKJ`EN?XaTFzI{ za^~eQ_{~y1YnLx|Ds8SPiVUvjvKi%SGR}JL2-P~^=!5nxR5Q&OgF4euU2FV&-)=e| zqb*k}Lx0TKGJm_Sf;PdI>q!`IK|2*QJ`!x3W5KZZfk5FVLtZxkBaoCvaYu0q)y3VhePPVs2(Nf*tOjxmNI+f_WrtQ z(}PVH&;5GMU47+dS*65b{xpM&%^DB*=tDpm2cU!&#Hpx+mf#EFZ%K97+juHq=+ZXL zC%7@(N!dHU1}}G<@T0#|l|Lnw&PNJwcyd`?e=Ix5!3G#Ux!dtW<5%eu|GrI%23k=ClR}gSb=z{An82k>JN!Qr1-8xi({d)B^8>& zj_K_D5*cf#JEGiw0 zWj40}RA~N_S`M)=H6BQ?;MHKnXI;lrvx|o^Pe3*&@a|dRnMi0G%nIns+Fg7kLTLh7 zbi(`j`_CbmGx`^4eV|y~gMTX@0kJ9uVGc^6bJNOh-8i+rf~gS?@PLQ#36LVXeX^pE z&r~8zEp2&(p;hTk_#>@rEQSM`z&xW){MNk98)hpt^)MVJICfKVx*1v!(Ve-WYc6Rcu{E{v_{?T$#=Cvs%p&EX%|H!GVf< zk>DOjJW}?BX@YN@GIv&E~ws>y!6WL5d)%1y>RPph2{*Wm3NL9_a#rGrrLSz;iVC>w& zwcUz;cGH}(oR5I1Y^U;6au}aE)q7pbDkQ$j{vwa%Q#g@&VgfXdbT8hl{`lxEjqjCU zL;KV;g$w4yaHXDjC_kwCL00z0`#Zf|m*y=l$W-hKqM{sdy(#p|n8k@HBB~N$==VNi zqnPeOpOnJ#g>}U7g>>9%bcqo7Qjp8y2Rj>Ji7(bC~rkFT`+ZJ1MKJ(EFCjoP}Q5}RG$USQ?&t>J zX3TP4~&CE6L>e3N&48ZsXosfJmZSJe6eAHOZ}tm*td zh>3pnszixFs%>XUQ}RWzRE?1L`EuZw!^<}FSw@iV)vavfK`o?sZTO0Q@E0~!zgjeg6yE;eUWsRuHn5RU|ZMVYGX>NM(t zoFEmh!rtKP{a@HmKYSoa{RIF*NN_j>it?8@7Hn$hI6mZnbziehj;-(H?fmPD015qO zz;cJT?V331Qa|(`y)t=WBC`63TSB}SUAnOG`w7KJGfiHEh^$7a7z}S={r3Ia@jG;L zw+0~6jp_6uc5p&CBk}JK(+Y!*@$f+%slPv<|A~Ox z&ov_);m*))tb>+w2NCbp*;o9h*SbrMRNt|7gRP}74kn!i7>LmVCT?3}-P82I5OVJv zH-M&}!V3b3TSc0L|JzgKSo3}83h#LMPoIFjlw=|oA%QIoEKOksPAmnRtqgMFDg%Tv zU&)V^<`;6%Ly-Q0%b)cI#$K~YiOJ4JylNN=70Bzd#htNh8a5y~)^}OUEkeC`=-oRK zrtHr9sqJ=U8BQmb9@4B&TP4Lmj=xaGcLTq^Z8>{Cz<=OP|Fw|T^qQ!xs2LZUeNFqK zwpyG_+_PlTwF5rbl-p^3+E36cVhPV-d@&Yic-j}u)Y7zCnn%G?9Z@@eHV9+ghaF`` zD7EDkWiG0zSswAVd>d`Wn@8Av!9eZ0@6L%(qoN`V_5=;08D{Ux4`viw{mh%cK^0G3 zxn=R7Th&yXbkMn>cG*SrV?A8dtj-3vBnBa{nhW?rM_J%M`dS;jH zJWWBKAXl>2F3yHas5_7G`BE+JX8lJk%vJ$w9RBXI1Gz46$w`Mur`nF6%Cl0ewjk8s zGe|>arWxlt;2X!~IgPDuqwNRB{xGZRdR-~me7Y<}xxRc+o%EJDcVoIIabeIA%W>NE zBQY>Wk5)x!Y%dYL;23(Kp?%Zna^M6mymbE`VO2f%W_hyzyNlBPlJ3(R)8R1^Iq-f_ zkTfYtZ|ZXDT|li&^sZ#lYCq(_?8^vTU7RmT%<}EkOJoub*pafAh^og2^$0)vbqlP- z-&QtYa_xiOu!egOq8Q9Q&px~7D4+_B-xhvR;Yyliv6w&$5+YSdZX>L-OkrwiyGRN4 zwb5@yd7L+E5vs|mrU%Pa-GI2rtN-QQsJh?%nlNKuM9|WXCGCLGZGdR%N7k6Q?F}=D z4fm}Zcc;zpX#Yy{%-rBH_MEM7G-m7^>%rnV(cq-%r$sY;E?7luS*?x!vl99*h;a2> zh;ot};EDVKRC!Ek>M?d5sPY(u?J77MnX+T(u4f`;J+^@fjoyDO+ulcf85Lruldt z3)@*^KY65$1wBTXGaFU?)U)NB?mvEWG7i1(^zNNHX37#+(`80~6j@)LMM1DSkx@DM ziq_z~pqc+9Iydp^G!NsnGmjDYmk~o|e(&nk9fVb!>r&vVC$%FL!tbKfyacZ^x<6z- z6ow53&kDYgw3eQnv0Y~!<3VuAkZBf>2HoE9-E@HD0vU5Bou(gRGC68b zpFIO*x0l;w*o$5~5M11d2I1q_Aa|`y{q;L-FS)rhc2)GG{R-o!)^yyN8C94}VfHy+ z6Crg{s}8`S={+c;*45~I5#CILD=dMQ4mDyLSWUw_r8DZ;=@TEF;el0g;x(=hzfUe8X>AbY4p zD}+nuYugBqjz|IdZpnvKui%g| zz?LK2a6rK+#mt0IW^V0%HD|Eako+ZBi;}MGMw+WDZL=j03tH9qYZpsbNHrxV-%Jx4 z3aP)^5bUn?PKW!e*I8fR7rlFV&2FkVgqAvm6%N#@llpSFYB{aYE*Y+!gT2b~@i0)+ zyl}WVlSTycbRRj3F`yHm3=wX1ogUWI_g8QY zGVfhEmB>spU1>e(=A^-3OnVQ!oGzkWEsEB=Oy*fQmMYU1-7S{Y)Wg&H;!>JP+4U4_ z!X0jKk?PR%UTV zb5Ew?rZtfhBpuzTmYAx9kP*G4+&Dh`u$+!mwv9J$<2Sf@k|0$~S z&x!){(PTZVxpdZe7c9MkJ!s9Xp7fudc0x=Ckk#zAMH34}c34W?=^4V|yz4Ql0}xov z5b_8Tie2H3h8S+7j#^db8CT(5l)-vsDR&z^v%2ym68b;`LeZl;!7}VrL_k7nAbh{} zA!I%tRU=RU-vp`RMSExjDt3LX$GPs74&Gr^L=pTQ$@Z=vg7YBoKBY>BTGB}Us1^cG zI-kkzU_)jWghsyJ^n?QydaAANrK4iVwaWI{J=oi2IFKC~q>bBKoIKRY%abM<|1#B~yWzF{&?WmOu@Tin)&9RxmF;;T zbbguYx8jiV*)CDGhNyqsa>VbdP(-Pg*O7;9 z885D0H05>h%m4Dc!4>f6!7X${=DgW4(#RY`PMU8Z8(9MmTWq7 zAWc&^aPt;Eip*&*CfDv-H09>X1B_m;+KsY-MSvW}}Df5-{~gTf@v3x(LIMlT?pmtcNTPLn8g9 zsRbY6kqTemAF=;j?aR}PXn!}hWc1>Ldt7XlL=o+$=EAiq=Wuc?2)mF_p@VktBm%oIl=@Oj5IKoN9tWTJ=VYVidu-Ud!OckTD2V{J9_IVqm%d^Plz1JX?1%qY{3!6n5eo6EgKsU^i`rDPafRO1OT?yT}A z@*XD*{1ss!K{$rONhItddf8tzoh!Yv5Izu4%Fv^fInU0C3*TSlCb4lHXdGLq!4p+9 z4>TSKFIBO-GmiH4lMoE!H?pwyMs+?*dL+W9sAQSN=Pw+B4S!_X?^G$`Z^oyrlnl^! z^AioO8!)fiY8%Y~YyEksiL*Rym zT<@J-<@S%%`!@y3tlEYTD4ei9p=)7Nc%7Qmc;ZpXEme)Nqqp1MKYIB@!;j~=$8LJN z)}#v6bxX0Ve#k?0<2lvhx}9U6szf;z+;7-@wHa@49kWq3W4^OkKF7E@pATa}TBmf1 zBAxQ);|ImR>W%^3)%2lyGX{ zs;oEzLZR}&U0Rs z2Jpr_KD2JsU7P=ykWs6%7H@!3+rTppd2!o}l5CUuMOtWdzKQVGn|j{}$+m7`hfbQR7=-?K{x^5ujv69h$*cW2%TYO|7nq{s zBY#swGhJfxKd(9)DF!95;y$z6M-FC+tX@k3xsFHRzWgAmHXfoGrfpkFmFaimGed#}!dza7igVg3=*U zN=gpW4Fb}kbfa`5(jqaWbhmU#TeNhyO1E^wf1d%t=l#C-`~BCf<-$2daiG_-*@k*Kqj*MlRT-bbHI{CtDpQcs(Uya1hCZ zFtY0Ks{R&90qhi)q8A*Wj6UO~8vP@wgY2>M1l>~tgutzGjr#JbvkS%>YWB0U=UPVs z^K^P=0-mWMzFBqA1FS))Ktt+v3ms|a3@QN)tBk8qq;NJ~h?yA$yhL_uZ&pN$0K-P& z*wd)6@&iWM`k)@Gzm@tTJ?LUVPi%f&F{;+p z=2nZiY1~#`pRw9!ev<)MX_@A34(md+c#1hqhH)rehB2w$Jui9Sj6E08q62?VX!F}?YO z350>tiF1TISTihRbxW&py;b_C@7|#)Bd;o#h{D8Zf&Of>Yipo9S9FG3o)$9;^M|O% zoG&8Yfv>bR z>rL~AX}so}#c3*U1Wi+a@*&+LjFaCL(U&!zX4DIOboHN?F~MMBkw0BT+@vuqmp-#I zI0fnld65A9KYXKT_3E4R$v`j%6A>i+z>u=4A)7rws0y_*Iu2BGFxfX7KCa!r4r*%T z!|T~1LqYFlyHGW_04Nm+T$sXq*b0`pICCueCBdRUTT>(i4WLg4K%X;39Q;Lp(wx{s z-FZf&{>miy(*gu)4pQni`oeTBx_s6igarzqfY#R9WEWJDE(9vx0f%!moatYbaS{es zTY_7cqpbhu#B6V0JATSEn*(~&1QEJ%3Viv-V_SGHwnvL>MH7Oiy9P#<*Vz$scD2**RI5dv{nwS0CH4EG#V zsLmFge)HRV%>!nDN$OhPAcQ)RFxq~ZN7%yt7chQ@W=CWx3R%{Kk)G5O-u;f z%mBERf%f~8nl*-?QV>G6WFUBXaf9_sy)lJAVwr{*a2(B7`)N9Ey5|BU9dn!k z)}~3PBFTWDsriPJ{qK1s-JlVSIwy-isCjGiz9}W8`rUhYQ)vXGs3L|QwFRQtsq#Lw z3z~7+nMmV!#%ToTlb#B8L)XdH zgl%s7RSVITqn3OJqN7qL$`kDs(Cyy#@N2|9w>{0av5X+YhKwEMZJ_lubi7lu#@{j? zvpKnKX2Qb4lNSY2nTD8cWOWXS%6hgIxIWy@>Sojg}_THFcqox z&wWJa{8-9O)#Q{joh7+msO4wcPpH2MfHdit?9+x@_46^AogZ5Pi!1vC_O(6hkPTKV z34HrsGH8*7#gNwod5aiudMMuZS4C%@$Lop?ZGYI9twY66jMuQOD{=#CVlVzmpkPIn zq__=aF=L^_Xo*E3(LkaP~$FXI}hExx5U8i{ocqcy3bu797+~FJKor&Uq z`-4zE0(drZF`nbT5T#~+jyqlIntI$@xHEG4CwPLlZ}`O^2| z(Fy4ZYWgM_EFwf7<%>_6Jt98qkVk_iZ>^5o_c?zR5}FERP)BbA#3Sij``)I1 zJW~FcrYS+2m0p=1n~fLe0Ak)!@;O}V!s<>6MJ?CNI4H$j9vQVnhUm>}3+Y7meMo<+ z*JG9m+f^|!8QI7k{?Zy5AumuIybvLgmCcbL4m#$&oi+eV74P)GjpOs{o;&2NX|%C- zmk)%^c9-+)-AJ%-R!Zrx$vt-5&zl+Ad^1Bhf7PG2h)wWM><9O_#e!0#gs#~uwoa; zK$RfByQEd?xgsWt5bzO3X8mk=oNnD)Q#Q>ch8KOMtnWZJWH|*K_Z3iX0?1SDP)jm5 z?PyUlSh(nn@UXcdX_9;~`MB3)-=jjaj&frRMq)N3Njk$9Q$vxZ19lZru;&E?{ehK# zxrioZa;N#5kY5SrE+htRutO&n?}@TyWa|Z!A0XzKrEVKZCnXeJT<0$$!1@T<&j9E- zS$er~Ble#j&}Pv@6--D($~#!iu?&U$MHd>V45c3MCWW(BX@AQ>e{z_zz8RVo=szuC zsjKI1>jQYP_gnTXx2Zqy2Fsf7*eiT69kc(JKpt3l*`j968BF;~;35qK1cQ>V9^mtt zC4j^#A!g8s))@J?xRwPvpmu&|j~D6eL81`QmhKP^WB6P}a>UHI$K@|)+)Z`-K-BB6 z+@lg?p9d(^{|08ZM)S-34^EMEHiKt!=J6SeT&vW%WEfg{nrR7Y-^U&GhDec1-V&(gO+2R?fcQ%Mt@w#L4^y~v6TFZ6t}kBs28|I$eD|&bZGug+6mP? zFP{(;dSVSeM*$5$>cyWsAw@Qb_PrT~euW)-3*b2zqwcgwKvzsy1so_E>Vn^~6fx)8m7@ zZaGy|`Sy&~X!afXD*qXLVEr%WQW@eIAWH2WS~*lod>iVMH0(eYLd$ctsiWjnVnl z$BEMdJ8rTYg}4cwlFl~WAkF-}zP)~aTBF(AXOM_bl~DbR*%7oy`TdQz^;5G;^iNzg zIw#^f4d5lN_BgMl9nizYPBI`l|&#BMTx2#z(NWY0y>NRDr%VD=#b6J3ZoX zqJ24{^2kz9t)pl-$Y-qourV>Zn^R|_+#mz0EW4;zr$+~UCxG(vLRjf^vBXmJ)6$#A z1!Q2l0A?}F^zTZa)4ZY~h10Z68LdTL~@%;BduN3BKwcXaDtf;d!DB!usaOe;Ud ztg~*AP!EB@&i=Y^$;+U(Aw4K#?q8o7BI&$#I!O(SzS5fg{;Z3A?tFft!g+Yx6UuNp zHZKP1cJ={X|6YpH;u3Vx%NsDTX65UDDcJ8|W>!N(mTRXjs*?d3t!8}Kjv$-u7wTHL=DB5HEpA@hFkVV&lHndRxg0d37INr1s>*iZ*uup~!mtM3f)CBT`0KRaJkJiQLF8VHV$CuPt;cU(~8 zRS_9`dqoUoD2n)P_C5d|GJ479?OYt_x{i3f<1|qt107#zVWd zTC^RLYk@aaq2ylMr{4|LR@kifQOjCPN|OY7CJ9FT9IN8)Ms-ULLTSY;IwCv9<_VQw znU2|YqIFtjpo#?5i0&e)p~84M@rWhnuFwhC2bMo~&LafszjJ#-)7526#IxeL`xHXL zTE*m5L>(69i_$~dK^Tgi&H}XLV@xA9a(!QGuqO?qR*`u<(2+MIx=sc(7}GjIYqjeR zVmW!Q*;gIWt}-r(&tj3f5xp^AG%c>$PuKS#qT5nKzJqZ!{XnZOGiUF~kHe#c)!sB=s-Sr)nq zr7+hiYUMGoHm41TOgp=XS>+X`Rw&b|Fephx*INQ)(=4J>#AAtE#HX|9)$BXWTuYv* zC3bDLoMK$<9o^VPW1Z9*vlw#v6|DaYtQILf(WbSy9t5EE=3TgH6t|-+C>R9oGDl42 zxk_c2A38M^?W}RJh}3RgZo2|^>|8f?6tXhfi%nP1Ea)ZBYa8lzXj7XHnVxP?1MNaW zgy7n0vWywx8|q>b(Z9%s%HK-8%qo0d(XHG~r$ieqUTR*5D>i5$uxK$YY&-?p5D%

&H?1&8=3e^ANFIH|~V$IkNN|yS^LfYb?d|H>re6*GG zd^Y^+gO4P*KHWk3LfIL6^nZCOAUyu>e4aB(@-HgF_OIrvVABQOoNX#hY95~&l76`^ zF!#!0Lucld1uq)d4MdpJ-Qad zrDa3X1vzaw>9|lLWmKWQSirFR>4V6m@qy%@No6{k~A zUTK@{8w|8hXJV2;3vkas7LAo_?R(Hfxw8!1nAt&h!E>xZK9r%r=T9}G$LK&ZczrrF zpd7D!v6LrY!fI7Eolf0VVJ0H=l%Yz-=uCSdvoSjs+P^xzcxSvcq|RI1H5IG+kqm z&0@#^bd!zJRpsNYX1A26-38aS_Q@)`D(U5ZP#UJj)+bo@_4}B2JLV>9z}lT?q8?CF zp)4FE!`3laDApF=*uYv2e^oUdc(BsR9a)>j5!0@^6wPAvNUtI!BrPIDpB!%fS5uA> zE_Y#i71adRUTNBFwF9NaFX19NeH2E$64AvN`N|CG?5t3?+kx&5`pQ@TY+bP!&EK<_ zII@VCI2c|v;oTcFpd)siV`sIS*b!^v*>P!E&k{MQn6Z;NacVo+si`Y*{+Y33Qu`GA zH>gJoFp0AT+Hz(?Bd-yoW9$Bt2H#VM(=WT0Gm>IH0mVqLFtJv^<|$G{}j0d&2aB`Md4j zl}HyM!I+NZ2=R#4`PiA#&9^f-jBwM6MYme5jpG#J{w0TBiF$^%a?CF+zgTIT@^#;I zT8XK=LEfVi?b35VHz_|EeLVEEEl{33A|{?_V2P8%XlP?TPpV5Yqvwc?dA`op_N1W)8h0RLaY7RS_d^MQWDu z+%Uniilosw-*coJYS{~tVvHHsb!PsD%yWTxAUn8{4~W1nvwi;jbyiDCAdx15_*uFa zpB<>1ux(syQsqnJa5t3)9gnUMr;NSh2`G!Eh79~6*Bhrl9>N?Aiau*W(j#fenacey z0?c1ok5JO$f9Nw?oD;wG8Q4=aW^q7Jn|J24_5|8##2DX|8Sfg>%YuFw4Qf!zrrD|4 zN}`5MwRtAy89;CqmpsM)x42{J%u_@;&RPzsrly;a<`PIA0Yt-MIKw^^SuZVQ@p9_fCH zA_n;l`nyfbanM6qn0OOQGvLMnRZTMh33+)P|9zjwr;#(3=Q=M7iO+`@JsLDYQ<74D z05Ajl+gf!?rW`({3?VWWB1a&b{ubc_d`K2IXaWBWz_uo^9YI`U5zw!y6-qs?^MD)3 zouAHekNHC#=cFKSZH{vSjJp|dy|XwVTzK%_Dt**F6qm?!Zj-mh5gcx8Nq%zpP|Z~a z8BDAiPv9p4O4t;*QVvYc>(0t&hjGkI? z&>O|8fJIopV!B8cpA3?=(SyczTE=aM-pn>mfUG%8)@9DOdE6t%R#?QJMCS3!CT9R}&xI$SvLq0%pZJ zwXI6|Ruv(wK+>7seA`fVvg)+;q;=J818&5-{w;$Atm>Y>bR59I~gQ(-pJSOy!dhCwl`+ zeZ26)_lIF4WoDg+CfqBfck(Leoi`5PEg#Bmj$Q+jF33VL1f1;y0jjGQ$;fMv{N?rG zPn`(l^gwH{6(%w3j8rA)bOZu8J6>OW4OY!L<7$IzZQ3JpZo{acNlQ6-{0ZF2;@5P4 zRJ`5s6RQ~tbGs^`eiW2vUMR*dUTKvMuYFsY)D4W&{bkhg&98io;6S(id(>v(*nEVV zsn{){r#O+r_zWT4D}e*Hbfu{gg5v7_AFhsE{oSsntGeafL4TR92vp;DtctE;s9(az ze2w{WM`@xalfQ=Q_5yvjY`&hrQ!huU2fb=Tox@dKdpblT)PWCrP2`fsuRZ8(GrWIa z#jEn})!PfK&C=kzZWL>)AzAQ8GHi?BS>`}0e~l2>mL+Qe9fhzfcK~dNR>&*|ClJ2a z01mH^q?vNQ>83(v%u{fbH~)E*ayhSk9YnRW`0Gr3QH0}rJ&`(;ty)$n1IS8;met^9A*Eq5$X0ewlI_xEiip^;W9}rgl+z(wT zC_8wk)tX>2d_|M>9u2+>!2)YMORov1QD!-(g<&xcP?)TC$O?Bxe1ea9d=POx8s7q2 z<3#yITBgaTsVWUnem|_xoP1$flm2ze(chDAxAPlP&g1icHKI5g#AFS&Aln5>i~{r!grYIuPZW zI+;d9wzkZx3yRm87~_u#)_fvQusC+QIDXa4@#r>31Sj9V9^!xKno;gs&U#Y6Og`pT z9q?iE@we52ZORhwlBd<(ii_ChB0eLSPj@e??)ir0VujF-JfKvg`r?K03?tE}YU0|+ zR<*4wrTGtgjcl}GN`osop4SteHxHn(!1a7Gc z!9yKHmhbxeL7{FrHm&gGpDO%H(gdp4GZ_fpSahJ-e0*Fpxms@H;}xJm^5BkK;5+5j zuU_o=-3i=bZ>RbBGzeSVFmA^`W{D?(Rfn^-6ROfFDP=_mrIjk{%rz7ST`ROF42;Ip zB00Wm?FU{7ecWqPLy5X-M@#V^ZWLI~Cymfl9qN=kqWAHm(xl>0aWXedG)#BSJqUyU&2J?Hz4u*v4q9k%c-;c6q3?%sy(1VuaWI z$AK1`f|WoOD?7_zc-J<$C(6aMQsuck%=3>@Oi@x%QgzJ78J{=mDW;h--VOS$A-vl= zxE)0G0D@Y*%_{@LVX*X&Jl2N3z5v3iO8}%et)pm{9f=vL(b{0sbw)|V0$ax`2D#Z>4L@PG+8YjGvNU;VX#o^Wd9(j}jO&z2XsP%~y@){mDvgorm_Y$TP=5$P ze=!!s$K!lV;42`_AfE;&<&-nG?;iftvD&nr^ApPUZ;>C~MAruV93YoM_m55~5C-6uy!@gJ@z zpLg8SR4G~%`Q9pKN>!)|W{3M0@bBW=^>(v88{&;Qxly5C9&EKkTETl8*e)P(TOSo>>t?AJ&N557FrHJrKL4KEIwtN2K`7qv$8i?)ZS3D>Gdbhe%a z@iFX)BLj>qs$%Th?Jbgm{DM;YPJ&id1-O`i;3$|?`#LaYK)#n90> zG90))^YU%q2YM)QZA~>p+WFy1jLx>2G^YabJ4q%r^!V$dq;-;ldv|e`@YdEsrWVCb zL>1^rfBsWk#Mx&l%DOA!v2etQa>AgTrmcsvL+KcRk+0H7O!kq&nRB<7sLXtR!WCd6 zANn^i1p*9`CBpa?DX~nmLSUehBy*tjS*BJiT+5I)8>iX3f9Sf(s&K0gV?ykWz%asW zfE@0pySc+`mT)VG{C>^n{C?D5)L~~#>OMg$Ib70^v;`KKh9i7 zLNl0KjILZ`byR~5)pfYs?|ge~`9ZCp2tv*6Uog$NQQnBKFV{S!~ zP2FAz#3I_DXK1GNL173mLl;@^Q4Og5w;fagjT)8ZY`_IaS!DG_zeiKvwKU^6AOf(D z<&YKJG824bQxKfjz6pRPG1Gnebkt~0fXH#|fFr`novc$w(}}uE*3SX%6DKaXy1XO~ z7IuK2;}l!t+Mn6dp{D`v-h89F!{-q&J3loq159Tt8E22nQv!hBhXVk=R7s&j1f5$D zrTQm9Z26c>BF--Z4T?D#{(;9F9Q03?aT2x*pJOzk+1}o>gYODx&n-Ploou^Nw0hv< z%b0M?^u^$_`l8@_sRGK4hiY6}1(F?t1Y%xI0#ybfq<$+=mpC^JC+xld;jO}V zSTD^$xNXej;&tj**U3MaPQ8CvFyU5OO3?O$Ls;Kj`<@RMg ziUdY7gwVI;1^TII4a(z&<7*DbllZ|p)CrW^)vmXi<0pJlMSRdXEqIQ0zrRcK+f*i) zzte%$+teVOv zoUr#08o6!B&k$9uLdi=8_E+Y1Y}2r~^7RT8E^EU-((e6|dwqN3Q_*d|*zn-$a75Ds zR5$K!}mm}M@&~ctaueER5k)AS$e)xFzgGRi}8uOnXW2;PDqqcs`Zb(u6#a*d zZFa(3+`Zofh)pODDTXPK}|zhRxNdP~rE3Y8E#ASSKwFC7gLmaW z*Nc)$p4D#AFQbv1dY~7e1pK^zgCU?~`d~^O7p8Ww((?^CRvn#udG+F8K*R*hYCb0j zTr~5`<8uLbxOB7&=E4yiB@ISD3=4tvHT{|Rkdv`3PEzKhz;+8Dhg4{THm-n6_I=44 zTdGz9FSIjdZ~~&Z+hDmV5|e)Q4Co?RgBi*YP8oeoP#wku5Ax)OSHh!XTCCcBr%DXf zH+fqT$6YAax#d9>m&UkjQPxC8Hzf>xrqbc@r%(SiaN4v9vcvgeDEQ#Kx&ZE+#C!p* zF=N7;Gy2Pei{>-M%z`M56ejRn-@lt$HdIaAR%opp=&s4_^Zxp5N&fpU&wlnY=jCTG z;w4uRyMGdHh(~(1nwa0OXwC&LDg<4PytsvSJoMOA@o?*sOJk#I`yv3A$9ZQ^tT%RH z--uuJFrqhlNx41dLE<2ZC?6Y(uRs8fVG!zEqYpSe097aF%`H0M4*p@Oze(H&iR6&J zX=f=ag$37ua(bEi2Pd-tr{m^lKX-2*+$w&YWD`WM>~zQOb-bGz6?iOz-VE|xm_6AmooQ)_Lzpp?OVs(s zS4i9pR>|rPBkP`|iUg6##I}(f9524mo;BgZ8ou^Bf(=JCfB8-aiFI_EJxOyGMK{NY zm-TlWtTAQ{(FyzLe;lkB*Lzz#$m*Dn555Iu6O*?p^1;%$pICh9mb;l`GGI7jNzxgr zcrFDDv%9}9zfY%x(B8Eeitrt=y|VY|7-4_3eP>FE(e2*Q#y%;T)eBTHDP3$%^W5^R z=3CwD2>xp#@{b(RM3kD}>7yTe-92`dmfphgo2TgJ3C)BtEZI1+d29w@VmUS5Bt2-q zOM0_*mtuWOqRy+jj9dD!lUH~}`D%sQ1Kj!|(nH)zlfX{q6WtJ9v(GRRl-AMs&aw zv&*HBcs`1V!h3u$=q}G1h2{E~l5Z7Tkf)Bgt}CiJ*`aJC>~^Z5Fr6ZX=;8h2LQUFXFqw_7E*JujR)_P2-Bsit#+-fY}u=n1&3ul1drj`!y}z=)2$ziY!No|pyx)Y~h+N=P(vfK@U?PT0aEZl=C9?n80tf!pic_?&ksn2c7#S;-{K3AWx40+H~Rrd2sdLDYV z<(QsLK?K? z&nNrd71$oR5N#TCt%Iq6#IVySkLBVRPNA|5dUq?PmMdOwR=Pn$rzYCILb5ujMS9}A zqU2YLAreg8t{=>^x)<=5dBpAba2`z+2`5I^upc>*}|PwWe9lwU$@GKZfcE^<{X}=C0}tr zXf)6q+ivOFx<~hpFWmlM2f@>^DkMDqm=BN$#FXweG082Q)7dJ>G$}^LHSDje&BnqL zAvA|(W?U30DoKrf_-M&y))fB<#%B9A=^F9WeDRg0cy>&j11%o!yWDHH))!X~iPj>H z=q*RYn~Lr{y-z3?c%x7*JSkUlzeXdi{QWdNKOQ|<#D{lNAKnS-qrxxIxTy}SseTPO z4r3iYsxJec$SI1xq%bTA%Iz09l^@yIfLIXFCcguCA=%|&>FM0WtISh*cb<$im)xGu zHJ!t|-fqL=2|=^`J1JGMimG|AM^kqSn!UYK{7emhX~Pi^2M00)8q5Y7E$;o&d~7A9T3S3@lm+@IC2$1oI( zv618Iq?hm2;n$T9KdA!^Am-gw$LNbe>U2Ixv&n&`(c;}5yS05NmS_Mx4L~y!pd-wd z_A@_2NdT$>80H(^3o?9gVl0JI$rmzjW|6Ov77wy|rys+Sqf6bmz#JsjKofU$K&zux z1Lyjd0c%lkwop^Z9m|e)iJ>i>9U>NsvFt3#R^O%~m#LVZR(sy%I$=$=+q}R2ZI6!0 zSr4;|IU4pp7?!I81Ol;CCn|UAc3bR^1q1ViHwtG1t~B*f#|ufjtzUaJf`_OI7t(z( zPxSeK>A_F;#FpFSa~dNI0`Bn{=Z`NDRT1a@?FXnwk1O%%$=Gw)eNAj{a{!U?TQPOK zz<%ve(2ck;iOm2#?4nzK^S7QfGR;RxlFhGCAnr(9eWx$xo8DODOU!pwOlm(${K_2K z!(-L$Xjl5ik-TQqkc!8Ao3S$FS1jIPp|#%wM`HzdvvqgvkeV8iV~g1wgH7p{aLJ1w zy>Qoo>uZ3te+z0&qhZX;Au?@`4npw^?5zmJ%)UnNmsgDRoW$6|8lv>MsoN|2qoflB z9`ueJueo|k500{q2v}<^i8!XC`6aP$lZ(i3`^7r%-2Roc2f*<;U!7(YH9MF zLS=dqmTUGoZl^E1a~O=AvhBqjgA7z63M}*Y-jFK{jKmpL9O|?&vt;@5rDVv%$+n+c zZpG1VrE~qi*^(W-CZJUU27+Y9ko1pF%~$oVCN1s@FfwNn;F$w_F{^ZGM79s1=!#*bc0aDEA7mI%~=nY zN4;wMm(_RBn58fwi4clXK%1cNhdN&>Dx2mRI5XYX;HT0h=T!-CCO);4k014#5L^N0 zcR=l_L{2(33V=Q^zo&M|s07?dosiu_jkm-~gstQ={F5rrIobfcHAPxG5HApk92)FU zo*at-^X5L_5r8}E2@qN&b`zW)lN}thtxahs50!u%vUaJO~*V2O%yKdv(0?~!=H>ZCFXt+zex%)-dYfq{GZx=RCjD@fbh7Qt6)jC!P6 zDIYIlJ`DSn-{R(VxW8LRy?-*{s(V6+hFJ1?@y0c|$B%#hamhGU`jwC#^i%_;C!12K zSey(i;#{1*oeq-np+?Eu1l_M*O)e`nxL&(+IQ|e3-%iG3k?!X*>4Qib*e3H}T%|nj zo60A3li$CTWX5M<6l%_qAh5erc2XJmK=g%CRHpaITg4|4x%_l0x0_XNCxK8)YmUOr z69T63vLQToNF}(xjMq6TOK_#S4}SXg441)>Q#;t|E0#yW1S}#PHr8DMpqIe$lv*Gs zLuV5R`D`h&-2yrhG*|)-v0XiFLXnUU-iF9OoYuI|;efgiTrKhZ^mu=q-DGfJ2<^XW zIBzN?YHfCPO`lIK0K@fQGb=mfX#tHUclQZqeCQvfeRw|;`EE=6GmrIJ3mev zo4Jw8`7CmmlK8{0N=(CpGfi_kKU*tGXNlr_Ro$T*_ihzYB*inut}sp@%i!e@xa)fS z*wT4ZC3UBb4)IL86pArs@`$$JmxKm-xXp7E%wBIvr}Z!@30+)ZINtqAlfCzKSR0vcq|cgdHS2xJG1;;sh%Va71TK--t@51uuC$(LRYHZ(>Y1 zDsP$?g5%hkp+_;&libe1d0OcCTZ==fwZYSEc(nbiM|{;^2JE|K7n9|PIXUrA?f9-PkzKX)oihq=;U45Yx$;x zSlYSf`+b@&CpN}UMl?0kEbEO0-1;OI2P|{{49HfPsUtt~ZEk@9URhgR zQi5aHj(qeUI>(9U@#>4T7 zE8T`~E19!ll-S9}=UX@j8=v#qhc3nbv%vaSG(6oeY5dnW z+5A6t25c@h%>-&T2rPGyRyuae<{K?6wV=P6OMb~NU|RN&QHC0*IDdzp?ZG~4slZ%` z3Dm%(2^MCtKqUK!G0FY29~l1C#DJ!gX%zDa?$o=c8aM|3r8UPLEJPBXcJ9vynh%76tA_t#-+=+bojrV-!C%EZ|6m9+G$O z(L~;49zg+a*LsBWNC3Lym%m`@I)KD8?OPAP70d1?mKP}yK3-6Q|3jD3DP!iQ3^g^x zy(y@w2La@#Z2(u5HG7L);Ycs*PqKg-^YGl$bHH^^mxRD5>}Es``83-!^`5_y>Z$W* zB~WMY*~y9=ie(V6&}-`RG?&Sclq7`@k{W**N_NO0!O-_ipu9#CgI###{Vu7LVwT{> zH-qg*>j67;9@cIqp8r%H-tB(G@tUF`M9?uE)9*yj4nuNBeL#MWP==fbw?=Sz!@K*{ zr)nuFV030he6M5#k=5~Tr~zp>{G<6sQ%yG$zmMU1S#T?PpB%PdLcge$z=*4Y!lggY zZJ5(NQ-LI+RpR=+&+GXTZX$={({R4+<9brE*W{WBI8k+@j*;@*h2(X>@CVXB$9!$}E~hli`HDf2B?1}JEBHQ$ zF)Js(B|AHEH|I6NCZ8^t_K+W+UyAZt>B3K$<0 z1sRgY4x>b>6-b8nj4cdhXz9=Kt&1D)jMYI%m-rcS8h+!8<^XRW(5h43Bj2g- zhF(iL>ANC$0qIcySHx_Asg}C2g$K-I07y0g>@(NY&?5-*l&S&7!z*dDg&Z(3AQC^P zPyOLQ2_+zyZ_XWr44PSp>FmgYy%sqaOqm(pfp9ISYbq0nK49~ftD>FSeWZeCDu=vP z`}gV~zlVLkxc{*olq3Ruh98rM^dqmTfF76)bBQHKS;~TX@FxhoBs%E{*o=456M1aD zJbyHN0stG4KQ&iFJ-^N^c|qC~q&lzFiYFOoa2+-Kwm=I4yD#K2(6O%OU`gnU z>I%Ok7P@xJzueDcn{@r8`anvzksZzNr=2U_{CgrnP7z!|M`1RWf~3L?qOI=DPDd+& z&@txA);7}YSkr&!!*1h-&#~xhA zOd~?t!ZXoVEr##+Bz3uS(EVX1%YhZr;vEL;lV4kI0q?4veFxz-w}xzzFvX-O{idvy zL`5te!@o(2yvzIc{lOSBda4zbn6=CfnakuIGDs{?-LE*;-bunU(McR=b zxkZu2e=NWqVvQ2?o**LiZhuE|GShd0yBAZx<9oH0bfb$K8m;uV5s*n5YLx2>u2$j6 zc2M&wjv?JfuJK3(^LeuSuG+7*WFP%J6wbc8S3K;X&CT{j~UC3br0}ig?*BS~{ zQp$og^fMEd_;)tey$P%U4GKbnrY0M+LeqvXg*6;SNrWebJv3LZWb1JavPtL`L|HG1k6E5y5 zlANl75)3fFPPY^?84I$34YcqKSm+XgqyGY=re zVl3>l(3$HM4~A#VY-xA&19uT1UI1PHD{e}|_DqvE?|Oy=yTXNE$R|&Mj0bAHr_(A8T0(NYJ` zlZ9kmVNax;3QoR5O1S@6$JaausZO|q%TW6v)GIHGvW2AM;jn4+*3UOTI}(#>fJ}%# z+Pk~H49V^q#5GTC2>CP!0h$`xKc3Y;NgmigCCGen;Ao4esX5_%v}c+gnAtF$sCbWa z`t`dB%;|;dq|cu%A-4YKL%gTtWsc0*Fl>OH%-XXaPFi=Hb7`fr{e^)41r5&)Kh;YN zZ^cR~%)&~=?+d0Bp&w4-75e+keO>D`w>FR14g&?EgBQ&L*Hy=8iO zvm_BO4 z6Im&O+Uq1Cl|^WK3o$ZS9+AbO#!PLVMGyNH%myknL{HS=i1*TDT-24po8fei9x}hv z)f$ny%dy9@zMhd!?nYQ6LZ^&QqtJTUOODjD{JX%8N)sc_@^<8pT=wkwI~VTXq9n<~ z+x62|lTA6M0>^|kPd4wqn)8|s{;Jb~J(h0}+^YZvgEUt2{7nkh8uC~WDQK7pydOvA3+BBuk?s|?^$V(-n(bDm}pg&!?x*L!aII5 zj_^tC_OE=Bo`h+)`o2H zot^qG^HuuiM?HYcS(`MH@I+r6artaxi?`xSZxBsKhSY(fF+0ibhn*#ZrbF~CYi*%D zoKNRsLj9A1=;uE-;DhPlUjIxZ4=Ae&`k41v;P8Ba&i331%U#i0qbsAi$7GkJ`_*{z@?)BWk&80$6nIqDrV?{ zoIQUhJzzn3n|SYhEw4@Gz8)CFJ~Kjy|nm*u=`*bJK4k- zUbNV9y=Zb&TKk9GH8H95C|SI+AIiQzccO%3%N z5SgksEA+|{JqdB-+wu0C&liSjNVz)F5gNrt6pwm@C=6^#c;vZ)YnyM9v4->E^w6a0 zq_YcG>gb2>VjkD7-RNdU2-|PGV2X=f5c=I!vl1_c6<4gGhR#!2?lJ3wNN`(=3|^Db z_ZzWAt1z%b@Z0z$5)byteY=(W*3)1K!?kweghuOO&J*3+$;Q~)im*%|CaT4;TUT`u zIs#^pFvvQ!l>1bB7rrVK80!SP6F(~Ayrs?_QXQ*z=yBtlj~8B*XFK7rTT;S5u|$H7 zGfbkR-rWxg%afeiiG>5JU*7c_k-e*1U1m&^DEo-)Ff3BS`&OH;mpD-paGe(Zmtfg> zN-uxO*tUz|{R;~;%nLNMXSWwrSr|CZJjWr~qFaEArV$T9iaqccRe`Y=q2$(?^KcyL z_}}G8U^mZ_wr!l14GSf7ktyCO!JzUsP|T49NsHOQD6fPiEs}V9 zquu)#tb!2uooAx^OIPeRAozh4#mICY^SOb%70J`{5`e_TPH!i%5`OXLlNYmS7a_EB zk!i^C^sia;GYd?5$gB(4vUf#RDn2_s5D_UjkjQl@_NORqz|x$Zw>UseRqK3^J{LGY z0~FvvrB;A^8oJBYqCp)YhkqeUZ4v;!SDU#a8yZDrsRU@#NR z*Y^5Q=vVs2XWbKZOuo|m&JNoJSB!$A&)@pH?)!ODwBXq9SUkA%1mDU@e*at<$eQYX z;5V=E?gtv%@!)o)6IJ1mF5?Zdj=0^cQ%jAL-wbT8M3t+Fjz?TCzE83=*AmXg&967~ z?tV1sRc4AJ*weD>pWECSGd??cKI3O~)4Z_@$5L zo@s*|fj)6;^z!vpw+~-md0)GFmyf8|zYhiHCO@rC$nmKe=QDwFONaCG! zIUmlggsC!ed;`^;xs`=IEZyf?s7W(Uu4GJ#|NT09LIxQthZ-mX0L?=q?aXpW;)jHr zGtZKqaDVTSB{2jXfA#`q@oO!@M&!(PN`Z?om;ddkOj!^P{yZ~f)9+In<<9vq0sSAH zzVr8Ukdm7>;~jz(4l^ssH_r_^HLu9%0AWnViWEAF?)j92aXdEqE7_P{{Eq?)Io>wV zL^OQt?%-b=y!G(xax|dJQCfFYr!4S-jM>z?`}B8YOYRmGST1y40_nX)La6a`u4#EQ z!9rC+hvmPtNIPPW@kLMeGW_B~ov=W4!+`D^(T**WtY*!Ijt@h_o@^xs*_h4h?N}fu zgWo});pW3xAEr+$p=iEtt}~Gc;z3MA2dGMTDDXyyEj;%a@7FUVUEwhM zIr|h78T&@M)A!wTWnORZGR(ZY?&^Hoe29C!+rR?HgOS%u*C3v>mTB0>T4O~3hgm~# zLKltcaX)s*KX);j-lbvfKbm;NqZ|W<@ub1EToZF=21~JNv{wLa;&w_s7a~(Ts z6}M~tBOF-w`>y58WbwCWRc}X&7DdPLz|=}K74F3R{hLRu)luz(*kM7A9xdt5ZBGle zk^{UaSK`^Nhb)^8wn;6w`|lT?#Q0okzdM9^LuQ5CR%(ZQ%*rUa&1~++HxLmS53-g@ z4Q`LRRk&!0C)Tk{bxmu+XX$_u4Z#d|jeB3tCCbr4&eHI0MEo(sx5nUl-<6R9On2m+1jMqLGAnpfH zw7Dh?nj;|O28j~l69M!`TzoRpr?X0uO~C?%vhx~pRC;sSy*vwW4VME6-0Y#`9LsXEjHx3yPkbj5yX5BORezT|&B{lV%^C?Zq3zRh<8)qUr_6qSTr23iMeho4@S9f|SP%STH23D09QO z|JqhGF%L%1a7VW2Zqf6rzw(5dii8ByRBsfd!3v(U`}%L-BT}f{E;k3lMVxK4*}ISW z%_%ryC>#w!L_xkpR8y)dVNnuu4G-VGcJy5QuonfDEh&g$kh$1i8nRk{xYmka8+hn( z^iPFRs~{V*I^5ml0 z4+K8!G?iQb7_Btx5Omb&tq~YcMlXN$OUB^$;dRR?t`3rXXJ_x-LKn}`0+XhqG0Jy= zDk^L_QoHdV6a#$!KgPa19;*I*U)o2n6rm`RP}!0#yG$aoWX)doU0FtUQbS4hk$uT7 zWZ$U}VeIP&MfS1p#`1fg8Ks`j^Z9&#ujdb*X3RNf&bhDmbzk>&zwgh^tQwEMH5O}R zI1DOaKF{-Nd1=JPsupK0j3akaHxJw>;g%6v8Mdt->;RRAmld~Lz7e(acgW;#IKsV| zynTQ}HJ)J<(Xv7YcJzY8H4X>T#ejPYn z_lHnZEhFt~om5}?-ELjLk;|V-SO}E_!T5Wf+p}fy+J)`Zy#}>Fo~e2yu(d;)XUKCC zeOHqL-aWW(gW%dOp;VNy6|y=KRuA6qt%)l8t4AR#pkE3;&})VLLz2+X_COoxtby#= z{jHS^_p19KVWGw==A}IR)AtD-eGnA|WHi$&fL81GQrkO*XO;GeTJO9@+f(!+Mc+kk z&lBWG0mWG(f38yKVGj}Wf>!Z<;XWg%4A#l7l!EME5-dNrnF_+8>*SrbKATyDPxic^WH0WbJ>R}F z3#^SlIi;uflRXOr@#Sm3az@C@idW0hn<&V^<)x+Dkj!d9;$5D*`NR&M9l#(fyH}MM zD8Yl`zcK@Sk)Pq!C+p8aqXCCmPB~=yuxbXTDw9a{p#sVfUd4|sPxS2$xFb)1(tYqkCxeNmX{+`-4YjuQ^#=1qU`!%|IY}Jdvt$N9Fv^Wzray)WX;1lKX zp=JltG(1}aZRkv|wE6AhUb5`RmW(&7s;_;n9hrB8XX~t6Nllf>A8is2hQ%)-5mmw- zox;`=mA1zXb|Wil=1W+EDnC$7#@rMG|7-$s)mGB6l^DK!Yaw`IU2ehI3-?5s3g+Bd z1-HgTeom0cGjQk%%DR})UFw;+miwSWRvE7JDCve0H(VU9n@N4z?9KONH@-lXV@^VO zT2h}tR^5+uGohmw&3Aa|F1TiX3=NwR6ckJ3AY~9_3cei~%V)ReR#wd0KA?6ZEg-9e zyImN?w5oIS*;Y1r)iW24O_^t47GjadgUY7o)wkVBo}YOy{gYK3h*-(nvhOJHCRiao zaD)BNMp*&7yf0T<2;Y#G;_O~P(00V{^>mj`7R{kA%K%d=n5dhbeS!-(p{`m&V zcVBC_v+T<25HYY|;;V;`odA3Lf;Nh0`+`aRyAm$ zKZ(Nm41FlwYt7<@7_01}xG7KQ$C2Nkv|rW0e;Btjc+>uWBjGLnVKUc1pOZaT`o9t# zP~HyUO2{`5`wFXnMxlS3q_6?-&=QD;-gw+E!l1L&cGuwhi+A;{qp=KbPQa()Vt(pt zC6`np6XNi5v+JWX0xd;tc8wi$6|)i8Tcs&MH9%j1BI9ORWPQxJJ25UZ>cb90JNiEl z;?9)Z*S=_TpMn$PuJ(grKsDh8naYw>pY)+29r!O-nkPcW!w7DHpz#l*4Wx`SFN(`7 zBQBtdGp|UpPlnoTCWoA;;vzx2v6yJA4F$tzStJdDhX2XRiMF)?2B}>v=dke?r@)_@ z=PvVvUd+`$Zt&CP#&<2J%LemX7u)$tsV1X@#OykY;?ruDuK}XiX<+?&xdBllzpiy% z=*s37uBHctq*DHd2k#v1@W1=i+g0DIrnS$t{s%b-C~ZO6a%(#JSd4MK-U|Eu%rmE1 zl;4)06Q8^5RHy1lauGBRjF-PxW)p9crhhtplqd7nmQv@#u$oK5{*E(;^;(!>=yk}d zxZG|wa10_HJb~|8r||sZOV?*E2C=8AHoC1Dj_UHiUXE=htIlJPT6;hm7}a#?%fntnaD|ICnG0f_7rE2N*48Jt6YgX zbIfm|U5{*t8tn)#uB|%M1hHLeEOD0NSG#2L_JKwNy+p>T!z>Ix1nov)S^xTIoSMZv z1aWhQKy`uPCG6dvI0NlQaV7P4r{Z5m86crsLOtm_2C=nf^fc74`{3n9q}i2UyD+qx z9j|dXU^T_Kus-p_27|^1t{*!Cyf_tOS(uGEZJ$q0v}_Uyyk%x{@!3Jvrh;#u2aS+_)y6 z{jeN1M?9y+yZorh#FApFr&~4N4O|d#AcVsF{0^4l1GZHa1Z-hfV1hO_XHR|th++*}(Pf??ovR_-Q1 zcGEvxLK!9TIsOIg1YGgd04LckE!lI`lajC@M)bXrTNcnJ5glNY2;eEC+`vwo{#x6C zmk^w6ev8vc|GHT#td-bqhBDt?Ep8P$%lzhiBJF9mZOu8b>4^0tt(0;-5;6kg`=!7a z-F2y${68NUh~e80Du}3B<0B9M z^}V;|}o(g9Sj={{d;-p+eE$dfN=$%lsn*oNkpm zUbALv4IbSTIZ~*x>wn)(LhfW1T6}1Gi;P-a_0H8&pF5#IGThw|cGqFmJPEd?xFwP+ z?=$2wT@>h*eg4j-yz$E)eWw$h-+RX`nJ_Ws9n+?7JrD&}8Fe30*vu5!w$F8$ZC4PyLxS)$si zNf`Vyhw5gGwyCM()}VG?mgCt|)xp2yQL~vFU7c?)d zz#95eu*Ow-9pvHD?F;E2M!Q@!gTJT&|1p41NCL(?i3l4tEQ)Hd2ekm|Tuk zR)4a^1;9B(yvx@oX=;ulE|ffS2#g9nwi7ar_K7;D$PG`Z7f%npq?kq-U{fHa{Mo%L zw+s1YW1ivjFozr4z}9IDCWER9;TKpkD|L*dW-cJ+3~UL+%6aJlPOfs2Qg>@xlq4|C zE#|o1E_d2Kvsl2jOLAj*#!auq{9ygZk^>307DRpgJkRY~UY`;Mc)yDUBbs>bosd0A zUmXkw>I!RMMS#SOcV4%h><&$y>-W7}w|4sFOCZH`UR+EnVfLxfwPz3NT!O7?6O43MsNn6ukWG{z5v3_kY0suco8)AA52KhTn7j zq$q|B=G@dX_(QHS+f-~p9DsQqb0AEcA?T?TjpN;QTBrl&FGTJTc>?)O_H_>d1<;ia z{3&~H`{hu9w)23P%8!)i19aNBb=|Ax6JH~aILv%1nVr}UKHUAZxYfG-x_nEIrkp`$ zyztqA&t-AAwZB_w_7{Tx=vUo;X@9Sy|5!fuUxKzlY6FEn83xh6azK!TL4^otGXa@h zvkZkQUKek$hsRE8vNM5kIRVDyw*xcX2HyDJw5;?1{N?PP9vi_+_#U@|2S#;^i=t7I z3nfNuG#WkR77N5boFNqx-wO*$p?^R*jmdR)=U-g~Kn9%#;_IKa1>PuX4R!d=i>$yS z%YQtQrRGv3ECL2?8~BwWh&bF@p+9s~ht4 zT}7U!6@7l*Y3JgT;qAGLd^1czdFSt6r5TnSgvG6y7#ND;&MM>|`>Gk(JMVffQ_y81 ze6JEFb6IT2Ww5(2-p;bT)-+D1<6bL|{26N6J9!!l)engcMc*4*o=~~v%Azn=2QL=T zbfavUDU6p1z44@aEHGpB>LQwM`|6YBP91}m4UtQNgPzMRSYR;~c>DD>>5ahI1B&G8 zm-sn>C<|k-Ln&AbCLax~F+iEjpbxks`j(sn4{`{5mp=v~Rpr3#tbXF4yc?fluVPHJ zMx;stDGpRtMX8_yUa=ikCb7e6i6~kbwI=f zyy~+Wj~*OborO)tP@gDn?SWwhdf>~^bGLHeO*$PCWFH3pJ{p=kiX%W#*5hasegZ&} z%SUJ-OuI&2dm}|^98_&99q#y4Q=PoX;4W}`%X?|}>p;gc3D*8giti}{QWY;X z{17cIe8ASlv=gH>Vwvr`S3!6IGziOhDkXV|<1Y7!^ZO)0*eL+7j_Dtx52^5vO1IG$`_QrMn*7)L7s> z&p+8c2rhODirxw8SRw61LWWHPOl}i*7}Id~iD6MhmaC>#z~K%o+DP}lZy#fIGJlzg zJpH6DR+2{`G{L=ao-t*1W639ADYRLDMJOyO`*4GC63qK_cZwYlyU?)h4thwOf_%7> z*GmS60R{d7ns;Q6eqP}fQm_iAOm%&$RfQUC`>#e3U{(S?n;3x*UT1E_U$hzQg#-pc zYhov)4PcXzjTbA7onONBj|Nt|Kk>P_u^>|~TlVrNtEBQ)4csG?)nm2yj%wDS zGi>4$;NshppH{me3iJr~6)<0x1DouL2tP^KnwfVnj zLYred0T1%V1~!*NuAZ`wXt+AW$#9zKXo3oU8G1wcG2_jdj8B^|;R*Ph1RAWIoUNt$(0Wf3DT2 zD`ADPAC7Q+9aXw|X)(KHM`pMr?9HXRK_T&Fzc&}PJK$1!P976cQlOO$D_;5qaoUy3 zwZ66AOUmrp*L%r|Vm9fZXE_Oe<7JvkX-e*)XoV7eCNFGpyTn%K&#-_UneF-?GN99v z{9t|XkjR~_+97w6l1Dv(&Is@NKA?KIh)i4?&6Pg_i~AbaX=ViiK#vdrCUf9X=*O+} z@C#nbIFsO_Ln9V=I1HzR&m_0whjo&zu8$TTiHW$i`zbyG{*O5IT`)`wm z`irdB&d~c7vTdPFAt56z4KVynASKcS6^Z?TB9C9K--PrRGlX>S*^CMqJc})=Wx5|Q z^tE0;^SW_*y$Z^Z7n~o=5l?FYdVt2uY=4j;d!m{ z8c<%Q1ph8O%QXmDcENvR$o4SHtuo~>Lg4<@MfVJR(*!eN)x)Q)wR_24^6}OkQL~<7 z61?0elC1Oy8kGCAwg=epWdL6M%f^KNbg=PUcEh}{QZ!+~;C2V35WP!1b?%C1DPG%y zYHr;ZuH^4oi}O{8^LPC*JP83X7(6ZV!OUOE)+zR1WSo#fYAj{k*cw(&A$*}|K-Nr_ zs*p}cq~rGYKd?UvW7`ucEklWBcHbfVt{A|p6{eU}@!HB}(cs~UvB7rX=lG2;33WpJ zS#71CsJhv;$4-`@irrRre2gbqYNVJ~Uuz2%K1^DD z16vQ2-=75o-Yl;Kt2&j?jgsjRebEf%;+CkJ?@h$w^<3N*Q5#pdI0DTWFdKe| zD|+h4#JIW54VgryBY{6_Kzi78Ln-{wsj^+lq4V>8(b$cOde5*}ah>7?>V-;ecvinq zuEpVJhh1_k?tOhF#&0YJwxtf4p;gRvrk7!4fH7(&X=PqqSVAsRN_?oe6-h_hrJAYi zHJ_NqGOoa;k#)qeu?xu?H&y7!aw}o{>wf^(nSCV z{EHvO(p!&nFzgPw2oIgV9~5yF^6i> zQP9t>nQ7{JF!nt>-S)`jOw{p-7&-4{gnV{8Pv~XE;Hw5hSP_GXPqi%@MyF_4cZ7-wd{Vy>#`0qL(W!(M*lJ1pr~f;JRY2 zy(jYXD$jwM(Vp)`vH`FOOC0an!^>v~*-2a`c^rp`wP|*Ng-Kb3C;>e5-D?*V$i=GR z-G}(nI5|7B+rKHG(o}YtU^~a479&}JO}`vqzkFhQP8jNcc{w-!A4W3J!8@}$a=S$h z`cgmif%{^G_zddotwehOgFM;@+UQ~PSG%qeFb?b%QUgLsp0|@UK_=WnZxiN-?<|G@ z8ZwZAof`@_{5_FdFA_rWW&sPRG!uC?YZf$UNrPVr|M}gZH5Dd&F%N0T;-X!Dy|Djt z`JgF{Tf!v$Uh+l)ihBc}KddN7KP)3NxlZGR9%Oc#iyo5Ll&2FDNWSC4%szJq(PS71 zxC{dgHKw(BlABD_+NAC_*<=;B$8z*E!$~c$17PUjrq*r~?#bk|7qfS1~R=bjnS64}GybsbjpzCPhH#zyU)Yrd5l|k71)dE^KBO|kCwU2Y} z`%++>XH6OR9&~52i%ZNPMu1Loee**tim+EIUVN?XONgK;6|Ry7%>_{1d66*?CBHFx!pHQ&sav4tDNhROA#PldkW+7!1M|3QPLZ|koPB)rIE@q zcMfT?RvsXK{Y-`BRQ`^Hrubsv?SMwD!ozxPlxC;ON<_7ezkL6!X7@GHTXxDcV1d_- z>IY-3_~EM|42Sq8Xgik>R3(r20{RiY>(fbe7u|2*Bx~|GE=aD%Qr|+v(lQ~N{VsYb zIR{ks(d&&X!#0@T2?k{A+#{3Mx_41N}{>8>i^}uZN`Sc@0yJLLQja^Q=CXVaHSuS=Ys+Xiy#V6RX zng8nW_OJl;!JY&VxUO#pj>=ZN2F~mI7;Kx=uieJ+PR>x6VIMWL73+SK{+nvMSF8UI zwjjH0zWYd(_TRVw*zaVH4~j1Dzm%3gIL1He#~+Ez{!73Qu(OZ`cD@0qVDb^f1I@fd z+cnU605vb-+ZQLnB1t3MFtJ0xjkx&Vz826^IQh%S0$MddZZ<(@tHHllwZVc9qZ1S# z@FX+Y`kj5yxF@z#6IQv8$$O2ygbYCXXk#r9EBv4~W1-ZUhWpkV9MWk$doCP@4!8Qr zH+zdO9E$#cv-Zr=_}$M4(Qk>pFAerU!=Gg2@6HcG>Huurb2o_N_PS6WkrJ03H7TlAzx zc2bzZr`Hdz(FEj4{Hz&r54-8KxNAHoTmDm^1=l3X%w-$Il~WLK$-~Od-XWeEcIwcv zpzrDE=9`5I={5; z%!(f!4dzV-S{fBb9T93&o!hI^9c3Eb#hNV9*k>oVRM6qBw?WFWqlwNwzkM{~C~Zkk z?i`7O$?Q!Rg*^8ioyM94uZU=p;E0)}0`cLXuhZwkY4Tn-zcyuhqsrqPo2_wDNU7u7 z(oYezB;9WDD7pMj&{&b&)=eFe5;evu_;td_oh+B5}K%lE}X8|zRP zA>@1nccP!Uycg3U*(i#i%W{Pe%>5`C(nXyl4m;NC*0bsPe)oxjjKeLAy`XY#NRS~T zqwKZEWE!c#$VF(PB4LgzTG{07{rkV?zJdv46+zWUU4>!1ozGKeR_A5FWJGB0 z4s?XnG=<&jEB!aF7@9|}gLhK=o&gJu7WwOA_s7HTjaqb2jen92W;WuS%y*@Ybil#? zIsOQ9?*)?5o`Sl_2j)i&#+iXnue-cIZu_tKYyV@yn*FU8$n)B2zpv<@htc?JeB7@g zx6r%7&ShG^?wjhJ`+}tOd3+E*i_q>e7#HN@El96$63p-Uf*dn$Kp#PVx!LCO&;&o_ zdT;Km>OaQS`nspQKL~%fT7@mFc0?Pvzp`{+F})U&6F<8CNdGE+DA4x?Fo8BF9-#xH zI}6Qoyuk}zPD_GM+r`a|V$dNgkyTbEJ8FISX|c- zY-p+@n0JrE8vFKvxt(BqTP8SVXilbO{uO=rIhrZ=$1lPE6Xpqp(&!3N;V*3YJa}SS zDj1ti9V!I#nFu2#t+qKxT8`mwxGS6pKV?!6&aadeTOKwIE}f+tjPmB<4dEKKN&Z&Z z*Q|dBKWXZF0~mgk{hD0qR$TV+<+rfy=~V|dExu*xtYuraj$V7XLribxIf0zU_KkZb zUE>+3?Uq3>vNwz_*F|{yC6a4&b%g`Q1;!kK=gd_y?x|^3S7&RdlD7VMlz-vUeH%e- zy?iQ;oi5HoSF_A$E>TQ@5U)?h6~P%)u|RljmhF(ERpaAqZIkcf(vBDz7+Oyt+i_h` zH~;+RB0SsFH`sg@YO1mlgMSiNfrn%;~VvZC8^}BcVbw>)iLQ=YPy5A?2 zCU==>xExVcYM+qN%~~1ENYzeeiamg9rp3%xv}s?>39OVgZ>$FCC`HOx^m&|bdY zpHO9ku}L6=fchldvHVmIoL0ll?iVt@6GFKko|a)>dqbxQ2C$5oc^+Ptk7~(+oEg=-Y-%> zNrR#Ip3M9~c1!C8^4#CZ@o%64j#60_N0`*SKdu@Y1X(5q-jA`m%&V+yVsamv|7c($ z1E3~a#pIjj7Gsg74FzU2TW8pKXf6Id$Iju`nb)vt$G~%5;IGhA_#x9MlCLmRk8WL0 z)8*4=mOTgvc}2vVuWZdsa?sQ7`1+3|=p<{A&7E1>>*5@u2SMnRF8CiT!Vio7`0&(+ z>KDDOXPKw!R($IgWDvfN$1L!1sIiqXC_C`ER{=-Qwqv9RA`{GD{M6fQa1{!oWfBmM zRpm-e%!jf(iFm=d=dm7GSI5sgmV5Khs@MFy_vTSMy&>Z5lneHS6?FW(!OPto(ckEf zDP~;y(yKrhReE(zJ?bnp4f0;eWK;}mk6bWKW(*UbnXv3^?T??Ur>8KKyxA5@$ej4Y z;@`lL!A$}%VuJKKLOi;M93AN=Nei~$+qf;LU&DjH$H(1^54}mw;Sm8N0Z=RIDqmT> zNt-LB^(Q1oghC%)Vg;s`ZPWE@ZxI5y;w}*lCUTC%_OK@#7`#XrORc&2?sG7H%$k@x zn0^Z;%4JX1huiQgu^TtA!J1{kxa>U~+%Dj+{{~&}*{5K@t>^ABqKBuB0c>$)+y1!d ze{wg-sE7P0PyhJbhplB7*}Ux+!VwGa%2kMc48$FB#XD8JJI*_{My+QonasU#);u=#ev*dXya#K$D?_`fTh@cvi+IqZs3aA6>RtLG?YP2SY@dko!qJwPkD><)b$klf z&mer+atAamW*8UGH3-I*6&Hm^ploLxxKlJZ%y+7itTo@1JKbIq)ZKMObBN%kQE=U@ zVxz^pH3P@>n7b_l!KB&7L&kHt=hr)Lp}k@&0)Y$qY1Ax{mJn>~lO5 z$tC{)ukUUBeD>Y&qqU%cc9nemnCn*AXjZk_aislycMRKVWVZbC<>3 zOzq40FtpgQ#DiX?S~dCNKbw0`4{rS)w%t2ISKz`^k@}-FUU=L0QxgFLj~_qduSkWw zFe$NXG0ll7P(@kkgXw-j+C0@SRD-l`x;E#QD)!_nDRtblml0+&AJlPb%tdKX3#RLC z7C!XS%rI47QgxDC3Rj~o{N}n&kN&wOj0y~!Z9U;S;xV?(%*0xBKC;sywm;)sczFJ6 zd0CTmB^5s~$yZQ7sXz<&g5P=T9JVxGbgh?}yCb_rLoUTOB1yUDjQ7k&Uy5%P=c-`H zZhKZz@vDcZuFi=7BQtfZ`83tRLfuRwvnb8(d`dM|)1*K~T$d?siRxu9+u@5dwW{8U zqd%_-dF@zOD~vO!_D}}b`ka%G+%~b?+=8)wyP(uBsN?d*yu3E1%G{jfR8N#vhIw~; zt`TQ+!B+7`#2C$ZWhVdP7tY3aq9X4%zWG-rY|L11SB^UDY>{%iuSd&kir~Uxdt64n zb-SCQ1@tyn8+y1oQmQ)3LkA1XgPTp8lNix98U?-eGG(uf^LOHNiXP@!hr5prPmW}l zb-&A4Nu6QPwy;DbjMCwWa7ZLr-oMRp$Q<>QIfQ+xni0b~;}q2EHmoR3Dfmf#VFG2j zI7KVb3G$u4qSuT7Gn6y}&!BOjqTcu!iq~5Yy^=gHNUK_uDG7WVbsN5t_i+=bXUQLt zs?OgGb#T~6aHUFM9LMKNM%TETuJCg2GA@UjEl{;~3-wHh_>vZl&tWLX6acs&zJLB5 z@dbci{WaBo9}NEErM=v)7P(pEL5p9)oS>^L8loFJNvtXU@r`jf7`v@((zzj*kkNYm zU2m(o=-DS;u?J{0dgU8KwoxuEPss=?zZfa`723;Rz*^0XQ=R~GU+o{7bV5^L|44lP z$7tEon`b+%a=>`l!S6FmG`luXGNTXAi~e|486bnpQ!rQ8oA2ja9{j<2iNRXW=25RC z7S{vd1keH~fx%2yDK!!9m6jTD_*yA9`zZheXc3CuR+?;P>v&kkL<`=T#jYxJSz}i7 zCUjH?HTnT4bOF@J1gKH^v|F)C%3y(m9qVvq_iH}*=l&lF@lVuxWQaEHg=bDkY4O>$ zH9f2!#tQh>7WKMOEb(0z^_?BPJ9B|UWQ1o>uVtv9;P6Ax4RjqK%9o?h-SLl$f)%)8 zo2n|-3y0WGPjJ#~-q{Qsr4z+9Mqq*+OkefDT!%hCPo4%T6bRlgDds4eEr&k7ol$|< zs}4VF2T<`Foan6JGM>lEE7P_4BR)Ki_XgTw#G^+(|+kSa=>;&db=FHcA zQ=4}MlN(9+D?e~7BwFmzK)8)ko7H7mgw$5MQ`c?roeAag*Dk_I%_XgJ5lKct`7{}n zWl{ZR8l75FDQqcV2DQ?pePh|=`>}f(tj^7`cc&foS3*V$mP^M%m($1AbT&9p+Pal+ z+i7x&M%){0=Qk(4urbsKPopJ}LVomBL^Lex_(orKa4C&2OujM5dC&w7sXI&GtLeIh zHs57Ga0}3BD-RrOEAQ9IkJ8p|&MkN0ZBcYqvE|injgo^%kHb=wBXj2Xz0!yLu_&HK zb8|=PMssylCE=D_zW}S`QK2WY;VbWxkc@{ilG{?vRbjiTRMQb(ULcbzdUMzP)3;Ab znv2#pUcHMM53W^pDQq-!zE|5#JL~+o_UIY4+dWTx(NB5`*KK4n6HW7jlRq3ocXqNS zQ}}HkxRr06*b$-DAqXW>>XorN-Q`g_dF80V*7E4V&hkh(byWK~v~+1)8^`z2O>vF3 z-WTG&WnHTd5<7uDgJ&s+h{0U*qQZG%M3w6yi$+F`$d9zNYkZ`l3b*!dyz+zQHmL$i&ay$WtP{OUwR%1~VAS#jA38xwg8VV)>v6&AH7}h?BG6ZiEKH7jzse##;dd(m z0wr)Yqk2QK{xBYTkknBi!!Ix4@9kj5y2tRV32N&c{#gvA?n%IS+6ZDsr|8dRd?>b# zgQL0b9JzrzRZIrWYKD{*C&ns@dk67MGl@|_=m?&f^nJC-i6_t}=xxRgD+_7h7ZVY; zg8WEN*0cC!1-gl&UPPV;F8)HDgY!ytmk3#+Ge9Mq0U#$CsgaFBydx|pzOdm#d}wV> zG{RRn3d*l~M9JFvy_1VM^@@6zyD4=(&K9*?2Wb+~$PoxEz2t~!1SVpMQ0^D;yce9n zgxFSZP5}O5=5-EXAM5A8hE^thc*fLiKEcl1xnyHPDhd+MP`e+@Ip%A38pCad%voOb zoMv|LLPB}W47xx-GE`AADI6E z8{p(i@3XflO13H1${lXz{!{&Cg1I|6risI$Fe0NBkbyTt zbOe?NfXD*?kzoB~O#3|;TB9sHsZFD?LrbUQ zeYCZ@7J@w~@#@yeevz=5OZJw06=vAY*V@civKj=2^qd20SH-2NYbgq{YT3IoRoj0~ zXMR!CD12)r1d*PU+Gh28zLd^8P8!{;DU6K`m>{E)l0^O?twOB_nr*DvT|9;5ZH0^O zGX*F{o}OIp?x5uLRr~D|y@xhZT4z}+e;|Bi>HZrQ>A`L3Aw@^=m!cyV_q2vnlzk8^ z9gRD=so_``+l_a=-mkYQBWdvzeem%{`oAeO0C+&A6A6)yX#xk@m!bi^vd8<8Sx=n4zd@#G}8bnyGG(bNbPO4cnBy-38dW;@L^e)H>da>#0Bn zYTYs@>1~yDPj`fP2oQiMKq{qMq20uKC<`P!1U*(~Ap5BQGdxiVI(3EidUK0*2GD~d zxJGrx&3y*H`y#(IPX4##=D%h?y4>9C4C#Q?L`)+Qf-69KDF_|~TFeRK`yz-+!;Xx) zW_bt3HA*$ZXlqW83IcM~8sbXIyPY<6fB=w3lIw%!H1;5!aY-;ZH5qa z^*35yk4CN0^=I}i4C|oR+q6*wy{+GnR*^J4SeHkib6pD)(qi7Wz82v!E190Sg@*f! zn1pM_v_;9K@T@2o88~0g(YFxHdJ(PD?@(wSojC>`hsd3&$_GL){B5|{DtZVu-P}w? zT##93GIQLb%R-HUt&n$H!)$aH)lJDWm+Sy&0v}I`B5(JS_hcE$I+2QJ34OJZ+*&lv zaVt7SCZ;IXQERa`&6q9LY2`F}e9GU{Z3egdE!P?0j-pzdY0g_RP~lqq%#NPd>QW33 zZ+$I4GZWR&lxTE$=-Y*eY`f-qi!Q}UBXXSUv#HMKW2@Cg<~#m#yUC+m#-b^X%gg!^ z#)Hwh=iQc4#}?FL^3JWgCaY-wTo1Jx3U0t)gx4?+c*SI9dOx={18)2s9TwiN z2_o@dNzCs|1@nXc-(vnRS)^M;959{6J*LxhCvKYa`&L}GrLZ1c=DV~6C?D|v5%@Q^ zfeK2$7z~h1_Ohe_^%q|%fQV9v9%#PCJq!NAvZ}E;YbpD`!_~fW^q<1a|A|%mbu0D; zNScDMEA?fZ3Hq?54UfM6;3C4SuMcZ}M$HxBdja=>SCB1ppJ$1A;{7Gc6ZJkGfh;p9Y8w5~E%J z^R>u`Q&0-zD%<;{)(4Qx)fQDcTNs|-&;YEoYI>nbuW*eRAw)tWpiR@#ffHDw9zR86 z#@twoL`^ZjdEto%qgfFDfV6Op8jUyO83sQ80!(PMUTjTPDjCW!6fS|(hO8o-6?SOQ zm!N1Qg*c{1L6iQE;*BhsY7t_G`mpWlo2O#EL8z?u`#aze(Kj^mF52DhRB)PTt z@|CNuvz{Q}tdJ)H=op)}-I$uT%}bac)mD}ZJ5FXM%_$P-X^`9$^@FO*+ALSZ?pD}t z+oHUjo8r>TwAdn-ZM@Ea$IhQoY z{#fuAy|U38y!$bCmxQiO=;oSj#6Zhzk<0voWkgP}O5=P^bi{?c>IhKaHgvg`MFC3Q zZ50v2hPP)*>M_4xqi{T{{(!xa3_gN+yXdd7G)?to!=mTOtiM9SDQ-tC@}L3NvHcj(AOz);tXLmX&|zZZ12pW!=#MOiFR z)XGmGShSU3YDEQxAJ%SKTVnJg<>ijzAI?#b6R_<%H<5{7?7Opp7E#LjOAXP3^Ev-K zOw$l}<>IvOeFnzq})erHj zR}%?E>_}-M8YiWNrQuV>oZ#Gmx)MyNhoQr5tef~k)$l-c;FuOOF=G9OMn`NnWy;#Q zX{S>Hu@~n)#M5!4wr1t#O&`K1Y}z|DP)c0zBc5jB)3ATRAb4_@V^WL0xl+cq>g1S5 zw#*&z^#yQ<@qSK;2i*o)A{vd^wXh_wkBkI};^wh`nmWV3wC{)TOc>zCKVRee8SMZ> z+<MQMj7dO5KS|EAt6uC^ex&PFdoCGS2HdfN)%~pkMvyH}Idi_n-UcTdz)wdfsu(2+F*vc1p{*6hrfZWo6Q?}!qmI<~4c zv}otnFjo~Qa`$usLy(#nh<#}1kZiny#P;e_OeDmC-^ zjxXngO>doB6>>}&``$rUpe*7pW;>3BM`&~5SOt^8T#Ma~el~L5{-nO`VRl)2rzS-~ zfxyxF!H7gByKF-PBgH(|%H)#Knzy6fBl;0PO45_o_$ITToRl2|Z><#m5 zAvUs1iHozShpWI?{Kf`$CZa#KwA!X;WX**3DV84H;xcK>TIIGL9I@-LGh`mK(;SSd zx`{K6aOluPb=lqOkn)XivTYk?5$Tt_R=9Bx>(;N&QdsJRurJW=%3UWz_@W;@LEFa< zv_@HGnKWl=ePHFG?3BR|7S8!;2YST$vG`Y~7Er_@ z*yDRrbII{DCryypre=DGj6tRR)ki(ug`}3#oPXH^AcyVVRW%sZXLg)Q={pCtnp@^Mf zpy=N^fY`lb#zu49$^M8kol1af-x8Ja$FUE^V~T(N?G&Vb1 z8jQHyAVTzS-#7#lnUCNzZ?k8PEpYwe%DTd<{15Yy<(@Z*<}7vQ$rFAWdoSaSOZU&6 zr7nP-@PiCXf9m$o-&E`#ebaN(8xP$Ix(j_GiaBVyhig=Zi315bOH*bLs<;^M1TK3f zuAXKq+B@@6eab#I@MO!`#@4P*ok$gd;T43jA#nlx$M*uK(!|(PPM$-XL4?E@-E!2V zY}R$7!YCQ9TM-ef{YFtjB_Ns=kWs#AI^$_EL0?v{BotKjn5P(`!rZmj%b_ZG-kk4I9?~Y48k?al zuZVtsY!NmFlahwMXB0lDnMWY1Bh_n7b8D>F{&#)YLz}&g_B$tvS_YE(MArh67Hizl zp24JMUyPaA=!9H+jmAIAHCjqqb-7IRY4UWXrPsEEINRkior{ggf88W!g1uK#M4PQ) zCCHon1N_?LqQGTm6KUArMrw)>;Y%pNy}+@0%ZbGGtt{&_){~cUliT9ByIu&#=$B>8 zMGqT_tTkbKu#u%Qc@CR$GKN;-c}owvZn#+#8TI5;M1c89Y(??|@g*Yw^tJtm4Eu1B z!4WtSd#R-i`JGpzdG4#{(0o)?k8)UE#>g9U%S@IheeeyLQP#$pHLD802#n5Y|BC1s zPJbKuO1S*uYHsbz@T+oh-aPDGefA<$n)W~&%T4aeGKYno_RA<>HB=V~<6apxP}jLf z4LDvw0W1G-d0Fv#VSNTv0MJAgAe1_!%_DsKPdZ{|3Rp9{5HZ~v+IihtZR@5@!*lC1 zim9~{xtdu0h@nV_9Y-JM4FYHNx&stilewFXf&qZRfMS;gq{#0jv_P!gdHkW3kOk2a z*B*RUf>S1SDrxq2!2DSmEdTuD{X}`cD5(uxkFM4f)DDl} z;1Iqro(13m5>WK@ku_i`TGi1< zsjb0ZQtKSJ7ksG@L3uOvD}o0@m!5pM$CU(JBwgW(u1!UlmPLZ zotipRhnw5%|H}pdQrT%FCiJ@Rv{POcBn^OiEO zpzS~_+NzmTnDDJKfNzzD_~(yP6GwlYAcnL`rHO&?GBa^4L*m|v0}yYL-MZYXpsA#V z+pLdy%vQjf%%!HJuax5*x#3%Q{UFtg7~qM7zEK@qU5xRsIwioaQ3r2FuaA_cuhW!v zOQ8_LcP&y9K6nSHDpB^=`S50ry5D|_3jR4@*Rbe3w8aq--!hn1vMul4yjXSqLfcj+ zHo&OoAh>)B1S1^v=0I5&wUbeR({T`x~~TXzCNC zk|xxtIE563?8=Gkl@?1vGRD{njqEv{I3-CjGPYC**|!j*1=Se)zP8vIvJI2%y`Py; zo!|Dp?;pS4Ij5PPnP;ARx$f(}?)xhvXVIjmN6R1e_(Gs+SSKwNhwFiuI*EkD za@CxxS97YfghrYO8aeeBv#xa2N`Alk*^WucJT~OnBHv=VU;CVtgxzV%xp2q%*?vZW ztaFkKv8BF)6dBG>oEKRXq{bL_XS7X?uF|EwSJj^xEUk{bzH}pzaG7l5jXy1;Xikwi ztmrtT?B9i^B?=4kcgVE9EjF;^m8w>!|Mk_#OUc&F^K{PZieU#hPb4Q((=0OYa)SWT z-E~Ujx+BrS)%|+i==J6U~uGnPwVpRW}KZjH+3Wbiwf256j8I0 z3#O|vpm9);#E-rzjc6}V$c+upO|i?h&a~dvp)HZ0?{wyrX;^ZEXm#_w@_oZDL9{-C z<24nZ!hD6XeAK0f?vBMOaSrkevmQBGTf|yNCFy^$usuud+oeMSRWBT#>UbF;&7rT~ zT1y?fGrKfRc&PANUu$RvGGKBA3Dn1gNz7eK zq8+>oybxCqeD6tn?*IBBfv#d|oPndii=x$uh-23?LrpqAJ7~tuFaw{8zEdO9uX8)( zPMmUV-}67d=1Q68H9c^f^%ecm$5#GO!N|!M163PP@z?gq<#ue-{-0MX(b?6*(e+8M z@aj3t+-}pXLvp$2{a!qhVm^(Rs$8RgJ1gZ$y};GG?9nZ?aUZI;Y}2QJ zIEkQW9ciH)&#?8I%#d(b_BmmsQeK-6}m(&`7nM0mR})KGG!@4xIRx$(b%1wCD0#&{ufi>$L^t5BZC$!$J>E! zx9?b6#mjcEGUyv|kD_d^a)*K8WyO!I*08?+9DqA1D}MF&w`G@@oI%+qK14CQWp>>v zo?Zk{K-%3{P2kgI(YJg&ka<+s@@?m0WguB46KL!R{UxHx7O^%n1$u?t!;4qFs&;dw z!#oF)|BFgv)YmYJJHG84z}T+3{?OzPp4Q_kOi?amXGo4Bn#>2i{dab9JOg2*YBNTX3F?PZPYWr z6gNR|)z5BEH=9ff;hsX8e1Mxz;yKr#i(JP3tXLu(^yo1)HEWDE3?h*omc#qhycgB% z=zibt+w^<}ZLpCS=B?{l3jNmM;4UR;C968yVq=jmTfvyv+6&{SaLQ_2yK23-M8#!B zvU=|00tfIUL}Ej~wTY7d^{ofNL8&x0{+5;Q%)5is*3iS$(x>jmV{yJGU1y&LO3ZrG zeW~Q@Lj|&8JETku5(+T7b|yxK066QjD>BeKA~xnp6g*6XoSB#V!bE!jpexv4M7`&^ z)8-90G2P-wMQ*g|u)fH)jja3n1drL^FJVrby_Sj3LmjT;ibMB;7^TsOatWJq{gs5@ zpRH?N2Q)j4Rr_5KKV#kUe~GG~=e(=-hXg;<>^hZ^hlx`?FxKxxnjGdEL~%kxHW!M? zp9!PbaK&Cdr}8*No0#4VAvPAsVNdN)!b7I7DSust{w9Ph8b9k~h^ ztJ{_Qzl=|_zl600V}rWof6_i=9%flK_{9;njZd6o>+?CdbhM#FP4G4|`JHDw>s3e( zacfwKW&2*_lb(A$UL~^S{TB`P)oYKoZ@Xl|v~tT&VEEiidpK_R@46D>i2FQeiqA({ zT`r0xRvx|FA@-VTUKxp=U!D@71ldHnsw4xNh3x-6G_W&E$j%nj5KyL_p; z#`!`b)j8H36EhBK`ER8?FI|v<#X;EFx-Oy@cC4v$X;6qbq1Kwfn0x4_HRaXA(4g?v z^I`@Xo+QSelhkF99k?awEjw;C8rA1EpN?hOJ?7u+UKU*yFZ6NlgW>~DmgRH!OCvTi zVQv$->l2rY$rh*g^-g=WWiXhT#_UItI{E82fi+hyeeb6C0xtPCzWg6V4+1adV+l*Q z2{~#0AL7B%{Xshp?CGiqg=?CnZ4#eU=hOju-W)G^*>dZj>CW08!{Pum2Xe} z4*iqwca>G}_mHG;7bQ90zmdYK{`mO7l>Cpb^RM6hzAF?i^pjNr`SRHHNTJ`}1+*XT zsrQ{RImEK*GB1em@S@XAqF_K-9&w~*u}~^j{(Zy#1uQZ z{j-^$iuiH%LTuJfW<<^0%FHkhzjLj<%i>(R?x1*LSF@f@Z2`RMGv9ppD_<+us+@Rg zE^(kDcK@v2d|2N%`x<*ZuiE3}DpgBH8B8*CtS^@Rn$scSwJm^IcGQdTw2nr)R2q!c zZxHHAPNt6LkE(e_^ruU8Su;R?Z2noDX*gXD(=Y=^vPS~sjG~tn z)>~`HPt3o5#tQwKoWXf#gUx@pI-F+gRxUKNFvL%?@SQv_(bN;wsC;DVD&^hOyllUy z)|b0<^6`Q(>2@Hg+*Tq#TZS)^Juts)dHFcQ{nQ zxOiExh0YGmAhH>OA9zIK`L2@}ISZA5qm-0$OY99SLuiD_rP8d+%zM9rLF_gdC3OAN znaNSmYglmO|-B-NqHd?vYH3!=ombx>m_^$-z_~h+L>K`_KOe{!j6cEFNuf z3A8VHYNM<%#|3^WynSKEAxW0meEJQ7rnN?$HQ)9_ETan3-^Dgxbwq75-BI&~cY}YY z&|w5a3wNj-Y=Z>>$TKIvi~5S|0XZ@a&MDA6rN56;MkNRPZGCHQ(|f#S7p`A47Rf zoGe=NsHnjTRXm5S<7q+tMk%KIhLZmHw z{NcL%A;dUEOAHg`ykp&FNt1v%>b+jkPB&9X+lo&Jzfz}OYezVjj7)EaNr z^TlWM@sb%@r13Og!<0opIu634GCh-18gy8I(n5- zH~Ob!V}-6~#oM1z-27zxXI183rsj{Wz2KHL$2X``2Jb>9`;gAv#eybj!<7hGrVp^9 zWL>R?HcuxLJKzYf;N;o2HQv#Y}~<>egnpDQM(SWpUMO{PFKEM zFjI2EmVacI?NC?FgMOa8IY=R}jK~i2X2o`| zbC~ld99-W)X_hZCnMS*?`1&!I#DP-%$Us zuGLezeSNAp$-P5B7IfFduR&7yrCICcGdZ(U^Ag3ej~ex=yR48Xu8Fki+OnLI&tR3X zPS2jSS$@IWoRfaIIAkp1*m5`(lz`!UFHvYb?+4$**wnXETPbwwwZbU1Qnw)N8Um$_5dLWdXnP>f>V2!adJ3c-};^TL*8-1Wg zEL6f{9wv0@ZDw(~&GcOt{wNo|rN0|6`161DpM zVnt(^k&vKks8xzzk2(Uy?v#m*~sJ{%w&Z0E+9AHq)NrB__^{)>ggeRw=~6} zyXAlz;tjOYDEKa3F~zn!PtpycaYTruOD?2v9xLN{)cy{J>JdRe9@M?|x&IZ=U`-?+kscSH|2za1;UVWjuV~;OG z5+#r>I1HADKFue*`jU5mpDAI0im^5XUR#_?KU~AtDuE;vS*7+{AlW$o_Yga5`{i&Vi={k@8COC2B;QP*DF*BO`|3)Ns&x( z`P6!p8mr}0u&_AbdunQNdJi>fDA(q28s3!l42H+{&6!-<#0ZB>NC=T9jzXxaD4gwG$(J#i~7;G-GfH`O_a{q}8HroG$MT zQL|0Xc+`4!%i&dAI);{RMOeYOJGz1CNs1UN!MJq0Q7!B1rI!Rvw>Jay*MJlwN4fV< zNp_EgP~F|d4=-(|Z{5MpSKUAE-u9$h!Mv_h!6%~6-%#zD!sPd`em6yHg@|hVb5SUO zaKcL2nVotb?P)LF20f8kubD65N0kynznp$LVqz~ZS(=iA5wX^A?hW9{U{eu;tKe}9 zU*~_chUbDaCxN31LOpO3N=vt(>CmGPE5Zh%MqCcoeCQq6#&?=SXZfItStVxq4@DmE zNdLhpe(@K0_PI&(ft22^^kzZ*lOkW{YRlHzp~GllMO@%oP{@3?uP|bp zkY~gV#|=oty_r8lnFJ#5*YvT{fJN*XW)tF{0E^f~ym!4C#TB~g1 z4J)|H`iBSp2u!M!2)8blrJt`LkUDWQvW2IRksV|TJPlO8?LQ~Eof<*^@yYj{u_g0c zzm((5Ka9xvzEtcwgoA6h)}joe!9DHGnkI3q8{^>ej0Quk?Ae9oI?Lu1;m5fsmZ>bs<$3#t5XW0)$|;#% zV{?&>zgnW$zsk$QJR5efuHacBFL&LS{ShG$1L5;{1fjc81H@?9*{Vv3x9hnv;nw`5;hX{!dd*#YN`p1=sM5BRh#a@7S>mm$H7T?Z zppFtYStzD<=k@Q8`{Jd1{*ZBXIts+2ZQ=cMvcXtgBW0tp`ddX<@lrWuZq{u)RtBp% zWZHE)=zDNe17su-v!%tj#e0d9m1n8x1ELan0-~6Xes|M=esM$$k_c;^h#wu!@)H`Q zUuEv0EPT5X8(Mgn`pFU1YL;IZ90;Lq`M+vjj9Z)0}oE+?{!x{Q#Pj+c}*Z zrTuVNJDW(9q|fCw);e5K32$CoU^8WBUpe`LZo(eWq=WBIN4@$XI*Q>F0dWN8`5`=3$qYdU5luh(!~kW@OA6} z%QvV6KJM$?^2nCQ;lT~ZFU;;=t-f#Iqn&K;Zee;ilnPf4SA5~!#Wu(mGwCX2_9wL? z04Qd64TpcM*pIJL<7Xdvlx1&a+aO9ZO`5}Idyq0hsKJ*V+~#!t+ZlG=@I_PsmF~eF z0cE1=z#>r&xO$^^FA|@bXn)u&FkL%nz3kO>LOZ8f??F>8j&an}WGd9w*CfYl_$x7# zQ7nr<9`hQ9f=&gQlw=r`K$|K{ODoG0ZAzsj1S3<8Q;aZFp+H{avE|8|pb7_Rg?CJ5Bk2=E4O{plQUms&dKZ4R2PgElNZ{_b$5NOlqprMxLBGP zh?$hK-e&v6KM{;g#cL*sNkZ=4!H>?j*-WEbD=7w!1Z*qdC|tw2Pt;OvN8RueC17UG z4Y+=zrZd<|3A%=C?x7b$3qf0Eos>$;k?O%HhLpK;ZuBU1d8(nc z`Yp3{^)AJ_?PoY*tbH+3VVB)ebv1_>S5zgQHvhROS_;@Kbv zjZjPSvc%#IzD#{@rSDrERsDZ9y}jnj5drm+e-YyR6ZBUEoXd<~J=tY@m~ANIN6YfL zf08`^GW+olcmgOwo5ulnJ7!zZTL08N@B_5Mpb6OVxnC=j;cMk{{M@%uJ|Slht&IKe zx?%+7rZb9gaSNwBQT?FOL!ret0R|!FUBcJY)bPIvJi(X|9W0>*9u6&V0p26+B1Roh zKOkLlX4(8xYGdBnfQ*h5$CI-xj$B-sS(xW?@B$%q$1$h?)IY#yIl`dH^cRB!p#wvU z;qtDmtvi5JF@V!Au2vRC`TOp+jG7}%uLp;Yc^yEfL_{*!zq12sRfq7q0HWSP<`KRd zH<;Kz$j>MU)kV@r#j@JsyK2S2+I=Q94@dF6+y=!%I(oSDA?!|>4E~bEw*6AjbHV&s z{~g?JL?wujthwU_=EfXs??E`Ii)c0YE~UF*=b2c<#GH1h;Yma7hD8_~_lS+#LKvz8 zoHOJ0`Vwsa@T&ARGE$m6MS0(ORR5Y)NFw2Sao?xWM*$-N_Y4eiceqvM{1Q9y*YGOy zv2C`6<5}|4Xy#o*%;7?o=FwYtcEm+$s6e6)whK>d zpo&dGSyCYE7wp_`$m8G5CV^;XwO$rR{XDG9ab*v@0R*_TP5kPQ_1Hl_xU=e09vi2q zoPbpsH=R*AT>fdImcoBCyS+o}goI6%tE?)y5$NTb*qOF;XVRPPDrisyp^6^grPcvbAwxMVXZNn(s5g&MXjKWSX*ZETNc z+_9NIwy)+r{g(bSoW{7vq$;(?Yghzd8d_@Op%haWZR)F)li!?wSqt@r=TG6^US8-Z zO6t-hoiX%iPfpiP4%G@deIX@C>%izXGX?snPPE`nDA=I9R0qTekNwZzYF7CRi$Q42 zU(E;Uh2{#b(oB$sSm*u-p6XW%6F|7krB^@!=kA%k8tz*m5BUZq5!3WkdxYk>Ai$Y_I|LPz(r&Tjgx4zK;@@bNmxLFc~|c> zjbFh%vf}BS;X`!ZubRn!yy0z(eCv2ga?gp2Y-n`l>AKctCd4ut`4s$eJ!c=&51ca3 zMF*0oM#JV8+{<~=Rsb7K!0`-WX?S{O^UsJ*MkxMAba??fGAbYQ$< zg|l~(+7e)Wk!0U|$3V62WtdzR-jV5Ac})nds3?=zHns4qFSe4`ZmBQJFP_od9%okl z%oViZ^}QmkLFPV%$yq{ObkpoDasFoPTd@Hmb-_$e`=Q}CS~)p$p}x-Vd8G2`hP%E# zNqx?GizsTEMTb)x;l&fd$hOpEVFg^WieCZN4Nu16oZh%lK73YIa#D!20ZBoFN5^fi z-5mbDVuxT8O6!oLT+g}6B&G6;>8u{f^K zV(PZ-QfdFlP!tgvJD%w?B4IyUK!c9(csFdNgQ?tSnv<E&9mze2OxFwOWpf2nJRY^AXgaWyf!EYMLbqq8)y?miOeE~{+R=S zmh2dxr$@#3IpCH;lh}>{iyW>_8A7sPaQz#m|F_h@LSxJUTu|sVpLvZfNPGl4LI$Nc zj|&!hEGiJyo;^gNPMLZiFHX3L3ND7P1Mh~_ZqOfcF3DVphsaW|uG7)Vf?S>tnQdUk z?aa*h5{AA_I{SIG1ObeaDl$a+1yi)QOVVZ#zvXnx^e*QXw#znn?2|;g$1U~=)TtF( z<_faIDTDiLEI+3Ts3&2IK?uQ0!)sLh<0!k9Ntc0i0M|=isW1T zeR4Ssy%p;cNB5qI-ao6D!SL{8`6UMz^tBpq)E;|$7fBDb3v&X{9q(}^vWD(#R)JIiTYk_#F9WZC>5w5kzd)5|4~}|HN|Vo`-UeX zog(ua1_;n|yr3v+=;&Q!G%9sYT!x<*+GaYip{7ak4|fi!7H$xIFq$5c(-{rZ14Q|H zB~r_Xvz=+OR%x8aK?ZQPLcl(Ha`X~_;Y%bT|&U-hti?4Q8xSc5v&G?qP12$;+Jovb!_ycc3j4Aq|b_jD1vJd`rnrD{k~>Z z$2+O9)xEmNBGF44Q{!Ch9?;{O|MHE#d!L1aQrHcV+DIUtWJJbpsqY7d)c2~$E{l&N zjv6DhDPlx}Jt?VSJ?Z1qS%5gacJ!+8mQgSKdza+XFYqF}(&*>9vk_G@6E>|4Ld-4yQ9B~_{+d3qHk|JGrB8%P#k+UD1LT=~*Ab62>; zEXT(wqt8d`?q!dwb3PuRh_G|8z6~>CzoY$~8R}#Dm!5o$p0qrE{S@9ZsUUrRQ-vKSmIdZNqgJm}W|6jA^$=h@yNEbTf$8sM5Ka8b&cGreofoD)9@2+PQ#g~sex?a<_j{A_O z*>Ku>EmGtlc|0r<3g%ct?RwQ1S!5@zAER0XCn_w|a91e9IDnjGG-V{FiYuI%dsK07 z!6Z@NG$YIZTY)A`|L+QNdlSY{y1 zNL|btX&!&?kmfqNPRVfRY`b{-@sX!OZEy9-NW@B`5%N*P&CH`X=RG-2$L`?56nX@KFrq@;#ENIY`XH;DSM zpY1#kLpt#_O|A(~nj)KIGcR<;G6}CxT%)-fM z#Rm*}7SPwWp*^>z`SCbsqJkq3W?uiX)8vWws0-p#r&&mU6;CIKLu;crVj})33l`1% z;KSiCIHNj!q6$GT=DZzYWg0^ue)>U%8jZ+M+m&@rt+|HGyEn(a7R~f}T2irY z^mDmj=K0Yg1$@ej)^`4FVwq;6TeITV_E!A-CWs;m_6`_2t~(^dt~LCTls*^2!NJrH zu4t@pek-vRWYZ6b@};%*LM`E%Gjf}4*W^HWv=jiushhreXJ@b|B$q2kM=1uB+c^;{*gs%O~tg_-n<)Jx}lva;y*Ilh5 zm5+?51&!n{Y>N_ul^2eG&g6-1WtBc0ocj<#$>*q#za1@G2f3@jhod5(d+z3@mieuY z=ObnMzPp1yljZ16oQ#RjLEQI2INO4vT`%-BvMFzNFhL%ZocpgojU)stJhw2cTI$ZW zTq!<%w4io%cNUb{;BPN#Isf~u{3{w0QlhT$c)vG-G}G8~GIk46issNEHb$J6wXH5qvr9_c$LQHD z5cgoE0^9c+AWNJ539|+;%O=+Cb9CzVfZr)2uS*#=ExPlVf>%edjAQ{V+41>d9FhO& zIAyA#VJme$R;11$F2zK1fNrCZ?<`y62s@5q#mK(bl&? zGMSF?iHG^OIojl>92U&?DaE$Qsl~Ucs#(Kcz>TMc~``6yW{$i!Wm<#3uPjuf3;Xey1kRa;rb9cz#RZFWEv%TV+@y5-8%wIgT%yk|sXXhvw$SgvBXoYN?C$rw^y8B*<>p3GO6Foc1b5EY@4KWtXhJJuB86e@Ip5$ldpkWi$vVt z^D4~=cW&+MSloBVl`6U7jA2B8MY+zB>(~0v?yYrTr5*QCOO90Dv8W|0-0EWC;)y+cCKAD2NgSX@HcHj=se~(XL4)KdmS&X z=PWt;IEpq(@RL|0my6{V@O*`!L$9wbfrTt3ZxoXyvvGL7fxVxtUAQNfOm9P?6D+3J zq>H9K^e|b8t4=6r9_YWW4m$QJaq}Qnsklo-CInJ5R*ZtQK>sUCB0yF{JQyKNklns& zZ_90aSqpJ*s7C^pXZ1N9^lt&x2;T)EStzO;9c{FwPdAxB zm$IbsnuV)>UI<2D$!lOO>_fO)giT%ZZn(2i=zt{Yvs@qQu=O61>*wxD6wX+cJ>1jQO)9eY=4i>j2eEUF9S{@p^|%F z*35U32bLaqjphCRz!=-AA`>jUA;9>=75?Lr_jZ;mg!0>7{o?wiGwNM6HZCf9Z}+9P zC(m!SYv1|p#_JcxCq6uJ*!SSo`v=Fbu35)Nv25-xon2$+q1t2Uud=NTCAb1+SLNSCiuAA6ij`dIa-3XDauQUJF#n_7!Tx@&|r= zpi*;2q9~PrCbkeCTc_emq)TPmKJBXQ_*yQv#%sPvDzjjI!y}4>{&@-T9pOjR)3VyP z1nGi@)KXe-!9|LP@pV4s?!zBjlk@HxoRQEldb^{eggoL<==0L~`OvU`WF0+AExyEc zt8QoT*@oEV{!l?~ zn`DPIcCI0CaNOX~{^RHw!?Bi~9=>|6gL+Lavn^wdql|W8%3S1I(p%R+OrWsZWe@M~ z4J5{b#nW%&I!n%7A|Gxo^b}Xv2*slHW;KTut3^Y5`6bF{qEJ5p<}%RxBF zKNUZ*Ma~VM6i9^lz?LKBP2GgMW(OW%rtFgnAfEgp#a=#^6@UCUW!A(e-$~B=9OiZu z5JLa*rhirX{qoXT+v%rZ+JOi3m<~o;QEVGA9+*Y~2w8QYcUOd>WJ* zxJ1|=2fJZb#%%vnNrGtmfV903Pz|R8?1_j!KdsfDcN7C!Kp4M2 z{(U+tUQQX2_R&&>R&8Ug7J*Ri@Vnn?zCkt4@&+sV-+NvM5Q;`G%yy!X=#YwG^^0H~ zTn95wBD~u|MLJFDA-aa7lS}EFm!4Xu@4IbT z>Oo}p5=f&4vFj#%dE7+&&*{*<2Icn2H5$H`%uToNJ|Q4Wo=u9&?Og8NLz)=kmc1!; z*R*?iL51YsW<@Eo7B600qbfK3PUGo=j~@ahZZ=qximOq0-!U_AyYZ;2Bei*>N;xgk zil>^qKZ*0&`}R?mJ13tekn3MOJF8z}lJg?{puK5wqKVx>v(wpX$CjTat<1=S;G#>s zy|(G)`dQO$rnuc%^|QsQPx%=@_gz{3Md1L9 z^3)by)%C#Zxz@ODrMwUBSV~K9DSD7(s^Dn1%;_c9jw(^P=wOstkTK8cRa{f{{_=4d zS&YMeLtc9aXN7=flQBgzySNfpP@EI<%f#qgbCho0i%G$aw&5I?xIsQBkKTXe1#kPp zA00HMg^_A<7d;zpaIo~d{>bo<&ionCz^O3thbE|krn^e^-M$WAwAt`#o|; zj3nP3Op0C%Zd05zFcW?hUKPG}@6DWjHI1JhKl4maQ8)zf#`V$(nd#s=Hr@cSZa@9{ zz}isRl0mnZ!jl+e&(CpP#*M!Frrdi5(+8GEXMU(n)hz?TyWO`R5#jdVxU2T!t%{r_ zUUa*wwZ^|~O+#=6l1B}a|C7Wp4d4KC+`&hZ^*H>y*$W+NEHzRO{DJi8i$}`yOHjeK zuozZU8s6+w;j^vBEZX<;CL|#i__f21TXyP|L!9jJ#aBBxOJI3DjFKbdu9uZrg*5XG zWs<-_v1F~<4mi1EFc8OVws)Fr-(hO&Fete^IC*U4T8g2Ng89i?``2-H=(5^#moy68 z#osnEON+;ESFiw3Y8LB}Dr4h(GM2z*tNB_lLTyCrqcrZWy^Yi$%tl@)?hJHCsJv9PWG>Z4_n0lkHu^4jB zSr46;wx?6RF@OjT<~V=c_RUJr?GyzEbNutGBj4a9R{I^OjPj^MSRp3Xl7k(uKTZZ> znBIVDYOumj--E4V;@~ug`H%K;3*nrN{vCTWJ3#RM!i?B(r+;QTv46^MW*;Rmj$sMxgIz; zrJNp?XWH}Ht1bHCAkP(0~Y(+Ke|R0);J?ab^%_>b*9*}7<7 z)gnuO`|=S{QlNexb+*C6erY7mr{1MkH^eTbM%hv@)>A!acKRq)h+l(PoTw%1WveMW zZ>uSx0f^`|EElS~eFy7s34HiW`I8#WuBEnX7M9K-`HRynKK>;oM^-=Oe@ps!x$Si9 zLHo5>3Q46<=Pte4b>v<5rPV`sZW^T~iSJk>JZVnqPSX+%#K<|-s4m9jKiP93X!RDY5BCGP)&$;*oWnSOuDWB$k1R5q90deVZzQn@}ZSl3#8Q9KzrZwoJX z^=W>6_rf6=dq&9FWJ3yhm=#sv9E1^qJp*b@a^`aZP(hbox#04&2s6s zUtAhm>qSQ`U+v^nL2d|i_h?)Gq7g~NagjH3=U-+E#T;Po?<_AGufZ#CCr+cmsW}Sx zr!s=*qLDz}){|)A6j0zJs~E8GPp0ao(lZ~n*BEZK$Y5*pR}?ra`{>!)VMMy0-xKzx zwl>@wH<(=#3)MG!u@~%@HUNf@mh1c%!@rEq|9kYtw*h0{3vbh6;e0a`FMx~XfB-{Q z{bKMN*fUbB6rN5umvAq3fA8+|9RkDib*ErQqfHfS<-_yT(SM60URMOkb z_+nqDOU1T`|I%KfHpy@?#Sco_k2B{3nYBe$yl2*h^e{m4^QSI3JYN;hZY--m?tn;L zyokQMv^(=E=dA{-4rh(16yEBsUcYk+|NakJgxBH3SSUuO44~s;Vq*?oo(JGe7;H#R3 z5twrEp5dHR9qYk*5T9;N%&Ze=?P!TXCg_N^Iwb$X2Z`51Ym{ojG49b)W}_+b^Zg%5 zlWuLNBX>5RG2|_%frM;CO2^Tw&$d?rbnI9pi;aDsc61nQO}G7H4&I`B{hdOFJHZ>Qdsa+|85gyB1fdT zbAI|JarkQ>W_grh(Nxu3W7gmBDv`Ksc3{E2cX?Fnu-~L+%hJapI>B@$?d;0zf^^ZL z|7b|#@f6P%1CYAAFLu5o)ZBnR6x%OhG%u~7Y7>i8vgGGN75g!ZZIXVclVD-pP)4e* z<5E^U?JQ0?2nD42Og`!T?4y?{wT^Mfse4Qjehj77^k~4r$no5syn1jqbvcdB8n!+zy@~97hmD zs|x3>E;R@{z_{P#Vtb)2QbB@k3}+g==~;(pRgb zkEo=yd5Na)%p)q*j7wb}j~RfYA*&vj89Bm4#+31x>vH4Kjc*WWFa>|RtTX)dj zpV5{%VpiX}Ps6z{C7xh%D(X*zg)UEA(TgmF&cSe(S?W1d@>rC)u3Zt{j`@>q)ITdr zNdEk>_saa1(m!=(+&c8mqz9Z#x@iX?7S zGoEtGFKq$T*qE022=ct9tdui zsArW0|H5*W^u^LN_xMiH^B*yne&GJmLy(s?t{(Wht9I27P`g_0coj>kJ&H_oGOt%2 zF#PRgu^lWpYN&k<9YGnI*akFS{YQ)$l!f~=nAdzH!sDQ}@|U`nBvEmQGK+&V<{t~# zN{kQAqG-Jqj{QGo{;7a-oMLwy-B2&s)S8QOOehjfASE^FjmLb)Q|nLYQ=`%fFgvzU@o|KU`$qP%=A$=CuXiSe5Z0@|4U*FLtZ&ueis`$Kbcqs3YWWISZZd^H{ z&!>jhbnJ-Q^Q@A}FGrMTPM-?V3&)fTo_i>eN9*RTI@5uqvw~9lu7r%8(aA`HlPywQ zc#%G;kh9I_YU4aM_10bRNlF<^qF(WQyYZn}Yx-!+p_ zXBW%-7i~)N4ik>=BkPLydSNRi=S4T#Z`AiY;o3XIYj#g%;!(dv?1G;pzknDHP>R#jN;9zW>Vywdp$y$}RpT^Mh$7fWFkN;Qdq~k{_6b9{8A- z*)CPqo__*+t}_pr+rbpyM&$trg*z?b!+1fPEN1!Y0RIpF=K}`|xH55xXPRrpEoirc z1=q6{G!_6DW}R3jh{kihJbe(xoF?SMB37u|S~PfN$%G2b^0&gK8I~`0y_dV$!u-|M z3s&mildk@EnYgidu`-6WsSQy?YQSGdzbOyeUCYl!`k;TGamwPOr;Z8GCRw&Uc2hO) zlPt`V&30U!I`AQ(zk@`^Ers_LlulX5a;y2AaP_9IqSU^-Li{j%GFEQ3Whgi)KvWB} zC#e#nkyI&37|H}DhuSS;LqTf8(!%V7X!Ky+!$6D(3HI%L4N-d$X`+w{XJXhDMyKP_ zn=kJ^f}4Y%tFrJ;Up17R=C+y`FKmvPrDm~ve z)bre$xc6qm)vxsu)=39QZ^Z&60}a4EHUCHpJP##e@?m|u;Y=*QsZWzRM!o>RsGY6_x z1~cV;xE`!)+TRio2z#k-k`tgVWfg7yV?bQd#>PVm1IuXa+313t{%^vp>#G+qm0E0a z6yQY~`3o#iV6#PLM*)az-4eN$t0<`KyPT}o@sWz)W0IJXYlE8OXj6+6lXLh~QeW;9 zhMi~mt6pS zD06*X_{=cdYYH|d`c!2*Oqz`XEWOepF~TGS>Ywz7WGqJZKkQk2(H9Z7xRtsX2O`Ap zg@-Be$Z0uA_e?(~h1jhX8y}}ZhHX&x9)8)^dR_~oWw5hxXSBlQHW{Pp$v5v~mEC<@ zji>yg=g6{NH5*OW+A`gZ`u?>lK}#(nJd;Z@Yv zx8WdT-^IWCvuy7ftGazrrE-gowJ5_&lu+9cyNXgz3!+q~JaM3wzY;@Mo=7FtEX)NF z)y$WANI^rAx{{K()AktMr$mYUO5b{Vc~Q=65*aXy5YTJwpDp-uxcwdBcw1#S9;cW4 zICK=?IIH%qf*q2>hFm&!SIc7$63-k+u z;*5Q9LIh-7cgEBZUn>gn@xfkP-HqWrgmf-+5nB8}9PBhh-U;*R>~xG@xeUeECX#Q( z?YfW?PEkFZr+EC+0E-~)<^n>@B|O`stJzdE;xxfE*Z?@T?7wZr8aM zv}~Bj5NnRuLBuXOAC|;l)XgxhmWXRoruTAVLZZEEr3p_`ZliCRD$>VPJ22J_;V$!f zHnXQ^jKpM`{FUdi;xw5;07%eQQ{k_MYW9KMe zNg5WaPRXiQ;}R#iwInO!7Bc%^i}{uM2+zIIlAZON&>+p1P9LR&W+0y*v-di^Q72`cV=77tzH}w?o{Q z-L+(UGTWTno7DPNhE`z!1@s18d)2!)`aA8i%;snIJ#g|bUb6SaA}cr9vIRCEOtCnd z$U21%rcC4^F%iBNR48j$-URq}VZXe{NMW^&3osic=6OB6(ikLqGoEcom_oDJx-L8P<~4yn4wFO z_1j;A9(vH9QEy>?QBTU$Aj1F`8|zmwIp4FaLKX2IpY>AiS&mVw^`0d!9F1LG>RNux zpsFojqe}S1pT8>V2qRDvj4@u%RG{{^dhl9``JRwtSt}0>U~HQBhQ*pZI^o+Xj74D zJ{P8j#+O3-CzfZlgM2+3;}%|zD**nj|DGsOdmIS>SgbGHP23$ z$uBY_=ca1>lEk7E#Sjjcb54?%r3{f0LW#1;CQ}lP5Bu?Z?9$~Q?o%@ur}Z2qvUT6! z6|h;Kx7yY};j~Dc$P2o}Z>&IT2`epDu;JCMJJQbsye$0Jc|=wl z{l_V|MO}e=0e1dOTkK9D=`JXT5lKFxCHMtQQW1)VeGPV|eEy%L#6O`dvf=t?r5A)U zpO1OQUiGT}cosMouVp3dy4|(D&-#Nkb~Pk0PMx|sm;?~AXpS?^(l^WoP-Nct3D|q} zD}m`_iQBLhNhELrBdLy6b*(JZK`Jg}4|9Lz;^Oqv_t`6zaBT!QjSnL)r*=`Z?6U2c zD57*MX*=r*geBQg)c7LPi3V*}k{RNK-@lzylBuPr-IPGDWHY`KttXdwcGYsj)z~LB z&RhOGBl4df`28aJf$~OHn!KT|1`iMp9jlV2tN6zh#0MzH`8T^{w}xLEI6r`is6S4z zhhqnwmnO(9I~k3uC~skL@fk5q$qt`~v0ZV#P8zy03H1E~8B)>8JH!ob1fzu;Mq^S< z5ej32cWMfQY&e>=bH0ByDYQnYc7blOklqK!yJA(%TO^tyBwElp|aAeK{Q2D+zIsonuMa*X-Hf>plybndkZa z-uI99FU7gsSGnHpS4T zxkA&^B_?6EB^f%(wnGJPUV#(!!;FpGAJld2wi7E!%kFUFS^F^4G$)5w9LeMrNMu7B zC<<8gToKUYPtZbXHIBijm1-)MRfOA^Z7nVR(V?c+*Mb?eqzYx|qXQdx*WLK+0Fx0S)crxA_W0`^-C*RkD$zCIbkLsloeFmd9H z93E;xcnCPcpGmn0N6F5Re9A55-MY5_NmbEidkdGHpN4Hk-eVx!8S;M(u{Z3dvSS*l zlms_velrQ_4z{{6>?CDq-w~EUQbB+rtZelx?Z6$rqGq9TC8GTi zbzSKH=RZ5ZG=3fZ1^@ zKPsM5%{~TDXuM0q*=Vl)4liluZ)LTF%!n12=0q2SX6W`@$+V1gAGm{m5XG7=X*VjZ zv)mXJMtEFqOKDFW_hmuqtuT;Tn>{W8mtjE=0-a<&|FgLMSE^D^3IqA64 zX4TA**PN9WhcP|Phvv`E(CJAjNq4bdx{r7mZoYmU1@MA<7OZlaUEPY?6K>cVF78=y zit^Sh%+R@vlv-0UWy%o3Hlw3(lB@m!mY?do&`i>9SFlsH=Ai|B9xi(a6)>uvw^pFH z7c`O9)9##Z?rLS`smL(&U6c;itW|%*GzoZowi8}EkA;oUX>s|y=?)i~lJs$D*Nc)a z`@6F0ji8gmD%+CBxJ@kLcrdQ6de~PP+Wc|(GuKN4bFN>W#Vk4KV*>~I+L|ulpU1Ze zzsM}L%3fOZznB`z>u=iFtd{fPnPYgnUo4)!+;)xep%%rw@9?%kI6*$zBAg(5_qU&Y z+Rbu8*X`^lgU&AIX3C-hTbUI99B72q(Y>334E04p_g4Q~|dxC-<1=+`LVRn0(Fk|PwA_dt^p06lDqmX#wO z3ldeECvUKYldmoKV~ag5zooOwc@_nu2U_@vl3*6xdE~kcZC12NtVMTKND9>K^wJGT zEfFU@wG>-*h|+eSgLM|>Z0^+%xMV@P1`xKvd^(d>iK6{9nFrhWfZFFwerTf)G&`EVrJ*L@s&}owKLz_0xU18 z`0I{eIXjgnE#hFaaf8tAAt$dKU=nslGAL2fMO&@db~s|lSJ=5kyLEi6F3Y6%x{kfW zvNT>U%I$-l)B3Bya}#_@$2t5q9ygN1^yR;0`=q18-J^S~Yfifco6t<2ckR07!slq|kOb;w|TZS>FV+T1<>G2s|{)$M!H4rhzx?^~fv1>mf9D-Gq~< zP-Tc^GtS99ee#nN-13k=DJKG+zh*V;T8KozTkdU3qrfYRAmtQda0|`D|KT&_xVN<9 z+HL;xuuX4Wv1Vp-I#LH@H)7u7l<2{BhFwn5e`*DYHYb)qrJ^VKAz%J;g49`XS`K{&CL8Ib%$dOpCbEUr5Zsjx9y!v5mX#GQo;jQ&hpo;Dv!uC6>GcWI~! zU%_*}0ZUHkDAE%Jh5S?NQ@Ya| z;^I&^dTOH(`;el5#lRvz?1t@Q+BZiFHP}U(2&UG)m0DB43h}uJ*A}eO}zF*hX zzZ*Fj=;0?1xQt1+wZZRaHe=y!EqDY>gM17VWWei8&=Qv>RjiLSbWn+K%N($++{#RI zu|Rb#LCRTy&N3Y0fU+{L&{CCsX=u4{eB9-ZYu9;Nc>UFD)NJE;>sm}@)0>MN`8Y1e zwlwo5?x_iAGBo!LSiA8LRb4N?h<+y!&#JX>aYzfv5K6m_?5j zR(yn)YRmA&nS}&-49F4^n{9^tai&KYt_Jrb=g>rdTgipz-1nP z+~p-YvrkicQEMt!rpEbO8INFEYG{gt`ahwkVWD7)$i$4H#G7)h`R- zH;-Jc5zuAzn3=LjG4yP@wY2?It7n0(co>nU9LyyvjbGv0*zsHhorL2~OHZ(1Dh(zPj7 zz5$DL5n<1e9t9rmnsW-6iV)r<&8&LQJv!GnUq}GFkd0FN&^Pq^+r4jjsxQ@@_Z2STOhGqNHWdf)ZG32#XvKrtKm_I~O= z20+m9OXLklPG6sVlBB>gfHt-HV$4KVc-K+@i3AVH--hefKFwUFsD=Y8Xy}j!7r=gS zP>X@?gw3=EjJ*^Npt%o`OOE4zQW_WEe$?S>g@`_?`!k!aG?^)Ihc_L9R?8B2*x~)w ziQJ`FN|(#OC3Oo!`X+CFGRcnUErz1$5~7Ob`gtaVX;9t*^7Rfi&jiozb71wJw>Ebj znv9WIv0Y!*wAB4-syY#@a%{<`fab-hzP^Q})z_s7HJdJ_0fErcOc$xO^RtF!^K88I z?t_1sj`!bGv~WeKi57nNfx&+I_~$?T5M35@US7ddX^UV{_3*SrT6q@MoTwcFWaBiZ>vo#9I&+3us88+ zX-wl%@({ML%rgdmh_^d#!Jw;DGp}Bcb(KmVu(V_d%1Fq&u2OBp{Jg!d)mXk^YVtv5 zy6jZil>_r}VTMYfEg`5p&Bip8TI8~&Tr8?5-CDxT?^gXqLRFJ>*{xcEEdhqb2E!lk zPFwDC;Mj>hCey?rD(307n7ld<$s6BaN4-u&A*rJ7Rxt&^xBQpd`PqG59~Uk7N;vY1 z^-YfVzBWOpN&ORVe{yvq{Ip;94}o;PWpPklsX&N~PZIZ{!0tj3K%0F#Zvxb76yPWP5+HGC zb`b|fob?r;ONOk_2D|~W#(y!kAj}0>&I!~%%%8=-keh%z_c`nVHPv!gsy#s^ zBL7yBmUsw&YH&L3T_V2DBw=d%>28r6l0UTOxn0p@emIjag`G$U{CIdwr5k$#T(BFt zfSY8^P-uMXqZKi-eyd47Pq#TrRH&Y)st&21a$$6och`;ZQu+5DnWgon`SsMq&5Z-* z*~0pkwzeE@(Pz9D0w8HA7Tds?a<`xkSX9rrjyVE9tP=hJqhXf&T(C?glh@=~1R^px zq&(hM>}6VJGAwZzA8GF~|&3SpaU#WuP+bp$3!NJQy> zrd84;R4Nw@yY;41o7EtIOq1TQvv?__$!9MY`an$sUt-ACB>BDKTd3DemrSeVQgFS6 z=POTh7oL&?9i;=I7gH=U^rPCE(bY!i3d{6(9h+7@KZ^_YQhfadPEsa1SK3f{xi>6? zwNM2U{(7+@Qn(|ww`1Sekb7!kI|&}e{vuJ4Ys!ZSgdbFHiqiOEEZc&CxqWGJUSk#n z$>@x@8ff!X4DkiH18}{ho+Y0)g0-zn$oVRCQY@kx9W>M;GqhLh=+w&Pf@U0CN`6pT z2jnm6Vq*e4CLdrj%Vq$|3N@Yy2aVWD^i*qUWLiSA^wLS4>(mpizurlNv8*;mF7tr) zv#BhvA@Rw|Cx|=7=4qu72B})T+}58}R1;_kzjk0hcm6h0O(N$&q`=z%G1hsu2px#h zzV>U%)2FIfb*7T6VwRQNsTr`utfx;V5E3z9HOd>@JDt3~+7} z(mfZ$>kB7r7&af4{pE(;^@Hx&F?|Y1;lI|IAwYHFR4Z;bPPyBB;_w*GT2w(aO!xom zT`+-$AmCaG0u-s?!haFULkeD$qLt+KJ$mR@hb>)ols<*}_!z--BWFO$T2PUNB?IAB z`&~%4g?mQ6tykM`i!1}6G{Z!m=i!~9;pxY7?)Sb5v^5&5|!2B zv`DABg|#!bz2_rWyWWh&V1(j**1IA@2sOQt9M(JL&Iesdg}icY0$n>4{;9tmrRU-IWCM+4#I}ypbDo)D7F}#4u<6{jOg+UI~ydd)c=R_v} zvM{&t115Kl-4@#AwEnT*INRDS<G>1mx#pK95T)RUtII>5!Nl3SuqT5V zSOmaiqJ%^w!LIoTf-oe32lK8Y2s)cyE3|bJZR&M&7QV_fx*t{iEm_0dug*4TvE@oG z`_MyM%&jbb$!7WK!2Dd0shB=CE$#xo@l(#nNjryFyw-!~u{POnT2_rd!kJ+Se zy8NgKu>7cU6gymJ+`RZI8PG?Xyt}c7l`LTXJTgVsmorr-!S~ULfv`sLu#6BspMWft z@r8wk$K{y!9&%CZ%RD+gmom{A38@%Y?9J&1Zy`tL;kKA5tA;r5h{Xjp6-9`kbXJY> zm*(2Ky{BUGA}&x!tRTaBvmc@crReVmLGtdgP-9ZB=aVWf?F|M5-W*AiYxb5t9?15~ z4LNAWK->%^O{>(mo0T2d?hCQ#L~3TZ&xF>lr2_hmD5vb0ddb)Sun(|S^mi@<2=t$h zy!E2}D0#&w0z5}Jw3YaDSG<;p_}NpaPNHffzupE9+HQWf!POBad5U$)Tqz5s>@J0m zjJhLiuCV2V_yJ_j1o>7X<^jb9V0UYVWyi59J4&6#M|QmlnLPzc__aRIj^*rEqz3{W znJ+9*XIejqG;(I_*#LTQ#U_`uLm7%wR!p!?jfjGP9Sv0h`zVuTQMh}&JQRu8>I4x_ zfDFMgF@Nfal5U^F{zd*CcH(nKiqH#>Om?3oBPI|-0nuFUV%e?GgS$Lm=1<1onb@P} z(cADqlq*GjoV1tdH zH@zZD+zhm9N`>6`cB`#Gs8EjitQH%Z9sCV`euH|Rh1RFMv9A}47OyZcFYAQ;j{W=9 z)0&}-iaLgLxA-m(vjx3z)k10@d>EI=ZnOJ7mo!*j@1vj9;Y)#XKy1naC zE@;ysylSD9j#VA{$WmE2G_fJVWf;S_Duh<#z7A8F#k}{i&(v4ZLe*HjYqUx?S51$E z4StHA3Lz6GD347_85F6~w{v~MKa@DV%Gyhlb$9cp6L=4JjOK zg{9zn7>Krfp=R%^0SX9YzxV222xb$Q0yb32^>SXH-bAt?vqOM7nP|54UAhm<(pB{y z2#v3KE>WH#Iwejk5ouF~VYdizNiHIbKjGLAK_xrAbn+3~q2oq zO}tSg1qpEPEe>K*8z5Vy^{!(Nj9Q_z{p;2p>KHI$WCOA78ggWc59zT=lUG4Osnr20 zKjxM0himsyIsGkrJpK6jaEpio-h*6fGm{_B#(SKT;=rH7nijNbH^8Dr)6*@yjFvB8 zDJ&WzdW4a$e%;}meSft)Z+YTV%aoy~7JKVivWmSHZ1C%hdr|R>li6J!Gs^z@-1#t0 zpUv!}sp78(Q}L(=LK-l#Xi@|4RJ=%g!#nQ+WSqFn<01$jZ6s^1dLo@AtN6-J{4=wu zd|EF{_1Qi%ud}l<>#NSZnek;%-&G79o3FuKj7=!0rpb8~WPGPIBU|{7&iLGvg2+(R ztVNHV6doPg6cpc~+Y+ZMg!J+BY@MxE%Bd;n-7FrenJ7sM&88;TKN;k z_=3=_03;zul$Sr@gfqX5Grk5je7D0#>bFYw|LUCo^e0&3v4}Ht7o>=O{smYrt#%Tf zz=QMCi%eN?qKi0_hLl8Y(Q5C*H{UK1#ppC9TInwLWnuqI0C9nThCX}4Yp0YdsHnDI zCEL-$H$fvHvSbshi~N=xU`4>sJFg+6>s$>Pp0HK9OI`*5)2C-a{miVACVG1yf6J6y zbF5|_am2Sk_-!k~>*;;0z~)o$_{q$;xati~y<`iExWh_Pd_V$dS}kx%eX+ay>scG= z-TK+ALcyClyJJ^A5be4WhVLGyfauV&>^{it7GfeSkPE-`APWgHE=2i>4f}EsE%KlxGfO1Q^&m6&}B^#CAPLw{0&ooln8piWCj z;v?Y)plyJ85x-lS#w4zlee|VNTyo@*`kC627RhhGB<3>QFOS;z@#` zA*0HUS*aUu+nQlV_OFtu=eE^4w%XaJDBBq&1fs@KRgZ(NZC)d0>k1th+6q9O>e2A!fruYEv89x}r zL~gCj(RjPRU?DoTWq#Mpv@zbzadBXmR|1!4`^1Nuy`hP!)`LOMKB_`QCM?LAB4kbB zS1H>^8~mwe^qt7oZQ>&z(=27b7OA!}hxyHyRN%8>EX*H{cUDF<2SG2 zr!VZl(IPx+@!2jtFM8Un>3yE00N|81MptdM={%O+BrK0#!^a3!@;XO$#eSABy6Ev; zA~v*$YqFJAi3WW#QJ&8;y!MTnX=Dr(yuV!00PIyqj%`L76DG}ayeXC?EY0#$Q#r)( zIVLwU;yRo;ADV}jK%HWxE>yU@UQ5dUR(X*3p~LtF`$gTSR{)dm@bv*^MS3G^pr6^W zt=M4WnaOFuQuEcLM-MpGKR4C4&(nDEL%iWqo@VHPdK+)T^K+pLO}e2?De<2zEmr}j z-yhKKO2{J!nQmgp_5KLlm?N#Nm$_XMfA}#Y#Wx_15!t(!?}_Z)vx&Nwj5k-(VlccB z&<~EWj{f8~o$z9!m<}EX;nDk73C%-Xgj5!Xhy|fGK`P`xoiZ^7sP~0@!{S5a5|%gN zk4*N}eLPjve=z#13xe0Mci;eva5FBv9bmUsa0K^r;ikikuhm-YRE8ieIf9roA)Hd}9*WmG*belE z4J^Cxm9o(fAoVOz<=6TI#kM8x&vc!#r+FxDz>3;?H8CnX25HnSa0NHtQ_khE7tTdmiee-uaf|Tb`d0YF0_jRO zdjlXF#s31HLz}s0hz>8EHIYOw(&$6s%Bi=ZMZFE0p834-hw(Q<3@huBF%8rWZ&r#{FmQi$_ ze{4O_@f}-6!F!A@&DWi3^PSv#I|+7XlGP2ypNcNrh@Hg#SSCFNjx7nawh<%~gOFn8 z$ySDtda}iF;MjI@v{puYEo$4z(*ds9bCTPD+PjDSYHm2Q#|gyVcwR-gWG5wr-Yi-% zY>PIKnAqv?5xEOUb@zWr=Jnc2dr0$py5@djFDW~G~DyM+v={{hw*Is z-yPn3$UFZd@XFp@`saVXSyE-k>GR$o9f~dG+=Pq2I}T7lW#AKGnTPF;U2F2kWDeVXJC-#pG5_rA*u=A4 z=iEwx&$1P|J^W8Fx|Ze{t%ER&1(3H?%+g24n!Ma-v7%MJn#!nUdCV=tyO(C4F#=7P z@z;B%8zXC&2ffnf9Wo_`YLTp9nKk*IKh9oY!W?Z1fkJ~f7~k8tG$ydcClgZve)q)G z+)^9B2YLv=$HSfj;&TqXl)%x3t~;)8?G|gZ5|+PC^9pns;_Vkj>C6|T-LB4lpOfb+ z`_W&C8tM_ZE(qnf$bj6SW#F)4N<0)W@|02|QMikcI+$>$TZXDNsiHajyI-iwjCB`g zwa&n8li(gwO2>N7l3T+Kkv;v{w<#7t_ANNQh<#F!Da(4Eq=KnlWW?~lTJ_{k1u}>K zKea@D${)AkS;0C3Xzm~6d;co#5(h%`AnwORe(+sb_kF=Z=>+n7uO6hBFlXoR4~gXX z0Fq7?7;EUh`NjPxmH0j44Ui0-#EtR~ycAoO6+s1v0!k`U$4A#h=}Q1y8=;oGW4K?4 z%G;VNFp36A6A-zw?j8TWlk$+p|9`vys7-yvGDoq8UpyW^-)I%LctuK>U?$umJg=V5 z8^?j?0Ys(kt0g7C&A6ayL|I+_tZ%PAt>lst$0ROlR507$jcL5n zF7ve_+oTeY+oo?k#&OZ%`7ut0jbHs07bCgzYr4K0r~rS9E|k+|VT2YhcuFV%5U*{2 zN4)8s@vfJSTbdg3ssViYWqWS@<}{pTX!8{eI#a-WHRH8#nXP$j7;1TO)u!Z?<}B)k z8q$Un&r9+{w|&$?_fRm1vZ9BwSmxZ@IGk>2Vrnq?jTi80wvr}H8_mDqAJ_-zUQB@X z9f`gunDz+u?tsxnsg&&QZu3W+vsY-w(kE+#;vEI`@38B(a|w8wYsuIRf4GT%B)#!+ za4b{O8aRIw3SRM}HOGYg*k;n>jFaQ7GS6&;Tfx}!GfmWdZk$Cth9llJ)P1=yb6qsA zBs#p!c929NL{yF&`rvgPf0^F3Z|>+$iBY}$?lU{W`(00>=wA8dm`*%ffX2D7qcLf` z0Vz&^dcd@y5az$uKUQE*g6e$qg^qhI(5(>xrdt5EpL!d4O+4_?y1JEO`y)vj^$(M( z6<30v0-@X{z|{IaI<=`@6X&1VT1=@Zc-wH^kQgQgq|KU7Yz)f6oVS^8N6_WA3m*;~ zYp|ypPqOWH`nJO=2+6aGU|PwlncDZ`)z2`mdkqQ7n0x7_$-C`#P(8di5lxEJ^tg>3 zW5{}k=nrWl&5E+lAN$he-#%S#wQdVHn05(2L5%(L`XD3Zvk|>Z>MDXhTA$cN!co>BtoYe&4(z2*|cB31?${OM#+{a8)cw zC(zpv*-&H6c|+b~496VBLcSyb{kY4$m)J~H#CPEykn$w!`1Zm)f9~x8AgoO@r}pHo z{gtXP@*ay;1_8rw9iNc!3=>`p#8R^J$3FC?D+-lkVv?Vj8s`{&HjCv~p+`HYPPIag2-p-P zOz#pYUm5H)6|rGSNye204?|NjLGVty-KydudcChr+9s@2GTB7}YUP(|LR(r26Y@e( z$&tL_rK&a_$oQg?66jrpM$%ZmAn&G)Xa3`cTmM)`gJ_c;Cb8%4C%fSQI`mU$4KPKD zCw0gOy{>kiuo)ku>E~7ou(Wa(?To3GB=!KWSVYW~(0I%Vu{B7}&Zvd90q=axNKQg) zl3ox?GpLk~(&gX{rO};ViX4xpn~z#tZc-3dy!l9iW9_f^z3vNE#X(-%UXB#hC_0-A z1rAVq>;DlgACa$0@W!(2w^jA|NZ4`^TYc}X+Kx3Y=dN8MWsXlRYeXKs-e{Z%iNM4j zq&t{=0dYK_ML3O^X)DB2fXk?RaZ?U)E@Zd$(RZ>D7Z^Z^zG!z6xCLIuJRi)t2zpD_ z$jz4G==&ZPk>-t!ON8=XcQ>#r{#(jQYWXuTcb-N|2$6#)C|w=9eF*GDxNILgOqd5# zjT_e#@`*Ip+1!xp4lt5y8nt7v8s^MbEhbx-1~V$FfTIZ3^P_L4!e_H^Dh9^Q_WB$% zh+mnFw|soe-k3ha*5pAg({@RZIzV%TL~72J+bYn ziz2IZ_W#BTuxydbZ=dqCS(83#KyaG>_}muTzZ*^+-gSQ3iCl2s_$5oqj_4CDc`j^N zAJ!%hEy67}XhG2BG4F`YIyiiF*F=EaLofnjP4mL{Wp6MRKOAg;HJ(k{MZ zu_C|M^pWWAW!UDoR_j$)9A#CbMV_u|_3Z}b+Ct|O@oMYhAw0YYsq%;(wLFc8wo^$!mc zpH&_ah;$#gzKl@LcG%qSd~-Y14)ao83G#-wn81)c6?RePRo}4Ld>()9Bs_xoinZr!@XY59}!>b;%;K(r>YnFRJL`+l3g46c^#_X5MYP771i@{7}deEhv}sew3;j zu@!#uO9b^t2Z(Ex9l~7Zx7|#AQW?zc!KcmZB?fKd8L( zFF;XvwtI-VsL?<7b#fwy65uqsTd@62 zi{ZW>Pu>t{AJ7O1*aEU{<7b36%(3YInseC_!YwdUdxH|@8j(Y5iIOSFdi`>08ew?0 zxlI&Y$kp<8-n7`PyU8ws4|m#duKE@HFfyuwh@GhT@684P+1W;PwS9~XX#c@o0LY&M03rgT1>&oTl9pE- zo3nB(a5N>navGzr-ySVUfw^w;@jiNj^C5*{l%Q4D6!9%5JHovvic0CK9OZl-RbTWI$8tGy=bxd;9!i`cOS#t zuEl{{nCZuNlq@W(RF_(lOmE;`B?_Jjk4Nc4#rYziTyU&Qid-=I^ekg~_lSM);?BJM z-n8^~Nm?b18CrU!JVh6A8=Jys{i63z;zMRa@YKCa{!*BLwGIJYI>|eiW;5&83J2#M zss*D$QGW9#`1kLF;=?x3xnGr|(8=+KYbek`W+687!2?sCIGNvNpYoc?b3M?s*Q!FbosE@GDKlPDBX788%3r)U zpLa;&k*LK=kFWGX0lj6U$2?Pw&z$d|Zec>UM~%7KaT6WoWDjV|f4ye86>BKW^DfP; z-4oW_>2@~LcDJ_lmR;PMQ#kJZ_0Hf$HsYT4tr0Fq1ON+R0=Yng5H=$e$oTWH0|LM~ z|Ffoq*EC#xjwby*Bk^4MbL22&CIklO1N7WNNpv{JvMz4DawBW&7>Xbvq4QaY6j)bP zbx!Qd<;uFYsN*gLvf+xIjxL`$hBUD|JtaP1Db{bCcbnuz=pSD~ZQkVeEY~SY_Op%6 z9Ksf>{vlDJp)4J2X+w8!>uGArnbOD_Y$RtLudSz-w5d(d4iAK)Aa$8K!~R_p`-$Zg zq-}2`H(^w8ojZTc^pP1w(c4XSae5N_@ephj6+fAorko!19-)veEO8GLrxFh&Ue2>g zY|N7Pq{6hJuFf-e=XDj~vePSLp^r+JqfN&@z~-#lzvA6J&tq+Ew6VJvX@p&LFibsH ztSmp%De0V)Q`5P~$>ZWH&q**%k!<9Tf0oQE*Yv|y+L zy>x<@(1udY0E{oagf+qQhZVt6|2D~7sII7^+4SD^vEHMM3Qp}e{^ljSMU^11C*M8c z(y?APWq)IxG(L0wL>^4XfKJVB!@Jt{#$Vr^>h0|k2K&d zRD3peAL}@PyEA{Qaof`?Qh}$p(!0|hd9PO`>$--Iw_p8Ni92HXF>afx=LDY}_*xw? zQdZ(S;cp~#64m2JBmB=n#PDL6C!T=Z_4)`*BzAKCMbq7f=Vc??_Te+|O0QfO4gy!O z6^N5lT5`o_;#YEDj-4#WggPd!qCEKE@P%E>j!_kD zNR+^Neqt^d%)SU9Myv_m5V8}~P!xCx>u~sQ2)TH^-Bo1Al)SMp4kMo$NhK^}FZgY& zd~p@|+;7yDN6fBaLNQU)1-J_+S3oxFu;-dsY(&Vsk>O<6uTpO-21{j;ME0JnGjY%n zxTY9u@}9pgYP&s1-cEwl$Zh~mrNME>G>XbK;O)h3v*~%F7XW2+OAkH7|gRgc@%WzDREat)9h!15azC?l{y)5j{_HF6MdfL-{4BV1jHa>_5X&Oq_b zt2Y&g8hi$VLKSW4)$v=H&t~+{*9V>$C2Mp@CB5K^_FLr0Q~bt|;is4U zs!mAkx(?UCC*$ytlffo0))@5XO^K6VB{WI_901L_VKe6Zwa`4uv122 zG;~T3>wVxPid6@&)dZ@wZ@Q^Id2c4fYc{*<4iY;F10n(%DnR8I{6bG!roF+K`Z-S3 zVMV-db+g{Mb6+lWH?931aj`e}QQ2^w0Vq;?gH>)4&EC9F#1b2Hp>nQ}lpRuo8(*oJ zI~TP+A!tsdG7mPtNso%sLA>n$#(xPU_j%|N{o>ZPTt9l`W`p0>N`=37_X}Joh#*& z)617$@89)+$)Wzrts@Wmb{yNsx#v@8+VjkeSgSGd>r0(u=&9+wQ{8z}%i^DdE}y(= zwCfq?@l%)7wZ*DJ%pd0i*1>+>yMX`l<0_}myXof-g?bm1XdXV?pOg5JW^qpCH`KCjTl#@pJ}18I z_R$Cu_*+yZ<5X$TyT`9MMY|aVm)DMCHYT5KNcVsD1IAp@^=tSNdXF>x%|4g$CPlBq z(hc_~3x7J2s-dOWVaby$8hY*|E}ENg9pjV3VWDl8_a(uNm!6_C4eM0z7yBSs<`=NY z=u8{bTbKw8keZ*x9RIfHGZ)dG%5?W;nQ2?CZ0*P@|K{dvsh7Dh zoNMdjz45b$%7OEH%|NPICX#b)SDK-3Z|b+yAuj6HkncX%wHCPMuiDJ`j)e32j>|Y* zn$@fH(wm*<5qLPvcHTgs^M1nh^oQC%cz9=7u^5iay}=zam(ZFPLB1O2Y8zi%8De7; zSdlkcnHosjxoM8?$s#op&f9>*j<|em#d%P7s`^d+_eYueO16Ddje6$g2YkgI%9qd_ ziaXhiPfEF(S#G#~*2gvVWHVYL#(?_pXgd5(!^f3HJt;rsTnXLDW@rH$JYqu&o@^c% zh9P(HRot)ex10CBkE!Bl%GMvgsKGs^aTF?iLgT0fGZf3QJU^Z50nNOoMpE0>xl-XA zNmp&*J4!HcNa5?vZ%KqpGKc?G_=-qfnm$IlspxO}9!`}fi`eq!7t@A#GD@#h+ zylR=#_htCsGd63eC;1^X;HdH6Sn`{&=eB7r(6y$ZlGqy#Q?-stW1A3<8P*&AJ7P~V z&Uoeok&TEG$3b#VK_hXYXp+FY$+Lza79auZ`HhqFzAV=-Rh{^}9@1`}^6yY?a%wyq z{+V)=_A7_^frbhMUL^~HZu;q+}FP#urm5(aGXs*=aB^#mD2!UdyYk zE?=tZVZ10jB~vOt+f+ZkU+nhk1C0E7-)Ve}ZP`)PoPiVb13|`O_E^{DDARJijGNC@ zHL#=7p-ZuROG5k}+21>-^1}9H-L6kjd`q=Ws90dDROeadU=45C#e?SS&Q^Du33H*V zOlv)C9U%RhhesW+#`L7n%VN#Oq|8_f}6vrP&cCiKiYluRV@tjwIA8l*Y@iB>pozPH%$V3 zuj7rRwwpJS^2JXzqgj3*b^QJJ(R4c6d0lE>SC+lLt^istQQqrY$V3DG0M}}eNd7tY z7EH<8tG2}B*Wr)enohVYpwST%!7He~KVD3Q_b|;gnK_&HY;^JCC+Y{zElB2T3Eg%&-y|b_w9z>?iAmD& z&$x}|m=m{-uVJQ*ysC^#WiA_T#2Jr1T}LgAuwWw9rkZFY2`sbMH=^U5Pck+NNhghj z_hgPlNd7K3SK%g{Xy|2N&tZ>_%U5;PtL+*c;VZ&wH0n9++T1#gMEh?C5qub{-XP$z za%sFJ_zKP!FWs(>OvQ*Fd?YYpQO@UnWiT77I2?>KG_k|9HcnK4SzWYWZQdv zm(RdF5K)1w1y40sKK=w6(&Qb}gESh#bI?L+6gvo_8xCP)iJ0=0J@CYYkS9j!g-;Ye z!j4l+Oq#-tJb@1ootpp73XV!+@gyhG6hSlz3F?l6-xulB<~<305Es6|O}K*Gd|8sc&LReL(!% zpnf`TBl|2q(aclH-e$?F>OP-2LngoZr=c2loYm!%rWQw9IPllMSu0g%JZw&T-SJZ2 zuYmG?8gjspe8K2o6p~X4I$yS2&*EVhsu@C+omoJ$uLaPe>7-X6mMi?-j^GeAxQ6Vp zjKcfONoh6rM|Ed*2b2&Q(3wJxVtVe-Dz$R%!AYSH^$;u$!GtX1WH$rf$%tE|mY>z(B#)FHG+Y*5+j)D)$$-P3@ak1=#> z>F`n{PUMN~kG-!_!2kT@nEp4-+xi+&t(bL)(z^fN3&A3UU24epK|rUazCFtOS0qXF zP|tgO^9@eQy$}?102cedNW5kwAs9IQs8LwEe9wnNqM}zv$a#KkkYDl6+06-r=-yW!O24H;Y-&TrI8n zOz<9jgEo8IUCT>CXQbmsb}{SLs+<^+$ktMmbUS9e_(3+PTB?Xc&J0oz&pa*rwp))- zUh4r~3^SOLjDqV0X~}$Ta%onVSI;S1jMmf~DeHWZVClzB18bJu68q;VSKDs9>z%LW z5e6g2;M%q!)Qbs)D*6dWykYTN8~dXB66`{#WNYY}AAcmb5Gj^462{s%{%VrG<8(w@ zm-O?dxmT>TBVIP=n?!YLjo;YXag?aZT~45OZJMj?M-|n9BB0yCOu0+X#1*WC5#$z* z)>}-vtUq90 zqeT?QI}}!qP81Gb(^Ms$1Xl7qjt`O|Fs7iKOz{}5+nA|b;%GXC(lX$ zK%Jr_7ra61>fqzveM}y6(Fu3I1}50roiJ{z4K%F`^A3y*+o{y+U?6nn89n#k^ybT4 zG)TZ?mgrUdd(KdM;9v$L+rE(~*2dzE;d=AsdOBZPrNhE2tUw&=IX86fY3c0WgN|<1}^Y_6v0lNBq4+xy1$}sz!k~iuPD`Qw@9$)SjDr9%m~u zo-j=H6zX3zUB6`C%jl(PU!NUC)8VzsivRNAtkTBFvp|W2y(k$eoSHo$tebtUw=?te zRHICaTjBxCsdsfk1%WJP_83C_e0+z;O2G+Qd#h=kv%amx@8;^Sj${Ci* z3oSR?#Iu$DsATWWdx64=Bqp2Kw9IKL+s@bW6@Oz6BiOkfXrhqh5#Q9$LLdv`x>qP< zUHc)8wVM_a^lX{npCtR|C`qLF0tmOrwHTX=7f4zBP2co4v6R9XEQ~wmJ$JxnD--$O zBBOs9ak`u)VmV;{eNtABWGNU@GQSnC{ha1(23h8O&tqEDeM5x=b6I=RnV32+nGD;# zjNIHliO6&~vPdQQZkQMZAy1&p1X;*f9qaF-Xk%%=?T=0nBTgH!J#X} zLlH-@!1h>s7wPYbQ;lZ3S2ZJVw;HLgWJNC6;F(uEO zK;zdFnY5j&#$_Es0}D|{TaUV~_XNIcS`lWuJLsg;J0it?+z`eYnR^qtJ@5S4zZkiZ zHdrt-i%At>{@S*urMAA#=STd7@VL{4G^fjQgH44NBnBx6b=d>IG|;avuXYUteph*$2_P>}nVj_X18OY~s=$M2a|{)jg19XSrxzbCU} zap`lQ8>_4AY+3E98UDvWcA)6EBi_nG^AP`mQEQG8p94M_%dK=xZp;QoEn=s(Rkh%$ zg4uQ0eNzx1)6p9H9|GYRY?L4ppxB@7=gzi7`Uqot8 zood#jg#W?bG3!?$kw)?WFO~twcZt#}`-s>T$&O(u4aT}|`(7moMZ(|qvBRyZ!9T^+ zChwjWGvqh>q~!U_M2J+xJSFJ<;!71&zkVBY-BwI3Ba*Xi>^46`T?liXyIZ+vrwZ%7 zCi{f0sC#{eo7%C%djh~p-K>+vkS1isgQ_6;gzE_8=Qbnke=(A45X4nFMD1EzVOJz) z7|54q>BAv}3z2P*-{S(`rikQPCM2KO5GxHS;A>ACOwn(4k6kvZno{=AwEyv#8ddS_ zk(}M3QYlN%qX#baw3>Ed#3wjkz9{Vqgr{$`(!BIQYPERh|<=X}G+n;e_yksA;; z1FV&3$}2>oDF%q9(AM;!NH(y!exs0^n$eUz{`h})qq12shp`FV^{uGTRVU+~P_!S$ zSs@eMlb3&PeXxk$g7xnBS^V&4H#w*xHqR+B$hn&C4SF>>_H3?hoNgq1vZ)_}fu+YW zb;__AuY^U)UfZ7V!r5n>iO2k6spD1qN|0tk;$*{b2E3eNQtFqmvwiv)L(g?BVR^=< zk6z_Fqx^8c8TBcZnkVQ89!L(e(6vc4q1^nzcI{mnLP|eOvvRY(;}Sk=HyW2o)#D9Y zc|(Te6f|3kHHzZI0ESsL#kO$>FXgooZTjQcarPDEuJmdp24M-)g@@ywPO`yKMwx)5f)d%d4*w%IMwrm?J?DAf>ugqRtJFL_( zD0c)Gce$5-y+@mnjwyKFq<7q2k8t3W@OBv$2>}_EyCWzB7D;$N)wO1IpTa+(G9xUK z+pW(nf=ao%v8D#n*hPtRhi~tK$AuIc%Jqz_C1fx9YN|2m)>U2I2>yGEXBsRD4%kE- z2o1CELHb)k`UOQ$EXab*|Fo;sZ?Cd(VZZ?Y)A&AuvI?wG8GFiAOhz3<^X;da_W?2W z&HvEZ)7svUH*I9O-3%hL3zK|r$DqBa2m2FMnC5v@fdSZIhE55c z-?m)=9^&?H_m9P}@hoeCY>0p04>1=`RB|woqkE!-zAhRv2G*Is(r>$dY|oaDLO$2Z zXF!8m6;~HQN9wkm=<_l##5v0ura!u}6!?y7s(J1x0o-`kU!03pXPbmP zW-)-?hxX~=aIRXct)(n>%z@u{sH6LG-P}Y7Vh)|8yA!#k zg-(U@NfAPcB1!Dx+eX8L;5+tCvA*YBK;lCWywndhAWErO4beas-8#k z!X<_ssUs4?zvV2>{grUr>QCbzAF@o1zebyG%yqN7B~G^XD|g3_xQyPYeL=Ty$!UH5 zufd_GYnD}z&1MZ2RM`3!-?X(HoOqI;skbltlU>jcMp%t}L1)L-n}CoQnOWw1Z_)~h zP%4qkPK}+|$!c#ncD|e*lT4fLBM;%C-S90jvV`-H-q`S`b=mE~C(;`2##QJTA{1xD z`o$4s!A~wvfKM8!R^f1(^!v^V>K&R}vk(qMfLqy~9YFF+ZY0Cl?d`N%Eaa?R6sUiZ zRLu5`+xM-i-#yt%1QWQ*X}SkKCq(>4Si+~hj}&4ITaukYD*eth$xV$OMtG(9y>@3U z9~@TL)psj9!g`HH2Ck}K zYZ7Wntd0Wc7=FAJv5tL5!nzyipjx-ArZsBqnG-z{e$w34bcVf1c?i{*?_RZI$Gshw z&!1J7sGp0ko{$VS{?fsYud8%MPm0|!tm=*Qx-{#t(iW)bbV1D^$^0vGdvE{V~O2IjH7A&cjh-0p)E`tKED z{CB~pkO7jL4FmiUN)iJn?2-hT#AA&V$Uz_x>;MWTAu56zI7@*Q?I6G3-A=}o)<1GF zUl_pI+x~J?1>(8Rm$Khw5gJHy)4NIkG*-%BsLb$6|0g?!26Vy4N*)HXyk?yyOaI4l z#ahZfRruOy7Wi7ioz(1Fu;$AUxl%5==(k&PYOG{i0E^y9qAYPk-t;iVV}LKPfx^ce z!@Frf-$ncHr=o{iH_|pjb;HChH$Ay+C`(OLPzai{j$>&k)&(9MveM4g@5|jIkUCzZ zI%1j{XG8OtLx!Qlu})A|uu1(SCpW>p%A_c1N#5=9Z1|xl8m6_zHB7l0+x`xFyGz(H z<4n`<9q$55N2HZ92p@fw8QzE4&Ia#J<#183vAfhHD*Ricgnq-gq!g5^IoTRFVCNGH zmz(fXCG|PazPUt{q4b7!Rq6sJ!RoM5x+;xD=|*eY-I~s(!P%i}6l;TfB|EdR6O9Y0 zK8M$AOnQORO#P@nn!s&1C4ub;^L&@lmdakE*?K)&44=B7S=Ba9zzFDjsLpb2%p|gx zO?TO%rRORF9!h>+q&J^j>DrB1Ve>rIe@JER$)Jq%iacgxDE`qoR?oHlc)x|9!IcHm zsy*RtwVkS$I#Liuk!(!G30v=4wo7{JPx}#zLAkDDS>Rk?RgZvuz=&2(0-alO`1E^Tu|HIgKz*E`3|F?1UN>K_GvMQp?B9T*OMr37`>{<4fgru@U zj_i@WM|L}-V~^|5Q5 z-E@SMJ3#C@^y=`LA{+lYNzD9OLQcq~)1gdBs)kIn?G_aeutwckJ{U30C8G*=*_8(g zzv6e&qgljwc2ZoGHamTo(@sy0LS|=&p)v_Jv9nW$KF*xK^&-`kkIN7B&I|c7@|{Z^ z3S~F4iC}-&$=jGhHNTk2ER@d|H_`iYpphbSpMCW51IU9K3>f9m=ZPxjw7iYF?eNJn zzhS$tE}^(V-AnlWFy?U(r)u(7$>FB~3D+|`Rq`Sj)kV1-nd+?`3{S~dSeQ!W7?1)n zK|A$KqoG9G+_3BphsQ;8IEE(BnXiv_ERttUXDwhL-Zh)CCr6n(qg@R%ZF8>gSaFPf zYr0W-yL`oiAa14<&*vjN((&?*I{7cm*R1Re=4pobC#c6aRsG%<{t3pxrY2uU8i-LE z{2kAMEI(4P%VgfwNW zh{m(@jj|IYHHoRJF*cni^BCIoze{TVnhzx~(i_~{Q3PCT0`Jcp>#@>TVw|72gXYtg)jqz-XpRBj)}F5R ztREE540pUJ4zIxZ+6z zNJ=65Dpu`x`heDGkYA7UxG#^unlXJ}-TaC~MCnhzzGts&Jx3jFBAG3zzsd+Hj5i6h zOVmzLdF# z%UV4P3fKZk4x<4RUY(?}#H56Rn*)?JfnkC?<2NS?7gj<}ts5Z~A-9>4G%dc|m)=_Z zR!n)KstV@M(Wy$(^0Tbo2}w87B&ZchCCV+8hovwcpPVXQo-xuhl?W`|`;#fGwZt@p zt8hL)t?z+`gyrl5ra~QM?!#j-1M&+Z6(8eCF$+~CdPzk`q~t`D#^)-~F=qbvL9%13N^EMON{gBX6FGQNh`K3(KpS`b zItU5!4Was1-N?TM|1>&SGKb%Ge|C{j#PbYY3oa=jV_q}hNBROk0s88)b_ z$UKgRPuwrr4nut_8nr$-A{R}3xLmY_Yea?XD;Bzf%GrvA) z6P{20Lqc{aK;!9Qf{{d&2w7(xW!G6YO1Q1tt_LWMT!)GW&D@G9hN(AwPlXx=Qzx8i zW|Pj-Y$(ZIE*d};ADJqg)~bJU$;q|CKg-u(oZqoL;pb49-}l1X(ghlPx#s*(7d859 zpi;V@$Ndg8y;68_UEs9RW?Ff*&)9)Q3~j;j%*e&a#A_hGGMqkEODM5$sn6eUiMCX1 z`e)C4IgfeUf?wNWYQoFz%USL2#|roEZ4*&)GUH%kgH5qKTecujRBKRqkd~6aY8WhCWFCc(e~#y#B)1wDgarl zr*B@sI35Eu!ScGpIR*K>{!b7t88PFX{D_Eg?kst_)zIx>!g5+TP;V!dJGT@Tzo{YZ{u?8Bf++{S-vfZOvYy5;SfZ^| z*@?f)n=}gIVN$px>VMwcExDP8R0$PYke#5-^Hg!<91|BdCRDHRw&8Hz;{lPCfPpi` z2Q6yK;uqdetVYrkMU=_r%ncoozGvYo?&5T|@`GGiSOZ@;X`B7HeuLAkpM{LQMbRD# z44B?KbDu6wzsZcd`~8x1&xdHg&godp+C3+)ffX*>hofuIb!DZ^sI&I-x6vi%(Gc$1 z#uSvHCjv#fz3h9_l3!6S~3iZneq?kZ6}a-K5M5(upgsxQ-MJxs##z zxhiT#H4ifr%YOFM^S(zY7Qv+rk;FB$)UDdqNb=5(eTH=TCTx$;OC4n-DnNSNYQzb| zgV3`Zl!tC?3ALgUYL^#f)MUa!IngC{TMg|@$14pHS*u8YW!hBszNP_r@nobB#5vJfCuQ!M!+{* z&)94eD%n410@kvoyDSyL{=2{s;u&WPZUVJz#YHgBSg~y_8ypJIcvX&IYX_b1W*zMJ zf*5}b)Po>)#dc5J&mZDYT=SWrK{@QM(yU?6}t=53SQU1AQT+F5K^2m3Gli%z;=D zQhKAuuz_J!#(O?{@<1AdtFXY%iOGXPjJt5soqj^7P^@w3ou6K--)LNZ{|O`;cO{cvbNIj)&#M?@}CDGh7sA zO}e;!tfdsvT6lUnV||p&j{_&rR(#QTQz_*7@y>p zhsy*bRvpPC8w>hz3gYZ~E}Z#oaO4>k)XMsxOh;_bldcyZA$H$w0Mr7z@C(3k9SQss zhh2^%Fv8~D+i+_f#CHqB9T)6L@zWxqGpyV31wnujjgF##M=WrgHG3bxa>6lE2WhBf zg5h2+U;FSp!{AxGr02f3F+yz7df;$N8t!QP?&AmetQt9SJA*nUcL#53a@MaA|AJm> zuU=OrFR_t(d#aV7Y}|*QqhkbP-eHSg?O=6%bz!+;1yfdjl=ys+SLJHpPes42jCK0jbJ>i{Ut`8e~c487!2Gt!289+aV8L*2Ou>dsZ{FYg1`UX}^e zf>z`T1-7la)`R;51GkjT6!PPAm{u8^M4nl|&Dd1c z{CGe6utv6a5plm*Q+tCu(FCJdAW640Ym?_V+)HCUKzeV0=I-*Rl20V>cBD*aXxOQWLW>}3OGjklQ>yAuk2*}ZViM>W3Uid`?%#>GajKqhS3DRrG;bJ^T} zbx13@dO9KrXWfJ~i~TNX#O3S{fjegTjVQ$H(vdvA8_{MGVJUL1+!a!|nj}Jn>N=vv z*DC$ad@qRKI5#Ec{nx%q=fcGN$Zfp>uJb;C`KtuBRj;R!5o`Nzeg#*s-5LGQI&LI& zjXVDgAzY$E2!u-u(_M;1u4OM_fEu~hJ+*99_}~rshTC>2LAkibp#v0PG)++V0gk$DQq&i!nZmQwge@} z0odAvaJ)4LadoIgq1j;YF*kd9oK6~C-tl&(>q<4k1Ll9D3B9^G)_;Qq4eVw+m4I-Z zA&}=or6ARwmFm0Bvh+-EriB@zNqnf(OPUhDtGINg~tpA1{aXF{jh;cM5g0gIe#3F3CX&6?B9PjsKtm-BN6G)57mhyiB7=g`)|84$RF{RmRPt#KT(@QuA*!LbPM# zzt>l14Ik1ds8qd8Y(>A0iQyByZzB~6n0m8_A?v&k{Q49xteihmIHj#FIaIH^iax~j zvSl~Bhf_yc%0g#~R^4*dWbMNz%Uv3n`amz>_&w3TU$PlEL{u97enR$eRIosn>u&y$ zY{z7+Mgc)2xACx#*$cyH*<7pbqOH;>#2cXF^t#&AV6snKyf->#fI`+ue!8`1sl(4T zf5M2p?J71^1EqR1qEV&rKn|cy&c;EsP%^7tfM{uQlFBKawqOj)QA+-`^A*&DxcAS) zCCEpV8eq0!>*}2D{e#RqE<19klFR2jW)2EsXXh#?YP;ERwsFJT{wuC0ben9HNFvPF zmiosIsEVY0=Q+S~^c^+Q+6BOLt3$?%+X&*s_w*!zH-;u70`a>}tDR@lv9TEci;%zu zKv1%b0hH&0_R%Q%r8+w z+3xF8@F0)`1BObY$n#!s+Qg+CsYl>PyPL8Cy#M(G2|^3!W%UeA zO(MkCp=4$s>Cid%jpL~Qv4Fv&2p(+HP|R0dhvK#L(?>OH;pJ} z&|_rE)lChuTT!J3(?DS|^?Cgc9#HSUid~z`6Cx`diC*F%g4{iv6A|sVqA$u*n6(`n zG3iwCrmz&VYUzl!k)APhcr|Uf2cspy4HPO@cFv2)BP}z&Pq}6F_8q&#n|s&jeBT=` zTb6})y*mSBFRo08td0{!ww9P6)wJ<`yTcmQOJ;1uU++r{G6{N)xYU z8`x%^krQiqc&p9Xc-D2>;o%(1JfI3ya<>ivg4hDowwe*7OG6PV455)B<<39K4Yx=S z0s(>OKbmhxXm;LgaPas3N(avtwWHDm94O^xs{^FIhi@Aj1Bd>f{@PKP)UM5^Q%hO_8vaP zIs$WrO!U}M6x|8ZLTxy*oqJUMIKpN4Hp+b9p+gx653m6 zqRbtVd>B3aH2YKXEaM@c!<1*jcqD8V@5;U?FSyNN7LTT^-ZV{X^J4)w4D;9q_q@|l z0&wU9o|S+~HayK8^fU!}Ea?B}KOls$5Q-*qzP^TcLITdOp$$96OP_MR+HOPQ@Cyio zL#K;|9@)d+Z*}1I@d*kAXGQ|=XDY;*v+WOj-RgOuaqVkeTJM(>P}PnEp&Qa(fKAA!%R)6cOYR*|!qEd@H8zgAr|Vj_xetDYei z7AD>mp48AUhOlr5G>LeILY;2vxZ+VnC9R0_A!g|!D+uL5s9=L2DX(ygaoF%o>*bnX zSz{roNWeX~J`?a0+UR~diS^Ree?q3Mm}S3}-Y<6e0F?14g?$~zHTF7*{KJ^9JEv)EW-G$CN;i`+8(LQc^mgtD?*-PqZtRTvO$^R+nB{kkj(GA)CS-YfJU31# zyvgqIMO7l_mLj(JX`!Dv+nPHt14~Z^YJL!jSZKAyo{FGu7!9M^H*}#sw(v(&y5H(y z6egn4SwhdES28Aa#FKI{LFt_}x|RRD;?PRsYUm_TZJ{v<^P_M5dKGL9MQO{`rjxw2 zNEW6#wCYRD%stg}NihQ<2WA^p)sQS6pH(HBPW`pO(#(^ssIhlsJCz8dcQ(ESPClYo z5rkrqlhd$&kn?}L4x~6eE1CjreCVYy<~WTJ6r%`?<`n%!)93l%>AIqkbJeZb5a5?v zUHcpvZ)P((8GdMUFt)KH|HXkqEe{g4j6nMLKWnts!x;=$fBu?VFweT2Y%w1M>zF_2 zc{>Xn7Ltj;GXVGO;1PAbac9ff9HeYokuWKs(fnVZZr3B9JK>iV9hB_xJUKrAqsZMm z)cvX7=!Kz?9=#%$gkgHL;d8b)B_6Cr(s53$WFtzNSw`g6-^8v9tLS}cpmo`6fgV}+>yQE2O&sU)#+Q-uYYmF9IdtLcgFppGp3+PH^LmKwY(@nSq42HQ= zMc;wHfL|-5;7`m{MhOaHU$eX2LbEENPN_*KWFf;sJ)0WUV)dv~ZeII%O@S8zjMfwy zMbf0!YYHi9)9P@RS9v=b&sy)o+J1}H!(@izLe`N9^B=nX-1HZDmLiXlv|VV49SR>p zTDUkX=f0%I**XXZ!c>aB&tlwfo%K4*XlU96G>8jVOk}3r^q067>wJfiHXaCoxSW=6 zRcOd|rPzPVB0|@Ey?~t?)kXXZr@19Y-v08Pc!w|9p?YuG;>^7FmyTz-3;ee=guVTZ zbTX}(Rv=|iDL||I3xW^;20@Czm((Oe697TJ2ruR=a&@|+P-RFtYVUPq%EZ5*>xSP! z#z}}lCKI9KK`4Dt8e$B9|K)AqE7zAnpEq*Wt^6g^M$Nyr8 z{!x;!evFaH;8W1n{|=9V2tXq7(Xr}wh{RhrK+5x4LIP)#S;7C)iUp*@*37nrdPmn) z7;sj7NJ>6GoB85R;~VJVp|tBcU`?7-zoH8$`vQ&9pix*q}m21iaK^~CpL!Y`g}YTZXeO$464pZKqE<3BbA+{y(7_B-eW zyUkx>(+>RyMFNSxePj@QYOG|vsoFH)XcJPg0$XEn*wjSn&<+h4`G(IlXGLoO2mSaj zpSS>@2r1vL;tYq!x}DvVs@*)0#FLCw@a0QsRc=UZ!)PmZj6P3GzF=-{*qu2|FV-WN zu+VoWvgzXdygU8eMN8j=HHb!k&15q31+^mezEH)9=^lc1y(T$C2B7U(nk#@-maDfF z)oe9yjb2JX(F@e}@d(rm1iY-AFu-VV?Zk8^Mf0>WesLRZe;A%gIIxcYNru5@Z|&dQs_sZH zXaXLTLWQL^*k$p*lPm%Vgt08nY1u!>juQ<~Y@{r$^}63*C3Oz*OcVL~So%6akW>(; zlloP#uU(d3^rin|=c3?^lJ3-yrUGY)gdT_;8T;}>!1!+=Ycp5?Wrh!6mxMnbNaPs~ zyZLVB>CVIy7sB zzaqjgUK>rT=^Xjuanon%^FHIpT1T6mhMPD%j)n^+*uU?tQ_r+T*R*ywsi$e|OHx&A zy!ZKn5@BlFR`o-~dmgEOHV2L&YJ^w^$>j4S%0=3ha^?bedA;cPq2XF2jL3WdTMM(? zSv>g#z%bL8#DkjW*yKQ^iC1=`*TNli@%Z^_)PF02aFi}QF*QAfOgbcB18bs<=Cas_ zM3ia#+a~${;@zPE0k+fZjJYOKSF#Z}Xi)#BV-%cG^wt)6e$oUb`2704@_6J*dd zOn-aWGju@G@RANPAxC~CV!)Sq?PMQ??^?;g4+UB>DyJAfoszRBp$r5K+!1suZI?c4 z-~C&fvhm4`bUGCI9c?h><<2Sl2s(*4?7(*=pLq8kM}-{df-=_Z>1&#?VH0Ar;aV_~ zLGXIhsIwJgUu%tvC{W)lNMYX5DbLcRLW9F-NQvh5XFc)w3rvFwqz6#H%S?9;NU}QB zT@R>BJZu!h3u{P}6r$NB!@3}&$J@Elinl>AA|w%#zrFzj1n|&s4?i5#@1G$qXbBH@z{}$@$3FfhD5nGx^-M2Yzeyl zKxn4zYH$8UXx?N-myiGoNoTlAy2y1=7q|3vogOPfbFpqJ1ln@z&D_xK9hXhJMT%wG z3WuSM3#Z??9%M0pWwF}5AqWi5r>q9j+l1IntuC_nRLbxdYnk=9g2v+Y9p=AD>^9!# zb0CF4jSpL^-FdJ#ji^mE%Lrrf5%cOs7EhdB{0q@Sn;%Uy{eGfp=}9$w+)6n}IggNv z!`11$j~O1ztD!=5qbn(;^hCZr@u!}k3@sFP(i`VRLr*`Ztg;u1izs<$(vF8|y|bh_ zK1R#oxi|c%DWvTD{mLq1VEh?0c;Y(aEV0vN6vf={YkT4^oWCcFbZ&63P1nmB9(Vki z0u9g;;Bfe$rK!QH>z?1Czetd9E0RmVCg@#-{A%QW72pD_sm&2D?MTuDypw5+$V&7U z{%LcDc*_ff);J)&McNJ@W*(d70JgArRn0`BZdDg$%kJ)d_I*KO+_cM6MCg5&tmPCgsy6kp z5Q$(SPZj7F`Blo*&PY1E^5k(2d{5t{hbHlSW8gz|iA^4&(psrmlT>)53$^LvAE(8c#B)pOO37!%H)nJ5g-`nqV}eAe z^NI%A4KFiQn=7GHwJ~4=%)gG%Yo%PwupgW)M-`6v5OEVlP}LulMR_2D77LRA8(7in z86_$=aA`En$Q(jj1fnsDwK^R_mvVztt?kpf-s;f1{(xpNw5Km^)2<7cQZs|Kc|->6 znQ1MS+SI3KTrICm3kl|+bEfSs^_67^CSKtDeLrC>gOpy#c7_7OQL^ySFU97%LjG>) z=3o&crTQ0&f!tq2hV@1yUZ^qDTynN&RTGTUX=a`rVesNkjbJX(wzEp<2wvEB`!Zoi z`L5DUOB}zX!WWB*tZ54oXBIE3e8|BoWESQU)b@<$OS-&;Y~z_gjc!aRvs2-e5-ql+ zjp|cttxQ&p<9E^zE@?TwwXZfZp4Ptw8JE%+?9MPDR9B5f$Ig@52 zDxh#=(1W4c^I53v&5sZskR9n`ywPz_va(1O10#*56S5wEjH_jDLwe{Qs%N(H)G9NJ ztPb}JH7}0_igA0D-Q3%@q*I=7Ug?^JP3{Z5Z=K=L93M0A%v(epPMM(acrh96Qu%FO zE+Fgsw@=LB)*mfRneCO2Q~C}rcF5=$2oO385X~lIPvmrT0e6bmJSw*RT;}-odQ1lPGvXqR4diS z6`5e=^8ul>arf36eUzlmiD!Izm6Sy425VS?e1Ttp$C@Qohc1`If(2S3tiZ1?#otw0 zGL$!&QeJi~MfvN4-jwGBhpTw7L7pCLFAR0sGSWWFGX=(f3ed5C%iX*nD&7~XwYyZN z{F(#Js)Bi%8U1#Nk4Bi8l&(B;hhFK9p{0w6N5!E4;R2*}a!KI+EC_guEZs6y=t{GT z&xAKJg|z4q1Ryo5@yFDY0e)`fErB#5kWC0`-8yQEMn@AVAx0|W0oC#;c`SA|gb-(p zn_3?BOOUpmYe^EqiEEpdjcif`oDi2AM_9z-P0SHBJGPo$@ z@M0&<=cf7yFV4=l>+^xv!Jv?I%^h@W-sef3KhaJmQp?j(y4%hf{LKo9j*HZ71WLD_ zw}VeSV}}mwda|!|qid&B`(qg_)t`NG2>LmVZ*{WbcN=BdjSp~VRw8EC4MkKK5^LL! z^#{JelEg4$?tJ{V5s74h{TxjGx^0ru;yKle<14yk5(9mHPwa z+-eZ5E-|g51{ba-O*gHE!rk$sCo@Ym#Nxdl3ZefhMJUlu5ci#kcX9T7!|A=jS1E%( zK{`xv1!-t#(a}IWOXq#zMN8RO9n9#-+`E#MAE7DZEhJ;w?6K9qv3`?MzJ`}9M*}fL zw2)n!hZ42u$(@*J?_R$S-`|F20->#YFS^n({yg0NT>WQJw9Am3#Ow5*!=|q@4IECW zyE@!XO(fxJ3Mn%SFWqM_J>uzE{iw{Asb0k5OoMmy=-n?eMfz)#{(eN|Rs{pH39e#X zv*QZ%6JN=Ad~B|A6*xic-&FUZ`hg~oltLsAcB;hV3%ers;SnFqs5QDL%N`3of6r6N z$vu#72_zx6=6;XG_cI2ycNnHON$1?)leVGwTp(vxnaSV1 zhgq_AWUrqnmOHP=<3?(<#M*$d&Ok`Xos|`&v4eo5t$4vx>6>e{Ahj899CtNn8AAy9 z6jhpjuSvi?O&w+h=fBVd#D|O}`mb3T*2{vdNT~wON3Ykm@bEsrgD=-ardc;+d~Pj~ zgXe?27Foz}PfAshvgxbQ=_W-TF1*rq=mGGAs!(eJp`?a*C{uw$3V%XL7`_WQatQnW z9SGt6uSa$aW$++pm_w0#?MO??NbT803UHUu)TsE*PR=yP{qlRkC#bF$?n0KhCJ|^> z6E8oG%pu-9dsWF!Ec*Da^MGMd5 z{NP;C$UA&pHPXAdXDJa%^dP5YHbMVV8RyE~p0fD42;!$e(v*js6Z@mgDRE>!Jii;gY7RBgPHs@X#}4n-cR zplrQ1Ni2-1{Pb=_!?>|J)}!aq``FO@+s%GYG}F?DB0QU+nZQ0jv!pHG`B@#?DV*6f zA#ocOyE^U2N!si*HEMX{y`XMN23L@%ptmBcv;vg;p;8QnmG;$(m8QQc5XFiNA8P#I zlMr&IlWR`qszOAb-&yC2Jf@3Srs=K^`9tj)~H=_}bt6UoLT#&nupuKK}F1!F_af*J1yT+~hE zuHX4jk5$K9A*LhQ9&_?>0Grg*K^DWXqtK)m!2QZ{sv1I#dv>JxKXyrPgd^I`q__EEL?mWLwF1JH6%AGu_);qzJ5i_4bH%Da} zk|eTHy%TZp;KWN4MN0MBPSI2q1wX6VacKDFbEKa`E?P4dHH(3gxl~pOJ<-v46NA12 zIlhzInWAm6qp=kl;Sk zEk&oPCpzIgLE3XBhU~3c%wnLKKkDOKxeP;?CKb^Vx9dGaNc=v<2d--IZFP?{o*o@9 zUCK#YW8HMaGZcO()9M06ns{UhkEDcoZxDXC%{Y>l2+JCy5Vp2wux9j|=Qv?`*i;v- zi{_!BUPx;|!7|s^|Js|R!n6Cs-PtDOk8XLP_e~NBKZEU^LL-W&aQA(4nrS}=SL~dq zrqT?(ozxB2hBL^w%#QZ&Io-AXAdm}$y|`~OD7{x%HVs*tN*G+ditv+;UCGf5LbgGe zBvpP#BD;CqvyxO;9Bc%#I9)VDxnj}fKTDI_!FO(ZTV2?Z^oX0tA2WF=5^s!D$iK2M zdi|wF#Dy}nR_nxLUiX8eRfX5Q2A0z7i4jqC+liQ2H*SWiND>^lWdKC zA4zBZXWxZCGtt4Zyyk_xD#)7d1Hg=zX{qoGpfyFh;L@rqn6(-LP_sk@t2=aXTeH(K znQX_p$X8#xm4qJrmczWdz4}J!0cX2MUt*!&hyUdVj3(zkGJFPpeG0EN!j$s!M}}v~ z%YR#yJxjArLr@zd#|}aN@GY%TQCwY$H<1Nf{fd=ETyI4^xqDr{st(4=wL7b@qtZ?Y&eNW z1o+FY!NB-tC7iBWg_gT7TCA@go=xua`!E~#-q2gzbFvQI79L)y>?8j1^e&Cu9Q8^D zkL9D++0W4NsL`Qpc8BKpRQRR{(XCDjl|8sPKj<#L7AxT0^<&9@HL%!U;F%dcIYpA6 zj`oR&Z50&o8Sncm-W`)Yas)4%(#IJOyM_N6UQ&9i51&9F{fvq=c3u zKRgT<>CWV;P<8ZqZSvDk1R6Vx&P9#3zT5p+??Vg~rxxGCTN`q7Vh(1UNHRWitPK2r5rtRCf5aPT_Wel<=z z1aq%YyW-l%9mBjnFR-3p!VZw?p@#ca<4Wv2GL7h?(9 z0oAF-f7EEH$KEt*W7B$(O`9jX&#MJS>zVld)w-)N2_s3)9ITMV4alX`h>0U6X{Uyy z<5lxn!ggD!>=@+;8>lj0-!uurC$ZgJ? zhP=-?xGvMqzP*)L>+R_di`cAajafSh`nO5tj@^r_zka=~?$*WJG1s4YZW{)}ivVbD@KM-l#E{+KG8x(wiTD>76J(;@n zQ5o{G`Fw~J*^N!6;pR0k4QI+&9i;K5K^jcMh-ZRDZ$tDQKJEP-L+9{5hIQ#}jJ^WS zZOq{mmIrwnvt_i6BO8|HrnoTF5@*iH;qK0lTnm1J0N|CTgE3snB*Ia{X2a1{ZXG6 zy}Ppn#cLbg#Rt6UzgyO>T$;MFD$#dn>D0ZN8af{v|HL*n?S+r`+p-T>>Q$6b1@JKp z?yzUd(G^K~TL1l4ZgOIQl{{wk0MU4TdULK?ib_0_LECk6hMvm=1S1^AwBM3Nx*B<&=VbU+HljZX4WZSh0r%LJ@!@FZl;_o}89VK6*I3PH0WRu&h z=eW)E*@of{A&R>wdp{phTp98Ex!ZvXk$}1$P_!G-n$@1^uLYkfN4s#qpVbti(`C>A zRZUL9Z`VB>q#=fcHxU3GXsIY(={H^?LKGFu0Q?11cVzI?wYEB$`LlJrI0wSd@AgJX z^hRQbFkD4!<* zJ^|NhQxKc<%V#U_a-V&J1EMP)4dH)u8DN<{JjC=IzH1yf6ZC64xgYqdAXIaZh5Mu& z*7N35_TZ)MHff9G$i3kG%J6b`}gE7vR zI%V!kR=P}Sx;?ajD&`icc&X;qC+uPUXRx95C=dVqT)8VKB}Vo(-9D>T)xL7qiCS+B z-|?#rzOxKy1xJ#bwmC!D;nIguV-eTbh#Xc2M+~i@)T#d3#c*aZkeK3;eqZ`>-eA#H z-&cGTY6-R{+VpK1)Skt8ccZELB6=PD&HKw`UgqBGdr~TLaP)-s?8p1xlz+EpOav9t z=M4Bf<&El5H6M~JOv`7=u`?(?pz-zed9h=vrf0GzVqN>(5*kP3cR7GlXS|Mw$OhB9 z3~IIVEFQwZg>T#a6|WAtV>^E3q-kc^RUINtR1M8!dR7$M^Se~--9*o_@pT`2X{~XN za%$m>^jo5JBGDmf*VHpV`Yn*Qe0x%gE>UqM34IxUWnbCi$;r8%1=c>Y$i<6ONv{lK=%Bdf6K#MZsr0Vgc z7S=1JW{>LM9;%f6-&G8^rc+ z8it4|UZ)Uu7z4vgKrukv5wE+U82Fd?<$%l4MW;O|Q{c^25E{?z!uf|eu<6fzdyy;k z%(Y&%#jTGJ>!6T`=slleSR5i_Q6P^JpcBZ?l(=om`>2`u`L}ZAbETC*BUg2{d3-)> zfN`@i8fdjop-&Wns7OL;J)*1hoYK!iA|RW+n>1!H4lXG$)YXy?cAzc^)B(_^DP5LE3bDp{zV-x* zQgQ7Q5>~RzX!5Q=6t6TBaS7ke#z4ogqq6k#+Ucz`m_`QGICDlRt4@CPIdk5$16iGUl)vJX0-C+MdZyA zi?HMB;~<8EtS$FNuZ}1&o}hi&tFKn7eI-p>d}gWfOgx6Zp3H1<(4^gy!;fqzmbSn5 zM+y&mN{Jy|<-i5==?_%JPcCXXAFy8@z5QK^WsPX6-h74GqE)CzdUT<+w8HH(86DYC zhx=cbo;t%X<1FK@Gu!*RU5gJFuK6!{*B)QpJJr87Pt-S9`2GWx<1whtV^AJF;a_ke z&gAMlqh8+&8hbCa2hcjNY0-AYBAbG@iEg|IszG&MF@1piB}#%|JF}xvz)x^Hh~`zE z@mDCTw@f(GMILdh)IlV;rnkzIw=HAD3@>X2XWZl{3WFKv1`#xRhDNgJ;D+M;@pJ!M zC;wAjH(VTOauCYY^i`DD22XJ;7;K+cX>YqaVn;Z)LmWl;!Ft;C5k>LhqWWJxpjnk> z7Bnl$(!D|&0pK*6yRZC_RJk1^{9u8sSAGwD#9i9#X&|PN1&r=k$IgSJ_13WXm|iD=v7H0P7nDnY`Koi>d~fr+zpV3a7eqbNIu=L zOKyw`9}6PXhKwZaMPRq7X$o>JxZ65Wk_cCI*<*y)e`SLA%S+x};b}C1^Le<Gu;_tU2sAUfv_pX*+y5ZX%Q|t3UL(&gYr^*<(#M-=FF8($R<(`MJ6FTsFZ- z(sc!rFrM>g4ES-1F=&Lz;ZuXS1EY^0B%JlR-QzxShKq8BT&@VRk)0tAV-DQjEAZOT zh|A49u{B8@)#kt^J?db@GL_^ndthxU$Mv#{j*uvO2irMg`@Yfm9P#M$=o?a8kAe>G zcCRODUeb!T$bRX^@cR5renr+HaYNd%?z#H+^Ju_GyxtQ{wg!mk){ zis&71$p7&n|Dr=AJ_SB`*$0}l>EmN|KTkU-!jUO|j`{qjj9^yrQ&U<@TB7rIF7;0; zl=mjykgSO5_a?QWvTt*daeB2%TfuUCjm=`>P9&p^po38M5AT(VZ;eZ#cb16U++v*n=?N)_3I$K(&ZG~&~zT~b8E9LP0IOq?LUc8sT z%rBpaC09DL`^(|I-pg2^-(=cW3#ARW7l1zSK9}*ySQGq%RKJr)bzRyThmMi2MUh!k{F594 zJ_qaR`2)22UU_fPhAWfX@$b9pq75(N1G@jX9WEBdMUbyGJjZciCGH!vvxA+GeNhEe2uM*yy|Pk^CBoA4~x& z^lQ6H3NXvC%crA%0$3i+ta6KCgjp*0K0UzY-EL z5wtoSz@IH}OGo+fi?2aD@~`bZp+T|p!!ZT-iZKQBhhu^0icjA3Itpfo{i)mBb$l1) zV^KDjN+Vydbm-U0jS1tUON0mPU#d`B+M6A{5z-Mt$F{lz0Zlm=2s5c+vSF z3q%ZgXo~h+@|hvW`N0Cbr^R|^?+-$i1}!l{6SekEc@H@_^dJJIleF?JPri8x|ua9MT0wEa?+C;!0%&ydtH^_R5Z<*MIBk zZPVn-H4#1d#qVO8YGZ2J3l5EkH%54L68OE;bE`jG5b!Ml&-6^=IP<>c4lzGxuj6z! zwC%n+WaGm5$J!+JMtpVGNm%qpiH$QBu>{h4k5}&T_Ga`4K$@h^QO^}D+Q6Xt5G-2U z9`mu7h?HMlhK{A!y+k@*jp7cuA%m6ietlPV3`KNyKKZmXGGX20%^f&0v9qCelrH~L z83hogm--qNT(2#^r|A)X79x8>e{}D?%9<00N3ni6huLn`uruhg?thz+yXMds|Mi{L zLQ45+t}+R&Tn6=Z(lu5!lIW4|n#NL0#=<{8=%SU^+$DOhf|FC=Yqp1GtmGFj~X;TK)@JrlZH+PCghgtHL&p;!vw zn9DEZH!k08 znqfj9T8<&}CEf5`2>{8bFB$TMABon`S9^9pCL?l|MZ{5<2<$5Oo&P^t1#wc;Fe7D4 z#L2IT&+!qs7=q#woHyPdZ@h$s^M(60tb+IEnt7M38+w; zoU=M!vV|RS0iC1>;)HTbZ5`VA|ES=7@R9MtO*lHK{p=qMs&PtLxytmtFP~`uqV(T9 z2{5uB;bXdg?YpvxIc*2+uj93&$RoimgPE`le7wuMkXVP0m-A)TY0ca;TZ{Jdf0lp? zBcyjU;NOOX7Rdh@Wnint2lM546o2aV6f|P!v|ji$+JZ;YyDI zM?e+ms9iwRT!AB}x6|Md>dJ(UQ1;S-jW;(OdR_z?va(+bWh`d+w`XMN6-SxP{66 z!75Yq_{$19ngq@-m7|_>Kl1~rzAMY<`e`}vQqZqR)$-2w>o-Qru_C)Oo>+AozGgA2+}-M*TKtj6V7T4faU8W^D9>Y|f{I?|3;+v+NQdYa)J zZmt?UAzd_bolPr1d~=5>ZS>d%`UJM9thL>pn;~DOAz8LV23>N<9h!L!K8|7ryH{QY=hKX)(C` znCuZ9w;%mMe1>7zbijLi+}zzgRObr=qdbI$l9TIg3P(H_8=~pM_0X|J1^V1Rbq&dO zt;N=7Z&k^@ka{H&P-wL`%uC@)?FU{)OKrcwu&-{6&rDHvdd4T>%yqW41$Fp#IvWU0 zdi-2Fa^dye{r2^mjNQ3>{#-V}r%EmN*g1}0luvIZF0x_QpblYwIbvFR6YaFpd!K(I zJ9(D;LGcIMk!NdBa@+7yB?AvHEoAVFhCoOQN<+I>&f(LitlzU_!H=6ohIP@Y2EtfM z?`a=>Kdyz=M+IZYU|{s+nl`5I(vCC>5rSS$Khne=^eMaqDK zmn65#Xr+5;6{NUMLw#ifD|wURroGx9_yFo zcVlosSo9AJ#`#r9g#LleGV>=J@W~ak+dKN$aV+sBWha#2K)OVU_xZ!EX`C%N6ePW3 z-kb5NEDvu~aGqF+9@IgRShWXNd~>%NBoy`OpK1iC_q&gSx_mp+G|?Th=Ku6 zUt(LdW^{mRrpW}rahR$z0)S$1ka%!$>0~3T5)wYLG2qa^Iud^(__*xGA07-Y0x6sF zxoa7?ij6u4u-_OIDtKRW5ro9ZPnzrVK~~)UjGSMG6?N7nq>WM=c0U+_+u00F6u76; zqOqg-@%Gu9Od?5|#&T&Pe%Xh-1N!|R^m~`|`(IVNBB}I5j$PF~SKPA zSfyI%d2`YV+Yur9vZ?Q_{<24x_hygy@BA>1Uh;qY!_lwLUo%FZ?P*frM?%k*2x;H6nHTbKG17DW4(Kd-^W=y=tWKU>( zF82TMl``h14sC-_>CPc%3)ZaZ%B~9YXD;Lm)sf3Q=WZSm)6C-Y_JPn*<@hNTkEotu zhi1PNDOHberOG2rzwf+_c&hikwaZM61NXF|b_ItDE6`B8)TlJ?cv4noC`GF6sK&w2 zKXsH-t4LTqDUvi(N?C;cD^s7fBaMC8GWvUH+qu5E$fX@qS(UQn?y_A^t^3~26J4O7C`5Wws#2vRT@aAoL6H)=(g{sO znus(32~BzjX+cUrpNLfHT|jyVfzaFkPJ*J}d*An4|HYytlgtd0x%=+3&p!7k(goDi z>(jX;5zde<(ITV~A-P{lY5Ll7B@lE$m~mwZTfqRJi-+V9pEVq-Z$8dQ1oM&)znjDu zC5fUO_L_G`P!@nP-jEjIWzx~jXj(u`0%P;h@~Sy6Synaf8RY#Y2Xn`R&yUR08?%D_ zpn0i}-v{2ksKUP>Ir!g%-8p~!HAYL^c!P!>e3KH4lf!iBQOx;AB1R4sHg5tsyfDrn zszpSAshBnMzUSkY_-hr~%8C0AaPRwXGyk8toj-!#2H&CQ?&x@B++9s}Hl&IU>-_>? zKn|@UlK3kI_%khZq%$9Jf}@l#fB_yTV+4GQzX8X8ArQPCI;uyCuq9eUbJ))lnlz3BmHG7vCF~xi zpZ*H0flKLuX}29P1{2b%>9JNrHakA8lQcqql; zz_Hlr*V7B=sE+QVE3yn=rgkdX6{jkOiiUTHaA%+Dw78sNE}8Pc#jtG>thY)(X-T5> zZp-uX7@!;3d%G{#^363-9)#4B{Lg@wk;(xMqrR61!qM0#VTw6Ne|-}(JTeZwzxY;-%DRJJ{18y60&=7U3} z^*vrXKirobkJXbR$rS@#)>@Y=(dMTPy8RC7KG9gA)y4V^Tk?VqKN%9Dw`0=$&M#4F zoJIj-iildImT0p%wK~uD-OoLteJgy1ZFy8t3pC4|z}!%$LtAGce{gbn;EM<0%>K6M zhc>Up5KKKw0>bvTDh)u zB)2Y}Rww$?jL?TX+8c&HG>K*??^3y!vC;6g`Oq;`i19EooJ74$3yC*Hgt{l=`MVMh z27X)p;a+nPyKhjp8nHxe)2Aa*-yn0YS^<&q+w|8Befo1hiy8;S2vuoc)gxdqfrfu_?_!2TL(f+k9`oV5eJtK`#csPi=%G*vwKZ!LS8<^@wz? zLkS!7kfK!(bWI-ApF+m&hXURTPebor2Xi+d#UMhruXj&B^!#|C?!K)bc?Xv1x;kr@ z1X26nxcom|iN9}!UQFn_opJsA5&QowHt@sQudqSEZ%_YA$Y8bFn1_Ev=wE*b10#}+ zG!S=+#TqB%6%KH+12ANiD_grRte0?OfrI`6L+kisO(>WLoZr*9^JrAdzQu~9@XzM%Y(x)c+@H6HG)R0uz_l1uRw|a;vn}=$T3jC%8gjcu|id= z{@G&ZZNDD;+^8(k`W1;Gl8~)zIX|MJ_iwJ}!ep~w=<8_~SNW^vyeKZWzMjvnSrBc0 zknBFR@R?}T1hU6kkU&4LY!4XSAAGa-2KdsjnAztR-vnc8c$)<|TX9Ydd`ikABl zezk?g&xp+~+-zlgtaNb}J%*OqkU;j{p1IO!_3mL7r4~qv8}Jt&&xg&*`T5oWex2@lh=EV!^S1$vBT%lr-cz0zDc|21>Vn(2&ubkV-RvXa@ym$O=fh- zQ}!UTVD_N$Yw%kWX$!VhJz)lNlmb24{o@Y|hLjP^tKU=g4Syi}=Z}Yuks-#A`yn|S zc&+P*f#ri`wruOm&)379d)AN??})13FmK0m?OmQcmZMMjJr036yR~+vMUz+iVufyj zpz=E{qi(i~HUm0!nLa8tQJy~(>rCVKg+RgW9)H2u9A3x*F-U7o0>rr{PgTtyDaPZ$ zC`ae+3jG;hYnHCXxYRT6gI4|_%>3f^`M|CLAYjnacKRW6{qi>B{ zRmik{ynG;$eZ(?fi@HKd5dEceloWLHyfZpszn#`cD&Kei4-_~W>Z~xbC)q!zDK8Dp zvu#Ae)b1Q8cNm`_l|b)&>(jl1a#ukRyTUO}FWeaG70P>b5Tcl~I@R5N_h^9xuaK2;|vpM5_vGJaQz;vS_yVPa{!x4tJQ4W1xIxc1;;(DVbd6!PdJZ+r6QHCs{d8 zx9u8SV_79l5DdR8&mS!3o@B)=Sa zY{mrpxvx=@(#R}zEiIa1n)R-&>{M2KeVg&2^2_Jcj1qO}Ojv_;QCj2a>rBfvTa2N@ zWcyt0YZJ{ii{JE(=B9a4Ox>8i6fNm_URvGZnFQ9)j*}8SMrZnNM@yD76fRpL z>u3hY`kaZ%SUBU)`dIMadWB)A6=zTmxE&S{@N}_WLZ;A_!-!@O|3_nB<#!`Cn7BC$ zEK!8J`>iS0z{`6raPLk{-}+RQFzVlh+Zw<#`Wt!orOK z*ML2|4cZM6N6Hnyv1&!Z-44IdD_QJRQwub=9<73AR%cYNOp4*B`aIoQ^|{b!fS7@7-{;)DqD`$I+5w?;I6fLJdJh?=na%XTr=pr8Fd|Sb=vkgZIAhzGVn%DS+!tQWm z&-M70LNBQa3q7@LTS}$dwq#;yo74)j>yCz)yN%3N=Vv>r;P+kuHnrWb0 z;P=xj*{kuW>(1y5(ulXBrhi3;G9~91>`e@rHkpk2KMxU`@mL! z4_0*@xlu{4|M0rRBcQ8ZR!a1c1HPfbdp_mNpfm*MUxys3zF>7|D4$|q8-k0pULAUF z|A@=}biZN?tyFPlcsL-4kkwTQ%m{ds%Sck}17*3yfWktolVMm*tonjfVPbRh^}T!b zzNicv+@9wq<`fZU`dY7Eo^=ZS-Cz4JCSOFrBWfsXOTWL^j`f%y7J+EyLt;vglR`e$ z0siA7F_qI*tF6qF6<3ua3KR1owdXgM_M1Wer?7jt6*A`IvOJi<(AEu;dq5ZxrXv%% zI=g|@QZ3xdRe4?$EW$x)7bE~ni9khO(8L8LZL^>pZhO3R?r)SGh+qH@Z@Rf#U}q{; zS*k3N84?e@!bHIJZr%iMA-jBNwugKP*t!7!3y^U)aN-}+1BBb)2&wEpz&tVrCXX~Q zc?5#V1IZRX2TdAtP+d!xZq>a!gWIJ~z$^oi^(zErh=mJaIysnCJ({ZiQQDP!He}}| zYPTGR_WB>SA-c%^ zLNeRu)Ro3&ouKQQ^zmV8A>BRrLGzg|S2@>@uf4cf45!O%P=m{Hi#KrVXfbi01a6Ky zixD0Vrtz8vHt|}~L+zZ!+s6Q5s6M9M-!ov2_PsC6+j>SWsN1}osB+u|qe*XjZcwyE zbc4sr!oi@7vxdZ+RjH*1c|q6{{oKL_De2k#%+o^})?1v~_sy_Mg5@gfj^{3`(zpW6x&N`aXrWHFPCCPI$d`TB&zXgQWrqn8mcl4km-n-2H|w={~>A}ZYoS{2Js6LL$K;FL6_QxCV=r`8weLPo zlS8=g8mDVu(>jMkh7kA^r}5+!3=UKCbM!zPZpLMLkhmPqr)8`yv)NY)>i~(LH_1Lw zmIwQ`NAE6Y^&IW(8)SmEQGSQe#)XQSoB&2~T=nNq?ROVau%Z{-x!{|lIw-$@;Gw6< zARR%C8?+Gr&b=$jgXtd6Tgt*|o7qu6GtEbq$_#FjVWZ2l7XGMWc!tRP`lLh;a=ly_ z84LLfumEom_?8FXfxrF!{WZs)Z9N_1H+es(*44b}lA5h>tnZmLFB) z!Hb~aVjjP15}PJ@ElTG#z4fk@1{i4nBsBk9+G2$@9GXas#ruLmd5?t>7^SEbvAvJ~ zCk{Z_EU>fMz^w?dAJE|m?)$E;$t$407!upL=?fJYD_eX@m6>7XLoFMU2GvkO;bC+PRXF|p0z~MEVDZU) zmQIEvxF-i$FSvB|UcWPR5k#c{ivUM-5HGRLz_N^yRQsPn>(Ac;qb(1yxoR9}J!S={ zxkq()J5*rZJvjOW{nS2}7X>lFqp$u&&$AYXb@s`;$8ONv3O#?9jzNrpm+@)m`~0E)2aN^IHR}Z)Mh4cDw%>moA6>Lr zl&097{1Q6sGU*f`60@+USG!W>l zz05Vb*LMEKo6p{aue#f&(sde4mQ|Y!Gd1uNgJT}&yE&9inX?oOo7Z1a&c3RYsd-H; zn`)VG|JX)k&L#1WvdnTN`ZU^2V<#;~kq2Ss^-s0Y&pR#XPb}>nlA!Xr6+{n9Wd49r|0mZa-UtwlB6+cq&>GL z$YG#E2j%x-(c-&J9xv_zzg{qU?do#R@B#C9(WeCQbBX(eE<2jwd3Q3qwxFTR#25+B2t`cVz}vPct*(^_Ta| z$QdD8ZyDR1gkFv^{JuAHlFBN3O?9YC?<~fF7Fgh3C!OH-7oXBDTfqYtx^10IonO)e zi0Kr-jEd^0$h5*Kz+NypDnZ(RxLN*gSlYoRU|K^?JffnP3 zKn2Gc4(+J85foI?#hj>p$ETcx{^MO>qCtpe=YskC|H!*zllH7I#3N7X8Kqy-Jji_i z8E3scB@9)^gS2(JM%yJvF;I;HWN}agcMe+ z{pG1#6Ogf2<-yES9Amtb%)NNQ`W=DOxn+UlA{iZ6-(72j5FPmI&@t}$qdFH8@%vd2 zLeZX|)7^ZmZ2k6>I*-?n$_f+6?pl~W(7j(&4_Hj$I((MLNL&MP|JEc3ih3Fdz>{oy zi$L7-SWZ53$tDqRScVx!hRx)at{=M#5hUY-x1B{tGW#54A$Qn_oH>m%1AHh1P>YS$ zKBbBS84KcFui4PD%-rqhMo?)U#q;`!MH!pO+7D7t0|QUmdD)Hm4l{#5=u0j2ELz9W@_bt`f+_C$XwvR6ZVFZ~bNGR4Br~o3(#n7&a~=adGm#r`p?~g= z$uP|&!O!S<;otS*)DSG!V$D#lGxwTeSHp7gw(s(?GN$yIBU#(vi9xZJ3w!kEJ(Vm* zJnej34ATVtn!2ulR&upP~67k?ISO{H^ zIT$-xw>ai>aVKp_vXFKll)~VXfRS7t-dW+ae0Osj;XZFm!3YVS*l$hutcQ-#)w+hN z-6kt58Kyz}2!A6(Q@>1ikz#LsJ;*2&^W#_>ub_WQ?RMzmGE2dh1Xfp~%>Hl;a99j+!4+|2J zSRttJk`Xr&1^8xd#{KF*7XMPEi(;UD#P@FpZa{t5v1veXAmk}VU@(|D-ic*ZkirF( zegk81z_p{CV|0SDD- zpp2|_ZFg~|G!%mLi319ZJCWZar%6T2eOd}2iUd+~MTx9)DD|~(v%>mC ziS~7u_IU9zEeuHqGS93NP2YMR8v$?!MP#k?gi7iQQv54GW;|USe*bqZga>jg zHV@tZSsO0_pa#Nld1=KHqhN6!B>u#VGA=Fp!?29&ye!yn)YS`+t5Hv7&UbQCQ>F;O zOItO}A@JzVsfF&G<(O=FobKo~2OdMQ-3lpG@s7(1wkyAd^cpbCbUp5|WqUZbijUVuunuh(M$3F;VwP)TS{~0W zM!wFG&_t7niYUdks>}MS%5^_CeAfy8LHt}qzB*&fPr4a?V~~R)S~q(y@@dxPM<0Z0 zK?ZStE)7q@GjPo59Ek0zHGq6Rfxy3^d6v(hN+LGf0Mz=N9=8&Zt~3;pj!)R3upOV0 z4#?jhe`wV5u_D0A4=;58k$2sPX=}qTo7O3wZj50RgHrZ{=^-_m_%md37n~-`Lj@Rk zE>gzNiv6(bn-fs9VcvG`#AMv&BDZM$d%HdJAPk>$W-nZOtWT5Vq|1IXL~ zRrw6_z*}g*zKuiv2wu8nts*$p^pWs(?_}v@e*Y-!-4h_v8(+u5WGJN;AH6e{k7M)kNh3#(8u&Md}AG1vjtHZ#K)koSLtC(gseHOykU~< zpH51&)Ex_JGKM^_hO3#vTFkou62waTF|oK_x2G#D$3#bBd~HvS0ty zf0RARK8PUB(DAw6$D)kVO0xEOs+~!onOWPatYeQTFekA!_8`zIrm_9VcJT}Qd0GSh zHTqHBSMJyPoQ&8x9=}hhqgaw|r|k>5hoF0F!xe;ixki(zYx7){3GXGN3U&Rm5sRA% zlQT*ezj~*Hzd1d7^YrRTgcPUDK#Mq?9Vy+dc!p_=ZjTXr;j%We?js#Fi}ijXRo-|Z&4f#I z$_H*&Y`+I6(sZ&=+2}apfRx(`8L<{DmIf3m(7MRs=U9@-F!JF#D@9 zQuYD(M z`%EtKcP_8z#EDmF>^Y6M>i7jzyX-H847<#()(IWhvxjcS=o<|z$JI<0aM?~Rs|vLa=0E=bv*OHAVJ-nEHUw1?mv6p>M?uR12F%t+TASVV+4fFWe3g$P zHt%bN5G$x^E-{E+12%XUWcIYNZmWM#oTJdLFwyNgJ&-2K`#pVUcaCBe3uXW{C2Jnj zT{uM&AqCL{TpxTE^puoWzWWgwN z`tCD_Uij&nfT{}e*4siM)Oc|am&tepirs1;Xq=l}Xb;3L3Ul478%uRk=ce_o98$jl zc7s!Zth(|(iwJ{sS!ColQ_M%GzD0TotR`T29kNH1-^(k7U~vrKS*4nD%x#-1p;zWlj~*b_1M7xt z7Vj(~w%H87*Ift`5`JpryK}buH5$H0Y!*cV^ z&g?65ih|E~N2ad?fVy6d@tWPUqaq8Ykh@v8*zO{mZt)pT)YB%d&^M)qGG;?$EZPBY znT<$t#9se>E&VF5XS~#?)&hh*s}Z+uUhd+OPy_sU+HU=jz+bd z&Z-h+zn@R~k=@_GcCg`=YVI{cz1<#-JB-t%Z#=$Cu_)@I_<#wFdI+^zH|Kc9Wqyq@ zpxS-8v2N)VSb!_^i-_#}UahdvF!4^vPOzZpH%=Fku;`(?bPA@S@{ApIlQX%egnQ>$ zTdc*)6^;Fy8Qbf8mroTw;kaul+!tuCxN(aSQQ_6BBD8E7ElXRkOJ;T;o=k5Ee|!q2 zx9#=Hc}Hq{Y=(3}nrMtP#e(T`>`?pZZ^9+V`|NGcgJs8b0PZ{4dzv={0$YI!?i?00jB+tmTV@{uoxg>efRY%U#mrNKY1v>#wbKp90vl7O1{TLv4x2v zHvBj*_&;|4-_$H4-ouC$A$Sx;9))#Ko%FLq7XpA_uos6I@>!MwK1ekQttNIjtS*DB z5=ww~ICc)?24NAz-Vgu^6d|SBJu6K7&DROVH-(M5`z&UiUq26v6&9HR!RKqbR0kGC z&MFng6eimLc(;gM5>jDTMROqMmpPvcy5vTQvN*ES|8uz$e(xIqe1Xe5qBJIVyDcLw zusSt!KLrn>UcNnFfnJUEfU91YFiXS(;S}ouQK!@qQpkQsgO6@FP|ODxqZONCPaQga zCTn@eEcg$BQeDg-9mW$k<-t3^F(KHRiA^)X{_#^5hkh&hoAVUQACPqZwz7)s_bcEE z&q^OI-r6tdm4VON%c5MUm89N6tDbpUf>E8M3FNn(Uzo@^yL{?fp?NaI1}diIM^C#_ zY|UC6_zQBaUntn9L(8nsP#evK#?_#{S*Nh`KD8&8yXf?iA*3dgt6;>4!&g8dZM5$( zO^{`*EU{iVsZobSB$bG4;XCpHOY@vNEp-o`C&q`K$!xnr$Jeb$XRDRsN+WNHoR=(5 zQwIL3d%h_=@;uY=G8Y2^E%^Kv%8(aV z)x=jW({9pFTKG!v1`J6cz9fq%aC4^UbJD$EnjM>doT|xu;atSlReY3a>(V8BFTHnx zH3E**l@Qb0&B5zI@Ii@V(s=d*%+Ab7d9!6pT^3d@QqW`n55sTL$S6ZgzsyG(c0|$ z)lmvWevF!jV0T1={=txrfCOv`0zM}V$o)QZjXus36RB_qKx5?BtF>_gut1?Al=UJ= z=JzCB1Z_l%6Mwe{$TPJ;?s(~zW9_Vopy<3Gr09Po>WdKq5-I3?s6#!oE$J^Vf|MBeBXaoxgH@Y1hV|)@O~*mksl=dmzE)zhvYH6 z_NSvk_BT7s2ae;3j8Mly)TiR0FMHw0XEqA1c2JA-#-TH!94d(cUx2q61N!#5mb;QZ zF)%#_tiKEL0>R4dx(|x+526E2#M_$m^Ub!y_q8q#&i%*wz0iWZjRzcO0rz`VWr$Fm zk?(;Lc%PWnfHKcF042`K7Z38f&fvHx^szSr24=6dJQIk^3qDx*m2?C23#d#Q4JD5S zUyqZQiIhM0DqSXg>xxb_^%s8XmTq~SJg*g)or22l~@eI68V}w(RhT_;jM_SI{^EYB^FDFZMzwuvw+z2;fQ%W7)?v z*5=bvI!IcuY*<#9o?)ky)PmtID`r=l7sTq|$DHqw<<9%=cmr_#?D2Pvv!afK{BM5) zkhOWZx!rvj3zMA%S?v1B(M;`&1?H?&h+3Dn^Jc&}FGLmlHdA%3CYF^ZDlhNDl^;m- zi&&O8Q3}2thtZGep2U4FKaLeHe5Ww{(d%IZpFI{9f0c%aSj%V?qy9|&4BDOF=NnJl zi&obGuCOYr@{bFQoHgW(g>|*{EO&bDSh>RbIs1cCf(a#i!-a?5+Bj>}-5-8@ELRXo zHpd9hRMIwmy;9xH_GGPpBbHv?QEH%*DE)TFND$;Ot&w;(9sliG7|4T#ypbWQe`1hR zd|bG!N9d7R63~K-zBtkhNcp}Qt0+A_5IiXPJwK(#wO07qe8MI;^MGM7VW(MO20Cb~ zCJO#K9&&ewdWCYGfB6O4yVC4RKv@dSl%ye)a7lSE#I`xau=&l4%U-sh{go46o)RJSF)Y!fY4}W}eB;VVrc`_-X7#6r zx8ns>;^`-?K%rs0X7OpGk0c?hj$Y1I%lPBct0Gb!aQ2I|Th~_D54O0+162-qmjf6n z#XvSu-*BU6gT{Nf-)CO1(y!OU{z5&)Mu`Xv6J+vN|MIACpT##ngM2eDbKS931o|P9 zcWbD4@d9uF+f%<-T;6vk;xl+&aopV+5kp4qpAHPDGcZzryx>!nX>(G=dju@PX?#lmqa?JhH4{O0*>8^{rKRfx6gM4E7T=Zvw1Fu z0sFEtMVt1afs`kfymvde%=%e|ShaTk#us=mQ)tZiiu{XXWnCeUc{1HII@HIdDx!t& zu2pz~pQuTmc?ZWYJ*r-cnWbgWUM^);VpdqXIo?O@%hS=z#g-}9!a4MoeC8LcU@Ex+xkh>z@93=3z(R=%%LX| zWWf_L_(AGw@J_I6u%Fzl){LX0{+CVt>Yl46s_-{TDh6p{$!g$)z`OK(e6N)l;P+Mc z79_gp{p{@o;YzvOZ$)H`L zq4?_RHJ+IFnT%t3U;cj5d%q}x=PH?%<4vwf35_%2$*7O5@Pb4J(7U7e{%Ty4@9YD3 zC+;UWo34+o84fqO%wgw)y7vuBt0Nckm*LU)C4?u_7Wwy!E)*q#edQAPO1USym5n)w z{cJ<$WdU05pn0snfi}udLEq1-xL&E93QswpCMP_v`|hhZbQ#+wqbSenFz{;YG4Red zag-I9=dp&va#_Ly@q_5?3KCI|^T58FWy@fBkD~F7Q@_C`cbM5P9savs_|%{`-h~{& z>$r{^U6#|Iw^E|x6r)*KTPz}@kVvisLC3P&6))jc z?#%SfVzS7I*M((oCb_5D2O@hq=8#eCjmV`m&v$~tu41bRRqJ<~z1W8yk?#IY-Tbk@ zmD}&@H;Wna;oL0|ih+k^Yes5ztC?AoX&q{fJ1wf5e0r|c<7p~ux@5d@+V#1d_>Cxo z8%_ob&J1gh{0jN*i>P0!a2*Z^9mTvNFy-KZKSMd?D7`@}_4aeIY*cIyL{4?cMJ}aNnpJu1 z!;r)+!8%o&J%sT6oes~etvcF+Zz~_A7rU-i9uPFwUD?p~T^vXzbup?oK3EnK zm}NY}y1wD&QkXRp&8AbX5XmK=;9zDgG&sShR<730tygNVNMOFQ-)?r|2`mT(JzG~o+4o;e&YUx7t9+wh*pz;{nZZM3Eb~`? z$`1}yU}zDvy2xUi^7KMIqQM=Vg&(91aOVg?Q_nfjRIz+W!bK4GFByU!HP8U=leUWnL-ib<_#?|==bK!p z27pb%SIO*>n7tE~=D>qP^s(|zY=dx%|0-Dtp>J(Q#(7_I(IRGL*Uvl`4 zf7#lPNrzsiliW<;TN?{ExyjZ4>|<;1xOd`{z(4or0Jcp^02l<&X?3+z+e93I6Az|A zB{6E^I!|%xelhvGM4fpZa(295$eaV(_}a^FzURc@iu+Hj%4!^!vI5_M_}tVG%$K`! z4ff`}EUu7lw7g!F*!S5M+PD29jXC2~UG;{+Z3A5wA1u0qCS;a$0PdyQCkn7l${w7< z!ac5IAwXt|29PT)b>MY2EovZYBj>uT4TShE@1-e@*sdjPso^|m^wM#TKM4mfM@A zkaw`{Z5LAOnSYaMZq27w^35#^DZe+V;=|YXUaRm?`NJFX-Q2JWjsb?)?-py9_+aH5 zEA%z{%bs&zM%xpu#wnMaKabYPu!fKH2Si|k2&OoCd9%zgL9(^89t(N%tmrXr`C-lG zb^)a}RR$;RhK|z9DH9Iju4zsr>8@$7>+5ApC+$lrZt9tCvkoeDaSK#)yuIP>P@1~Z z4=Hs?ci%3m|<<+ z!k{L^5IT0Z(79!=hfpjjPF#UAyF zO+ka$O?%B#;(%iNSW6HHjA+WDFrXSkbJXCxa%QUHLWH}#r(ruMs6Fg~W->0d=s zx0-lGOt%s|_ok4Faa**FHbMKS$w!2HI?e2E`x-1x`%A7|w4RRlIWei|$PsC2uAN}Y z_G`$>4o>$k)b(}a9&*FW$K_kv^n>)?-s*2RQtJ@X>$Z<$(XtjQQL$^BVQX$SEoUi> zXEMXs)lHNa^HgY2P57R}^Lu1&%sQ;RdS zqHOd9|H2MPY@@V7=#E{_9r3~4vD;t_Apa+w>sGh}z!jpBT9?VJ5&`=J;CjgW3KFd{ zTYJmaNPA!6<8xw3WM=DoNr2H10GGG89icO{gVRi0JP*Y=nYfzZ>i>e=hqUk?DEtq+ z|2Kffy=yiHKZqw;EV&utvS7G^4t4KE{j+8&k>#wH$pjvW^X`7q+$jPhdTooNHW|7i zfVzPW$hmg_I&%-<>7T}7*Hv6QSo5)SE>QshNH}2TVxS{&n@913n_N7X0RXF$pAYH> z+!CUXRyVn{!9#649My!_QkGRed}#GA&>p11(R%_Tf3(p0Kgu6w-h6Y>p}^2LOTWE4}Y0wnFb4` z-}^!T$)7-4e$Toy+Sv9{*SC3&vbI@{G9^w}gXMI2qmpIDS$?_ z-Oe#jOp?1Tvo`ta?_9aLc-X@hTuBrKI7GLrqO&CSy1vW9&2qTTx+R}&wQfX30I)Av zz7NeOYY!V7{n$%4_nW}=EzcXi<#H1{IYMmuHt6mLTVx$OjqNV@LHjHVE4w*Kdy=tP znbvC)ZKiug(Og?`F2kWA^Un^3@~3pi%t-RbdSh zYL6CI2haIvGc-n6HmIZ~-HUAWxgj4B*ukmSjS=cugtXWsp|d~z_s~c2jki4w%Z4IAZGL=63@Wn@0IbGWMqI`I+wv+gHkuVNd|!W+a7F-0nYyGMuQ=RO`Njk8!Y7pO!Y!2VLW_Rj!n!B1iaH1OE%;o1=1mWvdiEY~R7kn>~pP8dj@IoS12+fTjN*m`n@`x9tW_-zd%6nWB= zz`{{+p$ij?ugUbq9NAuwH6>wims6e9tgw1}?2%}Ts@hn>DHA3=pS~xBIc00AeMyvb zNo?|5EECHgpQ+a34K(&XHqIqAb1EBD-!U~%UN5>cXf)1Ap^BYmg*e$DK<>yL%I zdMDnJ>DP8NVdU26qlA@vFmVa9K(BBkJ#6?Y`oI;mKDJ)kNJxeng1%$L!Xe7BFRh~9 zL8!tHpS*=7940qesLWOb4#5HN5RlcJ*D*S`dFKqUNLHjV*Bd!}jt~A5won%V{_!A+ z_*AjayuSyv2M6a9k=I`ihtD@Th+8cHhKr@SR!-%wBW$e-z~in!pa3|C+p*a#Bq#N@ zA{G2+B?0uyM_J^-8lrydOnMjKDOe%jmIVv1kJV0T>-X3_EX#~mY_=qsQelW{PntAD z+HeM5>5v6PGxA*EDiTDPayQK8%TsL7?jLOzzrm1lX6km-aixL@9vP%UuJ=~)3=UpT zdk$X)EhMvmh79` zoeI-3;}=U+71qsURW8eKIM)|GvQJOrs*+QQo-OKB;O07M>dPf=D#h|CeI4$bCe7j< zzQcv5Fr3;a;NbTeV?O-p6H?E>ToX~%nt#JRFYkt@V_o|}v^(-+3q|q#*57(aZ$dYj z)kJBJzLj%|9uli<$&?+t{ma2x!uzEOt!^ti39Y;P!+TW|!Bu-ZNRh3to~65e8wZ-J zSB4J~kk#8C6SRbPyjw0!7A5R?eO_lDA`>X>9U)E^N!;43AMVkM$EHp}C`o!}V}ef+dvOTB~(^U6CKRK=7J&d9XT{o^%5wIzvp|kLD)oK|pBD=4j zlkbiEky>;^+drx0Jr`p)-PvldYj(Z(KJDp;~1Ft;vW zI*A-zuE6uK8GeDENI3_9fS3oEnWX|68jJbUcL8;leS#$qdz-(y6=^MuGx@S}Pc2L$WVj*8|2tVjwPRYMvFw~Nx0vA*f>Xws`bK>Nz9L7Z-N zYr7sy0$iL|$)X61c{(xaB`$krrQ-`G6{Qb=y|vgED51Jl=YF=9euoC&T)MH-(gr=# z8;PTpfSJafYVJX;y0QZ2C*MHV^?G3(P{Y;V14g;id%XEa@0}n$F0THO@aTDu+4~GF z*M_XNW)la)LQM%R94Y2Xo`3JOC%<7~-!VZ3GvDsewoBMT>1{+0Q-V8b&qi@CbTYzT zeRVx`73t)6hjm~jh6)ciNr8ADMGvMel#LJ`0r(Ie>=41(Qb$=>7@Jc&J9TANBUfjV zCgZrWU6`A-hZLp&r3gf>&V(7G%HC?p){mz16vkW`mW|{};3#{1<1Smg=b)`{TvuhZ ze!H81`{0V-@a}t)aZZQEeMVpIPttS9+5luKk9G$psEfPm`kW>jh@!FU3JF%Javu5v z%)ClHLV73=X&Q5=EQa-dZCk&m#+91+B2`e!jB{dT{IUv?$tBGxl4FKRK0n1YtIM|3&mx5i^*zJCY08cMdbVB_~K~@@~(j+suhx?O?cVuYvo#w@v%x-bfkTIH{Xa>}*}JhRFs0%BMM6zwgx6}nkYDh9!=1@!C3CDu@u1`E+ z+FaZbxxJ;-tT$GjQ}zfG#p?HJuhL|gcmpm)f$reg{Sk-s@*~h>+Ti7yz}w-Dkj7(i zm-gk_ORnHPsp85Kq~gl8mcC(L&X^TR-eD}?llfu-mEM4iX_@cb{Z>yN>B-@s!Z60W zM|`(Owa-v)uv?MP0@JcIQGU>A9kj=p40pPg3%B;LOivRO)&z>_!z!D5r@ z#C7Fsix~&yKD*}?O@+Hf?$zYBTV!37x2nha z0>7&xYN?BK^)+uY?=C5t=QJxo&n!S=|LrXRdM%jflf^#01nl>>6x1Kgw_gojr=;{R ziK;(e^+yg1Y>HD$bcrH0?^rjZ7AQzON^gNpe`dZwD$7Jw6)P7524)%%NqN~ekGaVF z1Wz&jhvuQZ6X*_1nm!q9}u4XA%^zdVeV;m6o|0><~O+*r1J%@lEqj8U3Pwd>!a|_ z?a%{ba{!6>b?P>d5ZP6A)fV>ibO-!^-nvuSa}C#yefRY-@R^i%DfX7|ZTGD_#tO{X z$Q_FEVT8tz$hk6B6NEkq{%R?23o1D$()!~gy|-%pQx?7|2RO(!N_5^BO1IPdW;7{sdOK!uY7Q%epmUL z%Z0DJ^B!^wAmhE&$k939eq)K`k~v>}89Ts7KiWQgqR+`&ZK4gc4Ih?b{SCtsZ+t z4HiAliDy{MG*(7tX=)$Oe9aiB!lo#jCTraCb){2QwnLAVLrs~wydOV^c4C>iwp+t3 zKS+{Hqg{YMw!Zgm?#EtU{tQwiMH?4`FU#JS9d38&tTNT@S2-yMnrfVa+NJaHvppEa z`F7Rxa#r^adiez-Es(A;pAqN+Nh`eqd$0);n`0)Mjwfj9D;GV_7N>Q$XJ#-`$K(w6 z5-i`sV^N~ncA)oZnuYy`LOaWMR28+pEE8?iLHo`Uaa+sIOX;b?1=1Z?hm%RK4UCbJ zlfFKmaJAq(NWzf{qjWeQy9FCRo_&{g%VCEheX9PU{7jv7b6zrSWWzEVIXmqke^5g$ z=e`17;NGj8(4Rh&K-P_s$JfdVKZ$HG5>NJgWRO>phTwM8YSjZGMtQ$Jy6tw7A*A*9w}FRu|;^eD|7 zn?`KRG=DO`D5SC+rXJ?`(NUtCENG*@DLr{KSb51RckR^`leKK>U5r)MOI~gIRjoP? z!{ib|&cXjj+>*mA76Anf z5|)U7itHsDwQLghUMeIZj36_F0C~T624bH+&-1>&f8IZ6V{+%7-*e7&u5+D}PP_0x zGx<`a@=3>6Vq!fLVcjpoq8^w`^1|WOr#JRvd4uNMns>^nJ_B@-o3G8BF7Ca#L5!>f zZ!h<-tW~g*9>-KhK*T4IShQiW$adg8Y`!5hzk0)e!>-EZ*WUbMlL->_{ns2_oP9U+ zKw_NLl00iI**k&)bzuXIzh8#%2FA%H-dxKq0$!lbJLy${* zW`5)Pz9#RHhJbM1x_Y^V$m{x$&W&1Eu4#EIM~Pc z7Di1tSxhq!tp}?U+BWM$yFfV6z1?EKa)dpA<){tCZWOYz6e!293mtf0`sQ)@@)dBA zfEaDBG@8;Du!6&jv(4df=W;M1++49MUEB0{FMnAspb1d13Lnc-kW)e;IeXY?%l5s6 zmq0Qgal#AYF}8)wXx7NSDj0ZjQNC9c6qH@l2s;P%JFfHeiOjpor`;K+wyLF7ek?6? zjMGJ96+3*J$!M$YwMHw(Jz^|{Vc6VeMd^N^;&T~o{aLS>GPe^u`AAKB^pOSjQ==NL z3RLUc8ZC95T*8Pu>qi{=Pu>hqCw1xR_BJLa#d%yjOYCWyN_vg*li)(6&3&)!>*9V+ zi|=kJT#L_G$2XwudPc5){hshn#WPQJQ{}Qp%pT_XCEFIwJ$kJ*)pTAwrqQGJy7GhG znFOMt%v%8z#lj!TRJ+18EnPA@-u9HG_gIlHxW>M>@JGeQqWUosQ#0b!u>tx1W4~_H zm#eg!X!p#2xIwGxPv)Y}nWVv17p{KMBsaxRx4v0V84=A|zmI1Wwbj8Cj?pZUoyh_5 z73Nu4ul@3r-Uke-THw;J7bNuz9GyVXO)Yv;8`j19_e4k!_1@0$k2mG-4thU|n$b7% z59THDYTYDEt&KX_i!Jr~by;-YB)2^W^|^zjo|vNI>rt5M8%`9>m(N#og^ic+>E6#@ zkmHY;I**Ctk_@>#9qJw5snkb zy?-AqPT!u)v$;AvPj3f5GgjDi|gOr-XCQ?6q*7 z9mBdK6j^U1Z@P8*(@@AS}x&?%ONb_o7e`MsOHZJ(j=qecbDmM?TZXDNT!IXS0hzNMnF z1>tQip>IKWTk?6jwc~?7p_=`c9sI2%pS@feHpp=ax6ju9P!sAkjcg8KRp9)-uL%{r z#8(5kLuWJb(d!!M=I8v0=n~+bDkavPsPBOj15Q~xFD0%hz_kJ)$LI+N-)==!SlA#2 z^JUG=ep>q^bP{EHTmay(BKHG@9K3(_<0?3mrPYRtGV?wTZ3AiZvczv1z?p<*8!3|$ zN}~Z08{zONFNJdOt(#->_9-LfJ~1R+qf*tZ;3jlNW{b1ea+$8$d33KM)4f8$uO{Nc zHUJSTtt!lzk?}1L*!3O}Z~_Q}>&%PDOY!2qfU@w?>p>3P;dT{QMrLce2J6l6E-eEo zR!b;9SzoBLo_T4@5x4m_7weD-*pp%py*Be6i|cr^bNfPhPxkz-V$DniS&bK^kE01Q zh0kd8TCn~X?`pyrL5u3nJR{yE_8&JYF{+Y0PLv>`1|}rcP?r%i44jt;W?)56ckI=l z>5RDiG|zNxbaNLDE0R&>(O){&rB!C%grU5`ro&IZJRTKgB9%(d??)c8xa1pfI`-ZC zTZsYGI^b z*Uo?v#TfzxgTv@~iPbAolNS0zZ^)|cuCMf$oS>Xd&% z7L$=px5M4j7Jy|25J?gofOEL56g+@L`iO@uJFZI~I942&IrM6UrxX$%{u{gZmF@rb zBjwu@J^yZ$|p5|RwB4BL^9cU&idYin~Yq+eM)1OmJ~wI=Czp3*%6|c21!@ca^P)~HEUoc%9lminlH1J1&Mdx5MjtMdcK@QnT|cLeA;Sy0i9AMi zs>^<>7rBsW?TUVc2eln@-!RJ;(~(Z z7ky?Ya_iMCy5!sPt4&7N#g(r#rgten!j0oC8zWN{QC_-U$k!Q}*b#XI4j-r1>>AVU z;#{Je{lY(e)MIKzR(F)Vy}994B{ro#6duvq1)~O$-Ed+m>-%sM;hHcoXigvK0}bV4 z@km)jD~i9P!cGZM(75Jbzdu&iEZ=I|#O8858wT*H*NRZfC-&nuI%>@$Umo7r5`d!O zi@bQhslRVb2W(1f^{P_Cbn|GLlG(Bg!X*ST0`3yB6Hj+wsuHs`#y z@BJGVI%|#CA#tLh{Ao)|iPx+-iVA6ofppLJ&t#T#FN94sJ1+0v_7#mx+yG|66MR>R zCFZ+byPv^ z136@+yymNMuN?*TsVE>t_sJvyG7&)A0IGb)^}ArI21Pm&Q>s9y z(1TcZY&WVC+D#TgjbH8M>&&z`2G2hD+G(~drJrt}G&R5AMm+A5#8NzGD{o&{Ig?&CgBc|#H{54-cx^fg(u)o!DR$FjfVXz`k|0;62t zJJLKHATY|+jrU%g_dizx7!Tsp z7@mFmg<`fTfI_%D9{}dXDpNS-o({KN+BLu0>E`5{>$~%H$#EURp@Uxh`Pw6csFkYi!hblKFsDNT$Sz8b2?eVLD&@3q17<(M2MhMtH z?~;5K@dUAym!Edhti7vF3fp1Z-JxpXDy?eJ{rRy3YWMMa!e9A$;So!by?+{1JkGX| zM3@aS1o3_)Dlk0j_T*;m9p`qOg8`BQH+Z?cR`w{?edd=Gnn=^wUF^G5I{c`@7C?9ZjgU1X{P&eGP!$Emx`R^ z<#rBLE2*D<7Zzl>;6J+ZnAkOcym>!)Hx5NM#O)7PFRq9g>1s*akG+?sjnR&kbtHN) z5b>96tQ;^H46Jx3Y!m2AxPXU^4+>UdJMx;>yF7xf%86h{9hdWm6{xqDxBU~Q{O{T2 znT%gFBKcpp^+CFszvrT^8;|YgV70(7A)B-XiLA>+@zuS;GT@v-cn)8lR$D;o@|&S3 z@}opxf_J$857wk~=nRByK`(=2;s3naAB3bpp|}lF{^X^I+z?IHU`Y;(4m8m5pOHGj zX7RnrUg1DR9?o34#_IzgB3R2AR24s-0>MyyAA5Pb0%HZ$+_+i~mUWe3_$Gz~m<#sI z?X!9G7I(zDQx@12w9EZqjRR&r)N1myEoYTOW%|WQ(>zw|$Ju8#04GCrg)&Rk!kzeL z^j_wHa^rT*R~4-A1H4IG${4;5?iI`WB5AMdLYTP?q?q|0I8vc=PwLrKX_w z8Z7V<)#Vl>^vN`YgzUAS^TMj1^2_98l)&X)7{goBl1+jVf}YcU^BbA}cux|+peZMJ z3@!D^nK>sPYX2_CH`$)i{sE&}&kI6VkG#?qcUuFoEa&M{$+Ja-mZD$kwTrxfQn>@d zj~4Pzih<=g0n0h4yYW7a(D*u?V0WHgHyQUpVfE*t_RtF@7qdhcJu2fQ+k9o2H(_Gi zj#^3q!3c~QLjqscv*s8S*0l1>exkt=*APRODML)I&ixjl)C5)0CiScWvG!PgET)#0c1K1=#n?}WpLX|pmTDUc$6-mBB?jQ#<{eY;|?Ymrch|`&si-W`h zG~R7tyx{PlpcMiYw4fW8ow0MG>ylg~gkNg9`Ho={VI^1)TCgBGFu|gyazM`5PaK-# ztvz@SsEhR?>^BragkVWoYeQKI2frU2$;#p0P@)=Eu~CR*mfR*H=7%5jazwE;w?GG1 zrEH(?RhA9b*#FRHEmZdKYP=F--~v=NoZr{ zL5AhzmyzyYmY|*H?p$|y-d#VYsYny;TY z;LpB)ch2Tbn^UtSG#9cO+t+xOv&mdhFT)~zCnW_1={S_Wz)U1r$4$w!0JI^b(`v{; zID7^djF91lk^;4&`LToAOOJpl@o8ZFqXOFI)vK4P5eDuFc`C`4?G@OOt~E!BZ!<4` z{nv%%jyLwl5wPaw<1uN4GMB;|JLmZ-hg3zI#wXqnJ-3suj`(8!)e)9~)nG|2xy@OB zz)E1PiSW++pR4ItwFH%wJJY$jZ~aqA+Lhfi`A*F1_EhAwhiqE4+<`= zzHaj=9Fn(B;t_Ioc*#z!rua;}M@`pm`<6SEJWVRhY8SjppAO+h{Jm_#Hae&v4WBw? zaj&j^c1?3}8n(O_nEA$^wH!M?e8UD<)QHKfKn|M_yTQFH-$83W_7{A+B@I9rk~DCEaIdh+f5P2ci11bBS+XNuvmY!%B} zg&n??ah1EFxY80DNpEY32*M`yvP?%v%X&D_0h9pP22zmHyR3WPpKYIqb9KSaN*aZ5 zzp>20OXA_JWLm#I+e+9BUZKV_6U%IR&sPKS+Ni3}<7j)@K)tz8{9j(os0cDN;q6e^ zAvl#w6Y$mkuUZv6j*B;Tq@~*h1znNvP3Se(TBub5y&Q}ipZu}Lpbyb_v=V+zVpMOm zBjA&Aa`&2*{+e=grPazq;+McMM3|_O?IGV&vJz#{?`-a3s`9YuDyHqs=pm`S8<1|} zS7+inY`q$?&{MtJVLsW0ibVl6pmD<>>7^;CJz%TaK?d{J4cWUzeA4Z7%WOr@pg*`+ zl@|QbTuK!>RV??^l}-TU`X8fg;;u;mKzHpzC&Hp=$S*&=lwkY8W2)s@I?CgGr}uoW zozJQpu4ar2e%ETqhDNIowp;*H$wY8tBvD}bH`8cO`s~i72Kv%&;YvNv$;a};ypG>b zv+pqXaR7zUvw6NpocQr_W^1XpHu(IPG1rv@jStSebw4e9VDk|l17#-I^AGHd=d8mI zC)S-@mvx%T9h`xGYI9P2<_tGBOxmqD8EBlvmQ8fVL0Jc-lhnvv#(HB!k7i@n9E&wbTyusqF$-D4d(wng(g& zwvz8#BywBGcZg`;EpbYLut&q@2WaKnD?D!ggYC!u-20|HYiNS&uTbm(AjeM5QDf^Q zplG!hkOM*Au|v;b)NN+r6NCUq<=Du|DI z2TT1wUh8i@SO#N;)tb>I9=- z3`2lZNAZ}=y@u|Yi(p7mW<8>+DwfoooFca_kDE={ctL28 z)R3$c5(rN?3laIPSN-{=o&gkPAKH!6(n%tkPvboTe}Ox!!Mzo6r5y}wEN-l?kN7w zL2OBfX|p%~h8}u;?GkPl{D5S$W>k=l{2Ji{X7YnSVrQqf?R-)Bp8S4VmncrRJ`)=+ zCS&TQ3iL9{S9;<0Uj9jf&cD8Pn8YMXdONwrkGvwEF`aLDT>dlYh1PY-w}16O5ngF? z7X+10pt~I*gLHMg-^-Hl3Tb^T8*J;iucqt!X7p;JaNCO9=eS{w3@Sfiyy3FKx+EQ; zoZ;R*q%x-uQ;ewA??k_TacFJ8viVDax8rIZkEvf(g=9?iQ18*wsdrWdYj}Bv#zLQV z4AxyPXcTmrW-G;xbX64Hz~>iMymV5CaX5|;Zw|lIxmrL8(5j8ozGP5=b}8bm$r>P} z+21V2EAmkQkiF{ChO`nvt^%ER?{6#?s#t$beYV(j zU8q}8j$(!ArpvetS~kpD!m`+lJ`%`S?0`;L6eQBl8Dw8omdT{BOvX_&sPWUYuZ!;q zfI~UwLkHRJU4-5KVb9+@+=iy8oMzrm7X*u#F1%YkdBbtjW)ACb6T&*Yhj9)p$s)4y zQkJqLBz>62RRD5CrU|XcsR$q5d^VTC{?g8|;as2SE{uWHuSQSOF*8@SFmEv(n5JJS z1A1uOi_*fUZ~;;@>6fx&rWFr=4kuUGDO9E@#ani+oml_NWBmQ^#FDCwOU(_j>Mu%Z zttc!tIA!$eA>}vy)NZS;X|gEo=;%@s0U_@0E;sd--MB zm$DR91H_+EKY)4EW#sY}6{6(vp=l5%Fq!HCs*SWB*YaeVd zITkBP#BR@X=pzW&!f_`If3&@?nyFc^2`>0{7jm&tA;WEn?C1L`?h^WD>50KH6t5;H zC)>6wNDB}tQ9D@o(3<}JF(9sb1*On{ARU~v#o5n3%gC1P1*_8tDx@Bds?hCPk7Nf{%mq)TFuTn5|1N(L{qt2XMK670{Ku)}IXnGK%C|8l< z>qL2?(~&7>w_tuIlV%UPNb_h;xY+on8HE{<6YlU_uYE?mTOU-59{(WrSlH*Y z9*$B^MLO&AI8C2=-j0#X#CGUh0A1k4KUygk`jJ4if?->2KLLcH!;)0z zRZ*0qS74cQKciL|UVUq|+NA2s5TJt7XHh}XmL(N2{D|0&eB%4s3(d3=A_C_fEkRJ{ z#y)WI<|_BE!l_#;m&nLTv|csCzi<-Zc2y8SG~;}A(Y_X#hXLm)d7HunKcS} znz`>>i+yi~z4_Je0M@j;iXzW&gq9hYbirdC;qZkC*8pv7?Ytm3fcV8);Tn(zV*5d# z4cN!3YQ)%PGhr(5{fd9eMD1rGE-)J6PYdEe3B;d9Q)8$6S!^taIC`?r{O(3!In<;L zsIsY`e)b3nrhrcv=(TwEDMG*v-0L$*H3J|AKMIvFrl!;uqC%N8anAI%9-lqQOp5}X zCe!MV?qZ4vf4hu|1M>joY`+GHco2%p8f$zv>#1hnA2Z6zL*y8TyEl?M?x9HtCokEU zdj#8)mCji+6}c5p*WKNG&n@VcIr@qxcCMYSboP}^><&<@e0HePvuXZS4&xOuR%|5} zJII){Y$eT>T6nB9gWe3kY1!rtn-WxLJ=F~Od3bsHDjeu?T!F{cGLBwc{;IU%(#HeZ z@(6iT7X^7!v!q^lEa}e}`me*2N6&BqJ0yStH`MQFwSNV>uyt1Rhui`Snu7O6<~=be z1H?s@fw@_Ka-m~4`$Fc*Dm+?ka^o_`X?{!agVlL*2h<70S{OeDvQ`rcm>wji zh49XQo(cm5YVnDMI-naCEPXv_=|gUv>HNVcfa_KvK1!UUy2t?gs+$M$akjg3jK95E zfav|W?Wf;a+zl`Uc!7?a%%3Qrb#2xvbq)T5v}s6Zt*3y#%x#z&YP^TN=+l`+yLZe4 zxQ`{DG1&=4fi62q1(5oJmLAR#`(y!z8YCnVPqW{V-lZd3>>OS~l5L9X@zDl^Wls;I zUt^qNJvg&lPENA<^Dj-dvM?dqT|^OZy@ zV$@|Lk;t30!Pm@?UsuKkFZb2M=~Xw%(`Fa$Vn?{9FawSn2I{JB0Q+MCQ%Iu9m z9ieDZrw5UCAM{hIxxBhD+=e*4)4l-;W}e$ZAo5CqR+f@>^q?-o?`7)D+l%lQdkbjVdPW*SU2SO}Ze30#9R!VRLWHLt`iMoLOxlHroPhG&gnZK^ ziw?M)0-{;F@j9<#GUfUq)9_%w0$y~xY@N?b+gEY$;^^7u)k(yw9TOJDSp}NOzOR!h z)kEe@wj-E23oUfNxw)3$AYklD-S-Y{Mm$X@;w=s~zvDza@rS)P@0I-MW}ZneL>spA zt6R9Zt|zOWr|=XHTiykr1e(PG0qzBd*4!<l$ zXyXwiV<(=-ODW~;+dLJJAb`5ngi(;Uk1K12ar0eJo0%si2(b_%_d1Bebx2m?=!_mxxnfd$`d zx_>xvsP8pw#7*kvjO#ZG2w?*#nW-TDBraC4ozkuua;Rc4HKkE4TTc88XsRhhk7!4- zC(hj{+NHAxT9@%!=Kjbv&%C0g;N=6Q%6(q`IAG5cOR9FQ1xzmU|MxR}va4lxu?r|} zmOs6k35JvjnQGxa7Y4kmJHnW^H|VH{i6%nwEesahPkT}7dE68uE1|paOGm|e#~X1A zt+<~)JI*{UXc#U1Qbxe_$HEYOk;4 zrYoqv09IsHmLZMJj{6hT9Gt;FowWG4by@n!6)gzkO!iXYs;w+CLP!gE_!<6!l%4^6 zJAd`SNS@!#)w)S+NaK-a%Bx{)NZxj!Hg`Vf6~%2v!B%K4l#i|%;52e{OsnE7+Y)pO zuxRofLL$u@?iAEs0GKk+beUkK6|L=V)z)IEGHY6OTDtThKLYLauEV_QWn+M6`Pxa4 z{Qe9<8+q#JRr!OqzbPGbPyKe02E}#d z$(eC$HmWt&sA(~4R+uF&Vk%HA!yTdA-0o(eu>;jC;BvqtM>6#njc@>VzBQe%nJ;th z7{R}^*rpD6$$DhMA98BCtwzuS9*j6^=`aA5^ozhCF?Qwvr5+#)futygEGlYC_6i|) zP~cnd94r_62(-O%*eycZ8sJ|Qzr@#Tvo(oVx& zIEVw?atTnkTsfqzoU?XxVKTbMwoK8`gQjSVd&k-^r)X^7`$p>-lzVjr5~mXAEqGW} zd891Jh=6}foc`%XBjiDf)j}%pg;2E|1;+S5C2PZKyBiRR#11{*4mR4hOX1Jkjd+af z$n8l`B{XU(0=*NN0)S4F6BI-gq#&(?zHmc<$MdJZ?>A!g`TMc2ur~r4!1zZlBMM*oD#MVUuOwMkIX2@n%~htcqo#r7y=iz6 zmmr^B$3C87!~k=QSB<%) zyFutrzP_%kFgbAloc7pCu6^r75N;%u4)YfsPCevj-RAM-(K^;jbx9hlug199yiS_! zT{~8p?W=?{#ixgZp{l$squjgBC7 z-mzD}IiP=2u>0K0jk6So%LH!}M%Txif;m{}?6Vk;xL~Vhy;%D zL50kg3P>@LL7w?}gCB@7(VfTO~@p~Gez=o>TqZNsDaK!QVxXPg)tL^z#ltY#1y*5 zljod3JE#Yje}KE|Wp}=d@-xR37+^e%c>tw18q)pP04@o1pnOfz;16qFx&Uh z&-+2|77$OLlmw&rxB~q@U*?!3$Vz}p(uYrpJ%I15|E?}iOWi=ko@-PHBHoG{dI|lx z#tk`czHT{bhLlDC%=xCk8DP$Mi-2xW-!HZX%~xGLV0!9;lo3Q3qJ^>JhvujNLfRs>R=$!N@>uG<}^5;jI!B=CF3x`&S;F;WVd&J_oYjb7S<> zge!(uXXHict<{~_Bm-qwcZMGr#hRrhWpGg2sqn=sJwpVT<)TgS$w?1*(c3`>v+IHj zQw|A>6o02rX@826iQ+Ae`!w%!Mat%AEm=gQ(cXR5@ye>+w5vRQRnKvaQknW8?m=x$ zp52Kl^YD^7JmfPRd#Q8CirWc8uAoAGTw_qsbq=^0GymVcymQNQKJ3p$-KZJ_Q(o1s zI!mhZf&C^4%eGikZ6z!W?q+pNV4aVG-&zqY=O)%%8_svgw~{|)(L0@#jhvn1uYn~?52WPXqem>+?dKoM_)Ibk6m~~;;)y>_mo}wi z0_Jn7S!3&K!(^t}(dq3W)ey z9EGId6|b1h6JQfIRA85TzoEl{3;Hjkqe0m!)$sbp*aX%+ueG(W4Kup0Z###m`=;j; za2GcayLtlh?GN6I3)E4L@AP1_@W6PF(9LH@1X$yf&WK_WiN^Ahpi`+4&z~A6sE zY_r$UZVA=vG5lk|)?w=~(}AOXpu)>C=wj9Kr;KeGCF5$0lVA|vFN$FaLL5&6((&_9 zI$nvaU?M4ypWiz2EF(!F9dyc`3GSAqP9M?)^Oqql6Exdy3jC2k&G^&M6VPSFX$*xL zLbtwVHiw#n|}58Qh&hj7FQ8YuM=mJkmPV1%;( zGgjSfL9%U<4NYKSPhkPnRZHl=Kxvkmf01yJ%dCNKxfmh)dN6%$Xnr@z+i~{576&)f z1_8ds!TNAc)61Ta%+n$12Vjf9G9aoS<|SF;0m*eVnTR-^W^)GiPi1$uJ6c+2Dt-3XFrI zJKUUR4ZJuP=OQ=jJh03YQpw>804)R>3j8#x11ngic8G#(!`{Zd$EVx+%EKJ-X-YU3 zvt09E1rP;fASeoNb*l2;aEHsKi8_)XV&8#LAbTQb zdxh8Pe$yV4=EmXgCt{J2!`Dk^CS0*ed7`?bp2=xyoyQt#UY%=hh*QOahAZSny_s&f z#2!TV(LhXMR4hVa9~iUb2*xA>&)D&oR?`?PRI_>PC>G31cJOp3G?7Jy2kkEcJ$hcz zorT!$=@q1oA~bJs{ygqEGF5h@Y*}P_F4baef9_ad$r9o@a-)rZ=9xM}Ju`gcz>XS)6%t{Z&7QgwMu-LS%K(@)(@v@${wMH$N|K}lZIJ$k}z->G?=Eue>U z!RU-hFWjsu-3pPsL2ornw@hqbvnJCqC17G|ny00FtgH#Kb9aR9)#8m4??gAT5m*&( z9|3seKJFdW%Puy9hm(EhKa{swwLz%Uls$9q-|{3^(FVW=y8?A@FlbVV;2vH*)jjh+(?aa$77qFun=W6_2+pDDX=cPD$Ki?Je}A9Cd3i1 z=C`E3@O5yyg8t37J^v|xK^#&C(_dQ{-M@$>b`wajR#>p+LW#CjuZ~qh{*d?bIo#|9 zF1UN`{TO5DDr3=7x7W%LrfT)tc@@l9n2vut>@l%8jNK_Y+x6XpNE0vB_Kf4I{h9r~ zFRqi-ilt-t(kL!|63y5V1B5Qac#q7^R!Wbjes_=Z66F;t%3}LXJ}^JmVl2t!`N++Z zm0M?;W4iBLlX%TPSn7kCuBa24rnG0z?Ou#Dh85+#PFFLt&|XZ*POl0j<%bn%=4R1~ zy`Min6yVi%)xX%Pldgk^k?$UHk;LY@Kz(lK)#QQ1#<)s`y1(~lTc=wi`&N0e zf86&n$q(6~W%%RXzbp^`el~o#xW4(paPxz5RU4{jq0RI@?-qXf8Ol#lioeYi=RWxU zSC`#CHvc-72Iis{+iDm8et!D}*SIIm!}yBZS1L#SWBjEX-~4Nep7f{H@Ay(`b39cg ztf}mgdZPd6Ag)M%G+`l0)4idedT&ZA+viKA5|>yhjD#VnU7LTWPRsFd^P8qbQ`K%b z;5YO~o}!oBM=yKO9cCM8?ok`R;B$hfytPD4{ZElv2ZHgmi*&C>>6z|?PS-Tsw5;(r zx~;^=QM)6YGLOsg>+Cyl`0VX%+js2RyJ&h=Xn-_aqySz+Z=T&dE(Nbk3IC zv+bu?DR}xY_ycc|OTkB_+z~fl{bGX!ACdlj%m4i;*sb~Nwx?bIwOlMWbkso~6dW_Z zSNHZ>%1NA|;{)$B7u|*nbCh4r<|l%P?f6x<@!?Ln$T-**u9srzp~C1 zx_~`DKjRi@vqwrn7jxk737zfi?Nq;1$)5$ zeGm9ho(1t_Lq5(8uXu7>VKK{gNRM^@4@}&@&AhJeP-l%wgKY06+`X3yg_3eNW$rQ` z5cE)LX!{&BT3Z_p+1DMSZFCmg3g|0EDFc_m6&KRmQ(~u^1@#lYerb7kValN5!okfi zX<7G}=^fX!IfM1e&r@pdA9{+>sV_)SNbCXwQkonqqS4MXCXM&Wc?n}PCV1@`LUgrj zaPk77Ke&Z<*I4X0ZOJ`If)wmSjMWO7f0T@))i^M2;<>ADIW*o9Q%*pSIm|YduJ5N} zhUQi(mBOM%;?WE3%334zMV!*C@BBctbmVj^?cGtj$4KCKezdo0kT1R}gO_Md>q@EZ zr*@@?lhv$)zAPNFy1Dq#oX7m;;*Rt;)JaKR9HA^Tx#hUPc=^ara#hcUggWQ<67G1o z>v(&<+c+Ag#Urfr6#b?<(;~6(MA5X@ep_PdZao_Qp2yKrqb((lWx}1o4!j!1;Lo}_^I5vP$U`(u-ipxX? zeVp*uY8vgI_m)Zr7ZRF)O7gM7ck_x$m414J^cZ0*a-k`zs~QMRH9z+zy4dPjJS@4q za-66?j9I7}t*9K=sHTo7G3Lp^F$=R*%TwaiyNmhL&V-?P_MnW5v_ zdjlaeU|Pigqm`NqHqiuAhw@)=M`T|UDtnP7W04MiRLa7vNzZkHA2$K4-?_ck&~Yf9 z?G_+oXPdLL#^3B1`sdYqb#P$5vfo;Hcc|Z`UpW_Y!gjms#6$1V0hUJ!Ik)%mm>5{m zj>qM+sY>eIp_DI<#GzOeSm*fAGeVOt6NfGDn*Pkb3%6@Tzi$hrJc{@NXF4x%cLcP~ z3Smbj6zia!I0eWBAjvL{)I=ZBNTXMy&?jgYFTIq-a7^+E?YlvW4?c(Pu{`q0fsqfk&3w+s1@HUJ- z>-Kzi_8Bq^Uzhd5wHQoJXzq7(y*Xd&{=m2%=3rMz&`HmF5rJ%4^%N(KFP?8~2EIOa zpfSN_MyJtxPzxXI3>Ma3aq5kwv#8*w3)=b&dUWu7O*Nj@kP&=_v>X-uV!V<%{0KeK zSu$=;{|FOTRJ)~#&kFW5ZqyC-I!$U58-0kbT`+#KRudCT0yg?CA!|f(`D3?!l6I9( z^Bk~T8T>)$V(ePY4d?H+Qjib5)xBxaD#88b21GIEY~h*P6;*W_!wacQV->KvOo?#v z{oUhSsW*8{uJrIMQD|(ZCeOIAN`7^GsbaB($2r>kQ;cRGWjCSO#!NKD{4ymmc!#lw zN=IWzhU^rPi$~>_ELZYsNNp*xv6-JVa1@*vb)_m{N^I1)Gs{K*{>pvi*2hrIRze+Y zM2mX1Y7Q&OGrkt9Z+>OoO1SbAiJqkX6x|=2BUifGtVj?JpkP2i4MgJUNpFvmiZw^9 zJnHYxww5lSy*=j}KX`jByc;c*CuyqDA0-4Y-(#eY2M0`(&=mTlq?YJfPpXoYDI-cL zc+m2gQjeY|deTHWHg+IWygpshLr)Jso^UAViHn|tQWjmGhU%O@`7yP}!w5NLKlYcs zUSQ4k3c>vI?6A8n|^e z>cTVI-g@5zgGo8x&iZAH9|}asKcIJtD!M{>#ttSJ{=kWQ(->f3B|oe3ux-~mhucvj zk^7cHp?@C;(onE%*0YqYeC8RqpebMCAEMydE;LgWq_Q~luI=>C*r*UUB|HeQ=HSOl z;9}oJ+=N23$KRs)Hye8z^G(FrH>%16qZw5|@K3iQp-o!N$Q^06Pd1R~lSu}FD zR?Cq-^7RtT7y6dMW8@;|LQ1FAJzmC0@=|7rlNmhY=Cs9)gh0(4snXAJfl9He{=Rr# zHE)`^Ed3n`PZ(~s!pM8i5$H*35693Nyeg&Y4jX8Vh02q%0+0Q@gUWn2#2RmEo1>7K;pK+HkAL&y_?^O%R zjj89ci1!$_3De3BUc9VFL#`#|3>kS4l7;c5t5H0p3X-(nHNGfHn3o%L>Cj3Sf@MSuM9Zv)`KJ{nth7)P=6~OcxwQf2 z&RH)MWG||k3f2mm;eQE?Hcz3j@O~O<$oG(`XmC}QjKK6N-!XOwg`7b7Gwz6Tt%HJ{ z05zWm;WY_pZiOKzsC>^6MB@rp_&&o}t%tFZAF#NQAKOB!j(-Z~ETF)HZ7lHEc5n8v ze@b)1{0bB>m3|WJge-9@LjK04{^tfX17M%mgv|cfa=p{%&kB|Csak2XP2ug2yP)XG z1nL8U1?CO___`fGUz8I2e!pPrBM!#7T{8%sweD%Fi<~doe*NNWZe6jTnC^=gxWSD! zfYHGVr*B@6z&m*bDFpG~3sQFf_4w8R zG0d&Cl$hTnLLn; zCUhF(>_(sHCpTB6(mjZ>Rg;r$2%n{xFrvqBw?6Ul{&@@c2V3H;V!CpfHRF*6LSJ-f z^b*%v&7-^GzRK4tRz?!7E{m$CD+lbLM^fZ`dlzC!YpFTrJ&mz)49($y(O9`w+6IYA zsF*6v)EZfz4oMITAX?)O>WfJMziAXo-s<%E~`t7eFT2;z9(&ux@6)%n7sX)O+h` z{Cf!hhX6kutkgPYH8{T;c~@E(&B67O9J8Iq9ORRNMN&ERaC6 z43(MKqEEo__q{-h`)?6=Ym)p11T`qP-pq%YUppgIrfC)9Yqsf>W*>k|IPoUcg5#6~ z^nqVIQ*Xu2X@M7s3}a&cT7T2e${btWd*JN^IMr}HiV!D`%H~53bTZMSTnxcUiwQW7 zq7(sI(S3K#uMzkYQV(6QxY}O^9_6_8kpm6Y>q8zYNyP~fH>H)z z`#pLtX4%>dcr<0iX0@6%+LvU@^hP12;|ejS;tLaS5l)Q*t3Nv^pv1}VEd4*uuQwNj zll|g}Z;B&8Mt-f)dmtQO&8kNWMazofz)CO+88cDZq87n$lFjJqOoA0Hl~FoQN?MCm zqHc_6qSbsDVcKe6=v3m+5{*|DFTy+2jZ5@aX=`-l6~&h>?Jpq>Eq=j?D+bNg0SH|h zbTiw3u`B^4rrd?Q)vMOih={UCMt_+T(#rOo4o#?~);$TAJ4UU8tFLs(jnZ~=iB(sP z*YNdnOBt)(dO1GaD%wJ;BJqv~Fwk5AB#Tzd*aeD1wp{5nSqMb%c_KgsZm`nT`-A9Z zbuWj;ka|js(n`ayQf~m65{;@}c?V9SN|6+pT%IvrJi7iX-h#?-#7C*EwQ2=z(5&#Z z?i|L&#@S?_)1+5RB#)~0DvSB+{z@PgpCVmTHt;A*Y*La}eu6H}!syt?D<%HxOGGet zbM>xavGsz2)aW@fE}=2*ie7xM{xW4O*^hh;?`U@|ni1#ks$zkms9VG=nKnAwU=4OJ z*Gd1_dgp7n*!=?lZih{HIRUIMa|cr48Le&$Zw1*n^iR6MYb+|R0 zbK|U^0Xq$GtFU9|$sZ0j)RHhZu8ve6N2>AX9K#X_XKeKx-|%l7aQ`1Spsf}RJ?Dl6 zl0K&<<3laiWQ~}l8031g1Has`I%ulIas4%ifuY~+vk(87?eG%#`trBq6d?j_RrV#7McV;NVQ273JKCmu zivHC$hPaAL$nO~A9uepm-2^>DXvgULQv zdR7`QA1qnuOk%NJoGe{FNw3xJlu+!00eigtV1ubUN*v{ia7Y7-eOM2Z;G9EDaLj2T zr18y|Te{YJM3&fy%M}ZFL}shUF4Q!JX$8%os^b>ITh~1B>VY4trD>n^fmMYCkv@of z2d^b1D9@HllfFn&UedZgeK=mipv)+F2T&rTKP0OspzFm%@yCxZGt* zKc&Q@vx8SK3Gr2)NL*@|yH@E^p0bCV?;1WjUaVA=RHy0I+UQ+*5>Ku3*|@VdY!jfZ zsHo=kcD(HWWWS=r(Gu2Xh0&@l~O>NjHOl=%ze23Go@4SL1x)h#vAFKUc?rWUAL55<` zaOFY^C+v}q-^d19G*9p!k3|@;{7hs3MszXa6`L1!%h89J@hyxR2UO^RY}^r`jjf~r zGflttl~9Mi20W4y_BD&k|Ig57i&OaTF2lU6p+kjjqPRCy>Ja(^nI@ zVQgxC$uC_RaHj}aQ12QOgmx5^hIZp2z%PP*;g#H>Gfr~rOrzOFR3 zCR{*&OLjwnj@8<6lymo%Uvh{9FSRq^2G~j`bplX4ft5Sfum&B_T z!zqA@^j|#qD1!rL4xhLTSje-ABl)be4>x{#Y9!Y0FtMN^itR4zA>{93@TR^VMcL4&t zACd{BCl-yYQ%DyzlU4UVp4d5P_-xZ&d`@H7UHw(?-P~6MBl2CK9byFN?+)J1YPhi z!3@pQc!@)+{s1$rk;}E+Xye05B|)Eon^dDcislVi)%2jyTB1m6othhljjbZIv;+pZ znc>h_O>d@qs0B`^BxovBU!8xl+zTZ#F$>-??y(grY8dqAB7GUP*mzzMoE9h-|~(B*S=vZVBq8`@AKKkJ+=$`f7pBTa46e8 z3>fL5(GglmgpyQ3rAQb`k%&r>y#-@eMuZtdg?b8Qn`9Xtp_1%mZ?!YFFxIR?7`riy zneVy>)$=s(bG+}j9^Y~FPbTJ``@XN=cAn?&cioev^wl+~{nd%S-WA4ETz<(KRj?L_ z8<&11GygNyVUB{J3$s(hUW}X6O_pmKk@|t#Jud@!!e72jZ*{3gfuffsybF>Jr;icO z*Tv{QDERtJr^NFKU_QBxe&HveM&uX9&-@`E9SWGD4uFn{pp1diA3t&lmqaYA=thok z#EMbUzLSkCA@1eg9Rqrh9vIlfu&*BX?i6Tgm~FP|zPAb+YJY@rR-xgWm8wvTl&L`> zR`0^+p%ge-Yj3g0%IAFD$rUQ+l9>`}pB17IIo97B%FVYuH!N7w*!1yvW2uO&Y)84> z4p*%rLrw|kT8Vd#5M#QsKm)u+pFinr%drUitf)yV$p>zR)dYK~r0MimshG-d9(D?o z^~vH0s8l>H zrynm5V!8@Z9E|KA5EJM28hIbJNFSs{>3S{ciK~#yW%{Yp8uU{YcqJ+x={4nptEJTA zmrhn_s4R&oh%9{K9_W}>1Rcl;3C!)|Q!T{@i@`Ul)$9%8Yvk@C_e2$_%*92KyWMmv zdhi{Q$PvUi8i8yd_u508Ai^(9(eU&ewVjyxcm*6ZRPh$>?ev)4HQbK zUu6cU<3Usz@shbwOgUu+hu%rl>PEfjCtw2ysgo5dm6U}cJMr!)lo-)>ZY&tvuBDKg zV}R7j3K1`BPgamfDnl9xf`{kLWduk>+dnd{Sa>mDuVZ|c%wb9v1T7q^Cab-TH;tpF zP*`0FhhRYWg5?OK7WwrT!i(b;TymZ?E@_NqWBSxPL%Gz)>?_n2BQu-ziOyC4FcMrn zZZ@}_(E<1y^~5}4-t{}gWQU0F%+9-utG{BnLCTj^)?uS)8_w8&SR>_5NZZ{`0#zCn5Gwi>9A*A^mQdh5v}3g;=Lx1Gz6%Psp#g+% zK&#g9CkO-Vvjj*d}MOow%f zMM`#5W=h!Wobb$sw%*sd;Th>U5lE{Hql{z5BhOP(6QdkP#3@}{agNF2No{9pBXZhm zB4krS^guLLxb90T)EJ`9gn>450SL|RET=)L<)TN0c~(g^rE!j^KsR3u2`26~uTaRR znbhiy;KNbWRCpM&+Z>${lIqo4?C723n+W zO+~?U>Ad1tq=LlmZnLPyMt-DzdzC`G>nkuI0ih0^;*o&K*D3uj81{Y1h?lol&^YorCt2o&&Ft4kq{ zIf@VLw~GkeonqCdzPFL0k{MughJv_O(0JZBQj0^Gp1HLz0MydvcH0Ug#Smmpv{_Vk zPH+gQ8soz)2V;bO7<)TpZ0#Y|@5VNUoa85n&S=@K;_ZPu|CIGsO6w$Q$I$x&0=#dsH$yfb{~5GUvVnLQUMve~4nU~^KbrlZ6GAlo zrAk$ne%$%ML`aFWWHbvp7cxy$3;;a1;q^9rDstQ->Q0MefE3J12+qz zy>R{t7zF?oaV1n=!O&v}9fc)=@`B+w1bolQw5~1@JEzHMfK7dyW?R2Ur08nzYk(10 zZOSi?ek(i+)B;DMgL9uLvH(EpMk;{Rb2@pQ@>ksCT(}FVlbe5hWE5zp#bh2>jrtkT zm;>WMr+gvUyfnUlCTYA{>R3@YN3OsViU_x4KQe;(3Z|rrdCGUw6iE>GQBhyT_zt zZ6g({E#%Ce4qG%=bfgx_CuKTV$aO|l-Ii0v$_cm~ipdF{@^SBLcCIWsD22<-t#9kC zF43^eOHlecnjI9fWL8XWpUB;2uPu*kmJk%T3kiq{AiS{13_!}Ysn;&p7g^kLl|xwO zKLa`7g0lz8>Uf~8d5TS{u&#T0(FNz%MN!iy6vL;Z=dM-cwz(mT8Ax=@H`t)PBFX?v z3G|Jf1e8~am;k7+Tbq_b!V)?Tox4k=Xe%Z;(s{grs}ft5rSyTiHbTBs##K+Byf8Db z1q24iG9=Vm0PQ;X7c+n&!lIg+!!2^^ofAi-5U3ofTI=kD>Sp~jZEdy^BM9S)L60f{ zhpedD?lgH?PC(ny1nOyNl}*y0vZzh_y06iQX0(?_9WxyhL-Y?t9oV6wzW0j>+CwF#s}Y~$mr18q{<@4MuV%H<@GALsd0s(89LuB69*`@fBtmyN=tVA z>8~bWjNKaG&$g5k@d97`T=N^i^h#wt5`>!~q`5)iKqlleKweRo^wU zL41+i>DJiZU%EIDPS%RT*@BKeV7SH`O2R#h^hkUIp!g~d0A+txYjf`RkK%c|6%y#< zMm<-@47<)RhgjRv5TLc~OV;=ci0};AL`Y7C>ToK0J{=EBaVi>#cJ8jno+$ny+@%2? z^RWw)ywVQ;V@I8hnz1C#D6estdj3P6aqmn|p0-uvcB^9!TmV*$S-p=h3MdHoBJ0ap zcpbBGaBE!RizneGZ)aK@+fJ;u3W=I@xsY+Nt=iC3(b(DQmbe6+%+nW5A8zh!)Fk7r z3NJayBSsb;dU*dQNmfyKo|R{#Q%O{ya7--P!g1p74Q9gv5>cP@dNq;e-;#lmcHuYt;O_l8p9p-645DSQ-V z5@eL9^X(n_a_xf~GUwaRT17sTwd;$b$S+9YklUQvi+6%q?Lq?D$5h}9EK7WpOwn~7@h#CYgU}oni}ltYDh~lQ0@RMXHh*bep$28 zi-1PP1{|EPGiJxWzhIom$^5z8)-7b@n1Fl`W<-3l!)q|iY!Zwd={Vwl<*xmpx zRFQpVV0Dp;WR`23qR4g#H~NF&QkM{Z447h@a$c@bq$Pfnm>sLw;++|U$iGBS7Ot*F zf%v%%yO1y@pxJvq58u$>CloxMvKSzX{*6fG($sjuR?oRB>IU1r_B~XK= z8KYE9YD?|IGn;pdBieT%vIF>t+U=L4zT`aFgj0R02QMZmB~FXL+Vc|hii*AVWJgJx zj?)Mx-It^4OOGP*5ANN&{kUL_b7G&Nro#3D1z}Lq`l6hLT!#_eI_>s1E6tyb>F}$} zQ;SkERZ=l&;}&hsy?R_S&gvmKq6IXI!LF`+s!*GCV^octR0X*<$iPZaT%r`=9Ox8N z>3(xI?Afe=xwgBzOGdwiagCvkpaP;@U6T@*-qqW97C+Fm@G@9-L{b5v0obNOf_R@? zCE*)UojiWE{b|CZwl))e4Nzch5a9ze&!s9~L{|_%fd{q0MBSnA=tIngPaGyPv_^{3 z*gWq6I=3Aq$$ePEi-@thR#&cyFM8(-DyM&r*x0lscESh(*Cq} zGZJz`4TXHTpL49C!U)#XY)Hi$Ul)3~{u11xoe(YhXgwaRC zx33PS%H-~s(f}l()WMk0I~-ut{-s(yC4?j!71-XZy&H689K<6t!;!9Fp30#wI1JFP z{1j}ItsR&1Un${Hj&=&bK_fhiIcExe?{2} z0$n0gyv!;|Q6Tzgct(Axc%(x|jZ0>9l}G!2g0-MRq(i(#ha7UZgBYTzc`)OctpdUs zqhNy=boOY-39A(YZKfLgV;&=*rarTYe6F1|9qmaBUr>vsMvu|zZjWi41QA6uFPbvH zMH5UPcxz%F^DYJr>wB;&V}po-0j%%1$7B5}lrZDlQ!;6?AlWh{*h(3xl1i{Nljh8~#IDM(^gYlV`w=N*UK$*$^3fRsi0HszZAFdOX|@Cr7;gGi>4b%-MnBQ6k zYyB2F>IT58q(2!m8gB|;Oo^^6Co3EFIjG^m9dh4;aAI!l89Qg*L??P)F)fV0M}Rb8 z?85)HlOr;nF9NZLgD#_=hshb2qCZ{4u`Uwc;5 z1v}@c4e;ogE@9okRV{asjlUQB>Y)hI-|jN?t7lIai7j{WQEj~C@Wr@#WBXjry)_yy zS+n9gVJNh|Yr4sK0M{vcV63s!1=^pG5QKsASF2bRCm=eBROhK{<|0_Z+P>7Dz=is} zlFYU`%Ar}%3bfV)M)y~z$jm!v6EV_xzTZ7q6$7lf)M+faD&E=eosjcF=HeDUVidlkkp2J2s0FcBo3a zNt2Jk=iWx74!^N1zz-zHq z)3MQ|T#p}X@ICOpzxd~>{B$MXo#^)^{a&TtzVtid{-&@n%{;&J((mm3k23qapnS*j zKfU-}P<|Jb-v#A&LHQda`JF0%%8{pTR{2}2{M{n_-AMgSEq|U1__b1ikh}$M8&~+>a+Pe9r?1 zw0)=#Go;GG5~kbVEmID3&&kjo50p;x?=Mb3mDOfa{3~2Bow;AGzYSpVp@DrS ziv_v*>R(gXE35n|!^Y^I$XsmdW$HC?QYWb@dTM^UQ65(wNms<2DiXgGHwjBEjzMz$ z%2RyabJ`QU2L(r*@Lg1?juE;sW-<{rHu024G>spc)4OS)B*Dh7e`S~}+_Jk^2|O8~ z=*N=;zmH#i4dz{bq{>i+`Qv;Xc)%5Sw48^{7#5**MV|dkgo29c+}TP4@W6=(gZx?F z(JM6WAimXSU#-f}JfaiIK2m~ps6O%=s{e6fi|>Hj-RVY3H=iRpr4LNrIn}$%(GL(v zsd+gb>vMU38d53@Q+1~tP(dflpr+@hwhVl!pt=;uxK;Myb-PhJooM6KEwg;%p#_}= z_kMbw;i>_KUaCsNbA{~Gx~WC+baB;K5im^VH5z}3r!`R30Y>amKaaxMg!)1A8B?-InpKIp8us!Z{T9QHGw3c}gG5jyG$A%wRU zMQ4%CZLck|v)3Bhr1aa{DNx>DS9bNn}VF24|n!dHl7TCsCq4$7|MPlFuv_c5B?&Jc=k( zBI6i$ZuaHFMKmXZuxD&+Hx-C8XLo)DH5mle19 z-SVX|uJ8Llvs+?eHO0oEWIs|{!{KgD9~uwX))X}I?!4%^S1b;D9IVmfvy>9dPUx<_ zAGQ3d&ac5QJfEeemUqaF6?j0&2_X@-wVcqe8~m6Z&}85(7b=(KZE5A|^X@CG&Tj)L zyRV$LHAB@)FrW9CQ$nZhybImXnNl!d7bo_l1XaB8P7pn0*q}6{h#o&8=jhTFTxW}D zu>J#AV^wGGcNR+$?5;~2?`v59zD&i%a#SQc-Ci_k&{5RfQIDWD`p49OuZZd>O;W}C z^1BW#9!VZgmh?r9qxw&^gcgO=j_R}YWUQ_1Qc2xd!G(MfQt~NX!n(amt7!DNa0+$r zMGEVEUFj>NKR6$wcnZLSV{6aPi3aI=-3b%%p6_QHbbK6j>DjgHLO>7NthX)rO_#GV8r6zCE7w!ZW*Ms>O9^8_Qy1 z9b{x?GdSF{rjpJLaEQY5yz>M__p@=9!8osw@TWWj{?Tq6e^_+ZKPiPW8gO-g61 zp@PXj*6{K?o)h2G@0<6j!o0V2(|)SuE^wgvA8u5kMA$%4oTBN?!4clA2Y@@V7F-dM zW^3n-g(bietX^Ceoy&dJ+WqVs+0M9jqbn)ZH&5`B8JqM?0-NPHPGslu@+kRV_jT}e ze~DEtj}PNASh-`?4?DeYy!K|{qse|i9(BJeeRB$XbdH@1Bk(}kyA}I>yNbV!nvGg+ zW@UAY=z(|8QlKV}y0GUgFU3v%%fKGae3#v*S`SGgJ*M=c^D@W50?@8ii>tr2_sJmR zkz0W)T_ZaI_xV3_>j|*VZW=om!|jeO4_$q1wDW)XYzJx z4G+%bT?dSZj}^RyJ#7NV8}spdm|UK(It><}c)hxce`MV7CZouRa=~@>ZPr!|wj5Yj z$Aup*nFV9dMm&w%Yw5mWLH;UC;6fq8IUH*Es@q;<`Gw7?^; z4UK+NU3J@~_Dp}~Twl!MF!a@2t(L{-G;7%rI@xU#r%idYFc{MQkcQTRz@_(=|6dGdK#{?mtCQwrJ3jT`XX3Jxg6!$7j zeQuMx>6L|&i~Z|9(eyVh8gKfL{=rwJ;ySmtmXM_P4Mucg_k!rW-&q0@)=5UfBK}YJ z-{3bWy)BcK&4#PaFAquYB1x|1pasryr8!F2u3H}3aYwn$bax3e8D&ijT#?%Ls-hN=kb$ql# z8$qd%xm%CF3axXl;qE~_&L&Opd>I{sNaU%nXMObhH3~-Jzifby=?q2daKgv*!4Jv# zR&!UprWiY}hG!Q++5VoW;W~#qzgA9BZ`EKn!ML$aMm5^oYD8^v)OIT*BcrV*Y}`ut zcPvKeOZM+7pblYoI&?V7ABnDU-7Pq#lX|bN*3b7kJI`qoZ@I&hT-C!n>ZEuK{c`dv z>vFmUARPrmr-T%^^jb9U-BY6bj;l=Ww|$yiJD3UZt*z*tUC}8 zCwF#=K2xT-gGs>`y#mZWrC&cPs5XZF3kB|?7yROZ`4t^*A4kX`&w0Uq#V71MFM=3I zg1qk_?s%*|I3zp2BWgdJ69XzV6U}h4r+z^->>wv3z$`6=e4YWbH&fTW8*VutOK`L? zicZu@{xWG(GKsB_9nQL=Yi;;>TSyJhUk#jbZc{Xu;{{t#`SRl=4e0j%fmopb+HjWJ zURGRuvWPg23?H=b(P>_A{$jC6vYETTbm4hGra#8A**>@XOmZeck*bw<%Y=^@H6o=d zXf!^8C$wBpO+F{7VYRBjOJ~RNQ1YrD9Xn5MGKiBSbt#cI z1i+XeHg=w^=U5G4A##%rd{zBi&IUw_n=)9yoyn>K2yq|0Wy*=z;FobGP_+{{(}?S5h3;c8mlG2Ndp8da+M^fL0;=5Dt4)e= z5ohB!9aH;6GVK9vd~r%$l?T--`VVBMGSTi6f#-y! zr~qz(k6Q+)>1^o`D!s=mZ7k|a&nZ$0u;iYy9>Diha;u`8S&{Opm)Tv9AD!Nwpg8Jf z?vu)(300>ob+-9D2X+d{kBVB)<|HYaJD(NDHZ^$B@tCaqeS&Y2r14yrs&KXqNS#F$ zxkE+t58SH7o+KJl{&8O_m0ePW1weyqxDzJVR?!!@0stip7zy?oKw^qkB80n`p~|=9 zKc=jE7IUvZcG{t_Cy37r;PBLy9DEnR5@1r54`2-#*gB^4*CJ6M8bt{N{hPusmK)3ao}ag|CQgKF?b2 zh6ld#hch({cV)$U^zLgtTCPw;2)Tw9twN(T2dA=8G0zEZQvotq0Vx#Sb^Vl7Kj%RG z2X3&!tDt|CP<+RJjhBBZFIV{Q$#y@HyJ*JV<#j#`ztdaw1c;M$rrJ7deUdrLF`YJQ zYx`?ncDPtM@?>)98sv;Z_^lB@NzV|cdQZBqh&PJdu|#wfEi?cBz+-IG22Oq5m;4H~ zjg`FtVDYm=Bj??mCTD?<>j>@>bn&&L{)m<>N+{WPu*5#y%?_sOss80!yAbBaEG1XAW9Z1ASz zUth6JnUe!thqk}e8o)nqKYX~Ikaa>fvPOTxChIOg%aA@;f{F(9Uxjy(!|M8zMX zomcxAy7=Q+N(e(S<1$x4Ne>F za@{|YU|?!60CM~3QvfN1NmjUv-nhj|N%b7x*Cd<(t1;gGu%z!fOzLth-RtFxd3L)A zJLC5s!swgJ;Qo1^(zVw7U(BN5dJFb7*`D9a3Bh=fZuaNu82K7q+B+cbF!Tj$>(0)~ zz7IH4%Drf(Ki|CpLO|ux)^TuMw1*`LwKlJ8C$vrls*XAxNiR9FLrBtOK16Abp~x<+)4HXhuXj zpeQNzz08)ZxGh|vbkFObB><-w6(6(&-<`awTBLu-DWX0t7w)gG^aaUyvI0jkBwRTgHI70RFFPy>EBGI>*!P;mU@E4hZUsw?XeF($L&lz`@?$^1ek$ERnhIN1^_Za zTA9`sTRnizp31pIR%M_B*f?hbK>T-`z&5b^G=O^N?qq$8Owy!v%PQ>sRZxq)2*iic zf>V}7Sy{IXT_3TqE$sy6kukW_ry8pSu0wGg_64)Mh1Sz?!AYK=z!YR|0X_}HvD}5~ z7~ZYy-~*4pJtHK>rno5;}f_KBJf{EZY|HqNwFE{>^Wxez zmHQOfj)3J!p=|PQO!Z}Pc!9b8B4B`qPt@!hbiTlBkvX4wzxJcZ`?XyLJh6 zrZ|s`ql)VnJS$|!oG2(2B?)(_!l6uI>4n$651-X0WNS;O-s-CKK$vFK+gLQV4Hbsf zxN7YjN$`F1IRj+YAq}urUWNOFHnDw%{oS}L5eo6Ag?&w>fS#sbjFX!MIyM?GtCuGn zpfFwpf4Sh>22rW-eNF#rQcz-|Qck1@)cpD>E2nA&pVGXq2_EtiybYbae8L+2xaLQI zX)O~u51aId>7y`K_Jwm`@wsJS{`XYh1GwP!@5J`S=D#w`j3#XN7pQ?w6R_}DiQNa@ z9p|zbs1&4HIC&vzFB30eaN>Hc+EH#FR&dz%G_KN~ooNt1qa~O)F7Ps8cD9lX9|^c* zSk66K8R$S;8Uv z&ER9xFP$(Q#Gsh@>lJkLLJP`kZn~s@dXw8yRDU2I^@&)Dr-t@75#c9)^$`e8T=-gw zN0k%R$V+xOT+ukcc*)E}37Jx(foUPi6jQLl9MT=*(*qM({fa#}v>6P)Sh&&bTeLxY z>b!})Y3S=5ef0B1d$&6lTFEc$@3FA01NCRO%Rz-L>^ZwdFTFTxqZU$FGw_`0$q%rC zoDP{0at6p_AY1{C`G?0ar0pN?I_NOe-28w5^VtSY)jV_!`HIs7AdfH*^r7w7n1ljg z79bCUB>g%->>Lt!@G}+Gqf5sa`8?4Bfp=#njJSYo-Qd@Jb9)q0{T(>bvGsnOO=^s0 z$70M=JhS5Xd|6u#3UjL6=#vaS-Ym?IgXi=mhOqTT(X*C|Nub6WFaJ5)v6jn63LNCf z`)3W$X^ktl5_S;mT~N(Nf^hz0shVaRQsyNd9gH z1af`3J_$oGw}NY0EtD!AsC>NL%uAbre{|!1Vw?>8(}8=^0jq=q$lgBZ9LV5xn_e>& z-(KJ7!9raG2Ay=n_hwoag`SCrm`)lY8#qKi|;ID9jtp%r73yEH2)wiFk>X1s$;zU>V1n2Pr(K zPpkf#d48%rKjjSO&Q|&D!gH3AoX@b)8EkkV*C*srNNaew2Lhw~|E;#D>l?R z>RUkkbh(|gzAz1VIaChqw%86p{XOXQ|B^iq$7P%8tYu}-*#(};B)(hjgs3|l^{rcrH*l#aiy@k}iiZF=d0skwezVtF-qqd)GCjlo6g)pnkns zk=~eudV?$aOloOn}d3E zH-NeVQEzuZMT1vboXbs~|FOmCoyI9DBq{3cOMf&0S}M}ijS!=NG?WRQwHu^kCh`WT zWANPQytB?9sR8gZ9o$3&t#@5Te^D7Kk)$B5FqapJ_L{9K>6xx4()68+r$g~vJ>s~5 z8-^KeMw5o-#*+jS(+~?jEr*^^ZcuGZ0ePL3tfuU^!Vs`?mbv8r8Ud^L;kEQB7~r|D z-|1j%DhgDWJB4}op_JtOvrzVLw5^=c=KEQ+!1BZX-d%nFjtc@V%puLcCzcgO`J2aH zI|v!)17!To;OVs5yJgPux#UO!UF+1B66{W)MbEt@5$#Czoqk0kHGuW0&N($+Tal)s zyr8D_f1?Th+pTV00t_|m#KjgZLp604pC*84^-4ZOiLe2#dPeX}&AIdyf}TLPGp@g6 zI5Qq_N(AD@-Xec7n(F@-$T4(kp#4Yuto<)n(_ZNVpw;!F@)h5nC35L2-Nzz-K`qT0 z?`8cC6Y~+`#D(YnH%>gW%!!3ZzD9|&8G!O%v=7ED`Zy3!;u@X|8>cK(^G83tT~DyZ zXyoH^t=_X1x|u)$ppJ7>?r;?1IY^7zG`gmpC?LupmT z9R9L-Zr0{<<9Uc6{CnAu;3b5_I%ar~O%o=hBumO1_bGyZAC}d9hMd{=JX@KrM6&KyukjFOI|$RzMd3*k`BYupuXy zG;CDgv7>%8M*acp|Fyg_+N@A>s?x*eg57(dMspSd&OX#0JF%Dj!luXce5eb0u8Zp- z6WVl65L7g&la@t?vj?u!a2EENqCNqPfJoiC? z3aGzk%>D;BJhVjc%+dp9=Q3baPgc{`!8G1IP*-J-=Gaet!5685Jo?5H~dk--IbReu(-&46cFi z97NVszv$nt#esUGklT$I-^3v@Vt*ktT9IevWl@xQVSN5RdE``GdSY|*|^zrj| zpGM7a>AuSFk6NCfV36lc$U|_Pov?zads)O)oQUz(Cnm^+$N1t!oq3^RqHBe}2-Om& zLjPvIh#JUF)ztr(p*wU~*3gdqL80gK-Y>?*%50pW(ty?;JJ<~-jn;w=m}L@hjRe^L zlg`oLr(a@K!z-GW3^a~{${KmK*loZZU4oU7=FE)y4M6NyzF_5#j5MJP*!KaFmGUUY z>Crn90D=InL*`oiPv#mTrJS0M<{8ogmAklbztCntV*h2biGka*T4$~1{N6zfU_*y^ zpEqx7o@&l^*qBz$LwJzaA}_Anb3#SSiy9&_mq+O$YX#yvdy!X2Y50lj8oNA&aWmk1 zLwRvzC0AAFF)>f{8^z2r#CSt?aF4GYI&pALGq8G8jH#%xYwv+0xn+o{4uA=Wob%N*# zj|8Gn8#1IQPj`x5Qo&3JQiQnN2|%*5 z!Vs>HRB^yWbHlzpX*_%MAf^;5x0xA>l4j^-mT%-To!I|S1>bMYBE8Z7zG^+=*SGRo zx+~~*!KqAS#s)@HTFS#WVrj<#s2RS-_5D#3_MDw{wO+4%Z{fIl{_2+;OI@T^^kKds z8_hd+DJ(qbgUi=;?o&v2DZ)2V&*RbwHWfo1E9X( z1doX1*AoZv9i!7+I8-wk2Yz$Yw+t0DHz$oPkiecQ6^D1mY_ zV^{|Y7+w1zm2CuGkiZjWd<^PU59G2jVd_5jK$H8CTvN%xrc!a~rVKkEIdOyAp}pN8 zw3f}65v{vXi?uJAG4_)nMyF&3`0}aMwLDvuz+vwTtb`7(47Qw?|6~t@-(NiaaTrz zRkdI7wcimO|A(sJAQid|E=Y+w4VUjiXZFu8m7xQxg`Q~FoTUgoi=K-(hCVqxk^WL! zM_ZYyzuPKMQ=OQI@(Wi-zwxxdjIWn@q($x8D#mPV<8d%hYsVB7qiSeqgsgy>&@ALC z5le%<0Jb5x8i`ZMvw+g*h9 zFkEzMSq2AKX-FD@m#7Mv-C?_M$yL|Qt2RTId4T^^`5_i-4UJUIq%4bj7ai3>{P%TT zdZE0JjFAi5euzob@u-RlfN_Z`NUa0YD?dwyK*5uPL_eULQ-WnYRl!%ffT0r7$)MCz zR}>i+mYdl)+ENa;QA-dBTU2SQvmlKs@G|ozM{tUG*sRm~?3=C*VW4ZU3)t$}*HZ(b z3nr?sDoMk&LFRLs0QEto!nnDc(83Mu$A1ASjPE-W98Kf^fO zC`8dyXA`ru#1MB}h<3H3tUf+`KoK0ODtpiUTs3(lK6>e~bYo&Vaj)m)b;&@X$DgKk zQZW+>lPxWa9dM+7{{lr19?uAA6+ydD0{xz|be zG%a<}tBXh)?;M$Sek)4ggyCAh802WM`1n9V=3A{&R_;Po1A(^6@HmIzLpEv>z+3y} zT&!)HG`iL?nlqP4L~FIrA9eZ7<8aH{b=B zhYNK~RN!Z3ML7Rs*USQ1D83xjs)FKs)$%7 ztjGqmtFEPITV02^IT)_-fdlwFHqG^^M;y4r8Np`_HHRTRM`UYobZx;+2@qoB z4!=KTtFzAM8AvkCqj!+`Xi@0cHX^x9Nch)7y}=zfIG!OBl*7hs)E2Ltk5B_A-VP2X z-4Bvczaq$1^M-p^1GMGRyAwi|E^m;8%VPONV1@Hce zypQmYvSRQ}nR>w$jT)##Vfdh|`@++cj_TZ?+>9zKb|^ZlAoK`3^q4FlD|;~S)(G5; zfYG*!{_2Tyav2`s?S7R;-K`yOEg)a8xLJZ9YGAFH|L_!F-{_AHL=QggPb|s%45`YS zaEK3X;v-i-O1RF3je&v5uYkI8kb-Z%TO(6<$xqHk4XXAlX`(V3;vpT-q|AU{uNh~Y{0EzCSBMwG3_$9h{*5olm z!82hXNsq%iXD{6--ods6S~6|sEqCKz-eu%&^G+D@z%M3+hQ*eF{negm`z zE-R-vCWfiF(jD=nOTg@D=**X~y&QL$c%!$f4`>?+U*0wx{lxbsEOaDt0a^< zQA3;~d~R`6B^QsFr#|lQ%p9K)FyA(v*Qe!nTBieDgx~IlsUzy)JH!pwNx~II@{|B* zxeLPL*nG=l*{z3JhYuAbxm#Lm6hBX1?_gO~=l4_3c~&nX+*<^ zw4eu91KH8&YmIaPGg;w99^*h2=}@FL=jdO+pQNu%r|{g?Q_aVd_Cn0M#;HyL%`6hx z7@lYtsS!H}!te-&?Z(0uP8TRiLmD`nlPgmXR;^(iCV82IXuPvd7aY0da^xr<`dO$n7MFxp&e~I+>@q+rs!QX-eu)_XZ}&1;8_CJ^$o? zOPS-m2+hjQZuz<>mbRAhYYWF>=7`G__z(bYA9fy&6n&fll53>_7OBM;?RLRBJ)yWV zi(D3fei?t6#)0Dvlj^#~W;v9ViX?3Gz>MdnPbA6PFJ9rK_IVAWaxB0j%weI%r zphw&Y*(tz(>FM*BGql_Y%rJ7|xr)Ig~ZCZQ~da@&n6Pm<{N z`#9b)qmL{;7VIuZ?60~!N2ojGRa;(j-4_xu{J_3+a5vhIUqgJcmNcC=I9h;KFM;oL zFY67W6i&}5qIHyS##{7u+2DqCV`T6fab^pd4wRwg-o3EwF<9&B=Oj;b z80g@tUITag!1SCBf`uIn+^dt0BdY4Y*bC$nmIeriTxx!_oYOm|HJ2xlex7e|2>~Q! z3o?=E)ouoO1mMFWKR_&A0Hk7_A}ue`&d*riQ=R1*B21DSE4wqp0T!=WM%`77JqAMI z+bE^>7GsL2rbx|l4by}EWR%8~k!woCfOp(bXJMacTKj)>CO1#ssBwQ)8~~G1lPfm0N@++Oc<2*N>cELG$(MLIe1VwUC?e4Q3L7G83n z(b?ZID4Tw}iJ0$uwW14{{LNAWyrMujuNg6(cNNzv=Q1^Ou;Np77Ji8OT$fB6koBM= z%;EBz z!xu#qhZ@lViNZ<)$f=lilo$DdO0Wq`65ctIjQWF>eIp<@XGiZiA6o-%d|&7Dvl<{> z03tqrdfD92a002T1f@Psw^rMGmzgBlu%+%xTFj*vTM||^5b$lkEPQbaC)s(*L1wc$ z`cyQH3oKQ`*#rijyqoDEJXea zJ6r&F##@Rl?m*j;u?YF@dH(^-RNnL(T)2=jIuak}s|V*0QP?kVOl5GIgk0P;?qLyx zkI~>>5V|aceN=mP(S;s&j`E0l^A5E{F#oXgyHn%z`GUA%+NDQ-c_FSaxdpIkbjY^# zL-}d^qndz4u+uU+Dk2=JkE<3%))2_^g?*z(f=7hgN2WaoN}g7o zy|-!`cx_{DUi(G_tUI)I22u~w3pZtXf!6dYXkUIV8j}ACe(hb2_tXAn%`5xIcGw^ovN6^ z0uzMU+QHRw`{rbbblPVu<;urQQ(k&{oj-I7F9q-8#!V@>kU}kn>TlxgYS(MNLA$gf zy2aw*AGtz;x6`!p#JKw49O3F78sqdq2@bMZxR?f$bF0SY0%!}937mhl|Iz8v!BX^Y zD+%;&M4~w0rEsqVQswQT>NLC}f7e(hnaWy|*Ha`tzR)X-yN+{da2AgC|_TUVBobwLql zEm2P~T zoTqwr|0MrNRQh<@4a0A@HDI&l%0?F?FAOni>)1#-d?81dZS-tN-ks7z63 znleWLFa?G+fBgu_!+B8xVB2Wr?z}g^R#W)?20zl&m<&@)%-H7!_D-2TA{O$_`+yJ8 zUCZvupio)*ZtY%WC%P&wh^=@_TuU(niUhh)<9_VGX;&N z9Rezt4#bd;8eBu8gL^teD|yI%)pIYVv+ z^N&ncvV;-k&DRE^Lr#AE2A0(zw}+R#610mFU}L$0*8)MG_!rn9dX;gY9OxPl?31|fu{iwp@0B>Qj=cM7y;Epka!o?M-#dgo#}|i zdrqzjM}EC{7O=ar+_u#xp~rqskl;wA(Hml#1TJJ!cfdh^JizZ6|6qB1%ileZMC zM%1M|!kdlD-Xf<2bHisI!Z8!Gbkel;ZPScx+u%h8=I($qZG<*-f8FT}TeDjf5^}4m zb&|*eu1+$z$scXOe;?!lV&9SY2rzZvtT6xtKr*x~9O?z7P{!9p!GB%R$2p+hSSACR z5X>tuhC+W5I5J!j(2jurFg^Oy8-Kn2I#Wy~;(1k;&A9Anml;qh_AR~Wpx1+q$OU); z6PG>0|M<%Rh%R+;)hhj|>H*9=Y^qoLqI>Q0#nG5ESWT#80oWU-^R;Mm?>yorfkj!CRu?L$Zfd z#08=w=L90NOQh>0X;!tRrevfTN4STjh1Z3hilHSAqCst0U}GOpWw|qal%5sPJ75-I z!y4m>8;q@iU@tXod2d$w2P)5Jco~>DTG^7GeDZaggN(}V|7rf}Z8UL$I{%`oyq9J_ z7qH*zP<~oB!rtps+4#50%lbr!eFNbQ-lr=x>0XBR+~qHlS3&HrUPJ|=dgUrKgcpwB zf>c1^;p)k-P(F;dI1&aL5YItUf7W$m;L(CTbycmjJOW6T!Qi7fg!I++0-gp0B z@B8nlMYdjwYc{v~heJP=%j)KjRe*yA96%;xJ9{>9hVBPs1mMn>(B22IT`y5#E(VN) zPkAm>a*OiaP%OE)+30qe+3|Z|XBS&KKD~8mTJ7G-uE!rc-rMG;L=+j5Y)8$t8aX9fvjnLsz6U z7yitAA9#j@xenMWQwi=v&uS<;`S+)*{O8fb z8>|eMzh&%8MDdmb2yLbObjLaHoP<3NFQ{#sJT>gv$z9OnPn^z%i9l1!mMXsc7`p`_ zj|^K9QinEgf@i?sdoEvXH#7T_v2*sr>JHDpo%kP@E;?s?v826e2OkoY3jC*orJQJS|j0mSo9NCz559PC}9_L-uVf!_51=N1bMJ zPtW_j?|Z%1^}g4gf4Z3azGr^F@9(>QKA$;0s_xZ(Ya26^#(aJje-nTi7vo|p+N)ov zM`fJTOJAm?)T8w1^keUmCBh6tg_WJx?*^^GH?ClOgJL)Aql@H`{d~Rv2|Ta;~fAl`3YL0lO4M$^NI8| z;dup9vnZr_)CtWdpY5;b8Bq=`wyT4vJ^T>XOTu=gFpm5i8##tf{K!mjZ;)531fb*8 zbty#8q-}H<*&iCn?!f-ci`x)&Amw1Q_AQ}l@-&Tu_V(zB)_Ont`OJj%EeIhvsITer z)`Fmw37QsT)A}{jA}5DtvB8r-d-OPem`x%dPWXzvM!{^(WSMYqRlWiupw(_wE%$34 zK=7E5=JzzYJPVUD0WbiYq?G4o*QVr7mHS`!pqGFF36z!0gzXPBGb99m28O7oNy@^~ z^F?%a^Pnxo;`qz9SFZ2(l&`X9of^CS&+GurKTb3YJcL6*=%xyRYE0Bp4m~1-r9OCg z^}hvuZ#WIICa;5!lTJpbZj+n?MV++58d);I7|Fj(a_&dQy8C#p$bJI^Tavi{-41!l zkkwX?3CSQEBEnF5iVz|7{$^pOF8D9-AU~?!V8g?;YD0WP$iwi_YYI!^q}a~H-ArDs zZLmZ2_+5x=tSys!URe@WZGU`%d;oC5l61#F1ax}wL^2L^>-MD^|U(FuEv$lJNn-W#Lka_&{__Lkoac zAJ`9eXW`e-Qby{$dmF>O@q-E!QcnNjaMD1(2Eb1xM%8mYGg{x#jt}RIAI@e>_P!@Y zY7W%z#iyRTfG@v(L|--%Z*CqAKkFFmM_1?_ zsPmw2DeG^UO14?qcG#%8q-i+}`~N#~B7 zIcSYFLOdQm)t=u$>f{)g)CtljeM@VjXY2cWG_wYx ziOo`gfn+>XXCXjw2=_4v9TNeW z|2t68FC6b0X*Ulv0{3_J;2Z*?2jSn~>%3W}Um~|NTl0&HfD%fCW&`{b{)C1tLDY5j z;da-Xm{y7=#ezR+OxaAc+`$jPWGMAck*H;8{YixBk8TcAJ&K_6G^5MN?rFUaUYk2u z=`5ADAAIeDe>@ZyI6Liw?lXLMEk^M{MeNb7aPKG89hV76d<)u;E+#l(S;SoM*uYn5 zr)kt#YMWlaxv*VOEN{E}aIqMEZ(<@5CY&mB#SY^Q zS`I6;IIfkx2|zQws#W3hwB3J4TNugEJ4JPCo+p>EN9b`N)EY zCy+yW3pu0{i`pkeHjulyNaJ7p2a1zH&OAbBKz84H+V;Mhk+Pe|-P34ZAAEorSJU8c z(CSxC5fXyX0~qob(*)DY4#1z$0sc%Y9CQ$vjFV(%80Z23DliYfntcwu%F)Y&N;vy2 zUd8H-XP~C;s`3Rs`7eDzXmEj~Fm{JhYe|W^3kSe75S}=mmoOQN3T(<^cb<(-kHqfP zJ%|jPED49i1b?;$N`e9HP-x&^A8V}U<5N?Wr4_THh&Sda?(Fp)u%p;&4_V^12ZAW! z@4cFO@QJ-zZA!#G(Xuzh8hp)sL&i!xai6<=ZxXe&+pcWvy&W1-4$(e4>`_V-mT&A- z+TxLC-^z^j)6*tBp@vbLq;q;cXb}C|iz$(lFLhZZ05bG@PaBv!H{9%52EOt{Sz_bk zU(J2nPEqJVI7+q9^6Uc>B~RB$aPy_oS*N0Y$P(s2yvz(gi21Dbi7iJ1oC|>l8t+~I z;cdTA&|kjlKC{k%OZtGo0x=yB6G-Ks*~#P+7=fncUx0DHvfqP4WooY^gUw8@o_ODd zK2=7503%jQXvv~uU?CkLzbusuO#xFOsa?^&h=##3nI^Y*))uHMeItw>Oq-SN>NKPi z3gb4MOR=L*4xo+XDHrUF1`j>{IJA#;A6kI#B=r4zDoBIlFP>@lLC&fznbWyfjS)BT z=Q>K4w$GE+R_j{EN=CPSS#w^97>aWP+~LA&1&lM47Td{CYOCW1#bx7tYU3AK&vE$d zsh-&~EdO>hBAz}{c%?#fbQZ-?qp3ep8`a zX-i1zXJDub@XboKLvsaxwqX+ja?vz&<5T|Ad%DiGqbPN!2NbW-;OHsVBEqv_qK&jU zy3V9hT3Od4(5O-Wgjawb#IpNU-C~@wCe}y{fFG0vA?LE^fycd%M5pRXih{S_rXZb2 zCMdGQM(&5M9aBxxbxUV@{GA{j0b{Y+&l^LeOn!pvmRs5Hg6sdqgVOcD=YY#_VG4d6 z?vkpWQ=BNOqgvVavF5;B`~wl`^$DFr)TkR#nl-1ZXtx0w=L>P(Etu4AZl%#Obhqz= z%y>rXWDZpVPcOxjPSEGe6pnWELAel7s5pK-kray_AZ``8X-_fmtY!mJ$B?BhlO;`> zs0nj8=@r%?@96J_#AzW`LomyZ2hw*(;>FDRimO_;U z>h|M@_WrY>_Hfv>jBW8%;LlDKOvL%RB5j2hpuBzG{r%5Y@QA>`k2npyo60kL8DAR% zk77Xp(R{ppo9H_P%(gh;-8}MEaQ&b;kUzd?=7ti$JTnvW)jUJZvemr=anM_r=L@rz ztnOpSl2cD=X)GohS&cn_=v)5|`p7bn1w_uP=oRgl{Vy$n{!C7#G=LBUcVF~r=z(aG z-ocDlVaJruQXOQ+lF#iji|J~9kQ^A?dg#E2kG$2Ok4*krANBn9H6+L3+x_=i8O@6* zOP<}wr$02Z6;hl49fAlyML(YVpV6F$rv}n8d5=tv;Z9=7H&=zO?; zr5YeH`|B1!%r;yR)9R{*T3?!+4}cedpa|tl5ZUOOq>#1=I-6S&czfphl7ZD}hhZH- z8^&mT4z4X0Ex((_alp2fUU=EfM=pjP7VqvVeYJ)y@ljuG{kROU8z^**;qyp5?@)~l z8(+X7b9W5XN8wx>AOBN*9-6Iwk`>Mwnm#=flI*1_)79g!wz4F*+~KB-xtr@)G91yXJcWab+D=Htwv{KCnLa&2 z8ARQM$j2IIK}xl7-Pm)(6>bh|{<>onm65abHz2pyIH;bo+0y=A zGzpf+$w)yt(cFbU$2Szh{2m)*mI$#IDdUu&q;QqfsQ5}2p(p9|Nb#sNesHqM;52G% zU<$xdB_bAtl%>1BocbytpIjX=tgp66J?=3mv=FqsEdp0F2=RrpT6@W`Syya-nwiG) z3x0;lqMX}&IPX(WZdAUKGC?$u2JUo=lKsKH;MXHLIW$AGjFb&R$ZU#CR$nFPWe%OY zsA51#?qlPyaoI@qY0`Nt4Tj^_fJ4;PUX=r|DEc#N@0r zmAP*xzhWvc!No3Phw2uben#V-1OTKHqPq3R*tJkavm4xjYYBoi-h( zKii;Q=sQpyfAY3s$?6T) z;GCZIY218N@Q|R_yWo_-{bgs~^#ip=e~ogwv+7ez=Tk&ai{c%9rLBDnJ&k)Pqy1$} z^HDXX>wK2eXyL3wFp!I@LdUD_n}w(vR;JY{U8)S#S5jVGlU}&54YH)?I8whe*>--h zql{pgyAVD~r$6kHs~jW5{OA!&U4(f+ z$MYdj_{m$fEVirzIm(|wrpc2}arwE6gjFA#5_|+V$bHtZqX4aw zJuSuvVEwl`n`{FKTi~irD}yRQwg{DQ^#i$c=x#%f$DS1qLWts3%;&3Z`64F- z>KblWS%d~=g(9m8YR;Mr#}{WO!`x%(A0&M>-QHh1QW!68N{q2HPZzZrGM}3YNkvqi zyPZn@)vUC-MN)RCk0Y!GQT3LZ&P+d@Jef{=?fQh4mLTqE z*0&Otmn5B!3sOof`UgPbH@l&@^ueu7Kopcljz@lS+(H3!@-fCcqFB^jou2mX#|cil zS@_yGd_Zl){s*6=ewld|cmzl+VwvvJXeRNG&Et3F6ns2m42sED_2V zM}E6scjmYKtlCe2-#1k`HWr8pu=EMIDdS`QqU6Y;@xp>ay!NWn9v{-mT3TYuW4yLR zX;047{!Zi4lfHQI(vckE2vaSUQa;tzH0GCIh?fX)bE6uU*4EM(E#-jk9s5N0^YuGL z{2(sDq-z#xXmWhVkjR%WO8O9A#Aq3x@H@jiO}udf|KWx))wq`Sth{Dqyty{2VW@Fn zkV;i6Eg#A8A3j}xXDz2T47pFb6MH4_cx~})TIaKqM1ST9D@s=s^YqkU`AMRM1ie0z zk4#dG4`%u*75+xp^)W_=TARJ_Ou>^o)k7mav@lDYRul8K^#{`O@h2B;_I8Y0;I3NC zTpFSL@FJC<8>y-5hW&^J3A6?moR+OEynG^3hnmfb)1js!7f;YTTjYaoxUpZxIz52= zG5dp$Q39>2!Hk++3lFBx=NE9ZCg6x&OXyRgn`gZ-A*l{u^?yT`JwEfXHt@nHvv;e! zDQy>AWe69gon?4Q>_xWeFB7neuS+-mAM%bxCc1xBmrh!}_cr=y%&#(Rj8hcKw`Ny682*H`V9MM7Yd|`yu=S>ijCo-kau%efxf^ z?+s5xa>JaY1hELI8E=vE#_j?~oqFvTubp}Ix8EFGV4^F#R`>f)%6S{1R(Q|v%YHSS z@yWj3CZI?6I~D4j1Am( z|L%&2faO~@E?dp<7H2$GQZ_!geV2pX4;OJQzl!IfP1}C-*$KM{xXSAlPk*?Gh5|=B z{sH2f~tQUP&^RL}OJLuY8nW0IR~VGM+P%a9Rph#$$aTUil~=)(67+Kpd?x zZXbd*60t@iuY45iL}Q(3-aRmEl!1*hxMK;2tzfe-Y!=304&3PnHcZ8asXT|b*fbuS z#`A2SV{i@(&cPi^IJ#gMoCAY%aF_#E`hmeYFgOR7L2y+r7@PxxbMR`PV{i@(&cQPu z6~y2i7@UJw`y7LFU~mpz`6veGz*reP3t34F&Vj)>c;%xQoCBlv@MdCRaE|}ia1N)* zGkSb{vcme?wt_$huK%b=S*km4?%%dC+tRllIGOQv) zaShmD6&tLg_{%S~2{u^82CKZ>CN@~b2CJNfDR(ym8?6414OS;DeZ8E1;^TX^p_`S; z&~cI(`mOA&6wmGv?1?0(OPw$KvA~iBNOtue5&oef7Iq(OeRv#kGG;&6`QnM3!2A#9 zSJA5q%x_?EndfW+%Qvum1IstK3n>JFhMf!STwvz{I~N=)faOtG9);ymGgkmR7ysAJ b1(}~<5PgiEd+9A7{L|mQYg>xW!QcJ^rs0>H literal 3745 zcmaJ^c{r5o`&SKVxC)W@hB=e1G&^HvG8l%)KK9BoD^r=7W=4h(6BSCfil}UrokElr zQnpN%)CgHqNN7XC`Hgex{Jwvj>-%2U`##TeKlkUpKlk>>8|Un}52y~5l9B@2+7L;S z6(e~qWo0DaR%+7@$)d)$^5VO)8T=43mo7!1u_<(rZ4fztPNI`(p~qV3CQ?!xVwi4T zd@l!k9F-jeC9ml~1wkAMT1v{qOu!*ikI?xb3O#_y!h>h)9)m$l8XoLvlZEvSf4VAR{OmLPel3AY&{PVT8pX4flYMa0D6#$HEYX5I6z{$Kv1!(60w9@y4Yw za3rGjFJF=q9vsN$b8s+NNJt1Y1O;Vt17HX&77K$TVMruIq50kxdN_qO z1En!(IAbgsjz!au5E|MD3Bi&LX%Mn81_3dqG7QNK4B3!^HU4eq-|%P)tfe&uLx5Xb zSs)Nr##lpR0>R3{h=@X16D-jGU~O4EKAAn3s`7a#cbOe=R zNTxvONMkYtZe&P-kf}5Tgn~3=P{>APG=hu)|H9M$D}R6YsYD`)gY%mXj!rfvQ?bSv z2%JHsLJ$bLF@%hzVE>TqO&CP z#FY$=yS*7)GR#%BM1q^3Z~CAd$8B82bYW&^=35gRSzDVlDGN%}m%subA@nRbka^2Z zu~;^+aNa22Qto)x=T}|3u1>i9jG`o~wORIT+gK1QjFP={OGRJyxGdmG+S3@CajWUf z;EA7C>q3m{Mp(Vmto5{|j&NSc?CL_t%FK_BACGx6S_F6ZDUn0I@8GJ_oHhIX@J50{ z3VI@~W=2EUs6C9%-o713lVXOcs&>jBl1kj57q!JK>+yY`~JHq`@XfO z=h^X*3iYFdXucg@}ZSw9sti+sJbothi z>aGa*ZdRMKm75toJ8BKpX`F;7o@<wmMWPi|Rx(fUqHaLx))py^eQl8e!LP$X^j%xS~dN+z+@!R_FXO^P4mrapi;4;-YHr<7ZK>F;E*|-2f;T1V6|_YnGwr{%oIA!}Ito;I2#;T3#WswJE@hsC zv`mT=$L`q(kz1?MCmwxKtnf!gn145Go@|g2Kak}fVPkHW?pJE<%=757*OD*p=(<`< zrG7YhTaT^4dV&hvag$LNc{qtsvtxNxlwB$aB@F*?0uWNy3sY=N-Ca>b#_&4TMa`01 z-$2+(%^S0I`^6*meou5XWjofjnw`ll5Pu|OCr^&>4*nRhI7PU0Y9K@N8u=v^r0OsV zN$}Dg><`Wg*W5CBr?Auf+v*qfTIa`rGST_;+>^cGQQXSzxcG_4yk`RonR3;Pv&SC$ z&DaY2`H(BynycCSyyonKH_x##%S;PrJTwvyWQfhy8bOByW+aN;BkW;PotjKD7 zc^vKhkT$xI{O-GpH&gMVJQQ>=-slZLZ+l6H-+7Od@t?E)XfTzDfFcQ2Uy{9@nTy%0 zX;;a!iS78;^X!MaRR)Y&Wd{C3pen;pz<$B_V_R$-~ z`;8v%Ih;=-D(*gGPKuRIkmKo#uB8MzXPj@Ws@Q1KkllZw3#R{gKo)91m??1N%01#q zgH*2fQ(opqpK|erSh|I48{{@Uy3k0>*qrH+oiggR_1H_NWAC*r#fh8d!;{qIEcEy( zMZQaCAuSUwi+2dubK8PX1b!VHd-q_#Ubx34^0@k&pi2TE#_YvML0`MAVf;1p1geBP zrdM^W8FBddeVh4vg?^0P-qbw^^{UqZMvZ}sFhJgdHJR`3%G11#7T$STlHY=q#p&xr z3SpBOwx0c1fA;~v#(;y&1>vV4ncdNi9r&%MRZ?u-ZRV>;kyql{-!J;w6LL7ERmy@x z*UQdD$oLG&{#+sZYcH2UXJRgY$^jg$dFh`VF|D=FsSGBnag7J1z6DO|{Z#5ocgMKJ zN^4&79@nVL8M>KBg0SRXhXM{@sM;q7Xr1gnt$qEcZGu0v_=H?j{-9HOnzyq`p+Tq8 z`eoLaX#Ss?;>hroC)q=l!f9zl1|ag)r9=3sc+x#P&4y^~@uC62S&yI*&rMa`HVQBe zR8{+xi~HsuNqen8TD5y`TQonKKStWLI{N9xX)t1zjHwppIfDT(8G+B zvS_{iQB&xEIC>%aRlN^JoOSND<&R;@ot4b6V=@=#Ybc7Ug%m-T6X$++0s3ow#0;Z++U%x@9ED!QmtcB zgIttbXookRJX1VoY?R~q@eg65a`cXh9e)xwgUa2FP^a{AF+a<7OS10klakK>PFN6y z&S@YU%O?O7C^u-APi;Dn;R1zd2#B%GQa4BojcHX!ZG&FCk76AQeI9YQVX%S z4RZ%tdg;@FiidX%i1KGY*O_hREFXqG;5&=rm9)oeWmyrU+lp9Ux-!CGq1qR_OFJ{u zNv|A~KAC>ZP4RPLq&$z-+pBiLp!uWzT;Gp8ujk7qM|8`(@8-3?styQCEAs~RDyueF zjo)({dasvh)e}BRsU)hJ*Ea2Pp=O#bZ-R}}T`!kkt%iNajT3y-e0maUO|~D5LvbU; zo;USsVm;N$HT9(kCl3L>cJE1});O0n+8aSkas3lJALm+UT919-wYTDowoYm$kXtu8 z-%#&s6vuyv^@qWKNY)sOr*-FjGb9NuniB_x!mpF_zdRR zbsJS`_*rx!l-IEbc(iFO2;}2FRy0%opU|a{f!?G!v{Hb<>(Xt}hd(Z&6b%pwRyXV_ z-qE#D%Q#^|VC)a@Ti0t=Tid!PCR!Oqg_mX3lqW~i?SRF@c_tBWoY>;x@n=1cu9A8n zPt`WCZ@u%0J+yfs0im9PZ?*)~e7Y5tn=O?y_2(#5e$?GJF-~Sng|Oms7BtSp_l^GE z;qK5+zLbxa-Z)|-Ml5Ge|Aea*$}7b{GiD$W~U0}5CCy#n7>pI z;J2vjPe20z=kCsNq7>zU`Rj4{Uf7H;sqaz?TXnj=5B4Qw?vGMTCB3uZ>f)bwl6F9_ zsdEb2-0BuFp72%0Ah`rKorNxpu2&LdXe)T?V{}p!B53WRyB|&JiC)gH8fw~;dl{4#GAfrrciujcLVZ|SiwDqRWB+}E|<-s7~ngJZ@E@lp#=(OB31.+)\.{{ include "artifactory-ha.fullname" . }} {{ include "artifactory-ha.fullname" . }} +{{ tpl (include "artifactory.nginx.hosts" .) . }}; + +if ($http_x_forwarded_proto = '') { + set $http_x_forwarded_proto $scheme; +} +set $host_port {{ .Values.nginx.https.externalPort }}; +if ( $scheme = "http" ) { + set $host_port {{ .Values.nginx.http.externalPort }}; +} +## Application specific logs +## access_log /var/log/nginx/artifactory-access.log timing; +## error_log /var/log/nginx/artifactory-error.log; +rewrite ^/artifactory/?$ / redirect; +if ( $repo != "" ) { + rewrite ^/(v1|v2)/(.*) /artifactory/api/docker/$repo/$1/$2 break; +} +chunked_transfer_encoding on; +client_max_body_size 0; + +location / { + proxy_read_timeout 900; + proxy_pass_header Server; + proxy_cookie_path ~*^/.* /; + proxy_pass {{ include "artifactory-ha.scheme" . }}://{{ include "artifactory-ha.fullname" . }}:{{ .Values.artifactory.externalPort }}/; + {{- if .Values.nginx.service.ssloffload}} + proxy_set_header X-JFrog-Override-Base-Url $http_x_forwarded_proto://$host; + {{- else }} + proxy_set_header X-JFrog-Override-Base-Url $http_x_forwarded_proto://$host:$host_port; + proxy_set_header X-Forwarded-Port $server_port; + {{- end }} + proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto; + proxy_set_header Host $http_host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + {{- if .Values.nginx.disableProxyBuffering}} + proxy_http_version 1.1; + proxy_request_buffering off; + proxy_buffering off; + {{- end }} + add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; + location /artifactory/ { + if ( $request_uri ~ ^/artifactory/(.*)$ ) { + proxy_pass http://{{ include "artifactory-ha.fullname" . }}:{{ .Values.artifactory.externalArtifactoryPort }}/artifactory/$1; + } + proxy_pass http://{{ include "artifactory-ha.fullname" . }}:{{ .Values.artifactory.externalArtifactoryPort }}/artifactory/; + } + location /pipelines/ { + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_set_header Host $http_host; + {{- if .Values.router.tlsEnabled }} + proxy_pass https://{{ include "artifactory-ha.fullname" . }}:{{ .Values.router.internalPort }}; + {{- else }} + proxy_pass http://{{ include "artifactory-ha.fullname" . }}:{{ .Values.router.internalPort }}; + {{- end }} + } +} +} \ No newline at end of file diff --git a/stable/artifactory-ha/files/nginx-main-conf.yaml b/stable/artifactory-ha/files/nginx-main-conf.yaml new file mode 100644 index 000000000..78cecea6a --- /dev/null +++ b/stable/artifactory-ha/files/nginx-main-conf.yaml @@ -0,0 +1,83 @@ +# Main Nginx configuration file +worker_processes 4; + +{{- if .Values.nginx.logs.stderr }} +error_log stderr {{ .Values.nginx.logs.level }}; +{{- else -}} +error_log {{ .Values.nginx.persistence.mountPath }}/logs/error.log {{ .Values.nginx.logs.level }}; +{{- end }} +pid /var/run/nginx.pid; + +{{- if .Values.artifactory.ssh.enabled }} +## SSH Server Configuration +stream { + server { + {{- if .Values.nginx.singleStackIPv6Cluster }} + listen [::]:{{ .Values.nginx.ssh.internalPort }}; + {{- else -}} + listen {{ .Values.nginx.ssh.internalPort }}; + {{- end }} + proxy_pass {{ include "artifactory-ha.fullname" . }}:{{ .Values.artifactory.ssh.externalPort }}; + } +} +{{- end }} + +events { + worker_connections 1024; +} + +http { + include /etc/nginx/mime.types; + default_type application/octet-stream; + + variables_hash_max_size 1024; + variables_hash_bucket_size 64; + server_names_hash_max_size 4096; + server_names_hash_bucket_size 128; + types_hash_max_size 2048; + types_hash_bucket_size 64; + proxy_read_timeout 2400s; + client_header_timeout 2400s; + client_body_timeout 2400s; + proxy_connect_timeout 75s; + proxy_send_timeout 2400s; + proxy_buffer_size 128k; + proxy_buffers 40 128k; + proxy_busy_buffers_size 128k; + proxy_temp_file_write_size 250m; + proxy_http_version 1.1; + client_body_buffer_size 128k; + + log_format main '$remote_addr - $remote_user [$time_local] "$request" ' + '$status $body_bytes_sent "$http_referer" ' + '"$http_user_agent" "$http_x_forwarded_for"'; + + log_format timing 'ip = $remote_addr ' + 'user = \"$remote_user\" ' + 'local_time = \"$time_local\" ' + 'host = $host ' + 'request = \"$request\" ' + 'status = $status ' + 'bytes = $body_bytes_sent ' + 'upstream = \"$upstream_addr\" ' + 'upstream_time = $upstream_response_time ' + 'request_time = $request_time ' + 'referer = \"$http_referer\" ' + 'UA = \"$http_user_agent\"'; + + {{- if .Values.nginx.logs.stdout }} + access_log /dev/stdout timing; + {{- else -}} + access_log {{ .Values.nginx.persistence.mountPath }}/logs/access.log timing; + {{- end }} + + sendfile on; + #tcp_nopush on; + + keepalive_timeout 65; + + #gzip on; + + include /etc/nginx/conf.d/*.conf; + +} diff --git a/stable/artifactory-ha/files/system.yaml b/stable/artifactory-ha/files/system.yaml index f4bcd7be5..3a1d93269 100644 --- a/stable/artifactory-ha/files/system.yaml +++ b/stable/artifactory-ha/files/system.yaml @@ -6,13 +6,7 @@ shared: jfrogColdStorage: coldInstanceEnabled: true {{- end }} -{{- if .Values.artifactory.openMetrics.enabled }} - metrics: - enabled: true - {{- if .Values.artifactory.openMetrics.filebeat.enabled }} - filebeat: {{ toYaml .Values.artifactory.openMetrics.filebeat | nindent 6 }} - {{- end }} -{{- end }} +{{ tpl (include "artifactory.metrics" .) . }} logging: consoleLog: enabled: {{ .Values.artifactory.consoleLog }} @@ -86,8 +80,21 @@ frontend: session: timeMinutes: {{ .Values.frontend.session.timeoutMinutes | quote }} access: + runOnArtifactoryTomcat: {{ .Values.access.runOnArtifactoryTomcat | default false }} database: maxOpenConnections: {{ .Values.access.database.maxOpenConnections }} + {{- if not (.Values.access.runOnArtifactoryTomcat | default false) }} + extraJavaOpts: > + {{- if .Values.splitServicesToContainers }} + -XX:InitialRAMPercentage=20 + -XX:MaxRAMPercentage=70 + {{- end }} + {{- with .Values.access.javaOpts }} + {{- if .other }} + {{ .other }} + {{- end }} + {{- end }} + {{- end }} tomcat: connector: maxThreads: {{ .Values.access.tomcat.connector.maxThreads }} @@ -146,4 +153,11 @@ federation: {{- if .Values.event.webhooks }} event: webhooks: {{ toYaml .Values.event.webhooks | nindent 6 }} +{{- end }} +{{- if .Values.evidence.enabled }} +evidence: + enabled: true +{{- else }} +evidence: + enabled: false {{- end }} \ No newline at end of file diff --git a/stable/artifactory-ha/logo/artifactory-logo.png b/stable/artifactory-ha/logo/artifactory-logo.png index 3e8ac0d10763a51d456cd900450ab8ddfc89a6b0..fe6c23c5a7f87edaf49f883ffa99d875073e2285 100644 GIT binary patch literal 82419 zcmeEu_ghri(zUjr(D-PRRRmf@LCGSLp;Zu&EGjt&2qIB(#vYX@K~O<57!VPVoP&~8 za#C_oa#AEp_-Z%Ky>q|&{t5Sod1eMU=j>CvcGap?t4@HLiX8R`cGs?5SOs~RE4y~> z{R{m=fq|cdkh!+QzbNhGwH7qG?EbRjWh(35t}4ga+$_{AeC&MH|I?!WK*&sE$M5&b`&jJMx?v#>sZ{GTuP=jz1$9Q*!{C(H0A z?q?Lu+V%fg1YPua_}l;SWMVz}<6$-qhJP;Rk3H|6i9Py%JQ-JX_l(}RYRvy(5;fn5 zJ^#m(*%;M)gJQLI{r~#}%lT+$|9?FBf1B}N?(@IR_z!RY-^uu|v;4m>^&g?B#(!j>|0VGMf*k)#;Qx_$|A(gj3;+EO+Wtr4{ZD9%Prz_QhqAsNELo{;y5`4_ zuw}cRaYw`D`u*)%tMxjL=|SvvS;6`f%}9x*C7+7z+Y_TX`wS;4-qZTnuUB}S+?=`4 zd%rs&{&!j?(|&2scVl_&Ss#VB7af0Tm(=<6zw~k{xyUgct@_O&LC}j>q;G zQ}1lmB*QHmORQ{~liX9j0b%jSxwY1tXRj6x=x;`<&ANNPuSz02XSL3gbfwE@#>M8) zVsOW%uulwsZ_7jVR8*{#_psMK@K?UEPVjrr`*pk1_j%ff1>GK@3R@dppcchtQ7xl_LCaX-Q;UdQu#U0QJd zomQWIOq-8iZEx=^R{tbN_Bx<h$H%tUZMh6q zyI-w*=r-zRF>p>S7i$V&2>N5Ru(MEDy=e5``cuTn(o(Qm>v|g*tg75x9heBBV)Zf| zo2`gicz%?jhDPXH$w`ClFQ3o*82tM3JIyfe-R7q!`xsfoiYjhtWE}gGR0w}TB}F44 zT6}58NRCQ)&r0j&0A|JI=G4BQ4TG9nqMpUGni}p)ycOK)-#Oxn{415eYxW5*y&4}o z=waSj|0X?wr(e3D*haJN=MeoRc+31$~)278*# zd0jl&-{SE31mme6tJf}*+i*_{IQ|Sydc8h36`3-}J?QADd{MEi>~A~}W&kh$t0^v? z7P$;jkK%r^t}DTOb$Mhmxi|5Lw33CoLO~E4zw5|Sb5n`5=O@>XA=zqC;$N>s2K86s zDM>aXD#5C58Xv*_MOu}qY+`y#ewo?muQ-!IgQYe>hk53+TgAy8HfO_c5bbh`+8-2Y zmvGETl%L=#`RmRfvmd5Y^ZhjR;s_0Chvgp;zyns5Gzyu&7)DC3EIi!pbvom--TV3$ zW88%9k90Y+{rgpKVGVT$?5*@2bTtB<_v!!fz-*qx{gJb4LSm%N2ooVLoM?wFdSbh^ zz!${oV>Hz$`N_RnEt;CG08{pn*UL_)0uJG|qVJ=5evxZ5mLnk)VlpHH{bYwbrF=bi zopdKPEOFsbyR{Hgt?h5N#~0?}+QbW%@OxDMBDhA^?P*^x&zkw#AYN-FU7kuOem`nw z%Lv}!2|vYGE~$|2m`p3u@pZOx~-_9clb$?Uk!ttFm)N+{kG=I!4C%sv?bhAVAqSrT`HKCJ| zGmixFIZL(qpP$-wm0BGz{frcy<92mbpUeH zLy#i-5S(?6S)aDt?#Sr_!cPoaH%A^YP?)OXAAkEm%kqIyvnuEA;vFOY%R8%1)CI1g ze`L{YX9)ttJxiStE)Ulhlk4_A{B5utc=D1AUX0kAmf_|0V-!O6Q45i%tg63;|Jc8V z27=Mk7tW;MM9?8u$?xEK9si>%aNJL2?y&x&3!lh-9=99ph#4>tvTxYRJfh3g=C0Rb zyYqBB296wsnvep?A=>co(wwIwnFcre-->%g8a_=}_kTp=uYvbW`W+y;^4NOoU9pY% zkr3><{LYz`;R04CJ+o`))sx9|dZHs)qlDeRQ@N;aSj5&)WKrNK63%(KEPYBlz+=Oc zdvfYsqTnCfTfvKGsZ;HE_vMpn?XIR%O+UvOH(uF(zxL)B8O7u4iQ8XnD{?1X+FgRv ztlymadj7o8AFI*9#V^$uBS?q5nhh5}u=>@vHMFVp`FND#WnC9s+%BR6DdKo8>kpR< zmsl3m*vsSY?}RGOER-fV2(F~NsW}oMEBVcrW8+sN9Qb~hUARj)L+&lQ=6kTaJZtSs zPckd+?4LJgmjiN5)FFw3^b(2FmUV~wC7E`&9f2kWtf8ClCj3`K6)Om z+TI8M`V%6q0Bslfld{7L8LHloP_)geGW)gR>U?)9Ok~meYpOCTL+tMHz zf9JX@a9u?EZ8g$$HpJ&xztj1izhVv-+)Onv;wGbz;aDiqb_p3=uKDrGWKwE*Qj!!v z>WjfXUFKg_k#X^o80GZf9OqDPWGxH>*BL8F(Db0E(R+@58g7!Jq#jz#_UNe-(G$bncr=tG;?0HZf6Ij zP%sspzod-LLICcyg~XNowJJN8lqkN|2geC`4$ML2ioDy?<^a7oM#55dLLYtwJhw=7 zH;D3~&b=OKhD9bDPA5w7jM2M@eb_$H;fk#y=Z>v)Np;rg+&|DLR+Dge zu9Vw=orH{P=qL&l6UsbB7QWtd@c3anL`K0bmk38E9x&coXM2yQNJf;LyEO^C5trdj zdxW#eNo$zMt|YEcLCSFU=*(*1L2EfiwA=Ga_P3d&`21G6X^UOMfmEhD(cy}c%PuGTFv|F9 z?(Ly->4rKPSxe|7F;lym)>evooXlg;S#(ko)*-zU?j`un zsc3mL?bZwD?FvzxV`J4YW?)gdQz@Zwe+b&S5n3Rgn|0Vpr|My4el#|d$7}u7Pp&KO z`sux}?1{&fjr4<_4r{C~-8P>--{>Rkm{S34a`^)M>UVZ(p1_ZNw#++D(g3MNvCDG;i=M`=jPKhuSCwbmC$?OoUv98;34UmL#mK00 zMS5^yg|@LS!nv=Db?1p%@Wg7B;1J|KgaGp8?s+%MnneVfzAfdPho2^LVm41_dIPjP zj@_r|S>7U~)5LKncopQ(QFR%|T2Y@QL# zk{o!RcZ;;g_?vL3PQ~!|Bh*EdC%?|BLt{gTU!yYH1Fu4$!vM&Vs2Cbnmg|;rPwWyQ zIkJ2v?40|!N;5k3iMKEhG#-$5wzI~$$_OKJkbR(iDXErsD}@tFdKF(V|CzJT zd|@S!_Ze?-sCihjYxC!wkPMY6iAL%jmZ{aa!DP5Il2Zu&5 zNxOu-x(kycY#**)xcVEGU!PM6fUT)t{DkMk>PVew#SV0I!vO}Z;$|Wtqzyjew#MCF zQRj(o@owe(=bXXL)u%`yv`0`|V9qBlc;g=Ote+eZuq#A`jo}ZzY2oRHUd_JU`2LM) zq;!>zRAi`7^-1S7$4W-fjoN#%oO48frw>-2KWwyt788IX(o|F6u?V`M@}#54o^4oE z3Vbc$V8B|7itavqlJs7yIuKASvC<^3I!AtCx6Q|pGvtMB22Mc$FNry1A9C)P&BiAl zifq)#R7d8kBnR{H?i#&`oJ78YusYEGwttj;R?4ZZXQ0iz- z9mXY~HxuJVP!g&w<9C|=TnZ}>wc&vF;o{=^U(A7sfi)W|MTN7Bw$7Y_<*?eNIsfjs9dM74K zMXYDlh*!>{Ysgs=9+yu7D_}X4BjNX9dx&;Sg%E2af)!<+!zQ599v`=Im#Ox z+JG|n^Qn}UU9it#0>t&F#ZU*&=zD8-bX)b1{E?fo@2Yo=ba%*YE9?3%7Oi$9Pf>(r zX-6xY9D`*QlVek`0Q36{oUEVnQU#-YMK(fLXgRVp?7MeTig}8JcuXOk^OiVRnxe-( zsRVaMfh#uhHi>T`Tqlo@a&RduI{!xHo)`qC-IyX2PHN6FvBT}cxz&0dtva%)0UXs& zbtc{+x!ne4cx>-5!#<}*j&RSt9m2?^>SN%I2F&_gkpb|;3rXp>d&d#t-1;O)O)}a+ z%pS%Z}l6-^hS?JjR)-X)|=ps z#P?L~ z>Ng^k8z)5>P25QleT~i)KtWwh2>s^Sl=GxZS~9=@B{Jto`#p!fFDLM@f4u>Y+4!P+ z^J~)TEWpw91>NMdT~uuccF>mCsl@%=3j8r7zvm#A2s~!Nn6Q2kEh~jwqBtoc#c}6% zE`Y3xxh6JAt2;(~)paS<*e;#4VG0Z)n-jiI^Pf`1eJb54*aJD?gvlr=lY*%aS=Uhm zG05Ty<-giUn}xU28QMzqg5q;A!67OExz=66S@5ma!rSPTMHz10O5N@aWORSJWaqSF z#5T5;w3#+Qb6tI1k4I?>lSoVcx8{JTNBLHy&}gAL;l=l4MQQZHcPk-;Mz>jRKB6xY zyTind_OKdWm@y?^3*MtXo8YC`|N7?frqZY%f}{dn2_A1PP7;nOhkjAiYN~)Cdv;?{l`(^M)_4XuGcFI2^xk>Q$4R^jQC|}U; z_4M$43y$C4%bpUKoaQB6aSg6W6?|@puE-~>I#x1$iZ5Gz88nEn;V$BSiu>k1ekCbC5G|zz>fQ# zImQ2O>i1$=iqmh?w4KKW!RazE>k$FJYSAV}@Hp}Dxv@oPD(@xbU9v#Vg|VN~=km@u zFH2aGa$G%%$Okz3!_XDwDDL?w6({*eaz-PFup4uj!4){Q;q#Yf6AZ1-qo1rXK;T>1 zU_xQDiJC&ygtK?!1~5B`_l=rM5uBdqD^@L`#+Sv1of83}R<6tHvB4BjN*0colE zb6Mtu=E)=MVdlj1qdp?8BdRPhLK8o}-ZM1VSWQ!mN33$fTc7D)KEU2QE6!otD7ZEF z7PxkwO+%;tj6F*p;!A@AwBi-s9;-J1w72v4jf;9S&jFOZf1ngNjwHd*&!v)%Gs|x* z7bV1NRbW+o+@3Eoin;=KsLX#T-FWcul%~O5zA3F_{WMg7xEEZP~x4IgmyEam3|c14vxDCzQFwJ+1yrks3=QpNIVC z0{K*Grmye8M-L7@elXJU@g7wH>!9O{VWSH!WBw&h6W_|yg_vOB!VoNXQL?`Eux|=W zitt!YEj-gno4yDk83iM?Xg<0gwt-VZq*!_iN+rdw_b1WG4CKX0VQ9-^uK(h~!80Eb zDn6$9DOa5Ee8S!Fybg#^&!bizjkQpV1eKTEEPOwzT$j(H%UVt;ZZn-SpYHvAjr^cA zf4c2ppzTXetm6|xD@v29HfhU;rTPvZfhQCnhrrD&IS;UhFhxE#7uVx6QxN1moOB)& zKws!I#4QEw9xacIjcujH$TCu_ zc&@tk$CM{VkKc>Wf&)Bc2>~hd)CP(OM=9^m*WXthOg6N*6-KZi|G?3Iq1F1=$88Nq zU9Ver(vx-FLvAPW7mN)31!Qe3@8|w2ZcY{s3XbT;F3)~N-u-nn;uoU%)gflfo=DRN ze_+3k*PC{qxY3%Kc~*;txbU`(dXZ&gyhnX;S%u0)RB1*f#Y7+X#lv{KuT0}Z|9X6! zi_hv+69pP2HB1eCp~D9sYmw}1s*-yJq&#JYN-M!9dr^_Mj4)7w?dtE~cz>}mrkb+s zHXSR>iqg8aYuJa1b7cjl+eZ_)EPN80TNs8}9DoSJ%Dr1y@Plp$tL{finZ!Z_7^n>E znp!d}I8pp<5d~{BxqU^=sY&|R)^FCTN`D7=h$aa^K)i1rB_(PuUs&SfN|sWr>mDjC zJHPhG_aa292Xfg561*bEvo4h}-L9Cx4Bt7yp*s~=Zg`6XV8i(!;%$hwT?Bj3oi}Q4 z6}so;UF|n?g$XZ>rMqW5;%sj@%=0XV&! zWWFlpcj|sLY7dGBhobP)1Tjlox4Hs?T$m&gI$ncUy=Cb%se9Pf=!gb4Bc;xm7_FMN z1LT?Zy1?#Hm*^_z2>AG~sY%<+BWu%>n^m-@gTj-K9K$^ztm4O^_c7WpEwht#LF@O# z6>}fpDB%U-$%aRdsq0CA;|Y^run>{RSb-X!8+fOrCDRw;f7Lp0;ocMntu%W3ETy3U z)fbT#qcA;7mW*2kB%wo0>Wy7;oZk+lcE&Cca^M4Gzb9s@TztYPo4qH;LT zQ^s}KCMEo9Eg2gPMe}yQyVa(4z*GYAhcHR-hndDyYB-ET9rvvb*VnJfXkLz;!S2s#HV{%lINC3%<^ z+;NWSHcB6qG`B1)-5?>T>#=}g<;XrT7fR_%i%C2aKJW1$12+)`9mD*s`aslA`0`6v zEPOT}wyLru&G5j%?OCm+o0<8$t{jFI!8&&o|OM zuD75C2E-WO<5&ZZFkYgaZ6jrGg{Skt=J1}&j0)ZrY;fE8iX%F`S0gg?FWDme22kXq z9rOL{!|;f3-gnTjGgMktr|aI+!)|9lgqAPO+$ux7Lk|GLU;P)iDIBliB@|6t%fCK< z8Vtuaw7KNC>mw+yhBF@YhT2Zu?r~>@J5jKsiloTlxj9&4qOh_f?z>brb^Dj!}n?pXP?Ced)09wy!6lTbrpL* z=5QGVNLj;8%P_RTuWYw_ei;-#^E$mk8+TIeDp8Un-_JN#w?5A4@j`Pl)vu!t4Jp&x z*E_y-l8WcYTEGcZ)8Y{zEItlB;h#loRe|Mm-FRXxGVzaHBFnf)vRYM;fuk2ETYGmUFFjOQBa#_jiK$p9{|S@ zd0Ye74e}9ycfng52aoIjvXt<{B)wyj>Y+VdD%-4urKt}9;OgDY_|9g`UeCl#J5S@{_2nNk>B$`flE9nkKfUiZXC}r?ErtM_l32c z8*7EFt$zSWcM;+r>k^IO?`Mn?`rc~^3=+8jmbxxj@-82}#~!weXtyh&#APaHaqi&F z$DdhE_w(N-wsIK)-*y6@=|njtO~Se*IEecDHvvIZKqg!`j%v z{_zs_l6Q$@Dpb%i`}Mun#ZRSNpjVFRd63S~v!azatJEA_QZAl?)N@7nrkD~U1>Q_M zZ`%LFs%K8-C0rxw)_Jcq()(aTm+D8GOg@u^pME!2|8v`5+0XllrukC6i5{eninm9l z-0-QC8K_|Rk0P^ynxZqp?qKF?&BdPPctW!P=qox~px=BJN(YXFrTe>xg5=PV1Cs97 zjqw>~;^<*@*S-FADe*-Y*Pemt8$fEHxOH^$7!>dfTBWwm09|Twq8U#JlKM6MoqT== z)yLe&1za(yG!&tyS;~IaKvyT?*`7zl>f<>3lM;K`uQg=kpgqWgJ;+EI9HPX@7goNQ z-F6n7cjYxXL;F4J**&wFBi(S`7y7y+A^ULQq)NnqB=R%gU;p`h1Hl+qn7R=N%y*pd z^HNeHOaY;?o`(~tklB(O8g;U*edo-`1_yijiY@QHzy)U?!`a9!thbp%KjT@j z$zydHo|c@qa$m;|<~-WC1n`__1?lLfhj(zuF5*>eE`tu_OvesI=UMZM_`c*4ARB<^ zO8x8f#IU?dqEPgRhr9GZV;Hi!|}bdH2)9)|ma zoQ_=qVL}DJ@xVQ<1H2+!J{u80)ML4OgvBN9oamI}i3^n*0=QPpcmCu-3=|%Oe?t)h z1KI5(p@k>ZBp6Rm2Dd@Ttw?vhF&_}8UGHiFkyH>f{45H>;(~JLFP6&D$u(%FRE=|r zM`-7hh_hAjtdSfB)U9D;e4WuNYTDL3s{K4D{1U|3OxB!9R^ANWa@I8-;I)t1iY>4C z7VLxK^hl`5`q9uzFAZBUM|+>K6><`beFV6IHWABpaMQiy9~zhD5Bcazq&cWx;lRcF ztarvYSkJ9Syw@KLqi|GDe3^c8EaNn5qDub{iTne8&}i#(WL)931q=Y>;YU05soOEI zDrQ!EL=zg7? zW1$`o1OQ{=-@~0KnpR<(a!c!8Cb!NB5Y#}rl%347lU5z z78w+_k*d7ao*+bWyfv>VS9(Hu5DaUI`Ro?^A=7o3jm|8!~|x#b&!8t- z#0A&BpN-pAx2->~9Jm4OnaqinmMhy3w`?^YGA#yI$5V{VXvzD&zM@=$?$ROvcL@>w zilBll4JTdCB_3Al@o3$*rr7;QeDrIchSCiM=9*ae?ji!R~3H5WQPpL#5 zL#>QeW|X#NxPiG5c!yGvoi9N*X%?!RAcs7j>lpIA;ELa$h63re1 zH`c>6Qwg}7+7Nwb_Xg+ofs#~wk3&=tPYCRW)!~SU&;Zp|fLkh$UNYI1?d~~R@c!pVe`3%%V#^k#hx6QZ}=3%dXTj(RA`or zgm^Vl9uJ!$tri<2MNK3k_P6Ns{S`pDf8TBN?3sjBfM84e?q%^b|scDdk6wZ1?C?hf^V9cj5_O*I5>8 zVFfExcF|xV@rXcP9QYpjWaC}xo*z`G31!#*kmglF3*7D>?5h7Yyyx^ds8;GK-Y{h4 zVt|=-b!yPqH{o5&xw0304(!7VY^BTjBNfQ9k>o08Sr5`bTkURPdwO{& zBcQwai%^E$o0jjfKTso){c@t(t(a1i&xt>}pG*~=w%NdhHnSYHdG+YEM8{$H15@w^ zUJr-cGO#MG#Ehclq{)KX3U`Jqc7$9uA#i#{rc`^xEr3TK$IWFdv=&zk=>2F6KWaoC zY-j`k&+{a2beuvOEc{=5Gtn5^QP3d?#ni^M8TBaR#5L#1*WZsr$fpw|<^lyp{6-0> zeF!*}dF`&_TgTJ=!B_(0EIzuI2Mk`z!Lt6Xb9k(W_k1#%rG0P2P$1|~MP<8#&v()N zCk96y;XWedBqAdB(Dsk()vM(3>$hKfX1VFmUfJkL8)V~+P!F|lI;?XMogokUF zHZ-XO!V=F6=t^W^Plg zH!VJllen-H%rU+{z~>3KF@&=@`2_1jvwJWBJxh)d5LU@QB*aPS{jLR>U$q+<1D7`u zl!?W8Ek}I*3V;Ov&$KK;c0qp(@KSAs6oY^Yk&!{l{$06Ph$ju|H(KBzt1Zox?i-Of z5JX==5LwBi?`aDQMFOFJ=mUwS*xcN_!UF-@AMj27D=L#^KZib;zDh6v{FRuCfdZZd zv|=Km4aPOx{PsWWo)ost-Asn}Kr!y2@@o(~;nE1J*|mTa=@$ReD*QsW9=hoaIKt}$ zM_1fsekhhs;^y#>Kr2?#SFc;`Gbb7|P&7C2tSagCI4fu=eMr4<#$K5Z+1Lga z)ub zyA}pEGa?j>LJCE%_|QU;@ZfZcatbAmGrbZdyn$}RTzdO4P)nQq{-OL*nFlpb!mvbW zdhd_%R^0DrbIh3G^_QRO=dN_18cXdoyvvn_An-dK^3w&LM;F623ty9iVO2WwoBMsl z(tp1|z9dhy+t<19IHvrGrmWZgZtqwOM4&TH=CW*pDk;b&sDN?&9AQ9%55o~H#JN1y zlN+OKtBXcL#kwE^h)${Rr~LZf@gDHml=tO?B|!Y~I`msls79jZ*Ox%D+~mE6MRmr% z8vw!bvNpEjYWEd z11`Hh-^xG2fN}+tctJSLb~xgf@Z4vs>;;=T)3sVD_k;9l;eG9A_7udn<7F`b6OL*v zZBB$N=!9q(RTf%0ciJecuTP$an}p+`fWNQZvJXQ>!-IPo1rn>1O-|@GrTM=mi^qCo zIAWXN2;kc>&~(}a)}fVoJnv{qCEv-73Bu-p635&3=!DdR>&ou!JPPF|Eyc>yawx(_ z^;!ezA60@F#xQ$3?cw(nqzA;m!~pqL0%9O)<^>_96lkCbgCIr0f@SI)EN29bI}Yl} zV92fOHs){}GP{ZhFh``z>z2hj+a==*@Bi_^iC2 z09H>$=R2QImQ&YYbX0u4}OOd?S<>H11%3rLT6qdT#kM?!zVE z%!yQ3&MN(|T8LNmF_p`sF%oZinr^z^F)1ru{Q)f&H$|OM#BX0GpNh6jFkG;^(@dum zqzp=)gHZh56cP<+f29d>c%c1Ui~MH{sE4EnAG-&`L)Pelw3+W?5=A}O z3#T~7PNdrPGXetjI%u3jg{m1%4A6#msJiD82&1;cKvsS~t&V*Pmomb^DJcwv_Fvc? zB4uy+Lm$c0#=_*@fUiKlBp4sFrv3*Ct-3RML#NFu4S!eyrd#0|bFo zpnS6z`{Ap6mw?mqHuBEQRx~kqi0xJ;x@cDP>D+pPFcm&bm1xKJmvH2ER!j1CS`4P@)lynU zuhSU&I-(!Qev)Jy5GY(0zm3e^!Gd;3)k{%7KBDUj>@E)NEgxUAm5hmHH)b4L zn*FUoL^Iad2~fVW8E~5p9IZPtzMN z2wS2Ku|~TEKWYXWwU%omNq$iaUD_v%YSZB>y^b>@v{R@{3+|j-+3I^SwDCyC_lOW- zC}B%BvSCI<5j8}p_rXq=}p;vu$kFt!t$rjRAZ^@nJjT|eqU>Qdqg-&KNueJSi$Q+%|^fOlo# z{A^mU*Rbd>rvKdO*i$G4g2Euw?bIo~6f&FCQuoQNBJ-x`1mrJw33tfHX5+dFMs(xE zB)^K75%;|s=xcG$E?mqIf;+LJ&3?9+tO<3OCTOabVQ9g`KnB}=ide$2r$5eO z9+C%m_$;NBXueI$Dy#Dp`_0iPas#bZ`QfWcWzT-0mi7w+xYLrxEf569Y7PMatS$AV z%h14tHXi*(+&`|Y&j&dfX&8r-uvM=H+fp^21e-7*PghqeL&BvnPQYI>%6?4%>5dXX zyeska*w{;lln=pr5~W4ysUi{S^rU@i5g;z))k!z`yw>30W~w`dW9fbeI6Or86;M6@ zEFVCL1u`vY-g7ivd#=UINb$W@wR?N^g2T8I=|;Fz=wB=kOlgXF_hjGvj49C6_kb?% z3(-WRNqCF|c)42u-_=Y((NcS(eZ8jClrG~Q2BskdELT?9REx&YVL}D>$@xRH@$LQZ zBO)7(8CGZC8UhC>F8cBuO1rlqyj&5yCU*HQv``?ZD18o+9Tww+u4v&@%Seb)GD&B5 zm(YQMKKCTJ#6Hy<=Yq6{`a69B#C9X$Gw}-2m|QjhL>|b;?_}=w`I8LX!EXFM>%2&L z(W*wqj&h{s8bZnUGYQTMGG;j<&v;9A{bMHD6WFEY3JIAy~)UrRbZz?@@hbD ze;TR7ka)SNGf9h?&K0K7ipOZxl}nv>?z2J`BFyXovtG;+sb9HOi2G8Os8%*+2Y$H= z!^xyUouR^0t;gVG;ukjl@*CA-4D38ljAYo%f0WK5ZCljYNOd5 zEP|b1+6Z`fscPtSGlu3scT|Q`4Rq@wn)i*J)bM?VML_5bS6l9k@zE(Dz2NON{{!(u zRtzbX-RGccF$e84$HM4kFqoq<5JIom=du^I1TPxLiMw*UH8x|*l*qYLdNn;;N8pg z6H{*8Qs5tKfOUc%YmUO^vhl<2ePQs#`@HES7B16G(vLsZG18pv0$f+vuaN|6 zSv6|3e5r!{0S?&mZ<^}|)n_QZ@?XXiX0d(ZFIS*1{v(CxzvEskFsuEFoijx3A4+AY>Hd$+eS$^?pqC;X?-b8Di!Fi-UIOFtuwqVYblCKTuK{dbVmr86+{wkgpdLKYqI1j3sw>g;x@&SS7e7plLgn=2 z^xXnGItjC+H9c z2U**Q_Ll(rJ4lCY(CwLgzX5+1HURt}fUtUK^_|5gulLhmy{=^Lk%r}fM-z*FoI6m4NRW0(D3o$*?3-S+&#jooiWT8 zexQ+Yf#0@-00SUS@CHOlLyC|4gG7(P`#>xKnpQ!c(hIr$Zp=%X*OnPxFuUNa8hy_H zJc^H}t{w45di4y5k4}w^C9qqnMlgpWz&(2ZmgZ1{=*4IqrqLMJM`#gu30KHJ?5jco z(~=YwCQ=Wl?#;!Zi0G5+h$LGCd0E`P8bw4bCcgSn4`B0BnQyyy3AFMDJHPaV#a6eV zAraUC9im;#)j<_&mrY#N-g_JdhV#ycU-loC;XnWlOxv2xvm28|B_X`sEx_=;#N=APZ*$@#_rH!i&%QqPgFiiJK_~u397-=Yc+N8T&MT$-( zqh>uU(+#t4I&GioM#F=qbc4|IiMBNb%bl|-2Dc}u;TcqE6L&f0jeu>a zTO#&>o5>rw%;rNDzEmdCzV!fcfy-Sc)3lFq#Uvds*%eOIrd^n=r;4*KW6480v4b6& zDg1XFpP{*8&Z_Um(b#apX|fOP>a5S)JUX}pXAR|t#sY0KL`%=orzS`2*ku?swVa;! zQt^lyyKaKE?WDv-Aemsu3U1*%g^eYQkbOMobEqm?$$t?G#fjCA@~;7(D4BP}h^h2Z zIp%E;Bbq#VmW=mfKvSY%JvRa4C)!Aq_;cn66Oj%yEJyrQO={kqq#e;CLWYB(iLhj= z)@!5_1N@yr?{+^7QIE&FmC@WIK&2<@`IB(^rwj+c{3ocV`>NN7lKm=PqUAQw+{RjA zly?k>KYGjMZ<$RXDhn91qDmN`^%;oBWHiCKf;i-qDr-Ln0gr?rhhwi^WD64`X6Z@? z+&Fcz+KpVQmtV|@@;PZ-5HVaxI9Hlt#8->w_Zt5~_cAa8>fn74N+mvL3(&~tBCQ0B z4hP;~K3QFafx<@K(S8EBD)e9&^61!x!H8x_DvuL;i69Vgfm5;`QBMKn1PWiyV{P&j zFVykeN(r%o?7p&5xN$7BHH>tVc!DjSH}7nNK2%JNs-KI-`y8?~jd82(fBCgN;c!aTN>m9@OP_XJ6qf~yZC=r0EBd$lCF@^Iz}9QoO} zr%xo#8~`E=3Aolzo!y00VHOf%Mtwp8Z_DnBC=NwN*oq7|a+f`OKEAVvV3;nB1Awyi zHX_@n7LPDwf>o-bNz(*0gT5m1(?IMIY9PH)4SR^e;6m&Pkh|`K?4EK`@z0FBsk{+X z1_dFTbJ{6p+Yis9B3AIRoG&oJf$%0*B;1Ns@SPa0gS<1MW8sIc>tBdH)dD353?wQz zjZKjB%sBbH%BhQr&{20A`}(z6fC6fzDjLpC@sK9k`iEdrvsY~diWdrrMd=nWEhNBQ zbYFzTw1S9BMI(8FG~|M-Pp*U+AP|C!EFPU5KSbs&Sythvar2JPnUk1*NiK<26rQzt*#oCLe(KXGGsHXcANYZN4A#Jw{r|V{Aei{TOrszxPi`6Ms?8Wb`|0 ztkDa+&4mRF&2w$Xmg}`5Efdrl`o!)?DX+0-J+S^?>7`RfUQW&qAM3$m{x#@os*q^+ z24)3@4n5TdGc3%M{`R6euK4>=7AYm|g<)eImIBTri@}1L+yWaLeH%9p%d=dBXjTSp zJsBr1$pPHrDe;fST1J$2UZEMQc-XI-#S=RTx;~d+tr1-EJ-+Bx!1%bEN6JmHbePT~ z$^fl+!rk35giwo`{|64aC`(XrtHa!sz?PU{dHok}QxVcToB-94^Zr9ClG9H`$me1g zOnj0)x2c$N|D$f6WIzK2cQUf7r!?+-hYwb?#hv~0t%_`3sJ)VbB-AYcBEGvC9U^|Q=G8~?G$Z#h12nxB^OFZFy!;Eg(p+hI6%D;u1A1 zu9nyUWu74Gvzw3MTBJzVUQ7}u%Ra4^x0DkVc^xhUCO9Wrv33V{o;jt)nJX!{QXb1^ zWX!VlS^wIz&nNCdLDK;1R)}ZzIvz$%?0ID}CwX){`;5eqJdhDy%C6%_Y344$h72f2 z9~i6_>E16IDg;6&CY>pV2t(j=32cCUX#}uh=kdKLh}5sK@ih(mnYYem4o1vAJoD!R z3fG9BV)}i}fO-7mvGFX_tG({fPzZkW3OxVJxNIi0=j zZf^-oN>hoQ$PtMdKKQJ;aXT+h*$R{e{zXb>@4*Af&;tpK;RF>V7_iAKK9|3w(X>bM z>}D5K&9N_@-q=ArpQ&Q4QcD18#PZo1Gi?E}b({Ign%Bo&lE&vgl z#S?GOatnCe16`Wt{C@j)ri8y~8G&L2RrBLPv0r?*8`cZ#V=aAE?h-s<1wXWdWPte` z7BvLPY>@T$$K!kbDk4teFyW_GmF+5>dnDYQc>0ifBSd<%-zKJ2;ipafT6Y4he6 z8{Z?TY4NxO@HfvcHtPC&1o(zYMOSUkrMErn+AL>2BCa1@+Kw@_@f401y43W%PjJ#4 zQdl+`lb}WtYO*wKj41sosHNcy)(CDu;m(_K*zC)W!(?KHZQdOplRVUX`S`dxe4z)Q zscqH=#oXT?(foPb4p@g6uJUJ#PP+T6D!@4wQmZz;J$XcO8N_fyzrDg^MAbyg>YIcN z0u2L>N?nMML$i*YSMwC`DHt?tF&>nE$afH0Xv}rO<7cb(BUKP^nFjd2!}%b;5#ScJ zXEBB}WuIUPV{QJ(<7lo2)6^%S*$a%#K?;gE5DTw0KJ2wGR|<4r9TsOD zj$!?YIu`%x2YtJm2wzuuZm{{SbQ2XCFt--_D)Po3V>8l258eqr*dl7kEi1W^D*lO2 zj1p>?T|^Z?x=xr+uaIp(OC$}`H|l&|_5)jRoXxX-?+~UyYFiS4SpM#rMYpuD4@T%b zw?{4Q&|Gh#IGnNm)CE;U_;dlA ze(bl>JE7_G@+>`|ad3ux>p77P?TK+}kfZxR|IeZPNRZsz;3i8+HEhz>;`VF(nS zfsS{=7i+5u2p>`o@EOgc5oJdR5E;*}EEeIk>l&?;4|SxH`%k??awlFkD2J(!ROpb-gXjLU5ane@3y>|yZgBhL#Z{h{ zX|wX+Tbatv3*aXFE1O1jKS=W0m%k0PS@qH1(vvfLe-5@u1SakK+_XVD3RSIhw@pc_ z+;FYu@#F_crPee*w^QnXz0Ao_@sa#J(ClKsVoQTp+%s%1M6@Aku)%iL0xf#ehk6oy zJ{NSe)r_Z4GnY3n)zj1V=C&e`8%fznQ<3|25V2;YH$&jbnmfa%n6 zMv8;-OX`LGU2((jbv;yOL@G)&cfvKA=l`OUlLWd&Y94+2ftl@1Laf{?XQ@+VAYAxc zL&i++3SZ$7HMEx%-te(?uXx^W1RJyCh;?LAI>M)mI~ALBy=7+|6ylR&eEs5OuHq~|p}vfs^tfm$^wkH_28eOKo1BP-;gCxO;SCO-d~|NqANqxKXNJLi5r6-g2xmkE)^RGE?(u^GZ(L{bFNFal59gbKut19#I!e{hO zrlQs!6gK^jnfPI>5EVADd^v1Kwt&`x$q)S~YTLihv7=gIYTg~FH>i2cz<3i+q;TEu z&*s96!8Wi59P|{pTXG=SOqo9;lT|&V-DNV`+BrM%TL{Gf6lr?@E_yh-1VwEHJ@Iq$ zRqt(@L-zvI{nyu79F>QHZ#Iv466sqP`c+?8Qcmjsu{|T1XVI}_`hHM0PJVDiLybkK z-8c z+=7iMMP$LvSHTg4ZZd>6WfY&r3jYSNt$qyk{NEwOQP~Jum9c!4U>X=hpX+((`p+o= zVhFZFD1pLfFz8lU__$dDsJ7(BE1h?i4#Sm{Fp=ro%n~~;q$OigQ8v}HaP%QtW4IZ- zdLcy7T8=LZKo}0e7^qCHR)a$h96hH*Z(EnK8qzF2+I@Xm)D7Oel&s}{-THT_rQiry z<{KiVZ3S&g$;3|MwqCiw+)T38t8b-^puC)zIQoS&v3W4ki*T67*$wo&}OdsOIqL?G1oycW(KINaPLSx(hH z3@wO%tbiT26)g+|^mDDmZ$*tTr>pH_D(iQ$^3vaCs3(KTz{v3v+A=0+p2Ae{)eTT@ zfb&Gg6`iHQ$kIiXc^J!3J(duLsoz1yJ0WLxDiUzr>`KsuJs!UXmm)O`Z?ivi9>Qqh z+{7y7-k_O?t$a6GAd@TBV4XAkET`_sK^L1NR;17Nz{CA7;U)Orz%);hew6Ilg*x+t zA!fz7P>?u7L6R*PdFeu;7NUWIZ&|?ReFAm#Tgo=lw+WEn{>H%2Cs(s&j(=_WaQ(+Q z)nEqLws){?z8u{xpu|R8Dw|H^xBRajDZgwiEGI`iU77ya4Ua+nF-VGM3qIxe@7)3@ zbUca+1hQewu=bhHFCXDJ1JOrNh7~Z>>5BHfGcZyabVmHh-=~gF-3UIH(Z}1&c4QT3 zCZH@&jU2TI+(mo{LFcB`1*{*zh18Ch2@3B!_xr;KxngmyKQrp+%}HgS1N%1C-3pKf+fMs;qj9BbK z99+ZG;t`dIE-=8qcnG@lL+wk?9m=gvuP;dV@)uLkKBxRUV47m)GrjXB6cb~Gwcvwy z^{*6xb9#Z~r~Qj5D=_>E@mvCCTty89>0MTVYh<ztlj@LAl>aT%OdxGqHJhG~A8XH5C>J|?%Jq);f)-ifYv2}9UKk0WEQ<+^*&w(Zk<%P7?|djKTOvE8yDEQLb@6-eiJr}npOJc{h_ zvpQSUE%Xw4d*AL+Ltse%{UJ?Gbv96cP$I>SBrY`87FJbf`*?>TftuhMZT64YA1 zRCldi!!^oIyxtikKCbmS^j%diQpZHj5=%$6JGxE8=tE(}=R#ED+Ul=AV#Q+5w6MXf z*w|52i;YP}$UMbK9ixtcIm|)fgTk)wbpxS#PZBuD#G$78Xc3CcbaZcP!L`$nCGJC~ z{d~k5d5@BwZ=&~01cRsW5b4=)@-pF0Yx3FGb$cY67@n?{o=CU4 zHX{xIcCvYJW%usy_okRcjZ^Y zQMDR2NM)P@nfnS+KEl36TNu7JXuALNx$aSehQ`LuB-PUq#Ap#tnGe_YIZ|I_tXt7R zhO#7k)Ymk;)(+}U#rK5ue(lC0gP-;miALYcR!BiMgcx^#+p%BS9CBax!c;YLVP34BhEZN-+gAX z*tFyo`sht_YmFgssHv$UJ1!FUWUCj&fkxjt=yCP3m$%)M-_N>4&) zKic^(VZ2d>XO)RbgcchPKEDu(ljn_wx(a13G1NL44P2^8iZmnL)hJ$@!KSlEOJAW| zn00=13_Ah1&xAhn0q=G757M!e02eQPofOJCe>&H?yv^o@I-SA*4M{hTQt@?*NX-K# zcd=Z1TIF%|AS3|7RNywJ)k-$nw!y`smvs*E-jgoSATQsZdq~UW?cuJ8hDS* zt-hD?DCyPmulkh*<7HqxUpO^6&Jaz0J;^M4k+cO(Z zBDNWD_eC62C4eZ-6^ya6KQ0lo4aW$=&Mnw>SUGk9&=0lTHcubAh8cQWy3aYYZVI|h z@Po|Z1;3io2S1iE$lv$VfWVabrO(A)Kq=QStBxL{nSIMS(AgXp5*@{-vZVL@;)9qgmAhz`smn2~eJwKx!8DJglSc9t2+v66Qfj^owS{G>U6H5ce}Ik`9IZz zzN8b@piDbmz&AAyGMe+Sxt{9xs}N1`Ru4|7pM!cEZh-QpSWy-p248k(NO#g7xv(** zIr{K(C%Zn%%%l!Wk62(wPH#|CXF*e(REMF-9fxIOb5R)r9w|vfM_}GB=GCDyZ}{UA zH*b+(<|6)4<#{7qVR_DC|3E|?9iXwjKveruSazansDBL)Ep{bkFp5gtml)1E?e*;P zvAPZaNfD+@DBE*uml&Gy>HJLZYU$wX=&5i`Na3DD*8TItVI;?8clVNj&7Fs?O+{Y3 z3aVGGZe9nz%sb;9m3A<*V7o~9m)t*a1XV0X7|jPf4{_KN00>y=MGZd4lcXW~D2loHHL-ef}h^hPYKdB^QTmtw_HK1$=`BBPCDwV12HIwfWr zPE|a#Bt!d$%yjHI^<8?tW0S~bc=g9|{S@A6z>;%Uqm@9h-nW!%6Y8mFlbDsu(k_tw z*-IL%P3G)eWDREFI}Rr2ylF0I8Tt`y&TBBW`#DDRpin*GK#tk>6s)jjN;ZZF{D5WG z)8Zy|+c5jmJ(+F0$wl7AxgLh_j0!B3&cpF<=qUEgKi^vjY)VIl45h|A$D+rMHh;ZN z+AasQNHiXWo3J&~7BMxI_1uxMjJfR$i4KxX*VWVGO4|3v_4ChXgJ96pCm{8v5yANMW6d zGcF=R(qL_xVflW%%ixo;S`>Ir12|A;vQFjL=ZHb4bqz{Bu>$ArMri7?Wz$z#ddBv5XrR)?ThXPXWofb2%61FH; zAHKvCo|%0PG!P35MjbyS6U&FH6L5`PJ;E|Y33sUd&t+xpDsCvru3sGtN?$@>GjKt+ zZ(sImhoSbYG$x)AsxS*6rK$G9$JoZH*IVu$RswW+=2u|^z)CC()2B->8@^eaVP3c|Odb)Qo{l2r5!hJ? z)}~FTyfIfP)c2nDSaCkBN5cXRhYv{=A!3W`WFt+3N25c`DD~ zF#Ck^p^2y|CY}56_@>KzP(3&xfZ~9p)ljc}*^F1Wr0JjfM^7}gNO~cSZfhw$>>8JL zVkKWgB1S&h8?Y~?a715?Z?UMD;w*u{sW#ueuN^TmUut_z(la)W7J>;TQP)MI@~bhv z;_5AtOID9}hLu;b0`4RRjFhB^0}a<}d<)xwVb^~0@|8%kxrnUvYowjV9VPhhAC632 zg1~pYZ>-5ezyO7I<^X5Udz6Vr{+tn5!x5+MVuyt?vJ3P&A*A&_qWan{QFBu}82{^% z2miWoC1JU)x5ijiWO2m_E3wfLZWAt+h6?IS(m#b-)D=lXn~?iX9w;d_@2IW3h=f$R zQT`Fza0ZlG?`QnJ$e^nPZKl7zq-tMk`jfrKecZ5RxolaT@yN!lXJNp#YKR|jElJ~C zf#AokXhe-Cml0CvrJz(JrQy7kfTx?v3!Nz$^6J)YHyRULxSCAGw-FctgbLLjd@IH6 zllH`soapJnvFIqZ3Nk=2WPtN?{@BL~;+$_T5gT!;Aupf9MT&%%e*jsoYgHTv68l#8 ze06T{aQ{}<$diAAlKNL5h}k+!?>xM4UUa^QC|whrDH-tU7IRzrp53bD`gh--tlS0X zLtxWVd;i$S=snk|_K(0z!LpYIWz$(y+;Lz|n*RjBp7EiE!@nf2tn&D;^D{!F{s|tA zeZ|K^ay|)u;lS=U3aLG>IIx5mc%7|WVP&G0#}f8bN2d*vF)w#TJQ06_4fG~b1i<|A zDuh-lcShGHkeP$Vnm|Pq6}+sJ!NM-FA6g5<@*v(*w~k73zSMFz-=+Bap1(UrE-2x( zsl?EpXrW_oZ2g~X!+G!+Vdj*5^^iB6Sddln;P1oBT_c}YTz*jTAvj&cbz-woof4hh z%x>-zxDyVGxfxLsjuwX5ADIAj!^{Tbk8`au;NGGiSUd90rFI5dr@KlLe|`O!VY}lI zt5shkb&Yyju9}DIzC{Cg^`3AC=hA!znwHwpv4y{|d*oKf-8U4dc4o+z1p9O>pg;hKHSC zvp-k^h2)ppu(#vPm&_5$r{!9>bteq`iXlF z)Rqq1ooFhny5lKLAY5ZLe6NVPA!HiNhy*^Hzgt(h;2`+o`;7uPb%U zi`70Ww#KwV;G3K$2W#g+nAn4+rFAr(4Yn))=+!L>X#`4!zh_%Tu}go+V&d#chsAP( ziJYppxWDsp^3^vsO4#&8*p`1}>(*NGOW)xhFZHvFwB3+Qe0r}g+n!f5eeN~itvU1@ zff91U5O%x9@zaBnog)(*jB{5{=y<7R+nz@}xkjW=ESz@!Tio_gvv1C}-FDZ^;&sjn zq0fPp@a8LyYh>D+_4Bv0!Ozg~LwTz;(<6dANGF}U z!78p^e78m`uRw^f^U$f|6(23l6^v|ixu&Ta&$y0DfKUvqY7ji3{97XD?WmZO)OewN zR~{r3ViIv@5v3WlsPMvi@@f8>aTUW5li^O1WZ#nAin6)qIXuB%0aI}cv&?)}XkSs-z3>6CT604@+*aZv(fWq?=utKNeL{4qn zv!pjH52wmfb$FpqQ6-oOv5|=(uW(CpN*W4wBMej0chxr!@bmn?Lpg&x3OyX=2W#)V zNSEDHNeW6sitt%MY)rW^FI?XGyY_y4L8qEgHcv@XZcgrrubxY+!G{X%))vy3Ikc_+ zPRnCcH*IMfd^gnE)oDnOw~eNOl^V%>Nk?*MbKpikt?2e;u{n%gKegwL>Ve9206v(! zB5Zq6D{)wf)l__PguybJ6>=dm>17>_bP$kW`yydf?w)VoJ#3YoXBdxfSf1D-!~s`H zbjp-v%|L^?~@!oHRMV^Qjrl3xGfS>6V zsFWbcl-*t^TWG$qO`Dp63xt#TOI1mWFvCzMb6C`NaJ9|Pj4r*Xo^%@+7#weZd0j|e zQYo?Qh*P;<2fr>5|sVsqeoHIgxX>$p|oY@_;*ZTC2aS}%Vb zZBPBS4Pac5sS+^y7XLg2>!3V$k7iKzu;^6(YUj_GkzbOJEt)@)N*PJ%_{pH_xyom% zMS5k*EbD*$No}VWVpF*dH^Pre%UPZFyQ`yBpE(Fd1;%ffGf=xo4UHBO`S^NEX`l~}n z_)!c z9u=H;@5>~2Sa_;m^2T)QBf*l**_s(3ol-QqA~^7Dnzh>=LZW6XOe9Sb_-DQFRNj0Z z$|lM3Jb2_(zLqWPK$08k7CQvln{5R4(2=6*1lhZ1LvSoe$c71 zGQy=hF9*`ln(?PXp#Df)b*wY0ILNw2WR$Gj^1}lu&5V7<(y>!uOTz`T(7db@f3&4A zl4gDKYXg)kJgV-0XXLkOernyfch<9eYI^xd_$|yAnxq8Srtk<)>M-TrOSS>pf_(0A z&M#QlNGCXhj*gOI|D4IR{G^SkKs|$Q%T%c>HuKXJg!8gx(}`BhSG=dH*I7=X_Gb@m z&prds=0Kp}y&w^+St{Ho7i$5FR8LKE<>Ah(oICN>jpuWKJ-jIuX1(Hwju>7$40PY! z?_3GGTE}m>TOd`7Q{D&Lk6b3hYm^#ikpLdEPn#?q%qxS1AOij&`tM!1@xVok7N@!y z#A3=iR6fGmgRM`waxqd(i=g>u?4+?VgX68AUJSP=lZp5-5GBviiTMt(>{^#}B>d%V z+1YSJ#R+t}DniRsox0$*tKoTB4crA?IklIwwxsmh2Wm%;-gfOliB=?n{C6gGg7M&F z*>AU9utLCPXg5Czfr2gR$esnKRi7CzT!jGT&deQk;-S3*c`yj1H}SA$+ODzE!E}(X zO=azm*ts!|qjA8Jb_CSyxto8L;UU5xdIR)_%%zL z43a?7Pj`lL;dmhaQGe-Yo0Nx#hnTV3zGC-3KXaSMFh58_OyMNF*RlCoZ!d#e~&_u13>|@wV-5U{yH_ zhlgQQS5T*YT4bdbByxK~*FbmjX1Fs}V0{!Yrl14`oKDVjJ!3;0*5@JWNLqP)u!A!g zzw#cGb=tBOaoE6Ul-^`s2s96`pWZ9f-Y+!lzb|~u)}b6$(kz53{0S5-3P6E zD)aTkX2lrBDThch<>5bO)8`bL_~T$y8hbB+ zSi#w=XPpABjP-@GgyGNU-0~H#8K^9UWYK(flZq7Eqe~m*wz3}7vppF#llx(%6Bujt z68<>3jRZr|Tf7+1L`v2V$a_F!xo#Q|OKoq#{dkyC5rT}*Vxsf>seAa64LB>;KdS?+ z+HywUqO~i?+YS!Z&6yAjf%>7QuaLqkKUCRK;m;Hed1Es?vs-8C(wR9Ibotm6{|?#bBh{+c zS3)XJX@iOxU*w!fp_-3sI_TBZP->Uj#WY2#+o>5E&8A;CEn7jz2iXs=8C7P|!luHx zUbClg9lQRyfbdwl1u~p3?9+PX8C=dPk;I{e$_-R)xm-U(CG~t?>P6#=ESF%WlOsom zx1l`rm&o5sA4N=q7}ijJy`cqUf6jV1H_A5(>Td z>^&+(DSl>fb~w-L>tFe~pXyyyd>!i#$uHwH#!!CTNwBUBY0r{&P;{JFu|Ot5Tu-cE z9O=DHab#k6D)9tNlfWJMIIFp%sjsNaZ~S-gFmTBs4!nYjoZXLD)Z$xmcdy zo2*_Viz|Z@)Z%B=MVZ5WiPsjntf`OGUE7#;BkP;DO-fnQBApZkduD$nadm>=OO=%! zVi`kuHW!#Gkhw6S^B5MmovrrwLQ>+e+mZDzZNLMa9jJI3Hdv7UVc*iCPV%^pZQJf`yC4ny zpLK$Zg)k{%R8!h_3z2k0n%>c}`A_7|b4+Wu7c$sR`8|i{59qL3A^LzUp=)0&GU?ZD z2?<39`HgQNB4@ogn}v*#f&(R4 zhIF4v_NX@qJ%zgiF0mmwT>d=;q`rsRyFTyz=7IymOt4gazwAny>>;blGe5Xo<8nQ1 z;gF)~QajlH`F!*jI6e;DGdN96c$n5i8srNchJufM`&k4FhImI@0ji8ocqGY#&{S6N zo7E1*4bCH8h2!{6IxVR8w6t1HjJRF0$YiD&+9)VoMjw85LUca%neYnaIpoZDJJHHt z0a4Zz`4%;xdh_3!xpnR=U$q`t)fx&4S?~P;)k?xY<8{*>P814UJmH{3(Z<_wG~^)| z9ae8zQ+A}}5;mki(xWZLDPuuhNUB}DqEPHO(~{Z;k9S)EYv5cBf7`J(qK$F5D(k;fbsiub6SPVJp}7(jXtTt?q|c9NyhX7BPf z59vew$v)MI8j9#>+XDg8AAh zAv{$d!Zx>0?2~%#zCIF;ishL5MP1^c>N);;0B(jMRlT?IG+HXS%Llpx#ZUHCy1jp? ze%3{%jkLgRsOs68y5p>}WhPa5q1zYF`Jq)|eHU|Wd(uU^u-=8!|@Zk%T3f=IiL}dscd-<*DDyeD#KPGuP-x7dz$n_eMd3v+GIDGS!cSR z#>;TI=aJm|J3i8sah#wR1~t-pR=Aj&0?GM~5bl-sqlP-a-2p$fAwqb&tx7aL+`HWK zd0&;{2n*kPucqyTaI0|wKxM(P0y@f&X{DF8@3;=rOtj6hxv(@Kj z$lj#i+#D-qN!C<;r0fR*li``34*AX_nkZk$Npol%`>CNzASAn0_&i8MYT`w0{6|P= z(`^v8KQMhk>t*PXF!C0@90&!V7MuPw|0GY$P05l|^B+QlSD@-b_M5@{uNVV+%u;1dWlh9(k=#lEJVjqeCP*{YfwmzA5_=66=*ys3(9C#4cdqE= z%Q+NM-^pD%OF}|!M|m(Mx&6kDCrWEV4lcU(pIt4RFPwPrpbOftW|qz#_^W|ND5>X; zw~;ZcCN;bj`=yJ}kKiqNF+mL#$bzIFc411H9B zs=v|`7yV;;{`@$Zf!?xzY#^%@$(tO*L9jBk685Xgu%`HgmX~}4RtR?VB}^ff2JJ4s zAcPEBEgAm!&pc89ctYm!Q7o6Og8)YfZlP_9jM`bU^nFYG$Pihp#f$Z_e+Bmx4+=8t zu5hRS4PE(xw6k#+S@yvoV`zP+K$UIhY5aQ9Zt%lDllbcTnCz$bGIWJU<1nx#Zl2I9 zNEkT4v(ytgB*Q|F%O7Mz*FVVu);SvQxyQ^H87B_NsYz$)Pv{27;$D2M^eTV_N+CZ9 zz2{n{9S*nee|fx*6k@PsuGUwjs}n*RH=fZ(rq# z^x$M{=~m&naY}tXE+AXhUkSF(84l_1T!i3xp_&U3yQDbJX;zYgCT#4{`X8M?|L6)` zsxA&%@@I3uLlJfv>`{O^%@swYWMS%@v$MQl_D%NjCFvHDJ$j1TA?MCLzwJ5q3RKoV zjM8b-aTUVyzEH83U{T_J%p)>)-41kspI46*qS4oAa_Tck7*~Z>$cjk)qeD8(Ho ztTEj}+qS9)^QHYE#3KWn^%+_IMpob&hVO?MCs93$6ZIL8Eywo3L30R(OrR(`j;(qU zk8E5tk3+>yo>XU{HZba}U?9pK$tCdGjQ@Oz*vcp{};<&@Ly^gcQp@SjdKb9}@#z~x&oQSF08`-i|xyL*IoeAFR zp=N}%LT1riO~mw`g4JcKON*Z+0|a5@OfIZWEWuss#%uZYo;P@?X%T$r1cStPnANzo zPQJlClNm-UK+#dN;T;8U6h3Ol#T?=S#{))Q**|n8MO$d3OtZc|!H)lJs%pibxT&>? zG+nQMHZ>OMZr`^L4hzyvR2_V(Tg3pqnqR%o zaLH&gT3g#NH8jJ+c{Sw5Ay&gp4=HEbO%(c4lvnjM0Aox5PQa@x^MOvysKV#O`li6U z{<|sUnJ~5Mx$vAiIV1Tk#$-CKWH101sMykOp#I!du3pp$bX|c;O+d?$DU#WsPIANA z5GBDoE7*jDXqVu0Z!*v*tKd!-A2lPM?t+Zeo-H97n$huEmp<`$0sbaslOz8EdjYYA zI(x6m&^;}*yVlZb(KliUKK!3efeZH~9`Bc~)6UQ&mJNYc_#4(9N*?6RpO(>F*}8V? zi{QVTiq^IyDoOBMEb^`=3SH7;?vBLy zd)OcFrmNDRnM5-@EwM6QU!MM|+E&+}iMM8wIEZM{Qb*^N9skpG@bc@j09=XhR{1$z zon#}5qOME$!oQmS$=bY*DDx5C=&d0x$PYZm`k;=}NB$?jiFTXF1WY-G={LD_8Of7G z-Rpi(ee%STm8g_3S^;rb?_N=Gzq(fkf2%rwv*4i=yX}UvdPfC+Ry>hY_ke1RZpWr4 zMPcR>niSc*tralyCs>gdJLEZf&sw1del|f(N@&Z^;sXx#3YA`gXup`FJm5PA>8B|^ zFglu6xK(@xKPb3tV>;>{DuEM%7jJkL&ovC!F$j$m$D0UDt8d3$f^L}Yd20IxzkL+iILm#%DD!# zqh>Y}$H5V%?&b^X6aShh9Jsk~p}B@;kdKDK0=WK^fSJxWo*Az&gH{ zkAd$;!%fhlKO#e~RpfAMeTh#U96kvA4gT`*?{jWZ5|_C0GCXTZX7+Co5{sX5`*Q*j zzTT2n$h}LOM}@V)At8_}B1LE|_`ek4xnV-w7}y)xe>MjBs$s%)hzmrRwV8?yjg`0P zM4DtKd!rb{AV`2<^jMzAI|-UWt!Fe5h9hpwTCC{!|2CH7W^c2r64Cj+5b)@K&i^#V^n-3Q2)T#Kl}f3aR)PR9_$Y?rA1M~x9d+;wu83@qvazt9 zcn~TH^zEQknOx`m5H`njqE>Z7fbj2RPL|CX8O_$mkH3T zQ8R5C=z81Am*T8opYwdK zk1@#|R*>y}-p1s#SQE7*e7*co$<;Unow)uuWyLHTeQnJt(_=FWb_3caa3nxx?daj)KL`+2oF>v3%`jr4K4dl_(Pou|$L-1L| zBWu+ZXG)P^C&d*M0!BKuCzs2!rbPa?t9w%2)hD$|GUr48JuA+^?#JeOyWA(C%0mCY zExmo?A~Bx^$rz}4F#I#iM17jBP@sQ>V7l9Dng4AGNj^v#+h&wTT1A0cc_SzVgLpFO4_dcY9Z4Z92l!$&{&gC3eUT?jji7C3bK)`TyJAKu8j8um7j08D76rv>(o31^Sbe}r_6De=%6 z5IxL0iSp;NnfY!_7PD6ku5Xpov2Akdvpm`38dt@- z58$x(+tZp*h3QT%9h{M)QYQ~94UQ&56H1B5OoLcGUX7KH?g^f4dbq7qKG624b>)J1P_%-OaP2>T z{wNOIwaheGm-M6ie5V z6bjP+wFP;|AS9Km>QEWJnTHH#n*R|n5(t9|07(>XO-cDzF`C>Y8+XMZ63a=kq%`0jr>YJd-0-l=4_$^PS*t9y== z^u$%70MYmb7;5G-EZ3+Dul6ZzW+dKG26W5^eLM0P|LJ_{dwbveB)MNj`afgLMej^P z2KN8C@YBT!dk;Zj3II7<62@3#q=`ld<0FvHFTf@e&_Nl7v>El0(He;20)1MMA@gsR zY^2y}H$qEDOqcZ(D!zZ|FD0JErt0;N=tP|dLXd?as5@6pc@kWhS_5gCFy6o0%djKA zR2fMt+zJ)NO(Ex0F3Y-$a{^FHRFV>4d83C~?_1Jrn!3)0JyCTsC%shk-shxYWN!1u>#sY|?A|JdbFd-fwv{+^gfZTA0SNHoKdyaQw z?x1#ct_*XBB&d?Z3rs5qX?GN8YEfuWP54s(F}P;o!o9K(R@{9!WLkmf`c!D2$vm+G z>X$WgEn6!j5BZ?Z)T4O)C9x>m_aIbk>(&O<1^2Un;Jbvm^&;e-k{mhKsG)@>^3yq{ zJ-TbM|Cnlsj$o zS+8!qqp;g>ZJaMm_EYJX3=p!nxgC)~QG(bx^u%9ksv9kRyR`G6BC3o!B}IyAY6FH3 z2Jqz1SIBnuK*UyJ27wwW8ODkMY;I?MY4E;Rb129PA^jO23^v~nfTnxVc?iG_olBAR z;oXN;PhYuh@4;fMft20+=vDVK&=o-AMF7pZY05hM7x=JlnlSeT%Itd_yylRH7-?(L zI2SWLvw%wWOv3wp#3C>8g}4njj8W{CJcU$p4ZoI^7X4;9fntChf2#bE_{+y}-2%?v z_l90TEHA^z_Mr{4iT0!_$sP7q+yRHBzj}vg1W9@rz%`L??{N}Jv5t3t?)Z16W!o|3 z6R^C)Ip#NrMN=MDP^Zvy3a_sr`D0|z{7@J#Z_ADb5}pmsQ~(J+WTprRD~WPkMgrc9 zPzpAr8q)%+!$-u+E}td|P(>ft)*3f^V0H)@F^LhLvn$Z>k;*J`1aR|FaixgKr=TP zHWQyIoQUm4-~^T)KKag8fE#Ougifl#B@;Co9OObxo>sC?j73H8s=AnyB>0YM84BMB zp1|F)<;~CHo$v{w&54@I78{R+ULZhMCtQ2Cv4q@%1;R(vt|@LncC4Z++3U+z1D|$6&UW3E zV8hW}1}mxwN9sSW$hp1*m_E$)ZoO|%Gp2ALK45S@*f9KqM)T=2HhO@e>PNIwEAxWT_Mjm%Q zHU%_F{Y_d)3JVhA@8=exY+Btv4t`fXsr2CbJ%R5tlLb9L9cGTYbNdpZ)ZW9dO>pXH z$Wz$eH8Q$eT)5iBCDJCzr=}SQumtQXK&em<6I%IG?u9D~2 zwf8ZpDlVJbdPQt{PNR!OpaMEcNY+s5IE!{a-X0O}&NFhuetsIq^83go(t&+M-#yeFWj|}T0zF!(S_c51=nV#* zM^7(V{VX9cy!^P9F%Yy`Ds06kisQK3WldkK=&gZ)2x#SoKr#iyml96rK)v1YN!0ap zXSa`bXWRaUtbUZskTJ9i@Tjn!6i#MX;to;Dg=tds4S#S5W`2u^&of!Qn2aPhw(6j2 z?Cf!~3I~hR4Qmr0fb@nsOuV0dl*54EDN&?urg`hSkA<=m|N;-iQ z(^yb|ZMK@OIrGU-=YX5kaI)-3~rj0c7Klk06Lsi>1IBh}w$AhCS0c=*-&M+kuN zolYy)BkT03RJ=rEMi6mp2-5J~M>=O>j2ts#GP;N$ed8qJfIW;DN+uDJhBbgRbT6OQ z3^(8AOZ^a@eqJ)pCI2%kZ$MEZxfi6JQop!vol%HjJ7f2HgX&l#j`|idPs! ze>jx@t~YJ`dh57E7H{(-|IL)WvJv!TAN`(&f;U-WY9g;e4m@iRv?e8!@~_*7LY-~V z%pT#ib|a$tHk>lx){_Fqql|JeyP%*mQ{*3mJqhx=!4P5n2%!>S8{z#igKz~r`pCFW z7Yb>;xO=`LpSP{G%j{X-mKJR5XAh-B5K^%naO5Q~@BcLEwpHDesa!p#7b-rt9vlj8 zn~rE25pYL+0}J{}U9ao{1~FMd`PsUVE{QNMB_ov;DUN3LerL?F+>H|^f3kCgeu!4y z0A^aCRbcVN|7;|;EeY=wf+jDD-<$Ppz$#uBS*sb1QYXBdl}s#FiZ^hcqJ9Xw1Wxd801v;J9hNV&|!pclv+Pv1Djj>&4V$VIMq{A$U~W z{+Y}1^EZIS*p@_lbx%Pl;tGFZ0m;xDUq>ueMzO8<`?%%h6tl^C0oFJk*`2!57d743 z*&}JEyXq^flihM#!9r3U_GW}PsB4~{P$MeM| zfNA3GU{EE6uk8E;|H`Srk;c5>3q@m|oYa805x6$H<7Sf?bfBcUn@3I|9p3r_p_u}&s zX6a7f1!2Q6q)o0!hUqkp0OKnTU>AKUcR{mPnWp_jG0=9zXvKSzye0+9F|*b%!gZLH z8JGpObwYUA3`xXPQ+*S4b)+@&*|_?l<#b3aX>LJN!-U=Z3nmlCg$);>#vFC)n~V|* zf;*kq8RC8oVK=CqOWEz-`unk(El_;qC6CaastTv+9Y) zwQzbQY$q-eSW}3Y^t}6VB>(4&8HLjAd_a`o3P21co1Iv{y`lnJLF~9WP6TFlQ;E&% z_ns<`*s{B%w^-dD%>)&Bk-|Fjdm!Z-f$d8%YbfkgW}d0x*c(2zi&QoEU~AxrRea_Dz7 zEAEGQBSmqK{C$#vOhSW!4S8;%GYGIZYIA0gwpzthXp7Tn18V=*L; z7DonnwY0*MF$gy7sJ?Rr9XOdpa_GgX|8u!6{B_y$@fuLB7^M}1tt~w|C=umfOs-rt z5vvG+hE5>M0Td1RURDkLT4;s>%#W+!IKiR0Ot*^ph(_#MJgJ|SHxt-)2z2IS(=qz< z*dlu-_$V0Cf!IiienbzQYITL(-4)hp-#E7RNgYvH3JD?f-WZ$aymiRHml4SD>*3zK ztQK6jLw4%0!Q-WsL(89l$YA|c)&(iAPssZcv6ETOE^+Or@1bN(!(}wMwITSpBW8N~ zj^XNR`GC8(T-hYpZ6MxI&K~w8Ns?V4b7_9I((8sqA>@*t`7#;KqbZi9K$qRHEb2gV z-mOvR4_%H(BSmw{rcDpYMqZQjPVfQjxkRRpXSV$xk^V{uF3ibL$(WMzN$A7tgZ4cL z(^cOTZCXrjs^vRX;h~B3&bBcnGb>@df_I?_6>{lHywvjQ2$XcDq;jLjvF@Nk?nDo1 zp>f=q(8Jx<+9DSXp9nIr6SJ`}TyI8QgJYcAb8r=h)j??nuV{=pI87Y*Y;CTb+5$bq z8_mrE$AFHhLax4J2+0(#OK2IO{z{zG@>)n4b-+D>ynGV85j(LNaeW*ueSu4xI&s+A z)gO;38TBfmRW|^7WtnchQkSGeDbl5A))Rnw}HN%yQIalGLC zgjdr6EF8?=X#u5_5ZTfA6>c$QtHG~LMMXb&<8fl{JLB@FwixD^u`}UnxzNRpUjt0s zoJYg_9`qw>gkEK$klkSsiTQkKsgRGHA>&oHZ@*$WmONv2B0U4ULmsycR}SyTX@+6bbc4)KqN9|33FxeHfK*2xIyxstOz%l&^#WR%mGi# zscHu7*Y&($ISh^$KEy_n-D9`(Tx^`2IhaUIfh=S=4wu2Fr|hWaS$gT6^#afcAi(60 ztuW-%5jWmp?I2QCGCgVgM17M>qlpXv0p;c=^6@d6rB64u2t5jOQrKlS96Q5B+ei- z*c_jKs;ayQ2q(k5C?E&fIGG~s?-8=$$a>Fiu^ZD163jDkT|0W9h1mlv%E}(!;v+f-7Zj@RI-1;XK95{!??rwF5ewP2zVgLj*-l0 zdb|qC_vB6NCIJsS57aYOyp9`Yn4O|>ANM-p@$|-!_oaJyPPja7*}-cHEF8GDaXYdY z&0$3ka6R13x@jbJgttHBv|o5>PqfQfx#p+kB73%nBX0gUXbN;g-(8LMC!FGIr=fz6 zO~&wSQWd>Il}V&U7rvd1baqi5Rd_r74w{l5gKLre@!5j|ygO7j_3L=0=1Y;5lM|w} zBaS5R-cJX)(fW_?B@eh}!Zm;rq@ba?jPyNV&}*^zD0;>ldjaj9-xo1cGSw*tHLnW_ z+`CAZ;1$9wb2TMR4tbtlTA%eV(ZU6zA7u-~VUAV!uwnQ_`}#hyU(n8y!-bF{O{j84 zpE|6gpPhn17-hg&V_x5(#tBh0m4yw%WlkP^Gu{Qb$gr1T*EY_EB904~r1bt6OQ2c< zm-6XH1WbX61I$_LMXm@Md09ff|Kaq(kK+c0O(BXIR2zK`TrqgT!PO>lAmV^ddV%!~ zUWE;MUq15?Hpu8MniI`b?ouwcZ1-6#=t*4EJJNjY>^9JM0NrF((P?rOQ%rQ`; zcU*_0f!7H7w=$wz%U!IY!`mr^dy~3~7L~h)y9|<&ijQU}O5jejTky-H(6*pP{Rwt# zxG4k|pNovN1iH^!UTd7pCaFsd9_aG|LhXTsB|p~Hn*qMTAOot;kUYeP;y|A3c0<7E za}ed(y$X$r3aXbjdAc4^JK7A?RFGGmA<`1MI2S!m%4GpA87OT>JgW_a8aI+78F{|L zv)f?l&QGtz+3=!Io}~9dn5@y<PR=B*RgSh- z=@{H5b@J&59y4APo>A7TP@Z3DFwBK=0Q?{~Ncqy$S!xtNZPJRZ%S7Y`>y^E$r9TEC z0VF2*02Fakyd(i(y#n?-LHkHDp!~Uw+;;6VzSsq{MR|w85`)9zOD}+N->t+o7tx>f z70;kn$7EjEnf{&~`K(_L-4oEAV+!_3_+pzK#asECakJ>(V2NXtp@q0c&M*kDrJ z6sAU~A6h|@z!PV)R;Rn62krtDA0G<6AA+vdZEA9~T#vE8H9JO_cRvR#a;}iNI`YM1 zIw4j8D;rgIsl*Xo;~ip5$92Jc_WOH^g`Fjq~d_D zDV{5l1x^+rHOPsR@WGCNoPHg4E#qcif%d@fz;;0aIeGp+m5E4}JI&05x>cSajnTi4a({ z>F?>mCow$6P3=H<>2L8@AsG?E%kmIh)sfX88Gqd$y_9d|K}a$ahcCtsp>hS^76CEY zCGi<5aml%$1kJil>e+arxtdYFqEuiyns3RRrRnDf3}me1)7a;#CBYHh^PBA zc1zM=ob|^K1Orfy z_*@}Z_Nrm+=Li346_w*av51h7GWNKf#66)bDP4?z^}v@fxcpi0gO$1V5eZT$v)%|Q z#TrZM1+R{F0VU2&o5F+20BnVuUuAG)lIF&JJno8%poLU%k`v6ETi0eO9r&D-O6Kxf zha8RqH>iV;NBXRlxk*y;Ubu!x`v}#fL==`6IEhab5LsNo<=s3}k`SId4OB=(tA)Le z*7$9B&=rVSSIn3s>!0$R4&R0g139avJkg@0=K@AC%)ykyQT7*c@wYcQqS;Xn%Ec-8 zQ11E5WzS!->+|nIy+JPDoAN}u8{6?SdnliHf?Ocb z2~}J2Y}?AuX^DV)?m#T;87xhffRtTY=o_w(o~JTY(8isBKMrdKt@_xgpXetL`Um*5 zRKb0J$)=3LUPd9rK7=cmaYJi28t%2l9AHx4Ke(w`9QDnO{f!qf&uO8*sahkv!47Ci zpMjWv@UR|6U1HF3GrEAId+<8J3iNr=X)nngZHG@c?-6cg;HU>IAt38d#VR0sz5sh> zuReMMMTVJg3Vvmp)^-{=s{r$qgC7?4+qlE^#<&yui5}1lLAG1IBDlzGQTS4N>}R0a zMEK-{H05rhqmCRieJu5RSq<0t6Y6{?U*C)-eSY9Z0Fp#!6y1M1WtQ6|kUI>7@prp8 zqzwUD2lVKGd>XKbQ$TY<##nioWGNFUp+_BWtkt9iN;csP_GWI~WB zWVHu_7J=pMfbOwP4p~1&#~UsD2?Z#!XagJTZydH@yS^ZWd&6^ZXwtxk?1T(UaXYaB z4G2`+f#=tq_;%DKYG~JeLX)nAgZI7gOPj-ByL2GzFmJy27QLU#W+ZO)qtanu5VsqS z-KkOijkMn$H1MzndVZ`;2QG-Bf<;kZsIbEmQa$mB&=HkHJcM$7ha{h$0z~{7{~pK! zt=~U7G&uAVg$%sMEC=I`($}(qLV~#xD11cu6gXVZ6xB7Asg{0UV4F9G@@`N@lC@g- znGHNVmpt|qnM|t6~g|<=hsfU4;Ti= z>;2YWZ+;}E56)j40D83sxWpIp@3L~LlpsC4NRsDTVhAB|26)z1IOpgMc{oYwRzGUM z-=$7we0Q=3;>}=(gS@XqYazPx1X(fgrG!y5u_1Ax-y!Mevq&tS{LqCoGcbcgy)q&9 z8kvE?qGRuHzcG9>5LD`7sb>$TN+yEK@rPk8a9#SB2AK3XLEqQoonc0Rheut0qlJSK z1r#DR983;E_qz!gOCDVvUz$pOB;foQ#HLgXI0!dI>#+xS*1s~wQcnTk06TrDF_fK7 z7ApAb>TNc^enp@`0scD8NL7XV*sG{N4$6Xe58l?f1Vy-fs?-oKl2X`HL5+PJWA06r z)>d9HRwWAI9uKIKdSQ_*TZnQj6t0mcsVf(yJHcdptr`kSf7Cy0d`Dv&?i$(bi;hl@ z`9ZH>Gw(!?xwol){Er)fmuRDg&xRtSQ2cQ!d!q0Iu8!X|^IqE~@4QMr0((F9j6nb) z11;k11&han@QY5OE(T*Iap}?N2%Y4_H}-j4Zt$o+q+-ha3j9eSKp4KE^pB^qNuYfB ztTsNk{EDht;ByEp)j?t@I@(S&Nt#A|pB(ldk3~!U0eifZ{=iwcapk}E-ZUKQHvAv1 zX%xeeEmXt^5k*w?Wm*+k+EBKH6k*7|HYJimDU!8SC1l^1P_l%QeI42NeP5pQno+;* z|L=MC9MALOIl5onnVIkRTF&cSKIi8=uQlP^f%qsCG??Gw=t5BXgAXtFSP2mD_dw}A zRw)l6Xd&&Cz%|`{yh7+x6;~cP?n5dOx_(i9A1y?3tk22*GVB7cl;AIs~aKxdM@k6@g$Zy}$gagED5WIwI#a^sS70jG%l?FIRVDLh< zqUhz??o-hrm=an4pAN@A`Mf{=YSphXeKrXz`a8tiA~cq~tzPPK8lA_LVe7!~5!v&X zLb(7O`JJq079w=ic5Bc?#cqGR60RRaFBAYrk1A%l>~GzjF5KQ2)=`oN4X6z`KHY(9 z!azX%+SX49j+G*AS-;fK{!hxW$6t9ud1&N-{CMfy%I^Yrm^kXzCo>@O;Hmkos7B9X z4s*}juii??0De%0#3rwpgo zD#xk8%zav`b+~^WCJ`+A;#=WB0z78J=EW>I6nbspW88;Kka&?);7LA+Gy8Y zBJ_+&krE(6l{|LE6Si(Os&JK;(6PD&S``Hu-nFQHJP&#OC8gHoO~2JzD+YQ%<{dIV zHD3#ZPkTEozy(wmOLYIUMCbu*xmmPerq0H0y;NNOUaK{)|?-_=CFI$7p}9$PVl{ zo8O*s0p7hj9!r$-6M76C(rMAFQ^tPm(hRr>($cq17C?-_cm8Yk0Jxf-7bX|IHw%Aa zT>bXKXQyLG3mwy2L|^kbBFIDw9mdLj0(^?)Dcm07F>L+t=ZfgbjQB_UsEZ8>5}4cO z`SGGrF2+YET{|mwsk)Q0}Tt_)>j)%y_iX^=hAtWFF&$I0^dmoRkI}_ zR}b1rx?0rIKisYo4`H_oO#5_FrGTb0s&qm9O}+i)J~8G)<`zm?welYFuN95|+zsi@ zK4@~d&5dY&bwT^S{3w)%%a(T`*Mgc+L`XDr@o_sM$nBF4(a=)24Ybxpx|!)nN9p|R z(`Va-Q9Y3COh1<;KY;eRUvcqTAQVwNI*{pbfw+^$X5C`XS ze)dfzz)i7D^@cw$>`I4tb*=3uC?M1UxvuZK;M_c_ng#r=_B_ATT13mn_SW5^4$P$L zn9;lM{Q=;~A8S^=2yq&UX=(bnPe!YNuh02mna=2COjJj2I}pm@jGTLC`J1ozQw)4@ z)T{1O$*bcrp1AE|F3IAN+ zz{y}!UCEK$%X-AoT#gG#Sxc>%Ibt>i4UgO^!xda3t4fp_e#j)(yVOPQcMa~XIMpsI z8h3#Yx;qH(iN}v7RCa!Jn$3Ct z%!9@d|3q$CZWnIqf!Cu`+MJ+p>DOCkhzTv-Sx3sFuV|3XYbnP!=Nq+Dg*7qG=ALL< ziwR%tB)%Ok=nz**k`+!bc%h$sHdJB)h&Jr-YaLrXGL0lW6hlT2|g&YmG@inP%XVr1M^!Zq-8RY@5kL8c*l5&tABgkIuEteS34w)-@lK!`5 zF>YsvOzmT7p3PpWO|rVKr?-l&p?8m%u8v$?sGT#sNDpI3%DS;RZAA5Q*$IGJ`d|z% zM0{`3c3td9D327GE&MujyC9jKyJA|NnR){>zIqe1Hfk~DeM~CY6l*Ye#6Ac0$5ddh z_8#mu;cZS=)Ts+rEJ34Wh_ z`BQ@@U;JRvAx~$SVPNA7X*EHF-sjB!TG_Ve5ra)pMwC>lRAdgn!CIWxbphWJGxRJ` zDQ%*Z&>mqfAbAGdtM*oLiKOsgRnB zP<3nTbaTJd#TgU4=6Uyv83P}E?8hZQD5lg1oblFHZO3jFoP=9F#$y?@RK002JnGXu#sn&^;#PVI{dPx*L7#Z~PF7Q&b@u zWSJexd*cJ$wvo(}B5A#>x1Ot=5}7+A7&cX;@922Ivj61i9CT4d%+6?>qp(XGB!hji zE3-8v$rmKInT|c3oJk#0JT1PocG=q3u!72-xZ4By))7Gu2pI$WtXYpjhs&-r1WwTq zQ`Q5}3DYZPlb+1Nrp6E9_a&}RJQ>!v%zV1_cSB)y;p!jGU1`1>J`j_bGvdihb(O(E z?4Rk;nHaz{5o4^b(nB6Rt{?-)W18$Fp~B?kLB5+1=ViF&F=nzjT^?x-mI{Re0a-=u zG@R9<;-sC%Hw+elT zkd%rqFa621Ydticx(bb_j>$0H)x*18kSOmy_o)Oo`>VM%M`2<&ul(AJGcdZ0)?Cs9 z*))a~CZQ{_s*$o*yi2I$z?7xhTZHw)Hx~Su80mK0;vS)7J+p)@v{4 z#y*pKX0?*x8EoNwE5LsG>EtbE?l<0B0b)>wnMYhK^CDDW>@C`N&&i7Ynu>bn=~*#( zXf3H-5Q5DLa8Qz6oVm}zK*M8I_~xPE`&*t6T*5^VO~h{YGA2^dJ?Z6(~=r!3SVw`|6W66 z?v_~jR8f%l73-+2iz!Uh%j=;POW&(+(-%Zp?z07-v|!vLH4U2`m)X*bcrGqsoZZR(6Vy! zlE&(zhwTjQ7=KrTyKuLAF-;0|!}~ZzTfBR$$80rXxv=~$kM#%N8;W|3>$+K`eYM3ctd=5%a1lbyej-b-%$m<%5lTyZj36r8p#9qV1?4#Hqtxw5<1 zqCMQ*2?xTs`IFO?TPLW7ff-v^*1O;xb-~9(Y@btwv)Zta-@X!P{Xe;ELtYWVRT z(flsDb9&K>S7(=Nyw8~&x>60j`QBt_$9CQztfOw4Gil7^rq7kO>%*s+Q92-a2^)l8 zkCA~hUVb{!O9ih+8deKyd7H5__Q$?H5x=MtH?&Hr+g8j!Hgv1~{D6+(n9U~tg^|4A zR`G8%i4ecr!QQ>7S~t&n_fWLMw=fz*KCOMr0b2RYMO;i9D89sr^Bu$8V&}#PhGWl5 ztUsKzHz@U6M+yfK?@l2W?h1TNm^1HcJsU4NCy{ujU;BL2Od^~4nZ+Ozv}pL9q^#7@ za|2A)EzJ9^?_Cw9MTU4)FdApJ6MWY@1;JmYIRfOHT@rUfPMDYE z8#eIXeBpdohgEg?KxHGSz2}YmY#1yHSaQ`@fj^)!0U7vYlMjyz;3V&DIw(iFz)wS6 zZr_4%NWXoM$vva&@XPSct_d!yT>lce*n=Q(0=`xb+`S%7Es*Xwv=CxpfVp5#4Scz}z)TvSbdR{SOHwsW}rWvXY? zNY8b()wQOCLu;nNatb8kilGZ1vJl$v``pe6;0Q~w&}yjdkn9$YEiD7(Rxg>#Q~9>b zo0sBQWwOzR1p3gIin#uiT)4g8+eOygYL=J8DijFoK)Sd0JZ7Gyp)F;%d|%nKq$JGq zZ7#1~?l#=7oI({ORT6Q0E}^w9Evry_+)#1A)iq$KENSEmlz9=_VG|a5dH~=v;oax3 zyy=PM;cW`EUb;Kd?YK){w0)sE^UkbS&8>58{OD$9VB>h2WqQ4>$KMIy=eO|wL-b;n z7-#0WgbV3fZbpJPH@(4K8@^sz9?nb+(Y_v!&U|^Tp-Uu=RakVaD`zq3UB>DE`Xi4| zU-AT3cAzS5ZbE$>*+axKBF^+fiW}m2JR1??jbBrR13-na|{I3H+ry zx(;9JNed9kD`X`wIbH49OYw^KuX#nLY_tj)i!r!F`L`K_^V8S-9KMNK#94;JQGCq? z9ztA99Hb%GNlJU?EI-#fV`wpaSK7LsWh9-l;Y1EOX^A$)?m)ZL^hNsHTY)vPbkt*) z{|S)KF^%<>(v$E7F4_aBJlsEs9t^Px;tWw9w-<}MFGVp^?*DkKjQ?pQjJ^qaFUII|h+>6|Y%Hnj3wo`$+#ZTA zz5M}unW+x~t!Epex-U1;BIaNTD54#)o|fm@_IjOju9y$ z03B%_SZ=b4vI{jO@MA{f+)`h4r;5WFG2sV`%ba2aYQdi5AMf9ODsShb&r$mh?|s(9 zsge63jq2HVa!5C1t%6(0wamvnH$26eot@noCAkv-fC6nWntA4(f>1#s^6}-haxhy* zldxO9>jq(F1PGxsR#Z%f(!JQFH4de0cbfOcLK0-<`WC`haMTX%3UbU7LGXnvOq34@4(L0EsziA2#Vcj)xsTlTxR zGM%~_CtIXtUg#f%=R!bcLF(5nnNCos5myiLL;p7!yY5{@57&mx%qw#S z_tb`VPwW16TbcK%wzO}+VdllEJiH>-7KV&Na`JgDgM3#Pu25f}T?ARBHCdhXh% z)1%7b$FT5l5)0U;C$vA{hU~ZDgxT*_QoepS9;^)A+633Wibx&2PYo8;MXTFtXNp_0 zf5|^$mwzAA$}-Y5SuX-8VJNI&C2kkoD&sFg%vi3T#wkHecd&9wxgzJ?>zDHx=O>R) z1WMC}^wBHBv&r6u`v?qSFRQ3|zxoJBb$h*3g zaN(tzl3r}a^q99;ZMhQFSkur*a_Jp(st9-VQDD_s2L(npv9=F3kEZL zvtU2HH-}r}cFP6rpHbPD+hf?CvU*cdJVR!k9M=(acwMXaI9*EEdHi@ob;fK&Q z1WIWS-7M(E#6|2)SI@}k@TvjCCyim@@i33`YWd)9oem8(qTYA}(M)r>A;2Lt!+CX1l>BBh_8UyQe0!5+ZPL&4)8=5!PJG95nU+?Ny$|oLG)>gI=d|QFmA({mP zrbDALTWaEn$-^T0Rqb?QZ-vS!oH1Biyc`JT(1!;=zX(Q$Kj|xd*-k6iDz!;c8~|8^ceGsSjh6h(8_Ex!azS zU+qK02jShY87JM1S@D6Sf}eYh`3&80VzfDFQ~mKH@eDn;d6A}z#$(7A2x5C&iVsQJ zlE!qr0d!$AQCA59qjQMBS$O~!)SV<1tjIaP{hZUGj!)Z;D5UT%=brY4z503-FCR#5 zdsi==^F?f|txS7=DDy_}We9sfyCt4G479Ar8qwL=7R41|orb>m#=LEm+KE@~=daw_ zONmaIv09^s4#N#m((mB`a7O+1@pc1VOfm**<6k@Gh`~N$lWy_o`(l%S-%~-j5WLsO zM0>X+*3*~KnS#6Nz=#fBfWJ?#mZOK?v)__|LE;BHr+14{?Q zl%;Iy;+;hjw+Zcl!ABs@!?Xy~|gyfx2K}rrwD4<~O zL9NxskdPvmyOVb`xOZ0_{fL^4b{&E9#ADAQupT3@1p-%aKHqcg)w#1U5fflH-X*%B~GUK!0>>c7O-u9~^gh`CFHW zgOqjEcsMKNmaNC;F1gmcG1SQUIWDe@k#cu4I_qkD(v0)~gdOh*A~7Eu3I%LJz9<1A z7Aq&H?5F+QJLdh~2AP-qwdu@gE54=@oO&MJcFJSlh;&!(wHxtf5go9dnk;avAMI-b z(pKh{r}@SgowT&`v=V6o(!kmw5^dEM@P*I3eF4?deaVE@CP&-!U^Ze#a>b{*Wp~jmDNrE*o6yW~H`wBXuw zLlD_r^_cLFXcV?+6hTdRh)7wT`fHTBtYkzwJ{fzYIL)?%s~x1!zYBKLRy2zbmwi_v zVk;sF+JhB5ai+6cFtAs7f;k=@#(6WH38A#)5kwS)u;7*O(xwAtBtONPZnbXsMdK}ZWH61fyOAV0dFK%;gA z_J-P=;Q{g9Zkq=pJ*1a;a>j#m+#yZ$NZaD2FszafxHM-im9yk=4AR19Q*o8PeUQmqM-{2x4m-rHsRYRJ$0` zDm@b7Zz02$0nQFID8J|a$QK20Y=95MGUXW2G2K0ncU%3e7JVaYgwe?7wde4&^cI|K zU8|}dI?cWWC#xT>B8Jn3m**9j3^i-4>(YD$cPATyK8h}Y$?w?{|2f6EH0=Mer<`=MJ5+n`| zg=d4upoPT^&Ry2=0oO0mQK&+BT9<~r8RZ}Fj{1z|i@J_j&<}B-^FM~p$1Y%1WBvJ< z^0rL&4K+{ZZD(I)y)kNaUCt>Svq)hJALS!P+mAxiz8e)~*#-M2d5CB4UY!vpfx1h8 z-ONd4h8rE8u+avza=|&zN$~xw1kM6jnbVD#CU)q6&B>C8Jc;0#7kn2U#V}URombW_ zsXyNc@i|1xe=;`UhOkTjbhrd|FDK#tXCAD<%2Xnt%wil3`RJR`wwP}_)T%`1B5t3< zVA3^m4xCH2JzM$}-taXDMiTj600cgXqv3l>H^`O1$D_f84}N(h+EpzL#RM`_UKWcX z%XWk7?RZ^`Ex~$Ok-L&wl>xsK7_f;KOhr#M~Er zg8h3u&)2uZ(h=~wq&G8PdfEMnCsdAfy#KzMn0xJP+WxOs(O}YHFnNQ5E-)BoojmLB zHy^gE7=Pa5H?}$h0b<#eo~@Ki#r&ZMfV*vmX$;@#?HKa&u0h6l`Lw(hb>#C1Li8xN z`ymHfpePKzW95*c>y_<;S1w>ltMgstH#0@Mq>$P%;j3a~3~BU?KGkYFX*`JJ034$VOCBFI@6*s=&4tCYK zAo;=PXJtu9<2X~YC$o=Zcj*0Kox4i8+ELa!6~~4$F9tuezy`WhME&=kPZF-TlxPf2y$)5Pt-uoPtAQdMg!-HVX$R z{DogRu0M2*%7thdc6fgJp)koB_2~zMp@ePNLd(Sj>$%V)Cm&(RbiYiWN=O1aODY5> znJvBxy8lF7a29aLEtK=E6bM$Z*0SB*)(9ODTr z)i6eFq3|0(`!fXMfMJ(}AvgP>7T9D{$4_TD&v}kCO!G*OpK#a|4D0)v34F&7`jb5c zry-lb%SWDy3U{;);nv&jz}}4P3uub{IJDg=$dkg(=-m#bisyV3d zoiA=ro5E-?9f!;r{ylKTPWIuLgWu;x(7h1n2%s}Dec;sN#Yxq^oQlidULhT4V&5wc zYtVae=Gi`J`1u4eQ5W`n?EUI5*wZ$=?qOQN%VcZD^p3ts{&5O*W$r!rHri@S=)~o+ zU+tH-ZU1ReW8hal0=Y;?5B7V#s?YY30?`R3WbhU#Y2`^=>PqM0_yJ@^3ixtO&7ct} zg9+G|CkZ5A)1NpJ4UrQVp_tsAA^J=ikOPbwi46Mk>In^u#zkbGb;(Zv*$T;cXYeu@ za2$)X4lYg<23Ghv2<~4UH9$5x5(h|29+<1HkRBEW4B0>iBKm2&D^BQ2hY7KdnKt?v z@@2fyv>3)yoIjcxAFaxWpdh9g5>Xt+=ZnGl_n_IF&VzHD5-Z%U?+>XcH~Z4F&pYQM z;&&qZs)2=EtEbKPmmGEBBSHDJm|6AQT`lG>1zC$MkWPtagekcbCfVVk;U}UKhYKuO zH*GO`En0%#_jYA5)uPR|D1&vF#RG~wtY`}3KD8N6hY-z9@yyXMZw1xMw?i#6;v)vV zYBShsTTOmmNcPB)jv#!->Dr;-p&tyG{Ozmd7n*nVSiQiZs6vqGX_E64O2>ZXQ0|D_ zeLHNrL;a)b92?A8g%_N8+%Y6P1=`r{&70d~`X@R+w3=?mjzl@M4lI}FNpLJ7Z6(91 zljr#TW2yGSC9%f@X|FpzYTei0;1C5<2IBs5qwij)P+ka-pNKD82Doz;RSs+r^g zRV^SGbnYpf^f@Wg-Uov`VUuAm-0jL8=cYL2gUIbO*i|IEjmY;nZczl^lXf}Ka;ZD= z-R-zhzg^Y&GxtN-mpweox#gg^0XwntW480+B)ziJ<|E%X>+rS%Hf}z6{ag7_HUt?? zh=N9(#odF_P)L3K`Z5wF`RZo5%Wgx7i7-#ynH=SJU-JC!1rW$Ih0CYF6Y2u!d%i_9 z8u7<*jGaPD>g&*S8{tTsnpr~b1Si6j*EimA-;j-HBi4;4g2A}c%dn87VdUuP%X$}b z&H<|t-D3I!hu+q<3-zoYoJ}4b>N5{;zIX2dJg6TY^jiDuHfB82OTt`M$&vlmqCLWf zb%#2@emyW)HGly0e)8E<;IL@m_12wF?)e5#<}|au4luIXS{qw0X3-Y8^|g%Klle{mkX^k+7o8wX8QQ1)xz_S_L306TpHx_8pcA6#95 z(2TY>CJ;n0FbA~lgg`KUJ%*XiYo*-y#)$Almf^^u4oJ>CXdZibMenHV8%^3RNAL$a zAW1t5`Sh97dPI^LhkQfaChhyV2El-^paWra+6xXu8HTJBRWy;_A-L`bBj(6yXKO_c%Ocpe|1iyal%<7AMp3Ul41&3=M-Sv%gYDc!Y#3El+kT$+F^^u-*s4 zl>kg03Dh6YJ+lt3e3{GN*dlkkB)pd|1OQssdB1n+_Rh%r7lYH}{O&Q7UY}6w7!_Hm z-@TqxMH6o!?OCxfThwT4o~)+`E2oZ^-+mQRZwEWLt}1f81$dysr|g?D9|{%=DESm& zbT%(z$RdZ&A6yRSWt!8&hwt@FS$NRn|K{Ge6B{7d^&&t%D?h=h8yxVlewB_JBzg<= zsE^l7Sdw*FKxn_Br0IyN5XhkI-hJ0@xa)AqY2e516o9f`9!%N9(uPQRv{qnJ0uMVyGFik|mgX65Q?#YDsml(k6}2p^6eli(uyfX$;NYz4sF25Lk6GJxfQ;+P94?O}~bMUw+U?E$0_Q zu1K=sj-oU1KNJvjNp|e4SoVt*yN~7R#?!bx}+#i9$tLQ1r;zfscNt>IK zn?UJhxc!_pFkFaHPZaNwh6D%fm-dyTKJa3Q&CbkWBVODH8$o8 zjDcgVe?Y$}x2g`#nC3-T^&c)x$nQ|WSAVZv`MIijVuU8U@$YOM$9LvgsA|?0-lP}I=-oHg) z1no9vpt~>y@bAvhfJ-~ zaHGm^u|ASn)GxlT;vn334iP+<*7%q+25?gr=^m|Da2bfPga08&Ox-S7>Vw4Rh(c2A z&Y-$z`063NeEkGaj2}9AhoaLlWbw`5QW;myl#2QfeqQN$jZK1_R{pmJ*_G#^=}t?Bt(7`+6loc_Z?t7? z5J`$iK8}(Gq_Ysb$q6W0qsUegofAgD?$2(EL*{kDjN1FlR0lmX)RTT@t9}~aVmTH%&j=1$I#=>fNjfHJXqDnve=A~t;jNW;0n zY#f)PG6hL4MsPPOLxDMa(t)47IlawsskmZ~Hv?2+$fDj;$-W zEaXqS1sW|aUx9#d->QvWy*O~v+!dyY4@CHuL)~$dO@O+6>v%_nW1p&uRl-&PpLVhC zjvWy{_g>+r11**W$YpMJXEy-&rq^b*bVZU1Zf03mH7b^_P%iz-griw*KM$q+aIk=g zZ3meQ_WA2aN4l9Z%mzB(pxb=3_q1``8_FtukmSDC)x18(zP{^Fcf%3Of)8Cov5-R^2O7t&>)ZQR+TEL_a$|2| zo;xde7*AWrv~SJZuk&U{%@w~r#NJos5DkiUL<*n_0$u^E90ENG!HAKtg?wV30Gm9l zI@M*MMXC;Lh?AVoLfx*iO$O$~J%W*hnL-*PEi; zvkC7mOkSB&w<~jf+(OHxaS4JYo)0d=ziL^iz)VL zipiIpz6dgS^NnQ^=B`X_0CGpdN^{Q_`_C=wO(PspGA%cMK#Uw#&+Rl|9Crpo_DFzA zUg!2F#grtEA#Cuhy@UsvFc-a-tB;}14VTyIy!Tb{w0d$gf+*DowQrAWxjY|l;hP#u zsR7ux(DRZWWa#9?fQh6B5FdC}pBsivP@LBZ=~A}z83`cHTaq*!tG1o0WG>>Sz@hcw8tO{TuqXqP2-itT!z&-6AL5mGNEj@IN19qL4> z6Otl`^>k<@CzySv>;f=t`H@c7Xf%Z3p{f+Vz}-+OcW^|&5W9RlG8Ba`{mj9g_R+2V z#aKiQKuEM9JKV3?E(pSC8NzI9ft*r0e1io}?>f>ike?l!J_n%fxld5-eFzSv{-?9_ zM_2)^0mysv-ppC8yewc{`p3_hILP`Q6<`uA&`UB~Y1dvFMJFe#z)*^FIh;U46KN=2 zXm;sb6z47Exm^H5SypE83+Y8jFH5w?bqYJ(Gwln)>B&zFk!un>9Y2=?|6}rVt&rlu z39h4aqdv#7ujI}*uC_oTTst?yZglb%4(An+m&mF3b+T=j1Jbd5si1ojN^{Wt(au}u zu8#@=am)tzlniRoJ{SnLav*fmW>;e79{mUqF1MqUxS7~T$YhN@y%VD3J~VSOL|?Ne z!6)cjIqf-3>Hq8rQmCF`5BjD+cbX?b4IY#cD`*e2m5!Sxj1#Hv3 zin5C{W39DgUOo_IH4g7Peoq%+prCsT)74fj>f(USX2A0%I2~;xU$RH*&$g|z>bnru z$Ry+kBfp?yi8@%=;Jm^*eZ=$-BVSeaLab3B4@0 zU};Cq##+z(TY|jayEKJK&wq&_BzLT@mPRgy$6QWxA@?)8h#&&>a(0|8x)T`iEprgE zBx1GUi90ZCTQXcKoS%p3W#*P4WDO7ZUBk-M6QD+z>8rsd?a3M9VjM2=-qvSeo`48; zdhUHaz}|G}bhl8Lb^Lyn?+Gir#LF}-5?OG<0i6fBDC8{h;VlDTr%k_8qBm{`E3 zsY%~aoDFXvKwDBvxMprQLgS~@qhH1@1GPD!gU7 z zKRlv8)uyKuJ<|L{cE7kNX^5tf?>5g<$u3VtXX%#6Ye4p>-=WvfeM4aNl8nP`a-yYvuwiFyE@Q*b+AkLI}l zFnuDc1TWeOokNy+W>0Nff^_j}Ugr~Ht6qk4&CHu`*WLMr13mUoJw!P``+4TGKfXb~d z_WuGW>X-k?4XtH+n`HKURH4(;tPzuc*1~aGBM&={+U0IJ1rFUMnh@0VBF_LX|G4_K z$P-zk{Z=DbFeVNe<1GqjHzBqvprTH2!~vyNv@dU{eu2~Qp^eLeOsHXg`scYYV9Oq9 zAO~CW-Wju>2F6lO?$T#7j-?T3v*kV5bT|o)@>l&(>?ydyoNOZwio(xEi38O&(Vn{q zBly9#PZ9ocnWdpV$#rgOP{j7fWlhxIiEBEdx**HF^EKJqj{H8Wy4D4tmgi=(^HFqR z=0)1lMNuICK0VrVtX41CU5rYWS({8sJT4AdH{NIoxx?e_bJ{I0)miS1d*1Rmr$ye@ zDadHi8F`Hu(e|g&g?Np%;3Y~k1>dRAd6g7G;*B`eHUQih8(G``f^Cx8bD!3;R8_p+@5 zp+_7X47B`a>IUFGkvi!Pq)I7D_DVHIm2RcpTiB(Fcl)0G`emk*2+cN%C?=2}RzFty02em=3;T_hN7vea>VVR_4Ce`&PDe~tF(Si#08r+-3bmC%kZ1&*tc~3;=5UupXQhBLm z!o=~f$%A!yHIS+9zn$NOmJ33$CgN+U)MGHISHetIitgoJeq}C~jgiFwWnfE^6V%TG zwC#O~3ku}_V^L11MaLyi*9vH80i$V&>m*Wn@W?Id287{&AJS_9$Z69lB+ z0iwD)V{#I4aNsRoaHXM3%InD!7$581@CQ^>n?e>Iv_@HuF5OEDbvBSd)GeIk0#-Uw zJE!UN_Ro||I-V+@{eE$Z^3n%j3l6+yLVX}6b`w9^qil=+z~htqsITCME1|i*|7?3& z^(*-;iuUoxK{sxVrO=GJ)PagdryU@Zz~3t`c^JI`>RgHXMe~p#sAwhYP)Hw4neYne zu8(e}w?*lJv2Biiu`99rZaCWHI-)DTpza=!#ReUlitU3tfW|l5mAI##GzOp?L1yej!AGgoh~7 zLcM}31WnvN+b1zc5U2eFAjqPmohrzLi{spqEb0JwTqN%7T4O*NQ}{k+u1db+SA{9O zsuQa4i#V4uROcX0=fydg15R_{G|jdswQbb8hAB-{NMi`GJY*T4`bPop7hY}xV|%nW zt{82zZvn8Gt;3|FePWInP#Y^rux^!{FPq+^ecU!<%SKoy+ATmlh=(S|P_qbyNItMW5Gxm+no+A4 zh`{o15#PE(+1+h8C%Yr_m6Dbe?c&ciCgjb)IO`l=P>q*mX6iA3r;LzW*vk7I~u33(y0+HE1j z)S2LkkZ|HqbbggMOt`RFUy?Es>;hz^>IEgODepc5?P9X~z%`Sxr*eg2M2S_8KS8a5 z*!07)88oDu1@FMKj(8tEOIh!CSjb@)YWoy&+*M!3R{S9y>>Mrtz* zA;ea@reKL+R;)VYXGwi`jsGk_P9UoojQRyg5rHAz{=pqcMro+x+g(<3ysocCzI9I*@6^aK}D%aUG(t@-Hzv>QrS2? zjm^&tjv&>-49k8D?s7va7%Gc;u16iPb35N87)rSUgOq@4kt9C?$33Etmh4Cw9o`C- zE@P07;`K^L5&*pht^;se7HfkJC{YgP6t?h}%NOepBLgF{ZQ`G*(4-)n0f)%;tS|{_ z4yby8G=ZV+f*qiiHFD&~lq9s9C=>U0R_>py-1U>MkK9B>Fi26s5W5r2FH~xqwmHrnioHa+DFeh} zp&rH+DjgvCBU6m#4#gWVJQk6+cJO`8t8jY_J7biGJ0>Rj3>v!;%?h~xkh|S8_36|E zdS+leh+bCe6G)3=?+G(SzH|g=f!=kahz%@s*SQYxAonz9e|%daI_GBoZr!>={wI$f zI_FFgZ(gKMPG3O=Hu@$8+|KO&U-UOzM1@f^nk_0FK$JzP+kzucfU^bPxeD@dEH=Xp z{-KE{0W>(y8H>!^9oeuasA-QaKM|W%VQi&q^iwgT)fGj7U`@d5(Sq@3Vc^~9z$ zszEi70@kt-StV=D3)njQL{1`^nsbDe_M9CPqX^hV{DEIzK6tKXAqJZo8pk}!-5*7n&$8ZtIjuB z#PUjhMv+HUORE5Bra|7vArybX9OYS!rM#}RX#A2lWkZ_y2h&#BJo6uKPH!i^+i?`g zFfbo?2nq&S!=xy`5e9C1{YP>U=a*&q2Q~T^V3v4pQkc?+(zP488})=YopPp3oDMcf z<>pmZ%0@eqh{4j};{yNaKxB>fL-eD3Owlew8P~;Ppw2ie$wC`ac>Q0DP59?LyUxcO z3xHU3&HmKxf+xNGPynePgCsMLya4PA1jRzW9IB;6IOA{>v9O}i8Zn$$Y;*)BnO0-+ zg_rPGNN^yhrz^*`o<}dVnb8Ab`XH@)V1!AUk`%Mnb^6kcUs>Rg!$G)Wpnm%^LMnzR z;E!t5iV>7d$a_@!t+||kDJ8ra#?^lar7t%O!#2AwG5Z*1%KZrm_csVjw9nMT+WY_ryW$JU_pM1Ht_NheERD z1)D2lsagaW_``3$@rcIH6ovxDrAg+ut@@dB)$Gt52mK7HEk)tpUJA9v7XK0aH-Ij7 zSe@i<-j?Kqj_78RpLx|n&8>Dsjo!pleVA%mm_g`|>2W=$YRSVtI~@+STYQ0!v3!c0u|CMt$zmivKl8%S}U-mWuu6>vHhNuLjXT zIDm4{G$?02p=5rC0*zuP&_?tQ_#!L<+sTS}Kw(kKv$e*RqB;sY!Ls|+0m`t25$hhv*tjT<<#*vMuBh>X1QR5MJ41h?!EnJlo*^FG43_$1GbQXr7jP$#k369#Z zn;)fAok*_%<_8yz7JxZ#xrp|I&YB68fw?HdY|4TvsUgrDpS!blGt*^?j2=d$i1#hj z$OA|JLE+<4w+0U<0D}?{7n_mdQpXbk5?%r84Ei~4O!+yPDr~30v%7cEnW`ZRx{Zzoi@ z|Kz1lR7v?S9y?i?0xT0mg+>Gdo;VNVe4i+-A>%fRQ~jS*3uw(_*x-@SRS4vfk0=&# zcoBJG3wR>9O=4~nU%}%PnIK)!q`c?vdL(2q>X5+)V8ll^W|sV+Sr>-Fl-CP)c;kX3 z>wQWJO_t|PsXiPbdK1W=0%3xM@}R&tzyOD##$p->8rMWX93eH~cxt;&?t(QcyqQTZ zyNV_T?-&J1aOv%)dJTA0goZ8ydj>H7_Mk~(0wguAQc}afVr+47IuabE`h}`UfxQ9# znVGCL_0TlZ?P*Q!0MCixy;AyB{f*$#jGc#D7{X@(R{)*#sMRd+A?20O1`eX9Cx^dF zQb({0DPhR_xq~g`?is87;uXbo!k`06wj%Y%vcYe#w|6w1cxcQ-U8Cq?n5n?VR2k|_ zNeGez;YEP(dcOQ8Zi9zzVR53!1CPA0&#iLiBzI2WrM7gNkoZ!09&P$7Dsgj^}+{dygKOk zDM^X;3oAc>Yf(0R=u-CDZxJU+{QMDWS54?V3t>lq!E6AK9kPI;NauLq)p0xrhJ3OF zDIBQB9=2%Ik5p*Wq8y=hq!Vz4cETmn)PcxAdP9qHPI#pnw6$XMANmD9zz0DO137o2 z?|k$Q>aztkwr&}XP&N(k|9S`3OSFt1I@qEma3KNsoCgq2_AW-1H{W=fF^O~#_+`76 z)voHymo3~DQO##;h6F46cAyj(_nh;mpza(A?@x?R)8H6#<`OIiS8b!H)?}T{zs9K!zG$1xZjU$lJ-GLX4%v8yY&r>=GRDnpe zvah#Ne6YQ}EhV!{?hTIOEw0C00|9+~S{d1PFoP`g02V+M$!c7c0SX7lK4+<V2W^2m|K1Mj{v^ zfc_UidnUY9NM-&rvz8vMc`hup zjDF!+rWH^rOY8U@XV_Ps6m)qHMuCGiB&SuOdq6ux{-FC{1|+%4Q{)p#(yPrq$;>4M>B{14%!@LOQ>9FG~VHSa)zuJE2ELZJfIqAk1Xng6@drGzx1H zekgq$7+qT#JdvLZPbw2bICsmAvu(Qby<@}qgPa~({)&E7oDu)gPE;O(^r<99ZTJECjV<|NCNPSLP;U?Avpbpzz^TY(qh%ah zo-S660=@RoqTL|PkqpSn^(#rpiJ=VRFE%F{RU@63^+)dnTwTKAB9zDTST!N0>2wRXQ6vR=ElmR?(>P^~O51(Q@(=%!C0RUz{^X-|G;ldOn?%U=0oMs5D@AVRmdvoGFfR=oCDCZSkRTo;@v#hI|H zchw<9u{)&~h|1r=?@tfOXX1W04g&0TJviYZsjKJf9vIdWJx-7zqk6{< z%x_0;ebTb~=T&d^W+>7*+zEM#>r>%g@|F7Hlo$ene^8ajG_kyE0$fUGXO}u^-j)XW zwCb#dC5=84_Z2}sGmZsEa+P7QJlldExeCBiTFV4zzyiv&nnUhW6f~Vs9N{ctTutdn zkFs8!e(ky7Ry;O!yULi>vRDk$40Xj`O|`90^qBdnAT#U=0{r4#?oyo6-^Yit1kelA z5_*9O?_N8hR6Rk_I}Cw~Z5}Qc(W> zd@LA-P^WlmEyMHIAjVF@`UF|n|KC9J=~$DD^cf>cb>x2*h@^r0N{rHrRi!Xi{xkL* z0en$zDr3!GZ&-u#-Odoa7rQR%Q=3-){rSHwLYx0@i_jVPe{hN#!h1rLJXZSCd6xex zmn1n-`|6VYWRz99hcX;eGmh+_rC&;(tIhcyV{5d8-|{$uU0H7T99j7_++$4(N?^#y z6}N3_#-o|y?i0{GsjJ!q8Td2w0wbRgXk>Jf4z$m6?=1cT%2kvndTtvb2~-5&i<~$AuP206F)G|-s2?rBO0-NH|C;^J z7YN=pJhtn%i5imDuRJ2l`}}?^MU@cu;*02@ihv;`p*d_ zieDR-NycQ!7i|i4^p67h`_by&sE+%O0wLX4zwNJ4Rq}8e=Kih42!B6XdaZci_s&() z{5>i;&+Bf}|5eg|KlgDXo86`kz_)W8(kW z;s2jI9xDso0a2a{!^)oj@h}M;>K(I6p3uFJq($(ySdRG3-u&a~;rH?4i_|_e3jD`y zrTBXn*KdoTc3fj`|K$P}c->@>O1u(6C9ePdzN_G?*0uNl{U_>+SRsTiex{FZJNWO1 z(QJX_i=KaOO8y^5@)S7stQHQG@}~b8ER5pcME>o_-(vJnwEmruzqQIgt@U3Gi&Xi) zGxG0@{5vC*75L|(tQ8*or6vCPTK~M?zr=y*|C=+?;rW*Qw)l}Y9cCT;ck-C}(fGrc GZv9`RA2Y%L literal 12876 zcmeIZcQ~8x8#o$?8NFz!y;`NzUPTeKMr}&%m7-Bwt=OX4s#-;B&!VWkH)*Y^S(F$d zidqq?#CBev-}n4+uJiBt^Td_Q<$a#}e(&|%>$yc4=skwALO~!9R8vFM5Cj67fj}hk zl;pq@62fIY@Qc*(q3%Nvs5+kd>=_yG_bq!3LtPLk@Gc01dJO`d0FO{>Ads&Z2($qQ zf#gy_ASTbumM03p0=b>`V^z@Q)lY7FQ4$Cw?x3mq@TvdI78dE_VET!8zTIJ*DA(vs z5rG}P@ip-s^&H zz5iH@EWLzlQE90|=n!&DHlm}_{uFeYdODvvM2-j_0V7blWM9C-$~8-ZWM7rZm`NH) zEW=~bcO#+XE?9HO1?iDJqTdM3h?Hhq|9f+`Ep*`MaG}EwZNI>EqhBN%2D;H7XH;n= z*Iv%sDOy$eY=16Tad==5{~R3*=d5B9bL+cY(GMYS|2V=MmVMd4VFpnkzhK7X)5L?~ z7cZLZR%5js}7kxYP{f*^?k7}?Cy}xUd_tBt%Pp30p)5Bp2J&e4qgUmx`fq< zY1`D5Y`miP39+et4ME|Y()h#A-5Qq@(m{|s2TU( zrML6;_j^WOl|6ZW=JMf5yiQRA#0)QT! zGFX>SCI&rF|25bWekYu40`YZOpN)h7aYq(q$`xkrULQVEt~T9lP)*MSCu<}*i!xXw z@=VVz%683D`hdKPg>|MJyN0Ks3gME=gcSJMU0!QREB^RC&eV6^d9+Uw?vC4t=xJ-j zk$d#v@1vst{Qm-~HZx}iCw1d4>4IOl3Y~A=A2@C70RSda6b;nUyFbqt*6trC(?pn( zWT9`bN!}_D@XYB#eS7{%AVRP;s9wybKy$6jn5RqbB)WN5e73ys_pq41VEy#hkROM$ zVX?j8eBl|`<0o?2Hj5_Kjb795r4G@mJnUpb3D+zvY?2EKMEm%e{iN&9zaqLhO_RKx zUFzL^iPVN;bi?^wJzl)PZihej;86}bjwO!aYy(3_lDM07?T_xTl2stjxRIS+#Re@( zhbUDCyQ^K@pZCVvEy`A6(UvGReluP2JLvkj%O6-#4uOv*eViZO>0AR|t?9n|sVA+O zQIPrYVN6m9hvl850R&Dib00OPoQE{RlSKWfc!H)&D@gtrXhFa9G=|99#+u3zq*J5K zjsc&2U!29sT=P3{3Zh8R)FRP#pxfXlvOnvc4R17>eQ8~@avMjHeL{pC$iEHLnqjeV zNW4O(DtAI%8?y|BZJ!zMV{`Xj3>~!O@gf? zJ~8~!c2YG35BG>ZiFU!mtQk`siy=Lo!3*-G`WN{I;aliJ!uk}Z;iC7Oq{o?NkcCn!ZZD$6B6FB z56K^AgsU4M;-?>e&tIPtK1>B`mJIdA;E!0zdi{dkD5RHMdoTnsg#U(_Gu$Rfbp|2E zkgD#sP+6k98CTiBVQYj8etwX!p&rRqFq|Ue_V>clcB)hcs>b>bFz<*pylpay2^A04 z?$;AzCNnXT-|>f5G5TNg@6P&-D0?|p^!4|~$R7r~3W5642bJ(7OynhUf5RKs&tWt`Bb@k^_CC(sa zZo_;)upq_*k*u_l)rIP%1l;ZFzFO*R#nB@hoF1|hf)AApo2cgd>eLdbP*Txa;i6V= z1Cd*qiuNuqH}cb`%dp2-WrlFjh%JfXC~3>dJ-nKPZh9sHQk}%_^*D;{53ZOV9lktE1T|ImD)f9Ke@HeYexi|QIxm=<`!2S%Q zbU_NDW3oG>J1F_7^kXP8G@`mX{Y$=J^h(Q+p6SsslNiDgd>6~2}Sbf_k>EkY4dd@9Np@nW&0@MKnxKWVb8Km!h zdaF0GWD7g-LLJrmZNOV)lW6l)9hSDNn$0Ud>y>vZ z^Sn?O6Yzw~!BTllUA6RN+GRm~6A*InuSYFJf$~?s?K4^*A{*nSF;uSVK+n*pH8sT({}{ zfweaCSTlt^}dU^`!9!rx-in7R-LExiW0Li)6AUZMEz~qs^%Mripj;ZZmg(| zaQn+9gUK{s-?0um^Wiyt=~WJ950b<8u)A>fv+on_~B7HRdHU#d3X-C z`meLr@?s2$pb@ds?i#J{f!n)~uyo_c&5n$t&w3ZY(eJq09*1xHZ>-WVp4RPHJG=rS zg--6U*9a%`DtP-2LDYbP(03jjLrvatQdite!hV$Gm(l4MsyDnB_N=~^j|rsNeLEJs z&^@jXy{WZnx4@MkbmgjV0cW^2JRZdL+0V>V=nnc5&UT^2w`&yYIG-y6VH^BxsIM3= zDpA|n>(B7A>xh46Wnw%G2t?9-9WvbJc_>~962=3DqGj)X3aBCtp7A9=t$ZkF!2%0j zK#B9T>C~;7K2WfZs5Vvw8vWASPAMhN%K#>BC>+TTcHva%*T?zda?N&cl5|@R# z6iM(bPRtDOPhF1{>Z9L6r(v%jXmhsh%n$7k&uq3>jh$FZ&c<8(c)$CjilKH%!^`C` za6GgT7WxYk*!t9gsVDeQG?7ZZX0S^CiF}gCTVLElMPi5KoB6!Y!`Cu(D$GMecs(?8 ziZY>ROjY7z28YtM@%lOQUcJ>y)?bR)xLY-pRJmJo^Cv>S@*d`(cN5<3fObA<)dzn2 zNvN3|(eaA@*~1cmhanE9&<_*dzKrg=-Orkm~Ko9}b0&UvrB-3@WK= zO*@BSYA9D8hYw)KYp2{SLkhneH(X=Tws-e?p8h3_f&tuh+!s8&NM1L7ky(Bm$t|bXj!HA z@%r2I=fitNqJ*tct|e}HO(1dL^Z6JQSKmEM^7nW1KO@}gql1BnH)H7-;=>KcVoW2= z5#2Cfc)hQP5*L0+bIi{He|k$|8nFE~4UUyRHi+QV6H$dwcG<{@5w^9Bsf<^;FRDgc zqb4q?iSghA#mwWT?xQ~5m0@++0t<&RAe{}kF{Ay)MDo-d2lW*>uUg__%iqfix6_QC z&cG-m7bs1RIgk2K6q{yp-~4rlEf&V77slyM72oMF0_R@zmAU&3j4jFdrrF^QPp5VDk3qt$j(#rZa%uYZN@pVK-Vr&Sl>RkvBaaMoLFN~*; zOj8tZ+Y0Up1TlDmR?Hu@Z~ zO**sj)Qe+heWFy!Y8q=Ah3%B82>ITy_rk@t0BBC#f%{YDWtu(ffjf1!A!Bw3E{AOqX{z8p44PY>5 z^jBvc@3#f$zloCN)GisLRV9k|A+vTw(WE}O>Gq^g*$EVR*@-r@e$Q&1jhWRyTNw+! z0{(Ob{J~_u?^Ot>xX&W#t9*+8&y+}LJDWXGBxz)4Z|}=j(+jfIB4vxnL^nhx%v)Wt z_t^w@(klS4R;cZ(i@Jzom~PfQs}Hl+*Blms!%6Sz8i&E3f8O6Gtn;B5d<6oE?YAwh zHog*BqW%X~x9nXB)+?DHV3lt60zbcc`8Vk!Pe@Lpbq3v zHC@%6iXyjnr%1Fn4BWf1BiiHtR!al54$LI)=-T-^d9)O^9NXb84RX}BD+ix>C>_41 zmx|`yy9QX9{Gj{nzCqVKRHsCxS#S>DmS?BwaqZ{p*6P*tUlZpG;R685bQX`*B(-R`=m;0&W!9P1lA9q`#|tbh?q zwJ(Wm{V-2#qrixI-s@||^a(JPTYT{~HRN(CJh8{o-TK#@9Es{|uPyV2ssXY3wRx?D zKFEgb_57z38JsPbTzi-{KD#jBn&{@j(}N9D)B=UbbGV0}cHBE`t;QV#bmAAkvys{T zx9wE2Ql2HTgy5wOOPNV~Sj>-FELAWIB?o~>HeX-&l=8gTx?u4hT+=86R=Z^;3A`e- z=gc(QYaO#-yddUTmu5Ia8RK@ZZ^D&al;`9r zKd4#xD~i7yk)egdwX<-9tjKeX)>iF(Lx5=qLaR|myEBy;g8C>RJ4S)7)i$B1xhP)t zBImXBPPSyN%n&vRne~KUR~sNF$(+gaDNdlh$-2H~(^=Rx<*m3C9{KgcC0EI_Bxxwo z$c`vT7Y(Q@%haZ!4(iWQ6@->3{U*xF|4)$x!0gC|7b)ML=p-wnHbV&PG{kvTb2C%N&W6@9QC)CzISH_)Cau$MVlaTot=l)M4M!2uT51sryITys4HFrMnWzLx}p zJP#whjav2qJP(-_6iBt>kCr$!OKiLASII5T59nu|pNNnArP;I{LP1{oX#);yw$boa z-~c@et!!YfLw<^jd@A0?nmNT^+XiTkF)n+vS1MhQ$cUICW~WGJZuL)GAu z&p!e|?qD)10J`hPr^1Ww%Ay-(-w4Rs6(C-ELiSDRvnbtR6q0I)+2AI_p z{f_IUdY;jxPth8vGEDwXr}$-Kd0bdZZfoo8pMvKfZBO85ZwIfpgTBqV}Xv{oFg zx(Qh?&-WMz!&<|0Pump$-~z!d*VJQn<6s@G+piS(rSLc4UorAGL4ma4Wf=G z6Q}GSIYFUji2?5HGP7)JmV!k*{d1!|JXez!3E{gK>-Rbzf#gSa_*NCnAc_pJ zhGFkl0ML~giCU%`$Y{_MmVro;^;=okSqk+2YtDuAeH0p!)}+D z^!C{SqRE!8M={u`U>T8snrne?>0i+8Nu=yih+s;2aj&}pPhEJ0B9a(Hd9wmp1!Je%pItdsjUYHC}Ha3x}}5unbAD?f7tq~lOc~}T#Q@vpUWD$+Q8;`|Mf|B z;{!h1(D%}8pL77nJE-X;4WZsAzg;y`C499fr91ISW*?vvgk^{Dj{$z}YCu4LQ+db3 z&BH}H88NJY0kwz=m{p>SpPntm`Q#{h-$y@gN7@x2{wEaZt+e#qk4B( z=JH{rg7&^=B}kvFC9t&F37YJ1WkT_9sLkLOVZ6F4d3=H;t!|V)$0j?qDL=l@GT}S{{ORbE$Cu zx?-VeoNjH5!J8`c0-#D0_^RcBCuI>!)fx09^7-J`NAvm$b0ei1 zPp^pnn-@2)0UNa4<&GVu^5%SIcLL*KDfDpdXWxe}Ou6R@vldVVXr*q4sB}j1-0n1xsQU43kv zAY4;=J>`u zie!A(=s&g}DuP{UJr}#X&Ur=0J}}z;%JO#g%N>Y+)^Q(D;cXzgkx%ni36IvR{I|g? zz>7SHyycAf`o=A%gkr#wz2`#YuP;~HMPQRZMjP1^`3*(0&E|#SXs-o!z>uy3TY_TB zm5XV&V05E$LQbqv2{NhlYkPN6J!1Z+vj=bATr&%L_Qlt1OjUt)klJTA;eD;5U*vzU z|Lbpo1;0Ki_2&X^3eq2^TL_9NjjlA7*=}ao5&7wW{Mcdm?XO=$dR3k8SHY531jr0? zq6y&@9Vds4hc0}`ejea-XIk3Ud(FYEa|gE9Iq@m68eP@wr}PLWqQH(n{zCQY)RtN3 zZZYgcCCdbV`#c~g>=(hES5HK;9o>FSWwz9$LZ#LK0!3HH-C^do%uT}F#iup5_=da;5`-zujp@cD)X0G{QQBn{c4ER`d8 zbUmrum==%XmD36q>Ew7-zWqWMcNAy%gc{2`K8UA;H-b|9c3QC^3V;st03F^1TDlx( zBH!CIF;KrY^Uo+=7RN}4B;dRC?id3u0&o*}FLw%ch}DB{vVIPAUnQw{Ym+~=tb!;g zT7uKR%qbf1yCgmN&oK*Cl9eSWr{v5|CbKhMu|ro235Njg#4R!P5S@4xQU)~pW>S(kj9A7Ss-9w8j ze>k6?Yra!XE5-bm zsLJ{p5dNgWGqvBo}>QB8|VB9!C2+27-+*AZ|i!^?OPLG*h z(*i9qKF(x29$TdG0#KKe%A36t4r;8*0|xzifSGPuiZ~jdU2$B4i@xaQyZ<7$6WEVp z2Z-?7QM_4O=RLuA5w*Lor&(Uhhwa?kVY6@KH>3qH1rS1+NG+dcF#91abc^}`W=-o; zS`JC&P?O5M*=0vZ!dF=mkev3ncwD-epF~B&N(R;(?boBo%bFO z%mD09L;(CQOcT()fH5&3GI%SM2xC1b0g0NMM}qMKB-ZFNW!~PwvXR@dK;8*kV|pd^ zrf#DY#Rsugbgc6KJ9v)*5cqOoI<|$l2-gND`*ZhrFbn*9Gjn8GaAjOZ7{x?I6otGr z1#Yyvj1S0zM6S7A?IjaJs_DEc7p6;~GStRH&A8X&KZ09xoI@U)&C3{%QRd%X*d0 zUDXr`IDK#-iuX{=-_0?MSO#osGutv1%6c{3it@CKl@%;qGUkZCqkBa_uX3J8>5}OU zg7|H8sS%O`B%Gu^maY^vgEuagyf0&4#%g0TPuFVtALhS*`~*F{(a<11L|8{b=XK|N z^#m$!{78$XSdhG!C_GJG;h+>K9Sl8yoc5`Dqg(4jRyc~6u1Yd?x#^0G4_IXF8)cbA zM5Q4v9cZe;uCi|#AhQ*i0=gQn#3>cns|Gu$4lCjWnOqpPStq}j27YPXC&!^t&nH`o zI^O}h0IK9MAA#Zf%0Ko;>EO-vde+PUd8>&dFJG~EP?~owBJ`VY|E~raH#c6xlAb{+ zoB2k<;f}t^2kLoJ*}R2+Vt5v@=mBsti{#ObD7RQ_<$q{1=PF4FP^*>tIN><#*B`aK zRNBRELabxk<5C=>zhuYCfRtWydI>#(az=BXrtWsUG4WYHEs2a8|zg4w1&5Ym4k2+NV$)ZLFB#m z|0~?e3x2lCrjUwAVq<8{;#7coZtMv`5n5Xto))fs5J<)md*{ExbW&O0N&ZMQoC1;( zs0QA)o-oa1y((p+gIbFs+Sz2qJxeIC$H${J9Uu7azLNqHWG82aMz-)$aEcSje7X$K z^r@7pw2JeSoY%yRgivr5KW)D2*ZE)8V`OQL$G-Iz-!Z@$iq>{te66*b6ZIPz3r_yW zaCpBq9_$THu~-^DE)5KPY)2HL%ed+fY!SMYm9C%o?tu~8>-J+s0lxf5sw3U%AV#N~K>Gv@ z6r()4fMQ4Q*1x-rOX$KoF}6%sJsv=@HC;RF zD^CVR$v1XW?PVkt6$m=!$-MxPUx4Dzzu9{-k4$AxmbdOng95{aR zGFNH~9nT(mO#wb&VA*$u;mvyTKnOEF)>q)TsWr_0g?WG*eqN0=;i?Y@FHmW+)i`ov z1ATebE>nHhD*qFfM-)iBCigedPTR$0FSLqC;^xbr_UdwU{3rYh?!W$>n3+(lY$mOh zWl>@fXf<`W7mylLYgn4Xj5e$pcBnD`48cW$m@L6Ve7Xcn5nj2CcA1j zUoV}bx_AJ$=7{EW8a@ z9VD*W%_J(;knAs3i^Gj29Mp!QeSA?N_O=HUIONJLeLxxmPJrp<%y35tU!tnTiso zIAz+9_kN?26Lb)w^2Q5Bqr%irI&{?`kFYMJczMa~sh_3I<%qEL(A;zM`N!ld>qGA> zda%5^>0S!AcRH*u08P9O>$t{8{SbCy)ZxMd^j3;dJ2_cQ~R9fR)2yZFZ zGq@1D%YdtrOIdig|A0;3w6}wnJ1G``(_>z{S9oXra9ci<#Gu6c_#7o_7hIL!>F9?K zy1gj8Av);Xzj8S_sHn2F(3#!KA)>L%1r-wg?UF&4FgVI8l#l|~wB3E)Y_+$I-sJvh zyS-yw`BX_}!pMf>)JB7uqeu>Dc6IGQmK{7x6vWAy&X*4Nmr(;Jz-7= zW*M{pb+hHL$?RLG2Y>l;mn%^_g$&;F!Jca4EqJz zgnq4fN;R9$;g1$#2^TE4djBj)<6={@7VLzJkROxRKdfCd^E&<>T$rvj9^>&OgCq7v z1*Z=&jCDcLOB;WBTOw`Uz&ycPY-{ApygW?CJ3396{EIsCcVN$R7)E01K(Hy*aI*1=f-{=nbUNwnTBKsX}D#A5UR{TQ*FqdgEm$0hd)r;v@v-`(9 z;<5}cqQqjbL#}ygTaCCZiurx?8)A7>h^@n_(E8>BffP)U*eR&WwBQ-gHmful|0xq0 zEvRn4K%daB=TfD5R~eZ5nH4(b!-KSbAL+06m`dKX^9^jdpbn-&g4#79n)vm znO8xN=~okOp_z|l`ufi2j0d#X>=u|3gaDG#ZgCV6nv*e(C?&pOoyqaZX76y81=h8V zcEQ7tgv<2_!^rwyfvLQQia0FV{YGRGctIblB=K}@+_Hq5UKP0F0s9^j@wCAt{`4>YL_&OwO*`kWmnID}z|_+T ztC)--d^`GE_a)vJC!nFEFlyWaJA~2of5s>+bEo|_Cn%EFih{7+wB`o0nLdTBwzv}O z`xDq!=|faaMZVQsUlr%zJVfX&VW!P-!~3Z9TgCiB59d1#6X3d)bYglTB(Ga)Xhhkc#88&mFF#G$Din?npFqb&Jj3SV~IkVc}z6T8DsG$Vaj z)^Eu|bmi^yVovJ!uZvK;h7?)n*ho|et3M=mKb6wC(?@1;esf19V)H9Qn3un~=0lgO z3%S4GqV!#wTxtyLFg2T(EcET^1IU{WrEbm`4N1TxN|J^zvdPd&;O)=Vk0!^Z!4ZVe zH2al>SYv`MGO+X2q_^w^6LnIWf^njM-HrF<@pFdEfJVbWOBMCjs5EFT;_)}i= z{d*mOO$N>_cl-f^FKU+T!%0a7(eG%%X+~LtTu1Crcof=ou zayNW!%ynK=+l!sb?y$0Y@1E{YgB8FEI8XW#+mtWs<;gP^7H(}4k5)D$PgvczOdP}F z!&f!i3)5$^HRG1V<$IjNox^a?(J`2%IZb=?O35jopk>l*Md*+*6uF?59tDgbL0)W& z4(lo$U+)cif%i2Zag3S4Pm<%@BNuRUt_0!-OyG|2Cud*n=MFy0Gm@siw~DikDg`WD zzCW#Xc*`PbNQ4c_cE{MG=+QJ3h$k6^>8>P1C;evc&`&>8Od0D^tqX1d;Z^EgPl~T@ zzwS`Z^WFuL$32`Qq#7l#ni;49B{0xMOG2AAy@bL~G@mwjI+z?OFYG>wcg((w24M&e)0-N>EE>!*vc#cqeq@*m={uD2MFp?3}v*}Zy_eIcM{JMF$L!YT+SZF!P#X#1j zq}f`C>>*rrIn4PlEq}t>hJp!6-f(wG#rH4irn80;nJU3ns{~t}5d6=@Ke-L?>rMuM zF+eM7trY4S_FLOIFnovpJn4Ml(R1S-G>lrv9?qC|3QEB7(9CV0yU#Ilz!P;2t$K&A z5KO!*0b4v;*>>Xs+Eu|K^e^se z<`56uE+uF>|1y3vEiBx>3EVmgsYc^!bHQakN1QwRfS>fel9K3ED#7Eo*HeV~2tx>K z#7sq;i#k(0b_tnWP68uIRwFK5b4#~7Fc7)~Yv7hOkz^}Gd*6(Z+ntDf)9&M()j*CtEr!hl3;?+cx0Id{R?1J^_I*6 zoz3$dM%;_Kc9j=23S@IM7fClo?$r0aeLv&%uz=<2EF{ETaC#GAboro$n3+SGzI3)4K_JhR|+)P`;eQ zY!Uiq(m3iz4sh?mE&5`Yc-ZJLe>*63`U3qBO@%nra?W#+uAeR!!n50Ack4Ni%DZC8 z8$m=l1zF5*Al`!hH=LXW9FP0FDa(#uoLVByy-0g^$@vUsM}6*!aio&hb#rd+GgAO# z+$H6OElg*K$c%7#&ulHMG%ZumV>{ZXs&~17Yw&5_Xf0T>44u$WY|(FX;bmIsCC``$ zG$Y6xg+&H$sSBfi@84KruA;(JExEvU3c4V&VV+~Hy?tjkwR63blXY_0Cga9E41xdn zxLX19QGNAb?@v!ZXRW22UV_w~;&0Ip?@Iyyfx+ve zX6EDY%;&kBz1MT#7f3=({DH8zxUhuSQ?UnflK15#?hA^E$%%8Vycg1`E|02F|xA^-pY diff --git a/stable/artifactory-ha/sizing/artifactory-2xlarge-extra-config.yaml b/stable/artifactory-ha/sizing/artifactory-2xlarge-extra-config.yaml index d3891eca4..6afc491dc 100644 --- a/stable/artifactory-ha/sizing/artifactory-2xlarge-extra-config.yaml +++ b/stable/artifactory-ha/sizing/artifactory-2xlarge-extra-config.yaml @@ -30,6 +30,10 @@ access: tomcat: connector: maxThreads: 200 + javaOpts: + other: > + -XX:InitialRAMPercentage=20 + -XX:MaxRAMPercentage=60 database: maxOpenConnections: 200 diff --git a/stable/artifactory-ha/sizing/artifactory-2xlarge.yaml b/stable/artifactory-ha/sizing/artifactory-2xlarge.yaml index ef809864f..02cf7f94e 100644 --- a/stable/artifactory-ha/sizing/artifactory-2xlarge.yaml +++ b/stable/artifactory-ha/sizing/artifactory-2xlarge.yaml @@ -65,6 +65,15 @@ event: # cpu: "1" memory: 500Mi +access: + resources: + requests: + cpu: 1 + memory: 2Gi + limits: + # cpu: 2 + memory: 4Gi + observability: resources: requests: @@ -96,7 +105,7 @@ nginx: postgresql: postgresqlExtendedConf: - maxConnections: "2500" + maxConnections: "5000" primary: affinity: # Require PostgreSQL pod to run on a different node than Artifactory pods diff --git a/stable/artifactory-ha/sizing/artifactory-large-extra-config.yaml b/stable/artifactory-ha/sizing/artifactory-large-extra-config.yaml index 038c2ac4a..fac24ad68 100644 --- a/stable/artifactory-ha/sizing/artifactory-large-extra-config.yaml +++ b/stable/artifactory-ha/sizing/artifactory-large-extra-config.yaml @@ -30,6 +30,10 @@ access: tomcat: connector: maxThreads: 125 + javaOpts: + other: > + -XX:InitialRAMPercentage=20 + -XX:MaxRAMPercentage=60 database: maxOpenConnections: 100 diff --git a/stable/artifactory-ha/sizing/artifactory-large.yaml b/stable/artifactory-ha/sizing/artifactory-large.yaml index 083643ca2..504edf1ed 100644 --- a/stable/artifactory-ha/sizing/artifactory-large.yaml +++ b/stable/artifactory-ha/sizing/artifactory-large.yaml @@ -29,6 +29,15 @@ artifactory: - name: SKIP_WAIT_FOR_EXTERNAL_DB value: "true" +access: + resources: + requests: + cpu: 1 + memory: 2Gi + limits: + # cpu: 2 + memory: 3Gi + router: resources: requests: @@ -96,7 +105,7 @@ nginx: postgresql: postgresqlExtendedConf: - maxConnections: "1000" + maxConnections: "600" primary: affinity: # Require PostgreSQL pod to run on a different node than Artifactory pods diff --git a/stable/artifactory-ha/sizing/artifactory-medium-extra-config.yaml b/stable/artifactory-ha/sizing/artifactory-medium-extra-config.yaml index 47a4004df..b2b20b198 100644 --- a/stable/artifactory-ha/sizing/artifactory-medium-extra-config.yaml +++ b/stable/artifactory-ha/sizing/artifactory-medium-extra-config.yaml @@ -31,6 +31,11 @@ access: connector: maxThreads: 75 + javaOpts: + other: > + -XX:InitialRAMPercentage=20 + -XX:MaxRAMPercentage=60 + database: maxOpenConnections: 50 diff --git a/stable/artifactory-ha/sizing/artifactory-medium.yaml b/stable/artifactory-ha/sizing/artifactory-medium.yaml index a9f0756d2..93b79788d 100644 --- a/stable/artifactory-ha/sizing/artifactory-medium.yaml +++ b/stable/artifactory-ha/sizing/artifactory-medium.yaml @@ -65,6 +65,15 @@ event: # cpu: 500m memory: 250Mi +access: + resources: + requests: + cpu: 1 + memory: 1.5Gi + limits: + # cpu: 1.5 + memory: 2Gi + observability: resources: requests: @@ -96,7 +105,7 @@ nginx: postgresql: postgresqlExtendedConf: - maxConnections: "350" + maxConnections: "200" primary: affinity: # Require PostgreSQL pod to run on a different node than Artifactory pods diff --git a/stable/artifactory-ha/sizing/artifactory-small-extra-config.yaml b/stable/artifactory-ha/sizing/artifactory-small-extra-config.yaml index 47a4004df..e8329f1a3 100644 --- a/stable/artifactory-ha/sizing/artifactory-small-extra-config.yaml +++ b/stable/artifactory-ha/sizing/artifactory-small-extra-config.yaml @@ -30,7 +30,10 @@ access: tomcat: connector: maxThreads: 75 - + javaOpts: + other: > + -XX:InitialRAMPercentage=20 + -XX:MaxRAMPercentage=60 database: maxOpenConnections: 50 diff --git a/stable/artifactory-ha/sizing/artifactory-small.yaml b/stable/artifactory-ha/sizing/artifactory-small.yaml index 3a3db7c89..b75a22323 100644 --- a/stable/artifactory-ha/sizing/artifactory-small.yaml +++ b/stable/artifactory-ha/sizing/artifactory-small.yaml @@ -38,6 +38,15 @@ router: # cpu: "1" memory: 500Mi +access: + resources: + requests: + cpu: 500m + memory: 1.5Gi + limits: + # cpu: 1 + memory: 2Gi + frontend: resources: requests: @@ -96,7 +105,7 @@ nginx: postgresql: postgresqlExtendedConf: - maxConnections: "350" + maxConnections: "100" primary: affinity: # Require PostgreSQL pod to run on a different node than Artifactory pods diff --git a/stable/artifactory-ha/sizing/artifactory-xlarge-extra-config.yaml b/stable/artifactory-ha/sizing/artifactory-xlarge-extra-config.yaml index e266e0638..8d04850ad 100644 --- a/stable/artifactory-ha/sizing/artifactory-xlarge-extra-config.yaml +++ b/stable/artifactory-ha/sizing/artifactory-xlarge-extra-config.yaml @@ -29,7 +29,10 @@ access: tomcat: connector: maxThreads: 150 - + javaOpts: + other: > + -XX:InitialRAMPercentage=20 + -XX:MaxRAMPercentage=60 database: maxOpenConnections: 150 diff --git a/stable/artifactory-ha/sizing/artifactory-xlarge.yaml b/stable/artifactory-ha/sizing/artifactory-xlarge.yaml index ccd336589..550bd051d 100644 --- a/stable/artifactory-ha/sizing/artifactory-xlarge.yaml +++ b/stable/artifactory-ha/sizing/artifactory-xlarge.yaml @@ -29,6 +29,15 @@ artifactory: - name: SKIP_WAIT_FOR_EXTERNAL_DB value: "true" +access: + resources: + requests: + cpu: 1 + memory: 2Gi + limits: + # cpu: 2 + memory: 4Gi + router: resources: requests: @@ -96,7 +105,7 @@ nginx: postgresql: postgresqlExtendedConf: - maxConnections: "2500" + maxConnections: "2000" primary: affinity: # Require PostgreSQL pod to run on a different node than Artifactory pods diff --git a/stable/artifactory-ha/sizing/artifactory-xsmall-extra-config.yaml b/stable/artifactory-ha/sizing/artifactory-xsmall-extra-config.yaml index cc557abd5..1371e87b8 100644 --- a/stable/artifactory-ha/sizing/artifactory-xsmall-extra-config.yaml +++ b/stable/artifactory-ha/sizing/artifactory-xsmall-extra-config.yaml @@ -30,7 +30,10 @@ access: tomcat: connector: maxThreads: 15 - + javaOpts: + other: > + -XX:InitialRAMPercentage=20 + -XX:MaxRAMPercentage=60 database: maxOpenConnections: 15 diff --git a/stable/artifactory-ha/sizing/artifactory-xsmall.yaml b/stable/artifactory-ha/sizing/artifactory-xsmall.yaml index e46ee61b6..3f7b07138 100644 --- a/stable/artifactory-ha/sizing/artifactory-xsmall.yaml +++ b/stable/artifactory-ha/sizing/artifactory-xsmall.yaml @@ -29,6 +29,15 @@ artifactory: - name: SKIP_WAIT_FOR_EXTERNAL_DB value: "true" +access: + resources: + requests: + cpu: 500m + memory: 1.5Gi + limits: + # cpu: 1 + memory: 2Gi + router: resources: requests: @@ -96,7 +105,7 @@ nginx: postgresql: postgresqlExtendedConf: - maxConnections: "100" + maxConnections: "50" primary: affinity: # Require PostgreSQL pod to run on a different node than Artifactory pods diff --git a/stable/artifactory-ha/templates/NOTES.txt b/stable/artifactory-ha/templates/NOTES.txt index 19b8decd2..30dfab8b8 100644 --- a/stable/artifactory-ha/templates/NOTES.txt +++ b/stable/artifactory-ha/templates/NOTES.txt @@ -134,9 +134,16 @@ jconsole {{ template "artifactory-ha.fullname" . }}:{{ .Values.artifactory.node. {{- if ge (.Values.artifactory.node.replicaCount | int) 1 }} ***************************************** WARNING ***************************************************************************** -* Currently member node(s) are enabled, will be depreciated in upcoming releases * +* Currently member node(s) are enabled, will be deprecated in upcoming releases * * It is recommended to upgrade from primary-members to primary-only. * * It can be done by deploying the chart ( >=107.59.x) with the new values. Also, please refer to changelog of 107.59.x chart * * More Info: https://jfrog.com/help/r/jfrog-installation-setup-documentation/cloud-native-high-availability * ******************************************************************************************************************************* +{{- end }} + +{{- if and .Values.nginx.enabled .Values.ingress.hosts }} +***************************************** WARNING ***************************************************************************** +* when nginx is enabled , .Values.ingress.hosts will be deprecated in upcoming releases * +* It is recommended to use nginx.hosts instead ingress.hosts +******************************************************************************************************************************* {{- end }} \ No newline at end of file diff --git a/stable/artifactory-ha/templates/_helpers.tpl b/stable/artifactory-ha/templates/_helpers.tpl index a0d318ba6..d6fb229fe 100644 --- a/stable/artifactory-ha/templates/_helpers.tpl +++ b/stable/artifactory-ha/templates/_helpers.tpl @@ -367,6 +367,9 @@ Resolve requiredServiceTypes value {{- if .Values.jfconnect.enabled -}} {{- $requiredTypes = printf "%s,%s" $requiredTypes "jfcon" -}} {{- end -}} +{{- if .Values.evidence.enabled -}} + {{- $requiredTypes = printf "%s,%s" $requiredTypes "jfevd" -}} +{{- end -}} {{- if .Values.mc.enabled -}} {{- $requiredTypes = printf "%s,%s" $requiredTypes "jfmc" -}} {{- end -}} @@ -491,6 +494,44 @@ Calculate the systemYaml from the unstructured text input {{ include (print $.Template.BasePath "/_system-yaml-render.tpl") . }} {{- end -}} +{{/* +Metrics enabled +*/}} +{{- define "metrics.enabled" -}} +shared: + metrics: + enabled: true +{{- end }} + +{{/* +Resolve artifactory metrics +*/}} +{{- define "artifactory.metrics" -}} +{{- if .Values.artifactory.openMetrics -}} +{{- if .Values.artifactory.openMetrics.enabled -}} +{{ include "metrics.enabled" . }} +{{- if .Values.artifactory.openMetrics.filebeat }} +{{- if .Values.artifactory.openMetrics.filebeat.enabled }} +{{ include "metrics.enabled" . }} + filebeat: +{{ tpl (.Values.artifactory.openMetrics.filebeat | toYaml) . | indent 6 }} +{{- end -}} +{{- end -}} +{{- end -}} +{{- else if .Values.artifactory.metrics -}} +{{- if .Values.artifactory.metrics.enabled -}} +{{ include "metrics.enabled" . }} +{{- if .Values.artifactory.metrics.filebeat }} +{{- if .Values.artifactory.metrics.filebeat.enabled }} +{{ include "metrics.enabled" . }} + filebeat: +{{ tpl (.Values.artifactory.metrics.filebeat | toYaml) . | indent 6 }} +{{- end -}} +{{- end -}} +{{- end -}} +{{- end -}} +{{- end -}} + {{/* Resolve unified secret prepend release name */}} @@ -501,3 +542,22 @@ Resolve unified secret prepend release name {{- printf "%s" (include "artifactory-ha.name" .) -}} {{- end }} {{- end }} + +{{/* +Resolve nginx hosts value +*/}} +{{- define "artifactory.nginx.hosts" -}} +{{- if .Values.ingress.hosts }} +{{- range .Values.ingress.hosts -}} + {{- if contains "." . -}} + {{ "" | indent 0 }} ~(?.+)\.{{ . }} + {{- end -}} +{{- end -}} +{{- else if .Values.nginx.hosts }} +{{- range .Values.nginx.hosts -}} + {{- if contains "." . -}} + {{ "" | indent 0 }} ~(?.+)\.{{ . }} + {{- end -}} +{{- end -}} +{{- end -}} +{{- end -}} \ No newline at end of file diff --git a/stable/artifactory-ha/templates/artifactory-license-secret.yaml b/stable/artifactory-ha/templates/artifactory-license-secret.yaml index 0018fa044..73f900863 100644 --- a/stable/artifactory-ha/templates/artifactory-license-secret.yaml +++ b/stable/artifactory-ha/templates/artifactory-license-secret.yaml @@ -1,4 +1,4 @@ -{{ if and (not .Values.artifactory.unifiedSecretInstallation) (not .Values.artifactory.license.secret) }} +{{ if and (not .Values.artifactory.unifiedSecretInstallation) (not .Values.artifactory.license.secret) (not .Values.artifactory.license.licenseKey) }} {{- with .Values.artifactory.license.licenseKey }} apiVersion: v1 kind: Secret diff --git a/stable/artifactory-ha/templates/artifactory-node-statefulset.yaml b/stable/artifactory-ha/templates/artifactory-node-statefulset.yaml index a46819614..9a5d4fd84 100644 --- a/stable/artifactory-ha/templates/artifactory-node-statefulset.yaml +++ b/stable/artifactory-ha/templates/artifactory-node-statefulset.yaml @@ -510,6 +510,100 @@ spec: {{- if .Values.frontend.livenessProbe.enabled }} livenessProbe: {{ tpl .Values.frontend.livenessProbe.config . | indent 10 }} + {{- end }} + {{- end }} + {{- if .Values.evidence.enabled }} + - name: {{ .Values.evidence.name }} + image: {{ include "artifactory-ha.getImageInfoByValue" (list . "artifactory") }} + imagePullPolicy: {{ .Values.artifactory.image.pullPolicy }} + {{- if .Values.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.containerSecurityContext "enabled" | toYaml | nindent 10 }} + {{- end }} + command: + - '/bin/bash' + - '-c' + - > + exec /opt/jfrog/artifactory/app/evidence/bin/jf-evidence start + {{- with .Values.evidence.lifecycle }} + lifecycle: +{{ toYaml . | indent 10 }} + {{- end }} + env: + - name: JF_SHARED_NODE_ID + valueFrom: + fieldRef: + fieldPath: metadata.name + {{- if or .Values.database.secrets.user .Values.database.user }} + - name: JF_SHARED_DATABASE_USERNAME + valueFrom: + secretKeyRef: + {{- if .Values.database.secrets.user }} + name: {{ tpl .Values.database.secrets.user.name . }} + key: {{ tpl .Values.database.secrets.user.key . }} + {{- else if .Values.database.user }} + {{- if not .Values.artifactory.unifiedSecretInstallation }} + name: {{ template "artifactory.fullname" . }}-database-creds + {{- else }} + name: "{{ template "artifactory.unifiedSecretPrependReleaseName" . }}-unified-secret" + {{- end }} + key: db-user + {{- end }} + {{- end }} + {{ if or .Values.database.secrets.password .Values.database.password .Values.postgresql.enabled }} + - name: JF_SHARED_DATABASE_PASSWORD + valueFrom: + secretKeyRef: + {{- if .Values.database.secrets.password }} + name: {{ tpl .Values.database.secrets.password.name . }} + key: {{ tpl .Values.database.secrets.password.key . }} + {{- else if .Values.database.password }} + {{- if not .Values.artifactory.unifiedSecretInstallation }} + name: {{ template "artifactory.fullname" . }}-database-creds + {{- else }} + name: "{{ template "artifactory.unifiedSecretPrependReleaseName" . }}-unified-secret" + {{- end }} + key: db-password + {{- else if .Values.postgresql.enabled }} + name: {{ .Release.Name }}-postgresql + key: postgresql-password + {{- end }} + {{- end }} + {{- if or .Values.database.secrets.url .Values.database.url }} + - name: JF_SHARED_DATABASE_URL + valueFrom: + secretKeyRef: + {{- if .Values.database.secrets.url }} + name: {{ tpl .Values.database.secrets.url.name . }} + key: {{ tpl .Values.database.secrets.url.key . }} + {{- else if .Values.database.url }} + {{- if not .Values.artifactory.unifiedSecretInstallation }} + name: {{ template "artifactory.fullname" . }}-database-creds + {{- else }} + name: "{{ template "artifactory.unifiedSecretPrependReleaseName" . }}-unified-secret" + {{- end }} + key: db-url + {{- end }} + {{- end }} +{{- with .Values.evidence.extraEnvironmentVariables }} +{{ tpl (toYaml .) $ | indent 8 }} +{{- end }} + ports: + - containerPort: {{ .Values.evidence.internalPort }} + name: http-evidence + - containerPort: {{ .Values.evidence.externalPort }} + name: grpc-evidence + volumeMounts: + - name: volume + mountPath: {{ .Values.artifactory.persistence.mountPath | quote }} + resources: +{{ toYaml .Values.evidence.resources | indent 10 }} + {{- if .Values.evidence.startupProbe.enabled }} + startupProbe: +{{ tpl .Values.evidence.startupProbe.config . | indent 10 }} + {{- end }} + {{- if .Values.evidence.livenessProbe.enabled }} + livenessProbe: +{{ tpl .Values.evidence.livenessProbe.config . | indent 10 }} {{- end }} {{- end }} {{- if .Values.metadata.enabled }} @@ -778,6 +872,185 @@ spec: {{ tpl .Values.observability.livenessProbe.config . | indent 10 }} {{- end }} {{- end }} + {{- if and .Values.access.enabled (not (.Values.access.runOnArtifactoryTomcat | default false)) }} + - name: {{ .Values.access.name }} + image: {{ include "artifactory-ha.getImageInfoByValue" (list . "artifactory") }} + imagePullPolicy: {{ .Values.artifactory.image.pullPolicy }} + {{- if .Values.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.containerSecurityContext "enabled" | toYaml | nindent 10 }} + {{- end }} + {{- if .Values.access.resources }} + resources: +{{ toYaml .Values.access.resources | indent 10 }} + {{- end }} + command: + - '/bin/bash' + - '-c' + - > + set -e; + {{- if .Values.access.preStartCommand }} + echo "Running custom preStartCommand command"; + {{ tpl .Values.access.preStartCommand . }}; + {{- end }} + exec /opt/jfrog/artifactory/app/access/bin/entrypoint-access.sh + {{- with .Values.access.lifecycle }} + lifecycle: +{{ toYaml . | indent 10 }} + {{- end }} + env: + {{- if and (not .Values.waitForDatabase) (not .Values.postgresql.enabled) }} + - name: SKIP_WAIT_FOR_EXTERNAL_DB + value: "true" + {{- end }} + {{- if or .Values.database.secrets.user .Values.database.user }} + - name: JF_SHARED_DATABASE_USERNAME + valueFrom: + secretKeyRef: + {{- if .Values.database.secrets.user }} + name: {{ tpl .Values.database.secrets.user.name . }} + key: {{ tpl .Values.database.secrets.user.key . }} + {{- else if .Values.database.user }} + {{- if not .Values.artifactory.unifiedSecretInstallation }} + name: {{ template "artifactory-ha.fullname" . }}-database-creds + {{- else }} + name: "{{ template "artifactory.unifiedSecretPrependReleaseName" . }}-unified-secret" + {{- end }} + key: db-user + {{- end }} + {{- end }} + {{ if or .Values.database.secrets.password .Values.database.password .Values.postgresql.enabled }} + - name: JF_SHARED_DATABASE_PASSWORD + valueFrom: + secretKeyRef: + {{- if .Values.database.secrets.password }} + name: {{ tpl .Values.database.secrets.password.name . }} + key: {{ tpl .Values.database.secrets.password.key . }} + {{- else if .Values.database.password }} + {{- if not .Values.artifactory.unifiedSecretInstallation }} + name: {{ template "artifactory-ha.fullname" . }}-database-creds + {{- else }} + name: "{{ template "artifactory.unifiedSecretPrependReleaseName" . }}-unified-secret" + {{- end }} + key: db-password + {{- else if .Values.postgresql.enabled }} + name: {{ .Release.Name }}-postgresql + key: postgresql-password + {{- end }} + {{- end }} + {{- if or .Values.database.secrets.url .Values.database.url }} + - name: JF_SHARED_DATABASE_URL + valueFrom: + secretKeyRef: + {{- if .Values.database.secrets.url }} + name: {{ tpl .Values.database.secrets.url.name . }} + key: {{ tpl .Values.database.secrets.url.key . }} + {{- else if .Values.database.url }} + {{- if not .Values.artifactory.unifiedSecretInstallation }} + name: {{ template "artifactory-ha.fullname" . }}-database-creds + {{- else }} + name: "{{ template "artifactory.unifiedSecretPrependReleaseName" . }}-unified-secret" + {{- end }} + key: db-url + {{- end }} + {{- end }} +{{- with .Values.access.extraEnvironmentVariables }} +{{ tpl (toYaml .) $ | indent 8 }} +{{- end }} + volumeMounts: + {{- if .Values.artifactory.customPersistentVolumeClaim }} + - name: {{ .Values.artifactory.customPersistentVolumeClaim.name }} + mountPath: {{ .Values.artifactory.customPersistentVolumeClaim.mountPath }} + {{- end }} + {{- if .Values.artifactory.customPersistentPodVolumeClaim }} + - name: {{ .Values.artifactory.customPersistentPodVolumeClaim.name }} + mountPath: {{ .Values.artifactory.customPersistentPodVolumeClaim.mountPath }} + {{- end }} + {{- if .Values.aws.licenseConfigSecretName }} + - name: awsmp-product-license + mountPath: "/var/run/secrets/product-license" + {{- end }} + - name: volume + mountPath: "{{ .Values.artifactory.persistence.mountPath }}" + + ######################## Artifactory persistence fs ########################## + {{- if eq .Values.artifactory.persistence.type "file-system" }} + {{- if .Values.artifactory.persistence.fileSystem.existingSharedClaim.enabled }} + {{- range $sharedClaimNumber, $e := until (.Values.artifactory.persistence.fileSystem.existingSharedClaim.numberOfExistingClaims|int) }} + - name: artifactory-ha-data-{{ $sharedClaimNumber }} + mountPath: "{{ tpl $.Values.artifactory.persistence.fileSystem.existingSharedClaim.dataDir $ }}/filestore{{ $sharedClaimNumber }}" + {{- end }} + - name: artifactory-ha-backup + mountPath: "{{ $.Values.artifactory.persistence.fileSystem.existingSharedClaim.backupDir }}" + {{- end }} + {{- end }} + + ######################## Artifactory persistence nfs ########################## + {{- if eq .Values.artifactory.persistence.type "nfs" }} + - name: artifactory-ha-data + mountPath: "{{ .Values.artifactory.persistence.nfs.dataDir }}" + - name: artifactory-ha-backup + mountPath: "{{ .Values.artifactory.persistence.nfs.backupDir }}" + {{- else }} + + ######################## Artifactory persistence binarystore Xml ########################## + {{- if or (not .Values.artifactory.unifiedSecretInstallation) .Values.artifactory.persistence.customBinarystoreXmlSecret }} + - name: binarystore-xml + {{- else }} + - name: {{ include "artifactory-ha.unifiedCustomSecretVolumeName" . }} + {{- end }} + mountPath: "/tmp/etc/artifactory/binarystore.xml" + subPath: binarystore.xml + + ######################## Artifactory persistence google storage ########################## + {{- if .Values.artifactory.persistence.googleStorage.gcpServiceAccount.enabled }} + {{- if or (not .Values.artifactory.unifiedSecretInstallation) .Values.artifactory.persistence.googleStorage.gcpServiceAccount.customSecretName }} + - name: gcpcreds-json + {{- else }} + - name: {{ include "artifactory-ha.unifiedCustomSecretVolumeName" . }} + {{- end }} + mountPath: "/artifactory_bootstrap/gcp.credentials.json" + subPath: gcp.credentials.json + {{- end }} + + ######################## Artifactory ConfigMap ########################## + {{- if .Values.artifactory.configMapName }} + - name: bootstrap-config + mountPath: "/bootstrap/" + {{- end }} + + ######################## Artifactory license ########################## + {{- if or .Values.artifactory.license.secret .Values.artifactory.license.licenseKey }} + {{- if or (not .Values.artifactory.unifiedSecretInstallation) .Values.artifactory.license.secret }} + - name: artifactory-license + {{- else }} + - name: {{ include "artifactory-ha.unifiedCustomSecretVolumeName" . }} + {{- end }} + mountPath: "/artifactory_bootstrap/artifactory.cluster.license" + {{- if .Values.artifactory.license.secret }} + subPath: {{ .Values.artifactory.license.dataKey }} + {{- else if .Values.artifactory.license.licenseKey }} + subPath: artifactory.lic + {{- end }} + {{- end }} + {{- end }} + {{- if or .Values.artifactory.customVolumeMounts .Values.global.customVolumeMounts }} +{{ tpl (include "artifactory-ha.customVolumeMounts" .) . | indent 8 }} + {{- end }} + {{- if .Values.access.startupProbe.enabled }} + startupProbe: +{{ tpl .Values.access.startupProbe.config . | indent 10 }} + {{- end }} + {{- if semverCompare " + exec /opt/jfrog/artifactory/app/evidence/bin/jf-evidence start + {{- with .Values.evidence.lifecycle }} + lifecycle: +{{ toYaml . | indent 10 }} + {{- end }} + env: + - name: JF_SHARED_NODE_ID + valueFrom: + fieldRef: + fieldPath: metadata.name + {{- if or .Values.database.secrets.user .Values.database.user }} + - name: JF_SHARED_DATABASE_USERNAME + valueFrom: + secretKeyRef: + {{- if .Values.database.secrets.user }} + name: {{ tpl .Values.database.secrets.user.name . }} + key: {{ tpl .Values.database.secrets.user.key . }} + {{- else if .Values.database.user }} + {{- if not .Values.artifactory.unifiedSecretInstallation }} + name: {{ template "artifactory.fullname" . }}-database-creds + {{- else }} + name: "{{ template "artifactory.unifiedSecretPrependReleaseName" . }}-unified-secret" + {{- end }} + key: db-user + {{- end }} + {{- end }} + {{ if or .Values.database.secrets.password .Values.database.password .Values.postgresql.enabled }} + - name: JF_SHARED_DATABASE_PASSWORD + valueFrom: + secretKeyRef: + {{- if .Values.database.secrets.password }} + name: {{ tpl .Values.database.secrets.password.name . }} + key: {{ tpl .Values.database.secrets.password.key . }} + {{- else if .Values.database.password }} + {{- if not .Values.artifactory.unifiedSecretInstallation }} + name: {{ template "artifactory.fullname" . }}-database-creds + {{- else }} + name: "{{ template "artifactory.unifiedSecretPrependReleaseName" . }}-unified-secret" + {{- end }} + key: db-password + {{- else if .Values.postgresql.enabled }} + name: {{ .Release.Name }}-postgresql + key: postgresql-password + {{- end }} + {{- end }} + {{- if or .Values.database.secrets.url .Values.database.url }} + - name: JF_SHARED_DATABASE_URL + valueFrom: + secretKeyRef: + {{- if .Values.database.secrets.url }} + name: {{ tpl .Values.database.secrets.url.name . }} + key: {{ tpl .Values.database.secrets.url.key . }} + {{- else if .Values.database.url }} + {{- if not .Values.artifactory.unifiedSecretInstallation }} + name: {{ template "artifactory.fullname" . }}-database-creds + {{- else }} + name: "{{ template "artifactory.unifiedSecretPrependReleaseName" . }}-unified-secret" + {{- end }} + key: db-url + {{- end }} + {{- end }} +{{- with .Values.evidence.extraEnvironmentVariables }} +{{ tpl (toYaml .) $ | indent 8 }} +{{- end }} + ports: + - containerPort: {{ .Values.evidence.internalPort }} + name: http-evidence + - containerPort: {{ .Values.evidence.externalPort }} + name: grpc-evidence + volumeMounts: + - name: volume + mountPath: {{ .Values.artifactory.persistence.mountPath | quote }} + resources: +{{ toYaml .Values.evidence.resources | indent 10 }} + {{- if .Values.evidence.startupProbe.enabled }} + startupProbe: +{{ tpl .Values.evidence.startupProbe.config . | indent 10 }} + {{- end }} + {{- if .Values.evidence.livenessProbe.enabled }} + livenessProbe: +{{ tpl .Values.evidence.livenessProbe.config . | indent 10 }} {{- end }} {{- end }} {{- if .Values.metadata.enabled }} @@ -872,6 +966,180 @@ spec: {{ tpl .Values.observability.livenessProbe.config . | indent 10 }} {{- end }} {{- end }} + {{- if and .Values.access.enabled (not (.Values.access.runOnArtifactoryTomcat | default false)) }} + - name: {{ .Values.access.name }} + image: {{ include "artifactory-ha.getImageInfoByValue" (list . "artifactory") }} + imagePullPolicy: {{ .Values.artifactory.image.pullPolicy }} + {{- if .Values.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.containerSecurityContext "enabled" | toYaml | nindent 10 }} + {{- end }} + {{- if .Values.access.resources }} + resources: +{{ toYaml .Values.access.resources | indent 10 }} + {{- end }} + command: + - '/bin/bash' + - '-c' + - > + set -e; + {{- if .Values.access.preStartCommand }} + echo "Running custom preStartCommand command"; + {{ tpl .Values.access.preStartCommand . }}; + {{- end }} + exec /opt/jfrog/artifactory/app/access/bin/entrypoint-access.sh + {{- with .Values.access.lifecycle }} + lifecycle: +{{ toYaml . | indent 10 }} + {{- end }} + env: + {{- if and (not .Values.waitForDatabase) (not .Values.postgresql.enabled) }} + - name: SKIP_WAIT_FOR_EXTERNAL_DB + value: "true" + {{- end }} + {{- if or .Values.database.secrets.user .Values.database.user }} + - name: JF_SHARED_DATABASE_USERNAME + valueFrom: + secretKeyRef: + {{- if .Values.database.secrets.user }} + name: {{ tpl .Values.database.secrets.user.name . }} + key: {{ tpl .Values.database.secrets.user.key . }} + {{- else if .Values.database.user }} + {{- if not .Values.artifactory.unifiedSecretInstallation }} + name: {{ template "artifactory-ha.fullname" . }}-database-creds + {{- else }} + name: "{{ template "artifactory.unifiedSecretPrependReleaseName" . }}-unified-secret" + {{- end }} + key: db-user + {{- end }} + {{- end }} + {{ if or .Values.database.secrets.password .Values.database.password .Values.postgresql.enabled }} + - name: JF_SHARED_DATABASE_PASSWORD + valueFrom: + secretKeyRef: + {{- if .Values.database.secrets.password }} + name: {{ tpl .Values.database.secrets.password.name . }} + key: {{ tpl .Values.database.secrets.password.key . }} + {{- else if .Values.database.password }} + {{- if not .Values.artifactory.unifiedSecretInstallation }} + name: {{ template "artifactory-ha.fullname" . }}-database-creds + {{- else }} + name: "{{ template "artifactory.unifiedSecretPrependReleaseName" . }}-unified-secret" + {{- end }} + key: db-password + {{- else if .Values.postgresql.enabled }} + name: {{ .Release.Name }}-postgresql + key: postgresql-password + {{- end }} + {{- end }} + {{- if or .Values.database.secrets.url .Values.database.url }} + - name: JF_SHARED_DATABASE_URL + valueFrom: + secretKeyRef: + {{- if .Values.database.secrets.url }} + name: {{ tpl .Values.database.secrets.url.name . }} + key: {{ tpl .Values.database.secrets.url.key . }} + {{- else if .Values.database.url }} + {{- if not .Values.artifactory.unifiedSecretInstallation }} + name: {{ template "artifactory-ha.fullname" . }}-database-creds + {{- else }} + name: "{{ template "artifactory.unifiedSecretPrependReleaseName" . }}-unified-secret" + {{- end }} + key: db-url + {{- end }} + {{- end }} +{{- with .Values.access.extraEnvironmentVariables }} +{{ tpl (toYaml .) $ | indent 8 }} +{{- end }} + volumeMounts: + {{- if .Values.artifactory.customPersistentVolumeClaim }} + - name: {{ .Values.artifactory.customPersistentVolumeClaim.name }} + mountPath: {{ .Values.artifactory.customPersistentVolumeClaim.mountPath }} + {{- end }} + {{- if .Values.artifactory.customPersistentPodVolumeClaim }} + - name: {{ .Values.artifactory.customPersistentPodVolumeClaim.name }} + mountPath: {{ .Values.artifactory.customPersistentPodVolumeClaim.mountPath }} + {{- end }} + {{- if .Values.aws.licenseConfigSecretName }} + - name: awsmp-product-license + mountPath: "/var/run/secrets/product-license" + {{- end }} + - name: volume + mountPath: "{{ .Values.artifactory.persistence.mountPath }}" + + ######################## Artifactory persistence fs ########################## + {{- if eq .Values.artifactory.persistence.type "file-system" }} + {{- if .Values.artifactory.persistence.fileSystem.existingSharedClaim.enabled }} + {{- range $sharedClaimNumber, $e := until (.Values.artifactory.persistence.fileSystem.existingSharedClaim.numberOfExistingClaims|int) }} + - name: artifactory-ha-data-{{ $sharedClaimNumber }} + mountPath: "{{ tpl $.Values.artifactory.persistence.fileSystem.existingSharedClaim.dataDir $ }}/filestore{{ $sharedClaimNumber }}" + {{- end }} + - name: artifactory-ha-backup + mountPath: "{{ $.Values.artifactory.persistence.fileSystem.existingSharedClaim.backupDir }}" + {{- end }} + {{- end }} + + ######################## Artifactory persistence nfs ########################## + {{- if eq .Values.artifactory.persistence.type "nfs" }} + - name: artifactory-ha-data + mountPath: "{{ .Values.artifactory.persistence.nfs.dataDir }}" + - name: artifactory-ha-backup + mountPath: "{{ .Values.artifactory.persistence.nfs.backupDir }}" + {{- else }} + + ######################## Artifactory persistence binarystore Xml ########################## + {{- if or (not .Values.artifactory.unifiedSecretInstallation) .Values.artifactory.persistence.customBinarystoreXmlSecret }} + - name: binarystore-xml + {{- else }} + - name: {{ include "artifactory-ha.unifiedCustomSecretVolumeName" . }} + {{- end }} + mountPath: "/tmp/etc/artifactory/binarystore.xml" + subPath: binarystore.xml + + ######################## Artifactory persistence google storage ########################## + {{- if .Values.artifactory.persistence.googleStorage.gcpServiceAccount.enabled }} + {{- if or (not .Values.artifactory.unifiedSecretInstallation) .Values.artifactory.persistence.googleStorage.gcpServiceAccount.customSecretName }} + - name: gcpcreds-json + {{- else }} + - name: {{ include "artifactory-ha.unifiedCustomSecretVolumeName" . }} + {{- end }} + mountPath: "/artifactory_bootstrap/gcp.credentials.json" + subPath: gcp.credentials.json + {{- end }} + + + ######################## Artifactory license ########################## + {{- if or .Values.artifactory.license.secret .Values.artifactory.license.licenseKey }} + {{- if or (not .Values.artifactory.unifiedSecretInstallation) .Values.artifactory.license.secret }} + - name: artifactory-license + {{- else }} + - name: {{ include "artifactory-ha.unifiedCustomSecretVolumeName" . }} + {{- end }} + mountPath: "/artifactory_bootstrap/artifactory.cluster.license" + {{- if .Values.artifactory.license.secret }} + subPath: {{ .Values.artifactory.license.dataKey }} + {{- else if .Values.artifactory.license.licenseKey }} + subPath: artifactory.lic + {{- end }} + {{- end }} + {{- end }} + {{- if or .Values.artifactory.customVolumeMounts .Values.global.customVolumeMounts }} +{{ tpl (include "artifactory-ha.customVolumeMounts" .) . | indent 8 }} + {{- end }} + {{- if .Values.access.startupProbe.enabled }} + startupProbe: +{{ tpl .Values.access.startupProbe.config . | indent 10 }} + {{- end }} + {{- if semverCompare " --from-literal=license_token=${TOKEN} --from-literal=iam_role=${ROLE_ARN}` aws: @@ -252,13 +250,12 @@ containerSecurityContext: drop: - ALL ## The following router settings are to configure only when splitServicesToContainers set to true -## splitServicesToContainers (by default it is false) router: name: router image: registry: releases-docker.jfrog.io repository: jfrog/router - tag: 7.105.1 + tag: 7.118.0 pullPolicy: IfNotPresent serviceRegistry: ## Service registry (Access) TLS verification skipped if enabled @@ -272,16 +269,16 @@ router: # - name: MY_ENV_VAR # value: "" resources: {} - # requests: - # memory: "100Mi" - # cpu: "100m" - # limits: - # memory: "1Gi" - # cpu: "1" - - # Add lifecycle hooks for router container + # requests: + # memory: "100Mi" + # cpu: "100m" + # limits: + # memory: "1Gi" + # cpu: "1" + + ## Add lifecycle hooks for router container lifecycle: - # From Artifactory versions 7.52.x, Wait for Artifactory to complete any open uploads or downloads before terminating + ## From Artifactory versions 7.52.x, Wait for Artifactory to complete any open uploads or downloads before terminating preStop: exec: command: ["sh", "-c", "while [[ $(curl --fail --silent --connect-timeout 2 http://localhost:8081/artifactory/api/v1/system/liveness) =~ OK ]]; do echo Artifactory is still alive; sleep 2; done"] @@ -289,11 +286,10 @@ router: # exec: # command: ["/bin/sh", "-c", "echo Hello from the postStart handler"] ## Add custom volumesMounts - customVolumeMounts: "" - # - name: custom-script - # mountPath: /scripts/script.sh - # subPath: script.sh - + customVolumeMounts: | + # - name: custom-script + # mountPath: /scripts/script.sh + # subPath: script.sh livenessProbe: enabled: true config: | @@ -334,15 +330,15 @@ router: timeoutSeconds: {{ .Values.probes.timeoutSeconds }} persistence: mountPath: "/var/opt/jfrog/router" -# Artifactory +## Artifactory artifactory: name: artifactory-ha - # Note that by default we use appVersion to get image tag/version + ## Note that by default we use appVersion to get image tag/version ## refer - https://www.jfrog.com/confluence/display/JFROG/Access+Federation#AccessFederation-EstablishingtheCircleofTrust ## root certificates added will be copied to $JFROG_HOME/artifactory/var/etc/access/keys/trusted folder. circleOfTrustCertificatesSecret: - # unifiedSecretInstallation flag enables single unified secret holding all the artifactory-ha internal(chart) secrets, It won't be affecting external secrets. + ## unifiedSecretInstallation flag enables single unified secret holding all the artifactory-ha internal(chart) secrets, It won't be affecting external secrets. ## Note: unifiedSecretInstallation flag is enabled by true by default from chart version 107.78.x, Users can switch to false to continue with the old way of secret creation. unifiedSecretInstallation: true ## unifiedSecretPrependReleaseName Set this flag to false if unifiedSecret should not be created with prepended. @@ -354,8 +350,8 @@ artifactory: pullPolicy: IfNotPresent ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ schedulerName: - # Create a priority class for the Artifactory pods or use an existing one - # NOTE - Maximum allowed value of a user defined priority is 1000000000 + ## Create a priority class for the Artifactory pods or use an existing one + ## NOTE - Maximum allowed value of a user defined priority is 1000000000 priorityClass: create: false value: 1000000000 @@ -363,7 +359,7 @@ artifactory: # name: ## Use an existing priority class # existingPriorityClass: - # Delete the db.properties file in ARTIFACTORY_HOME/etc/db.properties + ## Delete the db.properties file in ARTIFACTORY_HOME/etc/db.properties deleteDBPropertiesOnStartup: true database: maxOpenConnections: 80 @@ -374,14 +370,15 @@ artifactory: maxThreads: 200 sendReasonPhrase: false extraConfig: 'acceptCount="400"' - # certificates added to this secret will be copied to $JFROG_HOME/artifactory/var/etc/security/keys/trusted directory + ## certificates added to this secret will be copied to $JFROG_HOME/artifactory/var/etc/security/keys/trusted directory customCertificates: enabled: false # certificateSecretName: - # Support for open metrics is only available for Artifactory 7.7.x (appVersions) and above. - # To enable set `.Values.artifactory.openMetrics.enabled` to `true` - # Refer - https://www.jfrog.com/confluence/display/JFROG/Open+Metrics - openMetrics: + ## Support for metrics is only available for Artifactory 7.7.x (appVersions) and above. + ## To enable set `.Values.artifactory.metrics.enabled` to `true` + ## Note: Depricated `openMetrics` as part of 7.87.x and renamed to `metrics` + ## Refer - https://www.jfrog.com/confluence/display/JFROG/Open+Metrics + metrics: enabled: false ## Settings for pushing metrics to Insight - enable filebeat to true filebeat: @@ -395,30 +392,30 @@ artifactory: url: "Elasticsearch url where JFrog Insight is installed For example, http://:8082" username: "" password: "" - # Support for Cold Artifact Storage - # set 'coldStorage.enabled' to 'true' only for Artifactory instance that you are designating as the Cold instance - # Refer - https://jfrog.com/help/r/jfrog-platform-administration-documentation/setting-up-cold-artifact-storage + ## Support for Cold Artifact Storage + ## set 'coldStorage.enabled' to 'true' only for Artifactory instance that you are designating as the Cold instance + ## Refer - https://jfrog.com/help/r/jfrog-platform-administration-documentation/setting-up-cold-artifact-storage coldStorage: enabled: false - # This directory is intended for use with NFS eventual configuration for HA - # When enabling this section, The system.yaml will include haDataDir section. - # The location of Artifactory Data directory and Artifactory Filestore will be modified accordingly and will be shared among all nodes. - # It's recommended to leave haDataDir disabled, and the default BinarystoreXml will set the Filestore location as configured in artifactory.persistence.nfs.dataDir. + ## This directory is intended for use with NFS eventual configuration for HA + ## When enabling this section, The system.yaml will include haDataDir section. + ## The location of Artifactory Data directory and Artifactory Filestore will be modified accordingly and will be shared among all nodes. + ## It's recommended to leave haDataDir disabled, and the default BinarystoreXml will set the Filestore location as configured in artifactory.persistence.nfs.dataDir. haDataDir: enabled: false path: haBackupDir: enabled: false path: - # Files to copy to ARTIFACTORY_HOME/ on each Artifactory startup - # Note : From 107.46.x chart versions, copyOnEveryStartup is not needed for binarystore.xml, it is always copied via initContainers + ## Files to copy to ARTIFACTORY_HOME/ on each Artifactory startup + ## Note : From 107.46.x chart versions, copyOnEveryStartup is not needed for binarystore.xml, it is always copied via initContainers copyOnEveryStartup: - # # Absolute path - # - source: /artifactory_bootstrap/artifactory.cluster.license - # # Relative to ARTIFACTORY_HOME/ - # target: etc/artifactory/ + ## Absolute path + # - source: /artifactory_bootstrap/artifactory.cluster.license + ## Relative to ARTIFACTORY_HOME/ + # target: etc/artifactory/ - # Sidecar containers for tailing Artifactory logs + ## Sidecar containers for tailing Artifactory logs loggers: [] # - access-audit.log # - access-request.log @@ -438,132 +435,127 @@ artifactory: # - router-traefik.log # - derby.log - # Loggers containers resources + ## Loggers containers resources loggersResources: {} - # requests: - # memory: "10Mi" - # cpu: "10m" - # limits: - # memory: "100Mi" - # cpu: "50m" - - # Sidecar containers for tailing Tomcat (catalina) logs + # requests: + # memory: "10Mi" + # cpu: "10m" + # limits: + # memory: "100Mi" + # cpu: "50m" + + ## Sidecar containers for tailing Tomcat (catalina) logs catalinaLoggers: [] # - tomcat-catalina.log # - tomcat-localhost.log - # Tomcat (catalina) loggers resources + ## Tomcat (catalina) loggers resources catalinaLoggersResources: {} - # requests: - # memory: "10Mi" - # cpu: "10m" - # limits: - # memory: "100Mi" - # cpu: "50m" - - # Migration support from 6.x to 7.x + # requests: + # memory: "10Mi" + # cpu: "10m" + # limits: + # memory: "100Mi" + # cpu: "50m" + + ## Migration support from 6.x to 7.x. migration: - enabled: true + enabled: false timeoutSeconds: 3600 ## Extra pre-start command in migration Init Container to install JDBC driver for MySql/MariaDb/Oracle - # preStartCommand: "mkdir -p /opt/jfrog/artifactory/var/bootstrap/artifactory/tomcat/lib; cd /opt/jfrog/artifactory/var/bootstrap/artifactory/tomcat/lib && curl -o /opt/jfrog/artifactory/var/bootstrap/artifactory/tomcat/lib/mysql-connector-java-5.1.41.jar https://jcenter.bintray.com/mysql/mysql-connector-java/5.1.41/mysql-connector-java-5.1.41.jar" + # preStartCommand: "mkdir -p /opt/jfrog/artifactory/var/bootstrap/artifactory/tomcat/lib; cd /opt/jfrog/artifactory/var/bootstrap/artifactory/tomcat/lib && curl -o /opt/jfrog/artifactory/var/bootstrap/artifactory/tomcat/lib/mysql-connector-java-5.1.41.jar https://repo1.maven.org/maven2/mysql/mysql-connector-java/5.1.41/mysql-connector-java-5.1.41.jar" ## Add custom init containers execution before predefined init containers - customInitContainersBegin: "" - # - name: "custom-setup" - # image: {{ include "artifactory-ha.getImageInfoByValue" (list . "initContainers") }} - # imagePullPolicy: {{ .Values.initContainers.image.pullPolicy }} - # securityContext: - # runAsNonRoot: true - # allowPrivilegeEscalation: false - # capabilities: - # drop: - # - NET_RAW - # command: - # - 'sh' - # - '-c' - # - 'touch {{ .Values.artifactory.persistence.mountPath }}/example-custom-setup' - # volumeMounts: - # - mountPath: "{{ .Values.artifactory.persistence.mountPath }}" - # name: volume - + customInitContainersBegin: | + # - name: "custom-setup" + # image: {{ include "artifactory-ha.getImageInfoByValue" (list . "initContainers") }} + # imagePullPolicy: {{ .Values.initContainers.image.pullPolicy }} + # securityContext: + # runAsNonRoot: true + # allowPrivilegeEscalation: false + # capabilities: + # drop: + # - NET_RAW + # command: + # - 'sh' + # - '-c' + # - 'touch {{ .Values.artifactory.persistence.mountPath }}/example-custom-setup' + # volumeMounts: + # - mountPath: "{{ .Values.artifactory.persistence.mountPath }}" + # name: volume ## Add custom init containers ## Add custom init containers execution after predefined init containers - customInitContainers: "" - # - name: "custom-systemyaml-setup" - # image: {{ include "artifactory-ha.getImageInfoByValue" (list . "initContainers") }} - # imagePullPolicy: {{ .Values.initContainers.image.pullPolicy }} - # securityContext: - # runAsNonRoot: true - # allowPrivilegeEscalation: false - # capabilities: - # drop: - # - NET_RAW - # command: - # - 'sh' - # - '-c' - # - 'curl -o {{ .Values.artifactory.persistence.mountPath }}/etc/system.yaml https:///systemyaml' - # volumeMounts: - # - mountPath: "{{ .Values.artifactory.persistence.mountPath }}" - # name: volume - + customInitContainers: | + # - name: "custom-systemyaml-setup" + # image: {{ include "artifactory-ha.getImageInfoByValue" (list . "initContainers") }} + # imagePullPolicy: {{ .Values.initContainers.image.pullPolicy }} + # securityContext: + # runAsNonRoot: true + # allowPrivilegeEscalation: false + # capabilities: + # drop: + # - NET_RAW + # command: + # - 'sh' + # - '-c' + # - 'curl -o {{ .Values.artifactory.persistence.mountPath }}/etc/system.yaml https:///systemyaml' + # volumeMounts: + # - mountPath: "{{ .Values.artifactory.persistence.mountPath }}" + # name: volume ## Add custom sidecar containers - # - The provided example uses a custom volume (customVolumes) - # - The provided example shows running container as root (id 0) - customSidecarContainers: "" - # - name: "sidecar-list-etc" - # image: {{ include "artifactory-ha.getImageInfoByValue" (list . "initContainers") }} - # imagePullPolicy: {{ .Values.initContainers.image.pullPolicy }} - # securityContext: - # runAsNonRoot: true - # allowPrivilegeEscalation: false - # capabilities: - # drop: - # - NET_RAW - # command: - # - 'sh' - # - '-c' - # - 'sh /scripts/script.sh' - # volumeMounts: - # - mountPath: "{{ .Values.artifactory.persistence.mountPath }}" - # name: volume - # - mountPath: "/scripts/script.sh" - # name: custom-script - # subPath: script.sh - # resources: - # requests: - # memory: "32Mi" - # cpu: "50m" - # limits: - # memory: "128Mi" - # cpu: "100m" - + ## - The provided example uses a custom volume (customVolumes) + ## - The provided example shows running container as root (id 0) + customSidecarContainers: | + # - name: "sidecar-list-etc" + # image: {{ include "artifactory-ha.getImageInfoByValue" (list . "initContainers") }} + # imagePullPolicy: {{ .Values.initContainers.image.pullPolicy }} + # securityContext: + # runAsNonRoot: true + # allowPrivilegeEscalation: false + # capabilities: + # drop: + # - NET_RAW + # command: + # - 'sh' + # - '-c' + # - 'sh /scripts/script.sh' + # volumeMounts: + # - mountPath: "{{ .Values.artifactory.persistence.mountPath }}" + # name: volume + # - mountPath: "/scripts/script.sh" + # name: custom-script + # subPath: script.sh + # resources: + # requests: + # memory: "32Mi" + # cpu: "50m" + # limits: + # memory: "128Mi" + # cpu: "100m" ## Add custom volumes - # If .Values.artifactory.unifiedSecretInstallation is true then secret name should be '{{ template "artifactory.unifiedSecretPrependReleaseName" . }}-unified-secret'. - customVolumes: "" - # - name: custom-script - # configMap: - # name: custom-script - + ## If .Values.artifactory.unifiedSecretInstallation is true then secret name should be '{{ template "artifactory.unifiedSecretPrependReleaseName" . }}-unified-secret'. + customVolumes: | + # - name: custom-script + # configMap: + # name: custom-script ## Add custom volumesMounts - customVolumeMounts: "" - # - name: custom-script - # mountPath: "/scripts/script.sh" - # subPath: script.sh - # - name: posthook-start - # mountPath: "/scripts/posthoook-start.sh" - # subPath: posthoook-start.sh - # - name: prehook-start - # mountPath: "/scripts/prehook-start.sh" - # subPath: prehook-start.sh - - # Add custom persistent volume mounts - Available to the entire namespace + customVolumeMounts: | + # - name: custom-script + # mountPath: "/scripts/script.sh" + # subPath: script.sh + # - name: posthook-start + # mountPath: "/scripts/posthoook-start.sh" + # subPath: posthoook-start.sh + # - name: prehook-start + # mountPath: "/scripts/prehook-start.sh" + # subPath: prehook-start.sh + ## Add custom persistent volume mounts - Available to the entire namespace customPersistentVolumeClaim: {} - # name: - # mountPath: - # accessModes: + # name: + # mountPath: + # accessModes: # - "-" - # size: - # storageClassName: + # size: + # storageClassName: ## Artifactory HA requires a unique master key. Each Artifactory node must have the same master key! ## You can generate one with the command: "openssl rand -hex 32" @@ -586,19 +578,19 @@ artifactory: ## Alternatively, you can use a pre-existing secret with a key called jfconnect-token by specifying jfConnectTokenSecretName # jfConnectTokenSecretName: - # Add custom secrets - secret per file - # If .Values.artifactory.unifiedSecretInstallation is true then secret name should be '{{ template "artifactory.unifiedSecretPrependReleaseName" . }}-unified-secret' common to all secrets + ## Add custom secrets - secret per file + ## If .Values.artifactory.unifiedSecretInstallation is true then secret name should be '{{ template "artifactory.unifiedSecretPrependReleaseName" . }}-unified-secret' common to all secrets customSecrets: - # - name: custom-secret - # key: custom-secret.yaml - # data: > - # custom_secret_config: - # parameter1: value1 - # parameter2: value2 - # - name: custom-secret2 - # key: custom-secret2.config - # data: | - # here the custom secret 2 config + # - name: custom-secret + # key: custom-secret.yaml + # data: > + # custom_secret_config: + # parameter1: value1 + # parameter2: value2 + # - name: custom-secret2 + # key: custom-secret2.config + # data: | + # here the custom secret 2 config ## If false, all service console logs will not redirect to a common console.log consoleLog: false @@ -621,25 +613,24 @@ artifactory: dataKey: ## Create configMap with artifactory.config.import.xml and security.import.xml and pass name of configMap in following parameter configMapName: - # Add any list of configmaps to Artifactory - configMaps: "" - # posthook-start.sh: |- - # echo "This is a post start script" - # posthook-end.sh: |- - # echo "This is a post end script" - + ## Add any list of configmaps to Artifactory + configMaps: | + # posthook-start.sh: |- + # echo "This is a post start script" + # posthook-end.sh: |- + # echo "This is a post end script" ## List of secrets for Artifactory user plugins. ## One Secret per plugin's files. userPluginSecrets: - # - archive-old-artifacts - # - build-cleanup - # - webhook - # - '{{ template "my-chart.fullname" . }}' + # - archive-old-artifacts + # - build-cleanup + # - webhook + # - '{{ template "my-chart.fullname" . }}' ## Extra pre-start command to install JDBC driver for MySql/MariaDb/Oracle - # preStartCommand: "mkdir -p /opt/jfrog/artifactory/var/bootstrap/artifactory/tomcat/lib; cd /opt/jfrog/artifactory/var/bootstrap/artifactory/tomcat/lib && curl -o /opt/jfrog/artifactory/var/bootstrap/artifactory/tomcat/lib/mysql-connector-java-5.1.41.jar https://jcenter.bintray.com/mysql/mysql-connector-java/5.1.41/mysql-connector-java-5.1.41.jar" + # preStartCommand: "mkdir -p /opt/jfrog/artifactory/var/bootstrap/artifactory/tomcat/lib; cd /opt/jfrog/artifactory/var/bootstrap/artifactory/tomcat/lib && curl -o /opt/jfrog/artifactory/var/bootstrap/artifactory/tomcat/lib/mysql-connector-java-5.1.41.jar https://repo1.maven.org/maven2/mysql/mysql-connector-java/5.1.41/mysql-connector-java-5.1.41.jar" - # Add lifecycle hooks for artifactory container + ## Add lifecycle hooks for artifactory container lifecycle: {} # postStart: # exec: @@ -764,8 +755,8 @@ artifactory: ## Refer: https://jfrog.com/help/r/jfrog-installation-setup-documentation/cache-fs-template-configuration maxCacheSize: 50000000000 cacheProviderDir: cache - ## maxFileSizeLimit: - ## skipDuringUpload: + # maxFileSizeLimit: + # skipDuringUpload: ## artifactory data Persistent Volume Storage Class ## If defined, storageClassName: @@ -782,13 +773,13 @@ artifactory: ## nfs ## google-storage ## google-storage-v2 - ## google-storage-v2-direct + ## google-storage-v2-direct (Recommended for GCS - Google Cloud Storage) ## aws-s3-v3 - ## s3-storage-v3-direct + ## s3-storage-v3-direct (Recommended for AWS S3) ## s3-storage-v3-archive ## azure-blob ## azure-blob-storage-direct - ## azure-blob-storage-v2-direct + ## azure-blob-storage-v2-direct (Recommended for Azure Blob Storage) type: file-system ## Use binarystoreXml to provide a custom binarystore.xml ## This is intentionally commented and below previous content of binarystoreXml is moved under files/binarystore.xml @@ -818,7 +809,7 @@ artifactory: ## cluster nodes. ## Need to have the following set nfs: - # Must pass actual IP of NFS server with '--set For artifactory.persistence.nfs.ip=${NFS_IP}' + ## Must pass actual IP of NFS server with '--set For artifactory.persistence.nfs.ip=${NFS_IP}' ip: haDataMount: "/data" haBackupMount: "/backup" @@ -849,7 +840,7 @@ artifactory: # } endpoint: commondatastorage.googleapis.com httpsOnly: false - # Set a unique bucket name + ## Set a unique bucket name bucketName: "artifactory-ha-gcp" ## GCP Bucket Authentication with Identity and Credential is deprecated. ## identity: @@ -929,8 +920,8 @@ artifactory: internalPort: 1339 externalPort: 1339 annotations: {} - # Spread Artifactory pods evenly across your nodes or some other topology - # Note this applies to both the primary and replicas + ## Spread Artifactory pods evenly across your nodes or some other topology + ## Note this applies to both the primary and replicas topologySpreadConstraints: [] # - maxSkew: 1 # topologyKey: kubernetes.io/hostname @@ -946,7 +937,7 @@ artifactory: ## Customising their resources and java parameters is done here. primary: name: artifactory-ha-primary - # preStartCommand specific to the primary node, to be run after artifactory.preStartCommand + ## preStartCommand specific to the primary node, to be run after artifactory.preStartCommand # preStartCommand: labels: {} persistence: @@ -960,12 +951,12 @@ artifactory: type: RollingUpdate ## Resources for the primary node resources: {} - # requests: - # memory: "1Gi" - # cpu: "500m" - # limits: - # memory: "2Gi" - # cpu: "1" + # requests: + # memory: "1Gi" + # cpu: "500m" + # limits: + # memory: "2Gi" + # cpu: "1" ## The following Java options are passed to the java process running Artifactory primary node. ## You should set them according to the resources set above javaOpts: @@ -992,7 +983,7 @@ artifactory: topologyKey: "kubernetes.io/hostname" node: name: artifactory-ha-member - # preStartCommand specific to the member node, to be run after artifactory.preStartCommand + ## preStartCommand specific to the member node, to be run after artifactory.preStartCommand # preStartCommand: labels: {} persistence: @@ -1005,12 +996,12 @@ artifactory: minAvailable: 1 ## Resources for the member nodes resources: {} - # requests: - # memory: "1Gi" - # cpu: "500m" - # limits: - # memory: "2Gi" - # cpu: "1" + # requests: + # memory: "1Gi" + # cpu: "500m" + # limits: + # memory: "2Gi" + # cpu: "1" ## The following Java options are passed to the java process running Artifactory member nodes. ## You should set them according to the resources set above javaOpts: @@ -1027,9 +1018,6 @@ artifactory: accessFile: passwordFile: # other: "" - # xms: "1g" - # xmx: "2g" - # other: "" nodeSelector: {} ## Wait for Artifactory primary waitForPrimaryStartup: @@ -1055,17 +1043,17 @@ frontend: # - name: MY_ENV_VAR # value: "" resources: {} - # requests: - # memory: "100Mi" - # cpu: "100m" - # limits: - # memory: "1Gi" - # cpu: "1" + # requests: + # memory: "100Mi" + # cpu: "100m" + # limits: + # memory: "1Gi" + # cpu: "1" ## Session settings session: ## Time in minutes after which the frontend token will need to be refreshed timeoutMinutes: '30' - # Add lifecycle hooks for frontend container + ## Add lifecycle hooks for frontend container lifecycle: {} # postStart: # exec: @@ -1101,6 +1089,7 @@ frontend: periodSeconds: 5 timeoutSeconds: {{ .Values.probes.timeoutSeconds }} access: + name: access enabled: true ## Enable TLS by changing the tls entry (under the security section) in the access.config.yaml file. ## ref: https://www.jfrog.com/confluence/display/JFROG/Managing+TLS+Certificates#ManagingTLSCertificates @@ -1122,6 +1111,121 @@ access: maxThreads: 50 sendReasonPhrase: false extraConfig: 'acceptCount="100"' + livenessProbe: + enabled: true + config: | + exec: + command: + - sh + - -c + - curl --fail --max-time {{ .Values.probes.timeoutSeconds }} http://localhost:8040/access/api/v1/system/liveness + initialDelaySeconds: {{ if semverCompare ".+)\.{{ include "artifactory-ha.fullname" . }} {{ include "artifactory-ha.fullname" . }} - {{- range .Values.ingress.hosts -}} - {{- if contains "." . -}} - {{ "" | indent 0 }} ~(?.+)\.{{ . }} - {{- end -}} - {{- end -}}; - if ($http_x_forwarded_proto = '') { - set $http_x_forwarded_proto $scheme; - } - set $host_port {{ .Values.nginx.https.externalPort }}; - if ( $scheme = "http" ) { - set $host_port {{ .Values.nginx.http.externalPort }}; - } - ## Application specific logs - ## access_log /var/log/nginx/artifactory-access.log timing; - ## error_log /var/log/nginx/artifactory-error.log; - rewrite ^/artifactory/?$ / redirect; - if ( $repo != "" ) { - rewrite ^/(v1|v2)/(.*) /artifactory/api/docker/$repo/$1/$2 break; - } - chunked_transfer_encoding on; - client_max_body_size 0; - location / { - proxy_read_timeout 900; - proxy_pass_header Server; - proxy_cookie_path ~*^/.* /; - proxy_pass {{ include "artifactory-ha.scheme" . }}://{{ include "artifactory-ha.fullname" . }}:{{ .Values.artifactory.externalPort }}/; - {{- if .Values.nginx.service.ssloffload}} - proxy_set_header X-JFrog-Override-Base-Url $http_x_forwarded_proto://$host; - {{- else }} - proxy_set_header X-JFrog-Override-Base-Url $http_x_forwarded_proto://$host:$host_port; - proxy_set_header X-Forwarded-Port $server_port; - {{- end }} - proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto; - proxy_set_header Host $http_host; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - {{- if .Values.nginx.disableProxyBuffering}} - proxy_http_version 1.1; - proxy_request_buffering off; - proxy_buffering off; - {{- end }} - add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; - - location /artifactory/ { - if ( $request_uri ~ ^/artifactory/(.*)$ ) { - proxy_pass http://{{ include "artifactory-ha.fullname" . }}:{{ .Values.artifactory.externalArtifactoryPort }}/artifactory/$1; - } - proxy_pass http://{{ include "artifactory-ha.fullname" . }}:{{ .Values.artifactory.externalArtifactoryPort }}/artifactory/; - } - location /pipelines/ { - proxy_http_version 1.1; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection "upgrade"; - proxy_set_header Host $http_host; - {{- if .Values.router.tlsEnabled }} - proxy_pass https://{{ include "artifactory-ha.fullname" . }}:{{ .Values.router.internalPort }}; - {{- else }} - proxy_pass http://{{ include "artifactory-ha.fullname" . }}:{{ .Values.router.internalPort }}; - {{- end }} - } - } - } + ## The nginx main conf was moved to files/nginx-main-conf.yaml. This key is commented out to keep support for the old configuration + # mainConf: | + + ## The nginx artifactory conf was moved to files/nginx-artifactory-conf.yaml. This key is commented out to keep support for the old configuration + # artifactoryConf: | customInitContainers: "" customSidecarContainers: "" customVolumes: "" @@ -1710,10 +1643,10 @@ nginx: loadBalancerSourceRanges: [] ## Provide static ip address loadBalancerIP: - ## There are two available options: “Cluster” (default) and “Local”. + ## There are two available options: "Cluster" (default) and "Local". externalTrafficPolicy: Cluster labels: {} - # label-key: label-value + # label-key: label-value ## If the type is NodePort you can set a fixed port # nodePort: 32082 ## A list of custom ports to be exposed on nginx service. Follows the conventional Kubernetes yaml syntax for service ports. @@ -1733,7 +1666,7 @@ nginx: enabled: true externalPort: 443 internalPort: 8443 - # DEPRECATED: The following will be replaced by L1065-L1076 in a future release + ## DEPRECATED: The following will be replaced by L1065-L1076 in a future release # externalPortHttp: 80 # internalPortHttp: 8080 # externalPortHttps: 443 @@ -1750,7 +1683,7 @@ nginx: command: - sh - -c - - curl -s -k --fail --max-time 1 {{ include "nginx.scheme" . }}://localhost:{{ include "nginx.port" . }}/ + - curl -s -k --fail --max-time {{ .Values.probes.timeoutSeconds }} {{ include "nginx.scheme" . }}://localhost:{{ include "nginx.port" . }}/ initialDelaySeconds: {{ if semverCompare " ## If set to "-", storageClassName: "", which disables dynamic provisioning ## If undefined (the default) or set to null, no storageClassName spec is - ## set, choosing the default provisioner. (gp2 on AWS, standard on - ## GKE, AWS & OpenStack) + ## set, choosing the default provisioner. (gp2 on AWS, standard on + ## GKE, AWS & OpenStack) ## # storageClassName: "-" resources: {} - # requests: - # memory: "250Mi" - # cpu: "100m" - # limits: - # memory: "250Mi" - # cpu: "500m" + # requests: + # memory: "250Mi" + # cpu: "100m" + # limits: + # memory: "250Mi" + # cpu: "500m" nodeSelector: {} tolerations: [] affinity: {} -# Filebeat Sidecar container +## Filebeat Sidecar container ## The provided filebeat configuration is for Artifactory logs. It assumes you have a logstash installed and configured properly. filebeat: enabled: false @@ -1851,12 +1784,12 @@ filebeat: periodSeconds: 10 timeoutSeconds: 5 resources: {} - # requests: - # memory: "100Mi" - # cpu: "100m" - # limits: - # memory: "100Mi" - # cpu: "100m" + # requests: + # memory: "100Mi" + # cpu: "100m" + # limits: + # memory: "100Mi" + # cpu: "100m" filebeatYml: | logging.level: info @@ -1881,17 +1814,17 @@ filebeat: ## Use --- as a separator between multiple resources ## For an example, refer - https://github.com/jfrog/log-analytics-prometheus/blob/master/helm/artifactory-ha-values.yaml additionalResources: "" -# Adding entries to a Pod's /etc/hosts file -# For an example, refer - https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases +## Adding entries to a Pod's /etc/hosts file +## For an example, refer - https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases hostAliases: [] -# - ip: "127.0.0.1" -# hostnames: -# - "foo.local" -# - "bar.local" -# - ip: "10.1.2.3" -# hostnames: -# - "foo.remote" -# - "bar.remote" +# - ip: "127.0.0.1" +# hostnames: +# - "foo.local" +# - "bar.local" +# - ip: "10.1.2.3" +# hostnames: +# - "foo.remote" +# - "bar.remote" ## Toggling this feature is seamless and requires helm upgrade ## will enable all microservices to run in different containers in a single pod (by default it is true) diff --git a/stable/artifactory-jcr/CHANGELOG.md b/stable/artifactory-jcr/CHANGELOG.md index c552c32fa..b9d42a96b 100644 --- a/stable/artifactory-jcr/CHANGELOG.md +++ b/stable/artifactory-jcr/CHANGELOG.md @@ -1,7 +1,7 @@ # JFrog Container Registry Chart Changelog All changes to this chart will be documented in this file. -## [107.84.17] - Feb 20, 2024 +## [107.90.5] - Feb 20, 2024 * Updated `artifactory.installerInfo` content ## [107.80.0] - Feb 1, 2024 diff --git a/stable/artifactory-jcr/Chart.yaml b/stable/artifactory-jcr/Chart.yaml index 54843d171..5ae9c8012 100644 --- a/stable/artifactory-jcr/Chart.yaml +++ b/stable/artifactory-jcr/Chart.yaml @@ -1,9 +1,9 @@ apiVersion: v2 -appVersion: 7.84.17 +appVersion: 7.90.5 dependencies: - name: artifactory repository: file://charts/artifactory - version: 107.84.17 + version: 107.90.5 description: JFrog Container Registry home: https://jfrog.com/container-registry/ icon: https://raw.githubusercontent.com/jfrog/charts/master/stable/artifactory-jcr/logo/jcr-logo.png @@ -22,4 +22,4 @@ name: artifactory-jcr sources: - https://github.com/jfrog/charts type: application -version: 107.84.17 +version: 107.90.5 diff --git a/stable/artifactory-jcr/logo/jcr-logo.png b/stable/artifactory-jcr/logo/jcr-logo.png index 69e6d91bd1ddfdda2486f7c8391cd376c6364fcb..b1e312e3219a8e0bb1831976646260683f6d447f 100644 GIT binary patch literal 77047 zcmeEu_dk~X`+r?gTzW)GLWLyCDzdV!$V%CftRh(%8QFA|C@Lx=TSl^FD=V`1i0r-h z-h7Yqy67IC_YdDc;Qrx$+~ho8<2a7jF`mcsb-t39l|)mc_wCzL zs`565gP#7J>&Y8Lu3FJ6p9={MZ@eR6rhE4C!NbP$dGEU&>Y}ow18#oyFE-O$^Ej#a zIoPST+d*ihWFoLSIITrr$areGmfvB=MSEQYMLNV#bdH_QO(yuxq5tvDPxF?443B>s`;+je`Kx0S|C}24x2Gp-ssFtu_=9)$ z)06Cvbx!}E^%9Yh6{{WiA2X9vk`*(`CLH+N-u9NR!)N?IX2$fRbh3ZGvi_Gqke4ur z_0j)hW+@HKVSm1_NA|}3+bUl6CH!5gdr!O~dD%zK)UyA7{Oxiu_y3rg?(zQ18vQ@7 z{tuDRxuqT48~1NB|EG-qBdhn+7?qAF~AJ`dvxwKNe^mp3t3HJu{1{d1oBcne#Ph{(@7VP>lflE&Rc zb1gESXO0A@mKTV!Ke@G3mrv!VH&<62$3b);$E@_1Tx|~b>*?ZO1*8n<0nKk_wd-Om zV)rOTOQm9ZQjlSB8EYjQog2%_;n6Uhe2zu|n6Oc&+%()xJs152CU*Uve^~(mqlB72V6w zFZW+D(1r4+uz_jsb5abtM$OHX5GgU|4bPdt0WV;2DrXcUpWcn)@hl_Cu6peeSI zD!x^}{k2annZs_qPpy?Se%tQRr#o?_G^w@Twr&FbTaVi;BYC#08@ko{YOUTS$rhjA zOU*{}pPo$Gc-VanCmRnoGV-i9?y7a|{C!Q&s;W{}cO-pk`l~qKUE}qB4ImDc zY9cvqFc)G+if^~t@6L5s_6Tv0wDb*dR2!s6O?DG4#`A4uUO1qwvD#aXre*CG=wKS& z&Tv}Q-doglu&$TqJLC~F2)}|_O0@3#yiIRn=e(WQcOg2j!Zeq+3?){!Jy^k?T#-u6K?t9F(bxlxRb)My&B|?7Lw};vI zvHNf9ckx@#8hg?vw=Xt$w7+;Wg*3dH2kiDC#CaNvXsNN01W~r5GMr z|8;COP$5WoyQ|3E^rP+L>NfAM{^IxQzgV6L;O>8ZJGrJqC^2bB{$dun_|e_NKol&B zIc$TbD?khaYd~lewCtv@k^jBFWaFX6>HJG~{AR^t2;Q=oZ@Fscr}S>mF8!J<*Q~qu z<_WD{FW&QFhC$x}L7argU`)(2)OVUpxz4+Dl@XH3G&`OHrL@jcbS5Z&l~B97^iM8# z*XASg(u#ELj&%xNxwTh9)(Ze;HM5x;gh(WnBPGw-a>=hw>&|Q;_b(9{^`eL~s4ntR z)yMWP2fMYG#{2Wqf&>Cn3#_U4U@-CEFqDKvLNmp0xgvCaShEbz z>Y&t)j%wSLIyEJ4n=j4yPX~20HguNUDz5sIVZ1*E@SlFX9-?h2|3d6%Cooz!eb&RL zH$EhsyD)xE{y28qwSnWjH)1Z-Js9UTzxfrz4!C7n`@?I4en$hCg2EuZ6mOV z7TFJ72MTQ>sXuvgrLoA}?KMAd&Tr8w0*eb|rspViChA%WvZl&EKbj#@mfKyr)K@rX zB_ATMAe$e3R#+RUE@^5ja*n8v>RnE?~ih$&<15L7}3#V?Cg(4KMA1bh+Jo^L^zGFzs#{Y-R1Y*M4M{w z<(uHpIE9=%m_TtFuPl9hd-x4<4fw!N`+J2^=pTM%oa`C)I)V3^ZF z_=lS$82u#r)T5-+--nvq^)+3j#ly;EpqRh?PT=UH!A$d_dIjyfOyDKZ^ zXmFW6?dxZeBcntzY1XNkGsi(%eX_-7(D1_RGd|a!7G6fFzTFy|@fXao>IpV)DpfM; z)55!0BC?lvz)a=_X|BSm8_&siq>n71UGnwY>vfZ6w|w_u6NnC<*(&y@6yh{nNnftb zyfUTPEV`#BPtX$^*QX<(r=J((d+w@gF0?)8a^IL#SBW@bP0klx=zUqlS$B*po|N^K zW!A&yy)7RD*Cl&yU<9Y5aE!5J)$7y0jS^EQI0ZOv9@oNKp;MIXDM&;Jjq2SO!#+{jT{a6^qTFL9G;Eu zml^iF%Ob$tt(F2axL}n;k|2^kpQu-N1P;`+R-S{39ky*Z#Pa>Esi%X# z;UZp87*?>UI}h9WU={Mz*r}zU9`!ZF?DSe=qk9?zMCa&dXA>qKPM&OSX}cRJ()AfFQBif>tJuR-Ft24IP@Zj zkg4lguxNLcJUH7BJ;ce6ojkuE#YmP7X$^Rxj3?=fMk|9g_%-gs`hYSOdFU(Y;mk-7 z6b;S&Ok|h|<%uGo9Q+2SUl#i#(uFKEB{#=ZQ)1b(5)nV*BL3m*bqR`AO15p*b`Wdh zv)mtf9uvNZqMxJHUho=TF4cV^xqV~T>dO7V>eLsa@4^^9x5D$%oLXv$No!7Nt+SX5 zfdir=I!tX{+ffzP)7ASmPEUYr^doLQvQgxy_&@E2ql4WfIc3nk(l_3t%{}dS4f%T| zdwo_!U6ZA$_BS)xZJT@vDg1ncvJlz6U*M*L>5j|Y+xq0Ylh&KR?W^yzRiwTjWWXnZ zc!akd^EO_OnY-DwW$<$O8-ReVCbl|$wP;0dCct^K{3VXB1zkwnLwOhdWh z<#hCJ7IYSrAkH`D2Cf%-41LN(V1CU_gfu>%&P26+97J3wO|X7DczZHeJ6Sko(A9yr zV9&mzp#JiICM}PG-6+zfEEv=TRXIDT{c2;%sb6A&22aY z4eCNWtIT6n0AAENb|>FuTglRNN?<y82rX zUwD7y2E*@dlm;`8g0ig#-yGwpXrah30%NZ~fCRU#t@libgWd|sI=Y)_1VC3z&l!zI z=GUY&Ffu!t)Au~SY)h4tT`%tiG8#p8R7Bmv!c3Q=tx2oRM=j}Hvtj-Q+8>Rg2J^#E z6OP|K;+(xss``3c;Yo7DZNwzHNd$#AK2v0nG-U^=9D^OfIUvJ=tv!?GxsIIN->umb zh{O1DHGaiE`7VeZvdd{uX>OO&fH2=l@F2)L@&{pWRQ1*{F}9It(xj7W`ek#${A))I z9vVV;#Dm4WYEUM|l%`8zl(|M&jbm2}`|$uA_7r;3@b_GMKNEp@NuEwCHTb3DCxy2o zUa7OVKIRuZK~0XEM=A`K=42Uh7A9R3?G4-CIe^O6a3ee@{uE<@VmPmHN|>ruZFI8a z$Zz#MCl&+E#t>9_GW_mMf$c(fXlriT7I-v$_GN1KW?V*s1Vq=* z%C}mKhEQ;5+_ifs=>Jm!IWdhSoA&L=CuTxUSG+5^gx?c33QSj;#2Bfc#7`JJGFzPp zj|d0ydM=nVKDJ1@%L(9a%nKl zh+c{U#F_A16lvWzQ>YUHgxr{S7sp%x``NS%N5M*ik^J^DR7DV#eOAboXJGL!HNt1g zn~)^2yEG)G)68Kn8SL!<;h6=k62l%F87~=+xY96bk*`H3_rX+jLa4s{;F(0nF@uhG zR;SsNceA%BEjU=~7ZmCCqmGg!@MkZEj;VegsZ_!xIkOo^SUtjvhI8Y&dP#2-Z$Ow8 zNPW8&=8a&5J`(rjirF4A(X*!xO~D4CvlY)_R5a^6}w>qs{`qZ2U{FcVJ#{n?ssw6%iWf2 zynM!SgS=G^PJp*FR)4rVXTji>94V?B(i&v8L2cO54nL15ihz^;lG)0Yy8BW)+?i;^ zrYx||6fp%~7X!Zei3RX2GQY>`i5c?1q@TUt7{Kd&MFo*2I~feme$Z}R!{uBLqX0=u58l4Vbr7eVwULOG}h#=yjW465v_=rOt>csGT;Kooz2uU z`c}JHRFn*?Eon_2y&v_C$m+z^GLy9p5b<<>MzB9poM0pfi*%D$c&FbEjz0W|7k6O= zSRT{LoI337xc0poY&2N3U}WouN?i3ajn+`HUhZkh>*{V(*<|oIv1_k4Ay{&9YkDwZ z=mt>kfyPj8O7*;pv0fpsoj@L;n?TNP?!CI|*R*9myBYD~4ai(rgw0@NC@0zlIwVb3 z={nN|Cj8%xL#7J8i%5`rBohwiciYKX#PcE}>4V_~-}=%A3X#A@Zwz-|iPbh^@5seD zVG9Ox!=V7E^6X_KEvdck7$FJ=J-vtU!x$TH0!0HQQIDt-c&xZTl)M zxofF*AiANYR){xi$A8;D7=Svcwr42fC{ET5ga=ieI64K>)9M527$OvQtHU1fT}}sz zX+cQ!#@Lp(ek-bZ?ci1;v||jtk(FDpnzuHy@SN6anuzq?WfowS!B`cAggh7!C+4~A z{J3jXdvNt)Lp@GH{5ZSInrHMfEpPdxoq=0kIO6S0AKQU6s3 z5b5)mS*hXQ{!uEotIyX+!61ySWWvx9q6Un&`xFiYF(6lcg0F#?9P*w3#A5T3tflOo!KFGi>@xOiwQ{*=Q0b8yyFTlHP6oGRJEM zlel%;W1$Ami@7gpL#nQ|YnD-9mi}>L@`v}MVo&^5C>ZJj^LjZw)-`F;D%0OJVoz8X zYi(d4*jFr42)YPOsSf3hHiGTIE30?!&5qK_w(-P8m5GMzT1p963Wb;g4fq_@dy~Tj zFC27ToQ4KS@vCA)A-T6^)sM|H*f+Rhjc8CF_E9X&eGY>2S@RUT9RSv3D>D2zaiS^A zB6NEzWCm!VIRCieE^5LIi9r%UIg;NxptL80`2amCaQZR8grCF&RiM5qFQ)Fa{5Inv zKCzpFgWn%y$#5Ri8->)v+ILsw+u6T1<2}CY*-HuQBc3a@!eeta9J{tP54Ke)a_AyV zB7~}1sVjK0`GP5@b`Htq;85Si^7;ukH8uo?M#kO1Ep;DO7h*u!(^VF5Wa#uK>A7kB zFY+mz6dfK%U&6g)eghlCw3HmHPCNFs6AwdT#=%-*!_E?t(|P9>F0a=hNRLk|j}~5K zjU1Q4#}mNpq_=xx58<^E-hmvE4|WIkqxg@VgcKcWAK4u}U&NV%PiQ3sTvp%7ShMy> zn;U+AsX(!+T0a~YwhtRh;u>>VP-Le&NxRXO5vRs-Z;Y*Jab^1pA(5N*OuHxL5uB8- z;u(@iQPFZngU4}Goa$Sk;zg_lWX_hRzwbFEWs*ETra+yiCUmD0Td$Dto zcUx~hGj6u$_2~hXW_H2hf?Mvblg6Fa5j#bv6W-cwsk(%GbE;M~aZX+K(q5Xs9h1yz zf2Emh`@8P=(5G`@x@@iQ>&@H<*keZ*8UlH*l7vw4^Raxu#g{=O<6R);5kwK>v&l1C zA(#lnF8$G~H)09ilbsY?cV{@ixuV+F9wg&(43+#!U9z@Ii1ERFfRA5HCVb87>rj_( zcUJ63*S9IolwWuz#3gFW3#H_JI+r{1&1S>h)^&?4Vs~4idY2wG{D5&Im=1efvt8O{ z*kSt%FUvm_0-X^S@@m=u?z3X8vNss(Ww6F&+O|EfTA+70VfNA1;cZ4SG<5R3{z(#fsJw(sX9oetic z#oIC===%80XXN1jeG7|(xZK|gaj^K`96wjjhK(-^*(rQ|zd(C_P=BI_q=!_~>0X5} zt@Bt>espXe{W+_JCvr3yW63iKw)Bo})5{m0LvXm3HJkSlrs}@4e$!Y|hBEUo2h=r) zc*&t|Wh{zQfK2Ipy}~FFE#Z7udV&UX+`=GA)oUYJvLKsYL)NQvb~{*8$>{APgE0fy z4hjDy`yz((yr=GRTX&3_Q|9*6exHDfY<QU~r*73(^hqiNXEqUXQBRPsBOn&yE5Z zmjsh+8v&7(SnoZ{spnkDH9vp7J4@`SPA51q3%F~3T7L;KcbNOkhll;nCSAXU(-s=R z|At5!7mW;yu2TtH+s-V;7u77~3u!xx(ruv*#OL#xYMP4>3)A`c z`%C;TV-FL%2A#{a$&4|2t_W@xG*X@iS@Md~qo)M@6hyR|Ya8n}LPxp9T3sLeUA3B& z3k|gFfQ|r(jU1`m=4%_znv(M3kl~io8p013nEEQx`i_$M-wruF62~*1K;#-j+{!am zQ&Or=hSxO>==xFhhl@xQC~U}Npl>g)eBpgHlANfH<*+B0V6r8o?0v+cU78(QVf5Hp zzV;gHiBiax09`IHnb%WDw0vIUfm!u`s<$zsXOO0dU>>mMbXap!Q;aPVQB&q-#{ny^ ztYq}QYRN$+{N8S)`Gb)f_ zBfz8L+9TA}SOiN=dm>A;Hff@CaM)VxQqo~!L9Ufrx6DZX->HZ3ICzvAob%x}1qh*C z$B6Ei0m4*U&+VmXc^*M(gu#0?1c@Z^r+#uUZjFzmG%$!K^|H4$8=5IPJyaz5!6MV} zq^t^o#LevN&!$d`K@9uwW)}`}xTXPMmi!IqDGBvCxTxhcE9jdNxZU2_v>~C5OImv* zx#g$GZtFC3Cp;(b@mzNsZPIq}0WPT%j{^nNmZlO}40`%fy`hF;q&zcT`Wu{zxc$ph z!?80AUJ`wZIg2t0Nla#Q78FzEzEKm5S*;yI;M_c8MO_E6vz~V%3GC0M^wr1B{`>_{ z=m;%6XO?P({13znq%_*6i{`z;`C~FZXcC3<)iobfl*K{O4xCHoshDVNEH|;w(neXec2e`=vOl zqy%}D?7gWUda7OmA}s!w$E#fn3l(}?o^*Hh$+)#776?BeTPpm1x| zYA6_(V=$}PlD0bcRM_t}2RuY@;?0@)9pXCm*`r<-rj6^ecfyl~>RkitAWTGPmy8*9 zpZVoSjO~ay+}@Kd(8nEbhqp{i&`d4U?^&Wj>G0URzE^Eo5Bl$lzl){Fb}r)B$({GL zKIA`Q*mUUxD&{y~+kB31R~tA?z00DX%=o-2N;_Ms|TCG z`>N4qYvb#|09P&Q`Vj{kfLwY0-JJ64ePh z=`}?5#ggDxL_b6L&=XIP3tcvB8~^@E(*qwsUFaktuB|LuWVj*ZNO zr{H`SpO_8QMzD&!!JCN`Z1mmD^!w!Hp%``jiJ23^KE5(Xt^HK#1PhXlnk4(qFSegG<|bcS9wZ192rMeT4cMd}Rn}uoeNnp3L-+bZ11i|W z*>I>kRuEFx`71%CqI66s0H|p$_x0b@a9~blMLDsoBcNG;K&iXe&EW?PGzYQANt#c! z%`VT6h>dIdO=-pikU^_#9Sl$@*TYu=7v>w!!qTd4etEtRn@rGh`tD_`NxOjTarp;h zgoq#fkYNT9dzRld}Ajj<4eL=*XZ}Dvr&EfEpJ3jP$bDvOt=G7fig`lXQ`){ z90I7qi^Rx=vb5>>MN0}S?YrcPO%JW zl1|=%@mVyVjf%%7sEO_YY95YCZ zOtlG86>&O8han(7=#7qx#=b(kdakve5IJf}+~Zp^zzz8B_3-?RY3Sda5#BDkzCub} z=ZzHXomvI_j1x-u9v8TCo$STx7dME0GS_!@ul}42;g&2%yWDq4O_&P0mlVVjL zjCzR15)*eq%emPkvO}Qb+jrO8Q1AliM*^v1OVM&0pN&K}st2HSeK z*mElKQS}D>>R~yHoFcRbE-owr7T$W`iWxm7JPXz5e7RM5hgD4V=nb|c%|DuXQam91$?ojd3wr`FX zbu#)?u0d#ag5fU57ikldm1kkHO*B?5bXE`AA6;Pztn@2{96WeN+|&x6sIY+KlbG!Q zWD-X}_8;L2BM&AjuVsiI&9?7cW8ihHZ|;^)FNvZDgp4@_5GtmJJ&Hbg9uk~Pv+M6; zpz(K@U7ZnsBqQKRdPu~=qp}ysLc>Sib_IMl8h84^D?2IhY1mTk9^cTxenNu&qlkUA z*%eHKSL~j-pYF|ur99EuqcHkXKbGbKPV9WpD7HEL5@L(DPvM}+?X8QlbuGW1897`q z@9@DwZ9AGqDs7_N&glIZJB#^6R_Pj(v1p+>Fx5tGYgB6jc@>p*F5n-?(H4UExkOgm z0c~49%&*U0j^p&|{?d5~%aHj$oC)kq6z?xVdW9*G&Q*|7EzexZ>zsHvF-2N?YWfV} zW78Q4To)ckRtCWf-(8T%WG7Ybpuq}!J{*{4e4{`9#v!QdW$r=sq)I8$4FFL0q)RTZ z7}E1o?6K$5j{j|dFWX}w?8flSqfrF*470T!l$=(#!<)N_T=%heZYT4`mpBjuXnPM_ zusP)pG#jRB^2;64&LY@6lCwD0&q`FWns&C{gxjX!3L0IhwZ`|k21750P8ZODqW zgrO(en8+q{l+N22OIDhfJ9>2G^+b&+Kg&!Wgw2&JljTbmJbbtaJ4*}d-|3wN{)Pu5 z*>okXaD%sR)jsRxJ9L7C*28b-O78NsBmJFLRL2Cbh``MBnVFE>%PhFU=TfV7-FF<0 zyASIKsKC5XfrMnZAd3FEgIIvbQG-_IsM}8JS%4&IUSjMp_^FznXP`e z(5cV4EG!74xAbXXPV*0h=(zfxr{Xk zZk!{VKD1KZDbVC1np~7b;yPpJl)Ieh_jZ^(k-iJki11bv$#QkJp<+SO%xEs>7N|T_ z6{thW{%&|g6!Q%{_E;e4FS2q!jQ*#EoVAsx9c8T-nv|=c{-TxK)Qlsyp}U8rBRlg; z2=IgFk~=9A4uZ)ybDo~7{fs-EYd}pIGLwDt67z~c^x#U-vqOr`2a|J?NIHe}>f;W0 z%B0&{K@Ng_Ku~lbWM{_hF@xO1dUqX56D!>-nTKKxxSG)C7Ur-jkNxRm<>{Dgz28-y zXQUTieQ*E9ZeB7<`=)JEy8Jd*-gyc@8nMZQP`)}NZN(n6ykL6Qu}+y;$}i>1XDf)qpNQvni_5;Y|*tOXh&ZZwBRvLtw- z#7Z}9;fVGry&2MwUPs{kSOP$-k8SsT@^p~mkV!0jb8O>`DZhN&?MPZg_jKMbLHS2j z-jJ8a7jDFB-I{94Df-4t7W(3DtHq^cndWSG##{qCOG>Jn<#^S0k@Q=3{9>vV8cO@q zCIS|n7nX5{l+K$NlHc>6rQZ=K($9LKU2cp>=fr(uzNAxB0)Wu15*E@nh&$`ej#U$2 z$}X@rN|umS`wfiEHb_}CWo|%DL&hABQF17TcD|*7z|hfi8636`r$YcaPGvtEf{%rv zU}P8l_OS;9-_rO|WlJ1By0>?zyzmFCG`KTL{m zU93TIusMFAdo{6cv2p_uwUj$Z`t(9L8f8dv$I^TZ;P03Ta~64H??`wcMhT7S6HuN7RFV+?WJ-xP?V^Zu@flt) z%Q&q{SKaPo64|ewB7t=G&!B-)X#qU6vaZPW`;~-6T%8Vl6W#b6xso1IQTK1c#1F0^ zu`a$eBy9eJ*^rYuT_^j^`6`>51w%dG(J25p6|+7b$G3&^!Od@+ctuP0QawB|Z3)2JCYPebqGUoq z1^X7KbO*FDC6E(;mIQLein9KE;ra*tq&uwGIX1;f@jzFNM0Y13@aQ{A%i~ z2+4HS&$i671>}f@LDis0iL&juv>FZM@2T{7e8R#akpq+3@-L8jL0E2FaHP&9Mm4ZIr2jx2}G|yntxTl za@>KT9^pI?9ajP`cJr3WQSf3zrKD*V?-OeUVvZbHIa;@9uOtYMq@D%9WpTYR=Cpn4 zS#wY}WSeSgn&UVU(r<9aUu&}G$ocXM6GD!yt1MPjQa!1*UIqdwa+qcwiELkA$E9iK z7~nKD&tk?ul47W+H=w>G@@kiQNN<2Ar~c^>dXr*-Bv#COip$FWv`K7nnRfbeZ>nR$ zRfGWx>_{jrgrQ8>_FTA|OYuPdkR+M!NJ`(BNwwBRhorWBjAsgUNsux**!nZ}t z(O~fxo^A$Wvn-ypdq}0~3gYI!Yq&v__ zeiWNhcp8gSBYkv>b1C2Ncbrz@@LI$8&41l7>FVIWYwCvM_yvG6^eozs-wM|U zlCrzx&D9y7u(Oit-E1E?(Da6N4_m&2HZXLII53aH?rOWPTIHc`;86h^T`5)B2gfpe z41T^p*e3F=0OJY548uldaL05hjEe>R8s>-1PZs15zWyGpo>} zG+FL#7Bsag1>XTQM34rj5;Psuu|P(AKit%BU`*0#2tlvCqiqSNG^qe2-*vmKO*YlQ zR&xO9mH|{3^(c?o9f`?0pp6pFrc$b$Lg-bf3Ly5a z0;euQs5IKHcSW|~qN5XEGD#g0WifO$5d5yxy=_Ne)`o5l0HZ$)r}gm}e+OP1wDLW< z%I+eK46HI50tDhwg57g`yw;<|Nn#-Yg9-yCHm8B1@CwzgSS&K)@6{X&5*_!XoPWD zjw*uzEvInLsfQ1jy8+i#wuAn{ynWGgrID#nzv&l|R}qW&i(`|2g4t1RwWjm?S&?Gd zj@e{to9*!fGWnql_{_?d;BDq z$2dFJo^@6v3x+^Af0>46iVKOFI7g9($-dnQ6ttksVx_?);BzWKOK`mPEeaU|pd?@? z+>E*p{JDGG)3JT=C*FnKi7{H`V0TQ(h#dN8IIoI~@>2dD6!yS)3ypiOJXivl&amhw zuA*pza`+>iygg(!V>L@sbdM2sBnK^==a}X(DrcZnypTJ8UU=dvE>D~!V(sF!fmZS7 z5&7u%UM;zyAw!WkOu9S;PI~c&7%M1o0L3qOtfM{Bbm8bpz+-GN-H-JvNpY)vh=sBrGe=pN~cxvP%u_kM&1T;`C{Me1IldA;nrF_1usVuZ#{ERrr<;E%jr>Z|MWZMt`! zye7{SXFtZMzE5bN7IpV=GNOQb)&O{tn)>x|q+Nu4jSxe4?pHFJTkQAJld6byWFBa# zIIzq;ExhK4XS`fzCp*(VTiU4KXgTYV`yNVS3x?KmUTFlp#x#OFqh4glgfD70Kz5M zX#YD9?{me0AV?9S{G8wh8(Dto`}dYDAFHw*oB5%A&au=vfv_0~ESSu{&j00}^eK#tIjnnlsgr*CO##>e_F6QC6 zMvjaCpq)IkbZkn2Tj;sbM$a@Bsd0g%2LL| zTC-Z5jPGvZux27FAp5lnaU`FYe}V-x(`W9~mHDLNE;|X6b>p_yrzo7^$s#!(DcJpB zSwH6ykY<2nTAcdosxy8Z5%qAqw{!HQweOlUSoy{SaEg;u#x%+_@a~;G% zAhBnmFFRM4Hg9d*p|*a1HM`2i#I zb6kKrL9}z;X5eRj!ONxWyA{P%ggW?k-Px8?Q<_N~cgQi}#wf|Vq&=7Q z?f^Mw>yUc^nN&<6w7F%Asq`OlYY2}AL;L8nrSum(d`o}@qVf07T1PwfUqug`7F<8% zK>g&7D{dRW@7Kwm_OKJeDw4pxKwr0}n%_nU@nYggBJlSzCKnc@q05hs%#5oqV5QgHk1l^4`qmM3%9e6L@0L zqAc`q=OE)LwM>z%klIiU{kk^W-hC^?2B}>CaOct(FIg0CT;Q*I9rKz+VyAq~DwF5f zFQiB=R7D&J+~zn@M=!w0fUb)-nRt{zgoGr73HZ}o({-K`6@B6he`;T2C6|(g2bDBc z-;*kuBZ(K6ZtjW#ZWTgD4;Z8p7R|DCmv++UhtA##e~2^u9gyW_-PfZJak&|ww2hX| zRAP+KH%^1Hfi>v_H@?PBCM-HeBPfvZbA%1plye44$*SQvJn}CZMjt8mi zY=8@qHD1_1e=}1Hzg7jXmrz@Q8?>q_J)8Qbc-a5Q-XTweg zQdjA*sl=||ziIGpQ$~x}yv{81{=wG98}n!(Q5R>#-meQk4Y$*r*E%&dm$!IeMqvJm z{_%*i~pL<(_m|jwu(2HBIbkl`^MxqO`p8pPy8=Pfi6>M-zW@VkY;Po=I_BvJ@ zQb=>Nd^0)MF#Ksx2DNA_tscP6lR(nJyQyR}R!2QB`PEE34A{3-A``&pLI!$;v_-9_ zR!If~>;3hb0gYh(TG5QF#RjhddgQKl#m$lEN*3?>Rig`aAAytVAguCM0YAwHqDjHK zT+la*7A%tJZiRGPmh-eTpc6p+0&jCxd!Jj_S!|Y{5Y3vQ@dfuCsMJ0iO#9+*?z}(# z+uYz6v>$xt`DiS)=@$h%E$AxNnt70z@Bl6Z`S(>Q*@qGU@fY3m?)6%5hL5g`*^rFg zUBOcP2(lND{sdqStV0bv!}-o!D@jVVFDY?m84QZx8|nJe#8}_hAgJ?9Kfo#G%E$zQ z&1p6zQ{%KCPmTqWk#>L2ri9<9qb^+FU<|k&f_uFbYGSIOOGCqoy};QNA&+Lz2_TLXXZIzf(mU}sOu4o1x>j&D< z*Ss_~YZlBkya#bbL1#Dlio0gs>ON=U){G=L3*J=V-5!3v@hRsxP{Q*J6-7p3;mQk8 z!fs8Wb2P+(SC44_8({bE?mlBkW-mHKs@lvx+0tx_Fh!xp1G#Nn;3-rl$t@Va%>*wa ztbMVXj94x7F8?u_9CB`3Kcu0?(*-@4e4QRV?t;;0|dQ zl~E%ghQZ(A3Y3=WJEUxdU~&dQpU!ObmqwBPXeUL{CfFw)IyQ*waC@u57PRzRvK!ff zn$|63^0KKZiV&h|#&BU{dh)>~{0Q$!TphSO!96z~(wSNT^OouQ_FgXe2rki$2Ko8O zzD~8^xCH30?9C4+i0bk`Lg!_=_5FT4ZWl@ncV~DL)}KX@mbF9aOufC8p>H{;iOAL) zi4nEuo6S?{$!hH(AAg(H7)4n6X!{%uiKs7L`ZrPBl00zF=XsP@d3$o_>ivL+cW}tP zH#@xiZCH%^9g(2GjOj?EG>L1O_Vv`@!+7%DqQpJ87~SXjL7LW|!OR7&mdqG;{t7aj z*FvnK9Kr8s7YvT8k$)`Ew;$AxU_7}E;04+XTh*8<50prFh&c>taWV2;mFzA7mM449 z;RzgIyVsItAjiUWBcRcpTr)IiEZ$j4*M{p(*Ha^QmvCIX7dVEDPET95)2DPjIMt|e z72hP3xTyj*7we)5zq4pr9SQt`k>V%iZhdI+m>GYk(&u*Xo9H?yg5K@CKSoq%WH4=T zapD~Q>O&8i@(jK3BOo z$j&I!ZWCXb|H#_Vr>)qa4~{B8oB1H#Q6bMFHp>reks&J`G>a1|lGi2JfGB#d@{Nmh zPkQ{zy&-X?O|*%?1<@El!2#3*NbXYl@LcuZGn~sD)%e1~;MFgDZJ9oVb^bTA`4gr*YcYeIg zkY+lZ=l8GVC4>nfS=F$hR~}>&;U8&%>N9Mj^vgfw0pNvBwqR}C!Wnj9^g7J)O^~=1%-WB6RW+ za4x9ktV8s%R05^qXZ#qiY|h?s0}nc4H+B*zYIvpKlsTvj%Witbosf#~e-FdGu}`Ni z&Oht{G(v4eW#n&9!cxNBVclnn>}aqbh@k21!a!O@PQC5Km1GLYLF#4$fzNb1Qx%q=*AB$66OP%3P zE1+2v4oT^|_d<3hLU04%Lza+?P#rS35ui)-n%pBo$8_0jqWkUrt&=zeWba9$K_o;C zRB)$r5+Upp+`!v|!RjR1Cn_(6e8Z<`e|A~|?J9~oMVST?xQQ|#i6(g__N`k6@JFLM783EWSHdi`l!MLEHC_GC`KoBUk|xDNV`?QAi=Y}5TkcmGEqQHZ|#D-`aI zFJWe zICErqH+z3xUMld`X_Q6eR7adPq z0|T-o;AG+-Mc^&78OBx=5l7$rPzW?^og=j#0?RfkxgS60+$Q<60^AQ$DxkQ8@&gO1Gb^s+*B{{!>Tx9c;vhj6W! zKZ_NXg>FpuH%#*5@}J6cqhR6`w->1Oj3l7-pO>)s%}#|S|)6#ep~K*p~GL>LUe&)2mh1vQR2CjB0@i7);UgL zq67dVdxcsfE}8#Jb5aP|V~Q&(e;)nlYVP@Vu!sW)00F2)rGT&fzYg*qqu7uVY4M5Q zjEpcDhrB1+>GQ9DxovW2#xWjFSYyTYLf(4_H$2oYp0JLOUDyzU(TnVgV<~(9DP@_q9}C;&a?TZ(x%UGd3OaeN2pe76CBX^f|S!2e;=V zB>V63O6=Z3-rJ-sbg%^WzowPsm>uy=KF;Fdkr`4Y8Da^a0a%YF_@|vGi`Qt!=7S zt9R{Hdy>W5J=}!D*KBgk2;Q>x#nPTuT)aaRF#JT3^m*5O=e>_r?2g_K!YC2ik=Q|F zA(4H>bB(345c${+FW=U?e;jA%fRTbnaWP+&Nk_d9)wj*WC^UZIqoD$1A-}Y%A&K_D zztk54NJPl{a*_zLkKY|`1cS9nY{AEcBJVIC#KWq8mTnL5>_lwv%8*Pi^szlDq{M&M z)_)ZtwrQzq^|*vDbN>ih{sCy@-8F81aimRAJV1E%HF%4`$LiamC3dP@{}l7yCp~V& z76R>oMTL&yz5ws7@mAp4k2PQP{O1m%fW7A*7%MLofbe*c+cmDRXg5KKC!DuJO#hxO zgTL?tf1wu0mT{i`(x>4C9YV#UnU+AT0qTr&wI|QN9C$Pli$GmG`x! z0(MuvGJgrzqx#E+_P|%)%h*U0N%r`w-2o25|H*_aZ5A)s#co8ny{PXl7_xp6RKg_S{ITONtaEtyK+A%KQ%sInR>@)4d-x-N}DS1z`%-^H_Q$|VXuyGHb8xwPdNRepS_3fO#L%zebnM0%&a~>U)i=4S5?H4k)2olD=sq!ztEhIXIe2_9>I)sp;~Dx4*)E#H!6tb6M6Hi;kYtq!{kk*!@s_w=@S zZvpMjuc*i`fjz4wjFj6Y^?07=-_-d5DwtcfHQzmsXPa-Q2R5ZkujJcrc$^(cG(g6a zVokZfGC;y}WF6PkA$!SMzjoQ_RhYXU)2033{s>ZX(+#k-wDG}KM{Y0BaC~2I60g&o zLpJU$+v`{6tgyhKID`Bu?^>AuDR1n|3zhSip!?H#y(BkZ8LOSNrgfC`m4SHockBDH z463}y($0Yo7I!d;$FAZj;B&Ke}c<6wlF^~N+=;ISsSv@qUv&Xqw+V3Ho&EF z^j(9fdlF6pQt&*@#^rI`ePxgyeCt5)-WD-bJm-H7l|-Wx+Vam99SF~+9u^UjA20uf zqaBVx{#zo{MuAYL(D3t^9Kn;1PoJJNMcvW5n^b5`>KI)#a?6V?OkiYZz2jz8-Z1X7 z9tUAbLc&J)o*gxqB)9pw6!8_Xw&}#&RAua^cg6ZO+hqrZd(<;aXlZx!_I7v$ZYdbI zMQRIxWDJl`$Gj86-ui~zykQx#9zwHr*h{j|GD!zrb(*zyI5NX-GkOsTCRk)b>9CR$ zxL@)i9iZkT{~h4~cDSOVr50D1<*(iC?==&5Vyz-B+4rg$u4u+6!Ghvy4+cX0h4}5CDHBZ&y%mdpSyc#RC=0@NJ5gFb_P#0^)eOdT1L zneX;`%CNuQx%X0~FK)#DgpgGUQZQh+U|9xo=1YhlD2)I2M2fx9V&7${Y-{30UOMR= z#(J^awt~v{jMM-e5^w23a~9%H=z!Fi)YgRUDg{o)n*)O#;w04$_H^ZvF4y#`yJpKG z+>_v{AS@ETDyLe%pcxB4e}Ms7fBz_y=mL>`QR*!$p(llMM>M&%lPc;~PE0PvbGP~lJod%yu^9GvLU26; zQDh4oQEK5czfIvLa_4X1eD##Vh+ApuJJ-j|o+};tEcksT;F)BS6>g!(;(88!{e{~d zWIq4c-4NPws#`|M@nx26O|6_Sn@uO)Qief>Y{C=cYPC#jg&z#6I46Gv+V#f6`%QpJ4m^8tn0a;o4>w&nJ*ACvc@~7z z-Hr|%Va*izE1mpir>Ra~u<8G6K8iCZ(~%R@4^~qXMmEXk21-ACs^{XJ-i|5`j_En? ztlpp&E$!J{UtHUfAD*)d>w1E-W>ffuzm{lOFbU#C_LY2vq{2^q&tvKwop{5_wHBDL zhFn_T2MU)hn38bWU^yHiOK&8eV^?8YtnLIsXP_Fh5v0=QxD&o$6I|kQ(lu^2Xhls9AzxlRzgW1WgJ=NR zWRN-Vkx&WQN>U+}l@S`USN85!G^|Q!SSbk^WoAo}WbeJQ$8EdK`}exu zcjKJCozL(1<2=q?z2EQax?b07U9a)Hq*dX!3nzsbyA0~T*rK~nv-87zO{~-F>BbSp zAeWZ|R;0lW0TG;BsGPBb)L}T|lsc#+%^>+p6q*S1pa^SQR9G9{W7gcAV9>`PZV`ns zvKr`{XMW^P5T2ISf@d{osD-37VWgBhx{SOBrb>v$!-czKbwk7TtsK6ct)f>))ryo? z!T*hN5Y@sWFbmK^_S;|y+5Lsf%b(5XjHO)1Stw|<27v+`_W^XJVa(cN41QN`f|19j zJeGCA({rY{t-FO6X|EJ!_ZB}nS%Hh-9SEp1U27B&}vJa_GRM5^iU>A{RFT>EiYpk2ZhszE~-`gQKW?{QN>(hox+Z8rt(b zN^Fnc0TZ9UP12NiU>$KwN1nR^dA7iBZ!6=opTdEpe4as+Z(1hK(pB8xkhOCQl9gYV z2;C;Y5fI9xp1h#G4pGzxUMaOdpEPw4mQ^f05w)4ZEqylnip%6e{W-F!a5gThFUDAv z!&zX67i@`c*g<0r4Dfst%{{up_v$?m(9t;nS3@BFQ(7eEa zCP@z3heG^Vt@cBvgucP_=sA5YMvD16{E!-qtx!tlv=d383tIxSVL)#WqKB`qllrjjcj z%8R8#Pr+VYqSgH#}wWv>Kd%HW0v zDZz_jImsXC;;=N>2cX46$qZgh^}7O7cuJhC)p*R5Q2svs<#0LsTXEOE;l;_S)&<#i zi7Beva+^}GjyGcp9`Rg#IQwCM&BHMO883%yQ<*S;gp&MoJ)EtWdU|I}r2@4&KT)9| zKn=5Fw?NkjPSK`gLBna#qSTIeUZ-;%)Xqt^INI;-vJ{--vR!?qeUDaOx?Z;?HVTrF z*z(Ok-K4X(*MGXxrM;Gd+Qo5D)>CrBHoip=5t>cxTn^PFoqHc%@nRoH!%D7B!OV`a z?HuAgy-^)MB9C{0t@^5A5%MwG($iw_TVRyG7Jy*^#lbyN?|Oc$6#l>kO{R?Fl;^BZ zUCwwKt!sx@8goj?STCL6Vc|SPqfetXgS~Mc+}Pm~a}17m0FuFsleFh7&Rx!MGSGGE z7YHLL&V^?S=3O6}rccAWr%hYMVVFNi42>oA29V*3g2|Dw?J(v$wNZU)x^!&WWKKu( zOTSyYD8GioiKYNG0JQ>aG?dPB{n&z;x=h$3SqV86&0wa4>Vn|*S#Y_MujR!&tI$rI zFWc1+C}~bofPgy`as^XJA3;le5|>rc3S>%Xt_p4=)MSO-L8GCE`w$rnJaTwT*?>fb;;Z9ho$V@UYZW}s7ayOeS}S2 z?!^t0kYC>b-}P}vHphOntn%m=8O2md5oH=2#*t ziu2zr7zDy(HN-nGztqy<_*LnGuJ~!ak{}9RrgR3_A8C$PAfc~|6Le7!Kw26m_*MCM zs_NaYSXS2p-#iD1-wtw;FS+=uRdcURocPR5IEHyoAHb=Llvp4^sU$Lt+%&|K$dKVOAu{?ngYV~Hbu_xVm>M*M={}CWV;r}+P*rTfgM~P= zOX}Wi30rblNBpu;!Ikga&B!I;m8I8SYoe~xiyDwP4tV9yskuq^<&D_r1~Tz2;UW{r zK3Uq9WwExot&B}&5x>UI2l|g)sPnr!>;ddRewpeKTjBBmj=%U8)*{SJ%$y^O}8FV4xWwR!u7Q+k$Sx^#Duyt?el#-wQ|X zXS+kvdpAFxo1SL4dX*~0a#&fo|LFsgP2CJTu;*qy;DibSg^j~<+m+$f^RG1pp6AoB z6V9(?R-;a9%(TDq;ot>QMtr--PA}`N$R5wYeCqu#+@wMd_qz0piDZoYN8%}%HHH`@ zkIb>=9COB4i72N-W+SFQ8`_)VYg}@c+qcYSy1j(h?1io~W0m_6~m^-#2_5I|o++ zsS=nCvJjuW02bbr8?OcHH|f2g)l%!j=~g4{Rp-I0(@1nN;V1J&F&b$m7~}CdE@V++ zfaWn*b{Jr`R|dERozm+gtMm>NejzqD4F4>o!)c=XRQp4ihe0T7*V zkRM)_ete2K^X|BtC6O_b>Wl=ojMMM}PjM_aEGipdh~}D<&62mv;*JIov^S76u2y@QFcaUkRM}S4?ZTd7HX~5hd@Hq=6!6 zKNg*6)-c4)Sm7fm5lH$T_)a# z+Il@>oLOI=8@n}WBonRRTrhd5k(4Z0atEb}0i(x*&P;XtxXlzYkqrkjM)z_j8P<$E zol50%CU!rh<{TV0!>FLw4OF=M%yB&oMTPRtLI--i;9XDl2V}&&eExdv8vQLmI^+Q+ zVCOfE%EvIfgT^dCY>r^ywcu>m7I1z{hOf5NH!udfr1ZJOm$u{G%}=$gOT>BtDWP11 zT6}vH+8!wwZ{>)lXFd_^$cp+0Vll%Ji?NnWpU7C(CI}QjV8T!0L>*epv2J zffu|)b+g6%5Sjnz_Z1~vbga8-nS+IcC>79QUqb{BCRh3(%<%GwsLEq7y648&u|tfe zA?K`f>-F*0VVO~5rN@CW;nU!7B^X&PqBWr_1AD#+nF4-7Lho90IcGNoW8qV+3yck^ zS6VYMH{d*cEK1>YD7^X@-ZZbaX+PQd7)HACj&ONDj-NN@^|S4J8~eU!v7Sj@ZCiS<**i41S2lJA&v5P`!t48 zMIpK|;49abYNQ_J*EMwuv31OkXY6>yh{7BUx@$EtuLRBfvGq9wgRlV3?(nWxQIsU@ zK0t;RzvBw$8z0G&GuSo`qitk~@j~19-A&zF3DBtt!czD%{Nts99m9KX$Ic7ZT+5yX zoiP0(X)Rg_tpkK5#)zUQdtox&thwr^yVA^^@*KJb+fF(G zN&&nxkO<$+3sXZIiEM2CbFLUe_hw{Esp$-M zsgpZ_pEI*>VEGgU_)7_}os$g^7d$k$Wk2SflKX*17TfF14`hx|1Of^vD)Z9;ZRlP_ zc=ezVV&voLK@Cp1dLzuLoO3$l)E{5vb_*I#rk3y0zsi_CUlVs?NIWb$}Qb`T6B3q-iL{aNH% z7>al-B2*nHo;OE}dQPrEU6fbVZ)*fbojsw_I z*xKI4cCO*U+{M!nwG9-PNJSQu2Uex7pmRLJ1b#HA=rm^JC*0&$VSDS_lFJ^@Oi(q# zI)@3MJ;xFmR!}_)FKkJwO;Yn0lsq|M(PKry=6b0vLqw&QpO7Eo&Kz7tjTR5+PVmW{ z7fO)?_yM`g_p4N+uz*-!V>us#S%|9R7a{XS^@W2mquH~zaCXHVf{oMvdJ0tt4nRD( zVQpCYW)zx2L6|MaJNs;feV)mvu6Tq?OpkIDp2r+nbS|V8n-1PIs+nYUpodtG*L+6Z z-#L!+@wHEbI8=dljz1f7SC2?;HR=Nc;XQkgp+jPp4AfXuFVCSX_`Q|)EE2_ z6W)v=K@*g!AL}ddEt>fpffztJ+7eIJH%xpzN6*0dBNy^X4;c&hc%+)90!J9j=}Pw) zlrJp$$h{_Lg^N0L4-A}Kb5ms}wm2viW3)@UoZ+)x1fnC0$2JC^)Y%wJS^usM*bn^Z z>7qHB(J}|OeV2!+`<1*UWl0JMg`O@I^FU}Qh`z8llOL|a{r1W7t{$&eJP@Jv?As<7(Lm&2>+Zznu#UZ6!%xN=fzAC!yW@UZ z^*sz1=36D0E0knST|q|ZX$mGW;nhQS>w>689_NqIXJO>uM<4T&x+X5Q_3g~ajIeBY z&Nw~^|0M;*gRxQ{9e5$U(ju2wimi4rTx+xIy&+6D ztHInp_^HFj?1w@B@5cDI6H<8+zhLjhJFjZI_gPYpCYH9i4};$(ATGLn6+?PXMeB=8 zed<`~=+EU{pd?jgm?2LiGzoY?hrjd-PKN_i=sU)SZ#G+iv#=zz>3wb-SD z+C|ABkl=US;U&MD-%Fm{q{$ezy3SA1rU!x%%F*HXvDwB2yNga!Zp8{gwjx`&N#kFs zL(@i}UJS2rZ~z`cd87fleHe1nK1jrPvc7|A$5>F?_RX)}y*Aw~v?|4W4 zxEnCum;SL5Y&?izd9pq4#&(|!gs5?cch@1de#n-LQGpmT)6ZFSkq+sK zxf3szcj>??hC?Z%qC#alEjV);tYUe(Z|2S6y`^}F@gJOC+JceO7Ll_Yk@H`dC&-iV z*}>sn-puX(9D!B57dWSVe_|Y%t)hJf|GYmML#25Qv1dlRauCSkKdXR&B7PkQCv2X1 zjve}|c(22~Me7h-ShvM;&H6k#CpWAF9w!QV{!;&bklv6#>W*?ZNsTYpV zk^HX<^lu>)bggApIwNZ;VNl2mK%0k0i+N8qX3%s@Py^? z^ppU5(rg^{7Ly9Z91}sL(_S!uPOJK(PU{hJ>wl#s5EjyH;kwW{+`Z}hG*LKkB;|ii z6GeD{niJ_ObMGy@#l%VDAvY_j=6{Yil^L!tE&__F+cUbDHS7x}edt)%Xav$1Htg`iq*n7m0=N7A2VBS)>HEDrasZzeHAZSUXy#XSq(|Aco(SIjso?d$iwt+gJ z*T%+Gu)-5T&=!R z(|w5T8OVMyZuIEwXber{HA*k7Nz6eg|OiugG2w{hjW2g2D85+Xtu+L zRxwML<%CptZ6aM#zf~ZO$D`3!&=Jz;rMg!A`2pnwWE2tV8+dpc=2;W2~_Q1wt4_WkE#dtL4 zT0s+yAo%U(pb@*4j8;JwbxC`BY{c<&Ea8qYjGCo*an6BnkFbQ|4AK|n+MqAa{!w4hG!xL73R|85LpY1g zb&?1zAQ3Y7Un1lJRVk$9btg=%W_gWAc45mydUzGg0(sWY*fhZnqFu!_yNaG*(_Cq7 zV_yZ6xfQ=^BE9z}kA-g_Fb=7RTI{@P`@dw!JN!uiX%`s7>HqsQm%_@XKp_E7H-+M< z|2vcA+LV6qDSk!Ja_{y_Ud=8*?Gq*oQn>?PSFsDF;o!s|)xyXxF0l$GTdv?O!FErM zF`H)<@5T1x%Si9_g>PO3IiH)Al2pXXD1PHA$a!t?3r0>TL5p97YGHT1q>7QV;_33M zRglvk?{WkqXY{5prd2EtjO0~uA#f=m7kR?pXWjoXm~2CTbkmNqxZB|cfUn_HZb^`? z>>??_eMkwiX8bQD7`i^qKwJn;?5`b+`O4+~ zNvrUcCC5J|lFnoW*)gk_XTOBReQda73s>vbt{4ns!We3pJVVn!`0oDM14*BN5+0Is z{0+yw>&32BoQ>I=?R2rjDqfUutaY9=Vk{~PVTG9HzmJH8ZqS*UMaN}7+}Dg9KI%|x z!%y>n9X^ts!%G~lL#Rl#g5USQA97c!pECkM?=>#?DJHMtEbi~;r@;F7Ar=+Eak{bo z-_!rU1}PxT{uPVDB-U%QtRlFv)I#LNf*TD9+57%$a07x`z4l=N*gX09<_!ntxv?PH z5DKD&Cc{qrYY;7wKkG0y9=op1wN<<~tme80dk>#A6E0JsWQ95NsKb6F1T?n4^&g%2 zN?+n^6}y4BILWqb^50G+aqJW3m{TCfTn2>>%Kzw?%Luy-FLc1GU?l2uo*nZ)OBxbg zz&LXMe+`LwyeM$T-kc`BiohKdc7|i|MQY*ljsJa`xsDYz%rq!44WW)z#1}i99h9&* zp@DdpXRZw?-Uo5^Z6CuL)!;l<{NCqw3ZxQH@?vGO+MClZYIdd$a_ZMtY!4o6)#Y8H z$GL$BEj%~$B_{)m|9Fmx&Sehq1DUNns)G3ow*mfr?~S?lKKh;_rUM3(x@PsjFGJn3I!;`I!qK+W#6OZwS8lbYclq0za$M!G$fPfOR~iqdZv?fr0-uU_H#fpaubJh?k{V zD^7Eh0@j+)KR_*}1D^E11gxEUYS@VtKK;=<({z@;npH)=mPFw|L)5@F;sDgC0P6f9 zJ~!aokuyJwy_ah=IYfbl1d z2lYm)7|-9wPvO}_GnUuM!`Hj}{om}&{Xd2;7%K^m)*Ylo(&Ft|h65+}Am)*lM_HZq zD68|Y??p4ZbM(-~-idF(Yig|`0fmbGigu~cX>}w!>ip;I(;8poHwdsj2ff~BE5)OC z|1@f!#07!SeAqM#PHc$q+$b|q7|f}4*NAwM#Fd`Vc;ZwS`?sN-DSMv&(dG4X?mJLM zPAYBO$7j@irrqCQL}IWWfby~#60r)uN^c{_*@b8KK7TmGFdw=#ocHhfI8EX6RG_>% zA>-XzwbM;8LKwEw!mT~@ydKnv3GCGdB~bD~;QX2VX0+SV-?LM>sJuW8L{anL2}NkN zFQnM!b>44t<8<}H&UZ;ZvSFeQm;062xA*o1W3NRZ~kUikJd-ut>z$qE|iYz(C5stZh>{e?qOH9-^vz&Jv>cTvGtMZ1M;T^1(BM0ZUVip~cPXgiiq0o$%>-f#a_MVKx1)qCd7H7~I32*ZbKZKFAKr^F zgZI)DRixen55MQsBOas>8gUc9@jjw-FLrXK&#meb9!m?I*JPZ zN=V`DCyDLbB@fsxY>4`J>HSdl@RRqvx$9CezvU7V47nHR{=8`@&uZX5HB3u@2zq%S z?ZwWu)+>9|vsJ(33QI064=Af(iOv+LN^dBN8A2)ZM6l609)*$*P{-iS#o^B_Pmf6ZglXLXZd;BI4#bwYTv9%W~?S<|%TRCv3b*fFvQC|p$*i`oFB}Z@Vm62{!`gaGh91WD4#9beG z3Kx?jn4*hQ^=7CX%IS*O^!}t)8u`!_;ht+Qd5+&Q!=iXWPr*BTp#=NcUqQh@#t0Bi z?I+gCwg?)swdwT;KbhNwp$um2ehL)H%DXd9x>~Uk8rl-pT-5@u=78E8zQnw?76`qX zbSP*wRuPwyY6}`{>1FGdo(dS`SlQUT^z3Os41*N~%ZB=7A{rts)xpJkypsr0q)n+$ zNw^f#w%dorUP`0r2nnz=9x=&fpQo_D`AF#A+PL`Ve*^;13s3oNCj;m79aeAyU0F_k zU5!{b$Uc<95_K?x%gccK6J8k&ry@*w`Y*Es7xjSG)Y#tI)~ujfPkgN!az_9N9X2Er zA=JTrT99YuvA5gj4`lQfVN_-19q&xjZ~JyOFt4whBAS(|zX378|0>UMW(VKF3St)f zl$wgnh;W)&^qNgu)~v*Y?l`K1esW6`K5`#I@xeaz9|B=`s8_yg77h&4(|1-UX=pxb z&n9*3=K8adu!xT_F{tjH9+b4=9f0%mfmyNyL;E)+>ez}h?V(y)c)%{p{1|;!I${(^ zm8Nt7Rr6wg)X(}Tc`nPEW+IdDtx1oH{gT368~0-^i{v^`DC5lR<&HWg#DKh`A#n+) zWn;3b#nFRoPQp3*k(oBmzKoD1Q@Eb<w@2tcCgKnWy9JA*! zL@soV>*@N;R3MjesLK;qUE2zZ9o_ppFh!;s+~1-8SS-pa*6s2S$CVT4%nt zTFG$n4^WCjTJ*)ux1?<7ze}2uUTK)``80F#mGQ=k#c1@SVU$$E z$C?|U)|L9;I$0a;15Q_`-!xeaK~db2AQCpdQ#mAfMg>pbCZ*8o8&+wDyLmThPpkVatM{JQo>7=%4cPsAr<-b+SZ&U^HHU& zlIPidEB!$#R!0r7i>$wIIASy^AmTQUG)3fS8=q(kIw3ar@J>7n4iy7vT}z-r%b|qo zPij#nl+TE8hv!x_H1FmU!BA_j_uMcdlI=W{|H%A0RF7Fte5j#jiAOsk9dQ^$(THA| zAE_O%G|vt^5vFAVbb8^v{uW+X-|!cx?rRQ*3Qq{e-QFG%iE;EE7$9ilc~lxlx=Bwc zSLO%%De2%qfz~N*>J{`BDk~S`&cZqavM5gbcO~eo41(sLkU}$Nl0n-NMf9$N?%`3l z?ZXLBrlYMfb$*mc`PFeKs5+dytd^J)7;cZ1_`_XLWKqSIW#WFLSo@445OnYinOfK_ z@MAU`wm;P9jA3l(UEa>GKWA<3EZ=vo3G2E;UO!Lo$%r#BW-YAIWaiS#>^`_jx=i5{ z#5JO6aufR2pPI|DXk5;q#_ByOcLO)r5|7Vf7d(6ht154^F=^x*Y*&EwRKiy>^;TP* z1eyuBCUA-R{Eu;(k*XS2iO@vj056*0PrdwH4t4Z?idD$Wi?Z*aA6=OI)Ssb=Xoyw2 zwH^;IC0&bL21<7`>)QQdBEXd2TC;hQ^P%F*c%>)nBP;4GTdYj@TJsL;dOOLhlyoJhRmyD~h3yIK@6vwJYF2YM3 zsJE4`>R|r6A1&gO)GjVnPZZtkg0mXZ#}-vqjAAfT)C{=?o;inz>u61=zQ2e0WoH;T zax{sP)fN|AZ6%cabVMbr>sfA}@YCLYh8R z<9Ov7&N-dWv`;yUB1=4FH23GKkoV&u=p3J!|7-CjHn4uQcCs<{Y-M3oB$ zCv>-EUz)N1$5^h83R+lC)$b@xY$qY1UPnli#xhNq!w=BpG z5O9kKPDSyKNg4$T>?Kq=slmAhp}$6)f#2SKY-WbC8ymd1>st%`*$CG|D;}P*X`2s@ zddj~w2NTE+ke>jD?ao*q)nVjjF0RS<$N`PvR5jJUL}o7`klsZzaXo$U8!Ns{>HzAw zxFPKg3+@f0Lbop9oZvUFs8h=Gtp~MPUR|)J$)Xv3DtaI)OztFqsND)%j@e>by-O3t{2R#w6vF)uYze!GvJ=o zPSXeqAbJWooDD(Na`FrCcUSKVrd#zCc33P2ywIg`bDCIhoU1a8mG~}$$1yX!#*7th z^+|AphVeBW#uC6APUO?GOJp==T47_mvh;cESN_8Lt!%-!S3< zoZRXiLkFUVBWvV&L_9pJzE}LSP%HTf0 zGE_s^52GW~G5GDtF5Ik^%amY7ADHXQ@c zQvhAlP%M`hML0S6xTUlxUS8lA&qTgxmEbVI5i!6KVzi=QzMjqKRf4P&~-V(t~|9ofe)$_8~s;qcuHiL zX@oZ1O~7oOF1&N2!hR15EasnsKe$QE#n*gq=-7O$lg58}={1dZ-gcRYsq{h5A1k{6 zx`e4hqXVn*;DFaI(`*~vuf4IM{C#~>omZRx`uPaxc&%Blo9=FC5gL4tG#WoVxigIL zv+Ffie44kKA1ITzJD&a+I%y{^F$+AOh48$@$HpxfR*^pN=-%nZUk&0sQ;({eV?SBO zvzmqaE>9O&T%EtlZ&Op=@k+hlHqr!R1*91&*WP#sYdjkWzxiogy?>lIZ_#Ezl1NqJ zoRg^?c)&uC*t&e3#2IA34HA-fegRx;b@*s#T>{5irSuQ&5Q7zko=p}4mqi%^vR+h) z^w_nY(z+n@@gg*aNa6BAAa17jxy1uFa8MTZ7=;4ALqh8xaE1;&e)iFg^<&4`Gk#g{d!pJYc^3|9FB)iH zx~(;9YPwRGGr%eZ-Doe|&dPYE-wT2-V_g>m(Rtlyl)ErWdUTHc8~{Bw7@RGopv!Fdg}Oc{N!@fvOdn%-A{c*bLxzk@)Es1TlgG0Gd&OCsV-re38IABIYc+?2r=8E==x%T=|a-lJ|cltE`wWA^80L7mh zf3zriBSyVr;Mgw=nxf8i+5rGPSO54tGHmB3%bBm4nP;R95g)Zny^GWAf;^Ubn`-1G z>@ldmSFaN}nhdXSA)Qh9qFrkda50DTVz%C-M8~163n73)B9fk?4|&$l1kxoh2t?#P zThlKTk_n|Ps;badY20cnnB~^cJSO!tXHtpG-Xb?AA?|oOwoA~gP(F{{V$%&q*~y{S z*@Ot+Sr$&cyd6i=wvspzPW61>64YM!2uKEE(6wf+!vysuC6UA~M`}F3=SO+vf`X|Dob1~Iu1#}N^EqB&MZ5o@^yw}lPNVm2P zQ6iq-H(#){e$O4d;)-5uO;WAgE0Nr^SM~lC>*KFQlS_A0eu zJ##qLXUp*pc!+|=l^52AHAQ|lxJzY1kGcjjHQk0j*~YskOy?AUPh490xhs=zOB)K% zVCQyMcXBPPm1Y685)$a!#WsTq+T5)vdM6)>CgSkyz45x1P|fm#Hz<)6T6UDa2^(RE zC0UL}mVbaw!SbAh1PdK|8EQ5*s&q@JK5VcJ96&uOSeK#+VbB!22I?_#*1MG)@F&6W z%il2>_oA<^Tfc~`_>N;+ z=V$bT>wgY~N@Zp`)ixr9vmG5{3W~FWqrp5x&7?Zf;+lpnMEf}3@%!yKV5|3~PlClm z;VgE)E$Z7AF1qpyW`?hmF0$_-L_3x8BHKYlOg+LikUMVNqEdw524vOms)6uI>v@1w zdV~$0Mxnt}_`N~0Jx3hc8TjH8>v||%tV-nKT*nnMCyWGEW<8fHikTx%BM#(v1XQS2 zx`2+5f8mONtA1cM7}H%yF|xbDK5f=Kz-W@IRk|lq3CY)ExB@;wQON~vH3yaKR3Hu$ zViK_vhfm1Zc~QHrJJ3CEY~fzQW&~=Fx&LUc@WNpj?{I<|6*r2#@NO!tPPGFt1RFzw z-scCT-e1y#i0WJ5l)!UMg=+Mo9`r=^3(H4)$7yCyLQBQWm<96Uuuq~VLHVIbV&7mx z2)ghKh;?&Xc8Ec8){SDFErb#6G+fy`GBs z-66Cazosnxz3r4cCcl4d<*aw%JDd1W_r<(5MVyI!TsjL>$7opMnBNZ6 zoN1$>nxziKuSEx?U4O&kr5ymp*g)|xI7L2UN=6FRZ`k$g-^~;w&e|_fS&e40p!+L- zd>4L{f&P7(oTj`TH_S#j9T^cjQ_9zPgvr2fA1Ng8lNc26Al0^@^NV|v%=?Gx;iKD@ z#Ih} zVq)@)qekR9{>Q>~7I#c~6`!Mq;9pcb3E>0zFD4TiWXSKb9shXzsOoU=3`=*nP7_vA z`}5nl*T4?11J0>C0jiF6)k60Eb2m{9CLm%B%3USJBY)Bt?z=<&b4v|4(Ccoj0(+;3C$DT*Qsmh)8 z(dK99&Z)lZD;qX9?AQN(ncL6d?*r&d@LzQgdnrfQo1Kfk3adPPI+If-V6eO#R+v@# zB<=KXjDyZjXI!1-XbBUsiL(;nu?7V!>?>}!cEn=#<`=;*IE3&AR5euMGu@d^=aX~o zoj?M`Hkrzc?TGsahyBXxOz*Xv5AC1EK3i_VIpW)q_1pMcfwudK-juwhK>cn?#`SY& zqRSjc`y`b7c}KGTzG1+_Uk8In)~-v-^;IZQlo90r|XjwOA(D)QHRyF&M`Bj)Es?n2kUFozL0n%t zUH<}h{^kmgz1mb`kn7fu8@<#YhjK5!IGp1?95{mMI_kT~z2t6J0Lt9yoyo_|R>pDs zp3mYu{{AFr^S^)*ZtURN@h~5C>O{K4KGX+S)A4e{t_LS#f5RW91--y{dE>o1yOR3H z$KW8Kj?K7S_pPwg)x+fqs-)X5evYscBzUL7QL4A(Zj+r2^u4feS$aJ_7i3gP?Xy4k z<1>V=N+s4T7SlIo8_4u4snydzi5i%8O<$RUklDnwI8yrK7rR3=DA>2X=mACUyXh<3 zA7WzbAy`uPK<?|nUgSj?=*L>N3mAICT>{P=UWl%xi{ zG?^!4;TkUH_bg*$1*PogZhzUHiy;#HQhCxpyf88HAgQd3*w6dVB_qd;wc#d)hw-;3 z{ejQf*5u@*qNENgjgGX84bw-PvQ}nM(>c(P6l(psdp1Cc;iq4yhv|`hlyKC@JhS}9 zYr&kA^&g^^e-Labpe5}gbKlIw#wrOt?KQp1fp1&@P>a(}qC4_8$p{4habMnFDN=s< zUpd{?PhAK~DU)Z+F}P}Tb-PIiN=*KZ-BH;=s#EsUVU14UT2xI{eJA$eC)AN#QIqud zCxPv_pygkEeEd4)hQ}W! zIW==?SL|s9VslP#(YAQwUt59bA$=2Qx9+W(>Kgwkfv#BG;@3=4(5a}sY3NNNnVXDu-sVh{D>H1F%-vLc`EOHz2}dANS|fA* zGA)i}$tz>fy(aj;m`plx7}vFYv?vxka{T0YQe+4)G*XW0fe=HzN@MW$FFPBgrsIXQ z>79N(hY{~0Y+vT9$zx=4eyvFh#v3$s$zOqxe)C+ft^C_0kR6gpt~X*Qwf*n@_OeWXxjKX&~7^~z~bD}e|02%gwXXp-p|E45gkd{VBH(InySVXf4kOo{!# zAq3J}8A0Yz`4CH5qOw~4LW=^nV93>UIG_H;aB`pp{m3Td$$F@5+_I(fu5%6BtQZbK z6I#y;XNrI99xWH3b*K~m3JiyM1WWfB7V%Ra_58SSal*{@D=D1+eAW=1xwz8HG{Lj!woE`z#S?)YfAf(Ywau7bOF2!-P<9^lx)90v0lIjc>nHpkYj?6F6)KVeJJr8EHs?1BjaovJ5;stYYyNlf=PI4l_p;plv#z{8T@l`s7o!*sM$%8d%SFsk3IyxIbF~oF;%V1efyf(-{l`d z4I!ZCMNGs}we*JD6>F|7nYmkY#km439>U;S{8GjGV>htLr~u4K+||lv(_@|eae2Fr z3}@xLixbNBdKq9TreD%`A6>1$)Ho@KGE0jnP3F8wzW_quIyJU0|9M@3VKhu3)VfZU z4_CnH&LarlM0(J%!b@8q73H0Nu^H_E3f1uYFzgsN0D#r!(4jMmz6*#EPL_ll-)~3z zNr)f0VVZrG(DiaYc?(&?nJj#XR>{0@Xp)s`a+`3pLB9% z|E4g1B!ioG!-aivph_M*ow?Wvz+hr&W|=C}{}iJc*s`G~sb^TW65791%t_pOrzh8W z)4HQ-{%(qIdG)owFATIGJE#daF3p?yapZQ}8&}4jSkQ(<(Gs9!PfkuwM|O<*pU-mu zMhD-t!xr@v@ZBvG=#FV5?;3w5m%y{od=`UT{7D9cXAoyOplN!pioz2hZ$UVRsc+i}5I%~4!K$BrG8=Qkt zYpH8`&#FoGr=y#|r@2<^7O4HWmZyvrkSAtcL=fQWPYY$p=C4zV`k&Ao#n2aXRk_gR= zyUU*MmxMm%gVBlmFly7PA-RXzpKH-~UXpcW;*~G)|K*9o02nOqwUE(corz>pE}inH zlpGksg?dte@i1Mjb0YK{+QArdB)h z6}e8x5Gb?Hym4=DO~;RSgtU=v!q5YFE`OngKG$Fop_dF9(DMbS5I+&B4lHi64}3jU zAB})D6bN24hQ_5n?`jt_6eq3=$$f}v6=_=Z{&l^Ryp}_qcOf3T@sJfMwuFE^b=@KMdeTS&%CWzP;a*`sQi33r{PICrt|YBD6Yj5Lth+QOXlt{(qGK(fk)dWeGw!% zvoF5oELonez3W;|DJ|{fN$VA+ldpMn52B5sJ*wAKFUv`zV0Gps@Az9!0|LJX9iM|B zyp14?`95#JQm}z>Py&+ZTtOm5mSX9JH!?h{nk@a zf@>tkyxt7U7Eq!H*^w=K>h_ESezA}xRf=rClw1cObYE-;GAAuNjy!F&#c3=gU6koC zN9FwU(e++)dB$Y9m{w2)A&X_p>)S=SeVe2M_j(51UHU`(K_JkLS3TkFEo(grA9pjePUdCnhwM7pzr?DCOdG8`?L@SEJ`C#lT1@(!=5 zukuQsk2A4!)C~Z}1`Fp3_;}A8Yn!928&MtCt7|405*8PPlGLkHYMU?PZWgWwbhS{w z_%ceHl`|orxy&YdU!t@el&xLILH+{N-cb-Ytl*@t z;RIXM2`^%NL)%b}nV+rof#bI{l3V0Uxdg{c!P#4>RduCOZJ$-lFdOm%r>AA#c)4Mn^1TK3wwkxQf;pf znaAY=!i{36o5xLfUA@g3w>u%;J|GuXe)c_f>b+8-4DX7%6VfN;&tS>v1AyRcuDz2V zfVc8zXk1G*(oP}NEJMR@mNi$>*f9lrk{g2wp1fq7NK@`w47tJh6rVdO1W01 zlw34VWEf1=4)8Qa%tdgaRLgt8e$w%wvq`f*dqX|Xx&q}*g1 za`@9HPeW);{O#}qz^HBcHc_R6y7FPG`mULBlKB6GUO^GF+pJUJ`e!U^?wn-@;xXtr zGiW(WHH%y@^3BIL%!>sQUv&vg!^Z5oYf{Ggk`CUj<+cRq1MuIg$JeGzj*7b9Dd-T; z>K}cDq(=eH`NA6xTkNR3CCy2bIZ{5S>Xu-ZyNr)tT6*0<-|&&b9P^U~^70?@PAM@v zC{8I=JhdOWAq7TgrK0*C+P}*4pnBxj$Hl8rnl>d*fa_N0l2TT^2yx|ZK;cx=K8nig z{=(fO4>G&>%_7Bc<=c3RoV#|F>?>8YxB-+X5_nEQ`EpCfXpGch_lT4psGfV+K_5Js znTB28Gp*4Hot;-L%h>fKa|aZpx??JW-}R!g?O^N{&Nq3J6bRJ4&p*&E+pafoB`jkS z&&CRZ6+wmjRMFa35h>(uBLYD{0D64WO;xiSZR|AkfHz3V^U$5#l{A$z6c?&|a)R?&u1g14U5nuI?BFJ3haj%O} zjYYeC)A)d8NrPWA(mN4lWC%v9u0l4necE3Qzx_UnVVLD6O=D)h1eAS=A+JINm@Azb z)#n!&aEWcsgP=rnH`QFm1S5imEHqDAZC!A$={Qb=h)QN8eJVGje>;l`%5t9!XDHyH zVvb+a(l{vjm117@bR-l?f62B~!D`h;w>+Nzh6mTFKp@i*Za!F}ljABYmbeeQ5m5Sj z*(U8kK>n-Xdi#|_oqhh#>_#ZHq3kVmcZyO#3YK=D9XO@ec~{q2w0|>U^hLwWVQ~wr z!1)KBV$_DOO_uTrGSRM5$%Ix{8E5&dtF>72$BdrP)*SA{1usr_(-0;U&9YuhBS5rk z-~p96wfIU`kcF~uyFWZ&)FIE1vj~YJr!ZgyAl{AqtK?uBb%>Se;(pc}vJL8`Ok2`z z4+TtNP=*}ic|d+*;5d<-imuU_5H;18%iFM~Hka|MSQB0LeP`JxKqbRK>3&XoXosVs z>GlB-?fr&zd!n#9!OsYc`nkChWE7#|t`3k4%$L$ zP(8@)&1Ant`>gxBArpG0$EcDOmhlr5^fGm8_LzYq&5J<1+ibjr+x3PQZxiY2Fg}ro zF9-}8;6)QBIpGUpQt|Cd#>OS1FR6e9zd;11H|)mp28GjlfWQmKKQ8=(l*zUZz%hl) zQAq7{HYsLr!!zDp5Q>_Ydg12j(QqM$^Zn6v_F@MTQB}SaR@X& zoYT{sAA@*ycim;tUIg!(h14o9XN)0AEru$ z)J*=+C=aT(Uv|*6Uc*WhQ4$GN8vihZil!iEfPf;!+*ypuXqqT<+=p|OY!CAAla7CF zFpbQ>Nl~(c6sR(B*Y@)~i72hgI5l||3+8XxS2@pbhLE_vuqQUP;Fr`smg|01AK3HK z6r02Ms#v-KHORIM1PAMcEQiG2fbu&*anaV%#%!$L3(yGlCIr%ROo}=j)B3g^fxNz0 z-i`@^@+78jISxQ0LF?7p?Ay{@IEmZ#Q1v?M=pSo`r*yegBDZPdD7CE_7giT{k3OUK zt*!!CjP)jVpeVj_k9D6rfONx;X!r&nespqLGMF0apE);U61*t)R4Se^AM=lim*B=$a`BoI7a`OV$atjVZIu$Bi z-GOH_Y9l%ZDR9#0KXXRC*s zc8)`y)6OmU@>DR66{$;(+&`x^e}+WJNr?zn+HE{8FKs4X;Js*#h@1DaCsnn8)DF#4LlUZ1s&L{MbAsab?b7xd3;3#2+COqdO>E z)g%3|75am#?4NaU12~}~1B+VWGRrNW;E;oA3Feg@xA_xjo&VIV;lV(7e?I|x&%( zF7wyFW99uCwK8mlIN!c)X=-s>3H7ew_w2@1E3yo7yP!eh&Fs_KBOo(FbPjGE^`OUF zZbBV2)LPHayJ`)+-$c4w@FZ_#8L~DphSN7#gH>aczoP ziOpyplUv>lH7NPK{>$A^7|&+6hN4eG;%tfRYYYSV4it@e3(?Kcp4>A&;HL`Ok!hUk z%}bgJ=YB6nc6mVu1Xg-Ox(E58u2-5kB|0xtq0@%1E}al!#WiH^pt0X?p;Up35npKm zrsj^mCmEBm5X&?I2W{&`Z%ssMX9_4xLdncPsfG_}#7}$J;rbCHd|k8vrsSYB!CP|2 z4BbFtz6JZTRb#;04+!8`OiD2^k3Jo%$2`n!IoH=BCUvWrp7)hBCtDl1(g6)Ob4a!k z)q1^d$B4$;uNr@CMw#W`*frf+u+j>C=4e z!@}U7&LXtkBpi3JG@dN9!@?HfWjLQ!YlLpb4AbGr_Vs31YTHl&j@!P$`<>F|E?hvj znk-hP_4;0<5h6u_i^2V5RVr%OkfNd2P{3IJY%wj#K;P4Lg(?p!xyRt_`7H5R4w%6R zUQ~VAzZ{ruBDOSI>-)y7YuHR+z5K!3{}b-J$2e~;1W(_*uCF} zO}Dc-P@R>jS-5M^39HB3O@9HpCk+U9U)K=#5(K7eyrnwj?sH~s*pHPZ1%PT$JW=LM znR2RA-6Vm^%}Y&3uG7PjGqEEzO_4E72NC==x>Bm)O~!|0?%aI2zHoE^qR#pH2y@iT zAR3%%`)*-pWqdyP%=kA1)1|@`st&;({5r_Sq+8F3BF;I}3WwY@oW?aq5P!~`4~ zd~)@nLYIC0k`0~0OTzl4yIg+z81N5#duF9hQEUkxs+m`N=v-@s%lHwuCC7Z6fV-8OX{G!Q$ zTq@dnOMTCmy>!1-2i(fnmyr^(lDGae$5n$BB0mHlbdSC6D7hq8(#&|#@ClcFcf*t6 zBO95VOD5|n*heCzFyj$QzA603_{Ub~i&mRAGrj8z6cy}f0p0^b>cB*1sN#h8+)v2A zSMRA#m381bdj@s*kiMd;j@HCTNdo=g*!62rYK1eV`fB!MN%sXYXFN_pvzO>H;UD{+ z{|V+4(GuWN(lPuNH<=sxM8?N&U9~Cgs~1YL#+x>U5bAu_H#FbG4itQ3a%b3_>WM{inTi2!<%$omPI9E2A~7A!7&Mc#)C=Fx4;Mq~5r3$Fmod z2~pni{}kVm_pUKitqU0O2qP{n;C8qcAt~X{Z(LJMj5ys^c6I zIQ1Zjz}AZHy)Lpf#qQ~o24f7t?Gx9E$SDu2=&h6w3j3{Od!M{c)@39cUu-92({T`) z5*UCQTsRFqM{Zm-d1lA(?E4$v7W{Q$M1m*~}KF1CP~m&`OfeEq!3$?Ucsv z(%i+oP0Y_U=J}uy$s6?r$re1_o5965 zJbdWzF%I#-&!L^0bH2{7&kx$uB$#~ExuSq(!f_ThC&5lkYctnzj&Db9zM?rfZD3QA zYu2hBG!mx#IX4zPHm$8!Q57U-Kx6adq)J4`xOe@SZu^v-^B!z9uhBhUJADsOkp(gw zsjp%PI~p{gH1vv6AAjd<;olFXeRO<-`~=~t$#O^agQbm%iTq%FWDaFVZI-2C}G5?9|B zQsHC%_-kzB3qs+RL+r8hMdvsN?_JyU)-aPtED($u`o5LIf6$leM5RP zOlEiU)raK!b|;OFzhXJz$~P0 zCVpgBJ1Ow|5xD+Sve0InDY+24Q~$!b@UqVJPJ6_K7863vTHZAYY=sCFZjSnv|8j0> zU$3Q@yTRf{avk0I4~x%+G0b&o4!Gk_JJMIcjEst*(Z8H2Y4?$H ziZHLU6|~dUzS)Twd_W&+v*e&Pzq0W8jaX=7GM$6bAU)gEXeD->HU$T%DdqeQ@@*VR zcEm{&FWrzbnguFHhobnf7tJ@;mfQz^KgHpaBrNW+*X47=yg17mX6?{Tn=G(^y(*|8 z)hPPDqa5dObMKy|3$yF|hDARGX2N7rTpAMo)IwBXQH>@&DJ}SB6Eoeeo*7Ul@D@2~m+y52B=^ zfJlvjs3@S6NU4ByNeqpnpkjbQNMq0f0@5j1v_Z(w2-4ks*M0{*o^$5Q{c=Cthi?qC z=Y7{+d&O_X-dj<2I)SHYCV4ijm0)N8?mO{5av!$L7qSUo+*IZy?TvP~xm$NTT=7q5c^z8_vQ^G+c!~jlFzm> zaX-w*&lI@M)VaRk zOM`d2OL&$0^1eBuj?ak;mp)9{w9k)ehU>GkQX4?eIZGbaa(W(|coa!ue7CYDF?~Kj zN3!Ed0CP6Z^XHPuU@}S4SIvRp;C?FVRHz=C)k!}|uAHoiPvYjjSw8kj4Rtirxep^|#l9!43X#m^IKog!4#rpu$0 z!fb>`$cbcbX5i!Q2de)g#?zTgWlfpwlGWFFlvz~&(cR>0Kznnuj#}el#qBjjDQYne z?fISot1h>lYC4RLhCv&Ie2=NKA`>z41(ecP48?V(%->ym!bXDj(%&DT847jm3Jo}w zKKNG#;J+eS*6%h3<=@7+Xsd6RF0sTH)oT=tC{3^Rz-lQlPv~T7P?y^jd$%Z~B*b$2 z;&9y-9=L{eHaJ`GNkVFO5VX;k;s#_$W8?2-bDsD9;0cweoe7*QJmsJvY6JWL+l%U_ zn?=Fhezql!c;8y9FP!pq&+)dQQySGR?N4l^Wo7anuOTioe{aYTq_%bospjwW)N~9A z6rJ3f);qXtR@jP?Fe~S(PiXp6Z{z#yY+gUeoV3R^|D5V9;cSj`osT!Jxp#x&b^K|n zMqhJx_x5Qws-#eUxt_^47B5st@|9#uQ-iYXyeC25inh{h*wP$`f0;_ruomlt5CHsT`v*OV|BRBFvzlW16_6q zZfOaij5JMp5&dznbDD)7hBhvFH!x#dG!HgtxMV~NEUq56D_>s&%}t!P%N_|@ZP~uG zV|97gX5PJRY5j5^>^3XS&%w~Swl^VR4CO4eN{X%5jE}KSE7+0)gH51Ln^JIc*NgOM ziYtqCb>|F%?lG#ZC%TsiJKN75aPb{~~0LSx-g z2S-D4itPZ@q^qv~h=9D498p|@LC8V$`3U!CumIg`OP9XAP0!DI;smMeZGxX2#zq?Z zb?LcoUTfjk$kolV z+;3LWjuW7Vs&%5%O>v6v_yXwHZS?eDGQnE(g#H^($;eh zn_IoJG+qG~$nD6n>tCcU+jOBNr;W5J;*I(aM(QMvQLFYJ2XcLf_82W|>;=bG{Nmw9 zD^BO>mkD8&w4qE}@;Xz5BJ8Su(rVBmyYYu$O3<3iOjK3sFO}qY740RKhs;SyOc(Iv z8by@I7^+ZFchDhy3t^QVlpQ;uc!gS#PFrk3-{a!EX`asKlNdhW<^Zw|=ZmONY0|&p zY@AH=*3c|sbSx|q|DZ>jsA9jZw7tT)RbxBRlO|v&Xuj2U2=`@n-dDR&Sex6G%W16c z5#4YdLYhFDGqkMNhvc-tQ5$KSj3u26K+wICb^Vqv6BBOf%zX1|)ynmlZ5TMKt8g7J zjPtaXYN{Bm^44&lxjrfGMX!Bep@Xq%s-vnqk&G5Pz%adIH=d&&W9sQSJUg+l9;a8b zXW5RbJzPa!EWf$MNgz32SCslZ6D?uf_3GPWJGRR<+w=`9Y|b*NU~7@i5{lv=X_KFY zZnLnvwvLJ0`UG)kI!8}y)V#EOOL~N6TVFd{Vb;tS(fNRI8`&{X=Ngr^qS1U0&E=30 z>CppR;Y;ZTL~A2&YY%VdA%_-ncSa`^BFj?}Om{vkD0+>v%4tw8Er;u9-2t&46?&bV zFS@v>LqpBS_qn+_-MYSlx7%H^X)u9TKB}IDe`Mr-@@+{4RXbTRL9*TB0pk2~E<;;g zp3Ir#d!!ks!x*7^q`Ep!u28vx`9KfU6r*rt+u+HV(>jK z3>x67B+;bO5$bS=9fdJ#h*v^atxu!%um#GeuA$H z^Ct`TF4F6D?pc0C4Z2MD6s+OE(X2c5?1eLx(GFyk?hpRp3~>t-jtH-9h#p~^wvh2y z_!*t{y*iJ4!3?A0u=M`We4sO)-gC0ux7#gdq}FH5jB%!_W_epdd!n`3Z2WM?Px(k2 zD*lUXd9QmOnaM9`;ch=YdwMf17hX4;aPG&H_Ac^VRl)wmIaKA*vG6b!jEn&oRnQ%Y z&A&>t9?#;c%5ei%ILIM?@31K}C~lxim=>bb>wp~q!Ab&NR)?%RGzeVHHn%t`WHINl zmMR7?W|-oKRyguOg81+y;KC#A_qe+11*~gd({n}G629LfDRL$?RaqRReop&}lsi+~ zrPM0*Q`S_*$NVIB=*dNm2YWsy96`95TM3pn+)a&@s7+I>aj5`8U-cu@RdU=-)q7lJ zEFofTx17l4+}pQv#GUxCV9~Te>7`ZowU*a|dx_v+L3}2c^2^ES8MF#QoG{ivHfHY6 zj>LeBM1o@8*SmL$vgx&3YP#FEX8MpOV%!E3AGD@bLY<%HaL(a?!Jy@`)ELWc<6gG1 z7xLB-M~EGJwdCvUc_+yoK9Ojzfwzvv0l@0T^_Rn+x+KeOB06J+qTOkuhxU9~^i4Ar z*~1lu*2Iyp{)cdp%JLBxAW9QcKPLb(qcKiY?dFnVY(0XV9~!2-+|}Oz&je3 zJQOX=dllzP!$h3JHHl0;))R1YZBGhn-;|$1F#EA7Rt*IcpC^+Uf@Qd+p1drO_ayAH zuI@C`@*Rw~Z+)}U;5CA>>mF?*(4PO5>1n2IpJ<72#tAsofl7~K%G;WE%w~A0x?oD$ zgoEv>)*bu|srPOjO`*={g7`Rg+T$+DGkT-Yj|I*OfC%*8!rDZ(dqm-(> zan35yNy2q1&qy*_V?}nPVTC5|l-`33c`ClKbeC-KV&Y>q1ykSM*5EqY<2G6)yI3qP z`K!t7sSrFsEaBa#*eW*VCFkoYd{(}(5vQ7p&&q6T3MdWYkS`<0wQA7JsRqqtfWfkH zb_7CxO5gjDh#>`C(KzYUqWTl=KYM2xJgpKfWm9Lhr!O@!&pgD>^mKidwr#yIIX)jf zLAZ9$)s9W33Gy$+&Hs~qqcBI0nH_{XuVfwOc7~69JNMbnJGOr1bDjJiJ657k?IE(9 z`$BBVru-R>Rbu;@U2?=192VmQMTSh5T#r5+U@x0$ZI{ygf-$dbK@|XMT(cMUX^YYn2lgC0E_wA^W4o>u;Y^QKSaa=})0?xLD%k3W z^mHqaeRxHVYZZY9p*eBT6ThT%Y35d@Yg9rfkD;hpp?y8gSKRqOS10@y)Ukbub0<&5Bt_HGLGEBu^h5?waO}QjHq9n z8wv2n`<^O{f;yQnOIS4mkxgNvEu=649<3lDU$t(pi>eb&uM|EoGn1R*tYVdrnEK z2&yAA5}IjiS|%T!O}42MK!5LK#eF))L;MiKMQ7IKxjLytTw%M2Q&Me<-mm9qP!|TV z=GB2*4?3V;D&{&;RwB%o4LGt%tICtJ(gEV?{Q6{y?tP| z@|~YL+LA@EtpwQ55HiC~MJ>W|A3Jr%lzzC6))w1!x5+{s z%Kt}D>SKL$v+7um!r&~Or<8HqOLwJ;{AqE1_id@!Jh|PTN+uF5W}9hSX<8gFRSs}G z32t%v;cuw4Xgrl!ATy;fJ1EA-r^ziL5xjR)T5dah3l-FDFRA#cTwh2U=@d(ZR^+9!MUdO68RFTdT_ z?Xp{s{k)jCrKFDSqFV};`2D%2=Q?T5*0D}l4-f>1{UA5GykY=5{aI;S<>~cW`5i7t zTT|I@>H!nY=+k2k6gn`moBH(T znYR^ISEn@V%a)WcUm=4XUU+sm9FDb?ssZP@p1Vb+{qAE8V^dUPB?{0$zH3^x-=lF+ zmyi)?jddfgAyNYbp%bh0qhpLsz|UAV)8BJ{+O_Qrq{F}fMB``d`sNn-`<>G#R{Co3 z9H3wJ_z6g77;x`%YrIf>O29TH9%W_>c8?6)IP&o@NhIqaKY80$C!7LNo*cus6CZg3 z=~s!{D-o^xd$DT=%Qn$Yn{H4NjvM7OCg-M5G7paRuri0V_*eM$GaZ9h9;6q$UNxv< zrDi8+M$iZgDs# zH@C{wew>_HypAt{*Wj#(0I-$ihyYJPm-b}mPYz!VmEzd8Q8O1J; zZP)>+-rFY^(1VwDzrNb~6%t0l6Jr&f2&Z#vp#1;hh z(@>TcMAZq#j}0aF0XirwO7Y16Ftm{RjH~>T99F_$JbAS3=YG8n%N(&wfd_}No6ev) z0TNB`C&i#pm`y9tcwo8CMo;m|=+(!Fo8&~T?!~!xUwksOlOp;MS#XgayyvbZ+My4r z`;p2>jex~N0uR6HGzUqbRZs;xw$XmFfT#OfT&f^>U6f(#oOTrHvIv|G!~5EK__5Xf z!Z&3JhitL(Nhiwk${JJ(gGualAx2+qluHuYu=N!V25`K=$|AmqTP0n_2|Mu%tNdM!AFvN+u9hv49vwcc5SX z$%LOPUDD|2qlBQUTQKXHNc@FE58S4O>mSUh^7TuPV{HR{v?%s<8+4IzG#SO92#C`z znAC|%RnX*G#zT&-tq15ik9cY(rH_FO8k*uvWsiax`P+)y@7N6P$1Vs2ZQKvj ze!uO?VMz1xe{QjvAn<$CK@tTgM1K}*FxpAmB-=GNIj`~4B`sv_~=9RU418ZqAS#D0p`04m1$gOC7 zbjv>6f9wFlu0&lX6u%}5xWo^3wx1EYR7Mt0>MA&Hfw0k04C+Tk611TMhxdbMC2w=M zEG)Q?hY93C?Y3vVnRzbO%@W%D=9tw2%Lp#0JU;9$#1<07W_hjfV1h>p+g&mqnqmWWH2dX_dnaz9JQa$!>T0^Py%>fiNax!V9>lGH z{|D&kne(mRk&Iq1@~-*;nHChO$V}Hp60j#jt9x~p{STrj*P(>@Uz>i~7J>8AW;4=A zXm(hS%oM!6$3@Rje=qy`LGm>;yREz5@dKzj=iPt%6hxM(yrihSqEW0#B?GuSpu@4P=h z&qT69j}0jbV@?juc5~ep6=vnOH=F`T|hY=|F_ zSwB;e+Q{Rpr_rqN+~{Z@-9=<6kz1ZOE^mA9OZUUMVB<8{Asoxh&zbTMR-B}U=Gjc! zn3Z-jD32i6z-EP0N>^t#))TsT0=9U@(tq$GcE0K@~dO$TO4)(nUAj#$jtmtpU^ zjz0$i|D2R~0iMkIy}o6RbhkTctNZ9y^_SR%t6sDlf@P3D_0nY^cTAuHGUOJO-ERVi zxt~L1UE-lT-4FG{q=)_)==cOkpOoKnAAqpwRdbW`CV&>9uPk-uDdOZX6Zs? z4*Mu?vG61DN5R5UZ5-ry@Z9>uk%gWJp@kN3MQO4n{1|ot-etkuI&dP=uJms zeF`c{-z75(=_vsH5%m&UqATnm0XyEz8%@E-*n35i>(!+*FDZj09?-hY55*fQ8kB5? zEF)*XaYA|T7jgptaJ&y~o!S+h362v_qG~6`x0mb!D{W5fci>^>en>2uHgea8bRwAS z7&jp?7qSuH)`O)k$X7$BPMR{&R$FhGAJQuj9gW{m*LfN=h?;12Osq?t`dX~VRpJ%S)lc*TZa9I>F`)%jgP^`@@_lP%5&3=K*T6DNZc7vg*N4AM)y}Vfk5KLIytEE_QeGcc za0c(o%}Q+K)!uKn*xxQW>=h>I|7$s*@0UNe0Xy<#J8>5;!voUHM@UBmmUXmB(J>lF z;%SE>wDuWywaD2hDxV;ypg{fLgqeE0>oKG+wnXTdaIv5LhGcD>#tbARpvz!dDgSck zhaEezsuxsaSKtoVLU1@9PoQxdIP+POibIFjXz=Mw&j3;5pj%$5&2{fh+>B=dSqGwO zJxUGOmW?L;nq?noQhX!(0f3 z8-GboH%LynmJ<*9T!S?efFn+j+&z(~h`+QOwE1z7#%;F_NSjr)O5~^IrpXvF4*%L6 zc@j!Kf#&^ZPy=EwJ*ui^@`o2f+Q`LZao7SlS`R$u`G+D#`+C6u6~$vU|hCr_wXS%O&1s{FDP03lS7(_Ckhl~T*$u?zBz@?0spSR){s_Med;t*RCz zSu2m#FIz&*sGZ)%ND;Tdzm}?7$h!HC5}3o!uQ-^YK}BP}>5{`Qp2dUK#kcGj$0C$( zbZ^3>L;xQ%GCIEN%a#{xAr`Ht9tv_D9M-_;<`Yh3Y5eH*IpRUiQp4-5)q(o7j26c~ZGG}z%Be+=a)sWLqn}bC^|n0fI7Z&zgCxZnWVckDZIZS7LUt&C7P2O|j~MjND_E`G`3?yRZWxWc@(RF6R7 z9=*k37x3aX8=Ev9cK#L-5lmP{8Mu=(&nq6IOvf_Rd`mta4IB(2JRf(w$sk+uOYq77 zfBH9j)WYXTb7JCc@mnW{K%-h9&gS72HLX4q3C$?2Va`9;6LhsxU8+W_rc!;cq2ZX^ z@}X_u$_LJPAtBzj=kwPLL#PmSv$=Z|eP6B+@H?kSM+G)wVJS}Bvztb^MLHKi={g1; zWP!+zB@_-PB^=&LUePWbO3XTy-vQ{HYxcD^5Vv@NZimk{6_y^^v2Un?1}1-*J>P!2 z;Pf3eEDA<=U=u9j&Ick`x3KX;6p~x3B+4ewPyVnSvXRVYNsABtxxK)`84415no~8M ziMt5f8@@*B7r*|^M^RWvQ_nQ)3}?T+uhT3V0VcSo5AZ_jj?20sPkbue1#sup%lyIyPMcsooz;6v>!OFA*QEX zx&7m-uS~RhqHdta$%&2*Q$DAlyMrVN|m|G;EpO=B`lz;(u+g9?3Ytw`P)UH)3%^VB0Sq| z!Ae7lYv{%DWQv}tYMFl1X*y5WsoZat3teAhP>&a+w|og1@-2d7iNfeXT|O^5A7Gy6 zJ>44ur%QKH{3)$lsLhNk#H}7ARXfh{lY#Rwgrzoy)(AH>4T7vfLNG4M!pvqqpWLZ{ zL}Uqix#vSXSCHoyK*P_(wqM`~ciws<`(t;L8w5zlOuw;TemH%97o*Jh3^ZL8KRHvv zv5svpIDOt&VZyEKIwA@ao>~YC)iTAek~hiVpzfV+UY)mpxPYUe63o>+LV1PlZ0}D! zy8qRd2%xrQCG%Qvl+GND*e;9~6NXdoZt^6KvsWSjwu_3!Wt#LyD)1a82}N(Zct z<5G#1neI}n)+4_O>-~q2bemW6)%gGulRi zs*u<A3!la7#8;6{M9;a0QSkEkdmPo>PW&4*3Fr5Bv<<0hw~;8C$~)P7Pyc*_ICUs_eUHn7kT zEd*o=Jx$j?I&;@-W=k_f0bWKl0LQsI?KBt)vmU+^lnOdnGmp%I{{CXZ$yRM?$DX-* zUdyc+5M7PDyN|DFXx8)(N9{gje&g$a`d5t!*wx#p{0<4sV;j?-+h0D}e^kW2Pa)YV zX-V!*0u++0X$Oj@_aD1u-&YSlc3XIpmqciAMgEgy`fn~E_m|__>yraznXi4=Vdg$t z&v(l!q~FU(&+{wFOVYM+k>geL-d}Bk7!99}wSD$px1$|b2x)M}v0RnH-4yg5w<~?ZoU5otUzhAQ= zPJcq<-!g{%5ecWSYNsS>klS2;SuXT5ycB#RWwz@Vy8b1a{{YO`!u)y(gzS(8zGr0d z*9v3*{+4(JjQRTvUDT}m=SyJ3C;+h0R}WS;#Q*WF@+(;V?{)nDIzs|RaEF6E3QvFZ zpJ!3u1-)TyboTmfgMUBo9}NGK1bhmt{uQlc>;DpsHUc}=ognuR{Ym*AfM6Qt{jB8l z+Mi@FqKka1N#xcQvKv?-VRdm<7w3;q^Kae2Ou(wK?2uhZr&IN)G`nR81Ih+msMP8m;?v0|j{F{Y^3oTxyK<++SJ)s>i>KRcTiNa_hvNUReP^rf9mg!0`fCVnNJ!GnnfEzyHZ&n;b?6g z1vVIun#Geh&=5|)&!NDEi;KZ#r(l+kbHY>;DY4<=Qn2|E7;qyvOg)YQ8{X6vUe)q} zS%&KJs+&+?!@JEz(OPhhLDEz881+~RY)EH)JsSYK>G-3*mDXxfU_&;~YdSVG;N_QI z|6U4gu)>*tFogb)vL4$TYLwVuy~(^x4hGycw!JGyi4EE`A+~f#8gfDn9#CR~_Wwfc z)*@*L4!!D4fei=i-(C$XgnH64C-23}6xeW_tvEU?9|p{Cj=2~~fep3(ubsMK^H+I( zNok!11vWH9z4kUj1M=SX26R(k13}RIC%N<9s<^h6f;2epH}BJgW|CA(tFrgm6r@2H z7vfR{vkc7*v9qAW2HlMzt{-5){g4m`6AEm2Q(tm50^Mxh+Ok_$lL8ywvAv6qKsRqS z)E@2l1!*Q4YaxOt>PtvhP{5MwJ2y_Y6~ZilB2K zzSl^dra%JhV^^1R2ND*XgHOp(B0+Nt|1L=&!9lPxikkunLj3ynouK*Ui7y&zR49-T z5|wgP1e)Uv>pr`d+5DFaooQm~r*wgYyt$xrqLfIuxSgMeA4pIitccq}fds__{q#=g zkSLD}(X2gBfrNyvlq({z4b-rvBJVUM64GVV&&mJ^uFgT4Jd{Y#;^yZ?N1cf!RwOb~ zAiVB;@j>-VlLZ35H)kEtFYP;6mmJ^>ds^7UrH_W~D@e_Fw#a z;ZP>+%@!3Yv=m72NiY!Yg3H;H*dxnb&a5p=uJ=XX*Hlt{={R9Bk=5++=p zn$S=pL1zy?zY~x!CRmZah5`vm{D$^Xp!W*-Hyf%7GgJ~2|CCp#uxBV3dhwtEdBj=8 zR>ObY08_L3;qXOGLle;ZuS0qt(vk;N&G`Q*^AAU_XqudY0go;9s-6%i@GgxX z!Y?;)vdK)cmP9_g>9<=o$k$faE`|Y~A%W91I%5B#(1OY-IZ!PSPNf!VZZVV@Cn=_* zvsV7B6a)!B^$&zny--74my8VsHVpA!os2@apQYP2ROeD)!<52Rn%!u?8=G0BMha|L z4%YNC0Zj09Kx=JU(tp{YT=ZPi`xFd#Y_3K3#Noee@Oy2lu74M1$&#!7E|dZrSW?W@ z4Q{{y>Jar0eiYbX_$ov#2(=yLhqH?Opuh$%fl&V-beThTfWOFP3T)WRZ)6`0mO&v= z|9wR!1vczgF!I`s2E4l5b*BEmY*4NuX-1gSm{rG~}q&Xj5WCx~sbRQ6vq)YIUlV*pL{Z76PC_C`^}C>>DLE2uAvckPkod z7duCR4JQ1?lhI%r6rxn#SHj(W|4|AX1!EdsG~ngAuCw1Lu%Tt!#rGzF3BLBI5Yt{! zU_;x^i>0Svz++<-?R8p$mFm{H@N#F;k);=dn7W76zydE2oSnP?*KQ`HStWZ~=r`-jOcF zY6^T9x_Gf`WseO_brJrEw8DReGoVq$DV;MQMUbx&|C~uF*C0l>JvX)NkF! z?**%r6qpEd`ypU8(ATbnp+e|KvAcIKasLv!+}UH<=qykJ(84S`?&x%!s>@YL4Od>K!Z}y!SmQXrvEg3YG{X3w&c&19e{t3_Ykff7J71m z?_VYzMnocO%t!dx^vBCr-bZ$bC$S4Oey;-dhwADgAt78{Buo`oH3>5ztD1zF5d5mS z!_4%mPr{tjs!zfY#42$3{~tJvER$07x2;*T#`E%$j{Z#n`!!wv##?u2v)Xqai~lbg z9T8}|<)SP9uWNe|+`Ds~T}b5Rw*R8kYAVaDZhM3OV&2u4tg`E$G197Zt?J1i(cr3C f`MkUvo-M@p#hFOE>-xWCTUi literal 3134 zcmZ`)c{J2(AO97?=!9%#&l0X^m{7)R$&A7Hjj<(5QK2Md8`Px?g~$@F$dNY3y63$2kN2Esp5^;|Kg;*~d(N4gWD)@-iGm;qWnqr91uGr= zn)$fEtS3(}0}J&t?cn2fy5-i4A_ck1v7{w1~S9Q3hT+xvrxZ;oyy;zw4m57LluxjQ=(}^V7 zFA|VIrjbdF;D{JQfON1&?2(#CfEn@3Bs!Eiz|3EUNpvFI2-`H-kT?))I+0ihu!wU6 z2yPifD~@eo#`uvjiD?NKU^)y2V(%XwViRZxA_}U2HX$NFfjs~+tPnX)+~KJMXad-i zm{w*CGq3@KTRA`u*n>gI2n6x=D}t1OL>wA%oNjO=I8}fg;9*M?0O5zfDnioeh&tjN zfm?2I{;CLxBVP~zIm|?dM-H5;EeNP<%K%a!-~okL)?31l;4Km>8sd-)tO8~lr#T#} zh!*lHfHcw*8-@+&DmZd%aN`Ip_w+v~IB8Y7U2lQw!q63MhgZ zSOs61$f;{f2rzFA>qfw43DaPpYuRK8ZnvxgawHQ}0bBufCh{Fg4CFm*Zf<(=d9Hy6 zJsV_8vV$a#dR#ALc8z}hu`%=UMO|hDR%ow7!lO@((H1E3NN=hc@9s17m4$Lwp8D0r z``e`^Lo^G%-^S<6={Ns-tUcV&mu--9NyB5vPs!euN*QAToZG2bDoow{S}>}!S7 z^UB)}T&$hrnlj}ltp^J{i`|B5cwq0B?%QIn z`}_FQiu1R;FMQY;^+(vg=_J)-c^Em-NSg6E#b(>=oXd$mJx%W7hnJtdAFgcg4n-fg zQrmN<@3-)`Lnp?vz8qQlOXWYGZK^4-i-w_&(SFODF9`ux2hNsi;~T%p34_A7ohA}+ zbKSIFJ#gR+vVift;{u}mvbrB{6l8-)um#S)Q2gvwH~FDubP&VsJ1*3<`v-5GE~RKNs#(Oqd6SqIBRiL0e@QAF zwZ8igXWFS5x$MIFdi1?j1 zo#FlSLwno8=9J81p0gIJLzevbe0dekR&21va%l}w6E+(Qvg>;aY3mn1`ae3Cw0GLc z^CO)tvj6kY^WPP8NhZ}Va&RB8My$#welJr~^PU{KQfQSaiS3%b*q2u{d!nb6GK+aC zZZIA|m}WUWgsYY{ZWWiE=JZ7(Sg2dgW|+Fl$|`r;eAmqRQZ{fkTKk6ZHwn6} z+a%j)PW@B-Go8Bu&CK9~RV7Ma46OeaI`JUwc#dZ8v{ZA6=ful7frGZ}t2gZ(KLzAz z${o2pT3B~SEhDvA!!YmZg5!_QrlvS@*9%8`C1*zm5e3IbsOb}y`kLRg`)}+DO%P)4 z`2NloM=$>^>;$EvKHBf<-koY2(FR7M6KrMWqq$AuudujWL+;6J>=f)2^xTC!QorCf zsb6EJ=AtSvPv_px9K2$1#NRN3mSdjzGrC2-Rf_%YIwN@`@@oStOaxa^5v3CGf!d;o z;SCki$x@}!qPplm(ksg_o#UDJ)>k#>$LgDkb^Qe&2ax6Zj9XY+k(8Ox-~8)>~#i*sh5ZYOVVtl6P=PNOi5 zzhv2fldPM8O z%h%=W+BG}8MX9X|%L+F}<+K%B1l2AGeuiBPxMtN}vtsr3d19cLPO|tWpW3kC7uZEw zrkH!l_7*c#)Yjv=v^n06rdm|9HZk$HIi@FlCHVVm3- z?4<(DIW7-&w=lbQCic$0!LYX~{LF*blSLSz=`w5-E=(IcHc5Vbup~CGuRNc6pkep91TVmHK)GM~M;|vHRfGAA2XDqUy6bMGmuC?*IYH+q>O7{0T6^&^>yD3a zVOm(2w%$hw$8>$#p3peiZ|BoS#unRM7FCTcVI{hPqNcA$M)&7vobweF;4wsQV z5WTHs=zLoBgrAJ+&`Qn$rsReEKezvkQ)aj)r1+bNpA2Y2-F7uQKCB|{70}qebo%lJ zTWcz?OKO5aG%4Ob(D2OX_=gf*N*pN{6;5rmIBuX4R#Jx7?7o;rh&ik^!(dL(LBH{&Q9sKaW zNoIZt(4zOqUm1z4X)K>iA(~zbSY5fsT3n}8Et7Ih`-VrnvT%Aq$Nf8Na(Wgl7HPW@ z)%_oyIgdKw%M0JQ|NF{Xwjm`jc;&jeO#?Pp^GgcrHAj2bP5z*FLewiznOCM#Rgu*ln%B8@O{lU(P|7#D(xHa ze3E$1o@9S3PA4kn5?AQ;g}v(ui!I)pviBEhHTSd9?Jrd(tVfy1*1y?ZA55VKOt-i3 zY+E>slIC7NWz+wjBJzN1uG-zBUN%FoE9ZN?(b;ven!MAJuRNBFYIjc`{zF(rb8ziH z#y)yH9z5@5y$}07{7X~v)uG(8UiiJcV%kRi4om-g89d-leZ}qn!BBX0uZ+Z(F;@fh z=$LDEJg@4e3i}##&-mxST2H11_)}I6!XFRvI2GinexhPymWDRk9(_a~ sgVxtMq>e`GqtQZve&+uI_+Ikx_PYH40jD&deFp%@0#CwK9d(cVFH%mlbpQYW diff --git a/stable/artifactory-jcr/values.yaml b/stable/artifactory-jcr/values.yaml index 84febcc10..1cf33285e 100644 --- a/stable/artifactory-jcr/values.yaml +++ b/stable/artifactory-jcr/values.yaml @@ -69,7 +69,7 @@ postgresql: enabled: true router: image: - tag: 7.105.1 + tag: 7.118.0 initContainers: image: - tag: 9.4.949 + tag: 9.4.949.1716471857 diff --git a/stable/artifactory-oss/CHANGELOG.md b/stable/artifactory-oss/CHANGELOG.md index 79840e36e..77419acfc 100644 --- a/stable/artifactory-oss/CHANGELOG.md +++ b/stable/artifactory-oss/CHANGELOG.md @@ -1,7 +1,7 @@ # JFrog Artifactory OSS Chart Changelog All changes to this chart will be documented in this file -## [107.84.17] - Feb 20, 2024 +## [107.90.5] - Feb 20, 2024 * Updated `artifactory.installerInfo` content ## [107.80.0] - Feb 1, 2024 diff --git a/stable/artifactory-oss/Chart.yaml b/stable/artifactory-oss/Chart.yaml index 589aeb441..26cdb03cd 100644 --- a/stable/artifactory-oss/Chart.yaml +++ b/stable/artifactory-oss/Chart.yaml @@ -1,9 +1,9 @@ apiVersion: v2 -appVersion: 7.84.17 +appVersion: 7.90.5 dependencies: - name: artifactory repository: file://charts/artifactory - version: 107.84.17 + version: 107.90.5 description: JFrog Artifactory OSS home: https://www.jfrog.com/artifactory/ icon: https://raw.githubusercontent.com/jfrog/charts/master/stable/artifactory/logo/artifactory-logo.png @@ -20,4 +20,4 @@ name: artifactory-oss sources: - https://github.com/jfrog/charts type: application -version: 107.84.17 +version: 107.90.5 diff --git a/stable/artifactory-oss/values.yaml b/stable/artifactory-oss/values.yaml index a2a605e52..a0884bd1f 100644 --- a/stable/artifactory-oss/values.yaml +++ b/stable/artifactory-oss/values.yaml @@ -69,7 +69,7 @@ postgresql: enabled: true router: image: - tag: 7.105.1 + tag: 7.118.0 initContainers: image: - tag: 9.4.949 + tag: 9.4.949.1716471857 diff --git a/stable/artifactory/CHANGELOG.md b/stable/artifactory/CHANGELOG.md index f9abf951c..759cdf061 100644 --- a/stable/artifactory/CHANGELOG.md +++ b/stable/artifactory/CHANGELOG.md @@ -1,7 +1,38 @@ # JFrog Artifactory Chart Changelog All changes to this chart will be documented in this file. -## [107.84.17] - June 27, 2024 +## [107.90.5] - July 18, 2024 +* Fixed #adding colon in image registry which breaks deployment [GH-1892](https://github.com/jfrog/charts/pull/1892) +* Added new `nginx.hosts` to use Nginx server_name directive instead of `ingress.hosts` +* Added a deprecation notice of ingress.hosts when `ngnix.enabled` is true +* Added new evidence service +* Corrected database connection values based on sizing +* **IMPORTANT** +* Separate access from artifactory tomcat to run on its own dedicated tomcat + * With this change access will be running in its own dedicated container + * This will give the ability to control resources and java options specific to access + Can be done by passing the following, + `access.javaOpts.other` + `access.resources` + `access.extraEnvironmentVariables` +* Updating the example link for downloading the DB driver +* Added Binary Provider recommendations + +## [107.89.0] - June 7, 2024 +* Fix the indentation of the commented-out sections in the values.yaml file +* Fixed sizing values by removing `JF_SHARED_NODE_HAENABLED` in xsmall/small configurations + +## [107.88.0] - May 29, 2024 +* **IMPORTANT** +* Refactored `nginx.artifactoryConf` and `nginx.mainConf` configuration (moved to files/nginx-artifactory-conf.yaml and files/nginx-main-conf.yaml instead of keys in values.yaml) + +## [107.87.0] - May 29, 2024 +* Renamed `.Values.artifactory.openMetrics` to `.Values.artifactory.metrics` + +## [107.85.0] - May 29, 2024 +* Changed `migration.enabled` to false by default. For 6.x to 7.x migration, this flag needs to be set to `true` + +## [107.84.0] - May 29, 2024 * Added image section for `initContainers` instead of `initContainerImage` * Renamed `router.image.imagePullPolicy` to `router.image.pullPolicy` * Removed image section for `loggers` @@ -14,14 +45,13 @@ All changes to this chart will be documented in this file. * Renamed `artifactory.fsGroupChangePolicy` to `artifactory.podSecurityContext.fsGroupChangePolicy` * Renamed `artifactory.seLinuxOptions` to `artifactory.podSecurityContext.seLinuxOptions` * Added flag `allowNonPostgresql` defaults to false -* Update postgresql tag version to `15.6.0-debian-11-r16` +* Update postgresql tag version to `15.6.0-debian-12-r5` * Added a check if `initContainerImage` exists * Fixed an issue to generate unified secret to support artifactory fullname [GH-1882](https://github.com/jfrog/charts/issues/1882) * Fixed an issue template render on loggers [GH-1883](https://github.com/jfrog/charts/issues/1883) * Fixed resource constraints for "setup" initContainer of nginx deployment [GH-962] (https://github.com/jfrog/charts/issues/962) * Added .Values.artifactory.unifiedSecretPrependReleaseName` for unified secret to prepend release name * Fixed maxCacheSize and cacheProviderDir mix up under azure-blob-storage-v2-direct template in binarystore.xml -* Fixed #adding colon in image registry which breaks deployment [GH-1892](https://github.com/jfrog/charts/pull/1892) ## [107.82.0] - Mar 04, 2024 * Added `disableRouterBypass` flag as experimental feature, to disable the artifactoryPath /artifactory/ and route all traffic through the Router. diff --git a/stable/artifactory/Chart.yaml b/stable/artifactory/Chart.yaml index bd74e94a6..3a6f5a6e2 100644 --- a/stable/artifactory/Chart.yaml +++ b/stable/artifactory/Chart.yaml @@ -1,5 +1,5 @@ apiVersion: v2 -appVersion: 7.84.17 +appVersion: 7.90.5 dependencies: - condition: postgresql.enabled name: postgresql @@ -21,4 +21,4 @@ name: artifactory sources: - https://github.com/jfrog/charts type: application -version: 107.84.17 +version: 107.90.5 diff --git a/stable/artifactory/ci/test-values.yaml b/stable/artifactory/ci/test-values.yaml index d7b40636e..d2beb0eff 100644 --- a/stable/artifactory/ci/test-values.yaml +++ b/stable/artifactory/ci/test-values.yaml @@ -4,7 +4,7 @@ artifactory: joinKey: EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE masterKey: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF unifiedSecretInstallation: false - openMetrics: + metrics: enabled: true persistence: enabled: false diff --git a/stable/artifactory/files/nginx-artifactory-conf.yaml b/stable/artifactory/files/nginx-artifactory-conf.yaml new file mode 100644 index 000000000..8ee5e53dd --- /dev/null +++ b/stable/artifactory/files/nginx-artifactory-conf.yaml @@ -0,0 +1,98 @@ +{{- if .Values.nginx.https.enabled }} +ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; +ssl_certificate {{ .Values.nginx.persistence.mountPath }}/ssl/tls.crt; +ssl_certificate_key {{ .Values.nginx.persistence.mountPath }}/ssl/tls.key; +ssl_session_cache shared:SSL:1m; +ssl_prefer_server_ciphers on; +{{- end }} +## server configuration +server { +{{- if .Values.nginx.internalPortHttps }} +{{- if .Values.nginx.singleStackIPv6Cluster }} +listen [::]:{{ .Values.nginx.internalPortHttps }} ssl; +{{- else -}} +listen {{ .Values.nginx.internalPortHttps }} ssl; +{{- end }} +{{- else -}} +{{- if .Values.nginx.https.enabled }} +{{- if .Values.nginx.singleStackIPv6Cluster }} +listen [::]:{{ .Values.nginx.https.internalPort }} ssl; +{{- else -}} +listen {{ .Values.nginx.https.internalPort }} ssl; +{{- end }} +{{- end }} +{{- end }} +{{- if .Values.nginx.internalPortHttp }} +{{- if .Values.nginx.singleStackIPv6Cluster }} +listen [::]:{{ .Values.nginx.internalPortHttp }}; +{{- else -}} +listen {{ .Values.nginx.internalPortHttp }}; +{{- end }} +{{- else -}} +{{- if .Values.nginx.http.enabled }} +{{- if .Values.nginx.singleStackIPv6Cluster }} +listen [::]:{{ .Values.nginx.http.internalPort }}; +{{- else -}} +listen {{ .Values.nginx.http.internalPort }}; +{{- end }} +{{- end }} +{{- end }} +server_name ~(?.+)\.{{ include "artifactory.fullname" . }} {{ include "artifactory.fullname" . }} +{{ tpl (include "artifactory.nginx.hosts" .) . }}; + +if ($http_x_forwarded_proto = '') { + set $http_x_forwarded_proto $scheme; +} +set $host_port {{ .Values.nginx.https.externalPort }}; +if ( $scheme = "http" ) { + set $host_port {{ .Values.nginx.http.externalPort }}; +} +## Application specific logs +## access_log /var/log/nginx/artifactory-access.log timing; +## error_log /var/log/nginx/artifactory-error.log; +rewrite ^/artifactory/?$ / redirect; +if ( $repo != "" ) { + rewrite ^/(v1|v2)/(.*) /artifactory/api/docker/$repo/$1/$2 break; +} +chunked_transfer_encoding on; +client_max_body_size 0; + +location / { + proxy_read_timeout 900; + proxy_pass_header Server; + proxy_cookie_path ~*^/.* /; + proxy_pass {{ include "artifactory.scheme" . }}://{{ include "artifactory.fullname" . }}:{{ .Values.artifactory.externalPort }}/; + {{- if .Values.nginx.service.ssloffload}} + proxy_set_header X-JFrog-Override-Base-Url $http_x_forwarded_proto://$host; + {{- else }} + proxy_set_header X-JFrog-Override-Base-Url $http_x_forwarded_proto://$host:$host_port; + proxy_set_header X-Forwarded-Port $server_port; + {{- end }} + proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto; + proxy_set_header Host $http_host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + {{- if .Values.nginx.disableProxyBuffering}} + proxy_http_version 1.1; + proxy_request_buffering off; + proxy_buffering off; + {{- end }} + add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; + location /artifactory/ { + if ( $request_uri ~ ^/artifactory/(.*)$ ) { + proxy_pass http://{{ include "artifactory.fullname" . }}:{{ .Values.artifactory.externalArtifactoryPort }}/artifactory/$1; + } + proxy_pass http://{{ include "artifactory.fullname" . }}:{{ .Values.artifactory.externalArtifactoryPort }}/artifactory/; + } + location /pipelines/ { + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_set_header Host $http_host; + {{- if .Values.router.tlsEnabled }} + proxy_pass https://{{ include "artifactory.fullname" . }}:{{ .Values.router.internalPort }}; + {{- else }} + proxy_pass http://{{ include "artifactory.fullname" . }}:{{ .Values.router.internalPort }}; + {{- end }} + } +} +} \ No newline at end of file diff --git a/stable/artifactory/files/nginx-main-conf.yaml b/stable/artifactory/files/nginx-main-conf.yaml new file mode 100644 index 000000000..6ee7f98f9 --- /dev/null +++ b/stable/artifactory/files/nginx-main-conf.yaml @@ -0,0 +1,83 @@ +# Main Nginx configuration file +worker_processes 4; + +{{- if .Values.nginx.logs.stderr }} +error_log stderr {{ .Values.nginx.logs.level }}; +{{- else -}} +error_log {{ .Values.nginx.persistence.mountPath }}/logs/error.log {{ .Values.nginx.logs.level }}; +{{- end }} +pid /var/run/nginx.pid; + +{{- if .Values.artifactory.ssh.enabled }} +## SSH Server Configuration +stream { + server { + {{- if .Values.nginx.singleStackIPv6Cluster }} + listen [::]:{{ .Values.nginx.ssh.internalPort }}; + {{- else -}} + listen {{ .Values.nginx.ssh.internalPort }}; + {{- end }} + proxy_pass {{ include "artifactory.fullname" . }}:{{ .Values.artifactory.ssh.externalPort }}; + } +} +{{- end }} + +events { + worker_connections 1024; +} + +http { + include /etc/nginx/mime.types; + default_type application/octet-stream; + + variables_hash_max_size 1024; + variables_hash_bucket_size 64; + server_names_hash_max_size 4096; + server_names_hash_bucket_size 128; + types_hash_max_size 2048; + types_hash_bucket_size 64; + proxy_read_timeout 2400s; + client_header_timeout 2400s; + client_body_timeout 2400s; + proxy_connect_timeout 75s; + proxy_send_timeout 2400s; + proxy_buffer_size 128k; + proxy_buffers 40 128k; + proxy_busy_buffers_size 128k; + proxy_temp_file_write_size 250m; + proxy_http_version 1.1; + client_body_buffer_size 128k; + + log_format main '$remote_addr - $remote_user [$time_local] "$request" ' + '$status $body_bytes_sent "$http_referer" ' + '"$http_user_agent" "$http_x_forwarded_for"'; + + log_format timing 'ip = $remote_addr ' + 'user = \"$remote_user\" ' + 'local_time = \"$time_local\" ' + 'host = $host ' + 'request = \"$request\" ' + 'status = $status ' + 'bytes = $body_bytes_sent ' + 'upstream = \"$upstream_addr\" ' + 'upstream_time = $upstream_response_time ' + 'request_time = $request_time ' + 'referer = \"$http_referer\" ' + 'UA = \"$http_user_agent\"'; + + {{- if .Values.nginx.logs.stdout }} + access_log /dev/stdout timing; + {{- else -}} + access_log {{ .Values.nginx.persistence.mountPath }}/logs/access.log timing; + {{- end }} + + sendfile on; + #tcp_nopush on; + + keepalive_timeout 65; + + #gzip on; + + include /etc/nginx/conf.d/*.conf; + +} diff --git a/stable/artifactory/files/system.yaml b/stable/artifactory/files/system.yaml index d60122680..053207fd0 100644 --- a/stable/artifactory/files/system.yaml +++ b/stable/artifactory/files/system.yaml @@ -6,13 +6,7 @@ shared: jfrogColdStorage: coldInstanceEnabled: true {{- end }} -{{- if .Values.artifactory.openMetrics.enabled }} - metrics: - enabled: true - {{- if .Values.artifactory.openMetrics.filebeat.enabled }} - filebeat: {{ toYaml .Values.artifactory.openMetrics.filebeat | nindent 6 }} - {{- end }} -{{- end }} +{{ tpl (include "artifactory.metrics" .) . }} logging: consoleLog: enabled: {{ .Values.artifactory.consoleLog }} @@ -87,8 +81,21 @@ frontend: session: timeMinutes: {{ .Values.frontend.session.timeoutMinutes | quote }} access: + runOnArtifactoryTomcat: {{ .Values.access.runOnArtifactoryTomcat | default false }} database: maxOpenConnections: {{ .Values.access.database.maxOpenConnections }} + {{- if not (.Values.access.runOnArtifactoryTomcat | default false) }} + extraJavaOpts: > + {{- if .Values.splitServicesToContainers }} + -XX:InitialRAMPercentage=20 + -XX:MaxRAMPercentage=70 + {{- end }} + {{- with .Values.access.javaOpts }} + {{- if .other }} + {{ .other }} + {{- end }} + {{- end }} + {{- end }} tomcat: connector: maxThreads: {{ .Values.access.tomcat.connector.maxThreads }} @@ -139,4 +146,11 @@ federation: {{- if .Values.event.webhooks }} event: webhooks: {{ toYaml .Values.event.webhooks | nindent 6 }} +{{- end }} +{{- if .Values.evidence.enabled }} +evidence: + enabled: true +{{- else }} +evidence: + enabled: false {{- end }} \ No newline at end of file diff --git a/stable/artifactory/logo/artifactory-logo.png b/stable/artifactory/logo/artifactory-logo.png index 3e8ac0d10763a51d456cd900450ab8ddfc89a6b0..fe6c23c5a7f87edaf49f883ffa99d875073e2285 100644 GIT binary patch literal 82419 zcmeEu_ghri(zUjr(D-PRRRmf@LCGSLp;Zu&EGjt&2qIB(#vYX@K~O<57!VPVoP&~8 za#C_oa#AEp_-Z%Ky>q|&{t5Sod1eMU=j>CvcGap?t4@HLiX8R`cGs?5SOs~RE4y~> z{R{m=fq|cdkh!+QzbNhGwH7qG?EbRjWh(35t}4ga+$_{AeC&MH|I?!WK*&sE$M5&b`&jJMx?v#>sZ{GTuP=jz1$9Q*!{C(H0A z?q?Lu+V%fg1YPua_}l;SWMVz}<6$-qhJP;Rk3H|6i9Py%JQ-JX_l(}RYRvy(5;fn5 zJ^#m(*%;M)gJQLI{r~#}%lT+$|9?FBf1B}N?(@IR_z!RY-^uu|v;4m>^&g?B#(!j>|0VGMf*k)#;Qx_$|A(gj3;+EO+Wtr4{ZD9%Prz_QhqAsNELo{;y5`4_ zuw}cRaYw`D`u*)%tMxjL=|SvvS;6`f%}9x*C7+7z+Y_TX`wS;4-qZTnuUB}S+?=`4 zd%rs&{&!j?(|&2scVl_&Ss#VB7af0Tm(=<6zw~k{xyUgct@_O&LC}j>q;G zQ}1lmB*QHmORQ{~liX9j0b%jSxwY1tXRj6x=x;`<&ANNPuSz02XSL3gbfwE@#>M8) zVsOW%uulwsZ_7jVR8*{#_psMK@K?UEPVjrr`*pk1_j%ff1>GK@3R@dppcchtQ7xl_LCaX-Q;UdQu#U0QJd zomQWIOq-8iZEx=^R{tbN_Bx<h$H%tUZMh6q zyI-w*=r-zRF>p>S7i$V&2>N5Ru(MEDy=e5``cuTn(o(Qm>v|g*tg75x9heBBV)Zf| zo2`gicz%?jhDPXH$w`ClFQ3o*82tM3JIyfe-R7q!`xsfoiYjhtWE}gGR0w}TB}F44 zT6}58NRCQ)&r0j&0A|JI=G4BQ4TG9nqMpUGni}p)ycOK)-#Oxn{415eYxW5*y&4}o z=waSj|0X?wr(e3D*haJN=MeoRc+31$~)278*# zd0jl&-{SE31mme6tJf}*+i*_{IQ|Sydc8h36`3-}J?QADd{MEi>~A~}W&kh$t0^v? z7P$;jkK%r^t}DTOb$Mhmxi|5Lw33CoLO~E4zw5|Sb5n`5=O@>XA=zqC;$N>s2K86s zDM>aXD#5C58Xv*_MOu}qY+`y#ewo?muQ-!IgQYe>hk53+TgAy8HfO_c5bbh`+8-2Y zmvGETl%L=#`RmRfvmd5Y^ZhjR;s_0Chvgp;zyns5Gzyu&7)DC3EIi!pbvom--TV3$ zW88%9k90Y+{rgpKVGVT$?5*@2bTtB<_v!!fz-*qx{gJb4LSm%N2ooVLoM?wFdSbh^ zz!${oV>Hz$`N_RnEt;CG08{pn*UL_)0uJG|qVJ=5evxZ5mLnk)VlpHH{bYwbrF=bi zopdKPEOFsbyR{Hgt?h5N#~0?}+QbW%@OxDMBDhA^?P*^x&zkw#AYN-FU7kuOem`nw z%Lv}!2|vYGE~$|2m`p3u@pZOx~-_9clb$?Uk!ttFm)N+{kG=I!4C%sv?bhAVAqSrT`HKCJ| zGmixFIZL(qpP$-wm0BGz{frcy<92mbpUeH zLy#i-5S(?6S)aDt?#Sr_!cPoaH%A^YP?)OXAAkEm%kqIyvnuEA;vFOY%R8%1)CI1g ze`L{YX9)ttJxiStE)Ulhlk4_A{B5utc=D1AUX0kAmf_|0V-!O6Q45i%tg63;|Jc8V z27=Mk7tW;MM9?8u$?xEK9si>%aNJL2?y&x&3!lh-9=99ph#4>tvTxYRJfh3g=C0Rb zyYqBB296wsnvep?A=>co(wwIwnFcre-->%g8a_=}_kTp=uYvbW`W+y;^4NOoU9pY% zkr3><{LYz`;R04CJ+o`))sx9|dZHs)qlDeRQ@N;aSj5&)WKrNK63%(KEPYBlz+=Oc zdvfYsqTnCfTfvKGsZ;HE_vMpn?XIR%O+UvOH(uF(zxL)B8O7u4iQ8XnD{?1X+FgRv ztlymadj7o8AFI*9#V^$uBS?q5nhh5}u=>@vHMFVp`FND#WnC9s+%BR6DdKo8>kpR< zmsl3m*vsSY?}RGOER-fV2(F~NsW}oMEBVcrW8+sN9Qb~hUARj)L+&lQ=6kTaJZtSs zPckd+?4LJgmjiN5)FFw3^b(2FmUV~wC7E`&9f2kWtf8ClCj3`K6)Om z+TI8M`V%6q0Bslfld{7L8LHloP_)geGW)gR>U?)9Ok~meYpOCTL+tMHz zf9JX@a9u?EZ8g$$HpJ&xztj1izhVv-+)Onv;wGbz;aDiqb_p3=uKDrGWKwE*Qj!!v z>WjfXUFKg_k#X^o80GZf9OqDPWGxH>*BL8F(Db0E(R+@58g7!Jq#jz#_UNe-(G$bncr=tG;?0HZf6Ij zP%sspzod-LLICcyg~XNowJJN8lqkN|2geC`4$ML2ioDy?<^a7oM#55dLLYtwJhw=7 zH;D3~&b=OKhD9bDPA5w7jM2M@eb_$H;fk#y=Z>v)Np;rg+&|DLR+Dge zu9Vw=orH{P=qL&l6UsbB7QWtd@c3anL`K0bmk38E9x&coXM2yQNJf;LyEO^C5trdj zdxW#eNo$zMt|YEcLCSFU=*(*1L2EfiwA=Ga_P3d&`21G6X^UOMfmEhD(cy}c%PuGTFv|F9 z?(Ly->4rKPSxe|7F;lym)>evooXlg;S#(ko)*-zU?j`un zsc3mL?bZwD?FvzxV`J4YW?)gdQz@Zwe+b&S5n3Rgn|0Vpr|My4el#|d$7}u7Pp&KO z`sux}?1{&fjr4<_4r{C~-8P>--{>Rkm{S34a`^)M>UVZ(p1_ZNw#++D(g3MNvCDG;i=M`=jPKhuSCwbmC$?OoUv98;34UmL#mK00 zMS5^yg|@LS!nv=Db?1p%@Wg7B;1J|KgaGp8?s+%MnneVfzAfdPho2^LVm41_dIPjP zj@_r|S>7U~)5LKncopQ(QFR%|T2Y@QL# zk{o!RcZ;;g_?vL3PQ~!|Bh*EdC%?|BLt{gTU!yYH1Fu4$!vM&Vs2Cbnmg|;rPwWyQ zIkJ2v?40|!N;5k3iMKEhG#-$5wzI~$$_OKJkbR(iDXErsD}@tFdKF(V|CzJT zd|@S!_Ze?-sCihjYxC!wkPMY6iAL%jmZ{aa!DP5Il2Zu&5 zNxOu-x(kycY#**)xcVEGU!PM6fUT)t{DkMk>PVew#SV0I!vO}Z;$|Wtqzyjew#MCF zQRj(o@owe(=bXXL)u%`yv`0`|V9qBlc;g=Ote+eZuq#A`jo}ZzY2oRHUd_JU`2LM) zq;!>zRAi`7^-1S7$4W-fjoN#%oO48frw>-2KWwyt788IX(o|F6u?V`M@}#54o^4oE z3Vbc$V8B|7itavqlJs7yIuKASvC<^3I!AtCx6Q|pGvtMB22Mc$FNry1A9C)P&BiAl zifq)#R7d8kBnR{H?i#&`oJ78YusYEGwttj;R?4ZZXQ0iz- z9mXY~HxuJVP!g&w<9C|=TnZ}>wc&vF;o{=^U(A7sfi)W|MTN7Bw$7Y_<*?eNIsfjs9dM74K zMXYDlh*!>{Ysgs=9+yu7D_}X4BjNX9dx&;Sg%E2af)!<+!zQ599v`=Im#Ox z+JG|n^Qn}UU9it#0>t&F#ZU*&=zD8-bX)b1{E?fo@2Yo=ba%*YE9?3%7Oi$9Pf>(r zX-6xY9D`*QlVek`0Q36{oUEVnQU#-YMK(fLXgRVp?7MeTig}8JcuXOk^OiVRnxe-( zsRVaMfh#uhHi>T`Tqlo@a&RduI{!xHo)`qC-IyX2PHN6FvBT}cxz&0dtva%)0UXs& zbtc{+x!ne4cx>-5!#<}*j&RSt9m2?^>SN%I2F&_gkpb|;3rXp>d&d#t-1;O)O)}a+ z%pS%Z}l6-^hS?JjR)-X)|=ps z#P?L~ z>Ng^k8z)5>P25QleT~i)KtWwh2>s^Sl=GxZS~9=@B{Jto`#p!fFDLM@f4u>Y+4!P+ z^J~)TEWpw91>NMdT~uuccF>mCsl@%=3j8r7zvm#A2s~!Nn6Q2kEh~jwqBtoc#c}6% zE`Y3xxh6JAt2;(~)paS<*e;#4VG0Z)n-jiI^Pf`1eJb54*aJD?gvlr=lY*%aS=Uhm zG05Ty<-giUn}xU28QMzqg5q;A!67OExz=66S@5ma!rSPTMHz10O5N@aWORSJWaqSF z#5T5;w3#+Qb6tI1k4I?>lSoVcx8{JTNBLHy&}gAL;l=l4MQQZHcPk-;Mz>jRKB6xY zyTind_OKdWm@y?^3*MtXo8YC`|N7?frqZY%f}{dn2_A1PP7;nOhkjAiYN~)Cdv;?{l`(^M)_4XuGcFI2^xk>Q$4R^jQC|}U; z_4M$43y$C4%bpUKoaQB6aSg6W6?|@puE-~>I#x1$iZ5Gz88nEn;V$BSiu>k1ekCbC5G|zz>fQ# zImQ2O>i1$=iqmh?w4KKW!RazE>k$FJYSAV}@Hp}Dxv@oPD(@xbU9v#Vg|VN~=km@u zFH2aGa$G%%$Okz3!_XDwDDL?w6({*eaz-PFup4uj!4){Q;q#Yf6AZ1-qo1rXK;T>1 zU_xQDiJC&ygtK?!1~5B`_l=rM5uBdqD^@L`#+Sv1of83}R<6tHvB4BjN*0colE zb6Mtu=E)=MVdlj1qdp?8BdRPhLK8o}-ZM1VSWQ!mN33$fTc7D)KEU2QE6!otD7ZEF z7PxkwO+%;tj6F*p;!A@AwBi-s9;-J1w72v4jf;9S&jFOZf1ngNjwHd*&!v)%Gs|x* z7bV1NRbW+o+@3Eoin;=KsLX#T-FWcul%~O5zA3F_{WMg7xEEZP~x4IgmyEam3|c14vxDCzQFwJ+1yrks3=QpNIVC z0{K*Grmye8M-L7@elXJU@g7wH>!9O{VWSH!WBw&h6W_|yg_vOB!VoNXQL?`Eux|=W zitt!YEj-gno4yDk83iM?Xg<0gwt-VZq*!_iN+rdw_b1WG4CKX0VQ9-^uK(h~!80Eb zDn6$9DOa5Ee8S!Fybg#^&!bizjkQpV1eKTEEPOwzT$j(H%UVt;ZZn-SpYHvAjr^cA zf4c2ppzTXetm6|xD@v29HfhU;rTPvZfhQCnhrrD&IS;UhFhxE#7uVx6QxN1moOB)& zKws!I#4QEw9xacIjcujH$TCu_ zc&@tk$CM{VkKc>Wf&)Bc2>~hd)CP(OM=9^m*WXthOg6N*6-KZi|G?3Iq1F1=$88Nq zU9Ver(vx-FLvAPW7mN)31!Qe3@8|w2ZcY{s3XbT;F3)~N-u-nn;uoU%)gflfo=DRN ze_+3k*PC{qxY3%Kc~*;txbU`(dXZ&gyhnX;S%u0)RB1*f#Y7+X#lv{KuT0}Z|9X6! zi_hv+69pP2HB1eCp~D9sYmw}1s*-yJq&#JYN-M!9dr^_Mj4)7w?dtE~cz>}mrkb+s zHXSR>iqg8aYuJa1b7cjl+eZ_)EPN80TNs8}9DoSJ%Dr1y@Plp$tL{finZ!Z_7^n>E znp!d}I8pp<5d~{BxqU^=sY&|R)^FCTN`D7=h$aa^K)i1rB_(PuUs&SfN|sWr>mDjC zJHPhG_aa292Xfg561*bEvo4h}-L9Cx4Bt7yp*s~=Zg`6XV8i(!;%$hwT?Bj3oi}Q4 z6}so;UF|n?g$XZ>rMqW5;%sj@%=0XV&! zWWFlpcj|sLY7dGBhobP)1Tjlox4Hs?T$m&gI$ncUy=Cb%se9Pf=!gb4Bc;xm7_FMN z1LT?Zy1?#Hm*^_z2>AG~sY%<+BWu%>n^m-@gTj-K9K$^ztm4O^_c7WpEwht#LF@O# z6>}fpDB%U-$%aRdsq0CA;|Y^run>{RSb-X!8+fOrCDRw;f7Lp0;ocMntu%W3ETy3U z)fbT#qcA;7mW*2kB%wo0>Wy7;oZk+lcE&Cca^M4Gzb9s@TztYPo4qH;LT zQ^s}KCMEo9Eg2gPMe}yQyVa(4z*GYAhcHR-hndDyYB-ET9rvvb*VnJfXkLz;!S2s#HV{%lINC3%<^ z+;NWSHcB6qG`B1)-5?>T>#=}g<;XrT7fR_%i%C2aKJW1$12+)`9mD*s`aslA`0`6v zEPOT}wyLru&G5j%?OCm+o0<8$t{jFI!8&&o|OM zuD75C2E-WO<5&ZZFkYgaZ6jrGg{Skt=J1}&j0)ZrY;fE8iX%F`S0gg?FWDme22kXq z9rOL{!|;f3-gnTjGgMktr|aI+!)|9lgqAPO+$ux7Lk|GLU;P)iDIBliB@|6t%fCK< z8Vtuaw7KNC>mw+yhBF@YhT2Zu?r~>@J5jKsiloTlxj9&4qOh_f?z>brb^Dj!}n?pXP?Ced)09wy!6lTbrpL* z=5QGVNLj;8%P_RTuWYw_ei;-#^E$mk8+TIeDp8Un-_JN#w?5A4@j`Pl)vu!t4Jp&x z*E_y-l8WcYTEGcZ)8Y{zEItlB;h#loRe|Mm-FRXxGVzaHBFnf)vRYM;fuk2ETYGmUFFjOQBa#_jiK$p9{|S@ zd0Ye74e}9ycfng52aoIjvXt<{B)wyj>Y+VdD%-4urKt}9;OgDY_|9g`UeCl#J5S@{_2nNk>B$`flE9nkKfUiZXC}r?ErtM_l32c z8*7EFt$zSWcM;+r>k^IO?`Mn?`rc~^3=+8jmbxxj@-82}#~!weXtyh&#APaHaqi&F z$DdhE_w(N-wsIK)-*y6@=|njtO~Se*IEecDHvvIZKqg!`j%v z{_zs_l6Q$@Dpb%i`}Mun#ZRSNpjVFRd63S~v!azatJEA_QZAl?)N@7nrkD~U1>Q_M zZ`%LFs%K8-C0rxw)_Jcq()(aTm+D8GOg@u^pME!2|8v`5+0XllrukC6i5{eninm9l z-0-QC8K_|Rk0P^ynxZqp?qKF?&BdPPctW!P=qox~px=BJN(YXFrTe>xg5=PV1Cs97 zjqw>~;^<*@*S-FADe*-Y*Pemt8$fEHxOH^$7!>dfTBWwm09|Twq8U#JlKM6MoqT== z)yLe&1za(yG!&tyS;~IaKvyT?*`7zl>f<>3lM;K`uQg=kpgqWgJ;+EI9HPX@7goNQ z-F6n7cjYxXL;F4J**&wFBi(S`7y7y+A^ULQq)NnqB=R%gU;p`h1Hl+qn7R=N%y*pd z^HNeHOaY;?o`(~tklB(O8g;U*edo-`1_yijiY@QHzy)U?!`a9!thbp%KjT@j z$zydHo|c@qa$m;|<~-WC1n`__1?lLfhj(zuF5*>eE`tu_OvesI=UMZM_`c*4ARB<^ zO8x8f#IU?dqEPgRhr9GZV;Hi!|}bdH2)9)|ma zoQ_=qVL}DJ@xVQ<1H2+!J{u80)ML4OgvBN9oamI}i3^n*0=QPpcmCu-3=|%Oe?t)h z1KI5(p@k>ZBp6Rm2Dd@Ttw?vhF&_}8UGHiFkyH>f{45H>;(~JLFP6&D$u(%FRE=|r zM`-7hh_hAjtdSfB)U9D;e4WuNYTDL3s{K4D{1U|3OxB!9R^ANWa@I8-;I)t1iY>4C z7VLxK^hl`5`q9uzFAZBUM|+>K6><`beFV6IHWABpaMQiy9~zhD5Bcazq&cWx;lRcF ztarvYSkJ9Syw@KLqi|GDe3^c8EaNn5qDub{iTne8&}i#(WL)931q=Y>;YU05soOEI zDrQ!EL=zg7? zW1$`o1OQ{=-@~0KnpR<(a!c!8Cb!NB5Y#}rl%347lU5z z78w+_k*d7ao*+bWyfv>VS9(Hu5DaUI`Ro?^A=7o3jm|8!~|x#b&!8t- z#0A&BpN-pAx2->~9Jm4OnaqinmMhy3w`?^YGA#yI$5V{VXvzD&zM@=$?$ROvcL@>w zilBll4JTdCB_3Al@o3$*rr7;QeDrIchSCiM=9*ae?ji!R~3H5WQPpL#5 zL#>QeW|X#NxPiG5c!yGvoi9N*X%?!RAcs7j>lpIA;ELa$h63re1 zH`c>6Qwg}7+7Nwb_Xg+ofs#~wk3&=tPYCRW)!~SU&;Zp|fLkh$UNYI1?d~~R@c!pVe`3%%V#^k#hx6QZ}=3%dXTj(RA`or zgm^Vl9uJ!$tri<2MNK3k_P6Ns{S`pDf8TBN?3sjBfM84e?q%^b|scDdk6wZ1?C?hf^V9cj5_O*I5>8 zVFfExcF|xV@rXcP9QYpjWaC}xo*z`G31!#*kmglF3*7D>?5h7Yyyx^ds8;GK-Y{h4 zVt|=-b!yPqH{o5&xw0304(!7VY^BTjBNfQ9k>o08Sr5`bTkURPdwO{& zBcQwai%^E$o0jjfKTso){c@t(t(a1i&xt>}pG*~=w%NdhHnSYHdG+YEM8{$H15@w^ zUJr-cGO#MG#Ehclq{)KX3U`Jqc7$9uA#i#{rc`^xEr3TK$IWFdv=&zk=>2F6KWaoC zY-j`k&+{a2beuvOEc{=5Gtn5^QP3d?#ni^M8TBaR#5L#1*WZsr$fpw|<^lyp{6-0> zeF!*}dF`&_TgTJ=!B_(0EIzuI2Mk`z!Lt6Xb9k(W_k1#%rG0P2P$1|~MP<8#&v()N zCk96y;XWedBqAdB(Dsk()vM(3>$hKfX1VFmUfJkL8)V~+P!F|lI;?XMogokUF zHZ-XO!V=F6=t^W^Plg zH!VJllen-H%rU+{z~>3KF@&=@`2_1jvwJWBJxh)d5LU@QB*aPS{jLR>U$q+<1D7`u zl!?W8Ek}I*3V;Ov&$KK;c0qp(@KSAs6oY^Yk&!{l{$06Ph$ju|H(KBzt1Zox?i-Of z5JX==5LwBi?`aDQMFOFJ=mUwS*xcN_!UF-@AMj27D=L#^KZib;zDh6v{FRuCfdZZd zv|=Km4aPOx{PsWWo)ost-Asn}Kr!y2@@o(~;nE1J*|mTa=@$ReD*QsW9=hoaIKt}$ zM_1fsekhhs;^y#>Kr2?#SFc;`Gbb7|P&7C2tSagCI4fu=eMr4<#$K5Z+1Lga z)ub zyA}pEGa?j>LJCE%_|QU;@ZfZcatbAmGrbZdyn$}RTzdO4P)nQq{-OL*nFlpb!mvbW zdhd_%R^0DrbIh3G^_QRO=dN_18cXdoyvvn_An-dK^3w&LM;F623ty9iVO2WwoBMsl z(tp1|z9dhy+t<19IHvrGrmWZgZtqwOM4&TH=CW*pDk;b&sDN?&9AQ9%55o~H#JN1y zlN+OKtBXcL#kwE^h)${Rr~LZf@gDHml=tO?B|!Y~I`msls79jZ*Ox%D+~mE6MRmr% z8vw!bvNpEjYWEd z11`Hh-^xG2fN}+tctJSLb~xgf@Z4vs>;;=T)3sVD_k;9l;eG9A_7udn<7F`b6OL*v zZBB$N=!9q(RTf%0ciJecuTP$an}p+`fWNQZvJXQ>!-IPo1rn>1O-|@GrTM=mi^qCo zIAWXN2;kc>&~(}a)}fVoJnv{qCEv-73Bu-p635&3=!DdR>&ou!JPPF|Eyc>yawx(_ z^;!ezA60@F#xQ$3?cw(nqzA;m!~pqL0%9O)<^>_96lkCbgCIr0f@SI)EN29bI}Yl} zV92fOHs){}GP{ZhFh``z>z2hj+a==*@Bi_^iC2 z09H>$=R2QImQ&YYbX0u4}OOd?S<>H11%3rLT6qdT#kM?!zVE z%!yQ3&MN(|T8LNmF_p`sF%oZinr^z^F)1ru{Q)f&H$|OM#BX0GpNh6jFkG;^(@dum zqzp=)gHZh56cP<+f29d>c%c1Ui~MH{sE4EnAG-&`L)Pelw3+W?5=A}O z3#T~7PNdrPGXetjI%u3jg{m1%4A6#msJiD82&1;cKvsS~t&V*Pmomb^DJcwv_Fvc? zB4uy+Lm$c0#=_*@fUiKlBp4sFrv3*Ct-3RML#NFu4S!eyrd#0|bFo zpnS6z`{Ap6mw?mqHuBEQRx~kqi0xJ;x@cDP>D+pPFcm&bm1xKJmvH2ER!j1CS`4P@)lynU zuhSU&I-(!Qev)Jy5GY(0zm3e^!Gd;3)k{%7KBDUj>@E)NEgxUAm5hmHH)b4L zn*FUoL^Iad2~fVW8E~5p9IZPtzMN z2wS2Ku|~TEKWYXWwU%omNq$iaUD_v%YSZB>y^b>@v{R@{3+|j-+3I^SwDCyC_lOW- zC}B%BvSCI<5j8}p_rXq=}p;vu$kFt!t$rjRAZ^@nJjT|eqU>Qdqg-&KNueJSi$Q+%|^fOlo# z{A^mU*Rbd>rvKdO*i$G4g2Euw?bIo~6f&FCQuoQNBJ-x`1mrJw33tfHX5+dFMs(xE zB)^K75%;|s=xcG$E?mqIf;+LJ&3?9+tO<3OCTOabVQ9g`KnB}=ide$2r$5eO z9+C%m_$;NBXueI$Dy#Dp`_0iPas#bZ`QfWcWzT-0mi7w+xYLrxEf569Y7PMatS$AV z%h14tHXi*(+&`|Y&j&dfX&8r-uvM=H+fp^21e-7*PghqeL&BvnPQYI>%6?4%>5dXX zyeska*w{;lln=pr5~W4ysUi{S^rU@i5g;z))k!z`yw>30W~w`dW9fbeI6Or86;M6@ zEFVCL1u`vY-g7ivd#=UINb$W@wR?N^g2T8I=|;Fz=wB=kOlgXF_hjGvj49C6_kb?% z3(-WRNqCF|c)42u-_=Y((NcS(eZ8jClrG~Q2BskdELT?9REx&YVL}D>$@xRH@$LQZ zBO)7(8CGZC8UhC>F8cBuO1rlqyj&5yCU*HQv``?ZD18o+9Tww+u4v&@%Seb)GD&B5 zm(YQMKKCTJ#6Hy<=Yq6{`a69B#C9X$Gw}-2m|QjhL>|b;?_}=w`I8LX!EXFM>%2&L z(W*wqj&h{s8bZnUGYQTMGG;j<&v;9A{bMHD6WFEY3JIAy~)UrRbZz?@@hbD ze;TR7ka)SNGf9h?&K0K7ipOZxl}nv>?z2J`BFyXovtG;+sb9HOi2G8Os8%*+2Y$H= z!^xyUouR^0t;gVG;ukjl@*CA-4D38ljAYo%f0WK5ZCljYNOd5 zEP|b1+6Z`fscPtSGlu3scT|Q`4Rq@wn)i*J)bM?VML_5bS6l9k@zE(Dz2NON{{!(u zRtzbX-RGccF$e84$HM4kFqoq<5JIom=du^I1TPxLiMw*UH8x|*l*qYLdNn;;N8pg z6H{*8Qs5tKfOUc%YmUO^vhl<2ePQs#`@HES7B16G(vLsZG18pv0$f+vuaN|6 zSv6|3e5r!{0S?&mZ<^}|)n_QZ@?XXiX0d(ZFIS*1{v(CxzvEskFsuEFoijx3A4+AY>Hd$+eS$^?pqC;X?-b8Di!Fi-UIOFtuwqVYblCKTuK{dbVmr86+{wkgpdLKYqI1j3sw>g;x@&SS7e7plLgn=2 z^xXnGItjC+H9c z2U**Q_Ll(rJ4lCY(CwLgzX5+1HURt}fUtUK^_|5gulLhmy{=^Lk%r}fM-z*FoI6m4NRW0(D3o$*?3-S+&#jooiWT8 zexQ+Yf#0@-00SUS@CHOlLyC|4gG7(P`#>xKnpQ!c(hIr$Zp=%X*OnPxFuUNa8hy_H zJc^H}t{w45di4y5k4}w^C9qqnMlgpWz&(2ZmgZ1{=*4IqrqLMJM`#gu30KHJ?5jco z(~=YwCQ=Wl?#;!Zi0G5+h$LGCd0E`P8bw4bCcgSn4`B0BnQyyy3AFMDJHPaV#a6eV zAraUC9im;#)j<_&mrY#N-g_JdhV#ycU-loC;XnWlOxv2xvm28|B_X`sEx_=;#N=APZ*$@#_rH!i&%QqPgFiiJK_~u397-=Yc+N8T&MT$-( zqh>uU(+#t4I&GioM#F=qbc4|IiMBNb%bl|-2Dc}u;TcqE6L&f0jeu>a zTO#&>o5>rw%;rNDzEmdCzV!fcfy-Sc)3lFq#Uvds*%eOIrd^n=r;4*KW6480v4b6& zDg1XFpP{*8&Z_Um(b#apX|fOP>a5S)JUX}pXAR|t#sY0KL`%=orzS`2*ku?swVa;! zQt^lyyKaKE?WDv-Aemsu3U1*%g^eYQkbOMobEqm?$$t?G#fjCA@~;7(D4BP}h^h2Z zIp%E;Bbq#VmW=mfKvSY%JvRa4C)!Aq_;cn66Oj%yEJyrQO={kqq#e;CLWYB(iLhj= z)@!5_1N@yr?{+^7QIE&FmC@WIK&2<@`IB(^rwj+c{3ocV`>NN7lKm=PqUAQw+{RjA zly?k>KYGjMZ<$RXDhn91qDmN`^%;oBWHiCKf;i-qDr-Ln0gr?rhhwi^WD64`X6Z@? z+&Fcz+KpVQmtV|@@;PZ-5HVaxI9Hlt#8->w_Zt5~_cAa8>fn74N+mvL3(&~tBCQ0B z4hP;~K3QFafx<@K(S8EBD)e9&^61!x!H8x_DvuL;i69Vgfm5;`QBMKn1PWiyV{P&j zFVykeN(r%o?7p&5xN$7BHH>tVc!DjSH}7nNK2%JNs-KI-`y8?~jd82(fBCgN;c!aTN>m9@OP_XJ6qf~yZC=r0EBd$lCF@^Iz}9QoO} zr%xo#8~`E=3Aolzo!y00VHOf%Mtwp8Z_DnBC=NwN*oq7|a+f`OKEAVvV3;nB1Awyi zHX_@n7LPDwf>o-bNz(*0gT5m1(?IMIY9PH)4SR^e;6m&Pkh|`K?4EK`@z0FBsk{+X z1_dFTbJ{6p+Yis9B3AIRoG&oJf$%0*B;1Ns@SPa0gS<1MW8sIc>tBdH)dD353?wQz zjZKjB%sBbH%BhQr&{20A`}(z6fC6fzDjLpC@sK9k`iEdrvsY~diWdrrMd=nWEhNBQ zbYFzTw1S9BMI(8FG~|M-Pp*U+AP|C!EFPU5KSbs&Sythvar2JPnUk1*NiK<26rQzt*#oCLe(KXGGsHXcANYZN4A#Jw{r|V{Aei{TOrszxPi`6Ms?8Wb`|0 ztkDa+&4mRF&2w$Xmg}`5Efdrl`o!)?DX+0-J+S^?>7`RfUQW&qAM3$m{x#@os*q^+ z24)3@4n5TdGc3%M{`R6euK4>=7AYm|g<)eImIBTri@}1L+yWaLeH%9p%d=dBXjTSp zJsBr1$pPHrDe;fST1J$2UZEMQc-XI-#S=RTx;~d+tr1-EJ-+Bx!1%bEN6JmHbePT~ z$^fl+!rk35giwo`{|64aC`(XrtHa!sz?PU{dHok}QxVcToB-94^Zr9ClG9H`$me1g zOnj0)x2c$N|D$f6WIzK2cQUf7r!?+-hYwb?#hv~0t%_`3sJ)VbB-AYcBEGvC9U^|Q=G8~?G$Z#h12nxB^OFZFy!;Eg(p+hI6%D;u1A1 zu9nyUWu74Gvzw3MTBJzVUQ7}u%Ra4^x0DkVc^xhUCO9Wrv33V{o;jt)nJX!{QXb1^ zWX!VlS^wIz&nNCdLDK;1R)}ZzIvz$%?0ID}CwX){`;5eqJdhDy%C6%_Y344$h72f2 z9~i6_>E16IDg;6&CY>pV2t(j=32cCUX#}uh=kdKLh}5sK@ih(mnYYem4o1vAJoD!R z3fG9BV)}i}fO-7mvGFX_tG({fPzZkW3OxVJxNIi0=j zZf^-oN>hoQ$PtMdKKQJ;aXT+h*$R{e{zXb>@4*Af&;tpK;RF>V7_iAKK9|3w(X>bM z>}D5K&9N_@-q=ArpQ&Q4QcD18#PZo1Gi?E}b({Ign%Bo&lE&vgl z#S?GOatnCe16`Wt{C@j)ri8y~8G&L2RrBLPv0r?*8`cZ#V=aAE?h-s<1wXWdWPte` z7BvLPY>@T$$K!kbDk4teFyW_GmF+5>dnDYQc>0ifBSd<%-zKJ2;ipafT6Y4he6 z8{Z?TY4NxO@HfvcHtPC&1o(zYMOSUkrMErn+AL>2BCa1@+Kw@_@f401y43W%PjJ#4 zQdl+`lb}WtYO*wKj41sosHNcy)(CDu;m(_K*zC)W!(?KHZQdOplRVUX`S`dxe4z)Q zscqH=#oXT?(foPb4p@g6uJUJ#PP+T6D!@4wQmZz;J$XcO8N_fyzrDg^MAbyg>YIcN z0u2L>N?nMML$i*YSMwC`DHt?tF&>nE$afH0Xv}rO<7cb(BUKP^nFjd2!}%b;5#ScJ zXEBB}WuIUPV{QJ(<7lo2)6^%S*$a%#K?;gE5DTw0KJ2wGR|<4r9TsOD zj$!?YIu`%x2YtJm2wzuuZm{{SbQ2XCFt--_D)Po3V>8l258eqr*dl7kEi1W^D*lO2 zj1p>?T|^Z?x=xr+uaIp(OC$}`H|l&|_5)jRoXxX-?+~UyYFiS4SpM#rMYpuD4@T%b zw?{4Q&|Gh#IGnNm)CE;U_;dlA ze(bl>JE7_G@+>`|ad3ux>p77P?TK+}kfZxR|IeZPNRZsz;3i8+HEhz>;`VF(nS zfsS{=7i+5u2p>`o@EOgc5oJdR5E;*}EEeIk>l&?;4|SxH`%k??awlFkD2J(!ROpb-gXjLU5ane@3y>|yZgBhL#Z{h{ zX|wX+Tbatv3*aXFE1O1jKS=W0m%k0PS@qH1(vvfLe-5@u1SakK+_XVD3RSIhw@pc_ z+;FYu@#F_crPee*w^QnXz0Ao_@sa#J(ClKsVoQTp+%s%1M6@Aku)%iL0xf#ehk6oy zJ{NSe)r_Z4GnY3n)zj1V=C&e`8%fznQ<3|25V2;YH$&jbnmfa%n6 zMv8;-OX`LGU2((jbv;yOL@G)&cfvKA=l`OUlLWd&Y94+2ftl@1Laf{?XQ@+VAYAxc zL&i++3SZ$7HMEx%-te(?uXx^W1RJyCh;?LAI>M)mI~ALBy=7+|6ylR&eEs5OuHq~|p}vfs^tfm$^wkH_28eOKo1BP-;gCxO;SCO-d~|NqANqxKXNJLi5r6-g2xmkE)^RGE?(u^GZ(L{bFNFal59gbKut19#I!e{hO zrlQs!6gK^jnfPI>5EVADd^v1Kwt&`x$q)S~YTLihv7=gIYTg~FH>i2cz<3i+q;TEu z&*s96!8Wi59P|{pTXG=SOqo9;lT|&V-DNV`+BrM%TL{Gf6lr?@E_yh-1VwEHJ@Iq$ zRqt(@L-zvI{nyu79F>QHZ#Iv466sqP`c+?8Qcmjsu{|T1XVI}_`hHM0PJVDiLybkK z-8c z+=7iMMP$LvSHTg4ZZd>6WfY&r3jYSNt$qyk{NEwOQP~Jum9c!4U>X=hpX+((`p+o= zVhFZFD1pLfFz8lU__$dDsJ7(BE1h?i4#Sm{Fp=ro%n~~;q$OigQ8v}HaP%QtW4IZ- zdLcy7T8=LZKo}0e7^qCHR)a$h96hH*Z(EnK8qzF2+I@Xm)D7Oel&s}{-THT_rQiry z<{KiVZ3S&g$;3|MwqCiw+)T38t8b-^puC)zIQoS&v3W4ki*T67*$wo&}OdsOIqL?G1oycW(KINaPLSx(hH z3@wO%tbiT26)g+|^mDDmZ$*tTr>pH_D(iQ$^3vaCs3(KTz{v3v+A=0+p2Ae{)eTT@ zfb&Gg6`iHQ$kIiXc^J!3J(duLsoz1yJ0WLxDiUzr>`KsuJs!UXmm)O`Z?ivi9>Qqh z+{7y7-k_O?t$a6GAd@TBV4XAkET`_sK^L1NR;17Nz{CA7;U)Orz%);hew6Ilg*x+t zA!fz7P>?u7L6R*PdFeu;7NUWIZ&|?ReFAm#Tgo=lw+WEn{>H%2Cs(s&j(=_WaQ(+Q z)nEqLws){?z8u{xpu|R8Dw|H^xBRajDZgwiEGI`iU77ya4Ua+nF-VGM3qIxe@7)3@ zbUca+1hQewu=bhHFCXDJ1JOrNh7~Z>>5BHfGcZyabVmHh-=~gF-3UIH(Z}1&c4QT3 zCZH@&jU2TI+(mo{LFcB`1*{*zh18Ch2@3B!_xr;KxngmyKQrp+%}HgS1N%1C-3pKf+fMs;qj9BbK z99+ZG;t`dIE-=8qcnG@lL+wk?9m=gvuP;dV@)uLkKBxRUV47m)GrjXB6cb~Gwcvwy z^{*6xb9#Z~r~Qj5D=_>E@mvCCTty89>0MTVYh<ztlj@LAl>aT%OdxGqHJhG~A8XH5C>J|?%Jq);f)-ifYv2}9UKk0WEQ<+^*&w(Zk<%P7?|djKTOvE8yDEQLb@6-eiJr}npOJc{h_ zvpQSUE%Xw4d*AL+Ltse%{UJ?Gbv96cP$I>SBrY`87FJbf`*?>TftuhMZT64YA1 zRCldi!!^oIyxtikKCbmS^j%diQpZHj5=%$6JGxE8=tE(}=R#ED+Ul=AV#Q+5w6MXf z*w|52i;YP}$UMbK9ixtcIm|)fgTk)wbpxS#PZBuD#G$78Xc3CcbaZcP!L`$nCGJC~ z{d~k5d5@BwZ=&~01cRsW5b4=)@-pF0Yx3FGb$cY67@n?{o=CU4 zHX{xIcCvYJW%usy_okRcjZ^Y zQMDR2NM)P@nfnS+KEl36TNu7JXuALNx$aSehQ`LuB-PUq#Ap#tnGe_YIZ|I_tXt7R zhO#7k)Ymk;)(+}U#rK5ue(lC0gP-;miALYcR!BiMgcx^#+p%BS9CBax!c;YLVP34BhEZN-+gAX z*tFyo`sht_YmFgssHv$UJ1!FUWUCj&fkxjt=yCP3m$%)M-_N>4&) zKic^(VZ2d>XO)RbgcchPKEDu(ljn_wx(a13G1NL44P2^8iZmnL)hJ$@!KSlEOJAW| zn00=13_Ah1&xAhn0q=G757M!e02eQPofOJCe>&H?yv^o@I-SA*4M{hTQt@?*NX-K# zcd=Z1TIF%|AS3|7RNywJ)k-$nw!y`smvs*E-jgoSATQsZdq~UW?cuJ8hDS* zt-hD?DCyPmulkh*<7HqxUpO^6&Jaz0J;^M4k+cO(Z zBDNWD_eC62C4eZ-6^ya6KQ0lo4aW$=&Mnw>SUGk9&=0lTHcubAh8cQWy3aYYZVI|h z@Po|Z1;3io2S1iE$lv$VfWVabrO(A)Kq=QStBxL{nSIMS(AgXp5*@{-vZVL@;)9qgmAhz`smn2~eJwKx!8DJglSc9t2+v66Qfj^owS{G>U6H5ce}Ik`9IZz zzN8b@piDbmz&AAyGMe+Sxt{9xs}N1`Ru4|7pM!cEZh-QpSWy-p248k(NO#g7xv(** zIr{K(C%Zn%%%l!Wk62(wPH#|CXF*e(REMF-9fxIOb5R)r9w|vfM_}GB=GCDyZ}{UA zH*b+(<|6)4<#{7qVR_DC|3E|?9iXwjKveruSazansDBL)Ep{bkFp5gtml)1E?e*;P zvAPZaNfD+@DBE*uml&Gy>HJLZYU$wX=&5i`Na3DD*8TItVI;?8clVNj&7Fs?O+{Y3 z3aVGGZe9nz%sb;9m3A<*V7o~9m)t*a1XV0X7|jPf4{_KN00>y=MGZd4lcXW~D2loHHL-ef}h^hPYKdB^QTmtw_HK1$=`BBPCDwV12HIwfWr zPE|a#Bt!d$%yjHI^<8?tW0S~bc=g9|{S@A6z>;%Uqm@9h-nW!%6Y8mFlbDsu(k_tw z*-IL%P3G)eWDREFI}Rr2ylF0I8Tt`y&TBBW`#DDRpin*GK#tk>6s)jjN;ZZF{D5WG z)8Zy|+c5jmJ(+F0$wl7AxgLh_j0!B3&cpF<=qUEgKi^vjY)VIl45h|A$D+rMHh;ZN z+AasQNHiXWo3J&~7BMxI_1uxMjJfR$i4KxX*VWVGO4|3v_4ChXgJ96pCm{8v5yANMW6d zGcF=R(qL_xVflW%%ixo;S`>Ir12|A;vQFjL=ZHb4bqz{Bu>$ArMri7?Wz$z#ddBv5XrR)?ThXPXWofb2%61FH; zAHKvCo|%0PG!P35MjbyS6U&FH6L5`PJ;E|Y33sUd&t+xpDsCvru3sGtN?$@>GjKt+ zZ(sImhoSbYG$x)AsxS*6rK$G9$JoZH*IVu$RswW+=2u|^z)CC()2B->8@^eaVP3c|Odb)Qo{l2r5!hJ? z)}~FTyfIfP)c2nDSaCkBN5cXRhYv{=A!3W`WFt+3N25c`DD~ zF#Ck^p^2y|CY}56_@>KzP(3&xfZ~9p)ljc}*^F1Wr0JjfM^7}gNO~cSZfhw$>>8JL zVkKWgB1S&h8?Y~?a715?Z?UMD;w*u{sW#ueuN^TmUut_z(la)W7J>;TQP)MI@~bhv z;_5AtOID9}hLu;b0`4RRjFhB^0}a<}d<)xwVb^~0@|8%kxrnUvYowjV9VPhhAC632 zg1~pYZ>-5ezyO7I<^X5Udz6Vr{+tn5!x5+MVuyt?vJ3P&A*A&_qWan{QFBu}82{^% z2miWoC1JU)x5ijiWO2m_E3wfLZWAt+h6?IS(m#b-)D=lXn~?iX9w;d_@2IW3h=f$R zQT`Fza0ZlG?`QnJ$e^nPZKl7zq-tMk`jfrKecZ5RxolaT@yN!lXJNp#YKR|jElJ~C zf#AokXhe-Cml0CvrJz(JrQy7kfTx?v3!Nz$^6J)YHyRULxSCAGw-FctgbLLjd@IH6 zllH`soapJnvFIqZ3Nk=2WPtN?{@BL~;+$_T5gT!;Aupf9MT&%%e*jsoYgHTv68l#8 ze06T{aQ{}<$diAAlKNL5h}k+!?>xM4UUa^QC|whrDH-tU7IRzrp53bD`gh--tlS0X zLtxWVd;i$S=snk|_K(0z!LpYIWz$(y+;Lz|n*RjBp7EiE!@nf2tn&D;^D{!F{s|tA zeZ|K^ay|)u;lS=U3aLG>IIx5mc%7|WVP&G0#}f8bN2d*vF)w#TJQ06_4fG~b1i<|A zDuh-lcShGHkeP$Vnm|Pq6}+sJ!NM-FA6g5<@*v(*w~k73zSMFz-=+Bap1(UrE-2x( zsl?EpXrW_oZ2g~X!+G!+Vdj*5^^iB6Sddln;P1oBT_c}YTz*jTAvj&cbz-woof4hh z%x>-zxDyVGxfxLsjuwX5ADIAj!^{Tbk8`au;NGGiSUd90rFI5dr@KlLe|`O!VY}lI zt5shkb&Yyju9}DIzC{Cg^`3AC=hA!znwHwpv4y{|d*oKf-8U4dc4o+z1p9O>pg;hKHSC zvp-k^h2)ppu(#vPm&_5$r{!9>bteq`iXlF z)Rqq1ooFhny5lKLAY5ZLe6NVPA!HiNhy*^Hzgt(h;2`+o`;7uPb%U zi`70Ww#KwV;G3K$2W#g+nAn4+rFAr(4Yn))=+!L>X#`4!zh_%Tu}go+V&d#chsAP( ziJYppxWDsp^3^vsO4#&8*p`1}>(*NGOW)xhFZHvFwB3+Qe0r}g+n!f5eeN~itvU1@ zff91U5O%x9@zaBnog)(*jB{5{=y<7R+nz@}xkjW=ESz@!Tio_gvv1C}-FDZ^;&sjn zq0fPp@a8LyYh>D+_4Bv0!Ozg~LwTz;(<6dANGF}U z!78p^e78m`uRw^f^U$f|6(23l6^v|ixu&Ta&$y0DfKUvqY7ji3{97XD?WmZO)OewN zR~{r3ViIv@5v3WlsPMvi@@f8>aTUW5li^O1WZ#nAin6)qIXuB%0aI}cv&?)}XkSs-z3>6CT604@+*aZv(fWq?=utKNeL{4qn zv!pjH52wmfb$FpqQ6-oOv5|=(uW(CpN*W4wBMej0chxr!@bmn?Lpg&x3OyX=2W#)V zNSEDHNeW6sitt%MY)rW^FI?XGyY_y4L8qEgHcv@XZcgrrubxY+!G{X%))vy3Ikc_+ zPRnCcH*IMfd^gnE)oDnOw~eNOl^V%>Nk?*MbKpikt?2e;u{n%gKegwL>Ve9206v(! zB5Zq6D{)wf)l__PguybJ6>=dm>17>_bP$kW`yydf?w)VoJ#3YoXBdxfSf1D-!~s`H zbjp-v%|L^?~@!oHRMV^Qjrl3xGfS>6V zsFWbcl-*t^TWG$qO`Dp63xt#TOI1mWFvCzMb6C`NaJ9|Pj4r*Xo^%@+7#weZd0j|e zQYo?Qh*P;<2fr>5|sVsqeoHIgxX>$p|oY@_;*ZTC2aS}%Vb zZBPBS4Pac5sS+^y7XLg2>!3V$k7iKzu;^6(YUj_GkzbOJEt)@)N*PJ%_{pH_xyom% zMS5k*EbD*$No}VWVpF*dH^Pre%UPZFyQ`yBpE(Fd1;%ffGf=xo4UHBO`S^NEX`l~}n z_)!c z9u=H;@5>~2Sa_;m^2T)QBf*l**_s(3ol-QqA~^7Dnzh>=LZW6XOe9Sb_-DQFRNj0Z z$|lM3Jb2_(zLqWPK$08k7CQvln{5R4(2=6*1lhZ1LvSoe$c71 zGQy=hF9*`ln(?PXp#Df)b*wY0ILNw2WR$Gj^1}lu&5V7<(y>!uOTz`T(7db@f3&4A zl4gDKYXg)kJgV-0XXLkOernyfch<9eYI^xd_$|yAnxq8Srtk<)>M-TrOSS>pf_(0A z&M#QlNGCXhj*gOI|D4IR{G^SkKs|$Q%T%c>HuKXJg!8gx(}`BhSG=dH*I7=X_Gb@m z&prds=0Kp}y&w^+St{Ho7i$5FR8LKE<>Ah(oICN>jpuWKJ-jIuX1(Hwju>7$40PY! z?_3GGTE}m>TOd`7Q{D&Lk6b3hYm^#ikpLdEPn#?q%qxS1AOij&`tM!1@xVok7N@!y z#A3=iR6fGmgRM`waxqd(i=g>u?4+?VgX68AUJSP=lZp5-5GBviiTMt(>{^#}B>d%V z+1YSJ#R+t}DniRsox0$*tKoTB4crA?IklIwwxsmh2Wm%;-gfOliB=?n{C6gGg7M&F z*>AU9utLCPXg5Czfr2gR$esnKRi7CzT!jGT&deQk;-S3*c`yj1H}SA$+ODzE!E}(X zO=azm*ts!|qjA8Jb_CSyxto8L;UU5xdIR)_%%zL z43a?7Pj`lL;dmhaQGe-Yo0Nx#hnTV3zGC-3KXaSMFh58_OyMNF*RlCoZ!d#e~&_u13>|@wV-5U{yH_ zhlgQQS5T*YT4bdbByxK~*FbmjX1Fs}V0{!Yrl14`oKDVjJ!3;0*5@JWNLqP)u!A!g zzw#cGb=tBOaoE6Ul-^`s2s96`pWZ9f-Y+!lzb|~u)}b6$(kz53{0S5-3P6E zD)aTkX2lrBDThch<>5bO)8`bL_~T$y8hbB+ zSi#w=XPpABjP-@GgyGNU-0~H#8K^9UWYK(flZq7Eqe~m*wz3}7vppF#llx(%6Bujt z68<>3jRZr|Tf7+1L`v2V$a_F!xo#Q|OKoq#{dkyC5rT}*Vxsf>seAa64LB>;KdS?+ z+HywUqO~i?+YS!Z&6yAjf%>7QuaLqkKUCRK;m;Hed1Es?vs-8C(wR9Ibotm6{|?#bBh{+c zS3)XJX@iOxU*w!fp_-3sI_TBZP->Uj#WY2#+o>5E&8A;CEn7jz2iXs=8C7P|!luHx zUbClg9lQRyfbdwl1u~p3?9+PX8C=dPk;I{e$_-R)xm-U(CG~t?>P6#=ESF%WlOsom zx1l`rm&o5sA4N=q7}ijJy`cqUf6jV1H_A5(>Td z>^&+(DSl>fb~w-L>tFe~pXyyyd>!i#$uHwH#!!CTNwBUBY0r{&P;{JFu|Ot5Tu-cE z9O=DHab#k6D)9tNlfWJMIIFp%sjsNaZ~S-gFmTBs4!nYjoZXLD)Z$xmcdy zo2*_Viz|Z@)Z%B=MVZ5WiPsjntf`OGUE7#;BkP;DO-fnQBApZkduD$nadm>=OO=%! zVi`kuHW!#Gkhw6S^B5MmovrrwLQ>+e+mZDzZNLMa9jJI3Hdv7UVc*iCPV%^pZQJf`yC4ny zpLK$Zg)k{%R8!h_3z2k0n%>c}`A_7|b4+Wu7c$sR`8|i{59qL3A^LzUp=)0&GU?ZD z2?<39`HgQNB4@ogn}v*#f&(R4 zhIF4v_NX@qJ%zgiF0mmwT>d=;q`rsRyFTyz=7IymOt4gazwAny>>;blGe5Xo<8nQ1 z;gF)~QajlH`F!*jI6e;DGdN96c$n5i8srNchJufM`&k4FhImI@0ji8ocqGY#&{S6N zo7E1*4bCH8h2!{6IxVR8w6t1HjJRF0$YiD&+9)VoMjw85LUca%neYnaIpoZDJJHHt z0a4Zz`4%;xdh_3!xpnR=U$q`t)fx&4S?~P;)k?xY<8{*>P814UJmH{3(Z<_wG~^)| z9ae8zQ+A}}5;mki(xWZLDPuuhNUB}DqEPHO(~{Z;k9S)EYv5cBf7`J(qK$F5D(k;fbsiub6SPVJp}7(jXtTt?q|c9NyhX7BPf z59vew$v)MI8j9#>+XDg8AAh zAv{$d!Zx>0?2~%#zCIF;ishL5MP1^c>N);;0B(jMRlT?IG+HXS%Llpx#ZUHCy1jp? ze%3{%jkLgRsOs68y5p>}WhPa5q1zYF`Jq)|eHU|Wd(uU^u-=8!|@Zk%T3f=IiL}dscd-<*DDyeD#KPGuP-x7dz$n_eMd3v+GIDGS!cSR z#>;TI=aJm|J3i8sah#wR1~t-pR=Aj&0?GM~5bl-sqlP-a-2p$fAwqb&tx7aL+`HWK zd0&;{2n*kPucqyTaI0|wKxM(P0y@f&X{DF8@3;=rOtj6hxv(@Kj z$lj#i+#D-qN!C<;r0fR*li``34*AX_nkZk$Npol%`>CNzASAn0_&i8MYT`w0{6|P= z(`^v8KQMhk>t*PXF!C0@90&!V7MuPw|0GY$P05l|^B+QlSD@-b_M5@{uNVV+%u;1dWlh9(k=#lEJVjqeCP*{YfwmzA5_=66=*ys3(9C#4cdqE= z%Q+NM-^pD%OF}|!M|m(Mx&6kDCrWEV4lcU(pIt4RFPwPrpbOftW|qz#_^W|ND5>X; zw~;ZcCN;bj`=yJ}kKiqNF+mL#$bzIFc411H9B zs=v|`7yV;;{`@$Zf!?xzY#^%@$(tO*L9jBk685Xgu%`HgmX~}4RtR?VB}^ff2JJ4s zAcPEBEgAm!&pc89ctYm!Q7o6Og8)YfZlP_9jM`bU^nFYG$Pihp#f$Z_e+Bmx4+=8t zu5hRS4PE(xw6k#+S@yvoV`zP+K$UIhY5aQ9Zt%lDllbcTnCz$bGIWJU<1nx#Zl2I9 zNEkT4v(ytgB*Q|F%O7Mz*FVVu);SvQxyQ^H87B_NsYz$)Pv{27;$D2M^eTV_N+CZ9 zz2{n{9S*nee|fx*6k@PsuGUwjs}n*RH=fZ(rq# z^x$M{=~m&naY}tXE+AXhUkSF(84l_1T!i3xp_&U3yQDbJX;zYgCT#4{`X8M?|L6)` zsxA&%@@I3uLlJfv>`{O^%@swYWMS%@v$MQl_D%NjCFvHDJ$j1TA?MCLzwJ5q3RKoV zjM8b-aTUVyzEH83U{T_J%p)>)-41kspI46*qS4oAa_Tck7*~Z>$cjk)qeD8(Ho ztTEj}+qS9)^QHYE#3KWn^%+_IMpob&hVO?MCs93$6ZIL8Eywo3L30R(OrR(`j;(qU zk8E5tk3+>yo>XU{HZba}U?9pK$tCdGjQ@Oz*vcp{};<&@Ly^gcQp@SjdKb9}@#z~x&oQSF08`-i|xyL*IoeAFR zp=N}%LT1riO~mw`g4JcKON*Z+0|a5@OfIZWEWuss#%uZYo;P@?X%T$r1cStPnANzo zPQJlClNm-UK+#dN;T;8U6h3Ol#T?=S#{))Q**|n8MO$d3OtZc|!H)lJs%pibxT&>? zG+nQMHZ>OMZr`^L4hzyvR2_V(Tg3pqnqR%o zaLH&gT3g#NH8jJ+c{Sw5Ay&gp4=HEbO%(c4lvnjM0Aox5PQa@x^MOvysKV#O`li6U z{<|sUnJ~5Mx$vAiIV1Tk#$-CKWH101sMykOp#I!du3pp$bX|c;O+d?$DU#WsPIANA z5GBDoE7*jDXqVu0Z!*v*tKd!-A2lPM?t+Zeo-H97n$huEmp<`$0sbaslOz8EdjYYA zI(x6m&^;}*yVlZb(KliUKK!3efeZH~9`Bc~)6UQ&mJNYc_#4(9N*?6RpO(>F*}8V? zi{QVTiq^IyDoOBMEb^`=3SH7;?vBLy zd)OcFrmNDRnM5-@EwM6QU!MM|+E&+}iMM8wIEZM{Qb*^N9skpG@bc@j09=XhR{1$z zon#}5qOME$!oQmS$=bY*DDx5C=&d0x$PYZm`k;=}NB$?jiFTXF1WY-G={LD_8Of7G z-Rpi(ee%STm8g_3S^;rb?_N=Gzq(fkf2%rwv*4i=yX}UvdPfC+Ry>hY_ke1RZpWr4 zMPcR>niSc*tralyCs>gdJLEZf&sw1del|f(N@&Z^;sXx#3YA`gXup`FJm5PA>8B|^ zFglu6xK(@xKPb3tV>;>{DuEM%7jJkL&ovC!F$j$m$D0UDt8d3$f^L}Yd20IxzkL+iILm#%DD!# zqh>Y}$H5V%?&b^X6aShh9Jsk~p}B@;kdKDK0=WK^fSJxWo*Az&gH{ zkAd$;!%fhlKO#e~RpfAMeTh#U96kvA4gT`*?{jWZ5|_C0GCXTZX7+Co5{sX5`*Q*j zzTT2n$h}LOM}@V)At8_}B1LE|_`ek4xnV-w7}y)xe>MjBs$s%)hzmrRwV8?yjg`0P zM4DtKd!rb{AV`2<^jMzAI|-UWt!Fe5h9hpwTCC{!|2CH7W^c2r64Cj+5b)@K&i^#V^n-3Q2)T#Kl}f3aR)PR9_$Y?rA1M~x9d+;wu83@qvazt9 zcn~TH^zEQknOx`m5H`njqE>Z7fbj2RPL|CX8O_$mkH3T zQ8R5C=z81Am*T8opYwdK zk1@#|R*>y}-p1s#SQE7*e7*co$<;Unow)uuWyLHTeQnJt(_=FWb_3caa3nxx?daj)KL`+2oF>v3%`jr4K4dl_(Pou|$L-1L| zBWu+ZXG)P^C&d*M0!BKuCzs2!rbPa?t9w%2)hD$|GUr48JuA+^?#JeOyWA(C%0mCY zExmo?A~Bx^$rz}4F#I#iM17jBP@sQ>V7l9Dng4AGNj^v#+h&wTT1A0cc_SzVgLpFO4_dcY9Z4Z92l!$&{&gC3eUT?jji7C3bK)`TyJAKu8j8um7j08D76rv>(o31^Sbe}r_6De=%6 z5IxL0iSp;NnfY!_7PD6ku5Xpov2Akdvpm`38dt@- z58$x(+tZp*h3QT%9h{M)QYQ~94UQ&56H1B5OoLcGUX7KH?g^f4dbq7qKG624b>)J1P_%-OaP2>T z{wNOIwaheGm-M6ie5V z6bjP+wFP;|AS9Km>QEWJnTHH#n*R|n5(t9|07(>XO-cDzF`C>Y8+XMZ63a=kq%`0jr>YJd-0-l=4_$^PS*t9y== z^u$%70MYmb7;5G-EZ3+Dul6ZzW+dKG26W5^eLM0P|LJ_{dwbveB)MNj`afgLMej^P z2KN8C@YBT!dk;Zj3II7<62@3#q=`ld<0FvHFTf@e&_Nl7v>El0(He;20)1MMA@gsR zY^2y}H$qEDOqcZ(D!zZ|FD0JErt0;N=tP|dLXd?as5@6pc@kWhS_5gCFy6o0%djKA zR2fMt+zJ)NO(Ex0F3Y-$a{^FHRFV>4d83C~?_1Jrn!3)0JyCTsC%shk-shxYWN!1u>#sY|?A|JdbFd-fwv{+^gfZTA0SNHoKdyaQw z?x1#ct_*XBB&d?Z3rs5qX?GN8YEfuWP54s(F}P;o!o9K(R@{9!WLkmf`c!D2$vm+G z>X$WgEn6!j5BZ?Z)T4O)C9x>m_aIbk>(&O<1^2Un;Jbvm^&;e-k{mhKsG)@>^3yq{ zJ-TbM|Cnlsj$o zS+8!qqp;g>ZJaMm_EYJX3=p!nxgC)~QG(bx^u%9ksv9kRyR`G6BC3o!B}IyAY6FH3 z2Jqz1SIBnuK*UyJ27wwW8ODkMY;I?MY4E;Rb129PA^jO23^v~nfTnxVc?iG_olBAR z;oXN;PhYuh@4;fMft20+=vDVK&=o-AMF7pZY05hM7x=JlnlSeT%Itd_yylRH7-?(L zI2SWLvw%wWOv3wp#3C>8g}4njj8W{CJcU$p4ZoI^7X4;9fntChf2#bE_{+y}-2%?v z_l90TEHA^z_Mr{4iT0!_$sP7q+yRHBzj}vg1W9@rz%`L??{N}Jv5t3t?)Z16W!o|3 z6R^C)Ip#NrMN=MDP^Zvy3a_sr`D0|z{7@J#Z_ADb5}pmsQ~(J+WTprRD~WPkMgrc9 zPzpAr8q)%+!$-u+E}td|P(>ft)*3f^V0H)@F^LhLvn$Z>k;*J`1aR|FaixgKr=TP zHWQyIoQUm4-~^T)KKag8fE#Ougifl#B@;Co9OObxo>sC?j73H8s=AnyB>0YM84BMB zp1|F)<;~CHo$v{w&54@I78{R+ULZhMCtQ2Cv4q@%1;R(vt|@LncC4Z++3U+z1D|$6&UW3E zV8hW}1}mxwN9sSW$hp1*m_E$)ZoO|%Gp2ALK45S@*f9KqM)T=2HhO@e>PNIwEAxWT_Mjm%Q zHU%_F{Y_d)3JVhA@8=exY+Btv4t`fXsr2CbJ%R5tlLb9L9cGTYbNdpZ)ZW9dO>pXH z$Wz$eH8Q$eT)5iBCDJCzr=}SQumtQXK&em<6I%IG?u9D~2 zwf8ZpDlVJbdPQt{PNR!OpaMEcNY+s5IE!{a-X0O}&NFhuetsIq^83go(t&+M-#yeFWj|}T0zF!(S_c51=nV#* zM^7(V{VX9cy!^P9F%Yy`Ds06kisQK3WldkK=&gZ)2x#SoKr#iyml96rK)v1YN!0ap zXSa`bXWRaUtbUZskTJ9i@Tjn!6i#MX;to;Dg=tds4S#S5W`2u^&of!Qn2aPhw(6j2 z?Cf!~3I~hR4Qmr0fb@nsOuV0dl*54EDN&?urg`hSkA<=m|N;-iQ z(^yb|ZMK@OIrGU-=YX5kaI)-3~rj0c7Klk06Lsi>1IBh}w$AhCS0c=*-&M+kuN zolYy)BkT03RJ=rEMi6mp2-5J~M>=O>j2ts#GP;N$ed8qJfIW;DN+uDJhBbgRbT6OQ z3^(8AOZ^a@eqJ)pCI2%kZ$MEZxfi6JQop!vol%HjJ7f2HgX&l#j`|idPs! ze>jx@t~YJ`dh57E7H{(-|IL)WvJv!TAN`(&f;U-WY9g;e4m@iRv?e8!@~_*7LY-~V z%pT#ib|a$tHk>lx){_Fqql|JeyP%*mQ{*3mJqhx=!4P5n2%!>S8{z#igKz~r`pCFW z7Yb>;xO=`LpSP{G%j{X-mKJR5XAh-B5K^%naO5Q~@BcLEwpHDesa!p#7b-rt9vlj8 zn~rE25pYL+0}J{}U9ao{1~FMd`PsUVE{QNMB_ov;DUN3LerL?F+>H|^f3kCgeu!4y z0A^aCRbcVN|7;|;EeY=wf+jDD-<$Ppz$#uBS*sb1QYXBdl}s#FiZ^hcqJ9Xw1Wxd801v;J9hNV&|!pclv+Pv1Djj>&4V$VIMq{A$U~W z{+Y}1^EZIS*p@_lbx%Pl;tGFZ0m;xDUq>ueMzO8<`?%%h6tl^C0oFJk*`2!57d743 z*&}JEyXq^flihM#!9r3U_GW}PsB4~{P$MeM| zfNA3GU{EE6uk8E;|H`Srk;c5>3q@m|oYa805x6$H<7Sf?bfBcUn@3I|9p3r_p_u}&s zX6a7f1!2Q6q)o0!hUqkp0OKnTU>AKUcR{mPnWp_jG0=9zXvKSzye0+9F|*b%!gZLH z8JGpObwYUA3`xXPQ+*S4b)+@&*|_?l<#b3aX>LJN!-U=Z3nmlCg$);>#vFC)n~V|* zf;*kq8RC8oVK=CqOWEz-`unk(El_;qC6CaastTv+9Y) zwQzbQY$q-eSW}3Y^t}6VB>(4&8HLjAd_a`o3P21co1Iv{y`lnJLF~9WP6TFlQ;E&% z_ns<`*s{B%w^-dD%>)&Bk-|Fjdm!Z-f$d8%YbfkgW}d0x*c(2zi&QoEU~AxrRea_Dz7 zEAEGQBSmqK{C$#vOhSW!4S8;%GYGIZYIA0gwpzthXp7Tn18V=*L; z7DonnwY0*MF$gy7sJ?Rr9XOdpa_GgX|8u!6{B_y$@fuLB7^M}1tt~w|C=umfOs-rt z5vvG+hE5>M0Td1RURDkLT4;s>%#W+!IKiR0Ot*^ph(_#MJgJ|SHxt-)2z2IS(=qz< z*dlu-_$V0Cf!IiienbzQYITL(-4)hp-#E7RNgYvH3JD?f-WZ$aymiRHml4SD>*3zK ztQK6jLw4%0!Q-WsL(89l$YA|c)&(iAPssZcv6ETOE^+Or@1bN(!(}wMwITSpBW8N~ zj^XNR`GC8(T-hYpZ6MxI&K~w8Ns?V4b7_9I((8sqA>@*t`7#;KqbZi9K$qRHEb2gV z-mOvR4_%H(BSmw{rcDpYMqZQjPVfQjxkRRpXSV$xk^V{uF3ibL$(WMzN$A7tgZ4cL z(^cOTZCXrjs^vRX;h~B3&bBcnGb>@df_I?_6>{lHywvjQ2$XcDq;jLjvF@Nk?nDo1 zp>f=q(8Jx<+9DSXp9nIr6SJ`}TyI8QgJYcAb8r=h)j??nuV{=pI87Y*Y;CTb+5$bq z8_mrE$AFHhLax4J2+0(#OK2IO{z{zG@>)n4b-+D>ynGV85j(LNaeW*ueSu4xI&s+A z)gO;38TBfmRW|^7WtnchQkSGeDbl5A))Rnw}HN%yQIalGLC zgjdr6EF8?=X#u5_5ZTfA6>c$QtHG~LMMXb&<8fl{JLB@FwixD^u`}UnxzNRpUjt0s zoJYg_9`qw>gkEK$klkSsiTQkKsgRGHA>&oHZ@*$WmONv2B0U4ULmsycR}SyTX@+6bbc4)KqN9|33FxeHfK*2xIyxstOz%l&^#WR%mGi# zscHu7*Y&($ISh^$KEy_n-D9`(Tx^`2IhaUIfh=S=4wu2Fr|hWaS$gT6^#afcAi(60 ztuW-%5jWmp?I2QCGCgVgM17M>qlpXv0p;c=^6@d6rB64u2t5jOQrKlS96Q5B+ei- z*c_jKs;ayQ2q(k5C?E&fIGG~s?-8=$$a>Fiu^ZD163jDkT|0W9h1mlv%E}(!;v+f-7Zj@RI-1;XK95{!??rwF5ewP2zVgLj*-l0 zdb|qC_vB6NCIJsS57aYOyp9`Yn4O|>ANM-p@$|-!_oaJyPPja7*}-cHEF8GDaXYdY z&0$3ka6R13x@jbJgttHBv|o5>PqfQfx#p+kB73%nBX0gUXbN;g-(8LMC!FGIr=fz6 zO~&wSQWd>Il}V&U7rvd1baqi5Rd_r74w{l5gKLre@!5j|ygO7j_3L=0=1Y;5lM|w} zBaS5R-cJX)(fW_?B@eh}!Zm;rq@ba?jPyNV&}*^zD0;>ldjaj9-xo1cGSw*tHLnW_ z+`CAZ;1$9wb2TMR4tbtlTA%eV(ZU6zA7u-~VUAV!uwnQ_`}#hyU(n8y!-bF{O{j84 zpE|6gpPhn17-hg&V_x5(#tBh0m4yw%WlkP^Gu{Qb$gr1T*EY_EB904~r1bt6OQ2c< zm-6XH1WbX61I$_LMXm@Md09ff|Kaq(kK+c0O(BXIR2zK`TrqgT!PO>lAmV^ddV%!~ zUWE;MUq15?Hpu8MniI`b?ouwcZ1-6#=t*4EJJNjY>^9JM0NrF((P?rOQ%rQ`; zcU*_0f!7H7w=$wz%U!IY!`mr^dy~3~7L~h)y9|<&ijQU}O5jejTky-H(6*pP{Rwt# zxG4k|pNovN1iH^!UTd7pCaFsd9_aG|LhXTsB|p~Hn*qMTAOot;kUYeP;y|A3c0<7E za}ed(y$X$r3aXbjdAc4^JK7A?RFGGmA<`1MI2S!m%4GpA87OT>JgW_a8aI+78F{|L zv)f?l&QGtz+3=!Io}~9dn5@y<PR=B*RgSh- z=@{H5b@J&59y4APo>A7TP@Z3DFwBK=0Q?{~Ncqy$S!xtNZPJRZ%S7Y`>y^E$r9TEC z0VF2*02Fakyd(i(y#n?-LHkHDp!~Uw+;;6VzSsq{MR|w85`)9zOD}+N->t+o7tx>f z70;kn$7EjEnf{&~`K(_L-4oEAV+!_3_+pzK#asECakJ>(V2NXtp@q0c&M*kDrJ z6sAU~A6h|@z!PV)R;Rn62krtDA0G<6AA+vdZEA9~T#vE8H9JO_cRvR#a;}iNI`YM1 zIw4j8D;rgIsl*Xo;~ip5$92Jc_WOH^g`Fjq~d_D zDV{5l1x^+rHOPsR@WGCNoPHg4E#qcif%d@fz;;0aIeGp+m5E4}JI&05x>cSajnTi4a({ z>F?>mCow$6P3=H<>2L8@AsG?E%kmIh)sfX88Gqd$y_9d|K}a$ahcCtsp>hS^76CEY zCGi<5aml%$1kJil>e+arxtdYFqEuiyns3RRrRnDf3}me1)7a;#CBYHh^PBA zc1zM=ob|^K1Orfy z_*@}Z_Nrm+=Li346_w*av51h7GWNKf#66)bDP4?z^}v@fxcpi0gO$1V5eZT$v)%|Q z#TrZM1+R{F0VU2&o5F+20BnVuUuAG)lIF&JJno8%poLU%k`v6ETi0eO9r&D-O6Kxf zha8RqH>iV;NBXRlxk*y;Ubu!x`v}#fL==`6IEhab5LsNo<=s3}k`SId4OB=(tA)Le z*7$9B&=rVSSIn3s>!0$R4&R0g139avJkg@0=K@AC%)ykyQT7*c@wYcQqS;Xn%Ec-8 zQ11E5WzS!->+|nIy+JPDoAN}u8{6?SdnliHf?Ocb z2~}J2Y}?AuX^DV)?m#T;87xhffRtTY=o_w(o~JTY(8isBKMrdKt@_xgpXetL`Um*5 zRKb0J$)=3LUPd9rK7=cmaYJi28t%2l9AHx4Ke(w`9QDnO{f!qf&uO8*sahkv!47Ci zpMjWv@UR|6U1HF3GrEAId+<8J3iNr=X)nngZHG@c?-6cg;HU>IAt38d#VR0sz5sh> zuReMMMTVJg3Vvmp)^-{=s{r$qgC7?4+qlE^#<&yui5}1lLAG1IBDlzGQTS4N>}R0a zMEK-{H05rhqmCRieJu5RSq<0t6Y6{?U*C)-eSY9Z0Fp#!6y1M1WtQ6|kUI>7@prp8 zqzwUD2lVKGd>XKbQ$TY<##nioWGNFUp+_BWtkt9iN;csP_GWI~WB zWVHu_7J=pMfbOwP4p~1&#~UsD2?Z#!XagJTZydH@yS^ZWd&6^ZXwtxk?1T(UaXYaB z4G2`+f#=tq_;%DKYG~JeLX)nAgZI7gOPj-ByL2GzFmJy27QLU#W+ZO)qtanu5VsqS z-KkOijkMn$H1MzndVZ`;2QG-Bf<;kZsIbEmQa$mB&=HkHJcM$7ha{h$0z~{7{~pK! zt=~U7G&uAVg$%sMEC=I`($}(qLV~#xD11cu6gXVZ6xB7Asg{0UV4F9G@@`N@lC@g- znGHNVmpt|qnM|t6~g|<=hsfU4;Ti= z>;2YWZ+;}E56)j40D83sxWpIp@3L~LlpsC4NRsDTVhAB|26)z1IOpgMc{oYwRzGUM z-=$7we0Q=3;>}=(gS@XqYazPx1X(fgrG!y5u_1Ax-y!Mevq&tS{LqCoGcbcgy)q&9 z8kvE?qGRuHzcG9>5LD`7sb>$TN+yEK@rPk8a9#SB2AK3XLEqQoonc0Rheut0qlJSK z1r#DR983;E_qz!gOCDVvUz$pOB;foQ#HLgXI0!dI>#+xS*1s~wQcnTk06TrDF_fK7 z7ApAb>TNc^enp@`0scD8NL7XV*sG{N4$6Xe58l?f1Vy-fs?-oKl2X`HL5+PJWA06r z)>d9HRwWAI9uKIKdSQ_*TZnQj6t0mcsVf(yJHcdptr`kSf7Cy0d`Dv&?i$(bi;hl@ z`9ZH>Gw(!?xwol){Er)fmuRDg&xRtSQ2cQ!d!q0Iu8!X|^IqE~@4QMr0((F9j6nb) z11;k11&han@QY5OE(T*Iap}?N2%Y4_H}-j4Zt$o+q+-ha3j9eSKp4KE^pB^qNuYfB ztTsNk{EDht;ByEp)j?t@I@(S&Nt#A|pB(ldk3~!U0eifZ{=iwcapk}E-ZUKQHvAv1 zX%xeeEmXt^5k*w?Wm*+k+EBKH6k*7|HYJimDU!8SC1l^1P_l%QeI42NeP5pQno+;* z|L=MC9MALOIl5onnVIkRTF&cSKIi8=uQlP^f%qsCG??Gw=t5BXgAXtFSP2mD_dw}A zRw)l6Xd&&Cz%|`{yh7+x6;~cP?n5dOx_(i9A1y?3tk22*GVB7cl;AIs~aKxdM@k6@g$Zy}$gagED5WIwI#a^sS70jG%l?FIRVDLh< zqUhz??o-hrm=an4pAN@A`Mf{=YSphXeKrXz`a8tiA~cq~tzPPK8lA_LVe7!~5!v&X zLb(7O`JJq079w=ic5Bc?#cqGR60RRaFBAYrk1A%l>~GzjF5KQ2)=`oN4X6z`KHY(9 z!azX%+SX49j+G*AS-;fK{!hxW$6t9ud1&N-{CMfy%I^Yrm^kXzCo>@O;Hmkos7B9X z4s*}juii??0De%0#3rwpgo zD#xk8%zav`b+~^WCJ`+A;#=WB0z78J=EW>I6nbspW88;Kka&?);7LA+Gy8Y zBJ_+&krE(6l{|LE6Si(Os&JK;(6PD&S``Hu-nFQHJP&#OC8gHoO~2JzD+YQ%<{dIV zHD3#ZPkTEozy(wmOLYIUMCbu*xmmPerq0H0y;NNOUaK{)|?-_=CFI$7p}9$PVl{ zo8O*s0p7hj9!r$-6M76C(rMAFQ^tPm(hRr>($cq17C?-_cm8Yk0Jxf-7bX|IHw%Aa zT>bXKXQyLG3mwy2L|^kbBFIDw9mdLj0(^?)Dcm07F>L+t=ZfgbjQB_UsEZ8>5}4cO z`SGGrF2+YET{|mwsk)Q0}Tt_)>j)%y_iX^=hAtWFF&$I0^dmoRkI}_ zR}b1rx?0rIKisYo4`H_oO#5_FrGTb0s&qm9O}+i)J~8G)<`zm?welYFuN95|+zsi@ zK4@~d&5dY&bwT^S{3w)%%a(T`*Mgc+L`XDr@o_sM$nBF4(a=)24Ybxpx|!)nN9p|R z(`Va-Q9Y3COh1<;KY;eRUvcqTAQVwNI*{pbfw+^$X5C`XS ze)dfzz)i7D^@cw$>`I4tb*=3uC?M1UxvuZK;M_c_ng#r=_B_ATT13mn_SW5^4$P$L zn9;lM{Q=;~A8S^=2yq&UX=(bnPe!YNuh02mna=2COjJj2I}pm@jGTLC`J1ozQw)4@ z)T{1O$*bcrp1AE|F3IAN+ zz{y}!UCEK$%X-AoT#gG#Sxc>%Ibt>i4UgO^!xda3t4fp_e#j)(yVOPQcMa~XIMpsI z8h3#Yx;qH(iN}v7RCa!Jn$3Ct z%!9@d|3q$CZWnIqf!Cu`+MJ+p>DOCkhzTv-Sx3sFuV|3XYbnP!=Nq+Dg*7qG=ALL< ziwR%tB)%Ok=nz**k`+!bc%h$sHdJB)h&Jr-YaLrXGL0lW6hlT2|g&YmG@inP%XVr1M^!Zq-8RY@5kL8c*l5&tABgkIuEteS34w)-@lK!`5 zF>YsvOzmT7p3PpWO|rVKr?-l&p?8m%u8v$?sGT#sNDpI3%DS;RZAA5Q*$IGJ`d|z% zM0{`3c3td9D327GE&MujyC9jKyJA|NnR){>zIqe1Hfk~DeM~CY6l*Ye#6Ac0$5ddh z_8#mu;cZS=)Ts+rEJ34Wh_ z`BQ@@U;JRvAx~$SVPNA7X*EHF-sjB!TG_Ve5ra)pMwC>lRAdgn!CIWxbphWJGxRJ` zDQ%*Z&>mqfAbAGdtM*oLiKOsgRnB zP<3nTbaTJd#TgU4=6Uyv83P}E?8hZQD5lg1oblFHZO3jFoP=9F#$y?@RK002JnGXu#sn&^;#PVI{dPx*L7#Z~PF7Q&b@u zWSJexd*cJ$wvo(}B5A#>x1Ot=5}7+A7&cX;@922Ivj61i9CT4d%+6?>qp(XGB!hji zE3-8v$rmKInT|c3oJk#0JT1PocG=q3u!72-xZ4By))7Gu2pI$WtXYpjhs&-r1WwTq zQ`Q5}3DYZPlb+1Nrp6E9_a&}RJQ>!v%zV1_cSB)y;p!jGU1`1>J`j_bGvdihb(O(E z?4Rk;nHaz{5o4^b(nB6Rt{?-)W18$Fp~B?kLB5+1=ViF&F=nzjT^?x-mI{Re0a-=u zG@R9<;-sC%Hw+elT zkd%rqFa621Ydticx(bb_j>$0H)x*18kSOmy_o)Oo`>VM%M`2<&ul(AJGcdZ0)?Cs9 z*))a~CZQ{_s*$o*yi2I$z?7xhTZHw)Hx~Su80mK0;vS)7J+p)@v{4 z#y*pKX0?*x8EoNwE5LsG>EtbE?l<0B0b)>wnMYhK^CDDW>@C`N&&i7Ynu>bn=~*#( zXf3H-5Q5DLa8Qz6oVm}zK*M8I_~xPE`&*t6T*5^VO~h{YGA2^dJ?Z6(~=r!3SVw`|6W66 z?v_~jR8f%l73-+2iz!Uh%j=;POW&(+(-%Zp?z07-v|!vLH4U2`m)X*bcrGqsoZZR(6Vy! zlE&(zhwTjQ7=KrTyKuLAF-;0|!}~ZzTfBR$$80rXxv=~$kM#%N8;W|3>$+K`eYM3ctd=5%a1lbyej-b-%$m<%5lTyZj36r8p#9qV1?4#Hqtxw5<1 zqCMQ*2?xTs`IFO?TPLW7ff-v^*1O;xb-~9(Y@btwv)Zta-@X!P{Xe;ELtYWVRT z(flsDb9&K>S7(=Nyw8~&x>60j`QBt_$9CQztfOw4Gil7^rq7kO>%*s+Q92-a2^)l8 zkCA~hUVb{!O9ih+8deKyd7H5__Q$?H5x=MtH?&Hr+g8j!Hgv1~{D6+(n9U~tg^|4A zR`G8%i4ecr!QQ>7S~t&n_fWLMw=fz*KCOMr0b2RYMO;i9D89sr^Bu$8V&}#PhGWl5 ztUsKzHz@U6M+yfK?@l2W?h1TNm^1HcJsU4NCy{ujU;BL2Od^~4nZ+Ozv}pL9q^#7@ za|2A)EzJ9^?_Cw9MTU4)FdApJ6MWY@1;JmYIRfOHT@rUfPMDYE z8#eIXeBpdohgEg?KxHGSz2}YmY#1yHSaQ`@fj^)!0U7vYlMjyz;3V&DIw(iFz)wS6 zZr_4%NWXoM$vva&@XPSct_d!yT>lce*n=Q(0=`xb+`S%7Es*Xwv=CxpfVp5#4Scz}z)TvSbdR{SOHwsW}rWvXY? zNY8b()wQOCLu;nNatb8kilGZ1vJl$v``pe6;0Q~w&}yjdkn9$YEiD7(Rxg>#Q~9>b zo0sBQWwOzR1p3gIin#uiT)4g8+eOygYL=J8DijFoK)Sd0JZ7Gyp)F;%d|%nKq$JGq zZ7#1~?l#=7oI({ORT6Q0E}^w9Evry_+)#1A)iq$KENSEmlz9=_VG|a5dH~=v;oax3 zyy=PM;cW`EUb;Kd?YK){w0)sE^UkbS&8>58{OD$9VB>h2WqQ4>$KMIy=eO|wL-b;n z7-#0WgbV3fZbpJPH@(4K8@^sz9?nb+(Y_v!&U|^Tp-Uu=RakVaD`zq3UB>DE`Xi4| zU-AT3cAzS5ZbE$>*+axKBF^+fiW}m2JR1??jbBrR13-na|{I3H+ry zx(;9JNed9kD`X`wIbH49OYw^KuX#nLY_tj)i!r!F`L`K_^V8S-9KMNK#94;JQGCq? z9ztA99Hb%GNlJU?EI-#fV`wpaSK7LsWh9-l;Y1EOX^A$)?m)ZL^hNsHTY)vPbkt*) z{|S)KF^%<>(v$E7F4_aBJlsEs9t^Px;tWw9w-<}MFGVp^?*DkKjQ?pQjJ^qaFUII|h+>6|Y%Hnj3wo`$+#ZTA zz5M}unW+x~t!Epex-U1;BIaNTD54#)o|fm@_IjOju9y$ z03B%_SZ=b4vI{jO@MA{f+)`h4r;5WFG2sV`%ba2aYQdi5AMf9ODsShb&r$mh?|s(9 zsge63jq2HVa!5C1t%6(0wamvnH$26eot@noCAkv-fC6nWntA4(f>1#s^6}-haxhy* zldxO9>jq(F1PGxsR#Z%f(!JQFH4de0cbfOcLK0-<`WC`haMTX%3UbU7LGXnvOq34@4(L0EsziA2#Vcj)xsTlTxR zGM%~_CtIXtUg#f%=R!bcLF(5nnNCos5myiLL;p7!yY5{@57&mx%qw#S z_tb`VPwW16TbcK%wzO}+VdllEJiH>-7KV&Na`JgDgM3#Pu25f}T?ARBHCdhXh% z)1%7b$FT5l5)0U;C$vA{hU~ZDgxT*_QoepS9;^)A+633Wibx&2PYo8;MXTFtXNp_0 zf5|^$mwzAA$}-Y5SuX-8VJNI&C2kkoD&sFg%vi3T#wkHecd&9wxgzJ?>zDHx=O>R) z1WMC}^wBHBv&r6u`v?qSFRQ3|zxoJBb$h*3g zaN(tzl3r}a^q99;ZMhQFSkur*a_Jp(st9-VQDD_s2L(npv9=F3kEZL zvtU2HH-}r}cFP6rpHbPD+hf?CvU*cdJVR!k9M=(acwMXaI9*EEdHi@ob;fK&Q z1WIWS-7M(E#6|2)SI@}k@TvjCCyim@@i33`YWd)9oem8(qTYA}(M)r>A;2Lt!+CX1l>BBh_8UyQe0!5+ZPL&4)8=5!PJG95nU+?Ny$|oLG)>gI=d|QFmA({mP zrbDALTWaEn$-^T0Rqb?QZ-vS!oH1Biyc`JT(1!;=zX(Q$Kj|xd*-k6iDz!;c8~|8^ceGsSjh6h(8_Ex!azS zU+qK02jShY87JM1S@D6Sf}eYh`3&80VzfDFQ~mKH@eDn;d6A}z#$(7A2x5C&iVsQJ zlE!qr0d!$AQCA59qjQMBS$O~!)SV<1tjIaP{hZUGj!)Z;D5UT%=brY4z503-FCR#5 zdsi==^F?f|txS7=DDy_}We9sfyCt4G479Ar8qwL=7R41|orb>m#=LEm+KE@~=daw_ zONmaIv09^s4#N#m((mB`a7O+1@pc1VOfm**<6k@Gh`~N$lWy_o`(l%S-%~-j5WLsO zM0>X+*3*~KnS#6Nz=#fBfWJ?#mZOK?v)__|LE;BHr+14{?Q zl%;Iy;+;hjw+Zcl!ABs@!?Xy~|gyfx2K}rrwD4<~O zL9NxskdPvmyOVb`xOZ0_{fL^4b{&E9#ADAQupT3@1p-%aKHqcg)w#1U5fflH-X*%B~GUK!0>>c7O-u9~^gh`CFHW zgOqjEcsMKNmaNC;F1gmcG1SQUIWDe@k#cu4I_qkD(v0)~gdOh*A~7Eu3I%LJz9<1A z7Aq&H?5F+QJLdh~2AP-qwdu@gE54=@oO&MJcFJSlh;&!(wHxtf5go9dnk;avAMI-b z(pKh{r}@SgowT&`v=V6o(!kmw5^dEM@P*I3eF4?deaVE@CP&-!U^Ze#a>b{*Wp~jmDNrE*o6yW~H`wBXuw zLlD_r^_cLFXcV?+6hTdRh)7wT`fHTBtYkzwJ{fzYIL)?%s~x1!zYBKLRy2zbmwi_v zVk;sF+JhB5ai+6cFtAs7f;k=@#(6WH38A#)5kwS)u;7*O(xwAtBtONPZnbXsMdK}ZWH61fyOAV0dFK%;gA z_J-P=;Q{g9Zkq=pJ*1a;a>j#m+#yZ$NZaD2FszafxHM-im9yk=4AR19Q*o8PeUQmqM-{2x4m-rHsRYRJ$0` zDm@b7Zz02$0nQFID8J|a$QK20Y=95MGUXW2G2K0ncU%3e7JVaYgwe?7wde4&^cI|K zU8|}dI?cWWC#xT>B8Jn3m**9j3^i-4>(YD$cPATyK8h}Y$?w?{|2f6EH0=Mer<`=MJ5+n`| zg=d4upoPT^&Ry2=0oO0mQK&+BT9<~r8RZ}Fj{1z|i@J_j&<}B-^FM~p$1Y%1WBvJ< z^0rL&4K+{ZZD(I)y)kNaUCt>Svq)hJALS!P+mAxiz8e)~*#-M2d5CB4UY!vpfx1h8 z-ONd4h8rE8u+avza=|&zN$~xw1kM6jnbVD#CU)q6&B>C8Jc;0#7kn2U#V}URombW_ zsXyNc@i|1xe=;`UhOkTjbhrd|FDK#tXCAD<%2Xnt%wil3`RJR`wwP}_)T%`1B5t3< zVA3^m4xCH2JzM$}-taXDMiTj600cgXqv3l>H^`O1$D_f84}N(h+EpzL#RM`_UKWcX z%XWk7?RZ^`Ex~$Ok-L&wl>xsK7_f;KOhr#M~Er zg8h3u&)2uZ(h=~wq&G8PdfEMnCsdAfy#KzMn0xJP+WxOs(O}YHFnNQ5E-)BoojmLB zHy^gE7=Pa5H?}$h0b<#eo~@Ki#r&ZMfV*vmX$;@#?HKa&u0h6l`Lw(hb>#C1Li8xN z`ymHfpePKzW95*c>y_<;S1w>ltMgstH#0@Mq>$P%;j3a~3~BU?KGkYFX*`JJ034$VOCBFI@6*s=&4tCYK zAo;=PXJtu9<2X~YC$o=Zcj*0Kox4i8+ELa!6~~4$F9tuezy`WhME&=kPZF-TlxPf2y$)5Pt-uoPtAQdMg!-HVX$R z{DogRu0M2*%7thdc6fgJp)koB_2~zMp@ePNLd(Sj>$%V)Cm&(RbiYiWN=O1aODY5> znJvBxy8lF7a29aLEtK=E6bM$Z*0SB*)(9ODTr z)i6eFq3|0(`!fXMfMJ(}AvgP>7T9D{$4_TD&v}kCO!G*OpK#a|4D0)v34F&7`jb5c zry-lb%SWDy3U{;);nv&jz}}4P3uub{IJDg=$dkg(=-m#bisyV3d zoiA=ro5E-?9f!;r{ylKTPWIuLgWu;x(7h1n2%s}Dec;sN#Yxq^oQlidULhT4V&5wc zYtVae=Gi`J`1u4eQ5W`n?EUI5*wZ$=?qOQN%VcZD^p3ts{&5O*W$r!rHri@S=)~o+ zU+tH-ZU1ReW8hal0=Y;?5B7V#s?YY30?`R3WbhU#Y2`^=>PqM0_yJ@^3ixtO&7ct} zg9+G|CkZ5A)1NpJ4UrQVp_tsAA^J=ikOPbwi46Mk>In^u#zkbGb;(Zv*$T;cXYeu@ za2$)X4lYg<23Ghv2<~4UH9$5x5(h|29+<1HkRBEW4B0>iBKm2&D^BQ2hY7KdnKt?v z@@2fyv>3)yoIjcxAFaxWpdh9g5>Xt+=ZnGl_n_IF&VzHD5-Z%U?+>XcH~Z4F&pYQM z;&&qZs)2=EtEbKPmmGEBBSHDJm|6AQT`lG>1zC$MkWPtagekcbCfVVk;U}UKhYKuO zH*GO`En0%#_jYA5)uPR|D1&vF#RG~wtY`}3KD8N6hY-z9@yyXMZw1xMw?i#6;v)vV zYBShsTTOmmNcPB)jv#!->Dr;-p&tyG{Ozmd7n*nVSiQiZs6vqGX_E64O2>ZXQ0|D_ zeLHNrL;a)b92?A8g%_N8+%Y6P1=`r{&70d~`X@R+w3=?mjzl@M4lI}FNpLJ7Z6(91 zljr#TW2yGSC9%f@X|FpzYTei0;1C5<2IBs5qwij)P+ka-pNKD82Doz;RSs+r^g zRV^SGbnYpf^f@Wg-Uov`VUuAm-0jL8=cYL2gUIbO*i|IEjmY;nZczl^lXf}Ka;ZD= z-R-zhzg^Y&GxtN-mpweox#gg^0XwntW480+B)ziJ<|E%X>+rS%Hf}z6{ag7_HUt?? zh=N9(#odF_P)L3K`Z5wF`RZo5%Wgx7i7-#ynH=SJU-JC!1rW$Ih0CYF6Y2u!d%i_9 z8u7<*jGaPD>g&*S8{tTsnpr~b1Si6j*EimA-;j-HBi4;4g2A}c%dn87VdUuP%X$}b z&H<|t-D3I!hu+q<3-zoYoJ}4b>N5{;zIX2dJg6TY^jiDuHfB82OTt`M$&vlmqCLWf zb%#2@emyW)HGly0e)8E<;IL@m_12wF?)e5#<}|au4luIXS{qw0X3-Y8^|g%Klle{mkX^k+7o8wX8QQ1)xz_S_L306TpHx_8pcA6#95 z(2TY>CJ;n0FbA~lgg`KUJ%*XiYo*-y#)$Almf^^u4oJ>CXdZibMenHV8%^3RNAL$a zAW1t5`Sh97dPI^LhkQfaChhyV2El-^paWra+6xXu8HTJBRWy;_A-L`bBj(6yXKO_c%Ocpe|1iyal%<7AMp3Ul41&3=M-Sv%gYDc!Y#3El+kT$+F^^u-*s4 zl>kg03Dh6YJ+lt3e3{GN*dlkkB)pd|1OQssdB1n+_Rh%r7lYH}{O&Q7UY}6w7!_Hm z-@TqxMH6o!?OCxfThwT4o~)+`E2oZ^-+mQRZwEWLt}1f81$dysr|g?D9|{%=DESm& zbT%(z$RdZ&A6yRSWt!8&hwt@FS$NRn|K{Ge6B{7d^&&t%D?h=h8yxVlewB_JBzg<= zsE^l7Sdw*FKxn_Br0IyN5XhkI-hJ0@xa)AqY2e516o9f`9!%N9(uPQRv{qnJ0uMVyGFik|mgX65Q?#YDsml(k6}2p^6eli(uyfX$;NYz4sF25Lk6GJxfQ;+P94?O}~bMUw+U?E$0_Q zu1K=sj-oU1KNJvjNp|e4SoVt*yN~7R#?!bx}+#i9$tLQ1r;zfscNt>IK zn?UJhxc!_pFkFaHPZaNwh6D%fm-dyTKJa3Q&CbkWBVODH8$o8 zjDcgVe?Y$}x2g`#nC3-T^&c)x$nQ|WSAVZv`MIijVuU8U@$YOM$9LvgsA|?0-lP}I=-oHg) z1no9vpt~>y@bAvhfJ-~ zaHGm^u|ASn)GxlT;vn334iP+<*7%q+25?gr=^m|Da2bfPga08&Ox-S7>Vw4Rh(c2A z&Y-$z`063NeEkGaj2}9AhoaLlWbw`5QW;myl#2QfeqQN$jZK1_R{pmJ*_G#^=}t?Bt(7`+6loc_Z?t7? z5J`$iK8}(Gq_Ysb$q6W0qsUegofAgD?$2(EL*{kDjN1FlR0lmX)RTT@t9}~aVmTH%&j=1$I#=>fNjfHJXqDnve=A~t;jNW;0n zY#f)PG6hL4MsPPOLxDMa(t)47IlawsskmZ~Hv?2+$fDj;$-W zEaXqS1sW|aUx9#d->QvWy*O~v+!dyY4@CHuL)~$dO@O+6>v%_nW1p&uRl-&PpLVhC zjvWy{_g>+r11**W$YpMJXEy-&rq^b*bVZU1Zf03mH7b^_P%iz-griw*KM$q+aIk=g zZ3meQ_WA2aN4l9Z%mzB(pxb=3_q1``8_FtukmSDC)x18(zP{^Fcf%3Of)8Cov5-R^2O7t&>)ZQR+TEL_a$|2| zo;xde7*AWrv~SJZuk&U{%@w~r#NJos5DkiUL<*n_0$u^E90ENG!HAKtg?wV30Gm9l zI@M*MMXC;Lh?AVoLfx*iO$O$~J%W*hnL-*PEi; zvkC7mOkSB&w<~jf+(OHxaS4JYo)0d=ziL^iz)VL zipiIpz6dgS^NnQ^=B`X_0CGpdN^{Q_`_C=wO(PspGA%cMK#Uw#&+Rl|9Crpo_DFzA zUg!2F#grtEA#Cuhy@UsvFc-a-tB;}14VTyIy!Tb{w0d$gf+*DowQrAWxjY|l;hP#u zsR7ux(DRZWWa#9?fQh6B5FdC}pBsivP@LBZ=~A}z83`cHTaq*!tG1o0WG>>Sz@hcw8tO{TuqXqP2-itT!z&-6AL5mGNEj@IN19qL4> z6Otl`^>k<@CzySv>;f=t`H@c7Xf%Z3p{f+Vz}-+OcW^|&5W9RlG8Ba`{mj9g_R+2V z#aKiQKuEM9JKV3?E(pSC8NzI9ft*r0e1io}?>f>ike?l!J_n%fxld5-eFzSv{-?9_ zM_2)^0mysv-ppC8yewc{`p3_hILP`Q6<`uA&`UB~Y1dvFMJFe#z)*^FIh;U46KN=2 zXm;sb6z47Exm^H5SypE83+Y8jFH5w?bqYJ(Gwln)>B&zFk!un>9Y2=?|6}rVt&rlu z39h4aqdv#7ujI}*uC_oTTst?yZglb%4(An+m&mF3b+T=j1Jbd5si1ojN^{Wt(au}u zu8#@=am)tzlniRoJ{SnLav*fmW>;e79{mUqF1MqUxS7~T$YhN@y%VD3J~VSOL|?Ne z!6)cjIqf-3>Hq8rQmCF`5BjD+cbX?b4IY#cD`*e2m5!Sxj1#Hv3 zin5C{W39DgUOo_IH4g7Peoq%+prCsT)74fj>f(USX2A0%I2~;xU$RH*&$g|z>bnru z$Ry+kBfp?yi8@%=;Jm^*eZ=$-BVSeaLab3B4@0 zU};Cq##+z(TY|jayEKJK&wq&_BzLT@mPRgy$6QWxA@?)8h#&&>a(0|8x)T`iEprgE zBx1GUi90ZCTQXcKoS%p3W#*P4WDO7ZUBk-M6QD+z>8rsd?a3M9VjM2=-qvSeo`48; zdhUHaz}|G}bhl8Lb^Lyn?+Gir#LF}-5?OG<0i6fBDC8{h;VlDTr%k_8qBm{`E3 zsY%~aoDFXvKwDBvxMprQLgS~@qhH1@1GPD!gU7 z zKRlv8)uyKuJ<|L{cE7kNX^5tf?>5g<$u3VtXX%#6Ye4p>-=WvfeM4aNl8nP`a-yYvuwiFyE@Q*b+AkLI}l zFnuDc1TWeOokNy+W>0Nff^_j}Ugr~Ht6qk4&CHu`*WLMr13mUoJw!P``+4TGKfXb~d z_WuGW>X-k?4XtH+n`HKURH4(;tPzuc*1~aGBM&={+U0IJ1rFUMnh@0VBF_LX|G4_K z$P-zk{Z=DbFeVNe<1GqjHzBqvprTH2!~vyNv@dU{eu2~Qp^eLeOsHXg`scYYV9Oq9 zAO~CW-Wju>2F6lO?$T#7j-?T3v*kV5bT|o)@>l&(>?ydyoNOZwio(xEi38O&(Vn{q zBly9#PZ9ocnWdpV$#rgOP{j7fWlhxIiEBEdx**HF^EKJqj{H8Wy4D4tmgi=(^HFqR z=0)1lMNuICK0VrVtX41CU5rYWS({8sJT4AdH{NIoxx?e_bJ{I0)miS1d*1Rmr$ye@ zDadHi8F`Hu(e|g&g?Np%;3Y~k1>dRAd6g7G;*B`eHUQih8(G``f^Cx8bD!3;R8_p+@5 zp+_7X47B`a>IUFGkvi!Pq)I7D_DVHIm2RcpTiB(Fcl)0G`emk*2+cN%C?=2}RzFty02em=3;T_hN7vea>VVR_4Ce`&PDe~tF(Si#08r+-3bmC%kZ1&*tc~3;=5UupXQhBLm z!o=~f$%A!yHIS+9zn$NOmJ33$CgN+U)MGHISHetIitgoJeq}C~jgiFwWnfE^6V%TG zwC#O~3ku}_V^L11MaLyi*9vH80i$V&>m*Wn@W?Id287{&AJS_9$Z69lB+ z0iwD)V{#I4aNsRoaHXM3%InD!7$581@CQ^>n?e>Iv_@HuF5OEDbvBSd)GeIk0#-Uw zJE!UN_Ro||I-V+@{eE$Z^3n%j3l6+yLVX}6b`w9^qil=+z~htqsITCME1|i*|7?3& z^(*-;iuUoxK{sxVrO=GJ)PagdryU@Zz~3t`c^JI`>RgHXMe~p#sAwhYP)Hw4neYne zu8(e}w?*lJv2Biiu`99rZaCWHI-)DTpza=!#ReUlitU3tfW|l5mAI##GzOp?L1yej!AGgoh~7 zLcM}31WnvN+b1zc5U2eFAjqPmohrzLi{spqEb0JwTqN%7T4O*NQ}{k+u1db+SA{9O zsuQa4i#V4uROcX0=fydg15R_{G|jdswQbb8hAB-{NMi`GJY*T4`bPop7hY}xV|%nW zt{82zZvn8Gt;3|FePWInP#Y^rux^!{FPq+^ecU!<%SKoy+ATmlh=(S|P_qbyNItMW5Gxm+no+A4 zh`{o15#PE(+1+h8C%Yr_m6Dbe?c&ciCgjb)IO`l=P>q*mX6iA3r;LzW*vk7I~u33(y0+HE1j z)S2LkkZ|HqbbggMOt`RFUy?Es>;hz^>IEgODepc5?P9X~z%`Sxr*eg2M2S_8KS8a5 z*!07)88oDu1@FMKj(8tEOIh!CSjb@)YWoy&+*M!3R{S9y>>Mrtz* zA;ea@reKL+R;)VYXGwi`jsGk_P9UoojQRyg5rHAz{=pqcMro+x+g(<3ysocCzI9I*@6^aK}D%aUG(t@-Hzv>QrS2? zjm^&tjv&>-49k8D?s7va7%Gc;u16iPb35N87)rSUgOq@4kt9C?$33Etmh4Cw9o`C- zE@P07;`K^L5&*pht^;se7HfkJC{YgP6t?h}%NOepBLgF{ZQ`G*(4-)n0f)%;tS|{_ z4yby8G=ZV+f*qiiHFD&~lq9s9C=>U0R_>py-1U>MkK9B>Fi26s5W5r2FH~xqwmHrnioHa+DFeh} zp&rH+DjgvCBU6m#4#gWVJQk6+cJO`8t8jY_J7biGJ0>Rj3>v!;%?h~xkh|S8_36|E zdS+leh+bCe6G)3=?+G(SzH|g=f!=kahz%@s*SQYxAonz9e|%daI_GBoZr!>={wI$f zI_FFgZ(gKMPG3O=Hu@$8+|KO&U-UOzM1@f^nk_0FK$JzP+kzucfU^bPxeD@dEH=Xp z{-KE{0W>(y8H>!^9oeuasA-QaKM|W%VQi&q^iwgT)fGj7U`@d5(Sq@3Vc^~9z$ zszEi70@kt-StV=D3)njQL{1`^nsbDe_M9CPqX^hV{DEIzK6tKXAqJZo8pk}!-5*7n&$8ZtIjuB z#PUjhMv+HUORE5Bra|7vArybX9OYS!rM#}RX#A2lWkZ_y2h&#BJo6uKPH!i^+i?`g zFfbo?2nq&S!=xy`5e9C1{YP>U=a*&q2Q~T^V3v4pQkc?+(zP488})=YopPp3oDMcf z<>pmZ%0@eqh{4j};{yNaKxB>fL-eD3Owlew8P~;Ppw2ie$wC`ac>Q0DP59?LyUxcO z3xHU3&HmKxf+xNGPynePgCsMLya4PA1jRzW9IB;6IOA{>v9O}i8Zn$$Y;*)BnO0-+ zg_rPGNN^yhrz^*`o<}dVnb8Ab`XH@)V1!AUk`%Mnb^6kcUs>Rg!$G)Wpnm%^LMnzR z;E!t5iV>7d$a_@!t+||kDJ8ra#?^lar7t%O!#2AwG5Z*1%KZrm_csVjw9nMT+WY_ryW$JU_pM1Ht_NheERD z1)D2lsagaW_``3$@rcIH6ovxDrAg+ut@@dB)$Gt52mK7HEk)tpUJA9v7XK0aH-Ij7 zSe@i<-j?Kqj_78RpLx|n&8>Dsjo!pleVA%mm_g`|>2W=$YRSVtI~@+STYQ0!v3!c0u|CMt$zmivKl8%S}U-mWuu6>vHhNuLjXT zIDm4{G$?02p=5rC0*zuP&_?tQ_#!L<+sTS}Kw(kKv$e*RqB;sY!Ls|+0m`t25$hhv*tjT<<#*vMuBh>X1QR5MJ41h?!EnJlo*^FG43_$1GbQXr7jP$#k369#Z zn;)fAok*_%<_8yz7JxZ#xrp|I&YB68fw?HdY|4TvsUgrDpS!blGt*^?j2=d$i1#hj z$OA|JLE+<4w+0U<0D}?{7n_mdQpXbk5?%r84Ei~4O!+yPDr~30v%7cEnW`ZRx{Zzoi@ z|Kz1lR7v?S9y?i?0xT0mg+>Gdo;VNVe4i+-A>%fRQ~jS*3uw(_*x-@SRS4vfk0=&# zcoBJG3wR>9O=4~nU%}%PnIK)!q`c?vdL(2q>X5+)V8ll^W|sV+Sr>-Fl-CP)c;kX3 z>wQWJO_t|PsXiPbdK1W=0%3xM@}R&tzyOD##$p->8rMWX93eH~cxt;&?t(QcyqQTZ zyNV_T?-&J1aOv%)dJTA0goZ8ydj>H7_Mk~(0wguAQc}afVr+47IuabE`h}`UfxQ9# znVGCL_0TlZ?P*Q!0MCixy;AyB{f*$#jGc#D7{X@(R{)*#sMRd+A?20O1`eX9Cx^dF zQb({0DPhR_xq~g`?is87;uXbo!k`06wj%Y%vcYe#w|6w1cxcQ-U8Cq?n5n?VR2k|_ zNeGez;YEP(dcOQ8Zi9zzVR53!1CPA0&#iLiBzI2WrM7gNkoZ!09&P$7Dsgj^}+{dygKOk zDM^X;3oAc>Yf(0R=u-CDZxJU+{QMDWS54?V3t>lq!E6AK9kPI;NauLq)p0xrhJ3OF zDIBQB9=2%Ik5p*Wq8y=hq!Vz4cETmn)PcxAdP9qHPI#pnw6$XMANmD9zz0DO137o2 z?|k$Q>aztkwr&}XP&N(k|9S`3OSFt1I@qEma3KNsoCgq2_AW-1H{W=fF^O~#_+`76 z)voHymo3~DQO##;h6F46cAyj(_nh;mpza(A?@x?R)8H6#<`OIiS8b!H)?}T{zs9K!zG$1xZjU$lJ-GLX4%v8yY&r>=GRDnpe zvah#Ne6YQ}EhV!{?hTIOEw0C00|9+~S{d1PFoP`g02V+M$!c7c0SX7lK4+<V2W^2m|K1Mj{v^ zfc_UidnUY9NM-&rvz8vMc`hup zjDF!+rWH^rOY8U@XV_Ps6m)qHMuCGiB&SuOdq6ux{-FC{1|+%4Q{)p#(yPrq$;>4M>B{14%!@LOQ>9FG~VHSa)zuJE2ELZJfIqAk1Xng6@drGzx1H zekgq$7+qT#JdvLZPbw2bICsmAvu(Qby<@}qgPa~({)&E7oDu)gPE;O(^r<99ZTJECjV<|NCNPSLP;U?Avpbpzz^TY(qh%ah zo-S660=@RoqTL|PkqpSn^(#rpiJ=VRFE%F{RU@63^+)dnTwTKAB9zDTST!N0>2wRXQ6vR=ElmR?(>P^~O51(Q@(=%!C0RUz{^X-|G;ldOn?%U=0oMs5D@AVRmdvoGFfR=oCDCZSkRTo;@v#hI|H zchw<9u{)&~h|1r=?@tfOXX1W04g&0TJviYZsjKJf9vIdWJx-7zqk6{< z%x_0;ebTb~=T&d^W+>7*+zEM#>r>%g@|F7Hlo$ene^8ajG_kyE0$fUGXO}u^-j)XW zwCb#dC5=84_Z2}sGmZsEa+P7QJlldExeCBiTFV4zzyiv&nnUhW6f~Vs9N{ctTutdn zkFs8!e(ky7Ry;O!yULi>vRDk$40Xj`O|`90^qBdnAT#U=0{r4#?oyo6-^Yit1kelA z5_*9O?_N8hR6Rk_I}Cw~Z5}Qc(W> zd@LA-P^WlmEyMHIAjVF@`UF|n|KC9J=~$DD^cf>cb>x2*h@^r0N{rHrRi!Xi{xkL* z0en$zDr3!GZ&-u#-Odoa7rQR%Q=3-){rSHwLYx0@i_jVPe{hN#!h1rLJXZSCd6xex zmn1n-`|6VYWRz99hcX;eGmh+_rC&;(tIhcyV{5d8-|{$uU0H7T99j7_++$4(N?^#y z6}N3_#-o|y?i0{GsjJ!q8Td2w0wbRgXk>Jf4z$m6?=1cT%2kvndTtvb2~-5&i<~$AuP206F)G|-s2?rBO0-NH|C;^J z7YN=pJhtn%i5imDuRJ2l`}}?^MU@cu;*02@ihv;`p*d_ zieDR-NycQ!7i|i4^p67h`_by&sE+%O0wLX4zwNJ4Rq}8e=Kih42!B6XdaZci_s&() z{5>i;&+Bf}|5eg|KlgDXo86`kz_)W8(kW z;s2jI9xDso0a2a{!^)oj@h}M;>K(I6p3uFJq($(ySdRG3-u&a~;rH?4i_|_e3jD`y zrTBXn*KdoTc3fj`|K$P}c->@>O1u(6C9ePdzN_G?*0uNl{U_>+SRsTiex{FZJNWO1 z(QJX_i=KaOO8y^5@)S7stQHQG@}~b8ER5pcME>o_-(vJnwEmruzqQIgt@U3Gi&Xi) zGxG0@{5vC*75L|(tQ8*or6vCPTK~M?zr=y*|C=+?;rW*Qw)l}Y9cCT;ck-C}(fGrc GZv9`RA2Y%L literal 12876 zcmeIZcQ~8x8#o$?8NFz!y;`NzUPTeKMr}&%m7-Bwt=OX4s#-;B&!VWkH)*Y^S(F$d zidqq?#CBev-}n4+uJiBt^Td_Q<$a#}e(&|%>$yc4=skwALO~!9R8vFM5Cj67fj}hk zl;pq@62fIY@Qc*(q3%Nvs5+kd>=_yG_bq!3LtPLk@Gc01dJO`d0FO{>Ads&Z2($qQ zf#gy_ASTbumM03p0=b>`V^z@Q)lY7FQ4$Cw?x3mq@TvdI78dE_VET!8zTIJ*DA(vs z5rG}P@ip-s^&H zz5iH@EWLzlQE90|=n!&DHlm}_{uFeYdODvvM2-j_0V7blWM9C-$~8-ZWM7rZm`NH) zEW=~bcO#+XE?9HO1?iDJqTdM3h?Hhq|9f+`Ep*`MaG}EwZNI>EqhBN%2D;H7XH;n= z*Iv%sDOy$eY=16Tad==5{~R3*=d5B9bL+cY(GMYS|2V=MmVMd4VFpnkzhK7X)5L?~ z7cZLZR%5js}7kxYP{f*^?k7}?Cy}xUd_tBt%Pp30p)5Bp2J&e4qgUmx`fq< zY1`D5Y`miP39+et4ME|Y()h#A-5Qq@(m{|s2TU( zrML6;_j^WOl|6ZW=JMf5yiQRA#0)QT! zGFX>SCI&rF|25bWekYu40`YZOpN)h7aYq(q$`xkrULQVEt~T9lP)*MSCu<}*i!xXw z@=VVz%683D`hdKPg>|MJyN0Ks3gME=gcSJMU0!QREB^RC&eV6^d9+Uw?vC4t=xJ-j zk$d#v@1vst{Qm-~HZx}iCw1d4>4IOl3Y~A=A2@C70RSda6b;nUyFbqt*6trC(?pn( zWT9`bN!}_D@XYB#eS7{%AVRP;s9wybKy$6jn5RqbB)WN5e73ys_pq41VEy#hkROM$ zVX?j8eBl|`<0o?2Hj5_Kjb795r4G@mJnUpb3D+zvY?2EKMEm%e{iN&9zaqLhO_RKx zUFzL^iPVN;bi?^wJzl)PZihej;86}bjwO!aYy(3_lDM07?T_xTl2stjxRIS+#Re@( zhbUDCyQ^K@pZCVvEy`A6(UvGReluP2JLvkj%O6-#4uOv*eViZO>0AR|t?9n|sVA+O zQIPrYVN6m9hvl850R&Dib00OPoQE{RlSKWfc!H)&D@gtrXhFa9G=|99#+u3zq*J5K zjsc&2U!29sT=P3{3Zh8R)FRP#pxfXlvOnvc4R17>eQ8~@avMjHeL{pC$iEHLnqjeV zNW4O(DtAI%8?y|BZJ!zMV{`Xj3>~!O@gf? zJ~8~!c2YG35BG>ZiFU!mtQk`siy=Lo!3*-G`WN{I;aliJ!uk}Z;iC7Oq{o?NkcCn!ZZD$6B6FB z56K^AgsU4M;-?>e&tIPtK1>B`mJIdA;E!0zdi{dkD5RHMdoTnsg#U(_Gu$Rfbp|2E zkgD#sP+6k98CTiBVQYj8etwX!p&rRqFq|Ue_V>clcB)hcs>b>bFz<*pylpay2^A04 z?$;AzCNnXT-|>f5G5TNg@6P&-D0?|p^!4|~$R7r~3W5642bJ(7OynhUf5RKs&tWt`Bb@k^_CC(sa zZo_;)upq_*k*u_l)rIP%1l;ZFzFO*R#nB@hoF1|hf)AApo2cgd>eLdbP*Txa;i6V= z1Cd*qiuNuqH}cb`%dp2-WrlFjh%JfXC~3>dJ-nKPZh9sHQk}%_^*D;{53ZOV9lktE1T|ImD)f9Ke@HeYexi|QIxm=<`!2S%Q zbU_NDW3oG>J1F_7^kXP8G@`mX{Y$=J^h(Q+p6SsslNiDgd>6~2}Sbf_k>EkY4dd@9Np@nW&0@MKnxKWVb8Km!h zdaF0GWD7g-LLJrmZNOV)lW6l)9hSDNn$0Ud>y>vZ z^Sn?O6Yzw~!BTllUA6RN+GRm~6A*InuSYFJf$~?s?K4^*A{*nSF;uSVK+n*pH8sT({}{ zfweaCSTlt^}dU^`!9!rx-in7R-LExiW0Li)6AUZMEz~qs^%Mripj;ZZmg(| zaQn+9gUK{s-?0um^Wiyt=~WJ950b<8u)A>fv+on_~B7HRdHU#d3X-C z`meLr@?s2$pb@ds?i#J{f!n)~uyo_c&5n$t&w3ZY(eJq09*1xHZ>-WVp4RPHJG=rS zg--6U*9a%`DtP-2LDYbP(03jjLrvatQdite!hV$Gm(l4MsyDnB_N=~^j|rsNeLEJs z&^@jXy{WZnx4@MkbmgjV0cW^2JRZdL+0V>V=nnc5&UT^2w`&yYIG-y6VH^BxsIM3= zDpA|n>(B7A>xh46Wnw%G2t?9-9WvbJc_>~962=3DqGj)X3aBCtp7A9=t$ZkF!2%0j zK#B9T>C~;7K2WfZs5Vvw8vWASPAMhN%K#>BC>+TTcHva%*T?zda?N&cl5|@R# z6iM(bPRtDOPhF1{>Z9L6r(v%jXmhsh%n$7k&uq3>jh$FZ&c<8(c)$CjilKH%!^`C` za6GgT7WxYk*!t9gsVDeQG?7ZZX0S^CiF}gCTVLElMPi5KoB6!Y!`Cu(D$GMecs(?8 ziZY>ROjY7z28YtM@%lOQUcJ>y)?bR)xLY-pRJmJo^Cv>S@*d`(cN5<3fObA<)dzn2 zNvN3|(eaA@*~1cmhanE9&<_*dzKrg=-Orkm~Ko9}b0&UvrB-3@WK= zO*@BSYA9D8hYw)KYp2{SLkhneH(X=Tws-e?p8h3_f&tuh+!s8&NM1L7ky(Bm$t|bXj!HA z@%r2I=fitNqJ*tct|e}HO(1dL^Z6JQSKmEM^7nW1KO@}gql1BnH)H7-;=>KcVoW2= z5#2Cfc)hQP5*L0+bIi{He|k$|8nFE~4UUyRHi+QV6H$dwcG<{@5w^9Bsf<^;FRDgc zqb4q?iSghA#mwWT?xQ~5m0@++0t<&RAe{}kF{Ay)MDo-d2lW*>uUg__%iqfix6_QC z&cG-m7bs1RIgk2K6q{yp-~4rlEf&V77slyM72oMF0_R@zmAU&3j4jFdrrF^QPp5VDk3qt$j(#rZa%uYZN@pVK-Vr&Sl>RkvBaaMoLFN~*; zOj8tZ+Y0Up1TlDmR?Hu@Z~ zO**sj)Qe+heWFy!Y8q=Ah3%B82>ITy_rk@t0BBC#f%{YDWtu(ffjf1!A!Bw3E{AOqX{z8p44PY>5 z^jBvc@3#f$zloCN)GisLRV9k|A+vTw(WE}O>Gq^g*$EVR*@-r@e$Q&1jhWRyTNw+! z0{(Ob{J~_u?^Ot>xX&W#t9*+8&y+}LJDWXGBxz)4Z|}=j(+jfIB4vxnL^nhx%v)Wt z_t^w@(klS4R;cZ(i@Jzom~PfQs}Hl+*Blms!%6Sz8i&E3f8O6Gtn;B5d<6oE?YAwh zHog*BqW%X~x9nXB)+?DHV3lt60zbcc`8Vk!Pe@Lpbq3v zHC@%6iXyjnr%1Fn4BWf1BiiHtR!al54$LI)=-T-^d9)O^9NXb84RX}BD+ix>C>_41 zmx|`yy9QX9{Gj{nzCqVKRHsCxS#S>DmS?BwaqZ{p*6P*tUlZpG;R685bQX`*B(-R`=m;0&W!9P1lA9q`#|tbh?q zwJ(Wm{V-2#qrixI-s@||^a(JPTYT{~HRN(CJh8{o-TK#@9Es{|uPyV2ssXY3wRx?D zKFEgb_57z38JsPbTzi-{KD#jBn&{@j(}N9D)B=UbbGV0}cHBE`t;QV#bmAAkvys{T zx9wE2Ql2HTgy5wOOPNV~Sj>-FELAWIB?o~>HeX-&l=8gTx?u4hT+=86R=Z^;3A`e- z=gc(QYaO#-yddUTmu5Ia8RK@ZZ^D&al;`9r zKd4#xD~i7yk)egdwX<-9tjKeX)>iF(Lx5=qLaR|myEBy;g8C>RJ4S)7)i$B1xhP)t zBImXBPPSyN%n&vRne~KUR~sNF$(+gaDNdlh$-2H~(^=Rx<*m3C9{KgcC0EI_Bxxwo z$c`vT7Y(Q@%haZ!4(iWQ6@->3{U*xF|4)$x!0gC|7b)ML=p-wnHbV&PG{kvTb2C%N&W6@9QC)CzISH_)Cau$MVlaTot=l)M4M!2uT51sryITys4HFrMnWzLx}p zJP#whjav2qJP(-_6iBt>kCr$!OKiLASII5T59nu|pNNnArP;I{LP1{oX#);yw$boa z-~c@et!!YfLw<^jd@A0?nmNT^+XiTkF)n+vS1MhQ$cUICW~WGJZuL)GAu z&p!e|?qD)10J`hPr^1Ww%Ay-(-w4Rs6(C-ELiSDRvnbtR6q0I)+2AI_p z{f_IUdY;jxPth8vGEDwXr}$-Kd0bdZZfoo8pMvKfZBO85ZwIfpgTBqV}Xv{oFg zx(Qh?&-WMz!&<|0Pump$-~z!d*VJQn<6s@G+piS(rSLc4UorAGL4ma4Wf=G z6Q}GSIYFUji2?5HGP7)JmV!k*{d1!|JXez!3E{gK>-Rbzf#gSa_*NCnAc_pJ zhGFkl0ML~giCU%`$Y{_MmVro;^;=okSqk+2YtDuAeH0p!)}+D z^!C{SqRE!8M={u`U>T8snrne?>0i+8Nu=yih+s;2aj&}pPhEJ0B9a(Hd9wmp1!Je%pItdsjUYHC}Ha3x}}5unbAD?f7tq~lOc~}T#Q@vpUWD$+Q8;`|Mf|B z;{!h1(D%}8pL77nJE-X;4WZsAzg;y`C499fr91ISW*?vvgk^{Dj{$z}YCu4LQ+db3 z&BH}H88NJY0kwz=m{p>SpPntm`Q#{h-$y@gN7@x2{wEaZt+e#qk4B( z=JH{rg7&^=B}kvFC9t&F37YJ1WkT_9sLkLOVZ6F4d3=H;t!|V)$0j?qDL=l@GT}S{{ORbE$Cu zx?-VeoNjH5!J8`c0-#D0_^RcBCuI>!)fx09^7-J`NAvm$b0ei1 zPp^pnn-@2)0UNa4<&GVu^5%SIcLL*KDfDpdXWxe}Ou6R@vldVVXr*q4sB}j1-0n1xsQU43kv zAY4;=J>`u zie!A(=s&g}DuP{UJr}#X&Ur=0J}}z;%JO#g%N>Y+)^Q(D;cXzgkx%ni36IvR{I|g? zz>7SHyycAf`o=A%gkr#wz2`#YuP;~HMPQRZMjP1^`3*(0&E|#SXs-o!z>uy3TY_TB zm5XV&V05E$LQbqv2{NhlYkPN6J!1Z+vj=bATr&%L_Qlt1OjUt)klJTA;eD;5U*vzU z|Lbpo1;0Ki_2&X^3eq2^TL_9NjjlA7*=}ao5&7wW{Mcdm?XO=$dR3k8SHY531jr0? zq6y&@9Vds4hc0}`ejea-XIk3Ud(FYEa|gE9Iq@m68eP@wr}PLWqQH(n{zCQY)RtN3 zZZYgcCCdbV`#c~g>=(hES5HK;9o>FSWwz9$LZ#LK0!3HH-C^do%uT}F#iup5_=da;5`-zujp@cD)X0G{QQBn{c4ER`d8 zbUmrum==%XmD36q>Ew7-zWqWMcNAy%gc{2`K8UA;H-b|9c3QC^3V;st03F^1TDlx( zBH!CIF;KrY^Uo+=7RN}4B;dRC?id3u0&o*}FLw%ch}DB{vVIPAUnQw{Ym+~=tb!;g zT7uKR%qbf1yCgmN&oK*Cl9eSWr{v5|CbKhMu|ro235Njg#4R!P5S@4xQU)~pW>S(kj9A7Ss-9w8j ze>k6?Yra!XE5-bm zsLJ{p5dNgWGqvBo}>QB8|VB9!C2+27-+*AZ|i!^?OPLG*h z(*i9qKF(x29$TdG0#KKe%A36t4r;8*0|xzifSGPuiZ~jdU2$B4i@xaQyZ<7$6WEVp z2Z-?7QM_4O=RLuA5w*Lor&(Uhhwa?kVY6@KH>3qH1rS1+NG+dcF#91abc^}`W=-o; zS`JC&P?O5M*=0vZ!dF=mkev3ncwD-epF~B&N(R;(?boBo%bFO z%mD09L;(CQOcT()fH5&3GI%SM2xC1b0g0NMM}qMKB-ZFNW!~PwvXR@dK;8*kV|pd^ zrf#DY#Rsugbgc6KJ9v)*5cqOoI<|$l2-gND`*ZhrFbn*9Gjn8GaAjOZ7{x?I6otGr z1#Yyvj1S0zM6S7A?IjaJs_DEc7p6;~GStRH&A8X&KZ09xoI@U)&C3{%QRd%X*d0 zUDXr`IDK#-iuX{=-_0?MSO#osGutv1%6c{3it@CKl@%;qGUkZCqkBa_uX3J8>5}OU zg7|H8sS%O`B%Gu^maY^vgEuagyf0&4#%g0TPuFVtALhS*`~*F{(a<11L|8{b=XK|N z^#m$!{78$XSdhG!C_GJG;h+>K9Sl8yoc5`Dqg(4jRyc~6u1Yd?x#^0G4_IXF8)cbA zM5Q4v9cZe;uCi|#AhQ*i0=gQn#3>cns|Gu$4lCjWnOqpPStq}j27YPXC&!^t&nH`o zI^O}h0IK9MAA#Zf%0Ko;>EO-vde+PUd8>&dFJG~EP?~owBJ`VY|E~raH#c6xlAb{+ zoB2k<;f}t^2kLoJ*}R2+Vt5v@=mBsti{#ObD7RQ_<$q{1=PF4FP^*>tIN><#*B`aK zRNBRELabxk<5C=>zhuYCfRtWydI>#(az=BXrtWsUG4WYHEs2a8|zg4w1&5Ym4k2+NV$)ZLFB#m z|0~?e3x2lCrjUwAVq<8{;#7coZtMv`5n5Xto))fs5J<)md*{ExbW&O0N&ZMQoC1;( zs0QA)o-oa1y((p+gIbFs+Sz2qJxeIC$H${J9Uu7azLNqHWG82aMz-)$aEcSje7X$K z^r@7pw2JeSoY%yRgivr5KW)D2*ZE)8V`OQL$G-Iz-!Z@$iq>{te66*b6ZIPz3r_yW zaCpBq9_$THu~-^DE)5KPY)2HL%ed+fY!SMYm9C%o?tu~8>-J+s0lxf5sw3U%AV#N~K>Gv@ z6r()4fMQ4Q*1x-rOX$KoF}6%sJsv=@HC;RF zD^CVR$v1XW?PVkt6$m=!$-MxPUx4Dzzu9{-k4$AxmbdOng95{aR zGFNH~9nT(mO#wb&VA*$u;mvyTKnOEF)>q)TsWr_0g?WG*eqN0=;i?Y@FHmW+)i`ov z1ATebE>nHhD*qFfM-)iBCigedPTR$0FSLqC;^xbr_UdwU{3rYh?!W$>n3+(lY$mOh zWl>@fXf<`W7mylLYgn4Xj5e$pcBnD`48cW$m@L6Ve7Xcn5nj2CcA1j zUoV}bx_AJ$=7{EW8a@ z9VD*W%_J(;knAs3i^Gj29Mp!QeSA?N_O=HUIONJLeLxxmPJrp<%y35tU!tnTiso zIAz+9_kN?26Lb)w^2Q5Bqr%irI&{?`kFYMJczMa~sh_3I<%qEL(A;zM`N!ld>qGA> zda%5^>0S!AcRH*u08P9O>$t{8{SbCy)ZxMd^j3;dJ2_cQ~R9fR)2yZFZ zGq@1D%YdtrOIdig|A0;3w6}wnJ1G``(_>z{S9oXra9ci<#Gu6c_#7o_7hIL!>F9?K zy1gj8Av);Xzj8S_sHn2F(3#!KA)>L%1r-wg?UF&4FgVI8l#l|~wB3E)Y_+$I-sJvh zyS-yw`BX_}!pMf>)JB7uqeu>Dc6IGQmK{7x6vWAy&X*4Nmr(;Jz-7= zW*M{pb+hHL$?RLG2Y>l;mn%^_g$&;F!Jca4EqJz zgnq4fN;R9$;g1$#2^TE4djBj)<6={@7VLzJkROxRKdfCd^E&<>T$rvj9^>&OgCq7v z1*Z=&jCDcLOB;WBTOw`Uz&ycPY-{ApygW?CJ3396{EIsCcVN$R7)E01K(Hy*aI*1=f-{=nbUNwnTBKsX}D#A5UR{TQ*FqdgEm$0hd)r;v@v-`(9 z;<5}cqQqjbL#}ygTaCCZiurx?8)A7>h^@n_(E8>BffP)U*eR&WwBQ-gHmful|0xq0 zEvRn4K%daB=TfD5R~eZ5nH4(b!-KSbAL+06m`dKX^9^jdpbn-&g4#79n)vm znO8xN=~okOp_z|l`ufi2j0d#X>=u|3gaDG#ZgCV6nv*e(C?&pOoyqaZX76y81=h8V zcEQ7tgv<2_!^rwyfvLQQia0FV{YGRGctIblB=K}@+_Hq5UKP0F0s9^j@wCAt{`4>YL_&OwO*`kWmnID}z|_+T ztC)--d^`GE_a)vJC!nFEFlyWaJA~2of5s>+bEo|_Cn%EFih{7+wB`o0nLdTBwzv}O z`xDq!=|faaMZVQsUlr%zJVfX&VW!P-!~3Z9TgCiB59d1#6X3d)bYglTB(Ga)Xhhkc#88&mFF#G$Din?npFqb&Jj3SV~IkVc}z6T8DsG$Vaj z)^Eu|bmi^yVovJ!uZvK;h7?)n*ho|et3M=mKb6wC(?@1;esf19V)H9Qn3un~=0lgO z3%S4GqV!#wTxtyLFg2T(EcET^1IU{WrEbm`4N1TxN|J^zvdPd&;O)=Vk0!^Z!4ZVe zH2al>SYv`MGO+X2q_^w^6LnIWf^njM-HrF<@pFdEfJVbWOBMCjs5EFT;_)}i= z{d*mOO$N>_cl-f^FKU+T!%0a7(eG%%X+~LtTu1Crcof=ou zayNW!%ynK=+l!sb?y$0Y@1E{YgB8FEI8XW#+mtWs<;gP^7H(}4k5)D$PgvczOdP}F z!&f!i3)5$^HRG1V<$IjNox^a?(J`2%IZb=?O35jopk>l*Md*+*6uF?59tDgbL0)W& z4(lo$U+)cif%i2Zag3S4Pm<%@BNuRUt_0!-OyG|2Cud*n=MFy0Gm@siw~DikDg`WD zzCW#Xc*`PbNQ4c_cE{MG=+QJ3h$k6^>8>P1C;evc&`&>8Od0D^tqX1d;Z^EgPl~T@ zzwS`Z^WFuL$32`Qq#7l#ni;49B{0xMOG2AAy@bL~G@mwjI+z?OFYG>wcg((w24M&e)0-N>EE>!*vc#cqeq@*m={uD2MFp?3}v*}Zy_eIcM{JMF$L!YT+SZF!P#X#1j zq}f`C>>*rrIn4PlEq}t>hJp!6-f(wG#rH4irn80;nJU3ns{~t}5d6=@Ke-L?>rMuM zF+eM7trY4S_FLOIFnovpJn4Ml(R1S-G>lrv9?qC|3QEB7(9CV0yU#Ilz!P;2t$K&A z5KO!*0b4v;*>>Xs+Eu|K^e^se z<`56uE+uF>|1y3vEiBx>3EVmgsYc^!bHQakN1QwRfS>fel9K3ED#7Eo*HeV~2tx>K z#7sq;i#k(0b_tnWP68uIRwFK5b4#~7Fc7)~Yv7hOkz^}Gd*6(Z+ntDf)9&M()j*CtEr!hl3;?+cx0Id{R?1J^_I*6 zoz3$dM%;_Kc9j=23S@IM7fClo?$r0aeLv&%uz=<2EF{ETaC#GAboro$n3+SGzI3)4K_JhR|+)P`;eQ zY!Uiq(m3iz4sh?mE&5`Yc-ZJLe>*63`U3qBO@%nra?W#+uAeR!!n50Ack4Ni%DZC8 z8$m=l1zF5*Al`!hH=LXW9FP0FDa(#uoLVByy-0g^$@vUsM}6*!aio&hb#rd+GgAO# z+$H6OElg*K$c%7#&ulHMG%ZumV>{ZXs&~17Yw&5_Xf0T>44u$WY|(FX;bmIsCC``$ zG$Y6xg+&H$sSBfi@84KruA;(JExEvU3c4V&VV+~Hy?tjkwR63blXY_0Cga9E41xdn zxLX19QGNAb?@v!ZXRW22UV_w~;&0Ip?@Iyyfx+ve zX6EDY%;&kBz1MT#7f3=({DH8zxUhuSQ?UnflK15#?hA^E$%%8Vycg1`E|02F|xA^-pY diff --git a/stable/artifactory/sizing/artifactory-2xlarge-extra-config.yaml b/stable/artifactory/sizing/artifactory-2xlarge-extra-config.yaml index 7eb8729d6..7bccf330d 100644 --- a/stable/artifactory/sizing/artifactory-2xlarge-extra-config.yaml +++ b/stable/artifactory/sizing/artifactory-2xlarge-extra-config.yaml @@ -28,7 +28,10 @@ access: tomcat: connector: maxThreads: 200 - + javaOpts: + other: > + -XX:InitialRAMPercentage=20 + -XX:MaxRAMPercentage=60 database: maxOpenConnections: 200 diff --git a/stable/artifactory/sizing/artifactory-2xlarge.yaml b/stable/artifactory/sizing/artifactory-2xlarge.yaml index a4e0f9505..be477939b 100644 --- a/stable/artifactory/sizing/artifactory-2xlarge.yaml +++ b/stable/artifactory/sizing/artifactory-2xlarge.yaml @@ -28,6 +28,15 @@ artifactory: - name: SKIP_WAIT_FOR_EXTERNAL_DB value: "true" +access: + resources: + requests: + cpu: 1 + memory: 2Gi + limits: + # cpu: 2 + memory: 4Gi + router: resources: requests: @@ -95,7 +104,7 @@ nginx: postgresql: postgresqlExtendedConf: - maxConnections: "2500" + maxConnections: "5000" primary: affinity: # Require PostgreSQL pod to run on a different node than Artifactory pods diff --git a/stable/artifactory/sizing/artifactory-large-extra-config.yaml b/stable/artifactory/sizing/artifactory-large-extra-config.yaml index 4714acb38..d97a85c9f 100644 --- a/stable/artifactory/sizing/artifactory-large-extra-config.yaml +++ b/stable/artifactory/sizing/artifactory-large-extra-config.yaml @@ -28,7 +28,10 @@ access: tomcat: connector: maxThreads: 125 - + javaOpts: + other: > + -XX:InitialRAMPercentage=20 + -XX:MaxRAMPercentage=60 database: maxOpenConnections: 100 diff --git a/stable/artifactory/sizing/artifactory-large.yaml b/stable/artifactory/sizing/artifactory-large.yaml index 7212ba52a..80326a8e4 100644 --- a/stable/artifactory/sizing/artifactory-large.yaml +++ b/stable/artifactory/sizing/artifactory-large.yaml @@ -28,6 +28,15 @@ artifactory: - name: SKIP_WAIT_FOR_EXTERNAL_DB value: "true" +access: + resources: + requests: + cpu: 1 + memory: 1.5Gi + limits: + # cpu: 1 + memory: 2Gi + router: resources: requests: @@ -95,7 +104,7 @@ nginx: postgresql: postgresqlExtendedConf: - maxConnections: "1000" + maxConnections: "600" primary: affinity: # Require PostgreSQL pod to run on a different node than Artifactory pods diff --git a/stable/artifactory/sizing/artifactory-medium-extra-config.yaml b/stable/artifactory/sizing/artifactory-medium-extra-config.yaml index 6e0f72cb7..1c294c043 100644 --- a/stable/artifactory/sizing/artifactory-medium-extra-config.yaml +++ b/stable/artifactory/sizing/artifactory-medium-extra-config.yaml @@ -28,7 +28,10 @@ access: tomcat: connector: maxThreads: 75 - + javaOpts: + other: > + -XX:InitialRAMPercentage=20 + -XX:MaxRAMPercentage=60 database: maxOpenConnections: 50 diff --git a/stable/artifactory/sizing/artifactory-medium.yaml b/stable/artifactory/sizing/artifactory-medium.yaml index c32007fc3..8b7215041 100644 --- a/stable/artifactory/sizing/artifactory-medium.yaml +++ b/stable/artifactory/sizing/artifactory-medium.yaml @@ -28,6 +28,15 @@ artifactory: - name: SKIP_WAIT_FOR_EXTERNAL_DB value: "true" +access: + resources: + requests: + cpu: 500m + memory: 1.5Gi + limits: + # cpu: 1 + memory: 2Gi + router: resources: requests: @@ -95,7 +104,7 @@ nginx: postgresql: postgresqlExtendedConf: - maxConnections: "350" + maxConnections: "200" primary: affinity: # Require PostgreSQL pod to run on a different node than Artifactory pods diff --git a/stable/artifactory/sizing/artifactory-small-extra-config.yaml b/stable/artifactory/sizing/artifactory-small-extra-config.yaml index 6e0f72cb7..1c294c043 100644 --- a/stable/artifactory/sizing/artifactory-small-extra-config.yaml +++ b/stable/artifactory/sizing/artifactory-small-extra-config.yaml @@ -28,7 +28,10 @@ access: tomcat: connector: maxThreads: 75 - + javaOpts: + other: > + -XX:InitialRAMPercentage=20 + -XX:MaxRAMPercentage=60 database: maxOpenConnections: 50 diff --git a/stable/artifactory/sizing/artifactory-small.yaml b/stable/artifactory/sizing/artifactory-small.yaml index 5640049d7..eb8d7239d 100644 --- a/stable/artifactory/sizing/artifactory-small.yaml +++ b/stable/artifactory/sizing/artifactory-small.yaml @@ -23,11 +23,18 @@ artifactory: extraEnvironmentVariables: - name: MALLOC_ARENA_MAX value: "2" - - name : JF_SHARED_NODE_HAENABLED - value: "true" - name: SKIP_WAIT_FOR_EXTERNAL_DB value: "true" +access: + resources: + requests: + cpu: 500m + memory: 1.5Gi + limits: + # cpu: 1 + memory: 2Gi + router: resources: requests: @@ -95,7 +102,7 @@ nginx: postgresql: postgresqlExtendedConf: - maxConnections: "350" + maxConnections: "100" primary: affinity: # Require PostgreSQL pod to run on a different node than Artifactory pods diff --git a/stable/artifactory/sizing/artifactory-xlarge-extra-config.yaml b/stable/artifactory/sizing/artifactory-xlarge-extra-config.yaml index 9589afc24..00e6099f2 100644 --- a/stable/artifactory/sizing/artifactory-xlarge-extra-config.yaml +++ b/stable/artifactory/sizing/artifactory-xlarge-extra-config.yaml @@ -28,7 +28,10 @@ access: tomcat: connector: maxThreads: 150 - + javaOpts: + other: > + -XX:InitialRAMPercentage=20 + -XX:MaxRAMPercentage=60 database: maxOpenConnections: 150 diff --git a/stable/artifactory/sizing/artifactory-xlarge.yaml b/stable/artifactory/sizing/artifactory-xlarge.yaml index 002d9891c..e77152ee1 100644 --- a/stable/artifactory/sizing/artifactory-xlarge.yaml +++ b/stable/artifactory/sizing/artifactory-xlarge.yaml @@ -28,6 +28,15 @@ artifactory: - name: SKIP_WAIT_FOR_EXTERNAL_DB value: "true" +access: + resources: + requests: + cpu: 500m + memory: 2Gi + limits: + # cpu: 1 + memory: 3Gi + router: resources: requests: @@ -95,7 +104,7 @@ nginx: postgresql: postgresqlExtendedConf: - maxConnections: "2500" + maxConnections: "2000" primary: affinity: # Require PostgreSQL pod to run on a different node than Artifactory pods diff --git a/stable/artifactory/sizing/artifactory-xsmall-extra-config.yaml b/stable/artifactory/sizing/artifactory-xsmall-extra-config.yaml index 874ee8391..39709b691 100644 --- a/stable/artifactory/sizing/artifactory-xsmall-extra-config.yaml +++ b/stable/artifactory/sizing/artifactory-xsmall-extra-config.yaml @@ -29,7 +29,10 @@ access: tomcat: connector: maxThreads: 15 - + javaOpts: + other: > + -XX:InitialRAMPercentage=20 + -XX:MaxRAMPercentage=60 database: maxOpenConnections: 15 diff --git a/stable/artifactory/sizing/artifactory-xsmall.yaml b/stable/artifactory/sizing/artifactory-xsmall.yaml index 213cbb42c..246f830a0 100644 --- a/stable/artifactory/sizing/artifactory-xsmall.yaml +++ b/stable/artifactory/sizing/artifactory-xsmall.yaml @@ -23,11 +23,18 @@ artifactory: extraEnvironmentVariables: - name: MALLOC_ARENA_MAX value: "2" - - name : JF_SHARED_NODE_HAENABLED - value: "true" - name: SKIP_WAIT_FOR_EXTERNAL_DB value: "true" +access: + resources: + requests: + cpu: 500m + memory: 1.5Gi + limits: + # cpu: 1 + memory: 2Gi + router: resources: requests: @@ -95,7 +102,7 @@ nginx: postgresql: postgresqlExtendedConf: - maxConnections: "100" + maxConnections: "50" primary: affinity: # Require PostgreSQL pod to run on a different node than Artifactory pods diff --git a/stable/artifactory/templates/NOTES.txt b/stable/artifactory/templates/NOTES.txt index d8d5283f2..76652ac98 100644 --- a/stable/artifactory/templates/NOTES.txt +++ b/stable/artifactory/templates/NOTES.txt @@ -97,3 +97,10 @@ sudo sh -c "echo \"${SERVICE_IP} {{ template "artifactory.fullname" . }}\" >> 3. Launch jconsole: jconsole {{ template "artifactory.fullname" . }}:{{ .Values.artifactory.javaOpts.jmx.port }} {{- end }} + +{{- if and .Values.nginx.enabled .Values.ingress.hosts }} +***************************************** WARNING ***************************************************************************** +* when nginx is enabled , .Values.ingress.hosts will be deprecated in upcoming releases * +* It is recommended to use nginx.hosts instead ingress.hosts +******************************************************************************************************************************* +{{- end }} \ No newline at end of file diff --git a/stable/artifactory/templates/_helpers.tpl b/stable/artifactory/templates/_helpers.tpl index 9aa1940d9..7cea041f7 100644 --- a/stable/artifactory/templates/_helpers.tpl +++ b/stable/artifactory/templates/_helpers.tpl @@ -301,6 +301,9 @@ Resolve requiredServiceTypes value {{- if .Values.jfconnect.enabled -}} {{- $requiredTypes = printf "%s,%s" $requiredTypes "jfcon" -}} {{- end -}} +{{- if .Values.evidence.enabled -}} + {{- $requiredTypes = printf "%s,%s" $requiredTypes "jfevd" -}} +{{- end -}} {{- if .Values.mc.enabled -}} {{- $requiredTypes = printf "%s,%s" $requiredTypes "jfmc" -}} {{- end -}} @@ -456,6 +459,15 @@ Calculate the systemYaml from the unstructured text input {{ include (print $.Template.BasePath "/_system-yaml-render.tpl") . }} {{- end -}} +{{/* +Metrics enabled +*/}} +{{- define "metrics.enabled" -}} +shared: + metrics: + enabled: true +{{- end }} + {{/* Resolve unified secret prepend release name */}} @@ -466,3 +478,51 @@ Resolve unified secret prepend release name {{- printf "%s" (include "artifactory.name" .) -}} {{- end }} {{- end }} + +{{/* +Resolve artifactory metrics +*/}} +{{- define "artifactory.metrics" -}} +{{- if .Values.artifactory.openMetrics -}} +{{- if .Values.artifactory.openMetrics.enabled -}} +{{ include "metrics.enabled" . }} +{{- if .Values.artifactory.openMetrics.filebeat }} +{{- if .Values.artifactory.openMetrics.filebeat.enabled }} +{{ include "metrics.enabled" . }} + filebeat: +{{ tpl (.Values.artifactory.openMetrics.filebeat | toYaml) . | indent 6 }} +{{- end -}} +{{- end -}} +{{- end -}} +{{- else if .Values.artifactory.metrics -}} +{{- if .Values.artifactory.metrics.enabled -}} +{{ include "metrics.enabled" . }} +{{- if .Values.artifactory.metrics.filebeat }} +{{- if .Values.artifactory.metrics.filebeat.enabled }} +{{ include "metrics.enabled" . }} + filebeat: +{{ tpl (.Values.artifactory.metrics.filebeat | toYaml) . | indent 6 }} +{{- end -}} +{{- end -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Resolve nginx hosts value +*/}} +{{- define "artifactory.nginx.hosts" -}} +{{- if .Values.ingress.hosts }} +{{- range .Values.ingress.hosts -}} + {{- if contains "." . -}} + {{ "" | indent 0 }} ~(?.+)\.{{ . }} + {{- end -}} +{{- end -}} +{{- else if .Values.nginx.hosts }} +{{- range .Values.nginx.hosts -}} + {{- if contains "." . -}} + {{ "" | indent 0 }} ~(?.+)\.{{ . }} + {{- end -}} +{{- end -}} +{{- end -}} +{{- end -}} \ No newline at end of file diff --git a/stable/artifactory/templates/artifactory-license-secret.yaml b/stable/artifactory/templates/artifactory-license-secret.yaml index dda734033..ba83aaf24 100644 --- a/stable/artifactory/templates/artifactory-license-secret.yaml +++ b/stable/artifactory/templates/artifactory-license-secret.yaml @@ -1,4 +1,4 @@ -{{ if and (not .Values.artifactory.unifiedSecretInstallation) (not .Values.artifactory.license.secret) }} +{{ if and (not .Values.artifactory.unifiedSecretInstallation) (not .Values.artifactory.license.secret) (not .Values.artifactory.license.licenseKey) }} {{- with .Values.artifactory.license.licenseKey }} apiVersion: v1 kind: Secret diff --git a/stable/artifactory/templates/artifactory-statefulset.yaml b/stable/artifactory/templates/artifactory-statefulset.yaml index 73fdb7df7..c149d86d6 100644 --- a/stable/artifactory/templates/artifactory-statefulset.yaml +++ b/stable/artifactory/templates/artifactory-statefulset.yaml @@ -589,6 +589,100 @@ spec: {{- if .Values.frontend.livenessProbe.enabled }} livenessProbe: {{ tpl .Values.frontend.livenessProbe.config . | indent 10 }} + {{- end }} + {{- end }} + {{- if .Values.evidence.enabled }} + - name: {{ .Values.evidence.name }} + image: {{ include "artifactory.getImageInfoByValue" (list . "artifactory") }} + imagePullPolicy: {{ .Values.artifactory.image.pullPolicy }} + {{- if .Values.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.containerSecurityContext "enabled" | toYaml | nindent 10 }} + {{- end }} + command: + - '/bin/bash' + - '-c' + - > + exec /opt/jfrog/artifactory/app/evidence/bin/jf-evidence start + {{- with .Values.evidence.lifecycle }} + lifecycle: +{{ toYaml . | indent 10 }} + {{- end }} + env: + - name: JF_SHARED_NODE_ID + valueFrom: + fieldRef: + fieldPath: metadata.name + {{- if or .Values.database.secrets.user .Values.database.user }} + - name: JF_SHARED_DATABASE_USERNAME + valueFrom: + secretKeyRef: + {{- if .Values.database.secrets.user }} + name: {{ tpl .Values.database.secrets.user.name . }} + key: {{ tpl .Values.database.secrets.user.key . }} + {{- else if .Values.database.user }} + {{- if not .Values.artifactory.unifiedSecretInstallation }} + name: {{ template "artifactory.fullname" . }}-database-creds + {{- else }} + name: "{{ template "artifactory.unifiedSecretPrependReleaseName" . }}-unified-secret" + {{- end }} + key: db-user + {{- end }} + {{- end }} + {{ if or .Values.database.secrets.password .Values.database.password .Values.postgresql.enabled }} + - name: JF_SHARED_DATABASE_PASSWORD + valueFrom: + secretKeyRef: + {{- if .Values.database.secrets.password }} + name: {{ tpl .Values.database.secrets.password.name . }} + key: {{ tpl .Values.database.secrets.password.key . }} + {{- else if .Values.database.password }} + {{- if not .Values.artifactory.unifiedSecretInstallation }} + name: {{ template "artifactory.fullname" . }}-database-creds + {{- else }} + name: "{{ template "artifactory.unifiedSecretPrependReleaseName" . }}-unified-secret" + {{- end }} + key: db-password + {{- else if .Values.postgresql.enabled }} + name: {{ .Release.Name }}-postgresql + key: postgresql-password + {{- end }} + {{- end }} + {{- if or .Values.database.secrets.url .Values.database.url }} + - name: JF_SHARED_DATABASE_URL + valueFrom: + secretKeyRef: + {{- if .Values.database.secrets.url }} + name: {{ tpl .Values.database.secrets.url.name . }} + key: {{ tpl .Values.database.secrets.url.key . }} + {{- else if .Values.database.url }} + {{- if not .Values.artifactory.unifiedSecretInstallation }} + name: {{ template "artifactory.fullname" . }}-database-creds + {{- else }} + name: "{{ template "artifactory.unifiedSecretPrependReleaseName" . }}-unified-secret" + {{- end }} + key: db-url + {{- end }} + {{- end }} +{{- with .Values.evidence.extraEnvironmentVariables }} +{{ tpl (toYaml .) $ | indent 8 }} +{{- end }} + ports: + - containerPort: {{ .Values.evidence.internalPort }} + name: http-evidence + - containerPort: {{ .Values.evidence.externalPort }} + name: grpc-evidence + volumeMounts: + - name: artifactory-volume + mountPath: {{ .Values.artifactory.persistence.mountPath | quote }} + resources: +{{ toYaml .Values.evidence.resources | indent 10 }} + {{- if .Values.evidence.startupProbe.enabled }} + startupProbe: +{{ tpl .Values.evidence.startupProbe.config . | indent 10 }} + {{- end }} + {{- if .Values.evidence.livenessProbe.enabled }} + livenessProbe: +{{ tpl .Values.evidence.livenessProbe.config . | indent 10 }} {{- end }} {{- end }} {{- if .Values.metadata.enabled }} @@ -759,6 +853,139 @@ spec: {{ tpl .Values.jfconnect.livenessProbe.config . | indent 10 }} {{- end }} {{- end }} + {{- if and .Values.access.enabled (not (.Values.access.runOnArtifactoryTomcat | default false)) }} + - name: {{ .Values.access.name }} + image: {{ include "artifactory.getImageInfoByValue" (list . "artifactory") }} + imagePullPolicy: {{ .Values.artifactory.image.pullPolicy }} + {{- if .Values.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.containerSecurityContext "enabled" | toYaml | nindent 10 }} + {{- end }} + {{- if .Values.access.resources }} + resources: +{{ toYaml .Values.access.resources | indent 10 }} + {{- end }} + command: + - '/bin/bash' + - '-c' + - > + set -e; + {{- if .Values.access.preStartCommand }} + echo "Running custom preStartCommand command"; + {{ tpl .Values.access.preStartCommand . }}; + {{- end }} + exec /opt/jfrog/artifactory/app/access/bin/entrypoint-access.sh + {{- with .Values.access.lifecycle }} + lifecycle: +{{ toYaml . | indent 10 }} + {{- end }} + env: + {{- if and (gt (.Values.artifactory.replicaCount | int64) 1) (eq (include "artifactory.isImageProType" .) "true") (eq (include "artifactory.isUsingDerby" .) "false") }} + - name : JF_SHARED_NODE_HAENABLED + value: "true" + {{- end }} + {{- if and (not .Values.waitForDatabase) (not .Values.postgresql.enabled) }} + - name: SKIP_WAIT_FOR_EXTERNAL_DB + value: "true" + {{- end }} + {{- if or .Values.database.secrets.user .Values.database.user }} + - name: JF_SHARED_DATABASE_USERNAME + valueFrom: + secretKeyRef: + {{- if .Values.database.secrets.user }} + name: {{ tpl .Values.database.secrets.user.name . }} + key: {{ tpl .Values.database.secrets.user.key . }} + {{- else if .Values.database.user }} + {{- if not .Values.artifactory.unifiedSecretInstallation }} + name: {{ template "artifactory.fullname" . }}-database-creds + {{- else }} + name: "{{ template "artifactory.unifiedSecretPrependReleaseName" . }}-unified-secret" + {{- end }} + key: db-user + {{- end }} + {{- end }} + {{ if or .Values.database.secrets.password .Values.database.password .Values.postgresql.enabled }} + - name: JF_SHARED_DATABASE_PASSWORD + valueFrom: + secretKeyRef: + {{- if .Values.database.secrets.password }} + name: {{ tpl .Values.database.secrets.password.name . }} + key: {{ tpl .Values.database.secrets.password.key . }} + {{- else if .Values.database.password }} + {{- if not .Values.artifactory.unifiedSecretInstallation }} + name: {{ template "artifactory.fullname" . }}-database-creds + {{- else }} + name: "{{ template "artifactory.unifiedSecretPrependReleaseName" . }}-unified-secret" + {{- end }} + key: db-password + {{- else if .Values.postgresql.enabled }} + name: {{ .Release.Name }}-postgresql + key: postgresql-password + {{- end }} + {{- end }} + {{- if or .Values.database.secrets.url .Values.database.url }} + - name: JF_SHARED_DATABASE_URL + valueFrom: + secretKeyRef: + {{- if .Values.database.secrets.url }} + name: {{ tpl .Values.database.secrets.url.name . }} + key: {{ tpl .Values.database.secrets.url.key . }} + {{- else if .Values.database.url }} + {{- if not .Values.artifactory.unifiedSecretInstallation }} + name: {{ template "artifactory.fullname" . }}-database-creds + {{- else }} + name: "{{ template "artifactory.unifiedSecretPrependReleaseName" . }}-unified-secret" + {{- end }} + key: db-url + {{- end }} + {{- end }} +{{- with .Values.access.extraEnvironmentVariables }} +{{ tpl (toYaml .) $ | indent 8 }} +{{- end }} + volumeMounts: + {{- if .Values.artifactory.customPersistentVolumeClaim }} + - name: {{ .Values.artifactory.customPersistentVolumeClaim.name }} + mountPath: {{ .Values.artifactory.customPersistentVolumeClaim.mountPath }} + {{- end }} + - name: artifactory-volume + mountPath: {{ .Values.artifactory.persistence.mountPath | quote }} + + ######################## Artifactory persistence nfs ########################## + {{- if eq .Values.artifactory.persistence.type "nfs" }} + - name: artifactory-data + mountPath: "{{ .Values.artifactory.persistence.nfs.dataDir }}" + - name: artifactory-backup + mountPath: "{{ .Values.artifactory.persistence.nfs.backupDir }}" + {{- else }} + + ######################## Artifactory persistence googleStorage ########################## + {{- if .Values.artifactory.persistence.googleStorage.gcpServiceAccount.enabled }} + {{- if or (not .Values.artifactory.unifiedSecretInstallation) .Values.artifactory.persistence.googleStorage.gcpServiceAccount.customSecretName }} + - name: gcpcreds-json + {{- else }} + - name: {{ include "artifactory.unifiedCustomSecretVolumeName" . }} + {{- end }} + mountPath: "/artifactory_bootstrap/gcp.credentials.json" + subPath: gcp.credentials.json + {{- end }} + {{- end }} + {{- if or .Values.artifactory.customVolumeMounts .Values.global.customVolumeMounts }} +{{ tpl (include "artifactory.customVolumeMounts" .) . | indent 8 }} + {{- end }} + {{- if .Values.access.startupProbe.enabled }} + startupProbe: +{{ tpl .Values.access.startupProbe.config . | indent 10 }} + {{- end }} + {{- if semverCompare " prepended. unifiedSecretPrependReleaseName: true - # For HA installation, set this value > 1. This is only supported in Artifactory 7.25.x (appVersions) and above. + ## For HA installation, set this value > 1. This is only supported in Artifactory 7.25.x (appVersions) and above. replicaCount: 1 # minAvailable: 1 - # Note that by default we use appVersion to get image tag/version + ## Note that by default we use appVersion to get image tag/version image: registry: releases-docker.jfrog.io repository: jfrog/artifactory-pro @@ -304,8 +299,8 @@ artifactory: type: RollingUpdate ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ schedulerName: - # Create a priority class for the Artifactory pod or use an existing one - # NOTE - Maximum allowed value of a user defined priority is 1000000000 + ## Create a priority class for the Artifactory pod or use an existing one + ## NOTE - Maximum allowed value of a user defined priority is 1000000000 priorityClass: create: false value: 1000000000 @@ -313,7 +308,7 @@ artifactory: # name: ## Use an existing priority class # existingPriorityClass: - # Spread Artifactory pods evenly across your nodes or some other topology + ## Spread Artifactory pods evenly across your nodes or some other topology topologySpreadConstraints: [] # - maxSkew: 1 # topologyKey: kubernetes.io/hostname @@ -324,9 +319,9 @@ artifactory: # role: '{{ template "artifactory.name" . }}' # release: "{{ .Release.Name }}" - # Delete the db.properties file in ARTIFACTORY_HOME/etc/db.properties + ## Delete the db.properties file in ARTIFACTORY_HOME/etc/db.properties deleteDBPropertiesOnStartup: true - # certificates added to this secret will be copied to $JFROG_HOME/artifactory/var/etc/security/keys/trusted directory + ## certificates added to this secret will be copied to $JFROG_HOME/artifactory/var/etc/security/keys/trusted directory customCertificates: enabled: false # certificateSecretName: @@ -339,10 +334,11 @@ artifactory: maxThreads: 200 sendReasonPhrase: false extraConfig: 'acceptCount="400"' - # Support for open metrics is only available for Artifactory 7.7.x (appVersions) and above. - # To enable set `.Values.artifactory.openMetrics.enabled` to `true` - # Refer - https://www.jfrog.com/confluence/display/JFROG/Open+Metrics - openMetrics: + ## Support for metrics is only available for Artifactory 7.7.x (appVersions) and above. + ## To enable set `.Values.artifactory.metrics.enabled` to `true` + ## Note : Depricated openMetrics as part of 7.87.x and renamed to `metrics` + ## Refer - https://www.jfrog.com/confluence/display/JFROG/Open+Metrics + metrics: enabled: false ## Settings for pushing metrics to Insight - enable filebeat to true filebeat: @@ -356,27 +352,27 @@ artifactory: url: "Elasticsearch url where JFrog Insight is installed For example, http://:8082" username: "" password: "" - # Support for Cold Artifact Storage - # set 'coldStorage.enabled' to 'true' only for Artifactory instance that you are designating as the Cold instance - # Refer - https://jfrog.com/help/r/jfrog-platform-administration-documentation/setting-up-cold-artifact-storage + ## Support for Cold Artifact Storage + ## set 'coldStorage.enabled' to 'true' only for Artifactory instance that you are designating as the Cold instance + ## Refer - https://jfrog.com/help/r/jfrog-platform-administration-documentation/setting-up-cold-artifact-storage coldStorage: enabled: false - # This directory is intended for use with NFS eventual configuration for HA + ## This directory is intended for use with NFS eventual configuration for HA haDataDir: enabled: false path: haBackupDir: enabled: false path: - # Files to copy to ARTIFACTORY_HOME/ on each Artifactory startup - # Note : From 107.46.x chart versions, copyOnEveryStartup is not needed for binarystore.xml, it is always copied via initContainers + ## Files to copy to ARTIFACTORY_HOME/ on each Artifactory startup + ## Note : From 107.46.x chart versions, copyOnEveryStartup is not needed for binarystore.xml, it is always copied via initContainers copyOnEveryStartup: - # # Absolute path - # - source: /artifactory_bootstrap/artifactory.lic - # # Relative to ARTIFACTORY_HOME/ - # target: etc/artifactory/ + ## Absolute path + # - source: /artifactory_bootstrap/artifactory.lic + ## Relative to ARTIFACTORY_HOME/ + # target: etc/artifactory/ - # Sidecar containers for tailing Artifactory logs + ## Sidecar containers for tailing Artifactory logs loggers: [] # - access-audit.log # - access-request.log @@ -396,130 +392,125 @@ artifactory: # - router-traefik.log # - derby.log - # Loggers containers resources + ## Loggers containers resources loggersResources: {} - # requests: - # memory: "10Mi" - # cpu: "10m" - # limits: - # memory: "100Mi" - # cpu: "50m" - - # Sidecar containers for tailing Tomcat (catalina) logs + # requests: + # memory: "10Mi" + # cpu: "10m" + # limits: + # memory: "100Mi" + # cpu: "50m" + + ## Sidecar containers for tailing Tomcat (catalina) logs catalinaLoggers: [] # - tomcat-catalina.log # - tomcat-localhost.log - # Tomcat (catalina) loggers resources + ## Tomcat (catalina) loggers resources catalinaLoggersResources: {} - # requests: - # memory: "10Mi" - # cpu: "10m" - # limits: - # memory: "100Mi" - # cpu: "50m" - - # Migration support from 6.x to 7.x + # requests: + # memory: "10Mi" + # cpu: "10m" + # limits: + # memory: "100Mi" + # cpu: "50m" + + ## Migration support from 6.x to 7.x migration: - enabled: true + enabled: false timeoutSeconds: 3600 ## Extra pre-start command in migration Init Container to install JDBC driver for MySql/MariaDb/Oracle - # preStartCommand: "mkdir -p /opt/jfrog/artifactory/var/bootstrap/artifactory/tomcat/lib; cd /opt/jfrog/artifactory/var/bootstrap/artifactory/tomcat/lib && curl -o /opt/jfrog/artifactory/var/bootstrap/artifactory/tomcat/lib/mysql-connector-java-5.1.41.jar https://jcenter.bintray.com/mysql/mysql-connector-java/5.1.41/mysql-connector-java-5.1.41.jar" + # preStartCommand: "mkdir -p /opt/jfrog/artifactory/var/bootstrap/artifactory/tomcat/lib; cd /opt/jfrog/artifactory/var/bootstrap/artifactory/tomcat/lib && curl -o /opt/jfrog/artifactory/var/bootstrap/artifactory/tomcat/lib/mysql-connector-java-5.1.41.jar https://repo1.maven.org/maven2/mysql/mysql-connector-java/5.1.41/mysql-connector-java-5.1.41.jar" ## Add custom init containers execution before predefined init containers - customInitContainersBegin: "" - # - name: "custom-setup" - # image: {{ include "artifactory.getImageInfoByValue" (list . "initContainers") }} - # imagePullPolicy: {{ .Values.initContainers.image.pullPolicy }} - # securityContext: - # runAsNonRoot: true - # allowPrivilegeEscalation: false - # capabilities: - # drop: - # - NET_RAW - # command: - # - 'sh' - # - '-c' - # - 'touch {{ .Values.artifactory.persistence.mountPath }}/example-custom-setup' - # volumeMounts: - # - mountPath: "{{ .Values.artifactory.persistence.mountPath }}" - # name: artifactory-volume - + customInitContainersBegin: | + # - name: "custom-setup" + # image: {{ include "artifactory.getImageInfoByValue" (list . "initContainers") }} + # imagePullPolicy: {{ .Values.initContainers.image.pullPolicy }} + # securityContext: + # runAsNonRoot: true + # allowPrivilegeEscalation: false + # capabilities: + # drop: + # - NET_RAW + # command: + # - 'sh' + # - '-c' + # - 'touch {{ .Values.artifactory.persistence.mountPath }}/example-custom-setup' + # volumeMounts: + # - mountPath: "{{ .Values.artifactory.persistence.mountPath }}" + # name: artifactory-volume ## Add custom init containers execution after predefined init containers - customInitContainers: "" - # - name: "custom-systemyaml-setup" - # image: {{ include "artifactory.getImageInfoByValue" (list . "initContainers") }} - # imagePullPolicy: {{ .Values.initContainers.image.pullPolicy }} - # securityContext: - # runAsNonRoot: true - # allowPrivilegeEscalation: false - # capabilities: - # drop: - # - NET_RAW - # command: - # - 'sh' - # - '-c' - # - 'curl -o {{ .Values.artifactory.persistence.mountPath }}/etc/system.yaml https:///systemyaml' - # volumeMounts: - # - mountPath: "{{ .Values.artifactory.persistence.mountPath }}" - # name: artifactory-volume - + customInitContainers: | + # - name: "custom-systemyaml-setup" + # image: {{ include "artifactory.getImageInfoByValue" (list . "initContainers") }} + # imagePullPolicy: {{ .Values.initContainers.image.pullPolicy }} + # securityContext: + # runAsNonRoot: true + # allowPrivilegeEscalation: false + # capabilities: + # drop: + # - NET_RAW + # command: + # - 'sh' + # - '-c' + # - 'curl -o {{ .Values.artifactory.persistence.mountPath }}/etc/system.yaml https:///systemyaml' + # volumeMounts: + # - mountPath: "{{ .Values.artifactory.persistence.mountPath }}" + # name: artifactory-volume ## Add custom sidecar containers - # - The provided example uses a custom volume (customVolumes) - customSidecarContainers: "" - # - name: "sidecar-list-etc" - # image: {{ include "artifactory.getImageInfoByValue" (list . "initContainers") }} - # imagePullPolicy: {{ .Values.initContainers.image.pullPolicy }} - # securityContext: - # runAsNonRoot: true - # allowPrivilegeEscalation: false - # capabilities: - # drop: - # - NET_RAW - # command: - # - 'sh' - # - '-c' - # - 'sh /scripts/script.sh' - # volumeMounts: - # - mountPath: "{{ .Values.artifactory.persistence.mountPath }}" - # name: artifactory-volume - # - mountPath: "/scripts/script.sh" - # name: custom-script - # subPath: script.sh - # resources: - # requests: - # memory: "32Mi" - # cpu: "50m" - # limits: - # memory: "128Mi" - # cpu: "100m" - + ## - The provided example uses a custom volume (customVolumes) + customSidecarContainers: | + # - name: "sidecar-list-etc" + # image: {{ include "artifactory.getImageInfoByValue" (list . "initContainers") }} + # imagePullPolicy: {{ .Values.initContainers.image.pullPolicy }} + # securityContext: + # runAsNonRoot: true + # allowPrivilegeEscalation: false + # capabilities: + # drop: + # - NET_RAW + # command: + # - 'sh' + # - '-c' + # - 'sh /scripts/script.sh' + # volumeMounts: + # - mountPath: "{{ .Values.artifactory.persistence.mountPath }}" + # name: artifactory-volume + # - mountPath: "/scripts/script.sh" + # name: custom-script + # subPath: script.sh + # resources: + # requests: + # memory: "32Mi" + # cpu: "50m" + # limits: + # memory: "128Mi" + # cpu: "100m" ## Add custom volumes - # If .Values.artifactory.unifiedSecretInstallation is true then secret name should be '{{ template "artifactory.unifiedSecretPrependReleaseName" . }}-unified-secret' - customVolumes: "" - # - name: custom-script - # configMap: - # name: custom-script - + ## If .Values.artifactory.unifiedSecretInstallation is true then secret name should be '{{ template "artifactory.unifiedSecretPrependReleaseName" . }}-unified-secret' + customVolumes: | + # - name: custom-script + # configMap: + # name: custom-script ## Add custom volumesMounts - customVolumeMounts: "" - # - name: custom-script - # mountPath: "/scripts/script.sh" - # subPath: script.sh - # - name: posthook-start - # mountPath: "/scripts/posthoook-start.sh" - # subPath: posthoook-start.sh - # - name: prehook-start - # mountPath: "/scripts/prehook-start.sh" - # subPath: prehook-start.sh - - # Add custom persistent volume mounts - Available to the entire namespace + customVolumeMounts: | + # - name: custom-script + # mountPath: "/scripts/script.sh" + # subPath: script.sh + # - name: posthook-start + # mountPath: "/scripts/posthoook-start.sh" + # subPath: posthoook-start.sh + # - name: prehook-start + # mountPath: "/scripts/prehook-start.sh" + # subPath: prehook-start.sh + ## Add custom persistent volume mounts - Available to the entire namespace customPersistentVolumeClaim: {} - # name: - # mountPath: - # accessModes: + # name: + # mountPath: + # accessModes: # - "-" - # size: - # storageClassName: + # size: + # storageClassName: ## Artifactory license. license: @@ -532,20 +523,19 @@ artifactory: dataKey: ## Create configMap with artifactory.config.import.xml and security.import.xml and pass name of configMap in following parameter configMapName: - # Add any list of configmaps to Artifactory - configMaps: "" - # posthook-start.sh: |- - # echo "This is a post start script" - # posthook-end.sh: |- - # echo "This is a post end script" - + ## Add any list of configmaps to Artifactory + configMaps: | + # posthook-start.sh: |- + # echo "This is a post start script" + # posthook-end.sh: |- + # echo "This is a post end script" ## List of secrets for Artifactory user plugins. ## One Secret per plugin's files. userPluginSecrets: - # - archive-old-artifacts - # - build-cleanup - # - webhook - # - '{{ template "my-chart.fullname" . }}' + # - archive-old-artifacts + # - build-cleanup + # - webhook + # - '{{ template "my-chart.fullname" . }}' ## Artifactory requires a unique master key. ## You can generate one with the command: "openssl rand -hex 32" @@ -566,8 +556,8 @@ artifactory: ## Alternatively, you can use a pre-existing secret with a key called jfconnect-token by specifying jfConnectTokenSecretName # jfConnectTokenSecretName: - # Add custom secrets - secret per file - # If .Values.artifactory.unifiedSecretInstallation is true then secret name should be '{{ template "artifactory.unifiedSecretPrependReleaseName" . }}-unified-secret' common to all secrets + ## Add custom secrets - secret per file + ## If .Values.artifactory.unifiedSecretInstallation is true then secret name should be '{{ template "artifactory.unifiedSecretPrependReleaseName" . }}-unified-secret' common to all secrets customSecrets: # - name: custom-secret # key: custom-secret.yaml @@ -591,9 +581,9 @@ artifactory: secret: dataKey: ## Extra pre-start command to install JDBC driver for MySql/MariaDb/Oracle - # preStartCommand: "mkdir -p /opt/jfrog/artifactory/var/bootstrap/artifactory/tomcat/lib; cd /opt/jfrog/artifactory/var/bootstrap/artifactory/tomcat/lib && curl -o /opt/jfrog/artifactory/var/bootstrap/artifactory/tomcat/lib/mysql-connector-java-5.1.41.jar https://jcenter.bintray.com/mysql/mysql-connector-java/5.1.41/mysql-connector-java-5.1.41.jar" + # preStartCommand: "mkdir -p /opt/jfrog/artifactory/var/bootstrap/artifactory/tomcat/lib; cd /opt/jfrog/artifactory/var/bootstrap/artifactory/tomcat/lib && curl -o /opt/jfrog/artifactory/var/bootstrap/artifactory/tomcat/lib/mysql-connector-java-5.1.41.jar https://repo1.maven.org/maven2/mysql/mysql-connector-java/5.1.41/mysql-connector-java-5.1.41.jar" - # Add lifecycle hooks for artifactory container + ## Add lifecycle hooks for artifactory container lifecycle: {} # postStart: # exec: @@ -758,15 +748,15 @@ artifactory: ## nfs ## google-storage ## google-storage-v2 - ## google-storage-v2-direct + ## google-storage-v2-direct (Recommended for GCS - Google Cloud Storage) ## cluster-google-storage-v2 ## aws-s3-v3 - ## s3-storage-v3-direct + ## s3-storage-v3-direct (Recommended for AWS S3) ## cluster-s3-storage-v3 ## s3-storage-v3-archive ## azure-blob ## azure-blob-storage-direct - ## azure-blob-storage-v2-direct + ## azure-blob-storage-v2-direct (Recommended for Azure Blob Storage) ## cluster-azure-blob-storage type: file-system ## Use binarystoreXml to provide a custom binarystore.xml @@ -778,7 +768,7 @@ artifactory: ## cluster nodes. ## Need to have the following set nfs: - # Must pass actual IP of NFS server with '--set For artifactory.persistence.nfs.ip=${NFS_IP}' + ## Must pass actual IP of NFS server with '--set For artifactory.persistence.nfs.ip=${NFS_IP}' ip: haDataMount: "/data" haBackupMount: "/backup" @@ -812,7 +802,7 @@ artifactory: # } endpoint: commondatastorage.googleapis.com httpsOnly: false - # Set a unique bucket name + ## Set a unique bucket name bucketName: "artifactory-gcp" ## GCP Bucket Authentication with Identity and Credential is deprecated. ## identity: @@ -871,12 +861,12 @@ artifactory: ## Uncomment the following resources definitions or pass them from command line ## to control the cpu and memory resources allocated by the Kubernetes cluster resources: {} - # requests: - # memory: "1Gi" - # cpu: "500m" - # limits: - # memory: "2Gi" - # cpu: "1" + # requests: + # memory: "1Gi" + # cpu: "500m" + # limits: + # memory: "2Gi" + # cpu: "1" ## The following Java options are passed to the java process running Artifactory. ## You should set them according to the resources set above javaOpts: @@ -887,13 +877,12 @@ artifactory: port: 9010 host: ssl: false - # When authenticate is true, accessFile and passwordFile are required + ## When authenticate is true, accessFile and passwordFile are required authenticate: false accessFile: passwordFile: # corePoolSize: 24 - # other: "" - + # other: "" nodeSelector: {} tolerations: [] affinity: {} @@ -916,14 +905,14 @@ frontend: # - name: MY_ENV_VAR # value: "" resources: {} - # requests: - # memory: "100Mi" - # cpu: "100m" - # limits: - # memory: "1Gi" - # cpu: "1" - - # Add lifecycle hooks for frontend container + # requests: + # memory: "100Mi" + # cpu: "100m" + # limits: + # memory: "1Gi" + # cpu: "1" + + ## Add lifecycle hooks for frontend container lifecycle: {} # postStart: # exec: @@ -963,6 +952,7 @@ frontend: periodSeconds: 5 timeoutSeconds: {{ .Values.probes.timeoutSeconds }} access: + name: access enabled: true ## Enable TLS by changing the tls entry (under the security section) in the access.config.yaml file. ## ref: https://www.jfrog.com/confluence/display/JFROG/Managing+TLS+Certificates#ManagingTLSCertificates @@ -984,6 +974,67 @@ access: maxThreads: 50 sendReasonPhrase: false extraConfig: 'acceptCount="100"' + livenessProbe: + enabled: true + config: | + exec: + command: + - sh + - -c + - curl --fail --max-time {{ .Values.probes.timeoutSeconds }} http://localhost:8040/access/api/v1/system/liveness + initialDelaySeconds: {{ if semverCompare ".+)\.{{ include "artifactory.fullname" . }} {{ include "artifactory.fullname" . }} - {{- range .Values.ingress.hosts -}} - {{- if contains "." . -}} - {{ "" | indent 0 }} ~(?.+)\.{{ . }} - {{- end -}} - {{- end -}}; - - if ($http_x_forwarded_proto = '') { - set $http_x_forwarded_proto $scheme; - } - set $host_port {{ .Values.nginx.https.externalPort }}; - if ( $scheme = "http" ) { - set $host_port {{ .Values.nginx.http.externalPort }}; - } - ## Application specific logs - ## access_log /var/log/nginx/artifactory-access.log timing; - ## error_log /var/log/nginx/artifactory-error.log; - rewrite ^/artifactory/?$ / redirect; - if ( $repo != "" ) { - rewrite ^/(v1|v2)/(.*) /artifactory/api/docker/$repo/$1/$2 break; - } - chunked_transfer_encoding on; - client_max_body_size 0; - - location / { - proxy_read_timeout 900; - proxy_pass_header Server; - proxy_cookie_path ~*^/.* /; - proxy_pass {{ include "artifactory.scheme" . }}://{{ include "artifactory.fullname" . }}:{{ .Values.artifactory.externalPort }}/; - {{- if .Values.nginx.service.ssloffload}} - proxy_set_header X-JFrog-Override-Base-Url $http_x_forwarded_proto://$host; - {{- else }} - proxy_set_header X-JFrog-Override-Base-Url $http_x_forwarded_proto://$host:$host_port; - proxy_set_header X-Forwarded-Port $server_port; - {{- end }} - proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto; - proxy_set_header Host $http_host; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - {{- if .Values.nginx.disableProxyBuffering}} - proxy_http_version 1.1; - proxy_request_buffering off; - proxy_buffering off; - {{- end }} - add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; - location /artifactory/ { - if ( $request_uri ~ ^/artifactory/(.*)$ ) { - proxy_pass http://{{ include "artifactory.fullname" . }}:{{ .Values.artifactory.externalArtifactoryPort }}/artifactory/$1; - } - proxy_pass http://{{ include "artifactory.fullname" . }}:{{ .Values.artifactory.externalArtifactoryPort }}/artifactory/; - } - location /pipelines/ { - proxy_http_version 1.1; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection "upgrade"; - proxy_set_header Host $http_host; - {{- if .Values.router.tlsEnabled }} - proxy_pass https://{{ include "artifactory.fullname" . }}:{{ .Values.router.internalPort }}; - {{- else }} - proxy_pass http://{{ include "artifactory.fullname" . }}:{{ .Values.router.internalPort }}; - {{- end }} - } - } - } + ## The nginx artifactory conf was moved to files/nginx-artifactory-conf.yaml. This key is commented out to keep support for the old configuration + # artifactoryConf: | customInitContainers: "" customSidecarContainers: "" customVolumes: "" @@ -1575,7 +1497,7 @@ nginx: annotations: {} ## Provide static ip address loadBalancerIP: - ## There are two available options: “Cluster” (default) and “Local”. + ## There are two available options: "Cluster" (default) and "Local". externalTrafficPolicy: Cluster ## If the type is NodePort you can set a fixed port # nodePort: 32082 @@ -1597,7 +1519,7 @@ nginx: ssh: internalPort: 1339 externalPort: 1339 - # DEPRECATED: The following will be removed in a future release + ## DEPRECATED: The following will be removed in a future release # externalPortHttp: 8080 # internalPortHttp: 8080 # externalPortHttps: 8443 @@ -1667,12 +1589,12 @@ nginx: ## # storageClassName: "-" resources: {} - # requests: - # memory: "250Mi" - # cpu: "100m" - # limits: - # memory: "250Mi" - # cpu: "500m" + # requests: + # memory: "250Mi" + # cpu: "100m" + # limits: + # memory: "250Mi" + # cpu: "500m" nodeSelector: {} tolerations: [] affinity: {} @@ -1712,12 +1634,12 @@ postgresql: enabled: true containerSecurityContext: enabled: true - # requests: - # memory: "512Mi" - # cpu: "100m" - # limits: - # memory: "1Gi" - # cpu: "500m" + # requests: + # memory: "512Mi" + # cpu: "100m" + # limits: + # memory: "1Gi" + # cpu: "500m" ## If NOT using the PostgreSQL in this chart (postgresql.enabled=false), ## specify custom database details here or leave empty and Artifactory will use embedded derby database: @@ -1734,16 +1656,16 @@ database: ## If you have existing Kubernetes secrets containing db credentials, use ## these values secrets: {} - # user: - # name: "rds-artifactory" - # key: "db-user" - # password: - # name: "rds-artifactory" - # key: "db-password" - # url: - # name: "rds-artifactory" - # key: "db-url" -# Filebeat Sidecar container + # user: + # name: "rds-artifactory" + # key: "db-user" + # password: + # name: "rds-artifactory" + # key: "db-password" + # url: + # name: "rds-artifactory" + # key: "db-url" +## Filebeat Sidecar container ## The provided filebeat configuration is for Artifactory logs. It assumes you have a logstash installed and configured properly. filebeat: enabled: false @@ -1777,12 +1699,12 @@ filebeat: periodSeconds: 10 timeoutSeconds: 5 resources: {} - # requests: - # memory: "100Mi" - # cpu: "100m" - # limits: - # memory: "100Mi" - # cpu: "100m" + # requests: + # memory: "100Mi" + # cpu: "100m" + # limits: + # memory: "100Mi" + # cpu: "100m" filebeatYml: | logging.level: info @@ -1807,17 +1729,17 @@ filebeat: ## Use --- as a separator between multiple resources ## For an example, refer - https://github.com/jfrog/log-analytics-prometheus/blob/master/helm/artifactory-values.yaml additionalResources: "" -# Adding entries to a Pod's /etc/hosts file -# For an example, refer - https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases +## Adding entries to a Pod's /etc/hosts file +## For an example, refer - https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases hostAliases: [] -# - ip: "127.0.0.1" -# hostnames: -# - "foo.local" -# - "bar.local" -# - ip: "10.1.2.3" -# hostnames: -# - "foo.remote" -# - "bar.remote" +# - ip: "127.0.0.1" +# hostnames: +# - "foo.local" +# - "bar.local" +# - ip: "10.1.2.3" +# hostnames: +# - "foo.remote" +# - "bar.remote" ## Toggling this feature is seamless and requires helm upgrade ## will enable all microservices to run in different containers in a single pod (by default it is true) From 0c6f4458f8695d9538d9e618bc96649740498610 Mon Sep 17 00:00:00 2001 From: Ram <1331672+chukka@users.noreply.github.com> Date: Tue, 30 Jul 2024 09:43:33 +0530 Subject: [PATCH 02/30] [xray] 3.101.5 release --- stable/xray/CHANGELOG.md | 5 +- stable/xray/Chart.yaml | 4 +- stable/xray/templates/_helpers.tpl | 8 ++ stable/xray/templates/xray-statefulset.yaml | 1 + stable/xray/values.yaml | 113 ++++++++------------ 5 files changed, 61 insertions(+), 70 deletions(-) diff --git a/stable/xray/CHANGELOG.md b/stable/xray/CHANGELOG.md index e77213009..4c6025cfc 100644 --- a/stable/xray/CHANGELOG.md +++ b/stable/xray/CHANGELOG.md @@ -1,7 +1,10 @@ # JFrog Xray Chart Changelog All changes to this chart will be documented in this file. -## [103.98.5] - May 27, 2024 +## [103.101.5] - June 18, 2024 +* Fixed #adding colon in image registry breaks deployment with meta label error. [GH-1892](https://github.com/jfrog/charts/pull/1892) + +## [103.97.0] - May 27, 2024 * Added chart label to xray pods ## [103.96.0] - Apr 17, 2024 diff --git a/stable/xray/Chart.yaml b/stable/xray/Chart.yaml index 49634c023..35bb51c76 100644 --- a/stable/xray/Chart.yaml +++ b/stable/xray/Chart.yaml @@ -1,5 +1,5 @@ apiVersion: v2 -appVersion: 3.98.5 +appVersion: 3.101.5 dependencies: - condition: postgresql.enabled name: postgresql @@ -24,4 +24,4 @@ name: xray sources: - https://github.com/jfrog/charts type: application -version: 103.98.5 +version: 103.101.5 diff --git a/stable/xray/templates/_helpers.tpl b/stable/xray/templates/_helpers.tpl index c197c62f9..8a27fc05c 100644 --- a/stable/xray/templates/_helpers.tpl +++ b/stable/xray/templates/_helpers.tpl @@ -465,6 +465,14 @@ Return the proper xray chart image names {{- end -}} {{- end -}} +{{/* +Return the proper xray app version +*/}} +{{- define "xray.app.version" -}} +{{- $tag := (splitList ":" ((include "xray.getImageInfoByValue" (list . "server" )))) | last | toString -}} +{{- printf "%s" $tag -}} +{{- end -}} + {{/* Return the registry of a service */}} diff --git a/stable/xray/templates/xray-statefulset.yaml b/stable/xray/templates/xray-statefulset.yaml index bd08983a1..97e64ff7e 100644 --- a/stable/xray/templates/xray-statefulset.yaml +++ b/stable/xray/templates/xray-statefulset.yaml @@ -8,6 +8,7 @@ metadata: chart: {{ template "xray.chart" . }} heritage: {{ .Release.Service }} release: {{ .Release.Name }} + version: {{ include "xray.app.version" . }} component: {{ .Values.xray.name }} {{- with .Values.xray.labels }} {{ toYaml . | indent 4 }} diff --git a/stable/xray/values.yaml b/stable/xray/values.yaml index e99923429..7864eee8f 100644 --- a/stable/xray/values.yaml +++ b/stable/xray/values.yaml @@ -931,11 +931,9 @@ analysis: livenessProbe: enabled: true config: | - exec: - command: - - sh - - -c - - curl -s -k --fail --max-time {{ .Values.probes.timeoutSeconds }} http://localhost:{{ .Values.analysis.internalPort }}/api/v1/system/liveness + httpGet: + path: /api/v1/system/liveness + port: {{ .Values.analysis.internalPort }} initialDelaySeconds: {{ if semverCompare " Date: Tue, 30 Jul 2024 09:44:36 +0530 Subject: [PATCH 03/30] [distribution] 2.26.1 release --- stable/distribution/CHANGELOG.md | 8 +- stable/distribution/Chart.yaml | 4 +- stable/distribution/templates/_helpers.tpl | 11 + .../templates/distribution-statefulset.yaml | 17 +- .../distribution-unified-secret.yaml | 2 +- stable/distribution/values.yaml | 349 +++++++++--------- 6 files changed, 200 insertions(+), 191 deletions(-) diff --git a/stable/distribution/CHANGELOG.md b/stable/distribution/CHANGELOG.md index 4fb9511c4..83a4cc913 100644 --- a/stable/distribution/CHANGELOG.md +++ b/stable/distribution/CHANGELOG.md @@ -1,10 +1,14 @@ # JFrog Distribution Chart Changelog All changes to this project chart be documented in this file. -## [102.25.1] - May 16, 2024 -* Update postgresql tag version to `15.6.0-debian-11-r16` +## [102.26.1] - May 29, 2024 +* Fix the indentation of the commented-out sections in the values.yaml file + +## [102.25.0] - May 16, 2024 +* Update postgresql tag version to `15.6.0-debian-12-r5` * Fixed an issue to generate unified secret to support distribution fullname [GH-1882](https://github.com/jfrog/charts/issues/1882) * Fixed an issue template render on loggers [GH-1883](https://github.com/jfrog/charts/issues/1883) +* Added `.Values.distribution.unifiedSecretPrependReleaseName` for unified secret name as fullname release name ## [102.24.0] - Mar 27, 2024 * Added image section for `initContainers` instead of `initContainerImage` diff --git a/stable/distribution/Chart.yaml b/stable/distribution/Chart.yaml index 88379622b..748544019 100644 --- a/stable/distribution/Chart.yaml +++ b/stable/distribution/Chart.yaml @@ -1,5 +1,5 @@ apiVersion: v2 -appVersion: 2.25.1 +appVersion: 2.26.1 dependencies: - condition: postgresql.enabled name: postgresql @@ -19,4 +19,4 @@ name: distribution sources: - https://github.com/jfrog/charts type: application -version: 102.25.1 +version: 102.26.1 diff --git a/stable/distribution/templates/_helpers.tpl b/stable/distribution/templates/_helpers.tpl index ce6b82c3a..63c5acc65 100644 --- a/stable/distribution/templates/_helpers.tpl +++ b/stable/distribution/templates/_helpers.tpl @@ -283,3 +283,14 @@ Calculate the systemYaml from the unstructured text input {{- define "distribution.systemYaml" -}} {{ include (print $.Template.BasePath "/_system-yaml-render.tpl") . }} {{- end -}} + +{{/* +Resolve unified secret prepend release name +*/}} +{{- define "distribution.unifiedSecretPrependReleaseName" -}} +{{- if .Values.distribution.unifiedSecretPrependReleaseName }} +{{- printf "%s" (include "distribution.fullname" .) -}} +{{- else }} +{{- printf "%s" (include "distribution.name" .) -}} +{{- end }} +{{- end }} \ No newline at end of file diff --git a/stable/distribution/templates/distribution-statefulset.yaml b/stable/distribution/templates/distribution-statefulset.yaml index 883556e9b..cc31b55c8 100644 --- a/stable/distribution/templates/distribution-statefulset.yaml +++ b/stable/distribution/templates/distribution-statefulset.yaml @@ -127,7 +127,7 @@ spec: {{- if or (not .Values.distribution.unifiedSecretInstallation) (or .Values.distribution.joinKeySecretName .Values.global.joinKeySecretName) }} name: {{ include "distribution.joinKeySecretName" . }} {{- else }} - name: "{{ template "distribution.fullname" . }}-unified-secret" + name: {{ template "distribution.unifiedSecretPrependReleaseName" . }}-unified-secret {{- end }} key: join-key {{- end }} @@ -138,7 +138,7 @@ spec: {{- if or (not .Values.distribution.unifiedSecretInstallation) (or .Values.distribution.masterKeySecretName .Values.global.masterKeySecretName) }} name: {{ include "distribution.masterKeySecretName" . }} {{- else }} - name: "{{ template "distribution.fullname" . }}-unified-secret" + name: {{ template "distribution.unifiedSecretPrependReleaseName" . }}-unified-secret {{- end }} key: master-key {{- end }} @@ -280,7 +280,7 @@ spec: {{- if not .Values.distribution.unifiedSecretInstallation }} name: {{ template "distribution.fullname" . }}-database-creds {{- else }} - name: "{{ template "distribution.fullname" . }}-unified-secret" + name: {{ template "distribution.unifiedSecretPrependReleaseName" . }}-unified-secret {{- end }} key: db-user {{- end }} @@ -296,7 +296,7 @@ spec: {{- if not .Values.distribution.unifiedSecretInstallation }} name: {{ template "distribution.fullname" . }}-database-creds {{- else }} - name: "{{ template "distribution.fullname" . }}-unified-secret" + name: {{ template "distribution.unifiedSecretPrependReleaseName" . }}-unified-secret {{- end }} key: db-password {{- else if .Values.postgresql.enabled }} @@ -315,7 +315,7 @@ spec: {{- if not .Values.distribution.unifiedSecretInstallation }} name: {{ template "distribution.fullname" . }}-database-creds {{- else }} - name: "{{ template "distribution.fullname" . }}-unified-secret" + name: {{ template "distribution.unifiedSecretPrependReleaseName" . }}-unified-secret {{- end }} key: db-url {{- end }} @@ -328,7 +328,7 @@ spec: {{- else if not .Values.distribution.unifiedSecretInstallation }} name: {{ include "distribution.fullname" . }} {{- else }} - name: "{{ template "distribution.fullname" . }}-unified-secret" + name: {{ template "distribution.unifiedSecretPrependReleaseName" . }}-unified-secret {{- end }} key: redis-password - name: JF_SHARED_REDIS_CONNECTIONSTRING @@ -453,7 +453,7 @@ spec: {{- else if not .Values.distribution.unifiedSecretInstallation }} name: {{ include "distribution.fullname" . }} {{- else }} - name: "{{ template "distribution.fullname" . }}-unified-secret" + name: {{ template "distribution.unifiedSecretPrependReleaseName" . }}-unified-secret {{- end }} key: redis-password - name: REDIS_PORT @@ -583,7 +583,8 @@ spec: {{- if and .Values.distribution.unifiedSecretInstallation (eq (include "distribution.checkDuplicateUnifiedCustomVolume" .) "false" ) }} - name: {{ include "distribution.unifiedCustomSecretVolumeName" . }} secret: - secretName: {{ template "distribution.fullname" . }}-unified-secret + secretName: {{ template "distribution.unifiedSecretPrependReleaseName" . }}-unified-secret + {{- else if not .Values.distribution.unifiedSecretInstallation }} ############ If single secret installation flag is disable ############ {{- if and (not .Values.systemYamlOverride.existingSecret) }} diff --git a/stable/distribution/templates/distribution-unified-secret.yaml b/stable/distribution/templates/distribution-unified-secret.yaml index 39823ca99..3587d55a5 100644 --- a/stable/distribution/templates/distribution-unified-secret.yaml +++ b/stable/distribution/templates/distribution-unified-secret.yaml @@ -2,7 +2,7 @@ apiVersion: v1 kind: Secret metadata: - name: {{ template "distribution.fullname" . }}-unified-secret + name: {{ template "distribution.unifiedSecretPrependReleaseName" . }}-unified-secret labels: app: "{{ template "distribution.name" $ }}" chart: "{{ template "distribution.chart" $ }}" diff --git a/stable/distribution/values.yaml b/stable/distribution/values.yaml index 4d1404e33..d927f6bc3 100644 --- a/stable/distribution/values.yaml +++ b/stable/distribution/values.yaml @@ -1,7 +1,7 @@ -# Default values for distribution. -# This is a YAML-formatted file. -# Beware when changing values here. You should know what you are doing! -# Access the values with {{ .Values.key.subkey }} +## Default values for distribution. +## This is a YAML-formatted file. +## Beware when changing values here. You should know what you are doing! +## Access the values with {{ .Values.key.subkey }} global: # imageRegistry: @@ -37,19 +37,17 @@ global: ## Applies to distribution pods nodeSelector: {} ## String to partially override distribution.fullname template (will maintain the release name) -## # nameOverride: ## String to fully override distribution.fullname template -## # fullnameOverride: -# Init containers +## Init containers initContainers: image: registry: releases-docker.jfrog.io repository: ubi9/ubi-minimal - tag: 9.4.949 + tag: 9.4.949.1716471857 pullPolicy: IfNotPresent resources: requests: @@ -58,7 +56,7 @@ initContainers: limits: memory: "1Gi" cpu: "1" -# For supporting pulling from private registries +## For supporting pulling from private registries imagePullSecrets: # - myRegistryKeySecretName @@ -73,7 +71,7 @@ systemYamlOverride: existingSecret: ## The dataKey should be the name of the secret data key created. dataKey: -# For HA +## For HA replicaCount: 1 ## Database configurations ## Use the wait-for-db init container. Set to false to skip @@ -96,7 +94,7 @@ rbac: - watch - list networkpolicy: [] -# Allows all ingress and egress +## Allows all ingress and egress # - name: distribution # podSelector: # matchLabels: @@ -105,7 +103,7 @@ networkpolicy: [] # - {} # ingress: # - {} -# Uncomment to allow only distribution pods to communicate with postgresql (if postgresql.enabled is true) +## Uncomment to allow only distribution pods to communicate with postgresql (if postgresql.enabled is true) # - name: postgres # podSelector: # matchLabels: @@ -115,7 +113,7 @@ networkpolicy: [] # - podSelector: # matchLabels: # app: distribution -# Uncomment to allow only distribution pods to communicate with redis +## Uncomment to allow only distribution pods to communicate with redis # - name: redis # podSelector: # matchLabels: @@ -152,7 +150,7 @@ podSecurityContext: runAsGroup: 1020 fsGroup: 1020 # fsGroupChangePolicy: "Always" -# PostgreSQL +## PostgreSQL ## Configuration values for the PostgreSQL dependency sub-chart ## ref: https://github.com/bitnami/charts/blob/master/bitnami/postgresql/README.md postgresql: @@ -187,12 +185,12 @@ postgresql: enabled: true containerSecurityContext: enabled: true - # requests: - # memory: "1Gi" - # cpu: "250m" - # limits: - # memory: "2Gi" - # cpu: "1" + # requests: + # memory: "1Gi" + # cpu: "250m" + # limits: + # memory: "2Gi" + # cpu: "1" ## If NOT using the PostgreSQL in this chart (postgresql.enabled=false), ## specify custom/external database details here database: @@ -206,15 +204,15 @@ database: ## If you have existing Kubernetes secrets containing db credentials, use ## these values secrets: {} - # user: - # name: "dis-database-creds" - # key: "db-user" - # password: - # name: "dis-database-creds" - # key: "db-password" - # url: - # name: "dis-database-creds" - # key: "db-url" + # user: + # name: "dis-database-creds" + # key: "db-user" + # password: + # name: "dis-database-creds" + # key: "db-password" + # url: + # name: "dis-database-creds" + # key: "db-url" ## Configuration values for the redis dependency ## ref: https://github.com/helm/charts/blob/master/stable/redis/README.md ## @@ -244,18 +242,18 @@ redis: runAsUser: 1001 runAsGroup: 0 resources: {} - # requests: - # memory: "256Mi" - # cpu: "100m" - # limits: - # memory: "2Gi" - # cpu: "250m" + # requests: + # memory: "256Mi" + # cpu: "100m" + # limits: + # memory: "2Gi" + # cpu: "250m" nodeSelector: {} tolerations: [] affinity: {} common: - # Spread Distribution pods evenly across your nodes or some other topology + ## Spread Distribution pods evenly across your nodes or some other topology topologySpreadConstraints: [] # - maxSkew: 1 # topologyKey: kubernetes.io/hostname @@ -269,92 +267,87 @@ common: ## Custom command to run before distribution startup. Runs BEFORE any microservice-specific preStartCommand preStartCommand: ## Add custom volumes - # If .Values.distribution.unifiedSecretInstallation is true then secret name should be '{{ template "distribution.fullname" . }}-unified-secret'. - customVolumes: "" - # - name: custom-script - # configMap: - # name: custom-script - + ## If .Values.distribution.unifiedSecretInstallation is true then secret name should be '{{ template "distribution.unifiedSecretPrependReleaseName" . }}-unified-secret'. + customVolumes: | + # - name: custom-script + # configMap: + # name: custom-script ## Add custom volumesMounts - customVolumeMounts: "" - # - name: custom-script - # mountPath: /scripts/script.sh - # subPath: script.sh - - # Add any list of configmaps to distribution - configMaps: "" - # posthook-start.sh: |- - # echo "This is a post start script" - # posthook-end.sh: |- - # echo "This is a post end script" - + customVolumeMounts: | + # - name: custom-script + # mountPath: /scripts/script.sh + # subPath: script.sh + ## Add any list of configmaps to distribution + configMaps: | + # posthook-start.sh: |- + # echo "This is a post start script" + # posthook-end.sh: |- + # echo "This is a post end script" ## Add custom init containers execution before predefined init containers - customInitContainersBegin: "" - # - name: "custom-setup" - # image: {{ include "distribution.getImageInfoByValue" (list . "initContainers") }} - # imagePullPolicy: "{{ .Values.initContainers.image.pullPolicy }}" - # securityContext: - # runAsNonRoot: true - # allowPrivilegeEscalation: false - # capabilities: - # drop: - # - NET_RAW - # command: - # - 'sh' - # - '-c' - # - 'touch {{ .Values.distribution.persistence.mountPath }}/example-custom-setup' - # volumeMounts: - # - mountPath: "{{ .Values.distribution.persistence.mountPath }}" - # name: distribution-data - + customInitContainersBegin: | + # - name: "custom-setup" + # image: {{ include "distribution.getImageInfoByValue" (list . "initContainers") }} + # imagePullPolicy: "{{ .Values.initContainers.image.pullPolicy }}" + # securityContext: + # runAsNonRoot: true + # allowPrivilegeEscalation: false + # capabilities: + # drop: + # - NET_RAW + # command: + # - 'sh' + # - '-c' + # - 'touch {{ .Values.distribution.persistence.mountPath }}/example-custom-setup' + # volumeMounts: + # - mountPath: "{{ .Values.distribution.persistence.mountPath }}" + # name: distribution-data ## Add custom init containers execution after predefined init containers - customInitContainers: "" - # - name: "custom-systemyaml-setup" - # image: {{ include "distribution.getImageInfoByValue" (list . "initContainers") }} - # imagePullPolicy: "{{ .Values.initContainers.image.pullPolicy }}" - # securityContext: - # runAsNonRoot: true - # allowPrivilegeEscalation: false - # capabilities: - # drop: - # - NET_RAW - # command: - # - 'sh' - # - '-c' - # - 'curl -o {{ .Values.distribution.persistence.mountPath }}/etc/system.yaml https:///systemyaml' - # volumeMounts: - # - mountPath: "{{ .Values.distribution.persistence.mountPath }}" - # name: distribution-data - + customInitContainers: | + # - name: "custom-systemyaml-setup" + # image: {{ include "distribution.getImageInfoByValue" (list . "initContainers") }} + # imagePullPolicy: "{{ .Values.initContainers.image.pullPolicy }}" + # securityContext: + # runAsNonRoot: true + # allowPrivilegeEscalation: false + # capabilities: + # drop: + # - NET_RAW + # command: + # - 'sh' + # - '-c' + # - 'curl -o {{ .Values.distribution.persistence.mountPath }}/etc/system.yaml https:///systemyaml' + # volumeMounts: + # - mountPath: "{{ .Values.distribution.persistence.mountPath }}" + # name: distribution-data ## Add custom sidecar containers - # - The provided example uses a custom volume (customVolumes) - customSidecarContainers: "" - # - name: "sidecar-list-etc" - # image: {{ include "distribution.getImageInfoByValue" (list . "initContainers") }} - # imagePullPolicy: "{{ .Values.initContainers.image.pullPolicy }}" - # securityContext: - # runAsNonRoot: true - # allowPrivilegeEscalation: false - # capabilities: - # drop: - # - NET_RAW - # command: - # - 'sh' - # - '-c' - # - 'sh /scripts/script.sh' - # volumeMounts: - # - mountPath: "{{ .Values.distribution.persistence.mountPath }}" - # name: volume - # - mountPath: "/scripts/script.sh" - # name: custom-script - # subPath: script.sh - # resources: - # requests: - # memory: "32Mi" - # cpu: "50m" - # limits: - # memory: "128Mi" - # cpu: "100m" + ## - The provided example uses a custom volume (customVolumes) + customSidecarContainers: | + # - name: "sidecar-list-etc" + # image: {{ include "distribution.getImageInfoByValue" (list . "initContainers") }} + # imagePullPolicy: "{{ .Values.initContainers.image.pullPolicy }}" + # securityContext: + # runAsNonRoot: true + # allowPrivilegeEscalation: false + # capabilities: + # drop: + # - NET_RAW + # command: + # - 'sh' + # - '-c' + # - 'sh /scripts/script.sh' + # volumeMounts: + # - mountPath: "{{ .Values.distribution.persistence.mountPath }}" + # name: volume + # - mountPath: "/scripts/script.sh" + # name: custom-script + # subPath: script.sh + # resources: + # requests: + # memory: "32Mi" + # cpu: "50m" + # limits: + # memory: "128Mi" + # cpu: "100m" distribution: name: distribution ## Note that by default we use appVersion to get image tag/version @@ -363,13 +356,15 @@ distribution: repository: jfrog/distribution-distribution # tag: pullPolicy: IfNotPresent - # unifiedSecretInstallation flag enables single unified secret holding all the distribution internal(chart) secrets, It won't be affecting external secrets. + ## unifiedSecretInstallation flag enables single unified secret holding all the distribution internal(chart) secrets, It won't be affecting external secrets. ## Note: unifiedSecretInstallation flag is enabled by true by default from chart version 102.23.0, Users can switch to false to continue with the old way of secret creation. unifiedSecretInstallation: true + ## unifiedSecretPrependReleaseName Set this flag to false if unifiedSecret should not be created with prepended. + unifiedSecretPrependReleaseName: true ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ schedulerName: - # Create a priority class for the Distribution pod or use an existing one - # NOTE - Maximum allowed value of a user defined priority is 1000000000 + ## Create a priority class for the Distribution pod or use an existing one + ## NOTE - Maximum allowed value of a user defined priority is 1000000000 priorityClass: create: false value: 1000000000 @@ -378,7 +373,7 @@ distribution: ## Use an existing priority class # existingPriorityClass: labels: {} - # Add lifecycle hooks for the distribution pods + ## Add lifecycle hooks for the distribution pods lifecycle: {} # postStart: # exec: @@ -451,24 +446,23 @@ distribution: statefulset: annotations: {} ## Add custom volumeMounts - customVolumeMounts: "" - # - name: custom-script - # mountPath: "/scripts/script.sh" - # subPath: script.sh - - # Add custom secrets - secret per file - # If .Values.distribution.unifiedSecretInstallation is true then secret name should be '{{ template "distribution.fullname" . }}-unified-secret'. + customVolumeMounts: | + # - name: custom-script + # mountPath: "/scripts/script.sh" + # subPath: script.sh + ## Add custom secrets - secret per file + ## If .Values.distribution.unifiedSecretInstallation is true then secret name should be '{{ template "distribution.unifiedSecretPrependReleaseName" . }}-unified-secret'. customSecrets: - # - name: custom-secret - # key: custom-secret.yaml - # data: > - # custom_secret_config: - # parameter1: value1 - # parameter2: value2 - # - name: custom-secret2 - # key: custom-secret2.config - # data: | - # here the custom secret 2 config + # - name: custom-secret + # key: custom-secret.yaml + # data: > + # custom_secret_config: + # parameter1: value1 + # parameter2: value2 + # - name: custom-secret2 + # key: custom-secret2.config + # data: | + # here the custom secret 2 config resources: {} # requests: @@ -546,7 +540,7 @@ distribution: # - observability-request.log # - observability-service.log - # Loggers containers resources + ## Loggers containers resources loggersResources: {} # requests: # memory: "64Mi" @@ -568,7 +562,7 @@ router: image: registry: releases-docker.jfrog.io repository: jfrog/router - tag: 7.108.0 + tag: 7.118.0 pullPolicy: IfNotPresent serviceRegistry: ## Service registry (Access) TLS verification skipped if enabled @@ -577,14 +571,14 @@ router: externalPort: 8082 tlsEnabled: false resources: {} - # requests: - # memory: "100Mi" - # cpu: "100m" - # limits: - # memory: "1Gi" - # cpu: "1" + # requests: + # memory: "100Mi" + # cpu: "100m" + # limits: + # memory: "1Gi" + # cpu: "1" - # Add lifecycle hooks for the router pod + ## Add lifecycle hooks for the router pod lifecycle: {} # postStart: # exec: @@ -594,11 +588,10 @@ router: # command: ["/bin/sh", "-c", "echo Hello from the router preStart handler > /usr/share/message"] ## Add custom volumesMounts - customVolumeMounts: "" - # - name: custom-script - # mountPath: /scripts/script.sh - # subPath: script.sh - + customVolumeMounts: | + # - name: custom-script + # mountPath: /scripts/script.sh + # subPath: script.sh livenessProbe: enabled: true config: | @@ -649,18 +642,18 @@ observability: image: registry: releases-docker.jfrog.io repository: jfrog/observability - tag: 1.25.0 + tag: 1.29.0 pullPolicy: IfNotPresent internalPort: 8036 resources: {} - # requests: - # memory: "100Mi" - # cpu: "100m" - # limits: - # memory: "1Gi" - # cpu: "1" + # requests: + # memory: "100Mi" + # cpu: "100m" + # limits: + # memory: "1Gi" + # cpu: "1" - # Add lifecycle hooks for the observability pod + ## Add lifecycle hooks for the observability pod lifecycle: {} # postStart: # exec: @@ -699,7 +692,7 @@ observability: shared: node: id: -# Filebeat Sidecar container +## Filebeat Sidecar container ## The provided filebeat configuration is for Distribution logs. It assumes you have a logstash installed and configured properly. filebeat: enabled: false @@ -734,12 +727,12 @@ filebeat: periodSeconds: 10 timeoutSeconds: 5 resources: {} - # requests: - # memory: "100Mi" - # cpu: "100m" - # limits: - # memory: "100Mi" - # cpu: "100m" + # requests: + # memory: "100Mi" + # cpu: "100m" + # limits: + # memory: "100Mi" + # cpu: "100m" filebeatYml: | logging.level: info @@ -763,17 +756,17 @@ filebeat: ## Allows to add additional kubernetes resources ## Use --- as a separator between multiple resources additionalResources: "" -# Adding entries to a Pod's /etc/hosts file -# For an example, refer - https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases +## Adding entries to a Pod's /etc/hosts file +## For an example, refer - https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases hostAliases: [] -# - ip: "127.0.0.1" -# hostnames: -# - "foo.local" -# - "bar.local" -# - ip: "10.1.2.3" -# hostnames: -# - "foo.remote" -# - "bar.remote" +# - ip: "127.0.0.1" +# hostnames: +# - "foo.local" +# - "bar.local" +# - ip: "10.1.2.3" +# hostnames: +# - "foo.remote" +# - "bar.remote" ## Specify common probes parameters probes: From 5c22dd3fb097a5392908cc3259bfc4a4b054ab9e Mon Sep 17 00:00:00 2001 From: Ram <1331672+chukka@users.noreply.github.com> Date: Tue, 30 Jul 2024 09:45:10 +0530 Subject: [PATCH 04/30] [jfrog-platform] 10.19.0 release --- stable/jfrog-platform/CHANGELOG.md | 9 ++++- stable/jfrog-platform/Chart.lock | 8 ++--- stable/jfrog-platform/Chart.yaml | 8 ++--- .../templates/upgrade-hook.yaml | 35 ++++++++++++++++++- stable/jfrog-platform/values.yaml | 7 ++-- 5 files changed, 54 insertions(+), 13 deletions(-) diff --git a/stable/jfrog-platform/CHANGELOG.md b/stable/jfrog-platform/CHANGELOG.md index c77e9303f..69ded4729 100644 --- a/stable/jfrog-platform/CHANGELOG.md +++ b/stable/jfrog-platform/CHANGELOG.md @@ -1,7 +1,14 @@ # JFrog Platform Chart Changelog (GA releases only) All changes to this chart will be documented in this file. -## [10.18.3] - July 15, 2024 +## [10.19.0] - Jul 25, 2024 +* **Important change:** +* Mission Control is also disabled by default now, if you are using this product from previous release, enable them using your custom-values.yaml file. +* Update dependency artifactory chart version to 107.90.5 +* Update dependency xray chart version to 103.100.3 +* Update global.versions.router version to `7.122.1` + +## [10.18.3] - Jul 15, 2024 * Update dependency artifactory chart version to 107.84.17 * Update dependency xray chart version to 103.98.5 diff --git a/stable/jfrog-platform/Chart.lock b/stable/jfrog-platform/Chart.lock index 7f7b3030f..ff1aa1043 100644 --- a/stable/jfrog-platform/Chart.lock +++ b/stable/jfrog-platform/Chart.lock @@ -7,10 +7,10 @@ dependencies: version: 11.9.3 - name: artifactory repository: https://charts.jfrog.io/ - version: 107.84.17 + version: 107.90.5 - name: xray repository: https://charts.jfrog.io/ - version: 103.98.5 + version: 103.100.3 - name: distribution repository: https://charts.jfrog.io/ version: 102.25.1 @@ -20,5 +20,5 @@ dependencies: - name: pipelines repository: https://charts.jfrog.io/ version: 101.59.7 -digest: sha256:a03647c0b1cf25012f2320e3fc6f953499eab18a8b2b7f461a8e0eeaf36582c6 -generated: "2024-07-15T10:39:47.432479+05:30" +digest: sha256:724e270ffa0a4cd4b68c9a26d6d0ee114ecc6fe669f35d1acbba8234b07cbfe0 +generated: "2024-07-25T13:47:18.91713+05:30" diff --git a/stable/jfrog-platform/Chart.yaml b/stable/jfrog-platform/Chart.yaml index 12cf5e43c..0998a3e2f 100644 --- a/stable/jfrog-platform/Chart.yaml +++ b/stable/jfrog-platform/Chart.yaml @@ -1,5 +1,5 @@ apiVersion: v2 -appVersion: 7.84.17 +appVersion: 7.90.5 dependencies: - condition: postgresql.enabled name: postgresql @@ -12,11 +12,11 @@ dependencies: - condition: artifactory.enabled name: artifactory repository: https://charts.jfrog.io/ - version: 107.84.17 + version: 107.90.5 - condition: xray.enabled name: xray repository: https://charts.jfrog.io/ - version: 103.98.5 + version: 103.100.3 - condition: distribution.enabled name: distribution repository: https://charts.jfrog.io/ @@ -50,4 +50,4 @@ name: jfrog-platform sources: - https://github.com/jfrog/charts type: application -version: 10.18.3 +version: 10.19.0 diff --git a/stable/jfrog-platform/templates/upgrade-hook.yaml b/stable/jfrog-platform/templates/upgrade-hook.yaml index 853ccc3ec..f146e8137 100644 --- a/stable/jfrog-platform/templates/upgrade-hook.yaml +++ b/stable/jfrog-platform/templates/upgrade-hook.yaml @@ -1,5 +1,5 @@ {{- if .Values.preUpgradeHook.enabled }} -{{- if not (and .Values.insight.enabled .Values.pipelines.enabled .Values.distribution.enabled) }} +{{- if not (and .Values.insight.enabled .Values.pipelines.enabled .Values.distribution.enabled .Values.artifactory.mc.enabled) }} apiVersion: v1 kind: ServiceAccount metadata: @@ -36,6 +36,13 @@ rules: - create - get - list +- apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding @@ -130,6 +137,32 @@ spec: echo "Pipelines pod(s) don't exist. Allowing upgrade" fi {{- end }} + + {{- if not .Values.artifactory.mc.enabled }} + systemYamlUnifiedSecret={{ .Release.Name }}-artifactory-unified-secret + systemYamlSecret={{ .Release.Name }}-artifactory-systemyaml + systemYamlEncoded=$(kubectl get secrets "$systemYamlUnifiedSecret" -o jsonpath="{.data.system\.yaml}") + if [ $? -ne 0 ]; then + systemYamlEncoded=$(kubectl get secrets "$systemYamlSecret" -o jsonpath="{.data.system\.yaml}") + if [ $? -ne 0 ]; then + systemYamlEncoded=$(kubectl get secrets "artifactory-unified-secret" -o jsonpath="{.data.system\.yaml}") + if [ $? -ne 0 ]; then + echo "Error: Secret '$systemYamlSecret' or '$systemYamlUnifiedSecret' or "artifactory-unified-secret" not found" + exit 1 + fi + fi + fi + systemYaml=$(echo "$systemYamlEncoded" | base64 -d) + isMcEnabled=$(echo "$systemYaml" | awk 'BEGIN {flag=0} /^mc:/ {flag=1} flag && /^ enabled: / {print $2; exit} /^[^ ]/ && !/^mc:/ {if (flag) flag=0}') + if [ "$isMcEnabled" = "true" ]; then + echo "Failed to perform the upgrade. Refer to https://github.com/jfrog/charts/blob/master/stable/jfrog-platform/CHANGELOG.md#10180" + echo "From chart verison 10.19.x, Artifactory's Mission Control is disabled. If you are using this in the previous release(s)." + echo "Enable them using your custom-values.yaml file " + exit 1 + else + echo "Artifactory's Mission Control is not enabled. Allowing upgrade" + fi + {{- end }} restartPolicy: Never terminationGracePeriodSeconds: 10 {{- end }} diff --git a/stable/jfrog-platform/values.yaml b/stable/jfrog-platform/values.yaml index 3218bfcc1..bc663934e 100644 --- a/stable/jfrog-platform/values.yaml +++ b/stable/jfrog-platform/values.yaml @@ -27,7 +27,7 @@ global: ## For example : For artifactory, using global.versions.artifactory ## Note: Order of preference is 1) global.versions 2) .Values.artifactory.image.tag 3) Chart.AppVersion versions: - router: 7.118.0 + router: 7.122.1 # artifactory: # xray: # distribution: @@ -232,7 +232,7 @@ rabbitmq: artifactory: enabled: true unifiedUpgradeAllowed: true - installerInfo: '{"productId":"Helm_JFrogPlatform/{{ printf "10.18.3-%s" .Chart.AppVersion }}","features":[{"featureId":"Platform/{{ printf "%s-%s" "kubernetes" .Capabilities.KubeVersion.Version }}"},{"featureId":"Database/{{ .Values.database.type }}"},{"featureId":"Nginx_Enabled/{{ .Values.nginx.enabled }}"},{"featureId":"ArtifactoryPersistence_Type/{{ .Values.artifactory.persistence.type }}"},{"featureId":"SplitServicesToContainers_Enabled/{{ .Values.splitServicesToContainers }}"},{"featureId":"Filebeat_Enabled/{{ .Values.filebeat.enabled }}"},{"featureId":"ReplicaCount/{{ .Values.artifactory.replicaCount }}"}]}' + installerInfo: '{"productId":"Helm_JFrogPlatform/{{ printf "10.19.0-%s" .Chart.AppVersion }}","features":[{"featureId":"Platform/{{ printf "%s-%s" "kubernetes" .Capabilities.KubeVersion.Version }}"},{"featureId":"Database/{{ .Values.database.type }}"},{"featureId":"Nginx_Enabled/{{ .Values.nginx.enabled }}"},{"featureId":"ArtifactoryPersistence_Type/{{ .Values.artifactory.persistence.type }}"},{"featureId":"SplitServicesToContainers_Enabled/{{ .Values.splitServicesToContainers }}"},{"featureId":"Filebeat_Enabled/{{ .Values.filebeat.enabled }}"},{"featureId":"ReplicaCount/{{ .Values.artifactory.replicaCount }}"}]}' postgresql: enabled: false waitForDatabase: false @@ -243,8 +243,9 @@ artifactory: user: artifactory password: artifactory # Note: For artifactory Pro license, mission-control is not supported, Hence, set mc.enabled: false + # Note: mission-control is disabled by default, this is only available for E+ customers, and can be enabled by setting mc.enabled: true mc: - enabled: true + enabled: false artifactory: unifiedSecretInstallation: true ## unifiedSecretPrependReleaseName Set this flag to false if unifiedSecret should not be created with prepended. From 42ae7ab0ff24d9775d088e637444d0d41b7da9b1 Mon Sep 17 00:00:00 2001 From: Ram <1331672+chukka@users.noreply.github.com> Date: Thu, 1 Aug 2024 15:46:30 +0530 Subject: [PATCH 05/30] deprecated mission-control chart --- .../logo/jfrog-platform-logo.png | Bin 4552 -> 0 bytes stable/mission-control/.helmignore | 22 - stable/mission-control/CHANGELOG.md | 492 -------- stable/mission-control/Chart.lock | 6 - stable/mission-control/Chart.yaml | 22 - stable/mission-control/LICENSE | 201 ---- stable/mission-control/README.md | 53 - stable/mission-control/UPGRADE_NOTES.md | 44 - stable/mission-control/ci/default-values.yaml | 22 - .../ci/global-section-values.yaml | 123 -- stable/mission-control/ci/ha-values.yaml | 26 - stable/mission-control/ci/test-values.yaml | 39 - .../mission-control/files/jfmcDataExport.sh | 452 -------- stable/mission-control/logo/jfmc-logo.png | Bin 5904 -> 0 bytes stable/mission-control/templates/NOTES.txt | 3 - stable/mission-control/templates/_helpers.tpl | 294 ----- .../templates/additional-resources.yaml | 3 - .../templates/database-secrets.yaml | 30 - .../templates/elasticsearch-secrets.yaml | 22 - .../templates/filebeat-configmap.yaml | 15 - .../templates/jfmc-setup-scripts.yaml | 54 - .../mission-control-application-yaml.yaml | 14 - .../templates/mission-control-configmaps.yaml | 13 - .../mission-control-custom-secrets.yaml | 19 - .../mission-control-networkpolicy.yaml | 33 - .../templates/mission-control-role.yaml | 14 - .../mission-control-rolebinding.yaml | 19 - .../templates/mission-control-secrets.yaml | 26 - .../mission-control-serviceaccount.yaml | 12 - .../mission-control-statefulset.yaml | 840 -------------- .../templates/mission-control-svc.yaml | 38 - .../mission-control-system-yaml.yaml | 16 - .../templates/postgresql-setup-script.yaml | 173 --- stable/mission-control/values-large.yaml | 53 - stable/mission-control/values-medium.yaml | 53 - stable/mission-control/values-small.yaml | 53 - stable/mission-control/values.yaml | 1013 ----------------- 37 files changed, 4312 deletions(-) delete mode 100644 stable/jfrog-platform/logo/jfrog-platform-logo.png delete mode 100644 stable/mission-control/.helmignore delete mode 100644 stable/mission-control/CHANGELOG.md delete mode 100644 stable/mission-control/Chart.lock delete mode 100644 stable/mission-control/Chart.yaml delete mode 100644 stable/mission-control/LICENSE delete mode 100644 stable/mission-control/README.md delete mode 100644 stable/mission-control/UPGRADE_NOTES.md delete mode 100644 stable/mission-control/ci/default-values.yaml delete mode 100644 stable/mission-control/ci/global-section-values.yaml delete mode 100644 stable/mission-control/ci/ha-values.yaml delete mode 100644 stable/mission-control/ci/test-values.yaml delete mode 100644 stable/mission-control/files/jfmcDataExport.sh delete mode 100644 stable/mission-control/logo/jfmc-logo.png delete mode 100644 stable/mission-control/templates/NOTES.txt delete mode 100644 stable/mission-control/templates/_helpers.tpl delete mode 100644 stable/mission-control/templates/additional-resources.yaml delete mode 100644 stable/mission-control/templates/database-secrets.yaml delete mode 100644 stable/mission-control/templates/elasticsearch-secrets.yaml delete mode 100644 stable/mission-control/templates/filebeat-configmap.yaml delete mode 100644 stable/mission-control/templates/jfmc-setup-scripts.yaml delete mode 100644 stable/mission-control/templates/mission-control-application-yaml.yaml delete mode 100644 stable/mission-control/templates/mission-control-configmaps.yaml delete mode 100644 stable/mission-control/templates/mission-control-custom-secrets.yaml delete mode 100644 stable/mission-control/templates/mission-control-networkpolicy.yaml delete mode 100644 stable/mission-control/templates/mission-control-role.yaml delete mode 100644 stable/mission-control/templates/mission-control-rolebinding.yaml delete mode 100644 stable/mission-control/templates/mission-control-secrets.yaml delete mode 100644 stable/mission-control/templates/mission-control-serviceaccount.yaml delete mode 100644 stable/mission-control/templates/mission-control-statefulset.yaml delete mode 100644 stable/mission-control/templates/mission-control-svc.yaml delete mode 100644 stable/mission-control/templates/mission-control-system-yaml.yaml delete mode 100644 stable/mission-control/templates/postgresql-setup-script.yaml delete mode 100644 stable/mission-control/values-large.yaml delete mode 100644 stable/mission-control/values-medium.yaml delete mode 100644 stable/mission-control/values-small.yaml delete mode 100644 stable/mission-control/values.yaml diff --git a/stable/jfrog-platform/logo/jfrog-platform-logo.png b/stable/jfrog-platform/logo/jfrog-platform-logo.png deleted file mode 100644 index 0e696ee3af031ccae0dd8885d7747cc430a46305..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 4552 zcmai&WnU8xphhWiBc!`i8U~1zbTdkZNQ@0oN)XA>&FE4<=?>{0jna)ULZm@rA|T!D z{_h94zx(2O&iM={#!z3Al!%cC2M32#TTAWbf86-r0r3BOpbMwge@He2L)5WYta6X$ zvo3jsZZ+YKXU8|k<*OB-PHE|GMUf6Exo+i()vD&Lmi3c$fe!I|?7e=U@zwp+((&@l zAv$zAa{GLzW4mkqXyM~R+Qi?<_v7x4qb}(S8AE@D3zm!iT<)6=So%x_SPj|6%*KCO zNN@e!?lk6V)c?wS5au=M8~7ts>$@HqikZEQp9IB}vy|UfN9c!xLw>5QrVR1PK7hu3 zENrKB`3PrsqGsb0i2c=4&FYH9uB~t@QChX+Pv;7}n)@mtabnKBc;u|0VBX{~U8o*M zEBt@Rqi{NcEQDgXQG8vTBX##JXxw^TX{>=An$fQ8x}DX27AOtZ4I!Kx`f2^sht;6m znr&QunM*fTRVxZftfHbEWD%I|6P_MB^kj%S3&T3Ni?uj z+A$Da8e9@Qw39P9nwMI8^o+{&cjbk;|F`R}UMfGjtQ8faL*K0!Hrn@|8z1<#KYat+ z`WK{zn-DL2)gLAp%x(QmrR;D*G}-w`(T|%%$Z#t@69Bc=aTs%*Eq#W@{_RCn`A?7EkWJH;(zI8c7c#SirBqn}j3KF#^Wy*ANv@uSWRby+w?#s~2-bWz|rQLg7 z^!WO2ybphkv%N?!e&StL{`+bn+!nhRmzEgSc$?SEA*DGKCfz+HIW9v(1>f)=zz$M| zZCM#n)feG9(4LgXJ!)aE_DQ4jd8#f|X5CP8=$^k5vT}C%5EVe;F{)9&-10Bul9cxC zt7A!NPq~%%3ztKoYcdqc{hC7dK|{hB;)H#?-EUMq7c z^P)>af>2a=Z#eW8{J8LQ)oCrS(KCpi-Ki(jDk6q**-EL_shUCLw~>hFr5SvxA$-0% z(L1yn&NQLWn3K~jb_(Tr-d)+l(9gKKvGocu50N?>XTQ4=?xf zEEhcCR-+S;b8hPepB0T6fZuuGz1rHdVj<~fIgftdz^l3(&B3N6Q&7Nj1hR|61@uCR zI1*(7{L99Eh{w|jr!?}CUQ&{b+b|Yqr#Op47500Zr8^t z!a6<_AI~YXd_EVqN2I3W7!$PLXs=Tz|!FD7SF+(FOUh$I3NQ>Nii*Kh3UM7{%b+uZua<^XA~s(F}K$)7ha}4DmT<{ z68zp@tB4RLt6pX;g-V8Rgov-bk#s}LDDCkZ)yqZA11mDWnO6Yh^?+1{X(`0|vtF1s z8|_6!dMXthC~r%}5TIMJ4W$Q@?<8qOjapWol9o*|CAr?o0-lbcWoa_U%L{6O&}Afq z^2u`-Jcwd9EO8o7*;2I88o=b3U{gbLP*z?Y$_5%K;%qpItSz4Sw3B*|uU18LpVrVG zGaG)!5Vn$AbQP9ZAJ*s(I^?FPi-UL`=76Y!cQ;)y0WFu3&oIXp7>vQFDL?&n`cAkMUhw@2vP3Nzv2(xQ3-w`%0G! z5v9eCl5cBM#zd)yRNr<}HW{p;n-F-?w%MDeuYC6YUHnzw6{MV#Z)R_Qi*#<0R1If$ z|7E}{r*!Hz_xvgx6fjh;qjPv+zD%fT!kHE`QkXSP(%kTkODso6a0o6)88tw&i6H}G z3WcWXGPufyi-``2jcJHlhP^)1>fK}*aw>O-?X#2i8nXn&7s#Sc#V1@X0unde)w7Aw zN`Jw3Y7oEs)%ow|z0!W`BOToWlTy@+JO}f(!i2DRAF6d5!J9;OZ`V?LofMFR?826A zp`-`L4%Dmm&;;9NOiPZe6VmZ`EdJ}mRJq3I^_(8%c4YM@J zb9%}33LsD>gYbxSBt4}q86F7k@kxkqL%{a%O%&YnA8oCP_ERz8pNX4V#b$DQr1|5y z{jl2k=OP7=A8MF+qd`CDL0*i=1q`Gp?%i?6N_XsSo-h#?>u`y^ zEZ#fr=w~1zv@qn)#C|F(wpS7fsE>7d1VDG7i-2n>Q`BEpWhZIUQ}3!ABo6ZNMH?@Y zb0$er&E08b7>BvMLw3??Z0P{hapHI{$D{?rT78K%GIga*V(IqiqhIw^MU7`c(ZkzuF1Y zHyMWaet?}WXN13?Wy&2L8>jpBEGb*19XDmXZilkZpggu-ZoT4P3pZ(f%x=W{8jZ&@ zOd5-(?F~8QHRxQVwCq+`mmqk0p51P7VmS!;hhK!j4T$?I9T<1>?~Z4}R20sDdsN0s!e<0A zKwhRbssO!tH^R9b+4R-*@J)&bKbcXU#X4A`$U`X7I2w^c2XHT;2;?;mD@}&0$-pT$ zWsf}it3zQuhR8e5dg7BOz*$WJ^2LR@6b+&r$ zSzKQDn>N3#J)+D6J-4bm&)lf4UPVV4LQ$6(cWH>l{ZO8l=Mw6wrX3s8#I?d(QZ%97m?OlU&D^chUz@gCw*U|k*A4{ zd7hr*6y;PxY37zEuPuLWI1LeO2`3feS&A9e9nc~Mz*Bx_QK`NwwS&VjVNnQRL@t_$ zEjG+yiT_;U#sbQwY<`&3jc+-9@R`=zSNOxG?016Rs7;H4E7v}BClgq3)}n6sU*G)N z;((~NfxUI@twdh7K5T5;edxhLM1Ob0X+aF2r*~p zTRnAH3;1-91?|(0T;vpKp4_j)*61|Z7seMzwvp2ZO~`HR)uvuZsqm;yJh=0FCBlwY zpH5Tvh(RDZ!Oa^#yGSIKpjiH8I6y*-EmZ!+kjQE-Z|MXYww`#2k4S2-Z}@k| zygC?F@(_7_D*$4v6@eXOTSWsl9r$-|2QK8%EIx;)Wa=!#<|W-6&?~g#ht0LrRg6eChV+c+olIj^Q0X_4zT8Yp zoyEYisS29!d1xaKh30gJn+H`H7ONku4M5eZrUi|I6;s-Zzxe|Qyz%0Kd?462BBf$+ zh=DWB-Egbo*`zU=+C^co)hE61KCHTtOg#1ES>uX^Nk!BzdM68)ZTjvsYh{a65X430 z?9T@?qlx)k^QcT9$AWb=?Ye=T)?`;r#D^#ydcTT4`ld@WQg8yom+2aRaLT*FP#__5 z7akH5T@*Nr;~BzW^HySn!~F|tlur!y;hJ7m=24?u>6=D{8gBp5QZvGFd4_77*p zBYQFC`$4fAE#l*WWE-XE+|l5H1!`7X=~vK_Q3iK8J0Yg%ZKI+bZx4D_RqIg}ftH>w z-o?`?TU}c}UCRrFAWM^pVid@xz#&Lg2aKi2B zfwnUuirI&;H0#XRHPqgKZ?j~zUY~vBs-BRS^q4_lr6$m&-#8sr zryj_F!b!PKdi494U3J?+?a#Lq^PB*I$>J6tUDj)5WXXf|ZVZ+yj4NPLcVcUG<1dBmJ=sLMIk@OC}SdnBKmv`C6<*3;Gfln2{zNBfM zr=lEP=OfbocbL?uIVM%(TSpt1| z(D#%A3oT@uHy+o*S&qzL#rVK$Pv|f3VlCQlW?lkA^Da_>2b!H15h^h8x_liB*A8^3 z3qG-;=qE(Px;B$SK-pKh~$AfbZ(l8l~DPqdZAoQ@UZ^@kB`+I diff --git a/stable/mission-control/.helmignore b/stable/mission-control/.helmignore deleted file mode 100644 index c7eb1e274..000000000 --- a/stable/mission-control/.helmignore +++ /dev/null @@ -1,22 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*~ -# Various IDEs -.project -.idea/ -*.tmproj -OWNERS \ No newline at end of file diff --git a/stable/mission-control/CHANGELOG.md b/stable/mission-control/CHANGELOG.md deleted file mode 100644 index b515fbc10..000000000 --- a/stable/mission-control/CHANGELOG.md +++ /dev/null @@ -1,492 +0,0 @@ -# JFrog Mission-Control Chart Changelog -All changes to this chart will be documented in this file. - -## [104.7.16] - Sep 20, 2021 -* Added missing security context in filebeat container -* Update elasticsearch version to `7.14.1` -* Added min kubeVersion ">= 1.14.0-0" in chart.yaml -* Update alpine tag version to `3.14.2` -* Update busybox tag version to `1.33.1` - -## [104.7.14] - Sep 02, 2021 -* Dropped NET_RAW capability for the containers -* Added support for new probes(set to false by default) -* Update elasticsearch version to `7.14.0` -* Updated router version to `7.25.1` - -## [104.7.12] - Aug 25, 2021 -* Added security hardening fixes -* Update router version to `7.24.1` -* Update elasticsearch version to `7.13.4` -* Enabled startup probes for k8s >= 1.20.x -* Changed network policy to allow all ingress and egress traffic -* Added support for serviceRegistry insecure flag in router -* Fixed duplicate resources Key violates YAML spec -* Added elasticsearch default java opts to `2g` -* Added support for new probes(set to false by default) - -## [104.7.11] - July 22, 2021 -* Added support for graceful shutdown of router container on SIGTERM -* Update router version to `7.21.5` -* Added elasticsearch.app.version to system.yaml -* Update elasticsearch version to `7.13.2` - -## [104.7.10] - Aug 9, 2021 -* Added support for graceful shutdown of router container on SIGTERM -* Update router version to `7.21.5` -* Added elasticsearch.app.version to system.yaml -* Update elasticsearch version to `7.13.2` -* Support global and product specific tags at the same time -* Updated readme of chart to point to wiki. Refer [Installing Mission Control](https://www.jfrog.com/confluence/display/JFROG/Installing+Mission+Control) - -## [104.7.8] - July 6, 2021 -* Update router version to `7.21.3` -* Update alpine tag version to `3.14.0` -* Add required services for router container in systemYaml - -## [104.7.7] - June 17, 2021 -* Bumping chart version to align with app version -* **Breaking change:** -* Increased default postgresql persistence size to `100Gi` -* Update postgresql tag version to `13.2.0-debian-10-r55` -* Update postgresql chart version to `10.3.18` in chart.yaml - [10.x Upgrade Notes](https://github.com/bitnami/charts/tree/master/bitnami/postgresql#to-1000) -* If this is a new deployment or you already use an external database (`postgresql.enabled=false`), these changes **do not affect you**! -* If this is an upgrade and you are using the default PostgreSQL (`postgresql.enabled=true`), you need to pass previous 9.x/10.x/12.x's postgresql.image.tag, previous postgresql.persistence.size and databaseUpgradeReady=true -* **IMPORTANT** -* This chart is only helm v3 compatible -* Update router version to `7.19.8` -* Update alpine tag version to `3.13.5` -* Fix broken support for startupProbe for k8s < 1.18.x -* Remove `prepare-storage` init container fixes openShift issue -* Added support for `nameOverride` and `fullnameOverride` in values.yaml -* Added configurable `.Values.global.versions.router` in values.yaml -* Update elasticsearch version to `7.12.1` - -## [5.8.3] - May 26, 2021 -* Update mission-Control to version `4.7.4` - [Release notes](https://www.jfrog.com/confluence/display/JFROG/Mission+Control+Release+Notes#MissionControlReleaseNotes-MissionControl4.7.4) - -## [5.8.2] - April 15, 2021 -* Update mission-Control to version `4.7.3` - [Release notes](https://www.jfrog.com/confluence/display/JFROG/Mission+Control+Release+Notes#MissionControlReleaseNotes-MissionControl4.7.3) - -## [5.8.1] - April 6, 2021 -* Update alpine tag version to `3.13.4` - -## [5.8.0] - Apr 5, 2021 -* **IMPORTANT** -* Added `charts.jfrog.io` as default JFrog Helm repository - -## [5.7.2] - Mar 31, 2021 -* Update mission-Control to version `4.7.2` - [Release notes](https://www.jfrog.com/confluence/display/JFROG/Mission+Control+Release+Notes#MissionControlReleaseNotes-MissionControl4.7.2) - -## [5.7.1] - Mar 30, 2021 -* Update router version to `7.17.2` -* Add `timeoutSeconds` to all exec probes - Please refer [here](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#configure-probes) - -## [5.7.0] - Mar 22, 2021 -* Update mission-Control to version `4.7.1` -* Update router version to `7.17.1` -* Update Elasticsearch version to `7.10.2` with Searchguard -* Add support for graceful shutdown -* Optimized startupProbe time - -## [5.6.0] - Mar 18, 2021 -* Add support to startupProbe - -## [5.5.3] - Mar 12, 2021 -* Update mission-Control to version `4.6.5` - [Release notes](https://www.jfrog.com/confluence/display/JFROG/Mission+Control+Release+Notes#MissionControlReleaseNotes-MissionControl4.6.5) - -## [5.5.2] - Mar 9, 2021 -* Removed bintray URL references in the chart -* Update router version to `7.15.3` - -## [5.5.1] - Feb 19, 2021 -* Update router version to `7.15.2` -* Update busybox tag version to `1.32.1` - -## [5.5.0] - Feb 08, 2021 -* Support for custom certificates using secrets -* **Important:** Switched docker images download from `docker.bintray.io` to `releases-docker.jfrog.io` -* Update alpine tag version to `3.13.1` -* Update router version to `7.12.6` - -## [5.4.6] - Jan 27, 2021 -* Update router version to `7.12.4` - -## [5.4.5] - Jan 25, 2021 -* Add support for hostAliases - -## [5.4.4] - Jan 18, 2021 -* Update Mission Control version to 4.6.3 -* Upgrade Elasticsearch version to 7.8.1 with Searchguard -* Added support for `.Values.elasticsearch.username` -* Added support for custom tls certificates for elastic searchguard -* **IMPORTANT** -* If the certificates are changed, rolling update is not possible. Scale down to one replica and do an helm upgrade - -## [5.4.3] - Jan 8, 2021 -* Add support for creating additional kubernetes resources - -## [5.4.2] - Dec 17, 2020 -* Update Mission Control version to 4.6.2 - -## [5.4.1] - Dec 11, 2020 -* Added configurable `.Values.global.versions.missionControl` in values.yaml - -## [5.4.0] - Dec 10, 2020 -* Update postgresql tag version to `12.5.0-debian-10-r25` -* Updated chart maintainers email - -## [5.3.4] - Dec 4, 2020 -* **Important:** Renamed `.Values.systemYaml` to `.Values.systemYamlOverride` - -## [5.3.3] - Dec 3, 2020 -* Updated port namings on services and pods to allow for istio protocol discovery - -## [5.3.2] - Nov 30, 2020 -* Update router version to `7.11.5` -* Added special notes in readme for upgrading to 5.2.x and above chart versions - -## [5.3.1] - Nov 30, 2020 -* Update Mission Control version to 4.6.1 -* Update router version to `7.11.2` - -## [5.3.0] - Nov 16, 2020 -* Update Mission Control version to 4.6.0 -* Update alpine tag version to `3.12.1` - -## [5.2.2] - Nov 10, 2020 -* Pass system.yaml via external secret for advanced usecases -* Added configurable `insightServer.clients.elasticsearch.searchguard.connectionWaitTimeoutSecs` in values.yaml -* Bugfix - stateful set not picking up changes to database secrets - -## [5.2.1] - Nov 9, 2020 -* Expose router port 8082 for inter pod communication - -## [5.2.0] - Oct 27, 2020 -* Upgrade Elasticsearch version to 7.8.0 with Searchguard -* Added configurable `insightServer.clients.elasticsearch.connectionWaitTimeoutSecs` in values.yaml -* **IMPORTANT** -* Enable Elasticsearch request via router - -## [5.1.1] - Oct 24, 2020 -* Update router version to `1.4.4` - -## [5.1.0] - Oct 13, 2020 -* **Breaking** -* Changed `insightServer.internalHttpPort` to `insightServer.internalPort` -* Add support for livenessProbe and readinessProbe for all microservices -* Updated UPGRADE_NOTES.md - Upgrading to 4.x and above charts versions - -## [5.0.5] - Oct 9, 2020 -* Add support for customInitContainersBegin - -## [5.0.4] - Oct 1, 2020 -* Added support for resources in init containers - -## [5.0.3] - Sep 29, 2020 -* Fix broken failure when using existing pvc - -## [5.0.2] - Sep 25, 2020 -* Changed insightServer.internalHttpPort to `8087` -* Changed initial replicaCount to 1 when replicacount > 1 -* Update filebeat version to `7.9.2` - -## [5.0.1] - Sep 22, 2020 -* Readme updates - -## [5.0.0] - Sep 3, 2020 -* **Breaking change:** Modified `imagePullSecrets` value from string to list. -* **Breaking change:** Added `image.registry` and changed `image.version` to `image.tag` for docker images -* Added support for global values -* Updated maintainers in chart.yaml -* Update postgresql tag version to `12.3.0-debian-10-r71` -* Update router version to `1.4.3` -* Update postgresql chart version to `9.3.4` in requirements.yaml - [9.x Upgrade Notes](https://github.com/bitnami/charts/tree/master/bitnami/postgresql#900) -* Removed redundant mcKey -* **IMPORTANT** -* If this is a new deployment or you already use an external database (`postgresql.enabled=false`), these changes **do not affect you**! -* If this is an upgrade and you are using the default PostgreSQL (`postgresql.enabled=true`), you need to pass previous 9.x or 10.x's postgresql.image.tag and databaseUpgradeReady=true - -## [4.3.2] - Aug 20, 2020 -* Support list of custom secrets. - -## [4.3.1] - Aug 13, 2020 -* Expose Elasticsearch HTTP port with the mission control service. - -## [4.3.0] - Aug 12, 2020 -* Update Mission Control version to 4.5.0 -* **IMPORTANT** -* Removed insight executor service - -## [4.2.1] - Jul 30, 2020 -* Fix broken support for External elasticsearch -* Added tpl support for resolve jfrogUrl - -## [4.2.0] - Jul 27, 2020 -* Added support for `common.customSidecarContainers` to create custom sidecar containers. -* Added support for `common.configMaps` to create custom configMaps -* Moved customVolumes,customVolumeMounts,customInitContainers under `common` -* Added README for Establishing TLS and Adding certificates. Please refer [here](https://github.com/jfrog/charts/blob/master/stable/mission-control/README.md#establishing-tls-and-adding-certificates) -* Update router version to `1.4.2` - -## [4.1.1] - Jul 20, 2020 -* Updated Mission-Control Chart to add labels from values to service, pods and controller - -## [4.1.0] - Jul 10, 2020 -* Move some postgresql values to where they should be according to the subchart -* **IMPORTANT** -* Added ChartCenter Helm repository in README - -## [4.0.1] - Jun 29, 2020 -* Added UPGRADES_NOTES.md for upgrading to 3.x/4.x chart versions - -## [4.0.0] - Jun 26, 2020 -* Update postgresql tag version to `10.13.0-debian-10-r38` -* Update alpine tag version to `3.12` -* Update busybox tag version to `1.31.1` -* **IMPORTANT** -* If this is a new deployment or you already use an external database (`postgresql.enabled=false`), these changes **do not affect you**! -* If this is an upgrade and you are using the default PostgreSQL (`postgresql.enabled=true`), you need to pass postgresql.image.tag=9.6.18-debian-10-r7 and databaseUpgradeReady=true - -## [3.4.7] - Jun 17, 2020 -* Added support for javaopts via systemyaml - -## [3.4.6] - June 15, 2020 -* Update Mission Control version to 4.4.2 - https://www.jfrog.com/confluence/display/JFROG/Mission+Control+Release+Notes#MissionControlReleaseNotes-MissionControl4.4.2 - -## [3.4.5] - June 9, 2020 -* Added support for Elasticsearch secrets - -## [3.4.4] - June 4, 2020 -* Update postgresql image tag to `9.6.18-debian-10-r7` -* Added Upgrade Notes in README for 4.x upgrades - https://github.com/jfrog/charts/blob/master/stable/mission-control/README.md#special-upgrade-notes - -## [3.4.3] - June 1, 2020 -* Update Mission Control version to 4.4.1 -* Fixes Broken upgrades of charts - use `kubectl delete statefulsets ` and run helm upgrade - -## [3.4.2] - May 25, 2020 -* Added ci test for image version change -* Added ci test for postgresql image tag -* Readme fixes - -## [3.4.1] - May 21, 2020 -* Fix image version in statefulset - -## [3.4.0] - May 19, 2020 -* Update Mission Control to version `4.4.0` - https://www.jfrog.com/confluence/display/JFROG/Mission+Control+Release+Notes#MissionControlReleaseNotes-MissionControl4.4 -* Bump router version to `1.4.0` - -## [3.3.0] - May 12, 2020 -* Support external database secrets -* **Breaking change:** Use single user/password for all services for both internal/external databases. - -## [3.2.1] - April 26, 2020 -* Added `elasticsearch.configureDockerHost` parameter to enable control over running of privileged containers (init-elasticsearch) - -## [3.2.0] - Apr 21, 2020 -* Upgrade Elasticsearch version to 7.6.1 -* Upgrade Mission Control version to 4.3.2 -* Bump postgresql tag version to `9.6.17-debian-10-r72` in values.yaml -* Bump router version to `1.3.0` -* **NOTE:** If you have externalized elasticsearch, please upgrade your elasticsearch to 7.6.1 to work with Mission Control 4.3.x. Mission Control version 4.3.x and above is not compatible with Elasticsearch version 6.x. -* **NOTE:** Mission Control version 4.3.2 is compatible with Artifactory 7.4.1 and above. Refer Mission Control release notes for more details - https://www.jfrog.com/confluence/display/JFROG/Mission+Control+Release+Notes#MissionControlReleaseNotes-MissionControl4.3.2. - -## [3.1.1] - April 13, 2020 -* Update README with helm v3 commands - -## [3.1.0] - April 10, 2020 -* Use dependency charts from `https://charts.bitnami.com/bitnami` -* Bump postgresql chart version to `8.7.3` in requirements.yaml -* Bump postgresql tag version to `9.6.17-debian-10-r21` in values.yaml - -## [3.0.23] - April 3, 2020 -* Support masterKey and joinKey as secrets -* Support `masterKey` (previously `mcKey`) in values.yaml - -## [3.0.22] - Mar 30, 2020 -* Readme fixes - -## [3.0.21] - Mar 23, 2020 -* Use `postgresqlExtendedConf` for setting custom PostgreSQL configuration (instead of `postgresqlConfiguration`) - -## [3.0.20] - Mar 17, 2020 -* Changed all single quotes to double quotes in values files - -## [3.0.19] - Mar 11, 2020 -* Unified charts public release - -## [3.0.18] - Mar 9, 2020 -* Removed unused `ingress` code + fixes - -## [3.0.17] - Mar 9, 2020 -* Fix `elasticsearch` indentation in `system.yaml` file - -## [3.0.16] - Mar 4, 2020 -* Add support for disabling `consoleLog` in `system.yaml` file -* Add support for database secrets - -## [3.0.15] - Feb 27, 2020 -* Add an annotation with the checksum of the `system.yaml` file to make sure the pods restart after a configuration change - -## [3.0.14] - Feb 26, 2020 -* Fix path of mission-control entrypoint - -## [3.0.12] - Feb 24, 2020 -* Update Mission Control to version `4.2.0` - -## [1.1.17] - Feb 13, 2020 -* Add support for `ingress.additionalRules` and `ingress.defaultBackend` - -## [1.1.16] - Feb 11, 2020 -* Use a with clause for `preStartCommand`, `customVolumes` and `customVolumeMounts` - -## [1.1.15] - Feb 6, 2020 -* Fix init containers resources - -## [1.1.14] - Feb 2, 2020 -* Add a comment stating that it is recommended to use an external PostgreSQL with a static password for production installations - -## [1.1.13] - Jan 30, 2020 -* Add the option to configure resources for the logger containers - -## [1.1.12] - Jan 22, 2020 -* Add support for providing resources to the init containers and the insight container - -## [1.1.11] - Jan 19, 2020 -* Update Mission-Control version to 3.5.6 - -## [1.1.10] - Nov 21, 2019 -* Support missionControl.preStartCommand for running command before entrypoint starts - -## [1.1.9] - Nov 20, 2019 -* Update Mission-Control logo - -## [1.1.8] - Nov 12, 2019 -* Add annotation options to Mission-Control service - -## [1.1.7] - Nov 11, 2019 -* Update Mission-Control version to 3.5.5 - -## [1.1.6] - Sep 23, 2019 -* Update Mission-Control version to 3.5.4 - -## [1.1.5] - Jul 22, 2019 -* Change Ingress API to be compatible with recent kubernetes versions - -## [1.1.4] - Jun 24, 2019 -* Update chart maintainers - -## [1.1.3] - Jun 23, 2019 -* Add values files for small, medium and large installations - -## [1.1.2] - Jun 3, 2019 -* Update Mission-Control version to 3.5.3 -* Use correct key to specify UpdateStrategy -* Update apiVersion to apps/v1 - -## [1.1.1] - May 20, 2019 -* Fix missing logger image tag - -## [1.1.0] - May 10, 2019 -* Added support for `missionControl.customVolumeMounts` and `missionControl.customVolumes` to create custom volume mounts - -## [1.0.6] - Apr 17, 2019 -* Update Mission-Control version to 3.5.2 - -## [1.0.5] - Apr 9, 2019 -* Update Mission-Control version to 3.5.1 - -## [1.0.4] - Apr 7, 2019 -* Add network policy support - -## [1.0.3] - Apr 4, 2019 -* Add information about upgrading mission-control with auto-generated postgres password - -## [1.0.2] - Apr 4, 2019 -* Change mission-control auto-generated DB password to update the password on every startup - -## [1.0.1] - Apr 1, 2019 -* Fix error of missing volume when `missionControl.persistence` is disabled - -## [1.0.0] - Mar 28, 2019 -* **NOTE:** This chart is not compatible with older versions and should not be used to upgrade them. See README for more details on upgrades -* Updated Mission Control version to 3.5.0 -* HA support for Mission Control and elasticsearch with Statefulset -* Elasticsearch now part of Mission Control template -* New Elasticsearch (6.6.0) with searchguard plugin enabled - -## [0.9.4] - Mar 26, 2019 -* Add default auto-generated random password for mission control database users - -## [0.9.3] - Mar 15, 2019 -* Revert securityContext change that was causing issues - -## [0.9.2] - Mar 14, 2019 -* Move securityContext to container level - -## [0.9.1] - Mar 14, 2019 -* Updated Mission-Control version to 3.4.3 - -## [0.9.0] - Feb 28, 2019 -* Support loggers sidecars to tail a configured log - -## [0.8.1] - Feb 20, 2019 -* Update Mission-Control Readme with new database details - -## [0.8.0] - Feb 19, 2019 -* Update Mission-Control version 3.4.2 -* Move to using PostgreSQL as Mission-Control database (replace MongoDB) -* Move setup of database from post install hook to init container of corresponding deployment -* **NOTE:** For upgrading an existing deployment (pre 3.4.2), Mission-Control must be installed with both databases: MongoDB and PostgreSQL -* **UPGRADE NOTES:** For upgrading an existing deployment (pre 3.4.2), follow the following: - * Pass `--set mongodb.enabled=true` to the `helm upgrade command`. - * Mission-Control should be idle. - * New Mission-Control must be installed with both databases: MongoDB and PostgreSQL - * Upgrade to new version (3.4.2) with the following parameter for the upgrade process `helm upgrade .... --set mongodb.enabled=true ....` - * Once Mission-Control is up - it means the migration from MongoDB to PostgreSQL is done! - -## [0.7.3] - Jan 31, 2019 -* Add 0.5G to all memory limits for java services to be higher than java xmx value - -## [0.7.2] - Jan 23, 2019 -* Added support for `missionControl.customInitContainers` to create custom init containers - -## [0.7.1] - Dec 17, 2018 -* Updated Mission-Control version to 3.3.2 - -## [0.7.0] - Nov 16, 2018 -* Updated Mission-Control version to 3.3.0 -* Remove usage of certificates for internal communication - -## [0.6.0] - Oct 18, 2018 -* Updated Mission-Control version to 3.2.0 -* This chart version (0.6.0) cannot be used to deploy older versions of Mission Control (less than or equal to 3.1.2) - -## [0.5.2] - Oct 17, 2018 -* Add Apache 2.0 license - -## [0.5.1] - Oct 16, 2018 -* Fix #67 Set password used to generate internal certs in Mission-Control - -## [0.5.0] - Oct 14, 2018 -* Upgrade MongoDB version (chart 4.3.10, app 3.6.8-debian-9) - -## [0.4.5] - Oct 9, 2018 -* Quote ingress hosts to support wildcard names - -## [0.4.4] - Oct 2, 2018 -* Add `helm repo add jfrog https://charts.jfrog.io` to README - -## [0.4.3] - Sep 6, 2018 -* Option to set Java `Xms` and `Xmx` for Insight scheduler and executor - -## [0.4.2] - Aug 23, 2018 -* Updated Mission-Control version to 3.1.2 - -## [0.4.1] - Aug 22, 2018 -* Enabled RBAC Support -* Using secrets for credentials -* Updated Mission-Control version to 3.1.1 -* Changed deployment api to apps/v1beta2 -* Made postInstallHook image configurable diff --git a/stable/mission-control/Chart.lock b/stable/mission-control/Chart.lock deleted file mode 100644 index 75d82ee6c..000000000 --- a/stable/mission-control/Chart.lock +++ /dev/null @@ -1,6 +0,0 @@ -dependencies: -- name: postgresql - repository: https://charts.bitnami.com/bitnami - version: 10.3.18 -digest: sha256:0f05940ac62e827e3f5f7bfe513e3880576cbe6b8cc234d0f26a146c6d4e8ece -generated: "2021-04-23T11:36:16.206454+05:30" diff --git a/stable/mission-control/Chart.yaml b/stable/mission-control/Chart.yaml deleted file mode 100644 index 206939168..000000000 --- a/stable/mission-control/Chart.yaml +++ /dev/null @@ -1,22 +0,0 @@ -apiVersion: v2 -appVersion: 4.7.16 -dependencies: -- condition: postgresql.enabled - name: postgresql - repository: https://charts.bitnami.com/bitnami - version: 10.3.18 -description: A Helm chart for JFrog Mission Control -home: https://jfrog.com/mission-control/ -icon: https://raw.githubusercontent.com/jfrog/charts/master/stable/mission-control/logo/jfmc-logo.png -keywords: -- mission-control -- jfrog -kubeVersion: '>= 1.14.0-0' -maintainers: -- email: installers@jfrog.com - name: Chart Maintainers at JFrog -name: mission-control -sources: -- https://github.com/jfrog/charts -type: application -version: 104.7.16 diff --git a/stable/mission-control/LICENSE b/stable/mission-control/LICENSE deleted file mode 100644 index 8dada3eda..000000000 --- a/stable/mission-control/LICENSE +++ /dev/null @@ -1,201 +0,0 @@ - Apache License - Version 2.0, January 2004 - http://www.apache.org/licenses/ - - TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION - - 1. Definitions. - - "License" shall mean the terms and conditions for use, reproduction, - and distribution as defined by Sections 1 through 9 of this document. - - "Licensor" shall mean the copyright owner or entity authorized by - the copyright owner that is granting the License. - - "Legal Entity" shall mean the union of the acting entity and all - other entities that control, are controlled by, or are under common - control with that entity. For the purposes of this definition, - "control" means (i) the power, direct or indirect, to cause the - direction or management of such entity, whether by contract or - otherwise, or (ii) ownership of fifty percent (50%) or more of the - outstanding shares, or (iii) beneficial ownership of such entity. - - "You" (or "Your") shall mean an individual or Legal Entity - exercising permissions granted by this License. - - "Source" form shall mean the preferred form for making modifications, - including but not limited to software source code, documentation - source, and configuration files. - - "Object" form shall mean any form resulting from mechanical - transformation or translation of a Source form, including but - not limited to compiled object code, generated documentation, - and conversions to other media types. - - "Work" shall mean the work of authorship, whether in Source or - Object form, made available under the License, as indicated by a - copyright notice that is included in or attached to the work - (an example is provided in the Appendix below). - - "Derivative Works" shall mean any work, whether in Source or Object - form, that is based on (or derived from) the Work and for which the - editorial revisions, annotations, elaborations, or other modifications - represent, as a whole, an original work of authorship. For the purposes - of this License, Derivative Works shall not include works that remain - separable from, or merely link (or bind by name) to the interfaces of, - the Work and Derivative Works thereof. - - "Contribution" shall mean any work of authorship, including - the original version of the Work and any modifications or additions - to that Work or Derivative Works thereof, that is intentionally - submitted to Licensor for inclusion in the Work by the copyright owner - or by an individual or Legal Entity authorized to submit on behalf of - the copyright owner. For the purposes of this definition, "submitted" - means any form of electronic, verbal, or written communication sent - to the Licensor or its representatives, including but not limited to - communication on electronic mailing lists, source code control systems, - and issue tracking systems that are managed by, or on behalf of, the - Licensor for the purpose of discussing and improving the Work, but - excluding communication that is conspicuously marked or otherwise - designated in writing by the copyright owner as "Not a Contribution." - - "Contributor" shall mean Licensor and any individual or Legal Entity - on behalf of whom a Contribution has been received by Licensor and - subsequently incorporated within the Work. - - 2. Grant of Copyright License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - copyright license to reproduce, prepare Derivative Works of, - publicly display, publicly perform, sublicense, and distribute the - Work and such Derivative Works in Source or Object form. - - 3. Grant of Patent License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - (except as stated in this section) patent license to make, have made, - use, offer to sell, sell, import, and otherwise transfer the Work, - where such license applies only to those patent claims licensable - by such Contributor that are necessarily infringed by their - Contribution(s) alone or by combination of their Contribution(s) - with the Work to which such Contribution(s) was submitted. If You - institute patent litigation against any entity (including a - cross-claim or counterclaim in a lawsuit) alleging that the Work - or a Contribution incorporated within the Work constitutes direct - or contributory patent infringement, then any patent licenses - granted to You under this License for that Work shall terminate - as of the date such litigation is filed. - - 4. Redistribution. You may reproduce and distribute copies of the - Work or Derivative Works thereof in any medium, with or without - modifications, and in Source or Object form, provided that You - meet the following conditions: - - (a) You must give any other recipients of the Work or - Derivative Works a copy of this License; and - - (b) You must cause any modified files to carry prominent notices - stating that You changed the files; and - - (c) You must retain, in the Source form of any Derivative Works - that You distribute, all copyright, patent, trademark, and - attribution notices from the Source form of the Work, - excluding those notices that do not pertain to any part of - the Derivative Works; and - - (d) If the Work includes a "NOTICE" text file as part of its - distribution, then any Derivative Works that You distribute must - include a readable copy of the attribution notices contained - within such NOTICE file, excluding those notices that do not - pertain to any part of the Derivative Works, in at least one - of the following places: within a NOTICE text file distributed - as part of the Derivative Works; within the Source form or - documentation, if provided along with the Derivative Works; or, - within a display generated by the Derivative Works, if and - wherever such third-party notices normally appear. The contents - of the NOTICE file are for informational purposes only and - do not modify the License. You may add Your own attribution - notices within Derivative Works that You distribute, alongside - or as an addendum to the NOTICE text from the Work, provided - that such additional attribution notices cannot be construed - as modifying the License. - - You may add Your own copyright statement to Your modifications and - may provide additional or different license terms and conditions - for use, reproduction, or distribution of Your modifications, or - for any such Derivative Works as a whole, provided Your use, - reproduction, and distribution of the Work otherwise complies with - the conditions stated in this License. - - 5. Submission of Contributions. Unless You explicitly state otherwise, - any Contribution intentionally submitted for inclusion in the Work - by You to the Licensor shall be under the terms and conditions of - this License, without any additional terms or conditions. - Notwithstanding the above, nothing herein shall supersede or modify - the terms of any separate license agreement you may have executed - with Licensor regarding such Contributions. - - 6. Trademarks. This License does not grant permission to use the trade - names, trademarks, service marks, or product names of the Licensor, - except as required for reasonable and customary use in describing the - origin of the Work and reproducing the content of the NOTICE file. - - 7. Disclaimer of Warranty. Unless required by applicable law or - agreed to in writing, Licensor provides the Work (and each - Contributor provides its Contributions) on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or - implied, including, without limitation, any warranties or conditions - of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A - PARTICULAR PURPOSE. You are solely responsible for determining the - appropriateness of using or redistributing the Work and assume any - risks associated with Your exercise of permissions under this License. - - 8. Limitation of Liability. In no event and under no legal theory, - whether in tort (including negligence), contract, or otherwise, - unless required by applicable law (such as deliberate and grossly - negligent acts) or agreed to in writing, shall any Contributor be - liable to You for damages, including any direct, indirect, special, - incidental, or consequential damages of any character arising as a - result of this License or out of the use or inability to use the - Work (including but not limited to damages for loss of goodwill, - work stoppage, computer failure or malfunction, or any and all - other commercial damages or losses), even if such Contributor - has been advised of the possibility of such damages. - - 9. Accepting Warranty or Additional Liability. While redistributing - the Work or Derivative Works thereof, You may choose to offer, - and charge a fee for, acceptance of support, warranty, indemnity, - or other liability obligations and/or rights consistent with this - License. However, in accepting such obligations, You may act only - on Your own behalf and on Your sole responsibility, not on behalf - of any other Contributor, and only if You agree to indemnify, - defend, and hold each Contributor harmless for any liability - incurred by, or claims asserted against, such Contributor by reason - of your accepting any such warranty or additional liability. - - END OF TERMS AND CONDITIONS - - APPENDIX: How to apply the Apache License to your work. - - To apply the Apache License to your work, attach the following - boilerplate notice, with the fields enclosed by brackets "{}" - replaced with your own identifying information. (Don't include - the brackets!) The text should be enclosed in the appropriate - comment syntax for the file format. We also recommend that a - file or class name and description of purpose be included on the - same "printed page" as the copyright notice for easier - identification within third-party archives. - - Copyright {yyyy} {name of copyright owner} - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. diff --git a/stable/mission-control/README.md b/stable/mission-control/README.md deleted file mode 100644 index 47f3044ff..000000000 --- a/stable/mission-control/README.md +++ /dev/null @@ -1,53 +0,0 @@ -# JFrog Mission-Control Helm Chart - -**IMPORTANT!** Our Helm Chart docs have moved to our main documentation site. Below you will find the basic instructions for installing Mission Control. For all other information, refer to [Installing Mission Control](https://www.jfrog.com/confluence/display/JFROG/Installing+Mission+Control). - -## Prerequisites Details - -* Kubernetes 1.12+ - -## Chart Details -This chart will do the following: - -* Deploy PostgreSQL database **NOTE:** For production grade installations it is recommended to use an external PostgreSQL. -* Deploy Elasticsearch. -* Deploy Mission Control. - -## Requirements -- A running Kubernetes cluster -- Dynamic storage provisioning enabled -- Default StorageClass set to allow services using the default StorageClass for persistent storage -- A running Artifactory Enterprise -- [Kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/) installed and setup to use the cluster -- [Helm](https://helm.sh/) installed and setup to use the cluster (helm init) - -## Installing the Chart - -### Add the JFrog Helm Repository -Before installing JFrog helm charts, you will need to add the [JFrog helm repository](https://charts.jfrog.io) to your Helm client. - -```bash -helm repo add jfrog https://charts.jfrog.io -helm repo update -``` - -### Artifactory Connection Details -To connect Mission Control to your Artifactory installation, you will need to use a join key. To learn how to retrieve the connection details of your Artifactory installation (join key and JFrog URL) from the UI, see https://www.jfrog.com/confluence/display/JFROG/General+Security+Settings#GeneralSecuritySettings-ViewingtheJoinKey. - -### Initiate Installation -Provide a join key and the JFrog URL as a parameter to the Mission Control chart installation: - -```bash -helm upgrade --install mission-control --set missionControl.joinKey= \ - --set missionControl.jfrogUrl= --namespace mission-control jfrog/mission-control -``` - -## Uninstalling the Chart - -Uninstall is supported only on Helm v3 and on. - -Uninstall Mission-control using the following command. - -```bash -helm uninstall mission-control && sleep 90 && kubectl delete pvc -l app=mission-control -``` diff --git a/stable/mission-control/UPGRADE_NOTES.md b/stable/mission-control/UPGRADE_NOTES.md deleted file mode 100644 index 7edac8d95..000000000 --- a/stable/mission-control/UPGRADE_NOTES.md +++ /dev/null @@ -1,44 +0,0 @@ -# JFrog Mission-Control Chart Upgrade Notes -This file describes special upgrade notes needed at specific versions - -## Upgrade from 1.x/2.x to 3.x and above (Chart Versions) - -* To upgrade chart version to 3.x and above, you must be on chart version 1.0.5 or above as described in https://github.com/jfrog/charts/blob/master/stable/mission-control/CHANGELOG.md. -* Data other than your licenses, such as your service information and insight, will not be available after the upgrade. -* JFrog Mission Control v4.x is only compatible with JFrog Artifactory v7.x. To upgrade, you must first install JFrog Artifactory 7.x. -* To know more about upgrading mission control, please refer -> https://www.jfrog.com/confluence/display/JFROG/Upgrading+Mission+Control#UpgradingMissionControl-UpgradingfromVersion3.5.1to4.x - -**DOWNTIME IS REQUIRED FOR AN UPGRADE!** - -* Data export is done with a migration script jfmcDataExport.sh (available under files directory in mission-control chart). - -* Upgrade steps: -1. Stop old mission-control pod (scale down replicas to 0). Postgresql still exists - ```bash - $ kubectl scale statefulsets -mission-control --replicas=0 - ``` -2. Export data from old postgresql instance - 1. Connect to the old PostgreSQL pod (you can obtain the name by running kubectl get pods) - ```bash - $ kubectl exec -it -postgresql bash - ``` - 2. Copy the jfmcDataExport.sh file and run the following commands - ```bash - $ kubectl cp ./jfmcDataExport.sh -postgresql:/tmp/jfmcDataExport.sh - $ chown postgres:postgres /tmp/jfmcDataExport.sh - $ su postgres -c "PGPASSWORD=password bash /tmp/jfmcDataExport.sh --output=/tmp" - if you are on 2x charts(operating system user postgres is not there) run ./jfmcDataExport.sh --output=/tmp and provide jfmc user password - ``` - 3. Copy the exported file to your local system. - ```bash - $ kubectl cp -postgresql:/tmp/jfmcDataExport.tar.gz ./jfmcDataExport.tar.gz - ``` -3. Install new mission-control(4x) and copy the exported file - 1. Run the `helm install` with the `new version` say `mission-control-new` - 2. Copy the exported tar file to the new mission-control pod - ```bash - $ kubectl cp ./jfmcDataExport.tar.gz -mission-control:/opt/jfrog/mc/var/bootstrap/mc/jfmcDataExport.tar.gz -c mission-control - ``` - 3. Restart the mission-control new pod - 4. Validate that the import was successful. The filename should be renamed to jfmcDataExport.tar.gz.done. It will be renamed to jfmcDataExport.tar.gz.failed if the import procedure has failed. -4. Run `helm delete ` which will remove remove old Mission-control deployment and Helm release. diff --git a/stable/mission-control/ci/default-values.yaml b/stable/mission-control/ci/default-values.yaml deleted file mode 100644 index 2a874c48d..000000000 --- a/stable/mission-control/ci/default-values.yaml +++ /dev/null @@ -1,22 +0,0 @@ -# Leave this file empty to ensure that CI runs builds against the default configuration in values.yaml. -# If this is an upgrade over an existing Mission Control 4.x, explicitly pass 'unifiedUpgradeAllowed=true' to upgrade -unifiedUpgradeAllowed: true -databaseUpgradeReady: true -missionControl: - jfrogUrl: http://artifactory.rt:8082 - persistence: - enabled: false -# To Fix ct tool --reuse-values - PASSWORDS ERROR: you must provide your current passwords when upgrade the release -postgresql: - postgresqlPassword: password - db: - password: password - persistence: - enabled: false - -elasticsearch: - persistence: - enabled: false - javaOpts: - xms: "2g" - xmx: "2g" diff --git a/stable/mission-control/ci/global-section-values.yaml b/stable/mission-control/ci/global-section-values.yaml deleted file mode 100644 index f55d4a93a..000000000 --- a/stable/mission-control/ci/global-section-values.yaml +++ /dev/null @@ -1,123 +0,0 @@ -unifiedUpgradeAllowed: true -databaseUpgradeReady: true -missionControl: - persistence: - enabled: false -postgresql: - postgresqlPassword: password - db: - password: password - persistence: - enabled: false - -elasticsearch: - persistence: - enabled: false - javaOpts: - xms: "2g" - xmx: "2g" - -global: - jfrogUrl: http://artifactory.rt:8082 - masterKey: bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb - joinKey: EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE - customInitContainersBegin: | - - name: "custom-init-begin-global" - image: "{{ .Values.initContainerImage }}" - imagePullPolicy: "{{ .Values.imagePullPolicy }}" - command: - - 'sh' - - '-c' - - 'touch {{ .Values.missionControl.persistence.mountPath }}/init-begin-global' - volumeMounts: - - mountPath: "{{ .Values.missionControl.persistence.mountPath }}" - name: mission-control-data - customVolumes: | - - name: custom-volume-global - emptyDir: - sizeLimit: 100Mi - customVolumeMounts: | - - name: custom-volume-global - mountPath: "/scriptsglobal" - customInitContainers: | - - name: "custom-init-global" - image: "{{ .Values.initContainerImage }}" - imagePullPolicy: "{{ .Values.imagePullPolicy }}" - command: - - 'sh' - - '-c' - - 'touch {{ .Values.missionControl.persistence.mountPath }}/init-global' - volumeMounts: - - mountPath: "{{ .Values.missionControl.persistence.mountPath }}" - name: mission-control-data - customSidecarContainers: | - - name: "sidecar-list-global" - image: "{{ .Values.initContainerImage }}" - imagePullPolicy: "{{ .Values.imagePullPolicy }}" - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - NET_RAW - command: ["sh","-c","echo 'Sidecar is running in global' >> /scriptsglobal/sidecar.txt; cat /scriptsglobal/sidecar.txt; while true; do sleep 30; done"] - volumeMounts: - - mountPath: "/scriptsglobal" - name: custom-volume-global - resources: - requests: - memory: "32Mi" - cpu: "50m" - limits: - memory: "128Mi" - cpu: "100m" - -common: - customInitContainersBegin: | - - name: "custom-init-begin-local" - image: "{{ .Values.initContainerImage }}" - imagePullPolicy: "{{ .Values.imagePullPolicy }}" - command: - - 'sh' - - '-c' - - 'touch {{ .Values.missionControl.persistence.mountPath }}/init-begin-local' - volumeMounts: - - mountPath: "{{ .Values.missionControl.persistence.mountPath }}" - name: mission-control-data - customVolumes: | - - name: custom-volume-local - emptyDir: - sizeLimit: 100Mi - customVolumeMounts: | - - name: custom-volume-local - mountPath: "/scriptslocal" - customInitContainers: | - - name: "custom-init-local" - image: "{{ .Values.initContainerImage }}" - imagePullPolicy: "{{ .Values.imagePullPolicy }}" - command: - - 'sh' - - '-c' - - 'touch {{ .Values.missionControl.persistence.mountPath }}/init-local' - volumeMounts: - - mountPath: "{{ .Values.missionControl.persistence.mountPath }}" - name: mission-control-data - customSidecarContainers: | - - name: "sidecar-list-local" - image: "{{ .Values.initContainerImage }}" - imagePullPolicy: "{{ .Values.imagePullPolicy }}" - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - NET_RAW - command: ["sh","-c","echo 'Sidecar is running in local' >> /scriptslocal/sidecar.txt; cat /scriptslocal/sidecar.txt; while true; do sleep 30; done"] - volumeMounts: - - mountPath: "/scriptslocal" - name: custom-volume-local - resources: - requests: - memory: "32Mi" - cpu: "50m" - limits: - memory: "128Mi" - cpu: "100m" diff --git a/stable/mission-control/ci/ha-values.yaml b/stable/mission-control/ci/ha-values.yaml deleted file mode 100644 index 9350aa49c..000000000 --- a/stable/mission-control/ci/ha-values.yaml +++ /dev/null @@ -1,26 +0,0 @@ -# CI values for Mission-control - -# If this is an upgrade over an existing Mission Control 4.x, explicitly pass 'unifiedUpgradeAllowed=true' to upgrade -unifiedUpgradeAllowed: true -databaseUpgradeReady: true -missionControl: - jfrogUrl: http://artifactory.rt:8082 - persistence: - enabled: false - -postgresql: - postgresqlPassword: password - db: - password: password - persistence: - enabled: false - -elasticsearch: - persistence: - enabled: false - javaOpts: - xms: "2g" - xmx: "2g" - -# For HA -replicaCount: 2 diff --git a/stable/mission-control/ci/test-values.yaml b/stable/mission-control/ci/test-values.yaml deleted file mode 100644 index 169d605f3..000000000 --- a/stable/mission-control/ci/test-values.yaml +++ /dev/null @@ -1,39 +0,0 @@ -# CI values for Mission-control. - -# If this is an upgrade over an existing Mission Control 4.x, explicitly pass 'unifiedUpgradeAllowed=true' to upgrade -unifiedUpgradeAllowed: true -databaseUpgradeReady: true -missionControl: - jfrogUrl: http://artifactory.rt:8082 - javaOpts: - other: "-server -XX:+UseG1GC -Dfile.encoding=UTF8" - xms: "500m" - xmx: "1000m" - persistence: - enabled: false - -insightServer: - javaOpts: - xms: "500m" - xmx: "1000m" - -insightScheduler: - javaOpts: - xms: "500m" - xmx: "1000m" - -postgresql: - image: - tag: 9.6.15-debian-9-r91 - postgresqlPassword: password - db: - password: password - persistence: - enabled: false - -elasticsearch: - persistence: - enabled: false - javaOpts: - xms: "2g" - xmx: "2g" diff --git a/stable/mission-control/files/jfmcDataExport.sh b/stable/mission-control/files/jfmcDataExport.sh deleted file mode 100644 index e4a908929..000000000 --- a/stable/mission-control/files/jfmcDataExport.sh +++ /dev/null @@ -1,452 +0,0 @@ -#! /bin/bash -# This can be used to export JFrog Mission Control data for migration from Mission Control 3.5.1+ to 4.x - -set -e - -# default values -TEMP_FOLDER= # Will be defined during init -OUTPUT_DIR=. -OUTPUT_FILE= # Will be defined during init -DB_USER_NAME=jfmc -DB_HOST=127.0.0.1 -DB_PORT=5432 -DB_DATABASE_NAME=mission_control -DB_DATABASE_SCHEMA=jfmc_server -VERBOSE_MODE=false - - -# ..... _logger.sh ...... -# REF https://misc.flogisoft.com/bash/tip_colors_and_formatting -cClear="\e[0m" -cBlue="\e[38;5;69m" -cRedDull="\e[1;31m" -cYellow="\e[1;33m" -cRedBright="\e[38;5;197m" - - -_loggerGetMode() { - local MODE="$1" - case $MODE in - INFO) - printf "${cBlue}%s%-5s%s${cClear}" "[" "${MODE}" "]" - ;; - DEBUG) - printf "%-7s" "[${MODE}]" - ;; - WARN) - printf "${cRedDull}%s%-5s%s${cClear}" "[" "${MODE}" "]" - ;; - ERROR) - printf "${cRedBright}%s%-5s%s${cClear}" "[" "${MODE}" "]" - ;; - esac -} - -# Capitalises the first letter of the message -_loggerGetMessage() { - local originalMessage="$*" - local firstChar=$(echo "${originalMessage:0:1}" | awk '{ print toupper($0) }') - local resetOfMessage="${originalMessage:1}" - echo "$firstChar$resetOfMessage" -} - -# The spec also says content should be left-trimmed but this is not necessary in our case. We don't reach the limit. -_loggerGetStackTrace() { - printf "%s%-30s%s" "[" "$1:$2" "]" -} - -_loggerGetThread() { - printf "%s" "[main]" -} - -_loggerGetServiceType() { - printf "%s%-5s%s" "[" "shell" "]" -} - -#Trace ID is not applicable to scripts -_loggerGetTraceID() { - printf "%s" "[]" -} - -# The date binary works differently based on whether it is GNU/BSD -is_date_supported=0 -date --version > /dev/null 2>&1 || is_date_supported=1 -IS_GNU=$(echo $is_date_supported) - -_loggerGetTimestamp() { - if [ "${IS_GNU}" == "0" ]; then - echo -n $(date -u +%FT%T.%3NZ) - else - echo -n $(date -u +%FT%T.000Z) - fi -} - -logger() { - if [ -z "$CONTEXT" ] - then - CONTEXT=$(caller) - fi - local MESSAGE="$1" - local MODE=${2-"INFO"} - local SERVICE_TYPE="script" - local TRACE_ID="" - local THREAD="main" - - local CONTEXT_LINE=$(echo "$CONTEXT" | awk '{print $1}') - local CONTEXT_FILE=$(echo "$CONTEXT" | awk -F"/" '{print $NF}') - - # To comply with logging standards - printf "%s\n" "$(_loggerGetTimestamp) $(_loggerGetServiceType) $(_loggerGetMode $MODE) $(_loggerGetTraceID) $(_loggerGetStackTrace $CONTEXT_FILE $CONTEXT_LINE) $(_loggerGetThread) - $(_loggerGetMessage $MESSAGE)" - - CONTEXT= -} - -logDebug(){ - VERBOSE_MODE=${VERBOSE_MODE-"false"} - CONTEXT=$(caller) - if [ ${VERBOSE_MODE} == "true" ];then - logger "$1" "DEBUG" - else - logger "$1" "DEBUG" >&6 - fi - CONTEXT= -} - -logError() { - CONTEXT=$(caller) - logger "$1" "ERROR" - CONTEXT= -} - -errorExit () { - logError "$1" "ERROR" - exit 1 -} - -warn () { - CONTEXT=$(caller) - logger "$1" "WARN" - CONTEXT= -} - -note () { - CONTEXT=$(caller) - logger "$1" "NOTE" - CONTEXT= -} - -bannerStart() { - title=$1 - echo - echo -e "\033[1m${title}\033[0m" - echo -} - -bannerSection() { - title=$1 - echo - echo -e "******************************** ${title} ********************************" - echo -} - -bannerSubSection() { - title=$1 - echo - echo -e "************** ${title} *******************" - echo -} - -bannerMessge() { - title=$1 - echo - echo -e "********************************" - echo -e "${title}" - echo -e "********************************" - echo -} - -setRed () { - local input="$1" - echo -e \\033[31m${input}\\033[0m -} -setGreen () { - local input="$1" - echo -e \\033[32m${input}\\033[0m -} -setYellow () { - local input="$1" - echo -e \\033[33m${input}\\033[0m -} - -logger_addLinebreak () { - echo -e "---\n" -} - -bannerImportant() { - title=$1 - echo - echo -e "######################################## IMPORTANT ########################################" - echo -e "\033[1m${title}\033[0m" - echo -e "###########################################################################################" - echo -} - -bannerEnd() { - #TODO pass a title and calculate length dynamically so that start and end look alike - echo - echo "*****************************************************************************" - echo -} - -banner() { - title=$1 - content=$2 - bannerStart "${title}" - echo -e "$content" -} - -# The logic below helps us redirect content we'd normally hide to the log file. - # - # We have several commands which clutter the console with output and so use - # `cmd > /dev/null` - this redirects the command's output to null. - # - # However, the information we just hid maybe useful for support. Using the code pattern - # `cmd >&6` (instead of `cmd> >/dev/null` ), the command's output is hidden from the console - # but redirected to the installation log file - # - -#Default value of 6 is just null -exec 6>>/dev/null -redirectLogsToFile() { - echo "" - # local file=$1 - - # [ ! -z "${file}" ] || return 0 - - # local logDir=$(dirname "$file") - - # if [ ! -f "${file}" ]; then - # [ -d "${logDir}" ] || mkdir -p ${logDir} || \ - # ( echo "WARNING : Could not create parent directory (${logDir}) to redirect console log : ${file}" ; return 0 ) - # fi - - # #6 now points to the log file - # exec 6>>${file} - # #reference https://unix.stackexchange.com/questions/145651/using-exec-and-tee-to-redirect-logs-to-stdout-and-a-log-file-in-the-same-time - # exec 2>&1 > >(tee -a "${file}") -} - - -# Utility method to strip away codes -_codeStripper() { - # Some possible codes [39m, [33m, [1m - echo "$*" | sed 's/\[[0-9]\{1,\}m//g' -} - - -# Output from application's logs are piped to this method. It checks a configuration variable to determine if content should be logged to -# the common console.log file -redirectServiceLogsToFile() { - - local result="0" - # check if the function getSystemValue exists - LC_ALL=C type getSystemValue > /dev/null 2>&1 || result="$?" - if [[ "$result" != "0" ]]; then - warn "Couldn't find the systemYamlHelper. Skipping log redirection" - return 0 - fi - - getSystemValue "shared.consoleLog" "NOT_SET" - if [[ "${YAML_VALUE}" == "false" ]]; then - logger "Redirection is set to false. Skipping log redirection" - return 0; - fi - - if [ -z "${JF_PRODUCT_HOME}" ] || [ "${JF_PRODUCT_HOME}" == "" ]; then - warn "JF_PRODUCT_HOME is unavailable. Skipping log redirection" - return 0 - fi - - local targetFile="${JF_PRODUCT_HOME}/var/log/console.log" - - if [ ! -f ${targetFile} ]; then - mkdir -p "${JF_PRODUCT_HOME}/var/log" || return 0 - touch $targetFile - fi - - while read -r line; do - printf '%s\n' "${line}" >> $targetFile || return 0 # Don't want to log anything - might clutter the screen - done -} -# ..... _logger.sh ..... - -logInfo() { - CONTEXT=$(caller) - logger "$1" "INFO" - CONTEXT= -} - -usage() { - cat << END_USAGE - -jfmcDataExport.sh - Export JFrog Mission Control data for migration from Mission Control 3.5.1+ to 4.x. - -Usage: jfmcDataExport.sh [OPTION]... - -Options: - --host=HOST database server host (default: "127.0.0.1") - --port=PORT database server port (default: "5432") - --user=USER database user name (default: "jfmc") - --database=DATABASE database name to connect to (default: "mission_control") - --schema=SCHEMA database schema name to connect to (default: "jfmc_server") - --output=OUTPUT path to output dir where jfmcDataExport.tar.gz will be created (default: ".") - --verbose show detailed output logs - -h, --help show this help, then exit - -In case psql binary cannot be found in path, POSTGRES_PATH environment variable can be defined to provide psql -location dir. - -END_USAGE - - exit 1 -} - -parseOptions() { - for cliArgument in "$@" - do - case ${cliArgument} in - --user=*) - DB_USER_NAME="${cliArgument#*=}" - shift # past argument=value - ;; - --database=*) - DB_DATABASE_NAME="${cliArgument#*=}" - shift # past argument=value - ;; - --schema=*) - DB_DATABASE_SCHEMA="${cliArgument#*=}" - shift # past argument=value - ;; - --host=*) - DB_HOST="${cliArgument#*=}" - shift # past argument=value - ;; - --port=*) - DB_PORT="${cliArgument#*=}" - shift # past argument=value - ;; - --output=*) - OUTPUT_DIR="${cliArgument#*=}" - shift # past argument=value - ;; - --verbose) - VERBOSE_MODE=true - shift # past argument=value - ;; - -h|--help) - usage - ;; - *) - # unknown option - usage - ;; - esac - done -} - -logEnv() { - logDebug "Settings: " - logDebug " - Database server host: ${DB_HOST}" - logDebug " - Database server port: ${DB_PORT}" - logDebug " - Database name: ${DB_DATABASE_NAME}" - logDebug " - Database user name: ${DB_USER_NAME}" - logDebug " - Temporary output folder: ${TEMP_FOLDER}" - logDebug " - Output dir: ${OUTPUT_DIR}" -} - -cleanUp() { - [[ -d "${TEMP_FOLDER}" ]] && logDebug "Deleting temp folder..." && rm -rf ${TEMP_FOLDER} - logDebug "Clean up complete" - -} - -exitOnError() { - local message=$1 - logError "Stopping because: ${message}!" - cleanUp - exit 1 -} - -exitOnInterrupt() { - exitOnError "Process interrupted" -} - -init() { - if [[ -z $POSTGRES_PATH ]]; then - hash ${PSQL} 2>/dev/null || { echo >&2 "\"${PSQL}\" is not installed or not available in path"; exit 1; } - fi - logDebug "Preparing output folder..." - TEMP_FOLDER=$(mktemp -d) - logEnv - [[ -d ${TEMP_FOLDER} ]] || exitOnError "Temporary folder could not be created" - [[ -d ${OUTPUT_DIR} ]] || exitOnError "${OUTPUT_DIR} does not exist" - OUTPUT_FILE="${OUTPUT_DIR}/jfmcDataExport.tar.gz" - if [[ -f "${OUTPUT_FILE}" ]]; then - warn "${OUTPUT_FILE} will be overwritten." - fi -} - -verifyFileExistsAndIsNotEmpty() { - local file=$1 - [[ -f "${file}" ]] || exitOnError "${file} is missing" - [[ -s "${file}" ]] || exitOnError "${file} should not be empty" -} - -extractSqlQueryToJsonFile() { - local sqlQuery=$1 - local outputPath=$2 - logDebug "Dumping data to ${outputPath}" - # Note: Redirecting output requires less permissions than using "COPY ... TO 'path/to/file'" - ${PSQL} --command="COPY (SELECT array_to_json(coalesce(array_agg(row_to_json(t)), '{}')) FROM ($sqlQuery) t) TO STDOUT;" \ - --username=${DB_USER_NAME} \ - --host=${DB_HOST} \ - --port=${DB_PORT} \ - --dbname=${DB_DATABASE_NAME} > ${outputPath} || exitOnError "psql command failed" - verifyFileExistsAndIsNotEmpty "${outputPath}" -} - -bundleData() { - logInfo "Bundling exported data..." - tar --create --gzip --file ${OUTPUT_FILE} --directory ${TEMP_FOLDER} . || exitOnError "Bundle creation failed" - logInfo "Mission Control data dumped to: ${OUTPUT_FILE}" -} - -extractData() { - logInfo "Exporting license buckets..." - local bucketsSql="SELECT id, subject, product_name, product_id, license_type, issued_date, valid_date, quantity, identifier, signature, max_of_usage, name, saas_imported, identifier_index, jfmc_info_service_id, jfmc_info_url, split_parent_id FROM ${DB_DATABASE_SCHEMA}.bucket" - extractSqlQueryToJsonFile "${bucketsSql}" "${TEMP_FOLDER}/buckets.json" || exitOnError "Export of License Buckets failed" - logInfo "Exporting managed licenses..." - local managedLicensesSql="SELECT id, bucket_id, license_hash, encode(license_key, 'base64') AS license_key, instance_name, state FROM ${DB_DATABASE_SCHEMA}.managed_license" - extractSqlQueryToJsonFile "${managedLicensesSql}" "${TEMP_FOLDER}/managed-licenses.json" || exitOnError "Export of Managed Licenses failed" -} - -trap exitOnInterrupt SIGINT SIGTERM SIGHUP - -[[ -z "${POSTGRES_PATH}" ]] && PSQL=psql || PSQL=${POSTGRES_PATH}/psql - -parseOptions "$@" -init -extractData -bundleData -cleanUp - -cat << END_REPORT - -To import the data in Mission Control 4.x:" - 1. Copy ${OUTPUT_FILE} into JF_PRODUCT_HOME/var/bootstrap/mc without changing the file name on one Mission Control node." - 2. Restart Mission Control node." - -END_REPORT - - - diff --git a/stable/mission-control/logo/jfmc-logo.png b/stable/mission-control/logo/jfmc-logo.png deleted file mode 100644 index 8a070660593a4f2c066dc7c89c2e243516ea7331..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 5904 zcmcIoXH=70vyLb9-irYg0Tt9BDnW=q5F~Ud0wN>`h;)J>bWo}^0i}piBfTqf07GvI zQbI&ZAQS*LBXD2Nz2E(P*ZS`FW3P9uXV0G5v)|dXpP5)=BP1u=Nj4A&#Hp*J zWeNhFPyxmr7A64syJ^!G_^^8ESb2j$P^sf_!oN`c7-Yuj8s1|5#wyC92z$*s@Z}%q z)?J*256&5b1(jCy>i`f34uG^Ay&bSFUN{$wCy1X_5>NwTJH|CJUIADaCuba}g1aBE z3gY?)#X8y@i=M{0csPO-Y22*94D0cX8Rj9*&kpMdLU|n>i?jcu+{N3$-3}1Ng6iA; zP6A+-W7yIT>*?a@1ZsmUMgti0f3Nq!Iyi!Mjv`k7C8mk-@No3Rfp+^}wgMQ_vDh6K zoVz2aWMk+Y2qZ|+)zY}*pS3mHZGj(4lS-lf zMe(zUp|(S(tB|)D?n+>t-^+)GYBW{6@z;-D4~{+@&|7ydwIxc6pYo5bEl4=k z6JKBAC-9vZ6Hb_zp7Pj$v@0=W^IKDcWLoU0<%I=T7k~63NIv~fONCvd%i0P>h!2q@ zpPo92R$hwKY|!zdD_bGkLKmgko) zra{wF&5Czhdz(;jq_%g|vbBk9^3EVvIfMi$|LHyqz#nqZ-#X2Y1Z-qd*~2#kEAj&K zU%}%qrtNoCW_#Nq<+dKYud0yAHhsN=BsCkq^Lga9o>gG}Tf%)ed_2bV&5G4b#X)~_EowSD@#2V@RDH&h(lIo?W(hk#P`Ht8y3Ay0lca$Z?2$p$x3+oxILnm~lHf^ff=J#&ORDANi|PSU zXl7KHWH$jEH7FPrchB9r z4j+uXfr5m(ukcrF3y`mm!_F zyPOud3EJCpWtJpS$&0E1+L%BbtkkBXdw+W_{GEDdy{md>-|}6LK`5;TRe|27vhB~= z<<|*!XM6~C-`LO&uq{{}_uqld@5GO!OQ1G92FF~39!1(1!@d2K*}>g)qKpzOGx-

N-Rh<1YjjlDZ-W?VC5{b(9ZK+b~!@HhpD9TBf`c5Knbdtk*RluF7TGa*)%~8s@ zzfZM@{njP&KDT2;>^2+c?6D>;PU1MGYs$m^;k`pBcX(1TQhI>iP?8L8^_S z#<}I@p^DcOBNnig4AdwRYH-KonNE{~*W3CUjQ~DRbs=Bm+`T}YupU2lEK*F*VarE0 zr%$R@s@N-zTV-{?kk6*<1@84Xl{UAm(h%)t6d40eor^G9Zutz4Cp#iJcHN8aVfi-T z$Dy`hfb`haDr*fSBtmhe~CZ6D_QE+`x43q-~G z?OIo$UuYCxOQ}4ShwJ;IzPlDUc&V7`C2itLYWDVQebF@wE19bO!_Gh5`cXQLU4=gR zv9U4ubB6LTF~{x)daCVliuna7H5ISay{jM7kvQd^CBN0^P2Y%PQ=wRm(7kv@`z25Q za0(C>W!^;91cap=2K^-XsWv!)yXO`Bf=jW`)7-ni=H9uDp9Ox`vFU^|F8htDk zi`&Mx2Zi?&pB)x|DzqxxroPJ54!EtkN>w6ndXA0Y6e{MPJJFd& zw}NA5T>p^NgGjM<7kb}`SE)H(L2;;C{*t0SUMz>SyyU^H?bV#~=G7%*&KPS{`z$1i=%<=!X3Dy%?XQtb5=3#pz&9C)+ng*cW3QxhGz(=Q+?mO@w7xb@ zvjOkLJ5aLw#BoyHb+R|VAvcD(G`ST`;Hj6OYv1V*5#_omg1d%OpB__U`h9X7a@_O< zl%1_Rxkcb^!R8-MG2xRNNxkFwTVnI_R`BTVyS#RDr0o|IaTQ3)+vNLu_XcjDh|?d(XUV=!SjOz7lUc2RO-J{Zi#rATR(81(frn?c6FvOS+9!D~lVNi9f}~;Viv#SF z@1HD_eFYg~oi*woTCo;HsQpms!otwmGA)ZW?krQ+6$eQ>3KlV&8Eq90DQNIuKMP`Uepqw!to*@K_T zGq}*dR#-^+L0vtiQ=dvv0-j4T9jT)-7I$;MT(5A4ERRgZ8v3}>M5TMSHo-nC4W8doqjsw}4p*HvGy^p*D?Dt{JW8U5-^EP2STltL*rl>bL>vk@O*PW=&K+vKNt0 zbpa2YRQn;P@ul&VmS{s@+JMQ+Bt3O46;{~Ms=1C`q9^jpk%BRlg78k=d#@PW`P=j; zoz8^S5yzo14o?Ncs>9B52|7|wu2-^mGG%1DWle}H*HU87Yea{-*M_WcUK^7O0uN{^ z0xvdmIM=P-JvdrdSESem+2MIS;&FVqrl^SfU_*Z$ zAzY62HHBh6FvPh-zgI%sF7lkCN^`kMHpF=@Dj5hXX$le%cY4G7dCJlJN#J@2X_7&$XOoLy#m1Sx5oXVCqt^ zZz_Iu;S~C#n%qIDNu*8R>cV@RYdwEygeUO-`}F1P1V>Hg`m`qz{PH}7$Y?h55(|>rP$0c_yEAE zq^(Ig!~QQaoi|V#KnUmn6a*-&xL;nQX3hK!B#fVbx#O)W!Yn&$ewO`oZDdyt#Gz4> z=qheGPKdM6fSahr{II7JmLYrW##CD=YE9Oxr#fu$uxYUxQtS&)k)oa~_C*@4+dr|? zv$b2;s!}EEJAWJgV{5eTdlpGLSRc8ZHWs`V)1f=pmjhe`O4nFL+7c#zZyJ|~w^pe$ zBst!PIAgW!#(`@sJd>Yz4VPA6D@OSwMMl(|^qh$pd*`VTK(Z2@C@+U&U4@hGg9pl< zWleZwO|0LkV(j!xvrJSoSTS-bpNgEkKrUiKx5m#!SDLoqwCBZ59dc>3kaH9`Y_TO$Cme5KT-(RJ#)7F zDtiG`)8*3g-<`XGePxw7ofd;Lo=aHfsUgBatT(;cNwc3{99{4&ro%H}cM(=QkbC?V zm8jDA9riLpRktxdS=V({;`pPb-e=0vExUmhqBsG1%;sY*k?0^OM51MuA_@%&Z z*OzJTX*@XnrQPKb8T(stX1em@JSm*l8kY|GEor9zQ`$N=h&+DzqiY!=lvCt*>QJ3# zxE2UQHye7vo9!4s$S0oaA)gCReQ!#bN;)gcph^u>%yCHyw<=Y z_GE#stul{%8nb)xP%Q6tf+a?b;%DAP@`-^eD<}MnvcEZ64Z=Yj6 z6Sn0DY_CyHj_MvBxEw4R=)=+}S2;bn?XkXU9M7gQKXt3fGFoT4uT{x%=bgD+g-CT8 z{(Q9wy;du&5R3Rdkx4%@Gov?hE2fe!2$y_hGxcIZNz%B6egBjNZh7)CUm+7f#JKGU z_Z^Iedtsy7kFA2_zuzwE!Rv1pc3G@Myb7zbk@@f``utb;Ev9VUFOCx9(

u#VZ)L zrC(c~;#uzektsW^W{DN*s*m+DB*dtHLsZjZL zSEg$gRP>y_UX(4m2X(VO{m1x=hLdSpJw~J>?+!p!&*wyCWK!hR0IHfir~U`wvZxk1 zrla_PQ&FkjJec%afB$WHN&&0+-PDH-A}y8~l5RcIS$A|v+@3G|XS=Vdn z4&6}E$7NqEV^z_8|8+7w7OG?iKlj~!3!9>q-Uy`4KCQ9dyfXY%*_j(kFyvp-4sI%D zl^`8u)83*6e9gjH+4@96{`IgsYacVPiF=xVe{4@Gg;EX5IwBu@WEJA?%v5zal~%NO zTKBkiL*}_Tnmdv_23ZaLKRf99vA&JYseay=a#TlcyeWLzSCEkQy9Ma$qz!Ed+^`Hi z*fJ^b)2lh}zxrOjS-JEO4^Q5M^ui#!@X9$z(Q&Xykk zoy)`Q4`Q{M*#F#YxOV6r^`B zWM2wgo0sdCkaTTZqc{n9@e6=Iv+?Vj^qT6w(^av5gtRN zql5j=KTw#HqzHv1)73&57HfXSz32xwv#7-CT?{A*gN_A?qDyy58eOczLivD=1+1V`N_6 zl5uU-BjY2PKv5i@U38hp@b33lm}xUigwdHbW0{*9f`Q`yOz>de4mXxv2t8a5N#a5T z|7Tiu|9;c&|E!@Y*9;A`>A0jhP0{=aJ|OODKZo$&);)E1HZs=9eU{J#K9 C)KQNB diff --git a/stable/mission-control/templates/NOTES.txt b/stable/mission-control/templates/NOTES.txt deleted file mode 100644 index 804cf478f..000000000 --- a/stable/mission-control/templates/NOTES.txt +++ /dev/null @@ -1,3 +0,0 @@ -Congratulations. You have just deployed JFrog Mission Control! - -Open Artifactory - {{ .Values.missionControl.jfrogUrl }} in your browser. Mission Control should be activated with Artifactory. diff --git a/stable/mission-control/templates/_helpers.tpl b/stable/mission-control/templates/_helpers.tpl deleted file mode 100644 index 45fa0bc3f..000000000 --- a/stable/mission-control/templates/_helpers.tpl +++ /dev/null @@ -1,294 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "mission-control.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "mission-control.fullname" -}} -{{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Create a list of elasticsearch master eligible nodes. -This will create one entry per replica. -*/}} -{{- define "elasticsearch.endpoints" -}} -{{- $replicas := 1 }} -{{- $releaseName := printf "%s" (include "mission-control.fullname" .) }} - {{- range $i, $e := untilStep 0 $replicas 1 -}} -{{ $releaseName }}-{{ $i }}, - {{- end -}} -{{- end -}} - -{{/* -Create the name of the service account to use -*/}} -{{- define "mission-control.serviceAccountName" -}} -{{- if .Values.serviceAccount.create -}} -{{ default (include "mission-control.fullname" .) .Values.serviceAccount.name }} -{{- else -}} -{{ default "default" .Values.serviceAccount.name }} -{{- end -}} -{{- end -}} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "mission-control.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Scheme (http/https) based on Access TLS enabled/disabled -*/}} -{{- define "mission-control.scheme" -}} -{{- if .Values.router.tlsEnabled -}} -{{- printf "%s" "https" -}} -{{- else -}} -{{- printf "%s" "http" -}} -{{- end -}} -{{- end -}} - -{{/* -Resolve jfrogUrl value -*/}} -{{- define "mission-control.jfrogUrl" -}} -{{- if .Values.global.jfrogUrl -}} -{{- .Values.global.jfrogUrl -}} -{{- else if .Values.missionControl.jfrogUrl -}} -{{- .Values.missionControl.jfrogUrl -}} -{{- end -}} -{{- end -}} - -{{/* -Resolve joinKey value -*/}} -{{- define "mission-control.joinKey" -}} -{{- if .Values.global.joinKey -}} -{{- .Values.global.joinKey -}} -{{- else if .Values.missionControl.joinKey -}} -{{- .Values.missionControl.joinKey -}} -{{- end -}} -{{- end -}} - -{{/* -Resolve masterKey value -*/}} -{{- define "mission-control.masterKey" -}} -{{- if .Values.global.masterKey -}} -{{- .Values.global.masterKey -}} -{{- else if .Values.missionControl.masterKey -}} -{{- .Values.missionControl.masterKey -}} -{{- end -}} -{{- end -}} - -{{/* -Resolve joinKeySecretName value -*/}} -{{- define "mission-control.joinKeySecretName" -}} -{{- if .Values.global.joinKeySecretName -}} -{{- .Values.global.joinKeySecretName -}} -{{- else if .Values.missionControl.joinKeySecretName -}} -{{- .Values.missionControl.joinKeySecretName -}} -{{- else -}} -{{ include "mission-control.fullname" . }} -{{- end -}} -{{- end -}} - -{{/* -Resolve masterKeySecretName value -*/}} -{{- define "mission-control.masterKeySecretName" -}} -{{- if .Values.global.masterKeySecretName -}} -{{- .Values.global.masterKeySecretName -}} -{{- else if .Values.missionControl.masterKeySecretName -}} -{{- .Values.missionControl.masterKeySecretName -}} -{{- else -}} -{{ include "mission-control.fullname" . }} -{{- end -}} -{{- end -}} - -{{/* -Resolve imagePullSecrets value -*/}} -{{- define "mission-control.imagePullSecrets" -}} -{{- if .Values.global.imagePullSecrets }} -imagePullSecrets: -{{- range .Values.global.imagePullSecrets }} - - name: {{ . }} -{{- end }} -{{- else if .Values.imagePullSecrets }} -imagePullSecrets: -{{- range .Values.imagePullSecrets }} - - name: {{ . }} -{{- end }} -{{- end -}} -{{- end -}} - -{{/* -Resolve customInitContainersBegin value -*/}} -{{- define "mission-control.customInitContainersBegin" -}} -{{- if .Values.global.customInitContainersBegin -}} -{{- .Values.global.customInitContainersBegin -}} -{{- end -}} -{{- if .Values.common.customInitContainersBegin -}} -{{- .Values.common.customInitContainersBegin -}} -{{- end -}} -{{- end -}} - -{{/* -Resolve customInitContainers value -*/}} -{{- define "mission-control.customInitContainers" -}} -{{- if .Values.global.customInitContainers -}} -{{- .Values.global.customInitContainers -}} -{{- end -}} -{{- if .Values.common.customInitContainers -}} -{{- .Values.common.customInitContainers -}} -{{- end -}} -{{- end -}} - -{{/* -Resolve customVolumes value -*/}} -{{- define "mission-control.customVolumes" -}} -{{- if .Values.global.customVolumes -}} -{{- .Values.global.customVolumes -}} -{{- end -}} -{{- if .Values.common.customVolumes -}} -{{- .Values.common.customVolumes -}} -{{- end -}} -{{- end -}} - - -{{/* -Resolve customVolumeMounts value -*/}} -{{- define "mission-control.customVolumeMounts" -}} -{{- if .Values.global.customVolumeMounts -}} -{{- .Values.global.customVolumeMounts -}} -{{- end -}} -{{- if .Values.common.customVolumeMounts -}} -{{- .Values.common.customVolumeMounts -}} -{{- end -}} -{{- end -}} - -{{/* -Resolve customSidecarContainers value -*/}} -{{- define "mission-control.customSidecarContainers" -}} -{{- if .Values.global.customSidecarContainers -}} -{{- .Values.global.customSidecarContainers -}} -{{- end -}} -{{- if .Values.common.customSidecarContainers -}} -{{- .Values.common.customSidecarContainers -}} -{{- end -}} -{{- end -}} - -{{/* -Return the proper mission-control chart image names -*/}} -{{- define "mission-control.getImageInfoByValue" -}} -{{- $dot := index . 0 }} -{{- $indexReference := index . 1 }} -{{- $registryName := index $dot.Values $indexReference "image" "registry" -}} -{{- $repositoryName := index $dot.Values $indexReference "image" "repository" -}} -{{- $tag := default $dot.Chart.AppVersion (index $dot.Values $indexReference "image" "tag") | toString -}} -{{- if $dot.Values.global }} - {{- if and $dot.Values.global.versions.router (eq $indexReference "router") }} - {{- $tag = $dot.Values.global.versions.router | toString -}} - {{- end -}} - {{- if and $dot.Values.global.versions.missionControl (or (eq $indexReference "insightScheduler") (eq $indexReference "missionControl") (eq $indexReference "insightServer") ) }} - {{- $tag = $dot.Values.global.versions.missionControl | toString -}} - {{- end -}} - {{- if $dot.Values.global.imageRegistry }} - {{- printf "%s/%s:%s" $dot.Values.global.imageRegistry $repositoryName $tag -}} - {{- else -}} - {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} - {{- end -}} -{{- else -}} - {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} -{{- end -}} -{{- end -}} - -{{/* -Resolve elastic search url -*/}} -{{- define "elasticsearch.url" -}} -{{- if .Values.router.tlsEnabled -}} -{{- printf "https://localhost:%d" (int .Values.router.internalPort) -}} -{{- else -}} -{{- printf "http://localhost:%d" (int .Values.router.internalPort) -}} -{{- end -}} -{{- end -}} - -{{/* -Custom certificate copy command -*/}} -{{- define "mission-control.copyCustomCerts" -}} -echo "Copy custom certificates to {{ .Values.missionControl.persistence.mountPath }}/etc/security/keys/trusted"; -mkdir -p {{ .Values.missionControl.persistence.mountPath }}/etc/security/keys/trusted; -find /tmp/certs -type f -not -name "*.key" -exec cp -v {} {{ .Values.missionControl.persistence.mountPath }}/etc/security/keys/trusted \;; -find {{ .Values.missionControl.persistence.mountPath }}/etc/security/keys/trusted/ -type f -name "tls.crt" -exec mv -v {} {{ .Values.missionControl.persistence.mountPath }}/etc/security/keys/trusted/ca.crt \;; -{{- end -}} - -{{/* -mission-control liveness probe -*/}} -{{- define "mission-control.livenessProbe" -}} -{{- if .Values.newProbes -}} -{{- printf "%s" "/api/v1/system/liveness" -}} -{{- else -}} -{{- printf "%s" "/api/v1/system/ping" -}} -{{- end -}} -{{- end -}} - -{{/* -mission-control readiness probe -*/}} -{{- define "mission-control.readinessProbe" -}} -{{- if .Values.newProbes -}} -{{- printf "%s" "/api/v1/system/readiness" -}} -{{- else -}} -{{- printf "%s" "/api/v1/system/ping" -}} -{{- end -}} -{{- end -}} - -{{/* -router liveness probe -*/}} -{{- define "mission-control.router.livenessProbe" -}} -{{- if .Values.newProbes -}} -{{- printf "%s" "/router/api/v1/system/liveness" -}} -{{- else -}} -{{- printf "%s" "/router/api/v1/system/health" -}} -{{- end -}} -{{- end -}} - -{{/* -router readiness probe -*/}} -{{- define "mission-control.router.readinessProbe" -}} -{{- if .Values.newProbes -}} -{{- printf "%s" "/router/api/v1/system/readiness" -}} -{{- else -}} -{{- printf "%s" "/router/api/v1/system/health" -}} -{{- end -}} -{{- end -}} \ No newline at end of file diff --git a/stable/mission-control/templates/additional-resources.yaml b/stable/mission-control/templates/additional-resources.yaml deleted file mode 100644 index c4d06f08a..000000000 --- a/stable/mission-control/templates/additional-resources.yaml +++ /dev/null @@ -1,3 +0,0 @@ -{{ if .Values.additionalResources }} -{{ tpl .Values.additionalResources . }} -{{- end -}} diff --git a/stable/mission-control/templates/database-secrets.yaml b/stable/mission-control/templates/database-secrets.yaml deleted file mode 100644 index 96e48928f..000000000 --- a/stable/mission-control/templates/database-secrets.yaml +++ /dev/null @@ -1,30 +0,0 @@ -{{- if not .Values.database.secrets }} -apiVersion: v1 -kind: Secret -metadata: - name: {{ template "mission-control.fullname" . }}-database-creds - labels: - app: {{ template "mission-control.name" . }} - chart: {{ template "mission-control.chart" . }} - heritage: {{ .Release.Service }} - release: {{ .Release.Name }} -type: Opaque -data: - {{- if .Values.postgresql.enabled }} - {{- with .Values.postgresql.db.password }} - db-password: {{ tpl . $ | b64enc | quote }} - {{- else }} - db-password: {{ randAlphaNum 10 | b64enc | quote }} - {{- end }} - {{- else }} - {{- with .Values.database.url }} - db-url: {{ tpl . $ | b64enc | quote }} - {{- end }} - {{- with .Values.database.user }} - db-user: {{ tpl . $ | b64enc | quote }} - {{- end }} - {{- with .Values.database.password }} - db-password: {{ tpl . $ | b64enc | quote }} - {{- end }} - {{- end }} -{{- end }} diff --git a/stable/mission-control/templates/elasticsearch-secrets.yaml b/stable/mission-control/templates/elasticsearch-secrets.yaml deleted file mode 100644 index 53a0abbdb..000000000 --- a/stable/mission-control/templates/elasticsearch-secrets.yaml +++ /dev/null @@ -1,22 +0,0 @@ - {{- if .Values.elasticsearch.enabled }} -apiVersion: v1 -kind: Secret -metadata: - name: {{ template "mission-control.fullname" . }}-elasticsearch-cred - labels: - app: {{ template "mission-control.name" . }} - chart: {{ template "mission-control.chart" . }} - heritage: {{ .Release.Service }} - release: {{ .Release.Name }} -type: Opaque -data: -{{- with .Values.elasticsearch.username }} - username: {{ tpl . $ | b64enc | quote }} -{{- end }} -{{- with .Values.elasticsearch.password }} - password: {{ tpl . $ | b64enc | quote }} -{{- end }} -{{- with .Values.elasticsearch.url }} - url: {{ tpl . $ | b64enc | quote }} -{{- end }} -{{- end }} diff --git a/stable/mission-control/templates/filebeat-configmap.yaml b/stable/mission-control/templates/filebeat-configmap.yaml deleted file mode 100644 index 45d2cf5fb..000000000 --- a/stable/mission-control/templates/filebeat-configmap.yaml +++ /dev/null @@ -1,15 +0,0 @@ -{{- if .Values.filebeat.enabled }} ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ template "mission-control.fullname" . }}-filebeat-config - labels: - app: {{ template "mission-control.fullname" . }} - chart: {{ .Chart.Name }}-{{ .Chart.Version }} - heritage: {{ .Release.Service | quote }} - release: {{ .Release.Name | quote }} -data: - filebeat.yml: | -{{ tpl .Values.filebeat.filebeatYml . | indent 4 }} -{{- end -}} \ No newline at end of file diff --git a/stable/mission-control/templates/jfmc-setup-scripts.yaml b/stable/mission-control/templates/jfmc-setup-scripts.yaml deleted file mode 100644 index fbf3fac79..000000000 --- a/stable/mission-control/templates/jfmc-setup-scripts.yaml +++ /dev/null @@ -1,54 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ template "mission-control.fullname" . }}-jfmc-setup-scripts - labels: - app: {{ template "mission-control.name" . }} - chart: {{ template "mission-control.chart" . }} - heritage: {{ .Release.Service }} - release: {{ .Release.Name }} -data: - setProperties.sh: | - #!/bin/bash - # Setup script to set properties in mission-control.properties on install - addProperty() { - local propertyName=$1 - local propertyValue=$2 - local propertiesPath=$3 - local result= - local propertyNotSet=1 - local propertySet=0 - - # Return if any of the inputs are empty - [[ -z "$propertyName" || "$propertyName" == "" ]] && return - [[ -z "$propertyValue" || "$propertyValue" == "" ]] && return - [[ -z "$propertiesPath" || "$propertiesPath" == "" ]] && return - - grep "^${propertyName}\s*=.*$" ${propertiesPath} >/dev/null 2>&1 - result=$? - if [[ ${result} -eq ${propertyNotSet} ]]; then - echo "setting ${propertyName} property in ${propertiesPath}" - echo -e "\n${propertyName}=${propertyValue}" >> ${propertiesPath} - elif [[ ${result} -eq ${propertySet} && {{ .Values.missionControl.propertyOverride | quote }} == true ]]; then - echo "modifying ${propertyName} property in ${propertiesPath}" - sed -i -e "s|^${propertyName}\s*=.*$|${propertyName}=${propertyValue}|g;" ${propertiesPath} - else - echo "skipping ${propertyName} as it is already set" - fi - } - - JFMC_ETC={{ .Values.missionControl.persistence.mountPath }}/etc - JFMC_PROPERTIES=${JFMC_ETC}/mission-control.properties - - if ! [[ -f ${JFMC_PROPERTIES} ]]; then \ - mkdir -p ${JFMC_ETC}; \ - touch ${JFMC_PROPERTIES} || ( echo "unable to create ${JFMC_PROPERTIES} file" && exit 1 ) - fi - - addProperty "jfmc.db.username" "${JFMC_DB_USERNAME}" ${JFMC_PROPERTIES} && \ - addProperty "jfmc.db.password" "${JFMC_DB_PASSWORD}" ${JFMC_PROPERTIES} && \ - addProperty "jfsc.db.username" "${JFSC_DB_USERNAME}" ${JFMC_PROPERTIES} && \ - addProperty "jfsc.db.password" "${JFSC_DB_PASSWORD}" ${JFMC_PROPERTIES} && \ - addProperty "jfis.db.username" "${JFIS_DB_USERNAME}" ${JFMC_PROPERTIES} && \ - addProperty "jfis.db.password" "${JFIS_DB_PASSWORD}" ${JFMC_PROPERTIES} || \ - ( echo "unable to set mission-control properties in ${JFMC_PROPERTIES}" && exit 1 ) \ No newline at end of file diff --git a/stable/mission-control/templates/mission-control-application-yaml.yaml b/stable/mission-control/templates/mission-control-application-yaml.yaml deleted file mode 100644 index 30a1e1ce6..000000000 --- a/stable/mission-control/templates/mission-control-application-yaml.yaml +++ /dev/null @@ -1,14 +0,0 @@ -apiVersion: v1 -kind: Secret -metadata: - name: {{ template "mission-control.fullname" . }}-applicationyaml - labels: - app: {{ template "mission-control.name" . }} - chart: {{ template "mission-control.chart" . }} - component: {{ .Values.missionControl.name }} - heritage: {{ .Release.Service }} - release: {{ .Release.Name }} -type: Opaque -stringData: - application.yaml: | -{{ toYaml .Values.applicationConfigs | indent 4 }} diff --git a/stable/mission-control/templates/mission-control-configmaps.yaml b/stable/mission-control/templates/mission-control-configmaps.yaml deleted file mode 100644 index d8c4c609a..000000000 --- a/stable/mission-control/templates/mission-control-configmaps.yaml +++ /dev/null @@ -1,13 +0,0 @@ -{{- if .Values.common.configMaps }} -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ template "mission-control.fullname" . }}-configmaps - labels: - app: {{ template "mission-control.name" . }} - chart: {{ template "mission-control.chart" . }} - heritage: {{ .Release.Service }} - release: {{ .Release.Name }} -data: -{{ tpl .Values.common.configMaps . | indent 2 }} -{{- end }} diff --git a/stable/mission-control/templates/mission-control-custom-secrets.yaml b/stable/mission-control/templates/mission-control-custom-secrets.yaml deleted file mode 100644 index 0bb69cf9e..000000000 --- a/stable/mission-control/templates/mission-control-custom-secrets.yaml +++ /dev/null @@ -1,19 +0,0 @@ -{{- if .Values.common.customSecrets }} -{{- range .Values.common.customSecrets }} ---- -apiVersion: v1 -kind: Secret -metadata: - name: {{ template "mission-control.fullname" $ }}-{{ .name }} - labels: - app: "{{ template "mission-control.name" $ }}" - chart: "{{ template "mission-control.chart" $ }}" - component: "{{ $.Values.missionControl.name }}" - heritage: {{ $.Release.Service | quote }} - release: {{ $.Release.Name | quote }} -type: Opaque -stringData: - {{ .key }}: | -{{ .data | indent 4 -}} -{{- end -}} -{{- end -}} diff --git a/stable/mission-control/templates/mission-control-networkpolicy.yaml b/stable/mission-control/templates/mission-control-networkpolicy.yaml deleted file mode 100644 index 8fba63649..000000000 --- a/stable/mission-control/templates/mission-control-networkpolicy.yaml +++ /dev/null @@ -1,33 +0,0 @@ -{{- range .Values.networkpolicy }} -apiVersion: networking.k8s.io/v1 -kind: NetworkPolicy -metadata: - name: {{ template "mission-control.fullname" $ }}-{{ .name }}-networkpolicy - labels: - app: {{ template "mission-control.name" $ }} - component: {{ $.Values.missionControl.name }} - release: {{ $.Release.Name }} -spec: -{{- if .podSelector }} - podSelector: -{{ .podSelector | toYaml | trimSuffix "\n" | indent 4 -}} -{{ else }} - podSelector: {} -{{- end }} - policyTypes: - {{- if .ingress }} - - Ingress - {{- end }} - {{- if .egress }} - - Egress - {{- end }} -{{- if .ingress }} - ingress: -{{ .ingress | toYaml | trimSuffix "\n" | indent 2 -}} -{{- end }} -{{- if .egress }} - egress: -{{ .egress | toYaml | trimSuffix "\n" | indent 2 -}} -{{- end }} ---- -{{- end -}} \ No newline at end of file diff --git a/stable/mission-control/templates/mission-control-role.yaml b/stable/mission-control/templates/mission-control-role.yaml deleted file mode 100644 index 8a9795ed8..000000000 --- a/stable/mission-control/templates/mission-control-role.yaml +++ /dev/null @@ -1,14 +0,0 @@ -{{- if .Values.rbac.create }} -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - labels: - app: {{ template "mission-control.name" . }} - chart: {{ template "mission-control.chart" . }} - component: {{ .Values.missionControl.name }} - heritage: {{ .Release.Service }} - release: {{ .Release.Name }} - name: {{ template "mission-control.fullname" . }} -rules: -{{ toYaml .Values.rbac.role.rules }} -{{- end }} diff --git a/stable/mission-control/templates/mission-control-rolebinding.yaml b/stable/mission-control/templates/mission-control-rolebinding.yaml deleted file mode 100644 index 04e002fd1..000000000 --- a/stable/mission-control/templates/mission-control-rolebinding.yaml +++ /dev/null @@ -1,19 +0,0 @@ -{{- if .Values.rbac.create }} -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - labels: - app: {{ template "mission-control.name" . }} - chart: {{ template "mission-control.chart" . }} - component: {{ .Values.missionControl.name }} - heritage: {{ .Release.Service }} - release: {{ .Release.Name }} - name: {{ template "mission-control.fullname" . }} -subjects: -- kind: ServiceAccount - name: {{ template "mission-control.serviceAccountName" . }} -roleRef: - kind: Role - apiGroup: rbac.authorization.k8s.io - name: {{ template "mission-control.fullname" . }} -{{- end }} diff --git a/stable/mission-control/templates/mission-control-secrets.yaml b/stable/mission-control/templates/mission-control-secrets.yaml deleted file mode 100644 index a708c4e05..000000000 --- a/stable/mission-control/templates/mission-control-secrets.yaml +++ /dev/null @@ -1,26 +0,0 @@ -apiVersion: v1 -kind: Secret -metadata: - name: {{ template "mission-control.fullname" . }} - labels: - app: {{ template "mission-control.name" . }} - chart: {{ template "mission-control.chart" . }} - heritage: {{ .Release.Service }} - release: {{ .Release.Name }} -type: Opaque -data: -{{- if or .Values.missionControl.masterKey .Values.global.masterKey }} - {{- if not (or .Values.missionControl.masterKeySecretName .Values.global.masterKeySecretName) }} - master-key: {{ include "mission-control.masterKey" . | b64enc | quote }} - {{- end }} -{{- end }} -{{- if not (or .Values.missionControl.joinKey .Values.global.joinKey) }} - {{- if not (or .Values.missionControl.joinKeySecretName .Values.global.joinKeySecretName) }} - {{ required "\n\n.Values.missionControl.joinKey/joinKeySecretName or .Values.global.joinKey/joinKeySecretName is required!\n\n" .Values.missionControl.joinKey }} - {{- end }} -{{- end }} -{{- if or .Values.missionControl.joinKey .Values.global.joinKey }} - {{- if not (or .Values.missionControl.joinKeySecretName .Values.global.joinKeySecretName) }} - join-key: {{ include "mission-control.joinKey" . | b64enc | quote }} - {{- end }} -{{- end }} \ No newline at end of file diff --git a/stable/mission-control/templates/mission-control-serviceaccount.yaml b/stable/mission-control/templates/mission-control-serviceaccount.yaml deleted file mode 100644 index 16b907994..000000000 --- a/stable/mission-control/templates/mission-control-serviceaccount.yaml +++ /dev/null @@ -1,12 +0,0 @@ -{{- if .Values.serviceAccount.create }} -apiVersion: v1 -kind: ServiceAccount -metadata: - labels: - app: {{ template "mission-control.name" . }} - chart: {{ template "mission-control.chart" . }} - component: {{ .Values.missionControl.name }} - heritage: {{ .Release.Service }} - release: {{ .Release.Name }} - name: {{ template "mission-control.serviceAccountName" . }} -{{- end }} diff --git a/stable/mission-control/templates/mission-control-statefulset.yaml b/stable/mission-control/templates/mission-control-statefulset.yaml deleted file mode 100644 index 374db8d20..000000000 --- a/stable/mission-control/templates/mission-control-statefulset.yaml +++ /dev/null @@ -1,840 +0,0 @@ -apiVersion: apps/v1 -kind: StatefulSet -metadata: - name: {{ template "mission-control.fullname" . }} - labels: - app: {{ template "mission-control.name" . }} - chart: {{ template "mission-control.chart" . }} - component: {{ .Values.missionControl.name }} - heritage: {{ .Release.Service }} - release: {{ .Release.Name }} - {{- with .Values.missionControl.labels }} -{{ toYaml . | indent 4 }} - {{- end }} - {{- if .Release.IsUpgrade }} - unifiedUpgradeAllowed: {{ required "\n\n**************************************\nSTOP! UPGRADE from Mission Control 3.x currently not supported!\nIf this is an upgrade over an existing Mission Control 4.x, explicitly pass 'unifiedUpgradeAllowed=true' to upgrade.\n**************************************\n" .Values.unifiedUpgradeAllowed | quote }} - {{- end }} - {{- if and .Release.IsUpgrade .Values.postgresql.enabled }} - databaseUpgradeReady: {{ required "\n\n*********\nIMPORTANT: UPGRADE STOPPED to prevent data loss!\nReview CHANGELOG.md (https://github.com/jfrog/charts/blob/master/stable/mission-control/CHANGELOG.md), pass postgresql.image.tag '9.6.18-debian-10-r7' or '10.13.0-debian-10-r38' and databaseUpgradeReady=true if you are upgrading from chart version which has postgresql version 9.6.x or 10.13.x" .Values.databaseUpgradeReady | quote }} - {{- end }} -spec: - serviceName: {{ template "mission-control.fullname" . }} - replicas: {{ .Values.replicaCount }} - updateStrategy: - type: RollingUpdate - selector: - matchLabels: - app: {{ template "mission-control.name" . }} - component: {{ .Values.missionControl.name }} - release: {{ .Release.Name }} - template: - metadata: - labels: - app: {{ template "mission-control.name" . }} - component: {{ .Values.missionControl.name }} - release: {{ .Release.Name }} - {{- with .Values.missionControl.labels }} -{{ toYaml . | indent 8 }} - {{- end }} - annotations: - checksum/database-secrets: {{ include (print $.Template.BasePath "/database-secrets.yaml") . | sha256sum }} - checksum/systemyaml: {{ include (print $.Template.BasePath "/mission-control-system-yaml.yaml") . | sha256sum }} - {{- range $key, $value := .Values.missionControl.annotations }} - {{ $key }}: {{ $value | quote }} - {{- end }} - spec: - serviceAccountName: {{ template "mission-control.serviceAccountName" . }} - {{- if or .Values.imagePullSecrets .Values.global.imagePullSecrets }} -{{- include "mission-control.imagePullSecrets" . | indent 6 }} - {{- end }} - securityContext: - fsGroup: {{ .Values.common.uid }} - initContainers: - {{- if or .Values.common.customInitContainersBegin .Values.global.customInitContainersBegin }} -{{ tpl (include "mission-control.customInitContainersBegin" .) . | indent 6 }} - {{- end }} - {{- if .Values.elasticsearch.enabled }} - {{- if .Values.elasticsearch.configureDockerHost }} - - name: elasticsearch-init - image: "{{ .Values.elasticsearch.initContainerImage }}" - securityContext: - privileged: true - command: - - '/bin/sh' - - '-c' - - > - sysctl -w vm.max_map_count={{ .Values.elasticsearch.env.maxMapCount }} - resources: -{{ toYaml .Values.initContainers.resources | indent 10 }} - {{- end }} - {{- end }} - - name: copy-system-yaml - image: '{{ .Values.initContainerImage }}' - securityContext: - runAsNonRoot: true - runAsUser: {{ .Values.common.uid }} - allowPrivilegeEscalation: false - capabilities: - drop: - - NET_RAW - command: - - '/bin/sh' - - '-c' - - > - echo "Copy system.yaml to {{ .Values.missionControl.persistence.mountPath }}/etc"; - mkdir -p {{ .Values.missionControl.persistence.mountPath }}/etc; - {{- if .Values.systemYamlOverride.existingSecret }} - cp -fv /tmp/etc/{{ .Values.systemYamlOverride.dataKey }} {{ .Values.missionControl.persistence.mountPath }}/etc/system.yaml; - {{- else }} - cp -fv /tmp/etc/system.yaml {{ .Values.missionControl.persistence.mountPath }}/etc/system.yaml; - {{- end }} - echo "Copy application.yaml to {{ .Values.missionControl.persistence.mountPath }}/bootstrap/mc"; - mkdir -p {{ .Values.missionControl.persistence.mountPath }}/bootstrap/mc; - cp -fv /tmp/etc/application.yaml {{ .Values.missionControl.persistence.mountPath }}/bootstrap/mc/application.yaml; - echo "Remove {{ .Values.missionControl.persistence.mountPath }}/lost+found folder if exists"; - rm -rfv {{ .Values.missionControl.persistence.mountPath }}/lost+found; - {{- if or .Values.missionControl.joinKey .Values.missionControl.joinKeySecretName .Values.global.joinKey .Values.global.joinKeySecretName }} - echo "Copy joinKey to {{ .Values.missionControl.persistence.mountPath }}/etc/security"; - mkdir -p {{ .Values.missionControl.persistence.mountPath }}/etc/security; - echo ${MC_JOIN_KEY} > {{ .Values.missionControl.persistence.mountPath }}/etc/security/join.key; - {{- end }} - {{- if or .Values.missionControl.masterKey .Values.missionControl.masterKeySecretName .Values.global.masterKey .Values.global.masterKeySecretName }} - echo "Copy masterKey to {{ .Values.missionControl.persistence.mountPath }}/etc/security"; - mkdir -p {{ .Values.missionControl.persistence.mountPath }}/etc/security; - echo ${MC_MASTER_KEY} > {{ .Values.missionControl.persistence.mountPath }}/etc/security/master.key; - {{- end }} - env: - {{- if or .Values.missionControl.joinKey .Values.missionControl.joinKeySecretName .Values.global.joinKey .Values.global.joinKeySecretName }} - - name: MC_JOIN_KEY - valueFrom: - secretKeyRef: - name: {{ include "mission-control.joinKeySecretName" . }} - key: join-key - {{- end }} - {{- if or .Values.missionControl.masterKey .Values.missionControl.masterKeySecretName .Values.global.masterKey .Values.global.masterKeySecretName }} - - name: MC_MASTER_KEY - valueFrom: - secretKeyRef: - name: {{ include "mission-control.masterKeySecretName" . }} - key: master-key - {{- end }} - volumeMounts: - - name: mission-control-data - mountPath: {{ .Values.missionControl.persistence.mountPath | quote }} - {{- if or .Values.systemYamlOverride.existingSecret .Values.missionControl.systemYaml }} - - name: systemyaml - {{- if .Values.systemYamlOverride.existingSecret }} - mountPath: "/tmp/etc/{{.Values.systemYamlOverride.dataKey}}" - subPath: {{ .Values.systemYamlOverride.dataKey }} - {{- else if .Values.missionControl.systemYaml }} - mountPath: "/tmp/etc/system.yaml" - subPath: system.yaml - {{- end }} - {{- end }} - - name: applicationyaml - mountPath: "/tmp/etc/application.yaml" - subPath: application.yaml - resources: -{{ toYaml .Values.initContainers.resources | indent 10 }} - {{- if or .Values.missionControl.customCertificates.enabled .Values.global.customCertificates.enabled }} - - name: copy-custom-certificates - image: "{{ .Values.initContainerImage }}" - securityContext: - runAsNonRoot: true - runAsUser: {{ .Values.common.uid }} - allowPrivilegeEscalation: false - capabilities: - drop: - - NET_RAW - resources: -{{ toYaml .Values.initContainers.resources | indent 10 }} - command: - - 'sh' - - '-c' - - > -{{ include "mission-control.copyCustomCerts" . | indent 10 }} - volumeMounts: - - name: mission-control-data - mountPath: {{ .Values.missionControl.persistence.mountPath }} - - name: ca-certs - mountPath: "/tmp/certs" - {{- end }} - {{- if or .Values.postgresql.enabled ( and .Values.database.host .Values.database.port ) }} - - name: wait-for-db - image: "{{ .Values.initContainerImage }}" - securityContext: - runAsNonRoot: true - runAsUser: {{ .Values.common.uid }} - allowPrivilegeEscalation: false - capabilities: - drop: - - NET_RAW - command: - - 'sh' - - '-c' - - > - {{- if .Values.postgresql.enabled }} - until nc -z -w 2 {{ .Release.Name }}-postgresql {{ .Values.postgresql.service.port }} && echo database ok; do - {{- else }} - {{- if and .Values.database.host .Values.database.port }} - until nc -z -w 2 {{ .Values.database.host }} {{ .Values.database.port }} && echo database ok; do - {{- else }} - until true; do - {{- end }} - {{- end }} - sleep 2; - done; - {{- end }} - resources: -{{ toYaml .Values.initContainers.resources | indent 10 }} - {{- if .Values.postgresql.enabled }} - - name: postgresql-setup - image: "{{ .Values.dbSetup.postgresql.image.repository }}:{{ .Values.dbSetup.postgresql.image.tag }}" - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - NET_RAW - env: - - name: DB_PORT - value: '{{ .Values.postgresql.service.port }}' - - name: DB_HOST - value: '{{ .Release.Name }}-postgresql' - - name: DB_NAME - value: '{{ .Values.postgresql.db.name }}' - - name: DB_SSLMODE - value: '{{ .Values.postgresql.db.sslmode }}' - - name: DB_TABLESPACE - value: '{{ .Values.postgresql.db.tablespace }}' - - name: PGPASSWORD - valueFrom: - secretKeyRef: - name: {{ .Release.Name }}-postgresql - key: postgresql-password - - name: JFMC_DB_PASSWORD - valueFrom: - secretKeyRef: - name: {{ template "mission-control.fullname" . }}-database-creds - key: db-password - - name: JFMC_DB_USERNAME - value: '{{ .Values.postgresql.db.user }}' - - name: JFMC_DB_SCHEMA - value: '{{ .Values.postgresql.db.jfmcSchema }}' - - name: JFSC_DB_USERNAME - value: '{{ .Values.postgresql.db.user }}' - - name: JFSC_DB_SCHEMA - value: '{{ .Values.postgresql.db.jfscSchema }}' - - name: JFSC_DB_PASSWORD - valueFrom: - secretKeyRef: - name: {{ template "mission-control.fullname" . }}-database-creds - key: db-password - - name: JFIS_DB_USERNAME - value: '{{ .Values.postgresql.db.user }}' - - name: JFIS_DB_SCHEMA - value: '{{ .Values.postgresql.db.jfisSchema }}' - - name: JFIS_DB_PASSWORD - valueFrom: - secretKeyRef: - name: {{ template "mission-control.fullname" . }}-database-creds - key: db-password - command: - - 'bash' - - '-c' - - 'su postgres -c "PGPASSWORD=${PGPASSWORD} bash /scripts/createPostgresUsers.sh all"' - volumeMounts: - - name: postgresql-setup - mountPath: "/scripts" - resources: -{{ toYaml .Values.initContainers.resources | indent 10 }} - {{- end }} - {{- if or .Values.common.customInitContainers .Values.global.customInitContainers }} -{{ tpl (include "mission-control.customInitContainers" .) . | indent 6 }} - {{- end }} - {{- if .Values.hostAliases }} - hostAliases: -{{ toYaml .Values.hostAliases | indent 6 }} - {{- end }} - containers: - {{- if .Values.elasticsearch.enabled }} - - name: {{ .Values.elasticsearch.name }} - image: {{ include "mission-control.getImageInfoByValue" (list . "elasticsearch") }} - imagePullPolicy: {{ .Values.elasticsearch.imagePullPolicy }} - securityContext: - runAsNonRoot: true - runAsUser: {{ .Values.elasticsearch.uid }} - allowPrivilegeEscalation: false - capabilities: - drop: - - NET_RAW - command: - - '/bin/sh' - - '-c' - - > - sleep 10; -{{- if and .Values.elasticsearch.enabled .Values.elasticsearch.certificatesSecretName }} - mkdir -p /usr/share/elasticsearch/data/certs; - cp -fv /tmp/certs/* /usr/share/elasticsearch/data/certs; -{{- end }} - if [[ $mission_control_pod_name == *"-0"* ]] ; then echo "Setting clustersetup to no" && export ELASTICSEARCH_CLUSTERSETUP=NO; else echo "Setting clustersetup to yes" && export ELASTICSEARCH_CLUSTERSETUP=YES; fi; - (/usr/local/bin/initializeSearchGuard.sh &) && docker-entrypoint.sh 'elasticsearch'; - env: - - name: 'mission_control_pod_name' - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: 'cluster.name' - value: '{{ .Values.elasticsearch.env.clusterName }}' - - name: 'network.host' - value: '{{ .Values.elasticsearch.env.networkHost }}' - - name: 'transport.host' - value: '{{ .Values.elasticsearch.env.transportHost }}' - - name: 'transport.port' - value: '{{ .Values.elasticsearch.transportPort }}' - - name: 'discovery.seed_hosts' - value: '{{ template "mission-control.fullname" . }}' - - name: 'cluster.initial_master_nodes' - value: '{{ template "elasticsearch.endpoints" . }}' - - name: ELASTICSEARCH_PASSWORD - valueFrom: - secretKeyRef: - name: {{ template "mission-control.fullname" . }}-elasticsearch-cred - key: password - - name: ELASTICSEARCH_USERNAME - valueFrom: - secretKeyRef: - name: {{ template "mission-control.fullname" . }}-elasticsearch-cred - key: username - - name: JF_SHARED_ELASTICSEARCH_USERNAME - valueFrom: - secretKeyRef: - name: {{ template "mission-control.fullname" . }}-elasticsearch-cred - key: username - - name: JF_SHARED_ELASTICSEARCH_PASSWORD - valueFrom: - secretKeyRef: - name: {{ template "mission-control.fullname" . }}-elasticsearch-cred - key: password - - name: ES_JAVA_OPTS - value: " - {{- if .Values.elasticsearch.javaOpts.xms }} - -Xms{{ .Values.elasticsearch.javaOpts.xms }} - {{- end }} - {{- if .Values.elasticsearch.javaOpts.xmx }} - -Xmx{{ .Values.elasticsearch.javaOpts.xmx }} - {{- end }} - " - - name: JF_SHARED_ELASTICSEARCH_URL - valueFrom: - secretKeyRef: - name: {{ template "mission-control.fullname" . }}-elasticsearch-cred - key: url - ports: - - name: tcp-estransprt - containerPort: {{ .Values.elasticsearch.transportPort }} - volumeMounts: -{{- if and .Values.elasticsearch.enabled .Values.elasticsearch.certificatesSecretName }} - - name: elastic-certs - mountPath: /tmp/certs -{{- end }} - - name: elasticsearch-data - mountPath: {{ .Values.elasticsearch.persistence.mountPath | quote }} - resources: -{{ toYaml .Values.elasticsearch.resources | indent 10 }} -{{- if .Values.elasticsearch.startupProbe.enabled }} - startupProbe: -{{ tpl .Values.elasticsearch.startupProbe.config . | indent 10 }} -{{- end }} -{{- if .Values.elasticsearch.livenessProbe.enabled }} - livenessProbe: -{{ tpl .Values.elasticsearch.livenessProbe.config . | indent 10 }} -{{- end }} -{{- if .Values.elasticsearch.readinessProbe.enabled }} - readinessProbe: -{{ tpl .Values.elasticsearch.readinessProbe.config . | indent 10 }} -{{- end }} - {{- end }} - - name: {{ .Values.router.name }} - image: {{ include "mission-control.getImageInfoByValue" (list . "router") }} - imagePullPolicy: {{ .Values.router.image.imagePullPolicy }} - securityContext: - runAsNonRoot: true - runAsUser: {{ .Values.common.uid }} - allowPrivilegeEscalation: false - capabilities: - drop: - - NET_RAW - command: - - '/bin/sh' - - '-c' - - > - exec /opt/jfrog/router/app/bin/entrypoint-router.sh; - ports: - - name: http-router - containerPort: {{ .Values.router.internalPort }} - volumeMounts: - - name: mission-control-data - mountPath: {{ .Values.router.persistence.mountPath | quote }} - {{- if or .Values.common.customVolumeMounts .Values.global.customVolumeMounts }} -{{ tpl (include "mission-control.customVolumeMounts" .) . | indent 8 }} - {{- end }} - resources: -{{ toYaml .Values.router.resources | indent 10 }} -{{- if .Values.router.startupProbe.enabled }} - startupProbe: -{{ tpl .Values.router.startupProbe.config . | indent 10 }} -{{- end }} -{{- if .Values.router.livenessProbe.enabled }} - livenessProbe: -{{ tpl .Values.router.livenessProbe.config . | indent 10 }} -{{- end }} -{{- if .Values.router.readinessProbe.enabled }} - readinessProbe: -{{ tpl .Values.router.readinessProbe.config . | indent 10 }} -{{- end }} - - name: {{ .Values.missionControl.name }} - image: {{ include "mission-control.getImageInfoByValue" (list . "missionControl") }} - imagePullPolicy: {{ .Values.imagePullPolicy }} - securityContext: - runAsNonRoot: true - runAsUser: {{ .Values.common.uid }} - allowPrivilegeEscalation: false - capabilities: - drop: - - NET_RAW - command: - - '/bin/bash' - - '-c' - - > - {{- with .Values.missionControl.preStartCommand }} - echo "Running custom preStartCommand command"; - {{ tpl . $ }}; - {{- end }} - exec /opt/jfrog/mc/app/bin/entrypoint-mc.sh; - env: - {{- if or .Values.database.secrets.user .Values.database.user }} - - name: JF_SHARED_DATABASE_USERNAME - valueFrom: - secretKeyRef: - {{- if .Values.database.secrets.user }} - name: {{ tpl .Values.database.secrets.user.name .}} - key: {{ tpl .Values.database.secrets.user.key .}} - {{- else if .Values.database.user }} - name: {{ template "mission-control.fullname" . }}-database-creds - key: db-user - {{- end }} - {{- end }} - {{ if or .Values.database.secrets.password .Values.database.password .Values.postgresql.enabled }} - - name: JF_SHARED_DATABASE_PASSWORD - valueFrom: - secretKeyRef: - {{- if .Values.database.secrets.password }} - name: {{ tpl .Values.database.secrets.password.name . }} - key: {{ tpl .Values.database.secrets.password.key . }} - {{- else if or .Values.database.password .Values.postgresql.enabled }} - name: {{ template "mission-control.fullname" . }}-database-creds - key: db-password - {{- end }} - {{- end }} - {{- if or .Values.database.secrets.url .Values.database.url }} - - name: JF_SHARED_DATABASE_URL - valueFrom: - secretKeyRef: - {{- if .Values.database.secrets.url }} - name: {{ tpl .Values.database.secrets.url.name .}} - key: {{ tpl .Values.database.secrets.url.key .}} - {{- else if .Values.database.url }} - name: {{ template "mission-control.fullname" . }}-database-creds - key: db-url - {{- end }} - {{- end }} - ports: - - containerPort: {{ .Values.missionControl.internalPort }} - protocol: TCP - name: http-mc - volumeMounts: - - name: mission-control-data - mountPath: {{ .Values.missionControl.persistence.mountPath | quote }} - {{- if or .Values.common.customVolumeMounts .Values.global.customVolumeMounts }} -{{ tpl (include "mission-control.customVolumeMounts" .) . | indent 8 }} - {{- end }} - resources: -{{ toYaml .Values.missionControl.resources | indent 10 }} -{{- if .Values.missionControl.startupProbe.enabled }} - startupProbe: -{{ tpl .Values.missionControl.startupProbe.config . | indent 10 }} -{{- end }} -{{- if .Values.missionControl.livenessProbe.enabled }} - livenessProbe: -{{ tpl .Values.missionControl.livenessProbe.config . | indent 10 }} -{{- end }} -{{- if .Values.missionControl.readinessProbe.enabled }} - readinessProbe: -{{ tpl .Values.missionControl.readinessProbe.config . | indent 10 }} -{{- end }} - {{- if .Values.filebeat.enabled }} - - name: {{ .Values.filebeat.name }} - image: "{{ .Values.filebeat.image.repository }}:{{ .Values.filebeat.image.version }}" - imagePullPolicy: {{ .Values.filebeat.image.pullPolicy }} - securityContext: - runAsNonRoot: true - runAsUser: {{ .Values.common.uid }} - allowPrivilegeEscalation: false - capabilities: - drop: - - NET_RAW - args: - - "-e" - - "-E" - - "http.enabled=true" - volumeMounts: - - name: filebeat-config - mountPath: /usr/share/filebeat/filebeat.yml - readOnly: true - subPath: filebeat.yml - - name: mission-control-data - mountPath: "{{ .Values.missionControl.persistence.mountPath }}" - livenessProbe: -{{ toYaml .Values.filebeat.livenessProbe | indent 10 }} - readinessProbe: -{{ toYaml .Values.filebeat.readinessProbe | indent 10 }} - resources: -{{ toYaml .Values.filebeat.resources | indent 10 }} - terminationGracePeriodSeconds: {{ .Values.terminationGracePeriod }} - {{- end }} - - name: {{ .Values.insightServer.name }} - image: {{ include "mission-control.getImageInfoByValue" (list . "insightServer") }} - imagePullPolicy: {{ .Values.imagePullPolicy }} - securityContext: - runAsNonRoot: true - runAsUser: {{ .Values.common.uid }} - allowPrivilegeEscalation: false - capabilities: - drop: - - NET_RAW - env: - {{- if or .Values.database.secrets.user .Values.database.user }} - - name: JF_SHARED_DATABASE_USERNAME - valueFrom: - secretKeyRef: - {{- if .Values.database.secrets.user }} - name: {{ tpl .Values.database.secrets.user.name .}} - key: {{ tpl .Values.database.secrets.user.key .}} - {{- else if .Values.database.user }} - name: {{ template "mission-control.fullname" . }}-database-creds - key: db-user - {{- end }} - {{- end }} - {{ if or .Values.database.secrets.password .Values.database.password .Values.postgresql.enabled }} - - name: JF_SHARED_DATABASE_PASSWORD - valueFrom: - secretKeyRef: - {{- if .Values.database.secrets.password }} - name: {{ tpl .Values.database.secrets.password.name . }} - key: {{ tpl .Values.database.secrets.password.key . }} - {{- else if or .Values.database.password .Values.postgresql.enabled }} - name: {{ template "mission-control.fullname" . }}-database-creds - key: db-password - {{- end }} - {{- end }} - {{- if or .Values.database.secrets.url .Values.database.url }} - - name: JF_SHARED_DATABASE_URL - valueFrom: - secretKeyRef: - {{- if .Values.database.secrets.url }} - name: {{ tpl .Values.database.secrets.url.name .}} - key: {{ tpl .Values.database.secrets.url.key .}} - {{- else if .Values.database.url }} - name: {{ template "mission-control.fullname" . }}-database-creds - key: db-url - {{- end }} - {{- end }} - ports: - - containerPort: {{ .Values.insightServer.internalPort }} - protocol: TCP - name: http-inserver - volumeMounts: - - name: mission-control-data - mountPath: {{ .Values.missionControl.persistence.mountPath | quote }} - {{- if or .Values.common.customVolumeMounts .Values.global.customVolumeMounts }} -{{ tpl (include "mission-control.customVolumeMounts" .) . | indent 8 }} - {{- end }} - resources: -{{ toYaml .Values.insightServer.resources | indent 10 }} -{{- if .Values.insightServer.startupProbe.enabled }} - startupProbe: -{{ tpl .Values.insightServer.startupProbe.config . | indent 10 }} -{{- end }} -{{- if .Values.insightServer.livenessProbe.enabled }} - livenessProbe: -{{ tpl .Values.insightServer.livenessProbe.config . | indent 10 }} -{{- end }} -{{- if .Values.insightServer.readinessProbe.enabled }} - readinessProbe: -{{ tpl .Values.insightServer.readinessProbe.config . | indent 10 }} -{{- end }} - - name: {{ .Values.insightScheduler.name }} - image: {{ include "mission-control.getImageInfoByValue" (list . "insightScheduler") }} - imagePullPolicy: {{ .Values.imagePullPolicy }} - securityContext: - runAsNonRoot: true - runAsUser: {{ .Values.common.uid }} - allowPrivilegeEscalation: false - capabilities: - drop: - - NET_RAW - env: - - name: JFMC_EXTRA_JAVA_OPTS - value: " - {{- if .Values.insightScheduler.javaOpts.other }} - {{ .Values.insightScheduler.javaOpts.other }} - {{- end}} - {{- if .Values.insightScheduler.javaOpts.xms }} - -Xms{{ .Values.insightScheduler.javaOpts.xms }} - {{- end}} - {{- if .Values.insightScheduler.javaOpts.xmx }} - -Xmx{{ .Values.insightScheduler.javaOpts.xmx }} - {{- end}} - -Dserver.port={{ .Values.insightScheduler.internalPort }} - " - {{- if or .Values.database.secrets.user .Values.database.user }} - - name: JF_SHARED_DATABASE_USERNAME - valueFrom: - secretKeyRef: - {{- if .Values.database.secrets.user }} - name: {{ tpl .Values.database.secrets.user.name .}} - key: {{ tpl .Values.database.secrets.user.key .}} - {{- else if .Values.database.user }} - name: {{ template "mission-control.fullname" . }}-database-creds - key: db-user - {{- end }} - {{- end }} - {{ if or .Values.database.secrets.password .Values.database.password .Values.postgresql.enabled }} - - name: JF_SHARED_DATABASE_PASSWORD - valueFrom: - secretKeyRef: - {{- if .Values.database.secrets.password }} - name: {{ tpl .Values.database.secrets.password.name . }} - key: {{ tpl .Values.database.secrets.password.key . }} - {{- else if or .Values.database.password .Values.postgresql.enabled }} - name: {{ template "mission-control.fullname" . }}-database-creds - key: db-password - {{- end }} - {{- end }} - {{- if or .Values.database.secrets.url .Values.database.url }} - - name: JF_SHARED_DATABASE_URL - valueFrom: - secretKeyRef: - {{- if .Values.database.secrets.url }} - name: {{ tpl .Values.database.secrets.url.name .}} - key: {{ tpl .Values.database.secrets.url.key .}} - {{- else if .Values.database.url }} - name: {{ template "mission-control.fullname" . }}-database-creds - key: db-url - {{- end }} - {{- end }} - ports: - - containerPort: {{ .Values.insightScheduler.internalPort }} - protocol: TCP - name: http-insched - volumeMounts: - - name: mission-control-data - mountPath: {{ .Values.missionControl.persistence.mountPath | quote }} - {{- if or .Values.common.customVolumeMounts .Values.global.customVolumeMounts }} -{{ tpl (include "mission-control.customVolumeMounts" .) . | indent 8 }} - {{- end }} - resources: -{{ toYaml .Values.insightScheduler.resources | indent 10 }} -{{- if .Values.insightScheduler.startupProbe.enabled }} - startupProbe: -{{ tpl .Values.insightScheduler.startupProbe.config . | indent 10 }} -{{- end }} -{{- if .Values.insightScheduler.livenessProbe.enabled }} - livenessProbe: -{{ tpl .Values.insightScheduler.livenessProbe.config . | indent 10 }} -{{- end }} -{{- if .Values.insightScheduler.readinessProbe.enabled }} - readinessProbe: -{{ tpl .Values.insightScheduler.readinessProbe.config . | indent 10 }} -{{- end }} - {{- $image := .Values.logger.image.repository }} - {{- $tag := .Values.logger.image.tag }} - {{- $uid := .Values.common.uid }} - {{- $context := .Values.missionControl.appContext }} - {{- $name := .Values.missionControl.name }} - {{- $mountPath := .Values.missionControl.persistence.mountPath }} - {{- range .Values.missionControl.loggers }} - - name: {{ $name }}-{{ . | replace "_" "-" | replace "." "-" }} - image: {{ include "mission-control.getImageInfoByValue" (list $ "logger") }} - securityContext: - runAsUser: {{ $uid }} - runAsNonRoot: true - allowPrivilegeEscalation: false - capabilities: - drop: - - NET_RAW - command: - - tail - args: - - '-F' - - '{{ $mountPath }}/logs/{{ $context }}/{{ . }}' - volumeMounts: - - name: mission-control-data - mountPath: {{ $mountPath }} - resources: -{{ toYaml $.Values.missionControl.loggersResources | indent 10 }} - {{- end }} - {{- $name := .Values.insightServer.name }} - {{- $context := .Values.insightServer.appContext }} - {{- $mountPath := .Values.insightServer.persistence.mountPath }} - {{- range .Values.insightServer.loggers }} - - name: {{ $name }}-{{ . | replace "_" "-" | replace "." "-" }} - image: {{ include "mission-control.getImageInfoByValue" (list $ "logger") }} - securityContext: - runAsUser: {{ $uid }} - runAsNonRoot: true - allowPrivilegeEscalation: false - capabilities: - drop: - - NET_RAW - command: - - tail - args: - - '-F' - - '{{ $mountPath }}/logs/{{ $context }}/{{ . }}' - volumeMounts: - - name: mission-control-data - mountPath: {{ $mountPath }} - resources: - {{ toYaml $.Values.insightServer.loggersResources | indent 10 }} - {{- end }} - {{- $name := .Values.insightScheduler.name }} - {{- $context := .Values.insightScheduler.appContext }} - {{- $mountPath := .Values.insightScheduler.persistence.mountPath }} - {{- range .Values.insightScheduler.loggers }} - - name: {{ $name }}-{{ . | replace "_" "-" | replace "." "-" }} - image: {{ include "mission-control.getImageInfoByValue" (list $ "logger") }} - securityContext: - runAsUser: {{ $uid }} - runAsNonRoot: true - allowPrivilegeEscalation: false - capabilities: - drop: - - NET_RAW - command: - - tail - args: - - '-F' - - '{{ $mountPath }}/logs/{{ $context }}/{{ . }}' - volumeMounts: - - name: mission-control-data - mountPath: {{ $mountPath }} - resources: -{{ toYaml $.Values.insightScheduler.loggersResources | indent 10 }} - {{- end }} - {{- if or .Values.common.customSidecarContainers .Values.global.customSidecarContainers }} -{{ tpl (include "mission-control.customSidecarContainers" .) . | indent 6 }} - {{- end }} - {{- with .Values.missionControl.nodeSelector }} - nodeSelector: -{{ toYaml . | indent 8 }} - {{- end }} - {{- with .Values.missionControl.affinity }} - affinity: -{{ toYaml . | indent 8 }} - {{- end }} - {{- with .Values.missionControl.tolerations }} - tolerations: -{{ toYaml . | indent 8 }} - {{- end }} - volumes: - {{- if or .Values.missionControl.customCertificates.enabled .Values.global.customCertificates.enabled }} - - name: ca-certs - secret: - secretName: {{ default .Values.global.customCertificates.certificateSecretName .Values.missionControl.customCertificates.certificateSecretName }} - {{- end }} - {{- if and .Values.elasticsearch.enabled .Values.elasticsearch.certificatesSecretName }} - - name: elastic-certs - secret: - secretName: {{ .Values.elasticsearch.certificatesSecretName }} - {{- end }} - - name: applicationyaml - secret: - secretName: {{ template "mission-control.fullname" . }}-applicationyaml - {{- if or .Values.systemYamlOverride.existingSecret .Values.missionControl.systemYaml }} - - name: systemyaml - secret: - secretName: {{ default (printf "%s-%s" (include "mission-control.fullname" .) "systemyaml") .Values.systemYamlOverride.existingSecret }} - {{- end }} - {{- if .Values.postgresql.enabled }} - - name: postgresql-setup - configMap: - name: {{ template "mission-control.fullname" . }}-postgresql-setup-script - {{- end }} - - name: jfmc-setup-scripts - configMap: - name: {{ template "mission-control.fullname" . }}-jfmc-setup-scripts - {{- if .Values.filebeat.enabled }} - - name: filebeat-config - configMap: - name: {{ template "mission-control.fullname" . }}-filebeat-config - {{- end }} - {{- if .Values.common.configMaps }} - - name: mission-control-configmaps - configMap: - name: {{ template "mission-control.fullname" . }}-configmaps - {{- end }} - {{- if or .Values.common.customVolumes .Values.global.customVolumes }} -{{ tpl (include "mission-control.customVolumes" .) . | indent 6 }} - {{- end }} - {{- if not .Values.missionControl.persistence.enabled }} - - name: mission-control-data - emptyDir: {} - {{- end }} - {{- if and (.Values.missionControl.persistence.enabled) (.Values.missionControl.persistence.existingClaim) }} - - name: mission-control-data - persistentVolumeClaim: - claimName: {{ .Values.missionControl.persistence.existingClaim }} - {{- end }} - {{- if not .Values.elasticsearch.persistence.enabled }} - - name: elasticsearch-data - emptyDir: {} - {{- end }} - {{- if and (.Values.elasticsearch.persistence.enabled) (.Values.elasticsearch.persistence.existingClaim) }} - - name: elasticsearch-data - persistentVolumeClaim: - claimName: {{ .Values.elasticsearch.persistence.existingClaim }} - {{- end }} - volumeClaimTemplates: - {{- if and (.Values.missionControl.persistence.enabled) (not .Values.missionControl.persistence.existingClaim) }} - - metadata: - name: mission-control-data - spec: - {{- if .Values.missionControl.persistence.storageClass }} - {{- if (eq "-" .Values.missionControl.persistence.storageClass) }} - storageClassName: '' - {{- else }} - storageClassName: '{{ .Values.missionControl.persistence.storageClass }}' - {{- end }} - {{- end }} - accessModes: [ '{{ .Values.missionControl.persistence.accessMode }}' ] - resources: - requests: - storage: {{ .Values.missionControl.persistence.size }} - {{- end }} - {{- if and (.Values.elasticsearch.persistence.enabled) (not .Values.elasticsearch.persistence.existingClaim) }} - - metadata: - name: elasticsearch-data - spec: - {{- if .Values.elasticsearch.persistence.storageClass }} - {{- if (eq "-" .Values.elasticsearch.persistence.storageClass) }} - storageClassName: '' - {{- else }} - storageClassName: '{{ .Values.elasticsearch.persistence.storageClass }}' - {{- end }} - {{- end }} - accessModes: [ '{{ .Values.elasticsearch.persistence.accessMode }}' ] - resources: - requests: - storage: {{ .Values.elasticsearch.persistence.size }} - {{- end }} diff --git a/stable/mission-control/templates/mission-control-svc.yaml b/stable/mission-control/templates/mission-control-svc.yaml deleted file mode 100644 index 0f4f959aa..000000000 --- a/stable/mission-control/templates/mission-control-svc.yaml +++ /dev/null @@ -1,38 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: {{ template "mission-control.fullname" . }} - labels: - app: {{ template "mission-control.name" . }} - chart: {{ template "mission-control.chart" . }} - component: {{ .Values.missionControl.name }} - heritage: {{ .Release.Service }} - release: {{ .Release.Name }} - {{- with .Values.missionControl.labels }} -{{ toYaml . | indent 4 }} - {{- end }} -{{- if .Values.missionControl.service.annotations }} - annotations: -{{ toYaml .Values.missionControl.service.annotations | indent 4 }} -{{- end }} -spec: - type: {{ .Values.missionControl.service.type }} - ports: - - name: http - port: {{ .Values.missionControl.externalPort }} - targetPort: {{ .Values.missionControl.internalPort }} - protocol: TCP - - name: http-router - port: {{ .Values.router.externalPort }} - targetPort: {{ .Values.router.internalPort }} - protocol: TCP -{{- if .Values.elasticsearch.enabled }} - - name: tcp-estransport - port: {{ .Values.elasticsearch.transportPort }} - targetPort: {{ .Values.elasticsearch.transportPort }} -{{- end }} - publishNotReadyAddresses: true - selector: - app: {{ template "mission-control.name" . }} - component: {{ .Values.missionControl.name }} - release: {{ .Release.Name }} diff --git a/stable/mission-control/templates/mission-control-system-yaml.yaml b/stable/mission-control/templates/mission-control-system-yaml.yaml deleted file mode 100644 index 970890d85..000000000 --- a/stable/mission-control/templates/mission-control-system-yaml.yaml +++ /dev/null @@ -1,16 +0,0 @@ -{{- if not .Values.systemYamlOverride.existingSecret }} -apiVersion: v1 -kind: Secret -metadata: - name: {{ template "mission-control.fullname" . }}-systemyaml - labels: - app: {{ template "mission-control.name" . }} - chart: {{ template "mission-control.chart" . }} - component: {{ .Values.missionControl.name }} - heritage: {{ .Release.Service }} - release: {{ .Release.Name }} -type: Opaque -stringData: - system.yaml: | -{{ tpl .Values.missionControl.systemYaml . | indent 4 }} -{{- end }} diff --git a/stable/mission-control/templates/postgresql-setup-script.yaml b/stable/mission-control/templates/postgresql-setup-script.yaml deleted file mode 100644 index 6856922ef..000000000 --- a/stable/mission-control/templates/postgresql-setup-script.yaml +++ /dev/null @@ -1,173 +0,0 @@ -{{- if .Values.postgresql.enabled }} -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ template "mission-control.fullname" . }}-postgresql-setup-script - labels: - app: {{ template "mission-control.name" . }} - chart: {{ template "mission-control.chart" . }} - heritage: {{ .Release.Service }} - release: {{ .Release.Name }} -data: - createPostgresUsers.sh: | - #!/bin/bash - # This can be used to create user, database, schema and grant the required permissions. - # This script can handle multiple execution and not with "already exists" error. An entity will get created only if it does not exist. - # NOTE : 1. This expects current linux user to be admin user in postgreSQL (this is the case with 'postgres' user) - # 2. Execute this by logging as postgres or any other user with similar privilege - # 3. This files needs be executed from a location which postgres (or the admin user which will be used) has access to. (/opt can be used) - # - # su postgres -c "POSTGRES_PATH=/path/to/postgres/bin PGPASSWORD=postgres bash ./createPostgresUsers.sh" - - POSTGRES_LABEL="Postgres" - - log() { - echo -e "$1" - } - - errorExit() { - echo; echo -e "\033[31mERROR:\033[0m $1"; echo - exit 1 - } - - # Create user if it does not exist - createUser(){ - local user=$1 - local pass=$2 - - [ ! -z ${user} ] || errorExit "user is empty" - [ ! -z ${pass} ] || errorExit "password is empty" - - ${PSQL} $POSTGRES_OPTIONS -tAc "SELECT 1 FROM pg_roles WHERE rolname='${user}'" | grep -q 1 1>/dev/null - local rc=$? - # If the user already exists, change the password - if [[ ${rc} -eq 0 ]]; then - echo "Changing password for user ${user}..." - ${PSQL} $POSTGRES_OPTIONS -c "ALTER USER ${user} WITH PASSWORD '${pass}';" 1>/dev/null || errorExit "Failed updating user ${user} password on PostgreSQL" - echo "Done" - else - echo "Creating user ${user}..." - ${PSQL} $POSTGRES_OPTIONS -c "CREATE USER ${user} WITH PASSWORD '${pass}';" 1>/dev/null || errorExit "Failed creating user ${user} on PostgreSQL" - echo "Done" - fi - } - - # Create database if it does not exist - createDB(){ - local db=$1 - local user=$2 - - [ ! -z ${db} ] || errorExit "db is empty" - [ ! -z ${user} ] || errorExit "user is empty" - - if ! ${PSQL} $POSTGRES_OPTIONS -lqt | cut -d \| -f 1 | grep -qw ${db} 1>/dev/null; then - ${PSQL} $POSTGRES_OPTIONS -c "CREATE DATABASE ${db} WITH ENCODING='UTF8' TABLESPACE=${DB_TABLESPACE} template template0;" 1>/dev/null || errorExit "Failed creating db ${db} on PostgreSQL" - fi - } - - # Create schema if it does not exist - createSchema(){ - local schema=$1 - local db=$2 - local user=$3 - - [ ! -z ${schema} ] || errorExit "schema is empty" - [ ! -z ${db} ] || errorExit "db is empty" - [ ! -z ${user} ] || errorExit "user is empty" - - PGOPTIONS='--client-min-messages=warning' ${PSQL} $POSTGRES_OPTIONS --dbname="${db}" -qc "CREATE SCHEMA IF NOT EXISTS ${schema} AUTHORIZATION ${user}" 1>/dev/null - } - - postgresIsNotReady() { - attempt_number=${attempt_number:-0} - ${PSQL} $POSTGRES_OPTIONS --version > /dev/null 2>&1 - outcome1=$? - # Execute a simple db function to verify if postgres is up and running - ${PSQL} $POSTGRES_OPTIONS -l > /dev/null 2>&1 - outcome2=$? - if [[ $outcome1 -eq 0 ]] && [[ $outcome2 -eq 0 ]]; then - return 0 - else - if [ $attempt_number -gt 10 ]; then - errorExit "Unable to proceed. $POSTGRES_LABEL is not reachable. This can occur if the service is not running \ - or the port is not accepting requests at $DB_PORT (host : $DB_HOST). Gave up after $attempt_number attempts" - fi - let "attempt_number=attempt_number+1" - return 1 - fi - } - - init(){ - if [[ -z $POSTGRES_PATH ]]; then - hash ${PSQL} 2>/dev/null || { echo >&2 "\"${PSQL}\" is not installed or not available in path"; exit 1; } - fi - - log "Waiting for $POSTGRES_LABEL to get ready using the commands: \"${PSQL} $POSTGRES_OPTIONS --version\" & \"${PSQL} $POSTGRES_OPTIONS -l\"" - attempt_number=0 - while ! postgresIsNotReady - do - sleep 5 - echo -n '.' - done - log "$POSTGRES_LABEL is ready. Executing commands" - } - - setupDB(){ - local user=$1 - local pass=$2 - local db=$3 - local schema=$4 - - createUser "${user}" "${pass}" - createDB "${db}" "${user}" - createSchema "${schema}" "${db}" "${user}" - - ${PSQL} $POSTGRES_OPTIONS -c "GRANT ALL ON DATABASE ${db} TO ${user}" 1>/dev/null; - ${PSQL} $POSTGRES_OPTIONS -c "GRANT ALL ON SCHEMA ${schema} TO ${user}" --dbname="${db}" 1>/dev/null; - } - - # Load default and custom postgres details from below files - [ -f setenvDefaults.sh ] && source setenvDefaults.sh || true - [ -f setenv.sh ] && source setenv.sh || true - - ### Following are the postgres details being setup for each service. - ## Common details - : ${DB_PORT:=5432} - : ${DB_NAME:="mission_control"} - : ${DB_SSLMODE:="false"} - : ${DB_TABLESPACE:="pg_default"} - : ${DB_HOST:="localhost"} - - ## Insight Server - : ${JFIS_DB_USERNAME:="mc"} - : ${JFIS_DB_PASSWORD:="password"} - : ${JFIS_DB_SCHEMA:="insight_server"} - - ## Insight Scheduler - : ${JFSC_DB_USERNAME:="mc"} - : ${JFSC_DB_PASSWORD:="password"} - : ${JFSC_DB_SCHEMA:="insight_scheduler"} - - ## Jfmc Server - : ${JFMC_DB_USERNAME:="mc"} - : ${JFMC_DB_PASSWORD:="password"} - : ${JFMC_DB_SCHEMA:="jfmc_server"} - - # Enable script to run setup for specific service - SERVICE=${1:-all} - if ! [[ $SERVICE =~ all|jfmc|jfex|jfsc|jfis ]]; then - SERVICE=all - fi - - DB_HOST={{ .Release.Name }}-postgresql - [[ -z "${POSTGRES_PATH}" ]] && PSQL=psql || PSQL=${POSTGRES_PATH}/psql - POSTGRES_OPTIONS="--host=${DB_HOST} --port=${DB_PORT} -U {{ .Values.postgresql.postgresqlUsername }} -w" - - init - [[ $SERVICE =~ all|jfis ]] && setupDB "${JFIS_DB_USERNAME}" "${JFIS_DB_PASSWORD}" "${DB_NAME}" "${JFIS_DB_SCHEMA}" || true - [[ $SERVICE =~ all|jfsc ]] && setupDB "${JFSC_DB_USERNAME}" "${JFSC_DB_PASSWORD}" "${DB_NAME}" "${JFSC_DB_SCHEMA}" || true - [[ $SERVICE =~ all|jfmc ]] && setupDB "${JFMC_DB_USERNAME}" "${JFMC_DB_PASSWORD}" "${DB_NAME}" "${JFMC_DB_SCHEMA}" || true - log "$POSTGRES_LABEL setup is now complete" - - exit 0 -{{- end }} diff --git a/stable/mission-control/values-large.yaml b/stable/mission-control/values-large.yaml deleted file mode 100644 index 6f38d308d..000000000 --- a/stable/mission-control/values-large.yaml +++ /dev/null @@ -1,53 +0,0 @@ -initContainers: - resources: - requests: - memory: "64Mi" - cpu: "10m" - limits: - memory: "128Mi" - cpu: "250m" -elasticsearch: - resources: - requests: - memory: "8Gi" - cpu: "1" - limits: - memory: "8Gi" - cpu: "2" - ## ElasticSearch xms and xmx should be same! - javaOpts: - xms: "7g" - xmx: "7g" - -missionControl: - resources: - requests: - memory: "3Gi" - cpu: "1" - limits: - memory: "6Gi" - cpu: "2" - javaOpts: - xms: "3g" - xmx: "6g" - -insightServer: - resources: - requests: - memory: "512Mi" - cpu: "1" - limits: - memory: "4Gi" - cpu: "2" - -insightScheduler: - resources: - requests: - memory: "512Mi" - cpu: "1" - limits: - memory: "3Gi" - cpu: "2" - javaOpts: - xms: "512m" - xmx: "3g" diff --git a/stable/mission-control/values-medium.yaml b/stable/mission-control/values-medium.yaml deleted file mode 100644 index 995ad4093..000000000 --- a/stable/mission-control/values-medium.yaml +++ /dev/null @@ -1,53 +0,0 @@ -initContainers: - resources: - requests: - memory: "64Mi" - cpu: "10m" - limits: - memory: "128Mi" - cpu: "250m" -elasticsearch: - resources: - requests: - memory: "6Gi" - cpu: "500m" - limits: - memory: "6Gi" - cpu: "2" - ## ElasticSearch xms and xmx should be same! - javaOpts: - xms: "5g" - xmx: "5g" - -missionControl: - resources: - requests: - memory: "3Gi" - cpu: "500m" - limits: - memory: "6Gi" - cpu: "2" - javaOpts: - xms: "3g" - xmx: "6g" - -insightServer: - resources: - requests: - memory: "512Mi" - cpu: "500m" - limits: - memory: "4Gi" - cpu: "1" - -insightScheduler: - resources: - requests: - memory: "512Mi" - cpu: "500m" - limits: - memory: "3Gi" - cpu: "1" - javaOpts: - xms: "512m" - xmx: "3g" diff --git a/stable/mission-control/values-small.yaml b/stable/mission-control/values-small.yaml deleted file mode 100644 index 31885d438..000000000 --- a/stable/mission-control/values-small.yaml +++ /dev/null @@ -1,53 +0,0 @@ -initContainers: - resources: - requests: - memory: "64Mi" - cpu: "10m" - limits: - memory: "128Mi" - cpu: "250m" -elasticsearch: - resources: - requests: - memory: "4Gi" - cpu: "500m" - limits: - memory: "4Gi" - cpu: "1" - ## ElasticSearch xms and xmx should be same! - javaOpts: - xms: "3g" - xmx: "3g" - -missionControl: - resources: - requests: - memory: "2Gi" - cpu: "500m" - limits: - memory: "4Gi" - cpu: "1" - javaOpts: - xms: "2g" - xmx: "4g" - -insightServer: - resources: - requests: - memory: "512Mi" - cpu: "500m" - limits: - memory: "2Gi" - cpu: "1" - -insightScheduler: - resources: - requests: - memory: "512Mi" - cpu: "500m" - limits: - memory: "2Gi" - cpu: "1" - javaOpts: - xms: "512m" - xmx: "2g" diff --git a/stable/mission-control/values.yaml b/stable/mission-control/values.yaml deleted file mode 100644 index 75b2e7105..000000000 --- a/stable/mission-control/values.yaml +++ /dev/null @@ -1,1013 +0,0 @@ -# Default values for Mission Control. -# This is a YAML-formatted file. -# Beware when changing values here. You should know what you are doing! -# Access the values with {{ .Values.key.subkey }} - -global: - # imageRegistry: - # imagePullSecrets: - # - myRegistryKeySecretName - ## Chart.AppVersion can be overidden using global.versions.missionControl or image tags - ## Note: Order of preference is 1) global.versions 2) image tags 3) Chart.AppVersion - versions: {} - # missionControl: - # router: - # jfrogUrl: - # joinKey: - # masterKey: - # joinKeySecretName: - # masterKeySecretName: - - ## Note: tags customInitContainersBegin,customInitContainers,customVolumes,customVolumeMounts,customSidecarContainers can be used both from global and application level simultaneously - # customVolumes: | - - # customVolumeMounts: | - - # customInitContainersBegin: | - - # customInitContainers: | - - # customSidecarContainers: | - - customCertificates: - enabled: false - # certificateSecretName: - -## Partially override mission-control.fullname template (eg: -) -# nameOverride: - -## Fully override mission-control.fullname template -# fullnameOverride: - -initContainerImage: releases-docker.jfrog.io/alpine:3.14.2 - -# For supporting pulling from private registries -imagePullSecrets: - # - myRegistryKeySecretName - -## Mission-control systemYaml override -## This is for advanced usecases where users wants to provide their own systemYaml for configuring mission-control -## Refer - https://www.jfrog.com/confluence/display/JFROG/Mission+Control+System+YAML -## Note: This will override existing (default) .Values.missionControl.systemYaml in values.yaml -## Alternatively, systemYaml can be overidden via customInitContainers using external sources like vaults, external repositories etc. Please refer customInitContainer section below for an example. -## Note: Order of preference is 1) customInitContainers 2) systemYamlOverride existingSecret 3) default systemYaml in values.yaml -systemYamlOverride: -## You can use a pre-existing secret by specifying existingSecret - existingSecret: -## The dataKey should be the name of the secret data key created. - dataKey: - -# Init containers -initContainers: - resources: {} -# requests: -# memory: "64Mi" -# cpu: "10m" -# limits: -# memory: "128Mi" -# cpu: "250m" - -imagePullPolicy: IfNotPresent - -# For HA -replicaCount: 1 - -shared: - node: - id: - -common: - uid: 1050 - gid: 1050 - - ## Add custom volumes - customVolumes: | - # - name: custom-script - # configMap: - # name: custom-script - - ## Add custom volumesMounts - customVolumeMounts: | - # - name: custom-script - # mountPath: /scripts/script.sh - # subPath: script.sh - - # Add any list of configmaps - configMaps: | - # posthook-start.sh: |- - # echo "This is a post start script" - # posthook-end.sh: |- - # echo "This is a post end script" - - ## Add custom init containers execution before predefined init containers - customInitContainersBegin: | - # - name: "custom-setup" - # image: "{{ .Values.initContainerImage }}" - # imagePullPolicy: "{{ .Values.imagePullPolicy }}" - # securityContext: - # runAsNonRoot: true - # allowPrivilegeEscalation: false - # capabilities: - # drop: - # - NET_RAW - # command: - # - 'sh' - # - '-c' - # - 'touch {{ .Values.missionControl.persistence.mountPath }}/example-custom-setup' - # volumeMounts: - # - mountPath: "{{ .Values.missionControl.persistence.mountPath }}" - # name: data-volume - - ## Add custom init containers execution after predefined init containers - customInitContainers: | - # - name: "custom-systemyaml-setup" - # image: "{{ .Values.initContainerImage }}" - # imagePullPolicy: "{{ .Values.imagePullPolicy }}" - # securityContext: - # runAsNonRoot: true - # allowPrivilegeEscalation: false - # capabilities: - # drop: - # - NET_RAW - # command: - # - 'sh' - # - '-c' - # - 'wget -O {{ .Values.missionControl.persistence.mountPath }}/etc/system.yaml https:///systemyaml' - # volumeMounts: - # - mountPath: "{{ .Values.missionControl.persistence.mountPath }}" - # name: data-volume - - ## Add custom sidecar containers - # - The provided example uses a custom volume (customVolumes) - customSidecarContainers: | - # - name: "sidecar-list-etc" - # image: "{{ .Values.initContainerImage }}" - # imagePullPolicy: "{{ .Values.imagePullPolicy }}" - # securityContext: - # runAsNonRoot: true - # allowPrivilegeEscalation: false - # capabilities: - # drop: - # - NET_RAW - # command: - # - 'sh' - # - '-c' - # - 'sh /scripts/script.sh' - # volumeMounts: - # - mountPath: "{{ .Values.xray.persistence.mountPath }}" - # name: volume - # - mountPath: "/scripts/script.sh" - # name: custom-script - # subPath: script.sh - # resources: - # requests: - # memory: "32Mi" - # cpu: "50m" - # limits: - # memory: "128Mi" - # cpu: "100m" - - # Add custom secrets - secret per file - customSecrets: - # - name: custom-secret - # key: custom-secret.yaml - # data: > - # custom_secret_config: - # parameter1: value1 - # parameter2: value2 - # - name: custom-secret2 - # key: custom-secret2.config - # data: | - # here the custom secret 2 config - -## Role Based Access Control -## Ref: https://kubernetes.io/docs/admin/authorization/rbac/ -rbac: - create: true - role: - ## Rules to create. It follows the role specification - rules: - - apiGroups: - - '' - resources: - - services - - endpoints - - pods - verbs: - - get - - watch - - list - -networkpolicy: [] - # Allows all ingress and egress - # - name: mission-control - # podSelector: - # matchLabels: - # app: mission-control - # egress: - # - {} - # ingress: - # - {} - # Uncomment to allow only mission-control pods to communicate with postgresql (if postgresql.enabled is true) - # - name: postgres - # podSelector: - # matchLabels: - # app: postgresql - # ingress: - # - from: - # - podSelector: - # matchLabels: - # app: mission-control - -## Service Account -## Ref: https://kubernetes.io/docs/admin/service-accounts-admin/ -## -serviceAccount: - create: true - ## The name of the ServiceAccount to use. - ## If not set and create is true, a name is generated using the fullname template - name: - -## Details required for initialization/setup of database -dbSetup: - postgresql: - image: - repository: releases-docker.jfrog.io/postgres - tag: 13.2-alpine - pullPolicy: IfNotPresent - -# PostgreSQL - -## Configuration values for the PostgreSQL dependency sub-chart -## ref: https://github.com/kubernetes/charts/blob/master/stable/postgresql/README.md -postgresql: - enabled: true - image: - registry: releases-docker.jfrog.io - repository: bitnami/postgresql - tag: 13.2.0-debian-10-r55 - postgresqlUsername: postgres - postgresqlPassword: "" - postgresqlDatabase: mission_control - postgresqlExtendedConf: - listenAddresses: "*" - maxConnections: "1500" - db: - name: mission_control - sslmode: "false" - tablespace: "pg_default" - ## Use single user and password for all the services - user: mc - password: "" - jfmcSchema: jfmc_server - jfisSchema: insight_server - jfscSchema: insight_scheduler - service: - port: 5432 - persistence: - enabled: true - size: 100Gi - # existingClaim: - primary: - nodeSelector: {} - affinity: {} - tolerations: [] - readReplicas: - nodeSelector: {} - affinity: {} - tolerations: [] - resources: {} - # requests: - # memory: "1Gi" - # cpu: "250m" - # limits: - # memory: "2Gi" - # cpu: "1" - -### If NOT using the PostgreSQL in this chart (postgresql.enabled=false), -## specify custom database details here or leave empty -database: - type: postgresql - driver: org.postgresql.Driver - ## Please make sure these are created under the provided database - name: mission_control - jfisSchema: insight_server - jfmcSchema: jfmc_server - jfscSchema: insight_scheduler - ## Use single user and password for all the services - user: - password: - url: - ## If you have existing Kubernetes secrets containing db credentials, use - ## these values - secrets: {} - # user: - # name: "mc-database-creds" - # key: "db-user" - # password: - # name: "mc-database-creds" - # key: "db-password" - # url: - # name: "mc-database-creds" - # key: "db-url" - - -elasticsearch: - enabled: true - uid: 1000 - ## To overwrite existing ES search guard certificates, create a secret with the following files (localhost.key, localhost.pem, root-ca.pem, sgadmin.key, sgadmin.pem ) - ## certificatesSecretName: - name: elasticsearch - initContainerImage: releases-docker.jfrog.io/alpine:3.14.2 - configureDockerHost: true - image: - registry: releases-docker.jfrog.io - repository: jfrog/elasticsearch-sg - tag: 7.14.1 - pullPolicy: IfNotPresent - ## Enter elasticsearch connection details - ## By default url is set to localhost:8082 (router) - ## If external elasticsearch is used, provide external elasticsearch url and set elasticsearch.enabled=false - url: '{{ include "elasticsearch.url" . }}' - transportPort: 9300 - username: "admin" - password: "admin" - env: - clusterName: "es-cluster" - networkHost: "0.0.0.0" - transportHost: "0.0.0.0" - maxMapCount: 262144 - - persistence: - enabled: true - ## A manually managed Persistent Volume and Claim - ## Requires persistence.enabled: true - ## If defined, PVC must be created manually before volume will be bound - # existingClaim: - - mountPath: "/usr/share/elasticsearch/data" - accessMode: ReadWriteOnce - size: 100Gi - ## ElasticSearch data Persistent Volume Storage Class - ## If defined, storageClassName: - ## If set to "-", storageClassName: "", which disables dynamic provisioning - ## If undefined (the default) or set to null, no storageClassName spec is - ## set, choosing the default provisioner. (gp2 on AWS, standard on - ## GKE, AWS & OpenStack) - ## - # storageClass: "-" - - ## ElasticSearch xms and xmx should be same! - javaOpts: - xms: "2g" - xmx: "2g" - - resources: {} - # requests: - # memory: "2Gi" - # cpu: "100m" - # limits: - # memory: "2.5Gi" - # cpu: "500m" - - livenessProbe: - enabled: true - config: | - httpGet: - path: /_cluster/health - port: 9200 - initialDelaySeconds: {{ if semverCompare " Security > Settings" (include "mission-control.jfrogUrl" .)) . }}" - elasticsearch: - username: {{ .Values.elasticsearch.username }} - password: {{ .Values.elasticsearch.password }} - {{- if and .Values.elasticsearch.enabled (gt (int .Values.replicaCount) 1) }} - clusterSetup: "yes" - {{- end }} - {{- if not .Values.elasticsearch.enabled }} - external: true - url: {{ tpl .Values.elasticsearch.url . }} - {{- end }} - database: - {{- if .Values.postgresql.enabled }} - type: postgresql - driver: org.postgresql.Driver - url: jdbc:postgresql://{{ .Release.Name }}-postgresql:{{ .Values.postgresql.service.port }}/{{ .Values.postgresql.db.name }}?sslmode=disable - {{ else }} - type: "{{ .Values.database.type }}" - driver: "{{ .Values.database.driver }}" - {{- end }} - - mc: - {{- if .Values.postgresql.enabled }} - database: - username: {{ .Values.postgresql.db.user }} - schema: {{ .Values.postgresql.db.jfmcSchema }} - {{- end }} - extraJavaOpts: > - {{- with .Values.missionControl.javaOpts }} - {{- if .xms }} - -Xms{{ .xms }} - {{- end }} - {{- if .xmx }} - -Xmx{{ .xmx }} - {{- end }} - {{- if .other }} - {{ .other }} - {{- end }} - {{- end }} - - insight-scheduler: - {{- if .Values.postgresql.enabled }} - database: - username: {{ .Values.postgresql.db.user }} - schema: {{ .Values.postgresql.db.jfscSchema }} - {{- end }} - extraJavaOpts: > - {{- with .Values.insightScheduler.javaOpts }} - {{- if .xms }} - -Xms{{ .xms }} - {{- end }} - {{- if .xmx }} - -Xmx{{ .xmx }} - {{- end }} - {{- if .other }} - {{ .other }} - {{- end }} - {{- end }} - - insight-server: - {{- if .Values.postgresql.enabled }} - database: - username: {{ .Values.postgresql.db.user }} - schema: {{ .Values.postgresql.db.jfisSchema }} - {{- end }} - clients: - elasticsearch: - connectionWaitTimeoutSecs: {{ .Values.insightServer.clients.elasticsearch.connectionWaitTimeoutSecs }} - searchguard: - connectionWaitTimeoutSecs: {{ .Values.insightServer.clients.elasticsearch.searchguard.connectionWaitTimeoutSecs }} - - persistence: - enabled: true - ## A manually managed Persistent Volume and Claim - ## Requires persistence.enabled: true - ## If defined, PVC must be created manually before volume will be bound - # existingClaim: - - mountPath: "/var/opt/jfrog/mc" - accessMode: ReadWriteOnce - size: 100Gi - ## Mission Control data Persistent Volume Storage Class - ## If defined, storageClassName: - ## If set to "-", storageClassName: "", which disables dynamic provisioning - ## If undefined (the default) or set to null, no storageClassName spec is - ## set, choosing the default provisioner. (gp2 on AWS, standard on - ## GKE, AWS & OpenStack) - ## - # storageClass: "-" - - ## Control Java options (JAVA_OPTIONS) - ## IMPORTANT: keep resources.limits.memory higher than javaOpts.xmx by 0.5G - javaOpts: {} - # other: "-server -XX:+UseG1GC -Dfile.encoding=UTF8" - # xms: "2g" - # xmx: "3g" - resources: {} - # requests: - # memory: "2Gi" - # cpu: "100m" - # limits: - # memory: "3.5Gi" - # cpu: "1" - nodeSelector: {} - - tolerations: [] - - affinity: {} - - service: - type: ClusterIP - annotations: {} - internalPort: 8080 - externalPort: 80 - - livenessProbe: - enabled: true - config: | - exec: - command: - - curl - - http://127.0.0.1:{{ .Values.missionControl.internalPort }}{{ include "mission-control.livenessProbe" .}} - initialDelaySeconds: {{ if semverCompare " - ## If set to "-", storageClassName: "", which disables dynamic provisioning - ## If undefined (the default) or set to null, no storageClassName spec is - ## set, choosing the default provisioner. (gp2 on AWS, standard on - ## GKE, AWS & OpenStack) - ## - # storageClass: "-" - - ## Add any of the loggers to a sidecar if you want to be able to see them with kubectl logs or a log collector in your k8s cluster - loggers: [] - # - insight-server.log - - # Loggers containers resources - loggersResources: {} - # requests: - # memory: "64Mi" - # cpu: "25m" - # limits: - # memory: "128Mi" - # cpu: "50m" - - livenessProbe: - enabled: true - config: | - exec: - command: - - curl - - http://127.0.0.1:{{ .Values.insightServer.internalPort }}{{ include "mission-control.livenessProbe" .}} - initialDelaySeconds: {{ if semverCompare " - ## If set to "-", storageClassName: "", which disables dynamic provisioning - ## If undefined (the default) or set to null, no storageClassName spec is - ## set, choosing the default provisioner. (gp2 on AWS, standard on - ## GKE, AWS & OpenStack) - ## - # storageClass: "-" - - ## Add any of the loggers to a sidecar if you want to be able to see them with kubectl logs or a log collector in your k8s cluster - loggers: [] - # - insight-scheduler.log - # - access.log - - # Loggers containers resources - loggersResources: {} - # requests: - # memory: "64Mi" - # cpu: "25m" - # limits: - # memory: "128Mi" - # cpu: "50m" - - livenessProbe: - enabled: true - config: | - exec: - command: - - curl - - http://127.0.0.1:{{ .Values.insightScheduler.internalPort }}{{ include "mission-control.livenessProbe" .}} - initialDelaySeconds: {{ if semverCompare " Date: Tue, 6 Aug 2024 15:53:38 +0530 Subject: [PATCH 06/30] [artifactory] 7.90.6 release --- stable/artifactory-cpp-ce/CHANGELOG.md | 2 +- stable/artifactory-cpp-ce/Chart.yaml | 6 +++--- stable/artifactory-ha/CHANGELOG.md | 2 +- stable/artifactory-ha/Chart.yaml | 6 +++--- stable/artifactory-jcr/CHANGELOG.md | 2 +- stable/artifactory-jcr/Chart.yaml | 6 +++--- stable/artifactory-oss/CHANGELOG.md | 2 +- stable/artifactory-oss/Chart.yaml | 6 +++--- stable/artifactory/CHANGELOG.md | 2 +- stable/artifactory/Chart.yaml | 4 ++-- 10 files changed, 19 insertions(+), 19 deletions(-) diff --git a/stable/artifactory-cpp-ce/CHANGELOG.md b/stable/artifactory-cpp-ce/CHANGELOG.md index 82181cc3a..5b9da0429 100644 --- a/stable/artifactory-cpp-ce/CHANGELOG.md +++ b/stable/artifactory-cpp-ce/CHANGELOG.md @@ -1,7 +1,7 @@ # JFrog Artifactory CE for C++ Chart Changelog All changes to this chart will be documented in this file -## [107.90.5] - Feb 20, 2024 +## [107.90.6] - Feb 20, 2024 * Updated `artifactory.installerInfo` content ## [107.80.0] - Feb 1, 2024 diff --git a/stable/artifactory-cpp-ce/Chart.yaml b/stable/artifactory-cpp-ce/Chart.yaml index 19962ca30..79e0278a3 100644 --- a/stable/artifactory-cpp-ce/Chart.yaml +++ b/stable/artifactory-cpp-ce/Chart.yaml @@ -1,9 +1,9 @@ apiVersion: v2 -appVersion: 7.90.5 +appVersion: 7.90.6 dependencies: - name: artifactory repository: file://charts/artifactory - version: 107.90.5 + version: 107.90.6 description: JFrog Artifactory CE for C++ home: https://www.jfrog.com/artifactory/ icon: https://raw.githubusercontent.com/jfrog/charts/master/stable/artifactory-cpp-ce/logo/conan.png @@ -21,4 +21,4 @@ name: artifactory-cpp-ce sources: - https://github.com/jfrog/charts type: application -version: 107.90.5 +version: 107.90.6 diff --git a/stable/artifactory-ha/CHANGELOG.md b/stable/artifactory-ha/CHANGELOG.md index dc42cf9a5..d50a072b3 100644 --- a/stable/artifactory-ha/CHANGELOG.md +++ b/stable/artifactory-ha/CHANGELOG.md @@ -1,7 +1,7 @@ # JFrog Artifactory-ha Chart Changelog All changes to this chart will be documented in this file. -## [107.90.5] - July 18, 2024 +## [107.90.6] - July 18, 2024 * Fixed #adding colon in image registry which breaks deployment [GH-1892](https://github.com/jfrog/charts/pull/1892) * Added new `nginx.hosts` to use Nginx server_name directive instead of `ingress.hosts` * Added a deprecation notice of ingress.hosts when `ngnix.enabled` is true diff --git a/stable/artifactory-ha/Chart.yaml b/stable/artifactory-ha/Chart.yaml index e9c653a06..0149ef5b5 100644 --- a/stable/artifactory-ha/Chart.yaml +++ b/stable/artifactory-ha/Chart.yaml @@ -1,7 +1,7 @@ annotations: - artifactoryServiceVersion: 7.90.5 + artifactoryServiceVersion: 7.90.7 apiVersion: v2 -appVersion: 7.90.5 +appVersion: 7.90.6 dependencies: - condition: postgresql.enabled name: postgresql @@ -23,4 +23,4 @@ name: artifactory-ha sources: - https://github.com/jfrog/charts type: application -version: 107.90.5 +version: 107.90.6 diff --git a/stable/artifactory-jcr/CHANGELOG.md b/stable/artifactory-jcr/CHANGELOG.md index b9d42a96b..24f5da334 100644 --- a/stable/artifactory-jcr/CHANGELOG.md +++ b/stable/artifactory-jcr/CHANGELOG.md @@ -1,7 +1,7 @@ # JFrog Container Registry Chart Changelog All changes to this chart will be documented in this file. -## [107.90.5] - Feb 20, 2024 +## [107.90.6] - Feb 20, 2024 * Updated `artifactory.installerInfo` content ## [107.80.0] - Feb 1, 2024 diff --git a/stable/artifactory-jcr/Chart.yaml b/stable/artifactory-jcr/Chart.yaml index 5ae9c8012..a6f7d310f 100644 --- a/stable/artifactory-jcr/Chart.yaml +++ b/stable/artifactory-jcr/Chart.yaml @@ -1,9 +1,9 @@ apiVersion: v2 -appVersion: 7.90.5 +appVersion: 7.90.6 dependencies: - name: artifactory repository: file://charts/artifactory - version: 107.90.5 + version: 107.90.6 description: JFrog Container Registry home: https://jfrog.com/container-registry/ icon: https://raw.githubusercontent.com/jfrog/charts/master/stable/artifactory-jcr/logo/jcr-logo.png @@ -22,4 +22,4 @@ name: artifactory-jcr sources: - https://github.com/jfrog/charts type: application -version: 107.90.5 +version: 107.90.6 diff --git a/stable/artifactory-oss/CHANGELOG.md b/stable/artifactory-oss/CHANGELOG.md index 77419acfc..618c143e2 100644 --- a/stable/artifactory-oss/CHANGELOG.md +++ b/stable/artifactory-oss/CHANGELOG.md @@ -1,7 +1,7 @@ # JFrog Artifactory OSS Chart Changelog All changes to this chart will be documented in this file -## [107.90.5] - Feb 20, 2024 +## [107.90.6] - Feb 20, 2024 * Updated `artifactory.installerInfo` content ## [107.80.0] - Feb 1, 2024 diff --git a/stable/artifactory-oss/Chart.yaml b/stable/artifactory-oss/Chart.yaml index 26cdb03cd..3ce81cfd8 100644 --- a/stable/artifactory-oss/Chart.yaml +++ b/stable/artifactory-oss/Chart.yaml @@ -1,9 +1,9 @@ apiVersion: v2 -appVersion: 7.90.5 +appVersion: 7.90.6 dependencies: - name: artifactory repository: file://charts/artifactory - version: 107.90.5 + version: 107.90.6 description: JFrog Artifactory OSS home: https://www.jfrog.com/artifactory/ icon: https://raw.githubusercontent.com/jfrog/charts/master/stable/artifactory/logo/artifactory-logo.png @@ -20,4 +20,4 @@ name: artifactory-oss sources: - https://github.com/jfrog/charts type: application -version: 107.90.5 +version: 107.90.6 diff --git a/stable/artifactory/CHANGELOG.md b/stable/artifactory/CHANGELOG.md index 759cdf061..64e7da615 100644 --- a/stable/artifactory/CHANGELOG.md +++ b/stable/artifactory/CHANGELOG.md @@ -1,7 +1,7 @@ # JFrog Artifactory Chart Changelog All changes to this chart will be documented in this file. -## [107.90.5] - July 18, 2024 +## [107.90.6] - July 18, 2024 * Fixed #adding colon in image registry which breaks deployment [GH-1892](https://github.com/jfrog/charts/pull/1892) * Added new `nginx.hosts` to use Nginx server_name directive instead of `ingress.hosts` * Added a deprecation notice of ingress.hosts when `ngnix.enabled` is true diff --git a/stable/artifactory/Chart.yaml b/stable/artifactory/Chart.yaml index 3a6f5a6e2..0216c9913 100644 --- a/stable/artifactory/Chart.yaml +++ b/stable/artifactory/Chart.yaml @@ -1,5 +1,5 @@ apiVersion: v2 -appVersion: 7.90.5 +appVersion: 7.90.6 dependencies: - condition: postgresql.enabled name: postgresql @@ -21,4 +21,4 @@ name: artifactory sources: - https://github.com/jfrog/charts type: application -version: 107.90.5 +version: 107.90.6 From 128fea59fc39a754853e75365a9bf84782438cde Mon Sep 17 00:00:00 2001 From: Ram <1331672+chukka@users.noreply.github.com> Date: Tue, 6 Aug 2024 15:54:15 +0530 Subject: [PATCH 07/30] [jfrog-platform] 10.19.1 release --- stable/jfrog-platform/CHANGELOG.md | 4 ++++ stable/jfrog-platform/Chart.lock | 10 +++++----- stable/jfrog-platform/Chart.yaml | 10 +++++----- stable/jfrog-platform/values.yaml | 2 +- 4 files changed, 15 insertions(+), 11 deletions(-) diff --git a/stable/jfrog-platform/CHANGELOG.md b/stable/jfrog-platform/CHANGELOG.md index 69ded4729..bbce0bd72 100644 --- a/stable/jfrog-platform/CHANGELOG.md +++ b/stable/jfrog-platform/CHANGELOG.md @@ -1,6 +1,10 @@ # JFrog Platform Chart Changelog (GA releases only) All changes to this chart will be documented in this file. +## [10.19.1] - Aug 6, 2024 +* Update dependency artifactory chart version to 107.90.6 +* Update dependency xray chart version to 103.101.5 + ## [10.19.0] - Jul 25, 2024 * **Important change:** * Mission Control is also disabled by default now, if you are using this product from previous release, enable them using your custom-values.yaml file. diff --git a/stable/jfrog-platform/Chart.lock b/stable/jfrog-platform/Chart.lock index ff1aa1043..81e97917a 100644 --- a/stable/jfrog-platform/Chart.lock +++ b/stable/jfrog-platform/Chart.lock @@ -7,18 +7,18 @@ dependencies: version: 11.9.3 - name: artifactory repository: https://charts.jfrog.io/ - version: 107.90.5 + version: 107.90.6 - name: xray repository: https://charts.jfrog.io/ - version: 103.100.3 + version: 103.101.5 - name: distribution repository: https://charts.jfrog.io/ - version: 102.25.1 + version: 102.26.1 - name: insight repository: https://charts.jfrog.io/ version: 101.16.7 - name: pipelines repository: https://charts.jfrog.io/ version: 101.59.7 -digest: sha256:724e270ffa0a4cd4b68c9a26d6d0ee114ecc6fe669f35d1acbba8234b07cbfe0 -generated: "2024-07-25T13:47:18.91713+05:30" +digest: sha256:17a38770cacdd56d4a24fc8d198f09139f3c363b75d8b61707cc3b760de0fd11 +generated: "2024-08-06T01:33:16.248044+05:30" diff --git a/stable/jfrog-platform/Chart.yaml b/stable/jfrog-platform/Chart.yaml index 0998a3e2f..214ae072a 100644 --- a/stable/jfrog-platform/Chart.yaml +++ b/stable/jfrog-platform/Chart.yaml @@ -1,5 +1,5 @@ apiVersion: v2 -appVersion: 7.90.5 +appVersion: 7.90.6 dependencies: - condition: postgresql.enabled name: postgresql @@ -12,15 +12,15 @@ dependencies: - condition: artifactory.enabled name: artifactory repository: https://charts.jfrog.io/ - version: 107.90.5 + version: 107.90.6 - condition: xray.enabled name: xray repository: https://charts.jfrog.io/ - version: 103.100.3 + version: 103.101.5 - condition: distribution.enabled name: distribution repository: https://charts.jfrog.io/ - version: 102.25.1 + version: 102.26.1 - condition: insight.enabled name: insight repository: https://charts.jfrog.io/ @@ -50,4 +50,4 @@ name: jfrog-platform sources: - https://github.com/jfrog/charts type: application -version: 10.19.0 +version: 10.19.1 diff --git a/stable/jfrog-platform/values.yaml b/stable/jfrog-platform/values.yaml index bc663934e..2f8bd1348 100644 --- a/stable/jfrog-platform/values.yaml +++ b/stable/jfrog-platform/values.yaml @@ -232,7 +232,7 @@ rabbitmq: artifactory: enabled: true unifiedUpgradeAllowed: true - installerInfo: '{"productId":"Helm_JFrogPlatform/{{ printf "10.19.0-%s" .Chart.AppVersion }}","features":[{"featureId":"Platform/{{ printf "%s-%s" "kubernetes" .Capabilities.KubeVersion.Version }}"},{"featureId":"Database/{{ .Values.database.type }}"},{"featureId":"Nginx_Enabled/{{ .Values.nginx.enabled }}"},{"featureId":"ArtifactoryPersistence_Type/{{ .Values.artifactory.persistence.type }}"},{"featureId":"SplitServicesToContainers_Enabled/{{ .Values.splitServicesToContainers }}"},{"featureId":"Filebeat_Enabled/{{ .Values.filebeat.enabled }}"},{"featureId":"ReplicaCount/{{ .Values.artifactory.replicaCount }}"}]}' + installerInfo: '{"productId":"Helm_JFrogPlatform/{{ printf "10.19.1-%s" .Chart.AppVersion }}","features":[{"featureId":"Platform/{{ printf "%s-%s" "kubernetes" .Capabilities.KubeVersion.Version }}"},{"featureId":"Database/{{ .Values.database.type }}"},{"featureId":"Nginx_Enabled/{{ .Values.nginx.enabled }}"},{"featureId":"ArtifactoryPersistence_Type/{{ .Values.artifactory.persistence.type }}"},{"featureId":"SplitServicesToContainers_Enabled/{{ .Values.splitServicesToContainers }}"},{"featureId":"Filebeat_Enabled/{{ .Values.filebeat.enabled }}"},{"featureId":"ReplicaCount/{{ .Values.artifactory.replicaCount }}"}]}' postgresql: enabled: false waitForDatabase: false From 3cb49b2e2cf82c5227ef8dedf9bf605fd57a827c Mon Sep 17 00:00:00 2001 From: Ram <1331672+chukka@users.noreply.github.com> Date: Fri, 9 Aug 2024 10:30:48 +0530 Subject: [PATCH 08/30] [artifactory] 7.90.7 release --- stable/artifactory-cpp-ce/CHANGELOG.md | 2 +- stable/artifactory-cpp-ce/Chart.yaml | 6 +++--- stable/artifactory-ha/CHANGELOG.md | 2 +- stable/artifactory-ha/Chart.yaml | 6 +++--- stable/artifactory-jcr/CHANGELOG.md | 2 +- stable/artifactory-jcr/Chart.yaml | 6 +++--- stable/artifactory-oss/CHANGELOG.md | 2 +- stable/artifactory-oss/Chart.yaml | 6 +++--- stable/artifactory/CHANGELOG.md | 2 +- stable/artifactory/Chart.yaml | 4 ++-- 10 files changed, 19 insertions(+), 19 deletions(-) diff --git a/stable/artifactory-cpp-ce/CHANGELOG.md b/stable/artifactory-cpp-ce/CHANGELOG.md index 5b9da0429..decc5f28a 100644 --- a/stable/artifactory-cpp-ce/CHANGELOG.md +++ b/stable/artifactory-cpp-ce/CHANGELOG.md @@ -1,7 +1,7 @@ # JFrog Artifactory CE for C++ Chart Changelog All changes to this chart will be documented in this file -## [107.90.6] - Feb 20, 2024 +## [107.90.7] - Feb 20, 2024 * Updated `artifactory.installerInfo` content ## [107.80.0] - Feb 1, 2024 diff --git a/stable/artifactory-cpp-ce/Chart.yaml b/stable/artifactory-cpp-ce/Chart.yaml index 79e0278a3..f83f91884 100644 --- a/stable/artifactory-cpp-ce/Chart.yaml +++ b/stable/artifactory-cpp-ce/Chart.yaml @@ -1,9 +1,9 @@ apiVersion: v2 -appVersion: 7.90.6 +appVersion: 7.90.7 dependencies: - name: artifactory repository: file://charts/artifactory - version: 107.90.6 + version: 107.90.7 description: JFrog Artifactory CE for C++ home: https://www.jfrog.com/artifactory/ icon: https://raw.githubusercontent.com/jfrog/charts/master/stable/artifactory-cpp-ce/logo/conan.png @@ -21,4 +21,4 @@ name: artifactory-cpp-ce sources: - https://github.com/jfrog/charts type: application -version: 107.90.6 +version: 107.90.7 diff --git a/stable/artifactory-ha/CHANGELOG.md b/stable/artifactory-ha/CHANGELOG.md index d50a072b3..b1f601ec3 100644 --- a/stable/artifactory-ha/CHANGELOG.md +++ b/stable/artifactory-ha/CHANGELOG.md @@ -1,7 +1,7 @@ # JFrog Artifactory-ha Chart Changelog All changes to this chart will be documented in this file. -## [107.90.6] - July 18, 2024 +## [107.90.7] - July 18, 2024 * Fixed #adding colon in image registry which breaks deployment [GH-1892](https://github.com/jfrog/charts/pull/1892) * Added new `nginx.hosts` to use Nginx server_name directive instead of `ingress.hosts` * Added a deprecation notice of ingress.hosts when `ngnix.enabled` is true diff --git a/stable/artifactory-ha/Chart.yaml b/stable/artifactory-ha/Chart.yaml index 0149ef5b5..c0f9c5e99 100644 --- a/stable/artifactory-ha/Chart.yaml +++ b/stable/artifactory-ha/Chart.yaml @@ -1,7 +1,7 @@ annotations: - artifactoryServiceVersion: 7.90.7 + artifactoryServiceVersion: 7.90.9 apiVersion: v2 -appVersion: 7.90.6 +appVersion: 7.90.7 dependencies: - condition: postgresql.enabled name: postgresql @@ -23,4 +23,4 @@ name: artifactory-ha sources: - https://github.com/jfrog/charts type: application -version: 107.90.6 +version: 107.90.7 diff --git a/stable/artifactory-jcr/CHANGELOG.md b/stable/artifactory-jcr/CHANGELOG.md index 24f5da334..d5bef71bd 100644 --- a/stable/artifactory-jcr/CHANGELOG.md +++ b/stable/artifactory-jcr/CHANGELOG.md @@ -1,7 +1,7 @@ # JFrog Container Registry Chart Changelog All changes to this chart will be documented in this file. -## [107.90.6] - Feb 20, 2024 +## [107.90.7] - Feb 20, 2024 * Updated `artifactory.installerInfo` content ## [107.80.0] - Feb 1, 2024 diff --git a/stable/artifactory-jcr/Chart.yaml b/stable/artifactory-jcr/Chart.yaml index a6f7d310f..d3b2bc499 100644 --- a/stable/artifactory-jcr/Chart.yaml +++ b/stable/artifactory-jcr/Chart.yaml @@ -1,9 +1,9 @@ apiVersion: v2 -appVersion: 7.90.6 +appVersion: 7.90.7 dependencies: - name: artifactory repository: file://charts/artifactory - version: 107.90.6 + version: 107.90.7 description: JFrog Container Registry home: https://jfrog.com/container-registry/ icon: https://raw.githubusercontent.com/jfrog/charts/master/stable/artifactory-jcr/logo/jcr-logo.png @@ -22,4 +22,4 @@ name: artifactory-jcr sources: - https://github.com/jfrog/charts type: application -version: 107.90.6 +version: 107.90.7 diff --git a/stable/artifactory-oss/CHANGELOG.md b/stable/artifactory-oss/CHANGELOG.md index 618c143e2..65ef81684 100644 --- a/stable/artifactory-oss/CHANGELOG.md +++ b/stable/artifactory-oss/CHANGELOG.md @@ -1,7 +1,7 @@ # JFrog Artifactory OSS Chart Changelog All changes to this chart will be documented in this file -## [107.90.6] - Feb 20, 2024 +## [107.90.7] - Feb 20, 2024 * Updated `artifactory.installerInfo` content ## [107.80.0] - Feb 1, 2024 diff --git a/stable/artifactory-oss/Chart.yaml b/stable/artifactory-oss/Chart.yaml index 3ce81cfd8..279f86953 100644 --- a/stable/artifactory-oss/Chart.yaml +++ b/stable/artifactory-oss/Chart.yaml @@ -1,9 +1,9 @@ apiVersion: v2 -appVersion: 7.90.6 +appVersion: 7.90.7 dependencies: - name: artifactory repository: file://charts/artifactory - version: 107.90.6 + version: 107.90.7 description: JFrog Artifactory OSS home: https://www.jfrog.com/artifactory/ icon: https://raw.githubusercontent.com/jfrog/charts/master/stable/artifactory/logo/artifactory-logo.png @@ -20,4 +20,4 @@ name: artifactory-oss sources: - https://github.com/jfrog/charts type: application -version: 107.90.6 +version: 107.90.7 diff --git a/stable/artifactory/CHANGELOG.md b/stable/artifactory/CHANGELOG.md index 64e7da615..7e23d68f8 100644 --- a/stable/artifactory/CHANGELOG.md +++ b/stable/artifactory/CHANGELOG.md @@ -1,7 +1,7 @@ # JFrog Artifactory Chart Changelog All changes to this chart will be documented in this file. -## [107.90.6] - July 18, 2024 +## [107.90.7] - July 18, 2024 * Fixed #adding colon in image registry which breaks deployment [GH-1892](https://github.com/jfrog/charts/pull/1892) * Added new `nginx.hosts` to use Nginx server_name directive instead of `ingress.hosts` * Added a deprecation notice of ingress.hosts when `ngnix.enabled` is true diff --git a/stable/artifactory/Chart.yaml b/stable/artifactory/Chart.yaml index 0216c9913..f61f06661 100644 --- a/stable/artifactory/Chart.yaml +++ b/stable/artifactory/Chart.yaml @@ -1,5 +1,5 @@ apiVersion: v2 -appVersion: 7.90.6 +appVersion: 7.90.7 dependencies: - condition: postgresql.enabled name: postgresql @@ -21,4 +21,4 @@ name: artifactory sources: - https://github.com/jfrog/charts type: application -version: 107.90.6 +version: 107.90.7 From 142988b8817937f34c5294ee6ea158b4410a72a9 Mon Sep 17 00:00:00 2001 From: Ram <1331672+chukka@users.noreply.github.com> Date: Fri, 9 Aug 2024 10:31:10 +0530 Subject: [PATCH 09/30] [jfrog-platform] 10.19.2 release --- stable/jfrog-platform/CHANGELOG.md | 4 ++++ stable/jfrog-platform/Chart.lock | 6 +++--- stable/jfrog-platform/Chart.yaml | 6 +++--- stable/jfrog-platform/values.yaml | 4 ++-- 4 files changed, 12 insertions(+), 8 deletions(-) diff --git a/stable/jfrog-platform/CHANGELOG.md b/stable/jfrog-platform/CHANGELOG.md index bbce0bd72..6912e8432 100644 --- a/stable/jfrog-platform/CHANGELOG.md +++ b/stable/jfrog-platform/CHANGELOG.md @@ -1,6 +1,10 @@ # JFrog Platform Chart Changelog (GA releases only) All changes to this chart will be documented in this file. +## [10.19.2] - Aug 9, 2024 +* Update dependency artifactory chart version to 107.90.7 +* Update global.versions.router version to `7.124.0` + ## [10.19.1] - Aug 6, 2024 * Update dependency artifactory chart version to 107.90.6 * Update dependency xray chart version to 103.101.5 diff --git a/stable/jfrog-platform/Chart.lock b/stable/jfrog-platform/Chart.lock index 81e97917a..f26c1fd7c 100644 --- a/stable/jfrog-platform/Chart.lock +++ b/stable/jfrog-platform/Chart.lock @@ -7,7 +7,7 @@ dependencies: version: 11.9.3 - name: artifactory repository: https://charts.jfrog.io/ - version: 107.90.6 + version: 107.90.7 - name: xray repository: https://charts.jfrog.io/ version: 103.101.5 @@ -20,5 +20,5 @@ dependencies: - name: pipelines repository: https://charts.jfrog.io/ version: 101.59.7 -digest: sha256:17a38770cacdd56d4a24fc8d198f09139f3c363b75d8b61707cc3b760de0fd11 -generated: "2024-08-06T01:33:16.248044+05:30" +digest: sha256:11cf0f76de1a971c6dcad93ed0df7ae6af1a465413b583f6dfc03eb27893528b +generated: "2024-08-09T02:42:04.13602+05:30" diff --git a/stable/jfrog-platform/Chart.yaml b/stable/jfrog-platform/Chart.yaml index 214ae072a..21a864b38 100644 --- a/stable/jfrog-platform/Chart.yaml +++ b/stable/jfrog-platform/Chart.yaml @@ -1,5 +1,5 @@ apiVersion: v2 -appVersion: 7.90.6 +appVersion: 7.90.7 dependencies: - condition: postgresql.enabled name: postgresql @@ -12,7 +12,7 @@ dependencies: - condition: artifactory.enabled name: artifactory repository: https://charts.jfrog.io/ - version: 107.90.6 + version: 107.90.7 - condition: xray.enabled name: xray repository: https://charts.jfrog.io/ @@ -50,4 +50,4 @@ name: jfrog-platform sources: - https://github.com/jfrog/charts type: application -version: 10.19.1 +version: 10.19.2 diff --git a/stable/jfrog-platform/values.yaml b/stable/jfrog-platform/values.yaml index 2f8bd1348..49ec598b7 100644 --- a/stable/jfrog-platform/values.yaml +++ b/stable/jfrog-platform/values.yaml @@ -27,7 +27,7 @@ global: ## For example : For artifactory, using global.versions.artifactory ## Note: Order of preference is 1) global.versions 2) .Values.artifactory.image.tag 3) Chart.AppVersion versions: - router: 7.122.1 + router: 7.124.0 # artifactory: # xray: # distribution: @@ -232,7 +232,7 @@ rabbitmq: artifactory: enabled: true unifiedUpgradeAllowed: true - installerInfo: '{"productId":"Helm_JFrogPlatform/{{ printf "10.19.1-%s" .Chart.AppVersion }}","features":[{"featureId":"Platform/{{ printf "%s-%s" "kubernetes" .Capabilities.KubeVersion.Version }}"},{"featureId":"Database/{{ .Values.database.type }}"},{"featureId":"Nginx_Enabled/{{ .Values.nginx.enabled }}"},{"featureId":"ArtifactoryPersistence_Type/{{ .Values.artifactory.persistence.type }}"},{"featureId":"SplitServicesToContainers_Enabled/{{ .Values.splitServicesToContainers }}"},{"featureId":"Filebeat_Enabled/{{ .Values.filebeat.enabled }}"},{"featureId":"ReplicaCount/{{ .Values.artifactory.replicaCount }}"}]}' + installerInfo: '{"productId":"Helm_JFrogPlatform/{{ printf "10.19.2-%s" .Chart.AppVersion }}","features":[{"featureId":"Platform/{{ printf "%s-%s" "kubernetes" .Capabilities.KubeVersion.Version }}"},{"featureId":"Database/{{ .Values.database.type }}"},{"featureId":"Nginx_Enabled/{{ .Values.nginx.enabled }}"},{"featureId":"ArtifactoryPersistence_Type/{{ .Values.artifactory.persistence.type }}"},{"featureId":"SplitServicesToContainers_Enabled/{{ .Values.splitServicesToContainers }}"},{"featureId":"Filebeat_Enabled/{{ .Values.filebeat.enabled }}"},{"featureId":"ReplicaCount/{{ .Values.artifactory.replicaCount }}"}]}' postgresql: enabled: false waitForDatabase: false From c53d49390a5f1289fdd910779b1b138f08a581fc Mon Sep 17 00:00:00 2001 From: Ram <1331672+chukka@users.noreply.github.com> Date: Fri, 16 Aug 2024 16:08:33 +0530 Subject: [PATCH 10/30] [artifactory] 7.90.8 release --- stable/artifactory-cpp-ce/CHANGELOG.md | 2 +- stable/artifactory-cpp-ce/Chart.yaml | 6 +++--- stable/artifactory-ha/CHANGELOG.md | 2 +- stable/artifactory-ha/Chart.yaml | 6 +++--- stable/artifactory-jcr/CHANGELOG.md | 2 +- stable/artifactory-jcr/Chart.yaml | 6 +++--- stable/artifactory-oss/CHANGELOG.md | 2 +- stable/artifactory-oss/Chart.yaml | 6 +++--- stable/artifactory/CHANGELOG.md | 2 +- stable/artifactory/Chart.yaml | 4 ++-- 10 files changed, 19 insertions(+), 19 deletions(-) diff --git a/stable/artifactory-cpp-ce/CHANGELOG.md b/stable/artifactory-cpp-ce/CHANGELOG.md index decc5f28a..2ab4c360e 100644 --- a/stable/artifactory-cpp-ce/CHANGELOG.md +++ b/stable/artifactory-cpp-ce/CHANGELOG.md @@ -1,7 +1,7 @@ # JFrog Artifactory CE for C++ Chart Changelog All changes to this chart will be documented in this file -## [107.90.7] - Feb 20, 2024 +## [107.90.8] - Feb 20, 2024 * Updated `artifactory.installerInfo` content ## [107.80.0] - Feb 1, 2024 diff --git a/stable/artifactory-cpp-ce/Chart.yaml b/stable/artifactory-cpp-ce/Chart.yaml index f83f91884..784a3e3ae 100644 --- a/stable/artifactory-cpp-ce/Chart.yaml +++ b/stable/artifactory-cpp-ce/Chart.yaml @@ -1,9 +1,9 @@ apiVersion: v2 -appVersion: 7.90.7 +appVersion: 7.90.8 dependencies: - name: artifactory repository: file://charts/artifactory - version: 107.90.7 + version: 107.90.8 description: JFrog Artifactory CE for C++ home: https://www.jfrog.com/artifactory/ icon: https://raw.githubusercontent.com/jfrog/charts/master/stable/artifactory-cpp-ce/logo/conan.png @@ -21,4 +21,4 @@ name: artifactory-cpp-ce sources: - https://github.com/jfrog/charts type: application -version: 107.90.7 +version: 107.90.8 diff --git a/stable/artifactory-ha/CHANGELOG.md b/stable/artifactory-ha/CHANGELOG.md index b1f601ec3..6d4f52c19 100644 --- a/stable/artifactory-ha/CHANGELOG.md +++ b/stable/artifactory-ha/CHANGELOG.md @@ -1,7 +1,7 @@ # JFrog Artifactory-ha Chart Changelog All changes to this chart will be documented in this file. -## [107.90.7] - July 18, 2024 +## [107.90.8] - July 18, 2024 * Fixed #adding colon in image registry which breaks deployment [GH-1892](https://github.com/jfrog/charts/pull/1892) * Added new `nginx.hosts` to use Nginx server_name directive instead of `ingress.hosts` * Added a deprecation notice of ingress.hosts when `ngnix.enabled` is true diff --git a/stable/artifactory-ha/Chart.yaml b/stable/artifactory-ha/Chart.yaml index c0f9c5e99..baed17777 100644 --- a/stable/artifactory-ha/Chart.yaml +++ b/stable/artifactory-ha/Chart.yaml @@ -1,7 +1,7 @@ annotations: - artifactoryServiceVersion: 7.90.9 + artifactoryServiceVersion: 7.90.11 apiVersion: v2 -appVersion: 7.90.7 +appVersion: 7.90.8 dependencies: - condition: postgresql.enabled name: postgresql @@ -23,4 +23,4 @@ name: artifactory-ha sources: - https://github.com/jfrog/charts type: application -version: 107.90.7 +version: 107.90.8 diff --git a/stable/artifactory-jcr/CHANGELOG.md b/stable/artifactory-jcr/CHANGELOG.md index d5bef71bd..ef15d06c1 100644 --- a/stable/artifactory-jcr/CHANGELOG.md +++ b/stable/artifactory-jcr/CHANGELOG.md @@ -1,7 +1,7 @@ # JFrog Container Registry Chart Changelog All changes to this chart will be documented in this file. -## [107.90.7] - Feb 20, 2024 +## [107.90.8] - Feb 20, 2024 * Updated `artifactory.installerInfo` content ## [107.80.0] - Feb 1, 2024 diff --git a/stable/artifactory-jcr/Chart.yaml b/stable/artifactory-jcr/Chart.yaml index d3b2bc499..4639a2390 100644 --- a/stable/artifactory-jcr/Chart.yaml +++ b/stable/artifactory-jcr/Chart.yaml @@ -1,9 +1,9 @@ apiVersion: v2 -appVersion: 7.90.7 +appVersion: 7.90.8 dependencies: - name: artifactory repository: file://charts/artifactory - version: 107.90.7 + version: 107.90.8 description: JFrog Container Registry home: https://jfrog.com/container-registry/ icon: https://raw.githubusercontent.com/jfrog/charts/master/stable/artifactory-jcr/logo/jcr-logo.png @@ -22,4 +22,4 @@ name: artifactory-jcr sources: - https://github.com/jfrog/charts type: application -version: 107.90.7 +version: 107.90.8 diff --git a/stable/artifactory-oss/CHANGELOG.md b/stable/artifactory-oss/CHANGELOG.md index 65ef81684..5ac380389 100644 --- a/stable/artifactory-oss/CHANGELOG.md +++ b/stable/artifactory-oss/CHANGELOG.md @@ -1,7 +1,7 @@ # JFrog Artifactory OSS Chart Changelog All changes to this chart will be documented in this file -## [107.90.7] - Feb 20, 2024 +## [107.90.8] - Feb 20, 2024 * Updated `artifactory.installerInfo` content ## [107.80.0] - Feb 1, 2024 diff --git a/stable/artifactory-oss/Chart.yaml b/stable/artifactory-oss/Chart.yaml index 279f86953..ac79b1db2 100644 --- a/stable/artifactory-oss/Chart.yaml +++ b/stable/artifactory-oss/Chart.yaml @@ -1,9 +1,9 @@ apiVersion: v2 -appVersion: 7.90.7 +appVersion: 7.90.8 dependencies: - name: artifactory repository: file://charts/artifactory - version: 107.90.7 + version: 107.90.8 description: JFrog Artifactory OSS home: https://www.jfrog.com/artifactory/ icon: https://raw.githubusercontent.com/jfrog/charts/master/stable/artifactory/logo/artifactory-logo.png @@ -20,4 +20,4 @@ name: artifactory-oss sources: - https://github.com/jfrog/charts type: application -version: 107.90.7 +version: 107.90.8 diff --git a/stable/artifactory/CHANGELOG.md b/stable/artifactory/CHANGELOG.md index 7e23d68f8..6fd2d32d6 100644 --- a/stable/artifactory/CHANGELOG.md +++ b/stable/artifactory/CHANGELOG.md @@ -1,7 +1,7 @@ # JFrog Artifactory Chart Changelog All changes to this chart will be documented in this file. -## [107.90.7] - July 18, 2024 +## [107.90.8] - July 18, 2024 * Fixed #adding colon in image registry which breaks deployment [GH-1892](https://github.com/jfrog/charts/pull/1892) * Added new `nginx.hosts` to use Nginx server_name directive instead of `ingress.hosts` * Added a deprecation notice of ingress.hosts when `ngnix.enabled` is true diff --git a/stable/artifactory/Chart.yaml b/stable/artifactory/Chart.yaml index f61f06661..041c375ee 100644 --- a/stable/artifactory/Chart.yaml +++ b/stable/artifactory/Chart.yaml @@ -1,5 +1,5 @@ apiVersion: v2 -appVersion: 7.90.7 +appVersion: 7.90.8 dependencies: - condition: postgresql.enabled name: postgresql @@ -21,4 +21,4 @@ name: artifactory sources: - https://github.com/jfrog/charts type: application -version: 107.90.7 +version: 107.90.8 From f5d30fbcb3ee8049f7e5e18905018572536b7aca Mon Sep 17 00:00:00 2001 From: Ram <1331672+chukka@users.noreply.github.com> Date: Fri, 16 Aug 2024 16:09:07 +0530 Subject: [PATCH 11/30] [jfrog-platform] 10.19.3 release --- stable/jfrog-platform/CHANGELOG.md | 5 +++++ stable/jfrog-platform/Chart.lock | 8 ++++---- stable/jfrog-platform/Chart.yaml | 8 ++++---- stable/jfrog-platform/values.yaml | 4 ++-- 4 files changed, 15 insertions(+), 10 deletions(-) diff --git a/stable/jfrog-platform/CHANGELOG.md b/stable/jfrog-platform/CHANGELOG.md index 6912e8432..92702153b 100644 --- a/stable/jfrog-platform/CHANGELOG.md +++ b/stable/jfrog-platform/CHANGELOG.md @@ -1,6 +1,11 @@ # JFrog Platform Chart Changelog (GA releases only) All changes to this chart will be documented in this file. +## [10.19.3] - Aug 16, 2024 +* Update dependency artifactory chart version to 107.90.8 +* Update dependency xray chart version to 103.102.3 +* Update global.versions.router version to `7.124.1` + ## [10.19.2] - Aug 9, 2024 * Update dependency artifactory chart version to 107.90.7 * Update global.versions.router version to `7.124.0` diff --git a/stable/jfrog-platform/Chart.lock b/stable/jfrog-platform/Chart.lock index f26c1fd7c..164fa84f9 100644 --- a/stable/jfrog-platform/Chart.lock +++ b/stable/jfrog-platform/Chart.lock @@ -7,10 +7,10 @@ dependencies: version: 11.9.3 - name: artifactory repository: https://charts.jfrog.io/ - version: 107.90.7 + version: 107.90.8 - name: xray repository: https://charts.jfrog.io/ - version: 103.101.5 + version: 103.102.3 - name: distribution repository: https://charts.jfrog.io/ version: 102.26.1 @@ -20,5 +20,5 @@ dependencies: - name: pipelines repository: https://charts.jfrog.io/ version: 101.59.7 -digest: sha256:11cf0f76de1a971c6dcad93ed0df7ae6af1a465413b583f6dfc03eb27893528b -generated: "2024-08-09T02:42:04.13602+05:30" +digest: sha256:2bdb6a67e534646a852528717f66a30716a0206c28a5188ed5230f01bd6084ce +generated: "2024-08-16T09:02:20.330994+05:30" diff --git a/stable/jfrog-platform/Chart.yaml b/stable/jfrog-platform/Chart.yaml index 21a864b38..58f187dfa 100644 --- a/stable/jfrog-platform/Chart.yaml +++ b/stable/jfrog-platform/Chart.yaml @@ -1,5 +1,5 @@ apiVersion: v2 -appVersion: 7.90.7 +appVersion: 7.90.8 dependencies: - condition: postgresql.enabled name: postgresql @@ -12,11 +12,11 @@ dependencies: - condition: artifactory.enabled name: artifactory repository: https://charts.jfrog.io/ - version: 107.90.7 + version: 107.90.8 - condition: xray.enabled name: xray repository: https://charts.jfrog.io/ - version: 103.101.5 + version: 103.102.3 - condition: distribution.enabled name: distribution repository: https://charts.jfrog.io/ @@ -50,4 +50,4 @@ name: jfrog-platform sources: - https://github.com/jfrog/charts type: application -version: 10.19.2 +version: 10.19.3 diff --git a/stable/jfrog-platform/values.yaml b/stable/jfrog-platform/values.yaml index 49ec598b7..487fe2c37 100644 --- a/stable/jfrog-platform/values.yaml +++ b/stable/jfrog-platform/values.yaml @@ -27,7 +27,7 @@ global: ## For example : For artifactory, using global.versions.artifactory ## Note: Order of preference is 1) global.versions 2) .Values.artifactory.image.tag 3) Chart.AppVersion versions: - router: 7.124.0 + router: 7.124.1 # artifactory: # xray: # distribution: @@ -232,7 +232,7 @@ rabbitmq: artifactory: enabled: true unifiedUpgradeAllowed: true - installerInfo: '{"productId":"Helm_JFrogPlatform/{{ printf "10.19.2-%s" .Chart.AppVersion }}","features":[{"featureId":"Platform/{{ printf "%s-%s" "kubernetes" .Capabilities.KubeVersion.Version }}"},{"featureId":"Database/{{ .Values.database.type }}"},{"featureId":"Nginx_Enabled/{{ .Values.nginx.enabled }}"},{"featureId":"ArtifactoryPersistence_Type/{{ .Values.artifactory.persistence.type }}"},{"featureId":"SplitServicesToContainers_Enabled/{{ .Values.splitServicesToContainers }}"},{"featureId":"Filebeat_Enabled/{{ .Values.filebeat.enabled }}"},{"featureId":"ReplicaCount/{{ .Values.artifactory.replicaCount }}"}]}' + installerInfo: '{"productId":"Helm_JFrogPlatform/{{ printf "10.19.3-%s" .Chart.AppVersion }}","features":[{"featureId":"Platform/{{ printf "%s-%s" "kubernetes" .Capabilities.KubeVersion.Version }}"},{"featureId":"Database/{{ .Values.database.type }}"},{"featureId":"Nginx_Enabled/{{ .Values.nginx.enabled }}"},{"featureId":"ArtifactoryPersistence_Type/{{ .Values.artifactory.persistence.type }}"},{"featureId":"SplitServicesToContainers_Enabled/{{ .Values.splitServicesToContainers }}"},{"featureId":"Filebeat_Enabled/{{ .Values.filebeat.enabled }}"},{"featureId":"ReplicaCount/{{ .Values.artifactory.replicaCount }}"}]}' postgresql: enabled: false waitForDatabase: false From 7e1c395b645247e933872ebb6feea3d657c02eac Mon Sep 17 00:00:00 2001 From: Rhys Williams <26030558+rhys96@users.noreply.github.com> Date: Thu, 22 Aug 2024 11:03:36 +0100 Subject: [PATCH 12/30] [xray] Fix `volumeMounts` formatting for `panoramic` (#1896) * Remove leading spaces on initial volumeMount causing formatting errors * Update version and documentation * Correct name of sizing file * Update CHANGELOG.md * Update README.md --------- Co-authored-by: Megha Bansal --- stable/xray/README.md | 2 +- stable/xray/templates/xray-statefulset.yaml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/stable/xray/README.md b/stable/xray/README.md index fb953b032..d91648c6b 100644 --- a/stable/xray/README.md +++ b/stable/xray/README.md @@ -52,7 +52,7 @@ helm upgrade --install xray --set xray.joinKey= Date: Thu, 22 Aug 2024 15:50:57 +0530 Subject: [PATCH 13/30] [xray] 3.102.3 release --- stable/xray/CHANGELOG.md | 6 +- stable/xray/Chart.yaml | 4 +- stable/xray/README.md | 2 +- stable/xray/ci/default-values.yaml | 11 ++ stable/xray/files/system.yaml | 4 + stable/xray/templates/_helpers.tpl | 7 + stable/xray/templates/migration-hook.yaml | 4 + .../xray/templates/xray-ipa-deployment.yaml | 180 +++++++++++++++++- stable/xray/templates/xray-ipa-svc.yaml | 6 + .../templates/xray-server-deployment.yaml | 6 +- stable/xray/templates/xray-statefulset.yaml | 163 +++++++++++++++- stable/xray/values.yaml | 78 +++++++- 12 files changed, 455 insertions(+), 16 deletions(-) diff --git a/stable/xray/CHANGELOG.md b/stable/xray/CHANGELOG.md index 4c6025cfc..5facfef52 100644 --- a/stable/xray/CHANGELOG.md +++ b/stable/xray/CHANGELOG.md @@ -1,7 +1,11 @@ # JFrog Xray Chart Changelog All changes to this chart will be documented in this file. -## [103.101.5] - June 18, 2024 +## [103.102.3] - July 17, 2024 +* Added support of specifying resources constraints for RabbitMQ's pre-upgrade-hook job +* Fixed formatting error associated to the `volumeMounts` for the `panoramic` microservice [GH-1895](https://github.com/jfrog/charts/issues/1895) + +## [103.99.0] - June 18, 2024 * Fixed #adding colon in image registry breaks deployment with meta label error. [GH-1892](https://github.com/jfrog/charts/pull/1892) ## [103.97.0] - May 27, 2024 diff --git a/stable/xray/Chart.yaml b/stable/xray/Chart.yaml index 35bb51c76..dd0421ef3 100644 --- a/stable/xray/Chart.yaml +++ b/stable/xray/Chart.yaml @@ -1,5 +1,5 @@ apiVersion: v2 -appVersion: 3.101.5 +appVersion: 3.102.3 dependencies: - condition: postgresql.enabled name: postgresql @@ -24,4 +24,4 @@ name: xray sources: - https://github.com/jfrog/charts type: application -version: 103.101.5 +version: 103.102.3 diff --git a/stable/xray/README.md b/stable/xray/README.md index d91648c6b..fb953b032 100644 --- a/stable/xray/README.md +++ b/stable/xray/README.md @@ -52,7 +52,7 @@ helm upgrade --install xray --set xray.joinKey= + {{- with .Values.common.preStartCommand }} + echo "Running custom common preStartCommand command"; + {{ tpl . $ }}; + {{- end }} + {{- with .Values.policyenforcer.preStartCommand }} + echo "Running custom policyenforcer preStartCommand command"; + {{ tpl . $ }}; + {{- end }} + exec /opt/jfrog/xray/app/bin/wrapper.sh; + {{- with .Values.policyenforcer.lifecycle }} + lifecycle: +{{ toYaml . | indent 10 }} + {{- end }} + env: + - name: JF_SKIPENTLICCHECKFORCLOUD + value: "true" + {{ include "xray.envVariables" . | indent 8 }} + {{ include "xray.rabbitmqTlsEnvVariables" . | indent 8 }} + {{- if and .Values.rabbitmq.external.secrets (not .Values.common.rabbitmq.connectionConfigFromEnvironment) }} + - name: JF_SHARED_RABBITMQ_USERNAME + valueFrom: + secretKeyRef: + name: {{ tpl .Values.rabbitmq.external.secrets.username.name . }} + key: {{ tpl .Values.rabbitmq.external.secrets.username.key . }} + - name: JF_SHARED_RABBITMQ_PASSWORD + valueFrom: + secretKeyRef: + name: {{ tpl .Values.rabbitmq.external.secrets.password.name . }} + key: {{ tpl .Values.rabbitmq.external.secrets.password.key . }} + - name: JF_SHARED_RABBITMQ_URL + valueFrom: + secretKeyRef: + name: {{ tpl .Values.rabbitmq.external.secrets.url.name . }} + key: {{ tpl .Values.rabbitmq.external.secrets.url.key . }} + {{- end }} + {{- if or .Values.database.secrets.user .Values.database.user }} + - name: JF_SHARED_DATABASE_USERNAME + valueFrom: + secretKeyRef: + {{- if .Values.database.secrets.user }} + name: {{ tpl .Values.database.secrets.user.name . }} + key: {{ tpl .Values.database.secrets.user.key . }} + {{- else if .Values.database.user }} + {{- if not .Values.xray.unifiedSecretInstallation }} + name: {{ template "xray.fullname" . }}-database-creds + {{- else }} + name: "{{ template "xray.name" . }}-unified-secret" + {{- end }} + key: db-user + {{- end }} + {{- end }} + {{- if or .Values.database.secrets.actualUsername .Values.database.actualUsername }} + - name: JF_SHARED_DATABASE_ACTUALUSERNAME + valueFrom: + secretKeyRef: + {{- if .Values.database.secrets.actualUsername }} + name: {{ tpl .Values.database.secrets.actualUsername.name . }} + key: {{ tpl .Values.database.secrets.actualUsername.key . }} + {{- else if .Values.database.actualUsername }} + {{- if not .Values.xray.unifiedSecretInstallation }} + name: {{ template "xray.fullname" . }}-database-creds + {{- else }} + name: "{{ template "xray.name" . }}-unified-secret" + {{- end }} + key: db-actualUsername + {{- end }} + {{- end }} + {{ if or .Values.database.secrets.password .Values.database.password .Values.postgresql.enabled }} + - name: JF_SHARED_DATABASE_PASSWORD + valueFrom: + secretKeyRef: + {{- if .Values.database.secrets.password }} + name: {{ tpl .Values.database.secrets.password.name . }} + key: {{ tpl .Values.database.secrets.password.key . }} + {{- else if .Values.database.password }} + {{- if not .Values.xray.unifiedSecretInstallation }} + name: {{ template "xray.fullname" . }}-database-creds + {{- else }} + name: "{{ template "xray.name" . }}-unified-secret" + {{- end }} + key: db-password + {{- else if .Values.postgresql.enabled }} + name: {{ .Release.Name }}-postgresql + key: postgresql-password + {{- end }} + {{- end }} + {{- if or .Values.database.secrets.url .Values.database.url }} + - name: JF_SHARED_DATABASE_URL + valueFrom: + secretKeyRef: + {{- if .Values.database.secrets.url }} + name: {{ tpl .Values.database.secrets.url.name . }} + key: {{ tpl .Values.database.secrets.url.key . }} + {{- else if .Values.database.url }} + {{- if not .Values.xray.unifiedSecretInstallation }} + name: {{ template "xray.fullname" . }}-database-creds + {{- else }} + name: "{{ template "xray.name" . }}-unified-secret" + {{- end }} + key: db-url + {{- end }} + {{- end }} + {{- if .Values.common.rabbitmq.connectionConfigFromEnvironment }} + - name: JF_SHARED_RABBITMQ_USERNAME + value: {{ include "rabbitmq.user" .}} + - name: JF_SHARED_RABBITMQ_URL + value: {{ include "rabbitmq.url" .}} + - name: JF_SHARED_RABBITMQ_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "rabbitmq.passwordSecretName" .}} + key: rabbitmq-password + {{- end }} + - name: XRAY_HA_NODE_ID + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: XRAY_K8S_ENV + value: "true" + - name: EXECUTION_JOB_AES_KEY + valueFrom: + secretKeyRef: + {{- if not .Values.xray.unifiedSecretInstallation }} + name: {{ template "xray.executionServiceAesKeySecretName" . }} + {{- else if and .Values.xray.unifiedSecretInstallation (or .Values.xray.executionServiceAesKeySecretName .Values.global.executionServiceAesKeySecretName) }} + name: {{ template "xray.executionServiceAesKeySecretName" . }} + {{- else }} + name: "{{ template "xray.name" . }}-unified-secret" + {{- end }} + key: execution-service-aes-key + {{- if .Values.common.extraEnvVars }} + {{- tpl .Values.common.extraEnvVars . | nindent 8 }} + {{- end }} + {{- if .Values.policyenforcer.extraEnvVars }} + {{- tpl .Values.policyenforcer.extraEnvVars . | nindent 8 }} + {{- end }} + ports: + - containerPort: {{ .Values.policyenforcer.internalPort }} + name: http-polenf + volumeMounts: + - name: data-volume + mountPath: "{{ .Values.xray.persistence.mountPath }}" +{{- if or .Values.common.customVolumeMounts .Values.global.customVolumeMounts }} +{{ tpl (include "xray.customVolumeMounts" .) . | indent 8 }} +{{- end }} +{{- with .Values.policyenforcer.customVolumeMounts }} +{{ tpl . $ | indent 8 }} +{{- end }} + resources: +{{ toYaml .Values.policyenforcer.resources | indent 10 }} +{{- if .Values.policyenforcer.startupProbe.enabled }} + startupProbe: +{{ tpl .Values.policyenforcer.startupProbe.config . | indent 10 }} +{{- end }} +{{- if .Values.policyenforcer.livenessProbe.enabled }} + livenessProbe: +{{ tpl .Values.policyenforcer.livenessProbe.config . | indent 10 }} +{{- end }} {{- end }} - name: {{ .Values.indexer.name }} image: {{ include "xray.getImageInfoByValue" (list . "indexer") }} diff --git a/stable/xray/templates/xray-ipa-svc.yaml b/stable/xray/templates/xray-ipa-svc.yaml index a26de9860..529f2571e 100644 --- a/stable/xray/templates/xray-ipa-svc.yaml +++ b/stable/xray/templates/xray-ipa-svc.yaml @@ -47,6 +47,12 @@ spec: port: {{ .Values.panoramic.externalPort }} protocol: TCP targetPort: {{ .Values.panoramic.internalPort }} +{{- end }} +{{- if .Values.policyenforcer.enabled }} + - name: http-polenf + port: {{ .Values.policyenforcer.externalPort }} + protocol: TCP + targetPort: {{ .Values.policyenforcer.internalPort }} {{- end }} selector: app: {{ template "xray.name" . }} diff --git a/stable/xray/templates/xray-server-deployment.yaml b/stable/xray/templates/xray-server-deployment.yaml index e6e3a0762..a481b4fe5 100644 --- a/stable/xray/templates/xray-server-deployment.yaml +++ b/stable/xray/templates/xray-server-deployment.yaml @@ -27,10 +27,10 @@ spec: {{- if not .Values.autoscalingServer.enabled }} replicas: {{ .Values.replicaCountServer }} {{- end }} +{{- with .Values.deployment.strategy }} strategy: - type: RollingUpdate - rollingUpdate: - maxUnavailable: 1 +{{ toYaml . | indent 4 }} +{{- end }} selector: matchLabels: app: {{ template "xray.name" . }} diff --git a/stable/xray/templates/xray-statefulset.yaml b/stable/xray/templates/xray-statefulset.yaml index d17e4b97e..0e0914b8a 100644 --- a/stable/xray/templates/xray-statefulset.yaml +++ b/stable/xray/templates/xray-statefulset.yaml @@ -296,7 +296,7 @@ spec: key: rabbitmq-password {{- end }} - name: JF_SHARED_RABBITMQ_REPLICASCOUNT - {{- if .Values.rabbitmq.enabled }} + {{- if .Values.rabbitmq.enabled }} value: "{{ .Values.rabbitmq.replicaCount }}" {{- else }} value: "{{ .Values.global.xray.rabbitmq.replicaCount }}" @@ -1056,6 +1056,167 @@ spec: livenessProbe: {{ tpl .Values.panoramic.livenessProbe.config . | indent 10 }} {{- end }} +{{- end }} +{{- if .Values.policyenforcer.enabled }} + - name: {{ .Values.policyenforcer.name }} + image: {{ include "xray.getImageInfoByValue" (list . "policyenforcer") }} + imagePullPolicy: {{ .Values.imagePullPolicy }} + securityContext: + runAsNonRoot: true + runAsUser: {{ .Values.common.xrayUserId }} + allowPrivilegeEscalation: false + capabilities: + drop: + - NET_RAW + command: + - '/bin/bash' + - '-c' + - > + {{- with .Values.common.preStartCommand }} + echo "Running custom common preStartCommand command"; + {{ tpl . $ }}; + {{- end }} + {{- with .Values.policyenforcer.preStartCommand }} + echo "Running custom policyenforcer preStartCommand command"; + {{ tpl . $ }}; + {{- end }} + exec /opt/jfrog/xray/app/bin/wrapper.sh; + {{- with .Values.policyenforcer.lifecycle }} + lifecycle: +{{ toYaml . | indent 10 }} + {{- end }} + env: + {{ include "xray.envVariables" . | indent 8 }} + {{ include "xray.rabbitmqTlsEnvVariables" . | indent 8 }} + {{- if and .Values.rabbitmq.external.secrets (not .Values.common.rabbitmq.connectionConfigFromEnvironment) }} + - name: JF_SHARED_RABBITMQ_USERNAME + valueFrom: + secretKeyRef: + name: {{ tpl .Values.rabbitmq.external.secrets.username.name . }} + key: {{ tpl .Values.rabbitmq.external.secrets.username.key . }} + - name: JF_SHARED_RABBITMQ_PASSWORD + valueFrom: + secretKeyRef: + name: {{ tpl .Values.rabbitmq.external.secrets.password.name . }} + key: {{ tpl .Values.rabbitmq.external.secrets.password.key . }} + - name: JF_SHARED_RABBITMQ_URL + valueFrom: + secretKeyRef: + name: {{ tpl .Values.rabbitmq.external.secrets.url.name . }} + key: {{ tpl .Values.rabbitmq.external.secrets.url.key . }} + {{- end }} + {{- if or .Values.database.secrets.user .Values.database.user }} + - name: JF_SHARED_DATABASE_USERNAME + valueFrom: + secretKeyRef: + {{- if .Values.database.secrets.user }} + name: {{ tpl .Values.database.secrets.user.name . }} + key: {{ tpl .Values.database.secrets.user.key . }} + {{- else if .Values.database.user }} + {{- if not .Values.xray.unifiedSecretInstallation }} + name: {{ template "xray.fullname" . }}-database-creds + {{- else }} + name: "{{ template "xray.name" . }}-unified-secret" + {{- end }} + key: db-user + {{- end }} + {{- end }} + {{- if or .Values.database.secrets.actualUsername .Values.database.actualUsername }} + - name: JF_SHARED_DATABASE_ACTUALUSERNAME + valueFrom: + secretKeyRef: + {{- if .Values.database.secrets.actualUsername }} + name: {{ tpl .Values.database.secrets.actualUsername.name . }} + key: {{ tpl .Values.database.secrets.actualUsername.key . }} + {{- else if .Values.database.actualUsername }} + {{- if not .Values.xray.unifiedSecretInstallation }} + name: {{ template "xray.fullname" . }}-database-creds + {{- else }} + name: "{{ template "xray.name" . }}-unified-secret" + {{- end }} + key: db-actualUsername + {{- end }} + {{- end }} + {{ if or .Values.database.secrets.password .Values.database.password .Values.postgresql.enabled }} + - name: JF_SHARED_DATABASE_PASSWORD + valueFrom: + secretKeyRef: + {{- if .Values.database.secrets.password }} + name: {{ tpl .Values.database.secrets.password.name . }} + key: {{ tpl .Values.database.secrets.password.key . }} + {{- else if .Values.database.password }} + {{- if not .Values.xray.unifiedSecretInstallation }} + name: {{ template "xray.fullname" . }}-database-creds + {{- else }} + name: "{{ template "xray.name" . }}-unified-secret" + {{- end }} + key: db-password + {{- else if .Values.postgresql.enabled }} + name: {{ .Release.Name }}-postgresql + key: postgresql-password + {{- end }} + {{- end }} + {{- if or .Values.database.secrets.url .Values.database.url }} + - name: JF_SHARED_DATABASE_URL + valueFrom: + secretKeyRef: + {{- if .Values.database.secrets.url }} + name: {{ tpl .Values.database.secrets.url.name . }} + key: {{ tpl .Values.database.secrets.url.key . }} + {{- else if .Values.database.url }} + {{- if not .Values.xray.unifiedSecretInstallation }} + name: {{ template "xray.fullname" . }}-database-creds + {{- else }} + name: "{{ template "xray.name" . }}-unified-secret" + {{- end }} + key: db-url + {{- end }} + {{- end }} + {{- if .Values.common.rabbitmq.connectionConfigFromEnvironment }} + - name: JF_SHARED_RABBITMQ_USERNAME + value: {{ include "rabbitmq.user" .}} + - name: JF_SHARED_RABBITMQ_URL + value: {{ include "rabbitmq.url" .}} + - name: JF_SHARED_RABBITMQ_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "rabbitmq.passwordSecretName" .}} + key: rabbitmq-password + {{- end }} + - name: XRAY_HA_NODE_ID + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: XRAY_K8S_ENV + value: "true" + {{- if .Values.common.extraEnvVars }} + {{- tpl .Values.common.extraEnvVars . | nindent 8 }} + {{- end }} + {{- if .Values.indexer.extraEnvVars }} + {{- tpl .Values.indexer.extraEnvVars . | nindent 8 }} + {{- end }} + ports: + - containerPort: {{ .Values.policyenforcer.internalPort }} + name: http-polenf + volumeMounts: + - name: data-volume + mountPath: "{{ .Values.xray.persistence.mountPath }}" +{{- if or .Values.common.customVolumeMounts .Values.global.customVolumeMounts }} +{{ tpl (include "xray.customVolumeMounts" .) . | indent 8 }} +{{- end }} +{{- with .Values.sbom.customVolumeMounts }} +{{ tpl . $ | indent 8 }} +{{- end }} + resources: +{{ toYaml .Values.policyenforcer.resources | indent 10 }} +{{- if .Values.policyenforcer.startupProbe.enabled }} + startupProbe: +{{ tpl .Values.policyenforcer.startupProbe.config . | indent 10 }} +{{- end }} +{{- if .Values.policyenforcer.livenessProbe.enabled }} + livenessProbe: +{{ tpl .Values.policyenforcer.livenessProbe.config . | indent 10 }} +{{- end }} {{- end }} - name: {{ .Values.indexer.name }} image: {{ include "xray.getImageInfoByValue" (list . "indexer") }} diff --git a/stable/xray/values.yaml b/stable/xray/values.yaml index 7864eee8f..c280ecc71 100644 --- a/stable/xray/values.yaml +++ b/stable/xray/values.yaml @@ -54,6 +54,12 @@ global: waitForPreviousPodsOnInitialStartup: true vhost: xray_haq +deployment: + strategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 0 + ## String to partially override xray.fullname template (will maintain the release name) ## # nameOverride: @@ -337,7 +343,7 @@ autoscaling: value: "100" - name: persist value: "100" - - name: alert + - name: policyEnforcer value: "100" - name: impactAnalysis value: "100" @@ -1091,6 +1097,70 @@ panoramic: # memory: "2Gi" # cpu: "1" +policyenforcer: + enabled: false + name: xray-policyenforcer + ## Note that by default we use appVersion to get image tag/version + image: + registry: releases-docker.jfrog.io + repository: jfrog/xray-policyenforcer + internalPort: 7009 + externalPort: 7009 + annotations: {} + extraEnvVars: + + # Add lifecycle hooks for the indexer pod + lifecycle: {} + # postStart: + # exec: + # command: ["/bin/sh", "-c", "echo Hello from the postStart handler > /usr/share/message"] + # preStop: + # exec: + # command: ["/bin/sh", "-c", "echo Hello from the preStart handler > /usr/share/message"] + + ## Add custom volumesMounts + customVolumeMounts: | + # - name: custom-script + # mountPath: /scripts/script.sh + # subPath: script.sh + + livenessProbe: + enabled: true + config: | + exec: + command: + - sh + - -c + - curl -s -k --fail --max-time {{ .Values.probes.timeoutSeconds }} http://localhost:{{ .Values.policyenforcer.internalPort }}/api/v1/system/liveness + initialDelaySeconds: {{ if semverCompare " Date: Fri, 30 Aug 2024 10:44:32 +0530 Subject: [PATCH 14/30] [artifactory] 7.90.9 release --- stable/artifactory-cpp-ce/CHANGELOG.md | 2 +- stable/artifactory-cpp-ce/Chart.yaml | 6 +++--- stable/artifactory-ha/CHANGELOG.md | 2 +- stable/artifactory-ha/Chart.yaml | 6 +++--- stable/artifactory-jcr/CHANGELOG.md | 2 +- stable/artifactory-jcr/Chart.yaml | 6 +++--- stable/artifactory-oss/CHANGELOG.md | 2 +- stable/artifactory-oss/Chart.yaml | 6 +++--- stable/artifactory/CHANGELOG.md | 2 +- stable/artifactory/Chart.yaml | 4 ++-- 10 files changed, 19 insertions(+), 19 deletions(-) diff --git a/stable/artifactory-cpp-ce/CHANGELOG.md b/stable/artifactory-cpp-ce/CHANGELOG.md index 2ab4c360e..0d1fefaf1 100644 --- a/stable/artifactory-cpp-ce/CHANGELOG.md +++ b/stable/artifactory-cpp-ce/CHANGELOG.md @@ -1,7 +1,7 @@ # JFrog Artifactory CE for C++ Chart Changelog All changes to this chart will be documented in this file -## [107.90.8] - Feb 20, 2024 +## [107.90.9] - Feb 20, 2024 * Updated `artifactory.installerInfo` content ## [107.80.0] - Feb 1, 2024 diff --git a/stable/artifactory-cpp-ce/Chart.yaml b/stable/artifactory-cpp-ce/Chart.yaml index 784a3e3ae..56e19782d 100644 --- a/stable/artifactory-cpp-ce/Chart.yaml +++ b/stable/artifactory-cpp-ce/Chart.yaml @@ -1,9 +1,9 @@ apiVersion: v2 -appVersion: 7.90.8 +appVersion: 7.90.9 dependencies: - name: artifactory repository: file://charts/artifactory - version: 107.90.8 + version: 107.90.9 description: JFrog Artifactory CE for C++ home: https://www.jfrog.com/artifactory/ icon: https://raw.githubusercontent.com/jfrog/charts/master/stable/artifactory-cpp-ce/logo/conan.png @@ -21,4 +21,4 @@ name: artifactory-cpp-ce sources: - https://github.com/jfrog/charts type: application -version: 107.90.8 +version: 107.90.9 diff --git a/stable/artifactory-ha/CHANGELOG.md b/stable/artifactory-ha/CHANGELOG.md index 6d4f52c19..06046425d 100644 --- a/stable/artifactory-ha/CHANGELOG.md +++ b/stable/artifactory-ha/CHANGELOG.md @@ -1,7 +1,7 @@ # JFrog Artifactory-ha Chart Changelog All changes to this chart will be documented in this file. -## [107.90.8] - July 18, 2024 +## [107.90.9] - July 18, 2024 * Fixed #adding colon in image registry which breaks deployment [GH-1892](https://github.com/jfrog/charts/pull/1892) * Added new `nginx.hosts` to use Nginx server_name directive instead of `ingress.hosts` * Added a deprecation notice of ingress.hosts when `ngnix.enabled` is true diff --git a/stable/artifactory-ha/Chart.yaml b/stable/artifactory-ha/Chart.yaml index baed17777..7c1734f68 100644 --- a/stable/artifactory-ha/Chart.yaml +++ b/stable/artifactory-ha/Chart.yaml @@ -1,7 +1,7 @@ annotations: - artifactoryServiceVersion: 7.90.11 + artifactoryServiceVersion: 7.90.12 apiVersion: v2 -appVersion: 7.90.8 +appVersion: 7.90.9 dependencies: - condition: postgresql.enabled name: postgresql @@ -23,4 +23,4 @@ name: artifactory-ha sources: - https://github.com/jfrog/charts type: application -version: 107.90.8 +version: 107.90.9 diff --git a/stable/artifactory-jcr/CHANGELOG.md b/stable/artifactory-jcr/CHANGELOG.md index ef15d06c1..65ca8bcf7 100644 --- a/stable/artifactory-jcr/CHANGELOG.md +++ b/stable/artifactory-jcr/CHANGELOG.md @@ -1,7 +1,7 @@ # JFrog Container Registry Chart Changelog All changes to this chart will be documented in this file. -## [107.90.8] - Feb 20, 2024 +## [107.90.9] - Feb 20, 2024 * Updated `artifactory.installerInfo` content ## [107.80.0] - Feb 1, 2024 diff --git a/stable/artifactory-jcr/Chart.yaml b/stable/artifactory-jcr/Chart.yaml index 4639a2390..b5c6e5b05 100644 --- a/stable/artifactory-jcr/Chart.yaml +++ b/stable/artifactory-jcr/Chart.yaml @@ -1,9 +1,9 @@ apiVersion: v2 -appVersion: 7.90.8 +appVersion: 7.90.9 dependencies: - name: artifactory repository: file://charts/artifactory - version: 107.90.8 + version: 107.90.9 description: JFrog Container Registry home: https://jfrog.com/container-registry/ icon: https://raw.githubusercontent.com/jfrog/charts/master/stable/artifactory-jcr/logo/jcr-logo.png @@ -22,4 +22,4 @@ name: artifactory-jcr sources: - https://github.com/jfrog/charts type: application -version: 107.90.8 +version: 107.90.9 diff --git a/stable/artifactory-oss/CHANGELOG.md b/stable/artifactory-oss/CHANGELOG.md index 5ac380389..ecd4303e5 100644 --- a/stable/artifactory-oss/CHANGELOG.md +++ b/stable/artifactory-oss/CHANGELOG.md @@ -1,7 +1,7 @@ # JFrog Artifactory OSS Chart Changelog All changes to this chart will be documented in this file -## [107.90.8] - Feb 20, 2024 +## [107.90.9] - Feb 20, 2024 * Updated `artifactory.installerInfo` content ## [107.80.0] - Feb 1, 2024 diff --git a/stable/artifactory-oss/Chart.yaml b/stable/artifactory-oss/Chart.yaml index ac79b1db2..227902bec 100644 --- a/stable/artifactory-oss/Chart.yaml +++ b/stable/artifactory-oss/Chart.yaml @@ -1,9 +1,9 @@ apiVersion: v2 -appVersion: 7.90.8 +appVersion: 7.90.9 dependencies: - name: artifactory repository: file://charts/artifactory - version: 107.90.8 + version: 107.90.9 description: JFrog Artifactory OSS home: https://www.jfrog.com/artifactory/ icon: https://raw.githubusercontent.com/jfrog/charts/master/stable/artifactory/logo/artifactory-logo.png @@ -20,4 +20,4 @@ name: artifactory-oss sources: - https://github.com/jfrog/charts type: application -version: 107.90.8 +version: 107.90.9 diff --git a/stable/artifactory/CHANGELOG.md b/stable/artifactory/CHANGELOG.md index 6fd2d32d6..aa71f9f43 100644 --- a/stable/artifactory/CHANGELOG.md +++ b/stable/artifactory/CHANGELOG.md @@ -1,7 +1,7 @@ # JFrog Artifactory Chart Changelog All changes to this chart will be documented in this file. -## [107.90.8] - July 18, 2024 +## [107.90.9] - July 18, 2024 * Fixed #adding colon in image registry which breaks deployment [GH-1892](https://github.com/jfrog/charts/pull/1892) * Added new `nginx.hosts` to use Nginx server_name directive instead of `ingress.hosts` * Added a deprecation notice of ingress.hosts when `ngnix.enabled` is true diff --git a/stable/artifactory/Chart.yaml b/stable/artifactory/Chart.yaml index 041c375ee..87c63a4ab 100644 --- a/stable/artifactory/Chart.yaml +++ b/stable/artifactory/Chart.yaml @@ -1,5 +1,5 @@ apiVersion: v2 -appVersion: 7.90.8 +appVersion: 7.90.9 dependencies: - condition: postgresql.enabled name: postgresql @@ -21,4 +21,4 @@ name: artifactory sources: - https://github.com/jfrog/charts type: application -version: 107.90.8 +version: 107.90.9 From a4a5abf607a5b1f52d91c2cb6b4e5074c5e395dc Mon Sep 17 00:00:00 2001 From: Ram <1331672+chukka@users.noreply.github.com> Date: Fri, 30 Aug 2024 10:44:55 +0530 Subject: [PATCH 15/30] [xray] 3.103.6 release --- stable/xray/CHANGELOG.md | 2 +- stable/xray/Chart.yaml | 4 ++-- stable/xray/values.yaml | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/stable/xray/CHANGELOG.md b/stable/xray/CHANGELOG.md index 5facfef52..9df4d0e1a 100644 --- a/stable/xray/CHANGELOG.md +++ b/stable/xray/CHANGELOG.md @@ -1,7 +1,7 @@ # JFrog Xray Chart Changelog All changes to this chart will be documented in this file. -## [103.102.3] - July 17, 2024 +## [103.103.6] - July 17, 2024 * Added support of specifying resources constraints for RabbitMQ's pre-upgrade-hook job * Fixed formatting error associated to the `volumeMounts` for the `panoramic` microservice [GH-1895](https://github.com/jfrog/charts/issues/1895) diff --git a/stable/xray/Chart.yaml b/stable/xray/Chart.yaml index dd0421ef3..9a6dc18de 100644 --- a/stable/xray/Chart.yaml +++ b/stable/xray/Chart.yaml @@ -1,5 +1,5 @@ apiVersion: v2 -appVersion: 3.102.3 +appVersion: 3.103.6 dependencies: - condition: postgresql.enabled name: postgresql @@ -24,4 +24,4 @@ name: xray sources: - https://github.com/jfrog/charts type: application -version: 103.102.3 +version: 103.103.6 diff --git a/stable/xray/values.yaml b/stable/xray/values.yaml index c280ecc71..1932e2f25 100644 --- a/stable/xray/values.yaml +++ b/stable/xray/values.yaml @@ -1376,7 +1376,7 @@ router: image: registry: releases-docker.jfrog.io repository: jfrog/router - tag: 7.124.0 + tag: 7.124.1 imagePullPolicy: IfNotPresent serviceRegistry: ## Service registry (Access) TLS verification skipped if enabled. From 01776f62f6ac5cbcc277d57e41cc5967eee7ad2e Mon Sep 17 00:00:00 2001 From: Ram <1331672+chukka@users.noreply.github.com> Date: Fri, 30 Aug 2024 10:45:09 +0530 Subject: [PATCH 16/30] [jfrog-platform] 10.19.4 release --- stable/jfrog-platform/CHANGELOG.md | 4 ++++ stable/jfrog-platform/Chart.lock | 8 ++++---- stable/jfrog-platform/Chart.yaml | 8 ++++---- stable/jfrog-platform/values.yaml | 2 +- 4 files changed, 13 insertions(+), 9 deletions(-) diff --git a/stable/jfrog-platform/CHANGELOG.md b/stable/jfrog-platform/CHANGELOG.md index 92702153b..53d766a64 100644 --- a/stable/jfrog-platform/CHANGELOG.md +++ b/stable/jfrog-platform/CHANGELOG.md @@ -1,6 +1,10 @@ # JFrog Platform Chart Changelog (GA releases only) All changes to this chart will be documented in this file. +## [10.19.4] - Aug 28, 2024 +* Update dependency artifactory chart version to 107.90.9 +* Update dependency xray chart version to 103.103.6 + ## [10.19.3] - Aug 16, 2024 * Update dependency artifactory chart version to 107.90.8 * Update dependency xray chart version to 103.102.3 diff --git a/stable/jfrog-platform/Chart.lock b/stable/jfrog-platform/Chart.lock index 164fa84f9..6fc5ef94f 100644 --- a/stable/jfrog-platform/Chart.lock +++ b/stable/jfrog-platform/Chart.lock @@ -7,10 +7,10 @@ dependencies: version: 11.9.3 - name: artifactory repository: https://charts.jfrog.io/ - version: 107.90.8 + version: 107.90.9 - name: xray repository: https://charts.jfrog.io/ - version: 103.102.3 + version: 103.103.6 - name: distribution repository: https://charts.jfrog.io/ version: 102.26.1 @@ -20,5 +20,5 @@ dependencies: - name: pipelines repository: https://charts.jfrog.io/ version: 101.59.7 -digest: sha256:2bdb6a67e534646a852528717f66a30716a0206c28a5188ed5230f01bd6084ce -generated: "2024-08-16T09:02:20.330994+05:30" +digest: sha256:e8443b53820da5923425fe791eca0c2e4de4f63b5ae2b5afeb8fa73544b2aced +generated: "2024-08-28T19:40:38.134486+05:30" diff --git a/stable/jfrog-platform/Chart.yaml b/stable/jfrog-platform/Chart.yaml index 58f187dfa..5928e0c4c 100644 --- a/stable/jfrog-platform/Chart.yaml +++ b/stable/jfrog-platform/Chart.yaml @@ -1,5 +1,5 @@ apiVersion: v2 -appVersion: 7.90.8 +appVersion: 7.90.9 dependencies: - condition: postgresql.enabled name: postgresql @@ -12,11 +12,11 @@ dependencies: - condition: artifactory.enabled name: artifactory repository: https://charts.jfrog.io/ - version: 107.90.8 + version: 107.90.9 - condition: xray.enabled name: xray repository: https://charts.jfrog.io/ - version: 103.102.3 + version: 103.103.6 - condition: distribution.enabled name: distribution repository: https://charts.jfrog.io/ @@ -50,4 +50,4 @@ name: jfrog-platform sources: - https://github.com/jfrog/charts type: application -version: 10.19.3 +version: 10.19.4 diff --git a/stable/jfrog-platform/values.yaml b/stable/jfrog-platform/values.yaml index 487fe2c37..22c541937 100644 --- a/stable/jfrog-platform/values.yaml +++ b/stable/jfrog-platform/values.yaml @@ -232,7 +232,7 @@ rabbitmq: artifactory: enabled: true unifiedUpgradeAllowed: true - installerInfo: '{"productId":"Helm_JFrogPlatform/{{ printf "10.19.3-%s" .Chart.AppVersion }}","features":[{"featureId":"Platform/{{ printf "%s-%s" "kubernetes" .Capabilities.KubeVersion.Version }}"},{"featureId":"Database/{{ .Values.database.type }}"},{"featureId":"Nginx_Enabled/{{ .Values.nginx.enabled }}"},{"featureId":"ArtifactoryPersistence_Type/{{ .Values.artifactory.persistence.type }}"},{"featureId":"SplitServicesToContainers_Enabled/{{ .Values.splitServicesToContainers }}"},{"featureId":"Filebeat_Enabled/{{ .Values.filebeat.enabled }}"},{"featureId":"ReplicaCount/{{ .Values.artifactory.replicaCount }}"}]}' + installerInfo: '{"productId":"Helm_JFrogPlatform/{{ printf "10.19.4-%s" .Chart.AppVersion }}","features":[{"featureId":"Platform/{{ printf "%s-%s" "kubernetes" .Capabilities.KubeVersion.Version }}"},{"featureId":"Database/{{ .Values.database.type }}"},{"featureId":"Nginx_Enabled/{{ .Values.nginx.enabled }}"},{"featureId":"ArtifactoryPersistence_Type/{{ .Values.artifactory.persistence.type }}"},{"featureId":"SplitServicesToContainers_Enabled/{{ .Values.splitServicesToContainers }}"},{"featureId":"Filebeat_Enabled/{{ .Values.filebeat.enabled }}"},{"featureId":"ReplicaCount/{{ .Values.artifactory.replicaCount }}"}]}' postgresql: enabled: false waitForDatabase: false From 58b6186cf13c55012d7564e44919c4d1d999a63e Mon Sep 17 00:00:00 2001 From: Ram <1331672+chukka@users.noreply.github.com> Date: Thu, 12 Sep 2024 09:44:44 +0200 Subject: [PATCH 17/30] [artifactory] 7.90.10 release --- stable/artifactory-cpp-ce/CHANGELOG.md | 2 +- stable/artifactory-cpp-ce/Chart.yaml | 6 +++--- stable/artifactory-cpp-ce/values.yaml | 2 +- stable/artifactory-ha/CHANGELOG.md | 2 +- stable/artifactory-ha/Chart.yaml | 6 +++--- stable/artifactory-ha/values.yaml | 2 +- stable/artifactory-jcr/CHANGELOG.md | 2 +- stable/artifactory-jcr/Chart.yaml | 6 +++--- stable/artifactory-jcr/values.yaml | 2 +- stable/artifactory-oss/CHANGELOG.md | 2 +- stable/artifactory-oss/Chart.yaml | 6 +++--- stable/artifactory-oss/values.yaml | 2 +- stable/artifactory/CHANGELOG.md | 2 +- stable/artifactory/Chart.yaml | 4 ++-- stable/artifactory/values.yaml | 2 +- 15 files changed, 24 insertions(+), 24 deletions(-) diff --git a/stable/artifactory-cpp-ce/CHANGELOG.md b/stable/artifactory-cpp-ce/CHANGELOG.md index 0d1fefaf1..41ec88fee 100644 --- a/stable/artifactory-cpp-ce/CHANGELOG.md +++ b/stable/artifactory-cpp-ce/CHANGELOG.md @@ -1,7 +1,7 @@ # JFrog Artifactory CE for C++ Chart Changelog All changes to this chart will be documented in this file -## [107.90.9] - Feb 20, 2024 +## [107.90.10] - Feb 20, 2024 * Updated `artifactory.installerInfo` content ## [107.80.0] - Feb 1, 2024 diff --git a/stable/artifactory-cpp-ce/Chart.yaml b/stable/artifactory-cpp-ce/Chart.yaml index 56e19782d..aec5c0f38 100644 --- a/stable/artifactory-cpp-ce/Chart.yaml +++ b/stable/artifactory-cpp-ce/Chart.yaml @@ -1,9 +1,9 @@ apiVersion: v2 -appVersion: 7.90.9 +appVersion: 7.90.10 dependencies: - name: artifactory repository: file://charts/artifactory - version: 107.90.9 + version: 107.90.10 description: JFrog Artifactory CE for C++ home: https://www.jfrog.com/artifactory/ icon: https://raw.githubusercontent.com/jfrog/charts/master/stable/artifactory-cpp-ce/logo/conan.png @@ -21,4 +21,4 @@ name: artifactory-cpp-ce sources: - https://github.com/jfrog/charts type: application -version: 107.90.9 +version: 107.90.10 diff --git a/stable/artifactory-cpp-ce/values.yaml b/stable/artifactory-cpp-ce/values.yaml index 4b3e4535d..10f1b08e2 100644 --- a/stable/artifactory-cpp-ce/values.yaml +++ b/stable/artifactory-cpp-ce/values.yaml @@ -69,7 +69,7 @@ postgresql: enabled: true router: image: - tag: 7.118.0 + tag: 7.118.2 initContainers: image: tag: 9.4.949.1716471857 diff --git a/stable/artifactory-ha/CHANGELOG.md b/stable/artifactory-ha/CHANGELOG.md index 06046425d..28f5dd520 100644 --- a/stable/artifactory-ha/CHANGELOG.md +++ b/stable/artifactory-ha/CHANGELOG.md @@ -1,7 +1,7 @@ # JFrog Artifactory-ha Chart Changelog All changes to this chart will be documented in this file. -## [107.90.9] - July 18, 2024 +## [107.90.10] - July 18, 2024 * Fixed #adding colon in image registry which breaks deployment [GH-1892](https://github.com/jfrog/charts/pull/1892) * Added new `nginx.hosts` to use Nginx server_name directive instead of `ingress.hosts` * Added a deprecation notice of ingress.hosts when `ngnix.enabled` is true diff --git a/stable/artifactory-ha/Chart.yaml b/stable/artifactory-ha/Chart.yaml index 7c1734f68..94f34cae1 100644 --- a/stable/artifactory-ha/Chart.yaml +++ b/stable/artifactory-ha/Chart.yaml @@ -1,7 +1,7 @@ annotations: - artifactoryServiceVersion: 7.90.12 + artifactoryServiceVersion: 7.90.13 apiVersion: v2 -appVersion: 7.90.9 +appVersion: 7.90.10 dependencies: - condition: postgresql.enabled name: postgresql @@ -23,4 +23,4 @@ name: artifactory-ha sources: - https://github.com/jfrog/charts type: application -version: 107.90.9 +version: 107.90.10 diff --git a/stable/artifactory-ha/values.yaml b/stable/artifactory-ha/values.yaml index acd5b1a65..0affa3d69 100644 --- a/stable/artifactory-ha/values.yaml +++ b/stable/artifactory-ha/values.yaml @@ -255,7 +255,7 @@ router: image: registry: releases-docker.jfrog.io repository: jfrog/router - tag: 7.118.0 + tag: 7.118.2 pullPolicy: IfNotPresent serviceRegistry: ## Service registry (Access) TLS verification skipped if enabled diff --git a/stable/artifactory-jcr/CHANGELOG.md b/stable/artifactory-jcr/CHANGELOG.md index 65ca8bcf7..d05e2a520 100644 --- a/stable/artifactory-jcr/CHANGELOG.md +++ b/stable/artifactory-jcr/CHANGELOG.md @@ -1,7 +1,7 @@ # JFrog Container Registry Chart Changelog All changes to this chart will be documented in this file. -## [107.90.9] - Feb 20, 2024 +## [107.90.10] - Feb 20, 2024 * Updated `artifactory.installerInfo` content ## [107.80.0] - Feb 1, 2024 diff --git a/stable/artifactory-jcr/Chart.yaml b/stable/artifactory-jcr/Chart.yaml index b5c6e5b05..3334fb734 100644 --- a/stable/artifactory-jcr/Chart.yaml +++ b/stable/artifactory-jcr/Chart.yaml @@ -1,9 +1,9 @@ apiVersion: v2 -appVersion: 7.90.9 +appVersion: 7.90.10 dependencies: - name: artifactory repository: file://charts/artifactory - version: 107.90.9 + version: 107.90.10 description: JFrog Container Registry home: https://jfrog.com/container-registry/ icon: https://raw.githubusercontent.com/jfrog/charts/master/stable/artifactory-jcr/logo/jcr-logo.png @@ -22,4 +22,4 @@ name: artifactory-jcr sources: - https://github.com/jfrog/charts type: application -version: 107.90.9 +version: 107.90.10 diff --git a/stable/artifactory-jcr/values.yaml b/stable/artifactory-jcr/values.yaml index 1cf33285e..6892aa866 100644 --- a/stable/artifactory-jcr/values.yaml +++ b/stable/artifactory-jcr/values.yaml @@ -69,7 +69,7 @@ postgresql: enabled: true router: image: - tag: 7.118.0 + tag: 7.118.2 initContainers: image: tag: 9.4.949.1716471857 diff --git a/stable/artifactory-oss/CHANGELOG.md b/stable/artifactory-oss/CHANGELOG.md index ecd4303e5..e5179a058 100644 --- a/stable/artifactory-oss/CHANGELOG.md +++ b/stable/artifactory-oss/CHANGELOG.md @@ -1,7 +1,7 @@ # JFrog Artifactory OSS Chart Changelog All changes to this chart will be documented in this file -## [107.90.9] - Feb 20, 2024 +## [107.90.10] - Feb 20, 2024 * Updated `artifactory.installerInfo` content ## [107.80.0] - Feb 1, 2024 diff --git a/stable/artifactory-oss/Chart.yaml b/stable/artifactory-oss/Chart.yaml index 227902bec..38cd23544 100644 --- a/stable/artifactory-oss/Chart.yaml +++ b/stable/artifactory-oss/Chart.yaml @@ -1,9 +1,9 @@ apiVersion: v2 -appVersion: 7.90.9 +appVersion: 7.90.10 dependencies: - name: artifactory repository: file://charts/artifactory - version: 107.90.9 + version: 107.90.10 description: JFrog Artifactory OSS home: https://www.jfrog.com/artifactory/ icon: https://raw.githubusercontent.com/jfrog/charts/master/stable/artifactory/logo/artifactory-logo.png @@ -20,4 +20,4 @@ name: artifactory-oss sources: - https://github.com/jfrog/charts type: application -version: 107.90.9 +version: 107.90.10 diff --git a/stable/artifactory-oss/values.yaml b/stable/artifactory-oss/values.yaml index a0884bd1f..9ec458817 100644 --- a/stable/artifactory-oss/values.yaml +++ b/stable/artifactory-oss/values.yaml @@ -69,7 +69,7 @@ postgresql: enabled: true router: image: - tag: 7.118.0 + tag: 7.118.2 initContainers: image: tag: 9.4.949.1716471857 diff --git a/stable/artifactory/CHANGELOG.md b/stable/artifactory/CHANGELOG.md index aa71f9f43..c86d0e438 100644 --- a/stable/artifactory/CHANGELOG.md +++ b/stable/artifactory/CHANGELOG.md @@ -1,7 +1,7 @@ # JFrog Artifactory Chart Changelog All changes to this chart will be documented in this file. -## [107.90.9] - July 18, 2024 +## [107.90.10] - July 18, 2024 * Fixed #adding colon in image registry which breaks deployment [GH-1892](https://github.com/jfrog/charts/pull/1892) * Added new `nginx.hosts` to use Nginx server_name directive instead of `ingress.hosts` * Added a deprecation notice of ingress.hosts when `ngnix.enabled` is true diff --git a/stable/artifactory/Chart.yaml b/stable/artifactory/Chart.yaml index 87c63a4ab..223843784 100644 --- a/stable/artifactory/Chart.yaml +++ b/stable/artifactory/Chart.yaml @@ -1,5 +1,5 @@ apiVersion: v2 -appVersion: 7.90.9 +appVersion: 7.90.10 dependencies: - condition: postgresql.enabled name: postgresql @@ -21,4 +21,4 @@ name: artifactory sources: - https://github.com/jfrog/charts type: application -version: 107.90.9 +version: 107.90.10 diff --git a/stable/artifactory/values.yaml b/stable/artifactory/values.yaml index aec4b4ffd..ff9a6b33f 100644 --- a/stable/artifactory/values.yaml +++ b/stable/artifactory/values.yaml @@ -198,7 +198,7 @@ router: image: registry: releases-docker.jfrog.io repository: jfrog/router - tag: 7.118.0 + tag: 7.118.2 pullPolicy: IfNotPresent serviceRegistry: ## Service registry (Access) TLS verification skipped if enabled From 24b85b224f5f53708f4aedf71cac4cca65a1409a Mon Sep 17 00:00:00 2001 From: Ram <1331672+chukka@users.noreply.github.com> Date: Thu, 12 Sep 2024 09:45:15 +0200 Subject: [PATCH 18/30] [xray] 3.104.8 release --- stable/xray/CHANGELOG.md | 2 +- stable/xray/Chart.yaml | 4 ++-- stable/xray/templates/xray-ipa-deployment.yaml | 3 +++ stable/xray/templates/xray-statefulset.yaml | 3 +++ 4 files changed, 9 insertions(+), 3 deletions(-) diff --git a/stable/xray/CHANGELOG.md b/stable/xray/CHANGELOG.md index 9df4d0e1a..78a4ab283 100644 --- a/stable/xray/CHANGELOG.md +++ b/stable/xray/CHANGELOG.md @@ -1,7 +1,7 @@ # JFrog Xray Chart Changelog All changes to this chart will be documented in this file. -## [103.103.6] - July 17, 2024 +## [103.104.8] - July 17, 2024 * Added support of specifying resources constraints for RabbitMQ's pre-upgrade-hook job * Fixed formatting error associated to the `volumeMounts` for the `panoramic` microservice [GH-1895](https://github.com/jfrog/charts/issues/1895) diff --git a/stable/xray/Chart.yaml b/stable/xray/Chart.yaml index 9a6dc18de..e54688bf1 100644 --- a/stable/xray/Chart.yaml +++ b/stable/xray/Chart.yaml @@ -1,5 +1,5 @@ apiVersion: v2 -appVersion: 3.103.6 +appVersion: 3.104.8 dependencies: - condition: postgresql.enabled name: postgresql @@ -24,4 +24,4 @@ name: xray sources: - https://github.com/jfrog/charts type: application -version: 103.103.6 +version: 103.104.8 diff --git a/stable/xray/templates/xray-ipa-deployment.yaml b/stable/xray/templates/xray-ipa-deployment.yaml index c7c011ae5..6e7439e9b 100644 --- a/stable/xray/templates/xray-ipa-deployment.yaml +++ b/stable/xray/templates/xray-ipa-deployment.yaml @@ -76,6 +76,9 @@ spec: {{- with .Values.xray.annotations }} {{ toYaml . | indent 8 }} {{- end }} + {{- with .Values.policyenforcer.annotations }} +{{ toYaml . | indent 8 }} + {{- end }} spec: {{- if .Values.xray.schedulerName }} schedulerName: {{ .Values.xray.schedulerName | quote }} diff --git a/stable/xray/templates/xray-statefulset.yaml b/stable/xray/templates/xray-statefulset.yaml index 0e0914b8a..7d92bc25f 100644 --- a/stable/xray/templates/xray-statefulset.yaml +++ b/stable/xray/templates/xray-statefulset.yaml @@ -73,6 +73,9 @@ spec: {{- with .Values.xray.annotations }} {{ toYaml . | indent 8 }} {{- end }} + {{- with .Values.policyenforcer.annotations }} +{{ toYaml . | indent 8 }} + {{- end }} spec: {{- if .Values.xray.schedulerName }} schedulerName: {{ .Values.xray.schedulerName | quote }} From db9d5736e7885282a89a36f324119e813a43b1f5 Mon Sep 17 00:00:00 2001 From: Ram <1331672+chukka@users.noreply.github.com> Date: Thu, 12 Sep 2024 09:45:41 +0200 Subject: [PATCH 19/30] [jfrog-platform] 10.19.5 release --- stable/jfrog-platform/CHANGELOG.md | 4 ++++ stable/jfrog-platform/Chart.lock | 8 ++++---- stable/jfrog-platform/Chart.yaml | 8 ++++---- stable/jfrog-platform/values.yaml | 2 +- 4 files changed, 13 insertions(+), 9 deletions(-) diff --git a/stable/jfrog-platform/CHANGELOG.md b/stable/jfrog-platform/CHANGELOG.md index 53d766a64..317a4fcea 100644 --- a/stable/jfrog-platform/CHANGELOG.md +++ b/stable/jfrog-platform/CHANGELOG.md @@ -1,6 +1,10 @@ # JFrog Platform Chart Changelog (GA releases only) All changes to this chart will be documented in this file. +## [10.19.5] - Sep 11, 2024 +* Update dependency artifactory chart version to 107.90.10 +* Update dependency xray chart version to 103.104.8 + ## [10.19.4] - Aug 28, 2024 * Update dependency artifactory chart version to 107.90.9 * Update dependency xray chart version to 103.103.6 diff --git a/stable/jfrog-platform/Chart.lock b/stable/jfrog-platform/Chart.lock index 6fc5ef94f..9d8718838 100644 --- a/stable/jfrog-platform/Chart.lock +++ b/stable/jfrog-platform/Chart.lock @@ -7,10 +7,10 @@ dependencies: version: 11.9.3 - name: artifactory repository: https://charts.jfrog.io/ - version: 107.90.9 + version: 107.90.10 - name: xray repository: https://charts.jfrog.io/ - version: 103.103.6 + version: 103.104.8 - name: distribution repository: https://charts.jfrog.io/ version: 102.26.1 @@ -20,5 +20,5 @@ dependencies: - name: pipelines repository: https://charts.jfrog.io/ version: 101.59.7 -digest: sha256:e8443b53820da5923425fe791eca0c2e4de4f63b5ae2b5afeb8fa73544b2aced -generated: "2024-08-28T19:40:38.134486+05:30" +digest: sha256:fb50efce66803cefab39d3efc0a32c0842b97703a8bec572453b2217a56d8934 +generated: "2024-09-11T16:49:29.381655+02:00" diff --git a/stable/jfrog-platform/Chart.yaml b/stable/jfrog-platform/Chart.yaml index 5928e0c4c..2ff280b6f 100644 --- a/stable/jfrog-platform/Chart.yaml +++ b/stable/jfrog-platform/Chart.yaml @@ -1,5 +1,5 @@ apiVersion: v2 -appVersion: 7.90.9 +appVersion: 7.90.10 dependencies: - condition: postgresql.enabled name: postgresql @@ -12,11 +12,11 @@ dependencies: - condition: artifactory.enabled name: artifactory repository: https://charts.jfrog.io/ - version: 107.90.9 + version: 107.90.10 - condition: xray.enabled name: xray repository: https://charts.jfrog.io/ - version: 103.103.6 + version: 103.104.8 - condition: distribution.enabled name: distribution repository: https://charts.jfrog.io/ @@ -50,4 +50,4 @@ name: jfrog-platform sources: - https://github.com/jfrog/charts type: application -version: 10.19.4 +version: 10.19.5 diff --git a/stable/jfrog-platform/values.yaml b/stable/jfrog-platform/values.yaml index 22c541937..51d18dd2f 100644 --- a/stable/jfrog-platform/values.yaml +++ b/stable/jfrog-platform/values.yaml @@ -232,7 +232,7 @@ rabbitmq: artifactory: enabled: true unifiedUpgradeAllowed: true - installerInfo: '{"productId":"Helm_JFrogPlatform/{{ printf "10.19.4-%s" .Chart.AppVersion }}","features":[{"featureId":"Platform/{{ printf "%s-%s" "kubernetes" .Capabilities.KubeVersion.Version }}"},{"featureId":"Database/{{ .Values.database.type }}"},{"featureId":"Nginx_Enabled/{{ .Values.nginx.enabled }}"},{"featureId":"ArtifactoryPersistence_Type/{{ .Values.artifactory.persistence.type }}"},{"featureId":"SplitServicesToContainers_Enabled/{{ .Values.splitServicesToContainers }}"},{"featureId":"Filebeat_Enabled/{{ .Values.filebeat.enabled }}"},{"featureId":"ReplicaCount/{{ .Values.artifactory.replicaCount }}"}]}' + installerInfo: '{"productId":"Helm_JFrogPlatform/{{ printf "10.19.5-%s" .Chart.AppVersion }}","features":[{"featureId":"Platform/{{ printf "%s-%s" "kubernetes" .Capabilities.KubeVersion.Version }}"},{"featureId":"Database/{{ .Values.database.type }}"},{"featureId":"Nginx_Enabled/{{ .Values.nginx.enabled }}"},{"featureId":"ArtifactoryPersistence_Type/{{ .Values.artifactory.persistence.type }}"},{"featureId":"SplitServicesToContainers_Enabled/{{ .Values.splitServicesToContainers }}"},{"featureId":"Filebeat_Enabled/{{ .Values.filebeat.enabled }}"},{"featureId":"ReplicaCount/{{ .Values.artifactory.replicaCount }}"}]}' postgresql: enabled: false waitForDatabase: false From 7550ad2243d98064dee2e2f1f4003cdd8f6909b9 Mon Sep 17 00:00:00 2001 From: Ram <1331672+chukka@users.noreply.github.com> Date: Tue, 8 Oct 2024 19:47:50 +0530 Subject: [PATCH 20/30] [artifactory] 7.90.14 release --- stable/artifactory-cpp-ce/CHANGELOG.md | 2 +- stable/artifactory-cpp-ce/Chart.yaml | 6 +++--- stable/artifactory-cpp-ce/values.yaml | 2 +- stable/artifactory-ha/CHANGELOG.md | 2 +- stable/artifactory-ha/Chart.yaml | 6 +++--- stable/artifactory-ha/values.yaml | 2 +- stable/artifactory-jcr/CHANGELOG.md | 2 +- stable/artifactory-jcr/Chart.yaml | 6 +++--- stable/artifactory-jcr/values.yaml | 2 +- stable/artifactory-oss/CHANGELOG.md | 2 +- stable/artifactory-oss/Chart.yaml | 6 +++--- stable/artifactory-oss/values.yaml | 2 +- stable/artifactory/CHANGELOG.md | 2 +- stable/artifactory/Chart.yaml | 4 ++-- stable/artifactory/values.yaml | 2 +- 15 files changed, 24 insertions(+), 24 deletions(-) diff --git a/stable/artifactory-cpp-ce/CHANGELOG.md b/stable/artifactory-cpp-ce/CHANGELOG.md index 41ec88fee..0ee8af051 100644 --- a/stable/artifactory-cpp-ce/CHANGELOG.md +++ b/stable/artifactory-cpp-ce/CHANGELOG.md @@ -1,7 +1,7 @@ # JFrog Artifactory CE for C++ Chart Changelog All changes to this chart will be documented in this file -## [107.90.10] - Feb 20, 2024 +## [107.90.14] - Feb 20, 2024 * Updated `artifactory.installerInfo` content ## [107.80.0] - Feb 1, 2024 diff --git a/stable/artifactory-cpp-ce/Chart.yaml b/stable/artifactory-cpp-ce/Chart.yaml index aec5c0f38..b31b79502 100644 --- a/stable/artifactory-cpp-ce/Chart.yaml +++ b/stable/artifactory-cpp-ce/Chart.yaml @@ -1,9 +1,9 @@ apiVersion: v2 -appVersion: 7.90.10 +appVersion: 7.90.14 dependencies: - name: artifactory repository: file://charts/artifactory - version: 107.90.10 + version: 107.90.14 description: JFrog Artifactory CE for C++ home: https://www.jfrog.com/artifactory/ icon: https://raw.githubusercontent.com/jfrog/charts/master/stable/artifactory-cpp-ce/logo/conan.png @@ -21,4 +21,4 @@ name: artifactory-cpp-ce sources: - https://github.com/jfrog/charts type: application -version: 107.90.10 +version: 107.90.14 diff --git a/stable/artifactory-cpp-ce/values.yaml b/stable/artifactory-cpp-ce/values.yaml index 10f1b08e2..20d9ee86a 100644 --- a/stable/artifactory-cpp-ce/values.yaml +++ b/stable/artifactory-cpp-ce/values.yaml @@ -69,7 +69,7 @@ postgresql: enabled: true router: image: - tag: 7.118.2 + tag: 7.118.3 initContainers: image: tag: 9.4.949.1716471857 diff --git a/stable/artifactory-ha/CHANGELOG.md b/stable/artifactory-ha/CHANGELOG.md index 28f5dd520..5edb3eebb 100644 --- a/stable/artifactory-ha/CHANGELOG.md +++ b/stable/artifactory-ha/CHANGELOG.md @@ -1,7 +1,7 @@ # JFrog Artifactory-ha Chart Changelog All changes to this chart will be documented in this file. -## [107.90.10] - July 18, 2024 +## [107.90.14] - July 18, 2024 * Fixed #adding colon in image registry which breaks deployment [GH-1892](https://github.com/jfrog/charts/pull/1892) * Added new `nginx.hosts` to use Nginx server_name directive instead of `ingress.hosts` * Added a deprecation notice of ingress.hosts when `ngnix.enabled` is true diff --git a/stable/artifactory-ha/Chart.yaml b/stable/artifactory-ha/Chart.yaml index 94f34cae1..11d7e9f51 100644 --- a/stable/artifactory-ha/Chart.yaml +++ b/stable/artifactory-ha/Chart.yaml @@ -1,7 +1,7 @@ annotations: - artifactoryServiceVersion: 7.90.13 + artifactoryServiceVersion: 7.90.20 apiVersion: v2 -appVersion: 7.90.10 +appVersion: 7.90.14 dependencies: - condition: postgresql.enabled name: postgresql @@ -23,4 +23,4 @@ name: artifactory-ha sources: - https://github.com/jfrog/charts type: application -version: 107.90.10 +version: 107.90.14 diff --git a/stable/artifactory-ha/values.yaml b/stable/artifactory-ha/values.yaml index 0affa3d69..3d1a325af 100644 --- a/stable/artifactory-ha/values.yaml +++ b/stable/artifactory-ha/values.yaml @@ -255,7 +255,7 @@ router: image: registry: releases-docker.jfrog.io repository: jfrog/router - tag: 7.118.2 + tag: 7.118.3 pullPolicy: IfNotPresent serviceRegistry: ## Service registry (Access) TLS verification skipped if enabled diff --git a/stable/artifactory-jcr/CHANGELOG.md b/stable/artifactory-jcr/CHANGELOG.md index d05e2a520..3a984d30f 100644 --- a/stable/artifactory-jcr/CHANGELOG.md +++ b/stable/artifactory-jcr/CHANGELOG.md @@ -1,7 +1,7 @@ # JFrog Container Registry Chart Changelog All changes to this chart will be documented in this file. -## [107.90.10] - Feb 20, 2024 +## [107.90.14] - Feb 20, 2024 * Updated `artifactory.installerInfo` content ## [107.80.0] - Feb 1, 2024 diff --git a/stable/artifactory-jcr/Chart.yaml b/stable/artifactory-jcr/Chart.yaml index 3334fb734..4c389f432 100644 --- a/stable/artifactory-jcr/Chart.yaml +++ b/stable/artifactory-jcr/Chart.yaml @@ -1,9 +1,9 @@ apiVersion: v2 -appVersion: 7.90.10 +appVersion: 7.90.14 dependencies: - name: artifactory repository: file://charts/artifactory - version: 107.90.10 + version: 107.90.14 description: JFrog Container Registry home: https://jfrog.com/container-registry/ icon: https://raw.githubusercontent.com/jfrog/charts/master/stable/artifactory-jcr/logo/jcr-logo.png @@ -22,4 +22,4 @@ name: artifactory-jcr sources: - https://github.com/jfrog/charts type: application -version: 107.90.10 +version: 107.90.14 diff --git a/stable/artifactory-jcr/values.yaml b/stable/artifactory-jcr/values.yaml index 6892aa866..a96b4f7d2 100644 --- a/stable/artifactory-jcr/values.yaml +++ b/stable/artifactory-jcr/values.yaml @@ -69,7 +69,7 @@ postgresql: enabled: true router: image: - tag: 7.118.2 + tag: 7.118.3 initContainers: image: tag: 9.4.949.1716471857 diff --git a/stable/artifactory-oss/CHANGELOG.md b/stable/artifactory-oss/CHANGELOG.md index e5179a058..f79342ced 100644 --- a/stable/artifactory-oss/CHANGELOG.md +++ b/stable/artifactory-oss/CHANGELOG.md @@ -1,7 +1,7 @@ # JFrog Artifactory OSS Chart Changelog All changes to this chart will be documented in this file -## [107.90.10] - Feb 20, 2024 +## [107.90.14] - Feb 20, 2024 * Updated `artifactory.installerInfo` content ## [107.80.0] - Feb 1, 2024 diff --git a/stable/artifactory-oss/Chart.yaml b/stable/artifactory-oss/Chart.yaml index 38cd23544..c91051baf 100644 --- a/stable/artifactory-oss/Chart.yaml +++ b/stable/artifactory-oss/Chart.yaml @@ -1,9 +1,9 @@ apiVersion: v2 -appVersion: 7.90.10 +appVersion: 7.90.14 dependencies: - name: artifactory repository: file://charts/artifactory - version: 107.90.10 + version: 107.90.14 description: JFrog Artifactory OSS home: https://www.jfrog.com/artifactory/ icon: https://raw.githubusercontent.com/jfrog/charts/master/stable/artifactory/logo/artifactory-logo.png @@ -20,4 +20,4 @@ name: artifactory-oss sources: - https://github.com/jfrog/charts type: application -version: 107.90.10 +version: 107.90.14 diff --git a/stable/artifactory-oss/values.yaml b/stable/artifactory-oss/values.yaml index 9ec458817..986dbc5b5 100644 --- a/stable/artifactory-oss/values.yaml +++ b/stable/artifactory-oss/values.yaml @@ -69,7 +69,7 @@ postgresql: enabled: true router: image: - tag: 7.118.2 + tag: 7.118.3 initContainers: image: tag: 9.4.949.1716471857 diff --git a/stable/artifactory/CHANGELOG.md b/stable/artifactory/CHANGELOG.md index c86d0e438..61f0d3d9a 100644 --- a/stable/artifactory/CHANGELOG.md +++ b/stable/artifactory/CHANGELOG.md @@ -1,7 +1,7 @@ # JFrog Artifactory Chart Changelog All changes to this chart will be documented in this file. -## [107.90.10] - July 18, 2024 +## [107.90.14] - July 18, 2024 * Fixed #adding colon in image registry which breaks deployment [GH-1892](https://github.com/jfrog/charts/pull/1892) * Added new `nginx.hosts` to use Nginx server_name directive instead of `ingress.hosts` * Added a deprecation notice of ingress.hosts when `ngnix.enabled` is true diff --git a/stable/artifactory/Chart.yaml b/stable/artifactory/Chart.yaml index 223843784..58bbbab3f 100644 --- a/stable/artifactory/Chart.yaml +++ b/stable/artifactory/Chart.yaml @@ -1,5 +1,5 @@ apiVersion: v2 -appVersion: 7.90.10 +appVersion: 7.90.14 dependencies: - condition: postgresql.enabled name: postgresql @@ -21,4 +21,4 @@ name: artifactory sources: - https://github.com/jfrog/charts type: application -version: 107.90.10 +version: 107.90.14 diff --git a/stable/artifactory/values.yaml b/stable/artifactory/values.yaml index ff9a6b33f..15f5de112 100644 --- a/stable/artifactory/values.yaml +++ b/stable/artifactory/values.yaml @@ -198,7 +198,7 @@ router: image: registry: releases-docker.jfrog.io repository: jfrog/router - tag: 7.118.2 + tag: 7.118.3 pullPolicy: IfNotPresent serviceRegistry: ## Service registry (Access) TLS verification skipped if enabled From 149affad2fabe9a5457d7a15fa9c527811807850 Mon Sep 17 00:00:00 2001 From: Ram <1331672+chukka@users.noreply.github.com> Date: Tue, 8 Oct 2024 19:48:14 +0530 Subject: [PATCH 21/30] [xray] 3.104.17 release --- stable/xray/CHANGELOG.md | 2 +- stable/xray/Chart.yaml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/stable/xray/CHANGELOG.md b/stable/xray/CHANGELOG.md index 78a4ab283..d74830dfa 100644 --- a/stable/xray/CHANGELOG.md +++ b/stable/xray/CHANGELOG.md @@ -1,7 +1,7 @@ # JFrog Xray Chart Changelog All changes to this chart will be documented in this file. -## [103.104.8] - July 17, 2024 +## [103.104.17] - July 17, 2024 * Added support of specifying resources constraints for RabbitMQ's pre-upgrade-hook job * Fixed formatting error associated to the `volumeMounts` for the `panoramic` microservice [GH-1895](https://github.com/jfrog/charts/issues/1895) diff --git a/stable/xray/Chart.yaml b/stable/xray/Chart.yaml index e54688bf1..768bc8198 100644 --- a/stable/xray/Chart.yaml +++ b/stable/xray/Chart.yaml @@ -1,5 +1,5 @@ apiVersion: v2 -appVersion: 3.104.8 +appVersion: 3.104.17 dependencies: - condition: postgresql.enabled name: postgresql @@ -24,4 +24,4 @@ name: xray sources: - https://github.com/jfrog/charts type: application -version: 103.104.8 +version: 103.104.17 From 019967f4d20be26dab52db405bc87d291fec840e Mon Sep 17 00:00:00 2001 From: Ram <1331672+chukka@users.noreply.github.com> Date: Tue, 8 Oct 2024 19:48:48 +0530 Subject: [PATCH 22/30] [jfrog-platform] 10.19.6 release --- stable/jfrog-platform/CHANGELOG.md | 6 ++++++ stable/jfrog-platform/Chart.lock | 8 ++++---- stable/jfrog-platform/Chart.yaml | 8 ++++---- stable/jfrog-platform/files/setupPostgres.sh | 2 +- stable/jfrog-platform/templates/upgrade-hook.yaml | 4 ++++ stable/jfrog-platform/values.yaml | 3 ++- 6 files changed, 21 insertions(+), 10 deletions(-) diff --git a/stable/jfrog-platform/CHANGELOG.md b/stable/jfrog-platform/CHANGELOG.md index 317a4fcea..3abcac574 100644 --- a/stable/jfrog-platform/CHANGELOG.md +++ b/stable/jfrog-platform/CHANGELOG.md @@ -1,6 +1,12 @@ # JFrog Platform Chart Changelog (GA releases only) All changes to this chart will be documented in this file. +## [10.19.6] - Oct 8, 2024 +* Fixed typo to get fourth parameter for setupPostgres.sh [GH-1992](https://github.com/jfrog/charts/pull/1992) +* Added `preUpgradeHook.tolerations` +* Update dependency artifactory chart version to 107.90.14 +* Update dependency xray chart version to 103.104.17 + ## [10.19.5] - Sep 11, 2024 * Update dependency artifactory chart version to 107.90.10 * Update dependency xray chart version to 103.104.8 diff --git a/stable/jfrog-platform/Chart.lock b/stable/jfrog-platform/Chart.lock index 9d8718838..c4ff85600 100644 --- a/stable/jfrog-platform/Chart.lock +++ b/stable/jfrog-platform/Chart.lock @@ -7,10 +7,10 @@ dependencies: version: 11.9.3 - name: artifactory repository: https://charts.jfrog.io/ - version: 107.90.10 + version: 107.90.14 - name: xray repository: https://charts.jfrog.io/ - version: 103.104.8 + version: 103.104.17 - name: distribution repository: https://charts.jfrog.io/ version: 102.26.1 @@ -20,5 +20,5 @@ dependencies: - name: pipelines repository: https://charts.jfrog.io/ version: 101.59.7 -digest: sha256:fb50efce66803cefab39d3efc0a32c0842b97703a8bec572453b2217a56d8934 -generated: "2024-09-11T16:49:29.381655+02:00" +digest: sha256:a6071a02ef3029d1aba4ed221e61566dc2a098e2b4c6b85108b839d5fdf5d89a +generated: "2024-10-08T17:20:56.179314+05:30" diff --git a/stable/jfrog-platform/Chart.yaml b/stable/jfrog-platform/Chart.yaml index 2ff280b6f..15a0b0a5c 100644 --- a/stable/jfrog-platform/Chart.yaml +++ b/stable/jfrog-platform/Chart.yaml @@ -1,5 +1,5 @@ apiVersion: v2 -appVersion: 7.90.10 +appVersion: 7.90.14 dependencies: - condition: postgresql.enabled name: postgresql @@ -12,11 +12,11 @@ dependencies: - condition: artifactory.enabled name: artifactory repository: https://charts.jfrog.io/ - version: 107.90.10 + version: 107.90.14 - condition: xray.enabled name: xray repository: https://charts.jfrog.io/ - version: 103.104.8 + version: 103.104.17 - condition: distribution.enabled name: distribution repository: https://charts.jfrog.io/ @@ -50,4 +50,4 @@ name: jfrog-platform sources: - https://github.com/jfrog/charts type: application -version: 10.19.5 +version: 10.19.6 diff --git a/stable/jfrog-platform/files/setupPostgres.sh b/stable/jfrog-platform/files/setupPostgres.sh index 69cd53661..e766104ce 100644 --- a/stable/jfrog-platform/files/setupPostgres.sh +++ b/stable/jfrog-platform/files/setupPostgres.sh @@ -104,7 +104,7 @@ setupDB(){ : ${DB_NAME:=$1} : ${DB_USERNAME:=$2} : ${DB_PASSWORD:=$3} -: ${CHART_NAME:=4} +: ${CHART_NAME:=$4} ### Following are the postgres details being setup for each service. ## Common details diff --git a/stable/jfrog-platform/templates/upgrade-hook.yaml b/stable/jfrog-platform/templates/upgrade-hook.yaml index f146e8137..18873021d 100644 --- a/stable/jfrog-platform/templates/upgrade-hook.yaml +++ b/stable/jfrog-platform/templates/upgrade-hook.yaml @@ -165,5 +165,9 @@ spec: {{- end }} restartPolicy: Never terminationGracePeriodSeconds: 10 +{{- with .Values.preUpgradeHook.tolerations }} + tolerations: +{{ toYaml . | indent 8 }} + {{- end }} {{- end }} {{- end }} \ No newline at end of file diff --git a/stable/jfrog-platform/values.yaml b/stable/jfrog-platform/values.yaml index 51d18dd2f..aac6495f6 100644 --- a/stable/jfrog-platform/values.yaml +++ b/stable/jfrog-platform/values.yaml @@ -232,7 +232,7 @@ rabbitmq: artifactory: enabled: true unifiedUpgradeAllowed: true - installerInfo: '{"productId":"Helm_JFrogPlatform/{{ printf "10.19.5-%s" .Chart.AppVersion }}","features":[{"featureId":"Platform/{{ printf "%s-%s" "kubernetes" .Capabilities.KubeVersion.Version }}"},{"featureId":"Database/{{ .Values.database.type }}"},{"featureId":"Nginx_Enabled/{{ .Values.nginx.enabled }}"},{"featureId":"ArtifactoryPersistence_Type/{{ .Values.artifactory.persistence.type }}"},{"featureId":"SplitServicesToContainers_Enabled/{{ .Values.splitServicesToContainers }}"},{"featureId":"Filebeat_Enabled/{{ .Values.filebeat.enabled }}"},{"featureId":"ReplicaCount/{{ .Values.artifactory.replicaCount }}"}]}' + installerInfo: '{"productId":"Helm_JFrogPlatform/{{ printf "10.19.6-%s" .Chart.AppVersion }}","features":[{"featureId":"Platform/{{ printf "%s-%s" "kubernetes" .Capabilities.KubeVersion.Version }}"},{"featureId":"Database/{{ .Values.database.type }}"},{"featureId":"Nginx_Enabled/{{ .Values.nginx.enabled }}"},{"featureId":"ArtifactoryPersistence_Type/{{ .Values.artifactory.persistence.type }}"},{"featureId":"SplitServicesToContainers_Enabled/{{ .Values.splitServicesToContainers }}"},{"featureId":"Filebeat_Enabled/{{ .Values.filebeat.enabled }}"},{"featureId":"ReplicaCount/{{ .Values.artifactory.replicaCount }}"}]}' postgresql: enabled: false waitForDatabase: false @@ -366,3 +366,4 @@ preUpgradeHook: limits: cpu: 1 memory: 1Gi + tolerations: [] From 3dd65a591710a1bf880e35724a7c9d38562c80e4 Mon Sep 17 00:00:00 2001 From: Vinz <27849589+neolutin@users.noreply.github.com> Date: Tue, 8 Oct 2024 16:24:37 +0200 Subject: [PATCH 23/30] [jfrog-platform] Typo to get fourth parameter for setupPostgres.sh (#1922) * Typo to get fourth parameter for setupPostgres.sh Currently the CHART_NAME is either the value of the variable if defined, otherwise '4'. It would be better to be the fourth parameter of the script if not defined. * Bumping version --------- Co-authored-by: Ram Mohan Rao Chukka <1331672+chukka@users.noreply.github.com> --- stable/jfrog-platform/files/setupPostgres.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/stable/jfrog-platform/files/setupPostgres.sh b/stable/jfrog-platform/files/setupPostgres.sh index e766104ce..09af6eaaa 100644 --- a/stable/jfrog-platform/files/setupPostgres.sh +++ b/stable/jfrog-platform/files/setupPostgres.sh @@ -124,4 +124,4 @@ setupDB "${DB_USERNAME}" "${DB_PASSWORD}" "${DB_NAME}" || true log "$POSTGRES_LABEL setup is now complete." -exit 0 \ No newline at end of file +exit 0 From d28ed957ed6ab3f41027a004af54db7d913563c8 Mon Sep 17 00:00:00 2001 From: Mark Arends Date: Mon, 14 Oct 2024 11:35:31 +0200 Subject: [PATCH 24/30] * Fixed - Added podSecurityContext and containerSecurityContext for pre-upgrade-check migration hook container --- stable/jfrog-platform/CHANGELOG.md | 3 +++ stable/jfrog-platform/Chart.yaml | 2 +- stable/jfrog-platform/templates/upgrade-hook.yaml | 6 ++++++ stable/jfrog-platform/values.yaml | 13 +++++++++++++ 4 files changed, 23 insertions(+), 1 deletion(-) diff --git a/stable/jfrog-platform/CHANGELOG.md b/stable/jfrog-platform/CHANGELOG.md index 3abcac574..12cfac1b4 100644 --- a/stable/jfrog-platform/CHANGELOG.md +++ b/stable/jfrog-platform/CHANGELOG.md @@ -1,6 +1,9 @@ # JFrog Platform Chart Changelog (GA releases only) All changes to this chart will be documented in this file. +## [10.19.7] - Oct 14, 2024 +* Fixed - Added podSecurityContext and containerSecurityContext for pre-upgrade-check migration hook container + ## [10.19.6] - Oct 8, 2024 * Fixed typo to get fourth parameter for setupPostgres.sh [GH-1992](https://github.com/jfrog/charts/pull/1992) * Added `preUpgradeHook.tolerations` diff --git a/stable/jfrog-platform/Chart.yaml b/stable/jfrog-platform/Chart.yaml index 15a0b0a5c..0b3c69f6e 100644 --- a/stable/jfrog-platform/Chart.yaml +++ b/stable/jfrog-platform/Chart.yaml @@ -50,4 +50,4 @@ name: jfrog-platform sources: - https://github.com/jfrog/charts type: application -version: 10.19.6 +version: 10.19.7 diff --git a/stable/jfrog-platform/templates/upgrade-hook.yaml b/stable/jfrog-platform/templates/upgrade-hook.yaml index 18873021d..aab5080f2 100644 --- a/stable/jfrog-platform/templates/upgrade-hook.yaml +++ b/stable/jfrog-platform/templates/upgrade-hook.yaml @@ -87,6 +87,9 @@ spec: release: {{ .Release.Name }} spec: serviceAccountName: {{ template "jfrog-platform.fullname" . }} + {{- if .Values.preUpgradeHook.podSecurityContext.enabled }} + securityContext: {{- omit .Values.preUpgradeHook.podSecurityContext "enabled" | toYaml | nindent 8 }} + {{- end }} {{- if .Values.global.imagePullSecrets }} {{- include "jfrog-platform.imagePullSecrets" . | indent 6 }} {{- end }} @@ -94,6 +97,9 @@ spec: - name: pre-upgrade-check image: "{{ tpl .Values.preUpgradeHook.image.registry . }}/{{ .Values.preUpgradeHook.image.repository }}:{{ .Values.preUpgradeHook.image.tag }}" imagePullPolicy: {{ .Values.preUpgradeHook.image.pullPolicy }} + {{- if .Values.preUpgradeHook.containerSecurityContext.enabled }} + securityContext: {{- tpl (omit .Values.preUpgradeHook.containerSecurityContext "enabled" | toYaml) . | nindent 12 }} + {{- end }} resources: {{ toYaml .Values.preUpgradeHook.resources | indent 12 }} command: diff --git a/stable/jfrog-platform/values.yaml b/stable/jfrog-platform/values.yaml index aac6495f6..9896bac01 100644 --- a/stable/jfrog-platform/values.yaml +++ b/stable/jfrog-platform/values.yaml @@ -103,6 +103,10 @@ rabbitmq: image: repository: bitnami/rabbitmq tag: 3.12.10-debian-11-r1 + podSecurityContext: + enabled: false + containerSecurityContext: + enabled: false auth: ## Enable encryption to rabbitmq ## ref: https://www.rabbitmq.com/ssl.html @@ -242,6 +246,11 @@ artifactory: url: '{{ include "database.url" . }}' user: artifactory password: artifactory + ingress: + enabled: false + nginx: + service: + type: "" # Note: For artifactory Pro license, mission-control is not supported, Hence, set mc.enabled: false # Note: mission-control is disabled by default, this is only available for E+ customers, and can be enabled by setting mc.enabled: true mc: @@ -359,6 +368,10 @@ preUpgradeHook: repository: bitnami/kubectl tag: 1.24.12 pullPolicy: IfNotPresent + podSecurityContext: + enabled: false + containerSecurityContext: + enabled: false resources: requests: cpu: 5m From bfcce44b7b9cb1df349bbe04593bd96abd121ad8 Mon Sep 17 00:00:00 2001 From: amithk Date: Wed, 23 Oct 2024 18:25:15 +0530 Subject: [PATCH 25/30] [artifactory] 7.90.15 release --- stable/artifactory-cpp-ce/CHANGELOG.md | 2 +- stable/artifactory-cpp-ce/Chart.yaml | 6 +++--- stable/artifactory-ha/CHANGELOG.md | 2 +- stable/artifactory-ha/Chart.yaml | 6 +++--- stable/artifactory-jcr/CHANGELOG.md | 2 +- stable/artifactory-jcr/Chart.yaml | 6 +++--- stable/artifactory-oss/CHANGELOG.md | 2 +- stable/artifactory-oss/Chart.yaml | 6 +++--- stable/artifactory/CHANGELOG.md | 2 +- stable/artifactory/Chart.yaml | 4 ++-- 10 files changed, 19 insertions(+), 19 deletions(-) diff --git a/stable/artifactory-cpp-ce/CHANGELOG.md b/stable/artifactory-cpp-ce/CHANGELOG.md index 0ee8af051..47a527436 100644 --- a/stable/artifactory-cpp-ce/CHANGELOG.md +++ b/stable/artifactory-cpp-ce/CHANGELOG.md @@ -1,7 +1,7 @@ # JFrog Artifactory CE for C++ Chart Changelog All changes to this chart will be documented in this file -## [107.90.14] - Feb 20, 2024 +## [107.90.15] - Feb 20, 2024 * Updated `artifactory.installerInfo` content ## [107.80.0] - Feb 1, 2024 diff --git a/stable/artifactory-cpp-ce/Chart.yaml b/stable/artifactory-cpp-ce/Chart.yaml index b31b79502..709f8b811 100644 --- a/stable/artifactory-cpp-ce/Chart.yaml +++ b/stable/artifactory-cpp-ce/Chart.yaml @@ -1,9 +1,9 @@ apiVersion: v2 -appVersion: 7.90.14 +appVersion: 7.90.15 dependencies: - name: artifactory repository: file://charts/artifactory - version: 107.90.14 + version: 107.90.15 description: JFrog Artifactory CE for C++ home: https://www.jfrog.com/artifactory/ icon: https://raw.githubusercontent.com/jfrog/charts/master/stable/artifactory-cpp-ce/logo/conan.png @@ -21,4 +21,4 @@ name: artifactory-cpp-ce sources: - https://github.com/jfrog/charts type: application -version: 107.90.14 +version: 107.90.15 diff --git a/stable/artifactory-ha/CHANGELOG.md b/stable/artifactory-ha/CHANGELOG.md index 5edb3eebb..1370bd3ff 100644 --- a/stable/artifactory-ha/CHANGELOG.md +++ b/stable/artifactory-ha/CHANGELOG.md @@ -1,7 +1,7 @@ # JFrog Artifactory-ha Chart Changelog All changes to this chart will be documented in this file. -## [107.90.14] - July 18, 2024 +## [107.90.15] - July 18, 2024 * Fixed #adding colon in image registry which breaks deployment [GH-1892](https://github.com/jfrog/charts/pull/1892) * Added new `nginx.hosts` to use Nginx server_name directive instead of `ingress.hosts` * Added a deprecation notice of ingress.hosts when `ngnix.enabled` is true diff --git a/stable/artifactory-ha/Chart.yaml b/stable/artifactory-ha/Chart.yaml index 11d7e9f51..cf12ad5c6 100644 --- a/stable/artifactory-ha/Chart.yaml +++ b/stable/artifactory-ha/Chart.yaml @@ -1,7 +1,7 @@ annotations: - artifactoryServiceVersion: 7.90.20 + artifactoryServiceVersion: 7.90.21 apiVersion: v2 -appVersion: 7.90.14 +appVersion: 7.90.15 dependencies: - condition: postgresql.enabled name: postgresql @@ -23,4 +23,4 @@ name: artifactory-ha sources: - https://github.com/jfrog/charts type: application -version: 107.90.14 +version: 107.90.15 diff --git a/stable/artifactory-jcr/CHANGELOG.md b/stable/artifactory-jcr/CHANGELOG.md index 3a984d30f..e078ddd06 100644 --- a/stable/artifactory-jcr/CHANGELOG.md +++ b/stable/artifactory-jcr/CHANGELOG.md @@ -1,7 +1,7 @@ # JFrog Container Registry Chart Changelog All changes to this chart will be documented in this file. -## [107.90.14] - Feb 20, 2024 +## [107.90.15] - Feb 20, 2024 * Updated `artifactory.installerInfo` content ## [107.80.0] - Feb 1, 2024 diff --git a/stable/artifactory-jcr/Chart.yaml b/stable/artifactory-jcr/Chart.yaml index 4c389f432..b2db7ce67 100644 --- a/stable/artifactory-jcr/Chart.yaml +++ b/stable/artifactory-jcr/Chart.yaml @@ -1,9 +1,9 @@ apiVersion: v2 -appVersion: 7.90.14 +appVersion: 7.90.15 dependencies: - name: artifactory repository: file://charts/artifactory - version: 107.90.14 + version: 107.90.15 description: JFrog Container Registry home: https://jfrog.com/container-registry/ icon: https://raw.githubusercontent.com/jfrog/charts/master/stable/artifactory-jcr/logo/jcr-logo.png @@ -22,4 +22,4 @@ name: artifactory-jcr sources: - https://github.com/jfrog/charts type: application -version: 107.90.14 +version: 107.90.15 diff --git a/stable/artifactory-oss/CHANGELOG.md b/stable/artifactory-oss/CHANGELOG.md index f79342ced..f89d246e5 100644 --- a/stable/artifactory-oss/CHANGELOG.md +++ b/stable/artifactory-oss/CHANGELOG.md @@ -1,7 +1,7 @@ # JFrog Artifactory OSS Chart Changelog All changes to this chart will be documented in this file -## [107.90.14] - Feb 20, 2024 +## [107.90.15] - Feb 20, 2024 * Updated `artifactory.installerInfo` content ## [107.80.0] - Feb 1, 2024 diff --git a/stable/artifactory-oss/Chart.yaml b/stable/artifactory-oss/Chart.yaml index c91051baf..c81caff01 100644 --- a/stable/artifactory-oss/Chart.yaml +++ b/stable/artifactory-oss/Chart.yaml @@ -1,9 +1,9 @@ apiVersion: v2 -appVersion: 7.90.14 +appVersion: 7.90.15 dependencies: - name: artifactory repository: file://charts/artifactory - version: 107.90.14 + version: 107.90.15 description: JFrog Artifactory OSS home: https://www.jfrog.com/artifactory/ icon: https://raw.githubusercontent.com/jfrog/charts/master/stable/artifactory/logo/artifactory-logo.png @@ -20,4 +20,4 @@ name: artifactory-oss sources: - https://github.com/jfrog/charts type: application -version: 107.90.14 +version: 107.90.15 diff --git a/stable/artifactory/CHANGELOG.md b/stable/artifactory/CHANGELOG.md index 61f0d3d9a..aeba9bc88 100644 --- a/stable/artifactory/CHANGELOG.md +++ b/stable/artifactory/CHANGELOG.md @@ -1,7 +1,7 @@ # JFrog Artifactory Chart Changelog All changes to this chart will be documented in this file. -## [107.90.14] - July 18, 2024 +## [107.90.15] - July 18, 2024 * Fixed #adding colon in image registry which breaks deployment [GH-1892](https://github.com/jfrog/charts/pull/1892) * Added new `nginx.hosts` to use Nginx server_name directive instead of `ingress.hosts` * Added a deprecation notice of ingress.hosts when `ngnix.enabled` is true diff --git a/stable/artifactory/Chart.yaml b/stable/artifactory/Chart.yaml index 58bbbab3f..2d73d0a6e 100644 --- a/stable/artifactory/Chart.yaml +++ b/stable/artifactory/Chart.yaml @@ -1,5 +1,5 @@ apiVersion: v2 -appVersion: 7.90.14 +appVersion: 7.90.15 dependencies: - condition: postgresql.enabled name: postgresql @@ -21,4 +21,4 @@ name: artifactory sources: - https://github.com/jfrog/charts type: application -version: 107.90.14 +version: 107.90.15 From eccc65842ff0766f291edfcaf94ee623ec968cb3 Mon Sep 17 00:00:00 2001 From: amithk Date: Wed, 23 Oct 2024 18:26:20 +0530 Subject: [PATCH 26/30] [xray] 3.104.18 release --- stable/xray/CHANGELOG.md | 2 +- stable/xray/Chart.yaml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/stable/xray/CHANGELOG.md b/stable/xray/CHANGELOG.md index d74830dfa..a35b93863 100644 --- a/stable/xray/CHANGELOG.md +++ b/stable/xray/CHANGELOG.md @@ -1,7 +1,7 @@ # JFrog Xray Chart Changelog All changes to this chart will be documented in this file. -## [103.104.17] - July 17, 2024 +## [103.104.18] - July 17, 2024 * Added support of specifying resources constraints for RabbitMQ's pre-upgrade-hook job * Fixed formatting error associated to the `volumeMounts` for the `panoramic` microservice [GH-1895](https://github.com/jfrog/charts/issues/1895) diff --git a/stable/xray/Chart.yaml b/stable/xray/Chart.yaml index 768bc8198..5c9269029 100644 --- a/stable/xray/Chart.yaml +++ b/stable/xray/Chart.yaml @@ -1,5 +1,5 @@ apiVersion: v2 -appVersion: 3.104.17 +appVersion: 3.104.18 dependencies: - condition: postgresql.enabled name: postgresql @@ -24,4 +24,4 @@ name: xray sources: - https://github.com/jfrog/charts type: application -version: 103.104.17 +version: 103.104.18 From 08ffe0e8f199156b7d4bb1a04d511217831667dd Mon Sep 17 00:00:00 2001 From: amithk Date: Wed, 23 Oct 2024 18:27:36 +0530 Subject: [PATCH 27/30] [jfrog-platform] 10.19.7 release --- stable/jfrog-platform/CHANGELOG.md | 6 ++++-- stable/jfrog-platform/Chart.lock | 8 ++++---- stable/jfrog-platform/Chart.yaml | 6 +++--- stable/jfrog-platform/files/setupPostgres.sh | 2 +- stable/jfrog-platform/values.yaml | 19 +++++-------------- 5 files changed, 17 insertions(+), 24 deletions(-) diff --git a/stable/jfrog-platform/CHANGELOG.md b/stable/jfrog-platform/CHANGELOG.md index 12cfac1b4..851b51353 100644 --- a/stable/jfrog-platform/CHANGELOG.md +++ b/stable/jfrog-platform/CHANGELOG.md @@ -1,8 +1,10 @@ # JFrog Platform Chart Changelog (GA releases only) All changes to this chart will be documented in this file. -## [10.19.7] - Oct 14, 2024 -* Fixed - Added podSecurityContext and containerSecurityContext for pre-upgrade-check migration hook container +## [10.19.7] - Oct 23, 2024 +* Added podSecurityContext and containerSecurityContext for pre-upgrade-check migration hook container. [GH-1929](https://github.com/jfrog/charts/pull/1929) +* Update dependency artifactory chart version to 107.90.15 +* Update dependency xray chart version to 103.104.18 ## [10.19.6] - Oct 8, 2024 * Fixed typo to get fourth parameter for setupPostgres.sh [GH-1992](https://github.com/jfrog/charts/pull/1992) diff --git a/stable/jfrog-platform/Chart.lock b/stable/jfrog-platform/Chart.lock index c4ff85600..a493eeb01 100644 --- a/stable/jfrog-platform/Chart.lock +++ b/stable/jfrog-platform/Chart.lock @@ -7,10 +7,10 @@ dependencies: version: 11.9.3 - name: artifactory repository: https://charts.jfrog.io/ - version: 107.90.14 + version: 107.90.15 - name: xray repository: https://charts.jfrog.io/ - version: 103.104.17 + version: 103.104.18 - name: distribution repository: https://charts.jfrog.io/ version: 102.26.1 @@ -20,5 +20,5 @@ dependencies: - name: pipelines repository: https://charts.jfrog.io/ version: 101.59.7 -digest: sha256:a6071a02ef3029d1aba4ed221e61566dc2a098e2b4c6b85108b839d5fdf5d89a -generated: "2024-10-08T17:20:56.179314+05:30" +digest: sha256:b2d758a515ff07dd7f9778800680a86f7ff5f1c1fcce531eeb0fd53d75847c77 +generated: "2024-10-23T12:31:23.797688+05:30" diff --git a/stable/jfrog-platform/Chart.yaml b/stable/jfrog-platform/Chart.yaml index 0b3c69f6e..a0c3b133f 100644 --- a/stable/jfrog-platform/Chart.yaml +++ b/stable/jfrog-platform/Chart.yaml @@ -1,5 +1,5 @@ apiVersion: v2 -appVersion: 7.90.14 +appVersion: 7.90.15 dependencies: - condition: postgresql.enabled name: postgresql @@ -12,11 +12,11 @@ dependencies: - condition: artifactory.enabled name: artifactory repository: https://charts.jfrog.io/ - version: 107.90.14 + version: 107.90.15 - condition: xray.enabled name: xray repository: https://charts.jfrog.io/ - version: 103.104.17 + version: 103.104.18 - condition: distribution.enabled name: distribution repository: https://charts.jfrog.io/ diff --git a/stable/jfrog-platform/files/setupPostgres.sh b/stable/jfrog-platform/files/setupPostgres.sh index 09af6eaaa..e766104ce 100644 --- a/stable/jfrog-platform/files/setupPostgres.sh +++ b/stable/jfrog-platform/files/setupPostgres.sh @@ -124,4 +124,4 @@ setupDB "${DB_USERNAME}" "${DB_PASSWORD}" "${DB_NAME}" || true log "$POSTGRES_LABEL setup is now complete." -exit 0 +exit 0 \ No newline at end of file diff --git a/stable/jfrog-platform/values.yaml b/stable/jfrog-platform/values.yaml index 9896bac01..0ccabb3e7 100644 --- a/stable/jfrog-platform/values.yaml +++ b/stable/jfrog-platform/values.yaml @@ -103,10 +103,6 @@ rabbitmq: image: repository: bitnami/rabbitmq tag: 3.12.10-debian-11-r1 - podSecurityContext: - enabled: false - containerSecurityContext: - enabled: false auth: ## Enable encryption to rabbitmq ## ref: https://www.rabbitmq.com/ssl.html @@ -236,7 +232,7 @@ rabbitmq: artifactory: enabled: true unifiedUpgradeAllowed: true - installerInfo: '{"productId":"Helm_JFrogPlatform/{{ printf "10.19.6-%s" .Chart.AppVersion }}","features":[{"featureId":"Platform/{{ printf "%s-%s" "kubernetes" .Capabilities.KubeVersion.Version }}"},{"featureId":"Database/{{ .Values.database.type }}"},{"featureId":"Nginx_Enabled/{{ .Values.nginx.enabled }}"},{"featureId":"ArtifactoryPersistence_Type/{{ .Values.artifactory.persistence.type }}"},{"featureId":"SplitServicesToContainers_Enabled/{{ .Values.splitServicesToContainers }}"},{"featureId":"Filebeat_Enabled/{{ .Values.filebeat.enabled }}"},{"featureId":"ReplicaCount/{{ .Values.artifactory.replicaCount }}"}]}' + installerInfo: '{"productId":"Helm_JFrogPlatform/{{ printf "10.19.7-%s" .Chart.AppVersion }}","features":[{"featureId":"Platform/{{ printf "%s-%s" "kubernetes" .Capabilities.KubeVersion.Version }}"},{"featureId":"Database/{{ .Values.database.type }}"},{"featureId":"Nginx_Enabled/{{ .Values.nginx.enabled }}"},{"featureId":"ArtifactoryPersistence_Type/{{ .Values.artifactory.persistence.type }}"},{"featureId":"SplitServicesToContainers_Enabled/{{ .Values.splitServicesToContainers }}"},{"featureId":"Filebeat_Enabled/{{ .Values.filebeat.enabled }}"},{"featureId":"ReplicaCount/{{ .Values.artifactory.replicaCount }}"}]}' postgresql: enabled: false waitForDatabase: false @@ -246,11 +242,6 @@ artifactory: url: '{{ include "database.url" . }}' user: artifactory password: artifactory - ingress: - enabled: false - nginx: - service: - type: "" # Note: For artifactory Pro license, mission-control is not supported, Hence, set mc.enabled: false # Note: mission-control is disabled by default, this is only available for E+ customers, and can be enabled by setting mc.enabled: true mc: @@ -368,10 +359,6 @@ preUpgradeHook: repository: bitnami/kubectl tag: 1.24.12 pullPolicy: IfNotPresent - podSecurityContext: - enabled: false - containerSecurityContext: - enabled: false resources: requests: cpu: 5m @@ -380,3 +367,7 @@ preUpgradeHook: cpu: 1 memory: 1Gi tolerations: [] + podSecurityContext: + enabled: false + containerSecurityContext: + enabled: false From 5587603c8c92bd10a677a296a7cc5b78c93f0717 Mon Sep 17 00:00:00 2001 From: justin-six <57092032+justin-six@users.noreply.github.com> Date: Thu, 11 Apr 2024 16:08:17 +0200 Subject: [PATCH 28/30] Update distribution-svc.yaml Align with Xray svc options. This is required for hybrid deployments. We are a Enterprise Plus customer. --- stable/distribution/templates/distribution-svc.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/stable/distribution/templates/distribution-svc.yaml b/stable/distribution/templates/distribution-svc.yaml index 407aafb49..8b847cc3a 100644 --- a/stable/distribution/templates/distribution-svc.yaml +++ b/stable/distribution/templates/distribution-svc.yaml @@ -27,6 +27,9 @@ spec: - name: http-distro port: {{ .Values.distribution.externalPort }} targetPort: http-distro + - name: http-router + port: {{ .Values.router.externalPort }} + targetPort: http-router selector: app: {{ template "distribution.name" . }} release: {{ .Release.Name }} From 058ac629bc9c31cd8475ae27f2f6a18ae1ae7058 Mon Sep 17 00:00:00 2001 From: Rick Stokkingreef Date: Wed, 30 Oct 2024 08:57:25 +0100 Subject: [PATCH 29/30] [artifactory-ha] Add option to set Environment Variables option to filebeat sidecar (#1377) --- stable/artifactory-ha/CHANGELOG.md | 1 + .../templates/artifactory-node-statefulset.yaml | 4 ++++ .../templates/artifactory-primary-statefulset.yaml | 4 ++++ stable/artifactory-ha/values.yaml | 1 + 4 files changed, 10 insertions(+) diff --git a/stable/artifactory-ha/CHANGELOG.md b/stable/artifactory-ha/CHANGELOG.md index 1370bd3ff..6804030dc 100644 --- a/stable/artifactory-ha/CHANGELOG.md +++ b/stable/artifactory-ha/CHANGELOG.md @@ -17,6 +17,7 @@ All changes to this chart will be documented in this file. `access.extraEnvironmentVariables` * Updating the example link for downloading the DB driver * Added Binary Provider recommendations +* Add support for EnvironmentVaraiables on Filebeat Sidecar ## [107.89.0] - May 30, 2024 * Fix the indentation of the commented-out sections in the values.yaml file diff --git a/stable/artifactory-ha/templates/artifactory-node-statefulset.yaml b/stable/artifactory-ha/templates/artifactory-node-statefulset.yaml index 9a5d4fd84..1b0973110 100644 --- a/stable/artifactory-ha/templates/artifactory-node-statefulset.yaml +++ b/stable/artifactory-ha/templates/artifactory-node-statefulset.yaml @@ -1357,6 +1357,10 @@ spec: subPath: filebeat.yml - name: volume mountPath: "{{ .Values.artifactory.persistence.mountPath }}" + env: +{{- with .Values.filebeat.EnvironmentVariables }} +{{ tpl (toYaml .) $ | indent 10 }} +{{- end }} livenessProbe: {{ toYaml .Values.filebeat.livenessProbe | indent 10 }} readinessProbe: diff --git a/stable/artifactory-ha/templates/artifactory-primary-statefulset.yaml b/stable/artifactory-ha/templates/artifactory-primary-statefulset.yaml index 0e9bb6400..e629724fe 100644 --- a/stable/artifactory-ha/templates/artifactory-primary-statefulset.yaml +++ b/stable/artifactory-ha/templates/artifactory-primary-statefulset.yaml @@ -1468,6 +1468,10 @@ spec: subPath: filebeat.yml - name: volume mountPath: "{{ .Values.artifactory.persistence.mountPath }}" + env: +{{- with .Values.filebeat.EnvironmentVariables }} +{{ tpl (toYaml .) $ | indent 10 }} +{{- end }} livenessProbe: {{ toYaml .Values.filebeat.livenessProbe | indent 10 }} readinessProbe: diff --git a/stable/artifactory-ha/values.yaml b/stable/artifactory-ha/values.yaml index 3d1a325af..47f6de4e8 100644 --- a/stable/artifactory-ha/values.yaml +++ b/stable/artifactory-ha/values.yaml @@ -1783,6 +1783,7 @@ filebeat: initialDelaySeconds: 10 periodSeconds: 10 timeoutSeconds: 5 + EnvironmentVariables: {} resources: {} # requests: # memory: "100Mi" From 8d677423fa11fb7179ec16a6944f6e9e20fa22c4 Mon Sep 17 00:00:00 2001 From: Mike DuRussel Date: Wed, 30 Oct 2024 04:00:20 -0400 Subject: [PATCH 30/30] [artifactory] Add the ability to set `signedUrlExpirySeconds` to google providers (#1858) --- stable/artifactory/CHANGELOG.md | 1 + stable/artifactory/files/binarystore.xml | 3 +++ 2 files changed, 4 insertions(+) diff --git a/stable/artifactory/CHANGELOG.md b/stable/artifactory/CHANGELOG.md index aeba9bc88..cb4d78123 100644 --- a/stable/artifactory/CHANGELOG.md +++ b/stable/artifactory/CHANGELOG.md @@ -17,6 +17,7 @@ All changes to this chart will be documented in this file. `access.extraEnvironmentVariables` * Updating the example link for downloading the DB driver * Added Binary Provider recommendations +* Added `signedUrlExpirySeconds` option to artifactory.persistence.type of `google-storage`, `google-storage-v2`, and `google-storage-v2-direct` ## [107.89.0] - June 7, 2024 * Fix the indentation of the commented-out sections in the values.yaml file diff --git a/stable/artifactory/files/binarystore.xml b/stable/artifactory/files/binarystore.xml index e396e0a41..543f8d542 100644 --- a/stable/artifactory/files/binarystore.xml +++ b/stable/artifactory/files/binarystore.xml @@ -179,6 +179,9 @@ {{ .Values.artifactory.persistence.googleStorage.bucketName }} {{ .Values.artifactory.persistence.googleStorage.path }} {{ .Values.artifactory.persistence.googleStorage.bucketExists }} + {{- if .Values.artifactory.persistence.googleStorage.signedUrlExpirySeconds }} + {{ .Values.artifactory.persistence.googleStorage.signedUrlExpirySeconds }} + {{- end }} {{- end }}