From 51073a0c21cb9c48c8b697a3d3f378530553ed40 Mon Sep 17 00:00:00 2001
From: Kalyanasundaram Somasundaram <ksomasun@ksomasun-mn1.linkedin.biz>
Date: Thu, 3 Dec 2020 11:57:27 +0550
Subject: [PATCH] Deployed 9d7218b with MkDocs version: 1.1.2

---
 databases_nosql/key_concepts/index.html       |   4 +-
 .../linux_server_administration/index.html    |   4 +-
 search/search_index.json                      |   2 +-
 security/network_security/index.html          |   6 +-
 security/threats_attacks_defences/index.html  |   4 +-
 sitemap.xml                                   |  92 +++++++++---------
 sitemap.xml.gz                                | Bin 217 -> 217 bytes
 systems_design/images/availability.jpg        | Bin 48556 -> 123625 bytes
 systems_design/images/cdn.jpg                 | Bin 33651 -> 76662 bytes
 systems_design/images/horizontal-scaling.jpg  | Bin 28643 -> 52792 bytes
 systems_design/images/microservices.jpg       | Bin 40884 -> 107515 bytes
 systems_design/images/sharding-1.jpg          | Bin 46583 -> 94944 bytes
 systems_design/scalability/index.html         |   6 +-
 13 files changed, 59 insertions(+), 59 deletions(-)

diff --git a/databases_nosql/key_concepts/index.html b/databases_nosql/key_concepts/index.html
index acbf90b..5cfe009 100644
--- a/databases_nosql/key_concepts/index.html
+++ b/databases_nosql/key_concepts/index.html
@@ -1164,11 +1164,11 @@
 <ul>
 <li>
 <p><strong>Read Your Own Writes Consistency</strong></p>
-<p>A client will see his updates immediately after they are written. The reads can hit nodes other than the one where it was written. However he might not see updates by other clients immediately. </p>
+<p>Clients will see their updates immediately after they are written. The reads can hit nodes other than the one where it was written. However they might not see updates by other clients immediately.</p>
 </li>
 <li>
 <p><strong>Session Consistency</strong></p>
-<p>A client will see the updates to his data within a session scope. This generally indicates that reads &amp; writes occur on the same server. Other clients using the same nodes will receive the same updates. </p>
+<p>Clients will see the updates to their data within a session scope. This generally indicates that reads &amp; writes occur on the same server. Other clients using the same nodes will receive the same updates.</p>
 </li>
 <li>
 <p><strong>Casual Consistency</strong></p>
diff --git a/linux_basics/linux_server_administration/index.html b/linux_basics/linux_server_administration/index.html
index aaedd03..511bf50 100644
--- a/linux_basics/linux_server_administration/index.html
+++ b/linux_basics/linux_server_administration/index.html
@@ -1642,10 +1642,10 @@ commands on your own.</p>
 <h2 id="usergroup-management">User/Group Management</h2>
 <ul>
 <li>
-<p>Each user in Linux has an associated user ID called UID attached to him</p>
+<p>Users in Linux has an associated user ID called UID attached to them.</p>
 </li>
 <li>
-<p>Each user also has a home directory and a login shell associated with him/her</p>
+<p>Users also has a home directory and a login shell associated with them.</p>
 </li>
 <li>
 <p>A group is a collection of one or more users. A group makes it easier to share permissions among a group of users.</p>
diff --git a/search/search_index.json b/search/search_index.json
index 46bc5d4..e57d0b5 100644
--- a/search/search_index.json
+++ b/search/search_index.json
@@ -1 +1 @@
-{"config":{"lang":["en"],"min_search_length":3,"prebuild_index":false,"separator":"[\\s\\-]+"},"docs":[{"location":"","text":"School of SRE In early 2019, we started visiting campuses across India to recruit the best and brightest minds to ensure LinkedIn, and all the services that make up its complex technology stack, is always available for everyone. This critical function at Linkedin falls under the purview of the Site Engineering team and Site Reliability Engineers (SREs) who are Software Engineers specializing in reliability. SREs apply the principles of computer science and engineering to the design, development and operation of computer systems: generally, large scale, distributed ones As we continued on this journey we started getting a lot of questions from these campuses on what exactly the site reliability engineering role entails? And, how could someone learn the skills and the disciplines involved to become a successful site reliability engineer? Fast forward a few months, and a few of these campus students had joined LinkedIn either as interns or as full-time engineers to become a part of the Site Engineering team; we also had a few lateral hires who joined our organization who were not from a traditional SRE background. That's when a few of us got together and started to think about how we can onboard new graduate engineers to the Site Engineering team. There is a vast amount of resources scattered throughout the web on what the roles and responsibilities of SREs are, how to monitor site health, production incidents, define SLO/SLI etc. But there are very few resources out there guiding someone on the basic skill sets one has to acquire as a beginner. Because of the lack of these resources, we felt that individuals have a tough time getting into open positions in the industry. We created the School Of SRE as a starting point for anyone wanting to build their career as an SRE. In this course, we are focusing on building strong foundational skills. The course is structured in a way to provide more real life examples and how learning each of these topics can play an important role in day to day SRE life. Currently we are covering the following topics under the School Of SRE: Fundamentals Series Linux Basics Git Linux Networking Python and Web Data Relational databases(MySQL) NoSQL concepts Big Data Systems Design Security We believe continuous learning will help in acquiring deeper knowledge and competencies in order to expand your skill sets, every module has added references which could be a guide for further learning. Our hope is that by going through these modules we should be able to build the essential skills required for a Site Reliability Engineer. At Linkedin, we are using this curriculum for onboarding our non-traditional hires and new college grads into the SRE role. We had multiple rounds of successful onboarding experience with new employees and the course helped them be productive in a very short period of time. This motivated us to open source the content for helping other organizations in onboarding new engineers into the role and provide guidance for aspiring individuals to get into the role. We realize that the initial content we created is just a starting point and we hope that the community can help in the journey of refining and expanding the content.","title":"Home"},{"location":"#school-of-sre","text":"In early 2019, we started visiting campuses across India to recruit the best and brightest minds to ensure LinkedIn, and all the services that make up its complex technology stack, is always available for everyone. This critical function at Linkedin falls under the purview of the Site Engineering team and Site Reliability Engineers (SREs) who are Software Engineers specializing in reliability. SREs apply the principles of computer science and engineering to the design, development and operation of computer systems: generally, large scale, distributed ones As we continued on this journey we started getting a lot of questions from these campuses on what exactly the site reliability engineering role entails? And, how could someone learn the skills and the disciplines involved to become a successful site reliability engineer? Fast forward a few months, and a few of these campus students had joined LinkedIn either as interns or as full-time engineers to become a part of the Site Engineering team; we also had a few lateral hires who joined our organization who were not from a traditional SRE background. That's when a few of us got together and started to think about how we can onboard new graduate engineers to the Site Engineering team. There is a vast amount of resources scattered throughout the web on what the roles and responsibilities of SREs are, how to monitor site health, production incidents, define SLO/SLI etc. But there are very few resources out there guiding someone on the basic skill sets one has to acquire as a beginner. Because of the lack of these resources, we felt that individuals have a tough time getting into open positions in the industry. We created the School Of SRE as a starting point for anyone wanting to build their career as an SRE. In this course, we are focusing on building strong foundational skills. The course is structured in a way to provide more real life examples and how learning each of these topics can play an important role in day to day SRE life. Currently we are covering the following topics under the School Of SRE: Fundamentals Series Linux Basics Git Linux Networking Python and Web Data Relational databases(MySQL) NoSQL concepts Big Data Systems Design Security We believe continuous learning will help in acquiring deeper knowledge and competencies in order to expand your skill sets, every module has added references which could be a guide for further learning. Our hope is that by going through these modules we should be able to build the essential skills required for a Site Reliability Engineer. At Linkedin, we are using this curriculum for onboarding our non-traditional hires and new college grads into the SRE role. We had multiple rounds of successful onboarding experience with new employees and the course helped them be productive in a very short period of time. This motivated us to open source the content for helping other organizations in onboarding new engineers into the role and provide guidance for aspiring individuals to get into the role. We realize that the initial content we created is just a starting point and we hope that the community can help in the journey of refining and expanding the content.","title":"School of SRE"},{"location":"CONTRIBUTING/","text":"We realise that the initial content we created is just a starting point and our hope is that the community can help in the journey refining and extending the contents. As a contributor, you represent that the content you submit is not plagiarised. By submitting the content, you (and, if applicable, your employer) are licensing the submitted content to LinkedIn and the open source community subject to the BSD 2-Clause license. We suggest to open an issue first and seek advice for your changes before submitting a pull request. Repository URL : https://github.com/linkedin/school-of-sre Building and testing locally Run the following commands to build and view the site locally before opening a PR. pip install -r requirements.txt mkdocs build mkdocs serve","title":"Contribute"},{"location":"CONTRIBUTING/#building-and-testing-locally","text":"Run the following commands to build and view the site locally before opening a PR. pip install -r requirements.txt mkdocs build mkdocs serve","title":"Building and testing locally"},{"location":"big_data/evolution/","text":"Evolution of Hadoop Architecture of Hadoop HDFS The Hadoop Distributed File System (HDFS) is a distributed file system designed to run on commodity hardware. It has many similarities with existing distributed file systems. However, the differences from other distributed file systems are significant. HDFS is highly fault-tolerant and is designed to be deployed on low-cost hardware. HDFS provides high throughput access to application data and is suitable for applications that have large data sets. HDFS is part of the Apache Hadoop Core project . NameNode: is the arbitrator and central repository of file namespace in the cluster. The NameNode executes the operations such as opening, closing, and renaming files and directories. DataNode: manages the storage attached to the node on which it runs. It is responsible for serving all the read and writes requests. It performs operations on instructions on NameNode such as creation, deletion, and replications of blocks. Client: Responsible for getting the required metadata from the namenode and then communicating with the datanodes for reads and writes. YARN YARN stands for \u201cYet Another Resource Negotiator\u201c. It was introduced in Hadoop 2.0 to remove the bottleneck on Job Tracker which was present in Hadoop 1.0. YARN was described as a \u201cRedesigned Resource Manager\u201d at the time of its launching, but it has now evolved to be known as a large-scale distributed operating system used for Big Data processing. The main components of YARN architecture include: Client: It submits map-reduce(MR) jobs to the resource manager. Resource Manager: It is the master daemon of YARN and is responsible for resource assignment and management among all the applications. Whenever it receives a processing request, it forwards it to the corresponding node manager and allocates resources for the completion of the request accordingly. It has two major components: Scheduler: It performs scheduling based on the allocated application and available resources. It is a pure scheduler, which means that it does not perform other tasks such as monitoring or tracking and does not guarantee a restart if a task fails. The YARN scheduler supports plugins such as Capacity Scheduler and Fair Scheduler to partition the cluster resources. Application manager: It is responsible for accepting the application and negotiating the first container from the resource manager. It also restarts the Application Manager container if a task fails. Node Manager: It takes care of individual nodes on the Hadoop cluster and manages application and workflow and that particular node. Its primary job is to keep up with the Node Manager. It monitors resource usage, performs log management, and also kills a container based on directions from the resource manager. It is also responsible for creating the container process and starting it at the request of the Application master. Application Master: An application is a single job submitted to a framework. The application manager is responsible for negotiating resources with the resource manager, tracking the status, and monitoring the progress of a single application. The application master requests the container from the node manager by sending a Container Launch Context(CLC) which includes everything an application needs to run. Once the application is started, it sends the health report to the resource manager from time-to-time. Container: It is a collection of physical resources such as RAM, CPU cores, and disk on a single node. The containers are invoked by Container Launch Context(CLC) which is a record that contains information such as environment variables, security tokens, dependencies, etc. MapReduce framework The term MapReduce represents two separate and distinct tasks Hadoop programs perform-Map Job and Reduce Job. Map jobs take data sets as input and process them to produce key-value pairs. Reduce job takes the output of the Map job i.e. the key-value pairs and aggregates them to produce desired results. Hadoop MapReduce (Hadoop Map/Reduce) is a software framework for distributed processing of large data sets on computing clusters. Mapreduce helps to split the input data set into a number of parts and run a program on all data parts parallel at once. Please find the below Word count example demonstrating the usage of the MapReduce framework: Other tooling around Hadoop Hive Uses a language called HQL which is very SQL like. Gives non-programmers the ability to query and analyze data in Hadoop. Is basically an abstraction layer on top of map-reduce. Ex. HQL query: SELECT pet.name, comment FROM pet JOIN event ON (pet.name = event.name); In mysql: SELECT pet.name, comment FROM pet, event WHERE pet.name = event.name; Pig Uses a scripting language called Pig Latin, which is more workflow driven. Don't need to be an expert Java programmer but need a few coding skills. Is also an abstraction layer on top of map-reduce. Here is a quick question for you: What is the output of running the pig queries in the right column against the data present in the left column in the below image? Output: mysql 7,Komal,Nayak,24,9848022334,trivendram 8,Bharathi,Nambiayar,24,9848022333,Chennai 5,Trupthi,Mohanthy,23,9848022336,Bhuwaneshwar 6,Archana,Mishra,23,9848022335,Chennai 3. Spark 1. Spark provides primitives for in-memory cluster computing that allows user programs to load data into a cluster\u2019s memory and query it repeatedly, making it well suited to machine learning algorithms. 4. Presto 1. Presto is a high performance, distributed SQL query engine for Big Data. 2. Its architecture allows users to query a variety of data sources such as Hadoop, AWS S3, Alluxio, MySQL, Cassandra, Kafka, and MongoDB. 3. Example presto query: mysql use studentDB; show tables; SELECT roll_no, name FROM studentDB.studentDetails where section=\u2019A\u2019 limit 5; Data Serialisation and storage In order to transport the data over the network or to store on some persistent storage, we use the process of translating data structures or objects state into binary or textual form. We call this process serialization.. Avro data is stored in a container file (a .avro file) and its schema (the .avsc file) is stored with the data file. Apache Hive provides support to store a table as Avro and can also query data in this serialisation format.","title":"Evolution and Architecture of Hadoop"},{"location":"big_data/evolution/#evolution-of-hadoop","text":"","title":"Evolution of Hadoop"},{"location":"big_data/evolution/#architecture-of-hadoop","text":"HDFS The Hadoop Distributed File System (HDFS) is a distributed file system designed to run on commodity hardware. It has many similarities with existing distributed file systems. However, the differences from other distributed file systems are significant. HDFS is highly fault-tolerant and is designed to be deployed on low-cost hardware. HDFS provides high throughput access to application data and is suitable for applications that have large data sets. HDFS is part of the Apache Hadoop Core project . NameNode: is the arbitrator and central repository of file namespace in the cluster. The NameNode executes the operations such as opening, closing, and renaming files and directories. DataNode: manages the storage attached to the node on which it runs. It is responsible for serving all the read and writes requests. It performs operations on instructions on NameNode such as creation, deletion, and replications of blocks. Client: Responsible for getting the required metadata from the namenode and then communicating with the datanodes for reads and writes. YARN YARN stands for \u201cYet Another Resource Negotiator\u201c. It was introduced in Hadoop 2.0 to remove the bottleneck on Job Tracker which was present in Hadoop 1.0. YARN was described as a \u201cRedesigned Resource Manager\u201d at the time of its launching, but it has now evolved to be known as a large-scale distributed operating system used for Big Data processing. The main components of YARN architecture include: Client: It submits map-reduce(MR) jobs to the resource manager. Resource Manager: It is the master daemon of YARN and is responsible for resource assignment and management among all the applications. Whenever it receives a processing request, it forwards it to the corresponding node manager and allocates resources for the completion of the request accordingly. It has two major components: Scheduler: It performs scheduling based on the allocated application and available resources. It is a pure scheduler, which means that it does not perform other tasks such as monitoring or tracking and does not guarantee a restart if a task fails. The YARN scheduler supports plugins such as Capacity Scheduler and Fair Scheduler to partition the cluster resources. Application manager: It is responsible for accepting the application and negotiating the first container from the resource manager. It also restarts the Application Manager container if a task fails. Node Manager: It takes care of individual nodes on the Hadoop cluster and manages application and workflow and that particular node. Its primary job is to keep up with the Node Manager. It monitors resource usage, performs log management, and also kills a container based on directions from the resource manager. It is also responsible for creating the container process and starting it at the request of the Application master. Application Master: An application is a single job submitted to a framework. The application manager is responsible for negotiating resources with the resource manager, tracking the status, and monitoring the progress of a single application. The application master requests the container from the node manager by sending a Container Launch Context(CLC) which includes everything an application needs to run. Once the application is started, it sends the health report to the resource manager from time-to-time. Container: It is a collection of physical resources such as RAM, CPU cores, and disk on a single node. The containers are invoked by Container Launch Context(CLC) which is a record that contains information such as environment variables, security tokens, dependencies, etc.","title":"Architecture of Hadoop"},{"location":"big_data/evolution/#mapreduce-framework","text":"The term MapReduce represents two separate and distinct tasks Hadoop programs perform-Map Job and Reduce Job. Map jobs take data sets as input and process them to produce key-value pairs. Reduce job takes the output of the Map job i.e. the key-value pairs and aggregates them to produce desired results. Hadoop MapReduce (Hadoop Map/Reduce) is a software framework for distributed processing of large data sets on computing clusters. Mapreduce helps to split the input data set into a number of parts and run a program on all data parts parallel at once. Please find the below Word count example demonstrating the usage of the MapReduce framework:","title":"MapReduce framework"},{"location":"big_data/evolution/#other-tooling-around-hadoop","text":"Hive Uses a language called HQL which is very SQL like. Gives non-programmers the ability to query and analyze data in Hadoop. Is basically an abstraction layer on top of map-reduce. Ex. HQL query: SELECT pet.name, comment FROM pet JOIN event ON (pet.name = event.name); In mysql: SELECT pet.name, comment FROM pet, event WHERE pet.name = event.name; Pig Uses a scripting language called Pig Latin, which is more workflow driven. Don't need to be an expert Java programmer but need a few coding skills. Is also an abstraction layer on top of map-reduce. Here is a quick question for you: What is the output of running the pig queries in the right column against the data present in the left column in the below image? Output: mysql 7,Komal,Nayak,24,9848022334,trivendram 8,Bharathi,Nambiayar,24,9848022333,Chennai 5,Trupthi,Mohanthy,23,9848022336,Bhuwaneshwar 6,Archana,Mishra,23,9848022335,Chennai 3. Spark 1. Spark provides primitives for in-memory cluster computing that allows user programs to load data into a cluster\u2019s memory and query it repeatedly, making it well suited to machine learning algorithms. 4. Presto 1. Presto is a high performance, distributed SQL query engine for Big Data. 2. Its architecture allows users to query a variety of data sources such as Hadoop, AWS S3, Alluxio, MySQL, Cassandra, Kafka, and MongoDB. 3. Example presto query: mysql use studentDB; show tables; SELECT roll_no, name FROM studentDB.studentDetails where section=\u2019A\u2019 limit 5;","title":"Other tooling around Hadoop"},{"location":"big_data/evolution/#data-serialisation-and-storage","text":"In order to transport the data over the network or to store on some persistent storage, we use the process of translating data structures or objects state into binary or textual form. We call this process serialization.. Avro data is stored in a container file (a .avro file) and its schema (the .avsc file) is stored with the data file. Apache Hive provides support to store a table as Avro and can also query data in this serialisation format.","title":"Data Serialisation and storage"},{"location":"big_data/intro/","text":"Big Data Prerequisites Basics of Linux File systems. Basic understanding of System Design. What to expect from this course This course covers the basics of Big Data and how it has evolved to become what it is today. We will take a look at a few realistic scenarios where Big Data would be a perfect fit. An interesting assignment on designing a Big Data system is followed by understanding the architecture of Hadoop and the tooling around it. What is not covered under this course Writing programs to draw analytics from data. Course Contents Overview of Big Data Usage of Big Data techniques Evolution of Hadoop Architecture of hadoop HDFS Yarn MapReduce framework Other tooling around hadoop Hive Pig Spark Presto Data Serialisation and storage Overview of Big Data Big Data is a collection of large datasets that cannot be processed using traditional computing techniques. It is not a single technique or a tool, rather it has become a complete subject, which involves various tools, techniques, and frameworks. Big Data could consist of Structured data Unstructured data Semi-structured data Characteristics of Big Data: Volume Variety Velocity Variability Examples of Big Data generation include stock exchanges, social media sites, jet engines, etc. Usage of Big Data Techniques Take the example of the traffic lights problem. There are more than 300,000 traffic lights in the US as of 2018. Let us assume that we placed a device on each of them to collect metrics and send it to a central metrics collection system. If each of the IoT devices sends 10 events per minute, we have 300000x10x60x24 = 432x10^7 events per day. How would you go about processing that and telling me how many of the signals were \u201cgreen\u201d at 10:45 am on a particular day? Consider the next example on Unified Payments Interface (UPI) transactions: We had about 1.15 billion UPI transactions in the month of October 2019 in India. If we try to extrapolate this data to about a year and try to find out some common payments that were happening through a particular UPI ID, how do you suggest we go about that?","title":"Introduction"},{"location":"big_data/intro/#big-data","text":"","title":"Big Data"},{"location":"big_data/intro/#prerequisites","text":"Basics of Linux File systems. Basic understanding of System Design.","title":"Prerequisites"},{"location":"big_data/intro/#what-to-expect-from-this-course","text":"This course covers the basics of Big Data and how it has evolved to become what it is today. We will take a look at a few realistic scenarios where Big Data would be a perfect fit. An interesting assignment on designing a Big Data system is followed by understanding the architecture of Hadoop and the tooling around it.","title":"What to expect from this course"},{"location":"big_data/intro/#what-is-not-covered-under-this-course","text":"Writing programs to draw analytics from data.","title":"What is not covered under this course"},{"location":"big_data/intro/#course-contents","text":"Overview of Big Data Usage of Big Data techniques Evolution of Hadoop Architecture of hadoop HDFS Yarn MapReduce framework Other tooling around hadoop Hive Pig Spark Presto Data Serialisation and storage","title":"Course Contents"},{"location":"big_data/intro/#overview-of-big-data","text":"Big Data is a collection of large datasets that cannot be processed using traditional computing techniques. It is not a single technique or a tool, rather it has become a complete subject, which involves various tools, techniques, and frameworks. Big Data could consist of Structured data Unstructured data Semi-structured data Characteristics of Big Data: Volume Variety Velocity Variability Examples of Big Data generation include stock exchanges, social media sites, jet engines, etc.","title":"Overview of Big Data"},{"location":"big_data/intro/#usage-of-big-data-techniques","text":"Take the example of the traffic lights problem. There are more than 300,000 traffic lights in the US as of 2018. Let us assume that we placed a device on each of them to collect metrics and send it to a central metrics collection system. If each of the IoT devices sends 10 events per minute, we have 300000x10x60x24 = 432x10^7 events per day. How would you go about processing that and telling me how many of the signals were \u201cgreen\u201d at 10:45 am on a particular day? Consider the next example on Unified Payments Interface (UPI) transactions: We had about 1.15 billion UPI transactions in the month of October 2019 in India. If we try to extrapolate this data to about a year and try to find out some common payments that were happening through a particular UPI ID, how do you suggest we go about that?","title":"Usage of Big Data Techniques"},{"location":"big_data/tasks/","text":"Tasks and conclusion Post-training tasks: Try setting up your own 3 node Hadoop cluster. A VM based solution can be found here Write a simple spark/MR job of your choice and understand how to generate analytics from data. Sample dataset can be found here References: Hadoop documentation HDFS Architecture YARN Architecture Google GFS paper","title":"Conclusion"},{"location":"big_data/tasks/#tasks-and-conclusion","text":"","title":"Tasks and conclusion"},{"location":"big_data/tasks/#post-training-tasks","text":"Try setting up your own 3 node Hadoop cluster. A VM based solution can be found here Write a simple spark/MR job of your choice and understand how to generate analytics from data. Sample dataset can be found here","title":"Post-training tasks:"},{"location":"big_data/tasks/#references","text":"Hadoop documentation HDFS Architecture YARN Architecture Google GFS paper","title":"References:"},{"location":"databases_nosql/further_reading/","text":"Conclusion We have covered basic concepts of NoSQL databases. There is much more to learn and do. We hope this course gives you a good start and inspires you to explore further. Further reading NoSQL: https://hostingdata.co.uk/nosql-database/ https://www.mongodb.com/nosql-explained https://www.mongodb.com/nosql-explained/nosql-vs-sql Cap Theorem http://www.julianbrowne.com/article/brewers-cap-theorem Scalability http://www.slideshare.net/jboner/scalability-availability-stability-patterns Eventual Consistency https://www.allthingsdistributed.com/2008/12/eventually_consistent.html https://www.toptal.com/big-data/consistent-hashing https://web.stanford.edu/class/cs244/papers/chord_TON_2003.pdf","title":"Conclusion"},{"location":"databases_nosql/further_reading/#conclusion","text":"We have covered basic concepts of NoSQL databases. There is much more to learn and do. We hope this course gives you a good start and inspires you to explore further.","title":"Conclusion"},{"location":"databases_nosql/further_reading/#further-reading","text":"NoSQL: https://hostingdata.co.uk/nosql-database/ https://www.mongodb.com/nosql-explained https://www.mongodb.com/nosql-explained/nosql-vs-sql Cap Theorem http://www.julianbrowne.com/article/brewers-cap-theorem Scalability http://www.slideshare.net/jboner/scalability-availability-stability-patterns Eventual Consistency https://www.allthingsdistributed.com/2008/12/eventually_consistent.html https://www.toptal.com/big-data/consistent-hashing https://web.stanford.edu/class/cs244/papers/chord_TON_2003.pdf","title":"Further reading"},{"location":"databases_nosql/intro/","text":"NoSQL Concepts Prerequisites Relational Databases What to expect from this course At the end of training, you will have an understanding of what a NoSQL database is, what kind of advantages or disadvantages it has over traditional RDBMS, learn about different types of NoSQL databases and understand some of the underlying concepts & trade offs w.r.t to NoSQL. What is not covered under this course We will not be deep diving into any specific NoSQL Database. Course Contents Introduction to NoSQL CAP Theorem Data versioning Partitioning Hashing Quorum Introduction When people use the term \u201cNoSQL database\u201d, they typically use it to refer to any non-relational database. Some say the term \u201cNoSQL\u201d stands for \u201cnon SQL\u201d while others say it stands for \u201cnot only SQL.\u201d Either way, most agree that NoSQL databases are databases that store data in a format other than relational tables. A common misconception is that NoSQL databases or non-relational databases don\u2019t store relationship data well. NoSQL databases can store relationship data\u2014they just store it differently than relational databases do. In fact, when compared with SQL databases, many find modeling relationship data in NoSQL databases to be easier , because related data doesn\u2019t have to be split between tables. Such databases have existed since the late 1960s, but the name \"NoSQL\" was only coined in the early 21st century. NASA used a NoSQL database to track inventory for the Apollo mission. NoSQL databases emerged in the late 2000s as the cost of storage dramatically decreased. Gone were the days of needing to create a complex, difficult-to-manage data model simply for the purposes of reducing data duplication. Developers (rather than storage) were becoming the primary cost of software development, so NoSQL databases optimized for developer productivity. With the rise of Agile development methodology, NoSQL databases were developed with a focus on scaling, fast performance and at the same time allowed for frequent application changes and made programming easier. Types of NoSQL databases: Over time due to the way these NoSQL databases were developed to suit requirements at different companies, we ended up with quite a few types of them. However, they can be broadly classified into 4 types. Some of the databases can overlap between different types. They are Document databases: They store data in documents similar to JSON (JavaScript Object Notation) objects. Each document contains pairs of fields and values. The values can typically be a variety of types including things like strings, numbers, booleans, arrays, or objects, and their structures typically align with objects developers are working with in code. The advantages include intuitive data model & flexible schemas. Because of their variety of field value types and powerful query languages, document databases are great for a wide variety of use cases and can be used as a general purpose database. They can horizontally scale-out to accomodate large data volumes. Ex: MongoDB, Couchbase Key-Value databases: These are a simpler type of databases where each item contains keys and values. A value can typically only be retrieved by referencing its value, so learning how to query for a specific key-value pair is typically simple. Key-value databases are great for use cases where you need to store large amounts of data but you don\u2019t need to perform complex queries to retrieve it. Common use cases include storing user preferences or caching. Ex: Redis , DynamoDB , Voldemort / Venice (Linkedin), Wide-Column stores: They store data in tables, rows, and dynamic columns. Wide-column stores provide a lot of flexibility over relational databases because each row is not required to have the same columns. Many consider wide-column stores to be two-dimensional key-value databases. Wide-column stores are great for when you need to store large amounts of data and you can predict what your query patterns will be. Wide-column stores are commonly used for storing Internet of Things data and user profile data. Cassandra and HBase are two of the most popular wide-column stores. Graph Databases: These databases store data in nodes and edges. Nodes typically store information about people, places, and things while edges store information about the relationships between the nodes. The underlying storage mechanism of graph databases can vary. Some depend on a relational engine and \u201cstore\u201d the graph data in a table (although a table is a logical element, therefore this approach imposes another level of abstraction between the graph database, the graph database management system and the physical devices where the data is actually stored). Others use a key-value store or document-oriented database for storage, making them inherently NoSQL structures. Graph databases excel in use cases where you need to traverse relationships to look for patterns such as social networks, fraud detection, and recommendation engines. Ex: Neo4j Comparison Performance Scalability Flexibility Complexity Functionality Key Value high high high none Variable Document stores high Variable (high) high low Variable (low) Column DB high high moderate low minimal Graph Variable Variable high high Graph theory Differences between SQL and NoSQL The table below summarizes the main differences between SQL and NoSQL databases. SQL Databases NoSQL Databases Data Storage Model Tables with fixed rows and columns Document: JSON documents, Key-value: key-value pairs, Wide-column: tables with rows and dynamic columns, Graph: nodes and edges Primary Purpose General purpose Document: general purpose, Key-value: large amounts of data with simple lookup queries, Wide-column: large amounts of data with predictable query patterns, Graph: analyzing and traversing relationships between connected data Schemas Rigid Flexible Scaling Vertical (scale-up with a larger server) Horizontal (scale-out across commodity servers) Multi-Record ACID Transactions Supported Most do not support multi-record ACID transactions. However, some\u2014like MongoDB\u2014do. Joins Typically required Typically not required Data to Object Mapping Requires ORM (object-relational mapping) Many do not require ORMs. Document DB documents map directly to data structures in most popular programming languages. Advantages Flexible Data Models Most NoSQL systems feature flexible schemas. A flexible schema means you can easily modify your database schema to add or remove fields to support for evolving application requirements. This facilitates with continuous application development of new features without database operation overhead. Horizontal Scaling Most NoSQL systems allow you to scale horizontally, which means you can add in cheaper & commodity hardware, whenever you want to scale a system. On the other hand SQL systems generally scale Vertically (a more powerful server). NoSQL systems can also host huge data sets when compared to traditional SQL systems. Fast Queries NoSQL can generally be a lot faster than traditional SQL systems due to data denormalization and horizontal scaling. Most NoSQL systems also tend to store similar data together facilitating faster query responses. Developer productivity NoSQL systems tend to map data based on the programming data structures. As a result developers need to perform fewer data transformations leading to increased productivity & fewer bugs.","title":"Introduction"},{"location":"databases_nosql/intro/#nosql-concepts","text":"","title":"NoSQL Concepts"},{"location":"databases_nosql/intro/#prerequisites","text":"Relational Databases","title":"Prerequisites"},{"location":"databases_nosql/intro/#what-to-expect-from-this-course","text":"At the end of training, you will have an understanding of what a NoSQL database is, what kind of advantages or disadvantages it has over traditional RDBMS, learn about different types of NoSQL databases and understand some of the underlying concepts & trade offs w.r.t to NoSQL.","title":"What to expect from this course"},{"location":"databases_nosql/intro/#what-is-not-covered-under-this-course","text":"We will not be deep diving into any specific NoSQL Database.","title":"What is not covered under this course"},{"location":"databases_nosql/intro/#course-contents","text":"Introduction to NoSQL CAP Theorem Data versioning Partitioning Hashing Quorum","title":"Course Contents"},{"location":"databases_nosql/intro/#introduction","text":"When people use the term \u201cNoSQL database\u201d, they typically use it to refer to any non-relational database. Some say the term \u201cNoSQL\u201d stands for \u201cnon SQL\u201d while others say it stands for \u201cnot only SQL.\u201d Either way, most agree that NoSQL databases are databases that store data in a format other than relational tables. A common misconception is that NoSQL databases or non-relational databases don\u2019t store relationship data well. NoSQL databases can store relationship data\u2014they just store it differently than relational databases do. In fact, when compared with SQL databases, many find modeling relationship data in NoSQL databases to be easier , because related data doesn\u2019t have to be split between tables. Such databases have existed since the late 1960s, but the name \"NoSQL\" was only coined in the early 21st century. NASA used a NoSQL database to track inventory for the Apollo mission. NoSQL databases emerged in the late 2000s as the cost of storage dramatically decreased. Gone were the days of needing to create a complex, difficult-to-manage data model simply for the purposes of reducing data duplication. Developers (rather than storage) were becoming the primary cost of software development, so NoSQL databases optimized for developer productivity. With the rise of Agile development methodology, NoSQL databases were developed with a focus on scaling, fast performance and at the same time allowed for frequent application changes and made programming easier.","title":"Introduction"},{"location":"databases_nosql/intro/#types-of-nosql-databases","text":"Over time due to the way these NoSQL databases were developed to suit requirements at different companies, we ended up with quite a few types of them. However, they can be broadly classified into 4 types. Some of the databases can overlap between different types. They are Document databases: They store data in documents similar to JSON (JavaScript Object Notation) objects. Each document contains pairs of fields and values. The values can typically be a variety of types including things like strings, numbers, booleans, arrays, or objects, and their structures typically align with objects developers are working with in code. The advantages include intuitive data model & flexible schemas. Because of their variety of field value types and powerful query languages, document databases are great for a wide variety of use cases and can be used as a general purpose database. They can horizontally scale-out to accomodate large data volumes. Ex: MongoDB, Couchbase Key-Value databases: These are a simpler type of databases where each item contains keys and values. A value can typically only be retrieved by referencing its value, so learning how to query for a specific key-value pair is typically simple. Key-value databases are great for use cases where you need to store large amounts of data but you don\u2019t need to perform complex queries to retrieve it. Common use cases include storing user preferences or caching. Ex: Redis , DynamoDB , Voldemort / Venice (Linkedin), Wide-Column stores: They store data in tables, rows, and dynamic columns. Wide-column stores provide a lot of flexibility over relational databases because each row is not required to have the same columns. Many consider wide-column stores to be two-dimensional key-value databases. Wide-column stores are great for when you need to store large amounts of data and you can predict what your query patterns will be. Wide-column stores are commonly used for storing Internet of Things data and user profile data. Cassandra and HBase are two of the most popular wide-column stores. Graph Databases: These databases store data in nodes and edges. Nodes typically store information about people, places, and things while edges store information about the relationships between the nodes. The underlying storage mechanism of graph databases can vary. Some depend on a relational engine and \u201cstore\u201d the graph data in a table (although a table is a logical element, therefore this approach imposes another level of abstraction between the graph database, the graph database management system and the physical devices where the data is actually stored). Others use a key-value store or document-oriented database for storage, making them inherently NoSQL structures. Graph databases excel in use cases where you need to traverse relationships to look for patterns such as social networks, fraud detection, and recommendation engines. Ex: Neo4j","title":"Types of NoSQL databases:"},{"location":"databases_nosql/intro/#comparison","text":"Performance Scalability Flexibility Complexity Functionality Key Value high high high none Variable Document stores high Variable (high) high low Variable (low) Column DB high high moderate low minimal Graph Variable Variable high high Graph theory","title":"Comparison"},{"location":"databases_nosql/intro/#differences-between-sql-and-nosql","text":"The table below summarizes the main differences between SQL and NoSQL databases. SQL Databases NoSQL Databases Data Storage Model Tables with fixed rows and columns Document: JSON documents, Key-value: key-value pairs, Wide-column: tables with rows and dynamic columns, Graph: nodes and edges Primary Purpose General purpose Document: general purpose, Key-value: large amounts of data with simple lookup queries, Wide-column: large amounts of data with predictable query patterns, Graph: analyzing and traversing relationships between connected data Schemas Rigid Flexible Scaling Vertical (scale-up with a larger server) Horizontal (scale-out across commodity servers) Multi-Record ACID Transactions Supported Most do not support multi-record ACID transactions. However, some\u2014like MongoDB\u2014do. Joins Typically required Typically not required Data to Object Mapping Requires ORM (object-relational mapping) Many do not require ORMs. Document DB documents map directly to data structures in most popular programming languages.","title":"Differences between SQL and NoSQL"},{"location":"databases_nosql/intro/#advantages","text":"Flexible Data Models Most NoSQL systems feature flexible schemas. A flexible schema means you can easily modify your database schema to add or remove fields to support for evolving application requirements. This facilitates with continuous application development of new features without database operation overhead. Horizontal Scaling Most NoSQL systems allow you to scale horizontally, which means you can add in cheaper & commodity hardware, whenever you want to scale a system. On the other hand SQL systems generally scale Vertically (a more powerful server). NoSQL systems can also host huge data sets when compared to traditional SQL systems. Fast Queries NoSQL can generally be a lot faster than traditional SQL systems due to data denormalization and horizontal scaling. Most NoSQL systems also tend to store similar data together facilitating faster query responses. Developer productivity NoSQL systems tend to map data based on the programming data structures. As a result developers need to perform fewer data transformations leading to increased productivity & fewer bugs.","title":"Advantages"},{"location":"databases_nosql/key_concepts/","text":"Key Concepts Lets looks at some of the key concepts when we talk about NoSQL or distributed systems CAP Theorem In a keynote titled \u201c Towards Robust Distributed Systems \u201d at ACM\u2019s PODC symposium in 2000 Eric Brewer came up with the so-called CAP-theorem which is widely adopted today by large web companies as well as in the NoSQL community. The CAP acronym stands for C onsistency, A vailability & P artition Tolerance. Consistency It refers to how consistent a system is after an execution. A distributed system is called consistent when a write made by a source is available for all readers of that shared data. Different NoSQL systems support different levels of consistency. Availability It refers to how a system responds to loss of functionality of different systems due to hardware and software failures. A high availability implies that a system is still available to handle operations (reads and writes) when a certain part of the system is down due to a failure or upgrade. Partition Tolerance It is the ability of the system to continue operations in the event of a network partition. A network partition occurs when a failure causes two or more islands of networks where the systems can\u2019t talk to each other across the islands temporarily or permanently. Brewer alleges that one can at most choose two of these three characteristics in a shared-data system. The CAP-theorem states that a choice can only be made for two options out of consistency, availability and partition tolerance. A growing number of use cases in large scale applications tend to value reliability implying that availability & redundancy are more valuable than consistency. As a result these systems struggle to meet ACID properties. They attain this by loosening on the consistency requirement i.e Eventual Consistency. Eventual Consistency means that all readers will see writes, as time goes on: \u201cIn a steady state, the system will eventually return the last written value\u201d. Clients therefore may face an inconsistent state of data as updates are in progress. For instance, in a replicated database updates may go to one node which replicates the latest version to all other nodes that contain a replica of the modified dataset so that the replica nodes eventually will have the latest version. NoSQL systems support different levels of eventual consistency models. For example: Read Your Own Writes Consistency A client will see his updates immediately after they are written. The reads can hit nodes other than the one where it was written. However he might not see updates by other clients immediately. Session Consistency A client will see the updates to his data within a session scope. This generally indicates that reads & writes occur on the same server. Other clients using the same nodes will receive the same updates. Casual Consistency A system provides causal consistency if the following condition holds: write operations that are related by potential causality are seen by each process of the system in order. Different processes may observe concurrent writes in different orders Eventual consistency is useful if concurrent updates of the same partitions of data are unlikely and if clients do not immediately depend on reading updates issued by themselves or by other clients. Depending on what consistency model was chosen for the system (or parts of it), determines where the requests are routed, ex: replicas. CAP alternatives illustration Choice Traits Examples Consistency + Availability (Forfeit Partitions) 2-phase commits Cache invalidation protocols Single-site databases Cluster databases LDAP xFS file system Consistency + Partition tolerance (Forfeit Availability) Pessimistic locking Make minority partitions unavailable Distributed databases Distributed locking Majority protocols Availability + Partition tolerance (Forfeit Consistency) expirations/leases conflict resolution optimistic DNS Web caching Versioning of Data in distributed systems When data is distributed across nodes, it can be modified on different nodes at the same time (assuming strict consistency is enforced). Questions arise on conflict resolution for concurrent updates. Some of the popular conflict resolution mechanism are Timestamps This is the most obvious solution. You sort updates based on chronological order and choose the latest update. However this relies on clock synchronization across different parts of the infrastructure. This gets even more complicated when parts of systems are spread across different geographic locations. Optimistic Locking You associate a unique value like a clock or counter with every data update. When a client wants to update data, it has to specify which version of data needs to be updated. This would mean you need to keep track of history of the data versions. Vector Clocks A vector clock is defined as a tuple of clock values from each node. In a distributed environment, each node maintains a tuple of such clock values which represent the state of the nodes itself and its peers/replicas. A clock value may be real timestamps derived from local clock or version no. Vector clocks illustration Vector clocks have the following advantages over other conflict resolution mechanism No dependency on synchronized clocks No total ordering of revision nos required for casual reasoning No need to store and maintain multiple versions of the data on different nodes. Partitioning When the amount of data crosses the capacity of a single node, we need to think of splitting data, creating replicas for load balancing & disaster recovery. Depending on how dynamic the infrastructure is, we have a few approaches that we can take. Memory cached These are partitioned in-memory databases that are primarily used for transient data. These databases are generally used as a front for traditional RDBMS. Most frequently used data is replicated from a rdbms into a memory database to facilitate fast queries and to take the load off from backend DB\u2019s. A very common example is memcached or couchbase. Clustering Traditional cluster mechanisms abstract away the cluster topology from clients. A client need not know where the actual data is residing and which node it is talking to. Clustering is very commonly used in traditional RDBMS where it can help scaling the persistent layer to a certain extent. Separating reads from writes In this method, you will have multiple replicas hosting the same data. The incoming writes are typically sent to a single node (Leader) or multiple nodes (multi-Leader), while the rest of the replicas (Follower) handle reads requests. The leader replicates writes asynchronously to all followers. However the write lag can\u2019t be completely avoided. Sometimes a leader can crash before it replicates all the data to a follower. When this happens, a follower with the most consistent data can be turned into a leader. As you can realize now, it is hard to enforce full consistency in this model. You also need to consider the ratio of read vs write traffic. This model won\u2019t make sense when writes are higher than reads. The replication methods can also vary widely. Some systems do a complete transfer of state periodically, while others use a delta state transfer approach. You could also transfer the state by transferring the operations in order. The followers can then apply the same operations as the leader to catch up. Sharding Sharing refers to dividing data in such a way that data is distributed evenly (both in terms of storage & processing power) across a cluster of nodes. It can also imply data locality, which means similar & related data is stored together to facilitate faster access. A shard in turn can be further replicated to meet load balancing or disaster recovery requirements. A single shard replica might take in all writes (single leader) or multiple replicas can take writes (multi-leader). Reads can be distributed across multiple replicas. Since data is now distributed across multiple nodes, clients should be able to consistently figure out where data is hosted. We will look at some of the common techniques below. The downside of sharding is that joins between shards is not possible. So an upstream/downstream application has to aggregate the results from multiple shards. Sharding example Hashing A hash function is a function that maps one piece of data\u2014typically describing some kind of object, often of arbitrary size\u2014to another piece of data, typically an integer, known as hash code , or simply hash . In a partitioned database, it is important to consistently map a key to a server/replica. For ex: you can use a very simple hash as a modulo function. _p = k mod n_ Where p -> partition, k -> primary key n -> no of nodes The downside of this simple hash is that, whenever the cluster topology changes, the data distribution also changes. When you are dealing with memory caches, it will be easy to distribute partitions around. Whenever a node joins/leaves a topology, partitions can reorder themselves, a cache miss can be re-populated from backend DB. However when you look at persistent data, it is not possible as the new node doesn\u2019t have the data needed to serve it. This brings us to consistent hashing. Consistent Hashing Consistent hashing is a distributed hashing scheme that operates independently of the number of servers or objects in a distributed hash table by assigning them a position on an abstract circle, or hash ring . This allows servers and objects to scale without affecting the overall system. Say that our hash function h() generates a 32-bit integer. Then, to determine to which server we will send a key k, we find the server s whose hash h(s) is the smallest integer that is larger than h(k). To make the process simpler, we assume the table is circular, which means that if we cannot find a server with a hash larger than h(k), we wrap around and start looking from the beginning of the array. Consistent hashing illustration In consistent hashing when a server is removed or added then only the keys from that server are relocated. For example, if server S3 is removed then, all keys from server S3 will be moved to server S4 but keys stored on server S4 and S2 are not relocated. But there is one problem, when server S3 is removed then keys from S3 are not equally distributed among remaining servers S4 and S2. They are only assigned to server S4 which increases the load on server S4. To evenly distribute the load among servers when a server is added or removed, it creates a fixed number of replicas ( known as virtual nodes) of each server and distributes it along the circle. So instead of server labels S1, S2 and S3, we will have S10 S11\u2026S19, S20 S21\u2026S29 and S30 S31\u2026S39. The factor for a number of replicas is also known as weight , depending on the situation. All keys which are mapped to replicas Sij are stored on server Si. To find a key we do the same thing, find the position of the key on the circle and then move forward until you find a server replica. If the server replica is Sij then the key is stored in server Si. Suppose server S3 is removed, then all S3 replicas with labels S30 S31 \u2026 S39 must be removed. Now the objects keys adjacent to S3X labels will be automatically re-assigned to S1X, S2X and S4X. All keys originally assigned to S1, S2 & S4 will not be moved. Similar things happen if we add a server. Suppose we want to add a server S5 as a replacement of S3 then we need to add labels S50 S51 \u2026 S59. In the ideal case, one-fourth of keys from S1, S2 and S4 will be reassigned to S5. When applied to persistent storages, further issues arise: if a node has left the scene, data stored on this node becomes unavailable, unless it has been replicated to other nodes before; in the opposite case of a new node joining the others, adjacent nodes are no longer responsible for some pieces of data which they still store but not get asked for anymore as the corresponding objects are no longer hashed to them by requesting clients. In order to address this issue, a replication factor (r) can be introduced. Introducing replicas in a partitioning scheme\u2014besides reliability benefits\u2014also makes it possible to spread workload for read requests that can go to any physical node responsible for a requested piece of data. Scalability doesn\u2019t work if the clients have to decide between multiple versions of the dataset, because they need to read from a quorum of servers which in turn reduces the efficiency of load balancing. Quorum Quorum is the minimum number of nodes in a cluster that must be online and be able to communicate with each other. If any additional node failure occurs beyond this threshold, the cluster will stop running. To attain a quorum, you need a majority of the nodes. Commonly it is (N/2 + 1), where N is the total no of nodes in the system. For ex, In a 3 node cluster, you need 2 nodes for a majority, In a 5 node cluster, you need 3 nodes for a majority, In a 6 node cluster, you need 4 nodes for a majority. Quorum example Network problems can cause communication failures among cluster nodes. One set of nodes might be able to communicate together across a functioning part of a network but not be able to communicate with a different set of nodes in another part of the network. This is known as split brain in cluster or cluster partitioning. Now the partition which has quorum is allowed to continue running the application. The other partitions are removed from the cluster. Eg: In a 5 node cluster, consider what happens if nodes 1, 2, and 3 can communicate with each other but not with nodes 4 and 5. Nodes 1, 2, and 3 constitute a majority, and they continue running as a cluster. Nodes 4 and 5, being a minority, stop running as a cluster. If node 3 loses communication with other nodes, all nodes stop running as a cluster. However, all functioning nodes will continue to listen for communication, so that when the network begins working again, the cluster can form and begin to run. Below diagram demonstrates Quorum selection on a cluster partitioned into two sets. Cluster Quorum example","title":"Key Concepts"},{"location":"databases_nosql/key_concepts/#key-concepts","text":"Lets looks at some of the key concepts when we talk about NoSQL or distributed systems","title":"Key Concepts"},{"location":"databases_nosql/key_concepts/#cap-theorem","text":"In a keynote titled \u201c Towards Robust Distributed Systems \u201d at ACM\u2019s PODC symposium in 2000 Eric Brewer came up with the so-called CAP-theorem which is widely adopted today by large web companies as well as in the NoSQL community. The CAP acronym stands for C onsistency, A vailability & P artition Tolerance. Consistency It refers to how consistent a system is after an execution. A distributed system is called consistent when a write made by a source is available for all readers of that shared data. Different NoSQL systems support different levels of consistency. Availability It refers to how a system responds to loss of functionality of different systems due to hardware and software failures. A high availability implies that a system is still available to handle operations (reads and writes) when a certain part of the system is down due to a failure or upgrade. Partition Tolerance It is the ability of the system to continue operations in the event of a network partition. A network partition occurs when a failure causes two or more islands of networks where the systems can\u2019t talk to each other across the islands temporarily or permanently. Brewer alleges that one can at most choose two of these three characteristics in a shared-data system. The CAP-theorem states that a choice can only be made for two options out of consistency, availability and partition tolerance. A growing number of use cases in large scale applications tend to value reliability implying that availability & redundancy are more valuable than consistency. As a result these systems struggle to meet ACID properties. They attain this by loosening on the consistency requirement i.e Eventual Consistency. Eventual Consistency means that all readers will see writes, as time goes on: \u201cIn a steady state, the system will eventually return the last written value\u201d. Clients therefore may face an inconsistent state of data as updates are in progress. For instance, in a replicated database updates may go to one node which replicates the latest version to all other nodes that contain a replica of the modified dataset so that the replica nodes eventually will have the latest version. NoSQL systems support different levels of eventual consistency models. For example: Read Your Own Writes Consistency A client will see his updates immediately after they are written. The reads can hit nodes other than the one where it was written. However he might not see updates by other clients immediately. Session Consistency A client will see the updates to his data within a session scope. This generally indicates that reads & writes occur on the same server. Other clients using the same nodes will receive the same updates. Casual Consistency A system provides causal consistency if the following condition holds: write operations that are related by potential causality are seen by each process of the system in order. Different processes may observe concurrent writes in different orders Eventual consistency is useful if concurrent updates of the same partitions of data are unlikely and if clients do not immediately depend on reading updates issued by themselves or by other clients. Depending on what consistency model was chosen for the system (or parts of it), determines where the requests are routed, ex: replicas. CAP alternatives illustration Choice Traits Examples Consistency + Availability (Forfeit Partitions) 2-phase commits Cache invalidation protocols Single-site databases Cluster databases LDAP xFS file system Consistency + Partition tolerance (Forfeit Availability) Pessimistic locking Make minority partitions unavailable Distributed databases Distributed locking Majority protocols Availability + Partition tolerance (Forfeit Consistency) expirations/leases conflict resolution optimistic DNS Web caching","title":"CAP Theorem"},{"location":"databases_nosql/key_concepts/#versioning-of-data-in-distributed-systems","text":"When data is distributed across nodes, it can be modified on different nodes at the same time (assuming strict consistency is enforced). Questions arise on conflict resolution for concurrent updates. Some of the popular conflict resolution mechanism are Timestamps This is the most obvious solution. You sort updates based on chronological order and choose the latest update. However this relies on clock synchronization across different parts of the infrastructure. This gets even more complicated when parts of systems are spread across different geographic locations. Optimistic Locking You associate a unique value like a clock or counter with every data update. When a client wants to update data, it has to specify which version of data needs to be updated. This would mean you need to keep track of history of the data versions. Vector Clocks A vector clock is defined as a tuple of clock values from each node. In a distributed environment, each node maintains a tuple of such clock values which represent the state of the nodes itself and its peers/replicas. A clock value may be real timestamps derived from local clock or version no. Vector clocks illustration Vector clocks have the following advantages over other conflict resolution mechanism No dependency on synchronized clocks No total ordering of revision nos required for casual reasoning No need to store and maintain multiple versions of the data on different nodes.","title":"Versioning of Data in distributed systems"},{"location":"databases_nosql/key_concepts/#partitioning","text":"When the amount of data crosses the capacity of a single node, we need to think of splitting data, creating replicas for load balancing & disaster recovery. Depending on how dynamic the infrastructure is, we have a few approaches that we can take. Memory cached These are partitioned in-memory databases that are primarily used for transient data. These databases are generally used as a front for traditional RDBMS. Most frequently used data is replicated from a rdbms into a memory database to facilitate fast queries and to take the load off from backend DB\u2019s. A very common example is memcached or couchbase. Clustering Traditional cluster mechanisms abstract away the cluster topology from clients. A client need not know where the actual data is residing and which node it is talking to. Clustering is very commonly used in traditional RDBMS where it can help scaling the persistent layer to a certain extent. Separating reads from writes In this method, you will have multiple replicas hosting the same data. The incoming writes are typically sent to a single node (Leader) or multiple nodes (multi-Leader), while the rest of the replicas (Follower) handle reads requests. The leader replicates writes asynchronously to all followers. However the write lag can\u2019t be completely avoided. Sometimes a leader can crash before it replicates all the data to a follower. When this happens, a follower with the most consistent data can be turned into a leader. As you can realize now, it is hard to enforce full consistency in this model. You also need to consider the ratio of read vs write traffic. This model won\u2019t make sense when writes are higher than reads. The replication methods can also vary widely. Some systems do a complete transfer of state periodically, while others use a delta state transfer approach. You could also transfer the state by transferring the operations in order. The followers can then apply the same operations as the leader to catch up. Sharding Sharing refers to dividing data in such a way that data is distributed evenly (both in terms of storage & processing power) across a cluster of nodes. It can also imply data locality, which means similar & related data is stored together to facilitate faster access. A shard in turn can be further replicated to meet load balancing or disaster recovery requirements. A single shard replica might take in all writes (single leader) or multiple replicas can take writes (multi-leader). Reads can be distributed across multiple replicas. Since data is now distributed across multiple nodes, clients should be able to consistently figure out where data is hosted. We will look at some of the common techniques below. The downside of sharding is that joins between shards is not possible. So an upstream/downstream application has to aggregate the results from multiple shards. Sharding example","title":"Partitioning"},{"location":"databases_nosql/key_concepts/#hashing","text":"A hash function is a function that maps one piece of data\u2014typically describing some kind of object, often of arbitrary size\u2014to another piece of data, typically an integer, known as hash code , or simply hash . In a partitioned database, it is important to consistently map a key to a server/replica. For ex: you can use a very simple hash as a modulo function. _p = k mod n_ Where p -> partition, k -> primary key n -> no of nodes The downside of this simple hash is that, whenever the cluster topology changes, the data distribution also changes. When you are dealing with memory caches, it will be easy to distribute partitions around. Whenever a node joins/leaves a topology, partitions can reorder themselves, a cache miss can be re-populated from backend DB. However when you look at persistent data, it is not possible as the new node doesn\u2019t have the data needed to serve it. This brings us to consistent hashing.","title":"Hashing"},{"location":"databases_nosql/key_concepts/#consistent-hashing","text":"Consistent hashing is a distributed hashing scheme that operates independently of the number of servers or objects in a distributed hash table by assigning them a position on an abstract circle, or hash ring . This allows servers and objects to scale without affecting the overall system. Say that our hash function h() generates a 32-bit integer. Then, to determine to which server we will send a key k, we find the server s whose hash h(s) is the smallest integer that is larger than h(k). To make the process simpler, we assume the table is circular, which means that if we cannot find a server with a hash larger than h(k), we wrap around and start looking from the beginning of the array. Consistent hashing illustration In consistent hashing when a server is removed or added then only the keys from that server are relocated. For example, if server S3 is removed then, all keys from server S3 will be moved to server S4 but keys stored on server S4 and S2 are not relocated. But there is one problem, when server S3 is removed then keys from S3 are not equally distributed among remaining servers S4 and S2. They are only assigned to server S4 which increases the load on server S4. To evenly distribute the load among servers when a server is added or removed, it creates a fixed number of replicas ( known as virtual nodes) of each server and distributes it along the circle. So instead of server labels S1, S2 and S3, we will have S10 S11\u2026S19, S20 S21\u2026S29 and S30 S31\u2026S39. The factor for a number of replicas is also known as weight , depending on the situation. All keys which are mapped to replicas Sij are stored on server Si. To find a key we do the same thing, find the position of the key on the circle and then move forward until you find a server replica. If the server replica is Sij then the key is stored in server Si. Suppose server S3 is removed, then all S3 replicas with labels S30 S31 \u2026 S39 must be removed. Now the objects keys adjacent to S3X labels will be automatically re-assigned to S1X, S2X and S4X. All keys originally assigned to S1, S2 & S4 will not be moved. Similar things happen if we add a server. Suppose we want to add a server S5 as a replacement of S3 then we need to add labels S50 S51 \u2026 S59. In the ideal case, one-fourth of keys from S1, S2 and S4 will be reassigned to S5. When applied to persistent storages, further issues arise: if a node has left the scene, data stored on this node becomes unavailable, unless it has been replicated to other nodes before; in the opposite case of a new node joining the others, adjacent nodes are no longer responsible for some pieces of data which they still store but not get asked for anymore as the corresponding objects are no longer hashed to them by requesting clients. In order to address this issue, a replication factor (r) can be introduced. Introducing replicas in a partitioning scheme\u2014besides reliability benefits\u2014also makes it possible to spread workload for read requests that can go to any physical node responsible for a requested piece of data. Scalability doesn\u2019t work if the clients have to decide between multiple versions of the dataset, because they need to read from a quorum of servers which in turn reduces the efficiency of load balancing.","title":"Consistent Hashing"},{"location":"databases_nosql/key_concepts/#quorum","text":"Quorum is the minimum number of nodes in a cluster that must be online and be able to communicate with each other. If any additional node failure occurs beyond this threshold, the cluster will stop running. To attain a quorum, you need a majority of the nodes. Commonly it is (N/2 + 1), where N is the total no of nodes in the system. For ex, In a 3 node cluster, you need 2 nodes for a majority, In a 5 node cluster, you need 3 nodes for a majority, In a 6 node cluster, you need 4 nodes for a majority. Quorum example Network problems can cause communication failures among cluster nodes. One set of nodes might be able to communicate together across a functioning part of a network but not be able to communicate with a different set of nodes in another part of the network. This is known as split brain in cluster or cluster partitioning. Now the partition which has quorum is allowed to continue running the application. The other partitions are removed from the cluster. Eg: In a 5 node cluster, consider what happens if nodes 1, 2, and 3 can communicate with each other but not with nodes 4 and 5. Nodes 1, 2, and 3 constitute a majority, and they continue running as a cluster. Nodes 4 and 5, being a minority, stop running as a cluster. If node 3 loses communication with other nodes, all nodes stop running as a cluster. However, all functioning nodes will continue to listen for communication, so that when the network begins working again, the cluster can form and begin to run. Below diagram demonstrates Quorum selection on a cluster partitioned into two sets. Cluster Quorum example","title":"Quorum"},{"location":"databases_sql/concepts/","text":"Relational DBs are used for data storage. Even a file can be used to store data, but relational DBs are designed with specific goals: Efficiency Ease of access and management Organized Handle relations between data (represented as tables) Transaction: a unit of work that can comprise multiple statements, executed together ACID properties Set of properties that guarantee data integrity of DB transactions Atomicity: Each transaction is atomic (succeeds or fails completely) Consistency: Transactions only result in valid state (which includes rules, constraints, triggers etc.) Isolation: Each transaction is executed independently of others safely within a concurrent system Durability: Completed transactions will not be lost due to any later failures Let\u2019s take some examples to illustrate the above properties. Account A has a balance of \u20b9200 & B has \u20b9400. Account A is transferring \u20b9100 to Account B. This transaction has a deduction from sender and an addition into the recipient\u2019s balance. If the first operation passes successfully while the second fails, A\u2019s balance would be \u20b9100 while B would be having \u20b9400 instead of \u20b9500. Atomicity in a DB ensures this partially failed transaction is rolled back. If the second operation above fails, it leaves the DB inconsistent (sum of balance of accounts before and after the operation is not the same). Consistency ensures that this does not happen. There are three operations, one to calculate interest for A\u2019s account, another to add that to A\u2019s account, then transfer \u20b9100 from B to A. Without isolation guarantees, concurrent execution of these 3 operations may lead to a different outcome every time. What happens if the system crashes before the transactions are written to disk? Durability ensures that the changes are applied correctly during recovery. Relational data Tables represent relations Columns (fields) represent attributes Rows are individual records Schema describes the structure of DB SQL A query language to interact with and manage data. CRUD operations - create, read, update, delete queries Management operations - create DBs/tables/indexes etc, backup, import/export, users, access controls Exercise: Classify the below queries into the four types - DDL (definition), DML(manipulation), DCL(control) and TCL(transactions) and explain in detail. insert, create, drop, delete, update, commit, rollback, truncate, alter, grant, revoke You can practise these in the lab section . Constraints Rules for data that can be stored. Query fails if you violate any of these defined on a table. Primary key: one or more columns that contain UNIQUE values, and cannot contain NULL values. A table can have only ONE primary key. An index on it is created by default. Foreign key: links two tables together. Its value(s) match a primary key in a different table \\ Not null: Does not allow null values \\ Unique: Value of column must be unique across all rows \\ Default: Provides a default value for a column if none is specified during insert Check: Allows only particular values (like Balance >= 0) Indexes Most indexes use B+ tree structure. Why use them: Speeds up queries (in large tables that fetch only a few rows, min/max queries, by eliminating rows from consideration etc) Types of indexes: unique, primary key, fulltext, secondary Write-heavy loads, mostly full table scans or accessing large number of rows etc. do not benefit from indexes Joins Allows you to fetch related data from multiple tables, linking them together with some common field. Powerful but also resource-intensive and makes scaling databases difficult. This is the cause of many slow performing queries when run at scale, and the solution is almost always to find ways to reduce the joins. Access control DBs have privileged accounts for admin tasks, and regular accounts for clients. There are finegrained controls on what actions(DDL, DML etc. discussed earlier )are allowed for these accounts. DB first verifies the user credentials (authentication), and then examines whether this user is permitted to perform the request (authorization) by looking up these information in some internal tables. Other controls include activity auditing that allows examining the history of actions done by a user, and resource limits which define the number of queries, connections etc. allowed. Popular databases Commercial, closed source - Oracle, Microsoft SQL Server, IBM DB2 Open source with optional paid support - MySQL, MariaDB, PostgreSQL Individuals and small companies have always preferred open source DBs because of the huge cost associated with commercial software. In recent times, even large organizations have moved away from commercial software to open source alternatives because of the flexibility and cost savings associated with it. Lack of support is no longer a concern because of the paid support available from the developer and third parties. MySQL is the most widely used open source DB, and it is widely supported by hosting providers, making it easy for anyone to use. It is part of the popular Linux-Apache-MySQL-PHP ( LAMP ) stack that became popular in the 2000s. We have many more choices for a programming language, but the rest of that stack is still widely used.","title":"Key Concepts"},{"location":"databases_sql/concepts/#popular-databases","text":"Commercial, closed source - Oracle, Microsoft SQL Server, IBM DB2 Open source with optional paid support - MySQL, MariaDB, PostgreSQL Individuals and small companies have always preferred open source DBs because of the huge cost associated with commercial software. In recent times, even large organizations have moved away from commercial software to open source alternatives because of the flexibility and cost savings associated with it. Lack of support is no longer a concern because of the paid support available from the developer and third parties. MySQL is the most widely used open source DB, and it is widely supported by hosting providers, making it easy for anyone to use. It is part of the popular Linux-Apache-MySQL-PHP ( LAMP ) stack that became popular in the 2000s. We have many more choices for a programming language, but the rest of that stack is still widely used.","title":"Popular databases"},{"location":"databases_sql/conclusion/","text":"Conclusion We have covered basic concepts of SQL databases. We have also covered some of the tasks that an SRE may be responsible for - there is so much more to learn and do. We hope this course gives you a good start and inspires you to explore further. Further reading More practice with online resources like this one Normalization Routines , triggers Views Transaction isolation levels Sharding Setting up HA , monitoring , backups","title":"Conclusion"},{"location":"databases_sql/conclusion/#conclusion","text":"We have covered basic concepts of SQL databases. We have also covered some of the tasks that an SRE may be responsible for - there is so much more to learn and do. We hope this course gives you a good start and inspires you to explore further.","title":"Conclusion"},{"location":"databases_sql/conclusion/#further-reading","text":"More practice with online resources like this one Normalization Routines , triggers Views Transaction isolation levels Sharding Setting up HA , monitoring , backups","title":"Further reading"},{"location":"databases_sql/innodb/","text":"Why should you use this? General purpose, row level locking, ACID support, transactions, crash recovery and multi-version concurrency control etc. Architecture Key components: Memory: Buffer pool: LRU cache of frequently used data(table and index) to be processed directly from memory, which speeds up processing. Important for tuning performance. Change buffer: Caches changes to secondary index pages when those pages are not in the buffer pool and merges it when they are fetched. Merging may take a long time and impact live queries. It also takes up part of the buffer pool. Avoids the extra I/O to read secondary indexes in. Adaptive hash index: Supplements InnoDB\u2019s B-Tree indexes with fast hash lookup tables like a cache. Slight performance penalty for misses, also adds maintenance overhead of updating it. Hash collisions cause AHI rebuilding for large DBs. Log buffer: Holds log data before flush to disk. Size of each above memory is configurable, and impacts performance a lot. Requires careful analysis of workload, available resources, benchmarking and tuning for optimal performance. Disk: Tables: Stores data within rows and columns. Indexes: Helps find rows with specific column values quickly, avoids full table scans. Redo Logs: all transactions are written to them, and after a crash, the recovery process corrects data written by incomplete transactions and replays any pending ones. Undo Logs: Records associated with a single transaction that contains information about how to undo the latest change by a transaction.","title":"InnoDB"},{"location":"databases_sql/innodb/#why-should-you-use-this","text":"General purpose, row level locking, ACID support, transactions, crash recovery and multi-version concurrency control etc.","title":"Why should you use this?"},{"location":"databases_sql/innodb/#architecture","text":"","title":"Architecture"},{"location":"databases_sql/innodb/#key-components","text":"Memory: Buffer pool: LRU cache of frequently used data(table and index) to be processed directly from memory, which speeds up processing. Important for tuning performance. Change buffer: Caches changes to secondary index pages when those pages are not in the buffer pool and merges it when they are fetched. Merging may take a long time and impact live queries. It also takes up part of the buffer pool. Avoids the extra I/O to read secondary indexes in. Adaptive hash index: Supplements InnoDB\u2019s B-Tree indexes with fast hash lookup tables like a cache. Slight performance penalty for misses, also adds maintenance overhead of updating it. Hash collisions cause AHI rebuilding for large DBs. Log buffer: Holds log data before flush to disk. Size of each above memory is configurable, and impacts performance a lot. Requires careful analysis of workload, available resources, benchmarking and tuning for optimal performance. Disk: Tables: Stores data within rows and columns. Indexes: Helps find rows with specific column values quickly, avoids full table scans. Redo Logs: all transactions are written to them, and after a crash, the recovery process corrects data written by incomplete transactions and replays any pending ones. Undo Logs: Records associated with a single transaction that contains information about how to undo the latest change by a transaction.","title":"Key components:"},{"location":"databases_sql/intro/","text":"Relational Databases Prerequisites Complete Linux course Install Docker (for lab section) What to expect from this course You will have an understanding of what relational databases are, their advantages, and some MySQL specific concepts. What is not covered under this course In depth implementation details Advanced topics like normalization, sharding Specific tools for administration Introduction The main purpose of database systems is to manage data. This includes storage, adding new data, deleting unused data, updating existing data, retrieving data within a reasonable response time, other maintenance tasks to keep the system running etc. Pre-reads RDBMS Concepts Course Contents Key Concepts MySQL Architecture InnoDB Operational Concepts Lab Further Reading","title":"Introduction"},{"location":"databases_sql/intro/#relational-databases","text":"","title":"Relational Databases"},{"location":"databases_sql/intro/#prerequisites","text":"Complete Linux course Install Docker (for lab section)","title":"Prerequisites"},{"location":"databases_sql/intro/#what-to-expect-from-this-course","text":"You will have an understanding of what relational databases are, their advantages, and some MySQL specific concepts.","title":"What to expect from this course"},{"location":"databases_sql/intro/#what-is-not-covered-under-this-course","text":"In depth implementation details Advanced topics like normalization, sharding Specific tools for administration","title":"What is not covered under this course"},{"location":"databases_sql/intro/#introduction","text":"The main purpose of database systems is to manage data. This includes storage, adding new data, deleting unused data, updating existing data, retrieving data within a reasonable response time, other maintenance tasks to keep the system running etc.","title":"Introduction"},{"location":"databases_sql/intro/#pre-reads","text":"RDBMS Concepts","title":"Pre-reads"},{"location":"databases_sql/intro/#course-contents","text":"Key Concepts MySQL Architecture InnoDB Operational Concepts Lab Further Reading","title":"Course Contents"},{"location":"databases_sql/lab/","text":"Prerequisites Install Docker Setup Create a working directory named sos or something similar, and cd into it. Enter the following into a file named my.cnf under a directory named custom. sos $ cat custom/my.cnf [mysqld] # These settings apply to MySQL server # You can set port, socket path, buffer size etc. # Below, we are configuring slow query settings slow_query_log=1 slow_query_log_file=/var/log/mysqlslow.log long_query_time=0.1 Start a container and enable slow query log with the following: sos $ docker run --name db -v custom:/etc/mysql/conf.d -e MYSQL_ROOT_PASSWORD=realsecret -d mysql:8 sos $ docker cp custom/mysqld.cnf $(docker ps -qf \"name=db\"):/etc/mysql/conf.d/custom.cnf sos $ docker restart $(docker ps -qf \"name=db\") Import a sample database sos $ git clone git@github.com:datacharmer/test_db.git sos $ docker cp test_db $(docker ps -qf \"name=db\"):/home/test_db/ sos $ docker exec -it $(docker ps -qf \"name=db\") bash root@3ab5b18b0c7d:/# cd /home/test_db/ root@3ab5b18b0c7d:/# mysql -uroot -prealsecret mysql < employees.sql root@3ab5b18b0c7d:/etc# touch /var/log/mysqlslow.log root@3ab5b18b0c7d:/etc# chown mysql:mysql /var/log/mysqlslow.log Workshop 1: Run some sample queries Run the following $ mysql -uroot -prealsecret mysql mysql> # inspect DBs and tables # the last 4 are MySQL internal DBs mysql> show databases; +--------------------+ | Database | +--------------------+ | employees | | information_schema | | mysql | | performance_schema | | sys | +--------------------+ > use employees; mysql> show tables; +----------------------+ | Tables_in_employees | +----------------------+ | current_dept_emp | | departments | | dept_emp | | dept_emp_latest_date | | dept_manager | | employees | | salaries | | titles | +----------------------+ # read a few rows mysql> select * from employees limit 5; # filter data by conditions mysql> select count(*) from employees where gender = 'M' limit 5; # find count of particular data mysql> select count(*) from employees where first_name = 'Sachin'; Workshop 2: Use explain and explain analyze to profile a query, identify and add indexes required for improving performance # View all indexes on table #(\\G is to output horizontally, replace it with a ; to get table output) mysql> show index from employees from employees\\G *************************** 1. row *************************** Table: employees Non_unique: 0 Key_name: PRIMARY Seq_in_index: 1 Column_name: emp_no Collation: A Cardinality: 299113 Sub_part: NULL Packed: NULL Null: Index_type: BTREE Comment: Index_comment: Visible: YES Expression: NULL # This query uses an index, idenitfied by 'key' field # By prefixing explain keyword to the command, # we get query plan (including key used) mysql> explain select * from employees where emp_no < 10005\\G *************************** 1. row *************************** id: 1 select_type: SIMPLE table: employees partitions: NULL type: range possible_keys: PRIMARY key: PRIMARY key_len: 4 ref: NULL rows: 4 filtered: 100.00 Extra: Using where # Compare that to the next query which does not utilize any index mysql> explain select first_name, last_name from employees where first_name = 'Sachin'\\G *************************** 1. row *************************** id: 1 select_type: SIMPLE table: employees partitions: NULL type: ALL possible_keys: NULL key: NULL key_len: NULL ref: NULL rows: 299113 filtered: 10.00 Extra: Using where # Let's see how much time this query takes mysql> explain analyze select first_name, last_name from employees where first_name = 'Sachin'\\G *************************** 1. row *************************** EXPLAIN: -> Filter: (employees.first_name = 'Sachin') (cost=30143.55 rows=29911) (actual time=28.284..3952.428 rows=232 loops=1) -> Table scan on employees (cost=30143.55 rows=299113) (actual time=0.095..1996.092 rows=300024 loops=1) # Cost(estimated by query planner) is 30143.55 # actual time=28.284ms for first row, 3952.428 for all rows # Now lets try adding an index and running the query again mysql> create index idx_firstname on employees(first_name); Query OK, 0 rows affected (1.25 sec) Records: 0 Duplicates: 0 Warnings: 0 mysql> explain analyze select first_name, last_name from employees where first_name = 'Sachin'; +--------------------------------------------------------------------------------------------------------------------------------------------+ | EXPLAIN | +--------------------------------------------------------------------------------------------------------------------------------------------+ | -> Index lookup on employees using idx_firstname (first_name='Sachin') (cost=81.20 rows=232) (actual time=0.551..2.934 rows=232 loops=1) | +--------------------------------------------------------------------------------------------------------------------------------------------+ 1 row in set (0.01 sec) # Actual time=0.551ms for first row # 2.934ms for all rows. A huge improvement! # Also notice that the query involves only an index lookup, # and no table scan (reading all rows of table) # ..which vastly reduces load on the DB. Workshop 3: Identify slow queries on a MySQL server # Run the command below in two terminal tabs to open two shells into the container. docker exec -it $(docker ps -qf \"name=db\") bash # Open a mysql prompt in one of them and execute this command # We have configured to log queries that take longer than 1s, # so this sleep(3) will be logged mysql -uroot -prealsecret mysql mysql> sleep(3); # Now, in the other terminal, tail the slow log to find details about the query root@62c92c89234d:/etc# tail -f /var/log/mysqlslow.log /usr/sbin/mysqld, Version: 8.0.21 (MySQL Community Server - GPL). started with: Tcp port: 3306 Unix socket: /var/run/mysqld/mysqld.sock Time Id Command Argument # Time: 2020-11-26T14:53:44.822348Z # User@Host: root[root] @ localhost [] Id: 9 # Query_time: 5.404938 Lock_time: 0.000000 Rows_sent: 1 Rows_examined: 1 use employees; # Time: 2020-11-26T14:53:58.015736Z # User@Host: root[root] @ localhost [] Id: 9 # Query_time: 10.000225 Lock_time: 0.000000 Rows_sent: 1 Rows_examined: 1 SET timestamp=1606402428; select sleep(3); These were simulated examples with minimal complexity. In real life, the queries would be much more complex and the explain/analyze and slow query logs would have more details.","title":"Lab"},{"location":"databases_sql/mysql/","text":"MySQL architecture MySQL architecture enables you to select the right storage engine for your needs, and abstracts away all implementation details from the end users (application engineers and DBA ) who only need to know a consistent stable API. Application layer: Connection handling - each client gets its own connection which is cached for the duration of access) Authentication - server checks (username,password,host) info of client and allows/rejects connection Security: server determines whether the client has privileges to execute each query (check with show privileges command) Server layer: Services and utilities - backup/restore, replication, cluster etc SQL interface - clients run queries for data access and manipulation SQL parser - creates a parse tree from the query (lexical/syntactic/semantic analysis and code generation) Optimizer - optimizes queries using various algorithms and data available to it(table level stats), modifies queries, order of scanning, indexes to use etc. (check with explain command) Caches and buffers - cache stores query results, buffer pool(InnoDB) stores table and index data in LRU fashion Storage engine options: InnoDB: most widely used, transaction support, ACID compliant, supports row-level locking, crash recovery and multi-version concurrency control. Default since MySQL 5.5+. MyISAM: fast, does not support transactions, provides table-level locking, great for read-heavy workloads, mostly in web and data warehousing. Default upto MySQL 5.1. Archive: optimised for high speed inserts, compresses data as it is inserted, does not support transactions, ideal for storing and retrieving large amounts of seldom referenced historical, archived data Memory: tables in memory. Fastest engine, supports table-level locking, does not support transactions, ideal for creating temporary tables or quick lookups, data is lost after a shutdown CSV: stores data in CSV files, great for integrating into other applications that use this format \u2026 etc. It is possible to migrate from one storage engine to another. But this migration locks tables for all operations and is not online, as it changes the physical layout of the data. It takes a long time and is generally not recommended. Hence, choosing the right storage engine at the beginning is important. General guideline is to use InnoDB unless you have a specific need for one of the other storage engines. Running mysql> SHOW ENGINES; shows you the supported engines on your MySQL server.","title":"MySQL"},{"location":"databases_sql/mysql/#mysql-architecture","text":"MySQL architecture enables you to select the right storage engine for your needs, and abstracts away all implementation details from the end users (application engineers and DBA ) who only need to know a consistent stable API. Application layer: Connection handling - each client gets its own connection which is cached for the duration of access) Authentication - server checks (username,password,host) info of client and allows/rejects connection Security: server determines whether the client has privileges to execute each query (check with show privileges command) Server layer: Services and utilities - backup/restore, replication, cluster etc SQL interface - clients run queries for data access and manipulation SQL parser - creates a parse tree from the query (lexical/syntactic/semantic analysis and code generation) Optimizer - optimizes queries using various algorithms and data available to it(table level stats), modifies queries, order of scanning, indexes to use etc. (check with explain command) Caches and buffers - cache stores query results, buffer pool(InnoDB) stores table and index data in LRU fashion Storage engine options: InnoDB: most widely used, transaction support, ACID compliant, supports row-level locking, crash recovery and multi-version concurrency control. Default since MySQL 5.5+. MyISAM: fast, does not support transactions, provides table-level locking, great for read-heavy workloads, mostly in web and data warehousing. Default upto MySQL 5.1. Archive: optimised for high speed inserts, compresses data as it is inserted, does not support transactions, ideal for storing and retrieving large amounts of seldom referenced historical, archived data Memory: tables in memory. Fastest engine, supports table-level locking, does not support transactions, ideal for creating temporary tables or quick lookups, data is lost after a shutdown CSV: stores data in CSV files, great for integrating into other applications that use this format \u2026 etc. It is possible to migrate from one storage engine to another. But this migration locks tables for all operations and is not online, as it changes the physical layout of the data. It takes a long time and is generally not recommended. Hence, choosing the right storage engine at the beginning is important. General guideline is to use InnoDB unless you have a specific need for one of the other storage engines. Running mysql> SHOW ENGINES; shows you the supported engines on your MySQL server.","title":"MySQL architecture"},{"location":"databases_sql/operations/","text":"Explain and explain+analyze EXPLAIN <query> analyzes query plans from the optimizer, including how tables are joined, which tables/rows are scanned etc. Explain analyze shows the above and additional info like execution cost, number of rows returned, time taken etc. This knowledge is useful to tweak queries and add indexes. Watch this performance tuning tutorial video . Checkout the lab section for a hands-on about indexes. Slow query logs Used to identify slow queries (configurable threshold), enabled in config or dynamically with a query Checkout the lab section about identifying slow queries. User management This includes creation and changes to users, like managing privileges, changing password etc. Backup and restore strategies, pros and cons Logical backup using mysqldump - slower but can be done online Physical backup (copy data directory or use xtrabackup) - quick backup/recovery. Copying data directory requires locking or shut down. xtrabackup is an improvement because it supports backups without shutting down (hot backup). Others - PITR, snapshots etc. Crash recovery process using redo logs After a crash, when you restart server it reads redo logs and replays modifications to recover Monitoring MySQL Key MySQL metrics: reads, writes, query runtime, errors, slow queries, connections, running threads, InnoDB metrics Key OS metrics: CPU, load, memory, disk I/O, network Replication Copies data from one instance to one or more instances. Helps in horizontal scaling, data protection, analytics and performance. Binlog dump thread on primary, replication I/O and SQL threads on secondary. Strategies include the standard async, semi async or group replication. High Availability Ability to cope with failure at software, hardware and network level. Essential for anyone who needs 99.9%+ uptime. Can be implemented with replication or clustering solutions from MySQL, Percona, Oracle etc. Requires expertise to setup and maintain. Failover can be manual, scripted or using tools like Orchestrator. Data directory Data is stored in a particular directory, with nested directories for the data contained in each database. There are also MySQL log files, InnoDB log files, server process ID file and some other configs. The data directory is configurable. MySQL configuration This can be done by passing parameters during startup , or in a file . There are a few standard paths where MySQL looks for config files, /etc/my.cnf is one of the commonly used paths. These options are organized under headers (mysqld for server and mysql for client), you can explore them more in the lab that follows. Logs MySQL has logs for various purposes - general query log, errors, binary logs (for replication), slow query log. Only error log is enabled by default (to reduce I/O and storage requirement), the others can be enabled when required - by specifying config parameters at startup or running commands at runtime. Log destination can also be tweaked with config parameters.","title":"Operational Concepts"},{"location":"git/branches/","text":"Working With Branches Coming back to our local repo which has two commits. So far, what we have is a single line of history. Commits are chained in a single line. But sometimes you may have a need to work on two different features in parallel in the same repo. Now one option here could be making a new folder/repo with the same code and use that for another feature development. But there's a better way. Use branches. Since git follows tree like structure for commits, we can use branches to work on different sets of features. From a commit, two or more branches can be created and branches can also be merged. Using branches, there can exist multiple lines of histories and we can checkout to any of them and work on it. Checking out, as we discussed earlier, would simply mean replacing contents of the directory (repo) with the snapshot at the checked out version. Let's create a branch and see how it looks like: spatel1-mn1:school-of-sre spatel1$ git branch b1 spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD -> master, b1) adding file 2 * df2fb7a adding file 1 We create a branch called b1 . Git log tells us that b1 also points to the last commit (7f3b00e) but the HEAD is still pointing to master. If you remember, HEAD points to the commit/reference wherever you are checkout to. So if we checkout to b1 , HEAD should point to that. Let's confirm: spatel1-mn1:school-of-sre spatel1$ git checkout b1 Switched to branch 'b1' spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD -> b1, master) adding file 2 * df2fb7a adding file 1 b1 still points to the same commit but HEAD now points to b1 . Since we create a branch at commit 7f3b00e , there will be two lines of histories starting this commit. Depending on which branch you are checked out on, the line of history will progress. At this moment, we are checked out on branch b1 , so making a new commit will advance branch reference b1 to that commit and current b1 commit will become its parent. Let's do that. # Creating a file and making a commit spatel1-mn1:school-of-sre spatel1$ echo \"I am a file in b1 branch\" > b1.txt spatel1-mn1:school-of-sre spatel1$ git add b1.txt spatel1-mn1:school-of-sre spatel1$ git commit -m \"adding b1 file\" [b1 872a38f] adding b1 file 1 file changed, 1 insertion(+) create mode 100644 b1.txt # The new line of history spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 872a38f (HEAD -> b1) adding b1 file * 7f3b00e (master) adding file 2 * df2fb7a adding file 1 spatel1-mn1:school-of-sre spatel1$ Do note that master is still pointing to the old commit it was pointing to. We can now checkout to master branch and make commits there. This will result in another line of history starting from commit 7f3b00e. # checkout to master branch spatel1-mn1:school-of-sre spatel1$ git checkout master Switched to branch 'master' # Creating a new commit on master branch spatel1-mn1:school-of-sre spatel1$ echo \"new file in master branch\" > master.txt spatel1-mn1:school-of-sre spatel1$ git add master.txt spatel1-mn1:school-of-sre spatel1$ git commit -m \"adding master.txt file\" [master 60dc441] adding master.txt file 1 file changed, 1 insertion(+) create mode 100644 master.txt # The history line spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 60dc441 (HEAD -> master) adding master.txt file * 7f3b00e adding file 2 * df2fb7a adding file 1 Notice how branch b1 is not visible here since we are on the master. Let's try to visualize both to get the whole picture: spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 60dc441 (HEAD -> master) adding master.txt file | * 872a38f (b1) adding b1 file |/ * 7f3b00e adding file 2 * df2fb7a adding file 1 Above tree structure should make things clear. Notice a clear branch/fork on commit 7f3b00e. This is how we create branches. Now they both are two separate lines of history on which feature development can be done independently. To reiterate, internally, git is just a tree of commits. Branch names (human readable) are pointers to those commits in the tree. We use various git commands to work with the tree structure and references. Git accordingly modifies contents of our repo. Merges Now say the feature you were working on branch b1 is complete and you need to merge it on master branch, where all the final version of code goes. So first you will checkout to branch master and then you pull the latest code from upstream (eg: GitHub). Then you need to merge your code from b1 into master. There could be two ways this can be done. Here is the current history: spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 60dc441 (HEAD -> master) adding master.txt file | * 872a38f (b1) adding b1 file |/ * 7f3b00e adding file 2 * df2fb7a adding file 1 Option 1: Directly merge the branch. Merging the branch b1 into master will result in a new merge commit. This will merge changes from two different lines of history and create a new commit of the result. spatel1-mn1:school-of-sre spatel1$ git merge b1 Merge made by the 'recursive' strategy. b1.txt | 1 + 1 file changed, 1 insertion(+) create mode 100644 b1.txt spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 8fc28f9 (HEAD -> master) Merge branch 'b1' |\\ | * 872a38f (b1) adding b1 file * | 60dc441 adding master.txt file |/ * 7f3b00e adding file 2 * df2fb7a adding file 1 You can see a new merge commit created (8fc28f9). You will be prompted for the commit message. If there are a lot of branches in the repo, this result will end-up with a lot of merge commits. Which looks ugly compared to a single line of history of development. So let's look at an alternative approach First let's reset our last merge and go to the previous state. spatel1-mn1:school-of-sre spatel1$ git reset --hard 60dc441 HEAD is now at 60dc441 adding master.txt file spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 60dc441 (HEAD -> master) adding master.txt file | * 872a38f (b1) adding b1 file |/ * 7f3b00e adding file 2 * df2fb7a adding file 1 Option 2: Rebase. Now, instead of merging two branches which has a similar base (commit: 7f3b00e), let us rebase branch b1 on to current master. What this means is take branch b1 (from commit 7f3b00e to commit 872a38f) and rebase (put them on top of) master (60dc441). # Switch to b1 spatel1-mn1:school-of-sre spatel1$ git checkout b1 Switched to branch 'b1' # Rebase (b1 which is current branch) on master spatel1-mn1:school-of-sre spatel1$ git rebase master First, rewinding head to replay your work on top of it... Applying: adding b1 file # The result spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 5372c8f (HEAD -> b1) adding b1 file * 60dc441 (master) adding master.txt file * 7f3b00e adding file 2 * df2fb7a adding file 1 You can see b1 which had 1 commit. That commit's parent was 7f3b00e . But since we rebase it on master ( 60dc441 ). That becomes the parent now. As a side effect, you also see it has become a single line of history. Now if we were to merge b1 into master , it would simply mean change master to point to 5372c8f which is b1 . Let's try it: # checkout to master since we want to merge code into master spatel1-mn1:school-of-sre spatel1$ git checkout master Switched to branch 'master' # the current history, where b1 is based on master spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 5372c8f (b1) adding b1 file * 60dc441 (HEAD -> master) adding master.txt file * 7f3b00e adding file 2 * df2fb7a adding file 1 # Performing the merge, notice the \"fast-forward\" message spatel1-mn1:school-of-sre spatel1$ git merge b1 Updating 60dc441..5372c8f Fast-forward b1.txt | 1 + 1 file changed, 1 insertion(+) create mode 100644 b1.txt # The Result spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 5372c8f (HEAD -> master, b1) adding b1 file * 60dc441 adding master.txt file * 7f3b00e adding file 2 * df2fb7a adding file 1 Now you see both b1 and master are pointing to the same commit. Your code has been merged to the master branch and it can be pushed. Also we have clean line of history! :D","title":"Working With Branches"},{"location":"git/branches/#working-with-branches","text":"Coming back to our local repo which has two commits. So far, what we have is a single line of history. Commits are chained in a single line. But sometimes you may have a need to work on two different features in parallel in the same repo. Now one option here could be making a new folder/repo with the same code and use that for another feature development. But there's a better way. Use branches. Since git follows tree like structure for commits, we can use branches to work on different sets of features. From a commit, two or more branches can be created and branches can also be merged. Using branches, there can exist multiple lines of histories and we can checkout to any of them and work on it. Checking out, as we discussed earlier, would simply mean replacing contents of the directory (repo) with the snapshot at the checked out version. Let's create a branch and see how it looks like: spatel1-mn1:school-of-sre spatel1$ git branch b1 spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD -> master, b1) adding file 2 * df2fb7a adding file 1 We create a branch called b1 . Git log tells us that b1 also points to the last commit (7f3b00e) but the HEAD is still pointing to master. If you remember, HEAD points to the commit/reference wherever you are checkout to. So if we checkout to b1 , HEAD should point to that. Let's confirm: spatel1-mn1:school-of-sre spatel1$ git checkout b1 Switched to branch 'b1' spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD -> b1, master) adding file 2 * df2fb7a adding file 1 b1 still points to the same commit but HEAD now points to b1 . Since we create a branch at commit 7f3b00e , there will be two lines of histories starting this commit. Depending on which branch you are checked out on, the line of history will progress. At this moment, we are checked out on branch b1 , so making a new commit will advance branch reference b1 to that commit and current b1 commit will become its parent. Let's do that. # Creating a file and making a commit spatel1-mn1:school-of-sre spatel1$ echo \"I am a file in b1 branch\" > b1.txt spatel1-mn1:school-of-sre spatel1$ git add b1.txt spatel1-mn1:school-of-sre spatel1$ git commit -m \"adding b1 file\" [b1 872a38f] adding b1 file 1 file changed, 1 insertion(+) create mode 100644 b1.txt # The new line of history spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 872a38f (HEAD -> b1) adding b1 file * 7f3b00e (master) adding file 2 * df2fb7a adding file 1 spatel1-mn1:school-of-sre spatel1$ Do note that master is still pointing to the old commit it was pointing to. We can now checkout to master branch and make commits there. This will result in another line of history starting from commit 7f3b00e. # checkout to master branch spatel1-mn1:school-of-sre spatel1$ git checkout master Switched to branch 'master' # Creating a new commit on master branch spatel1-mn1:school-of-sre spatel1$ echo \"new file in master branch\" > master.txt spatel1-mn1:school-of-sre spatel1$ git add master.txt spatel1-mn1:school-of-sre spatel1$ git commit -m \"adding master.txt file\" [master 60dc441] adding master.txt file 1 file changed, 1 insertion(+) create mode 100644 master.txt # The history line spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 60dc441 (HEAD -> master) adding master.txt file * 7f3b00e adding file 2 * df2fb7a adding file 1 Notice how branch b1 is not visible here since we are on the master. Let's try to visualize both to get the whole picture: spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 60dc441 (HEAD -> master) adding master.txt file | * 872a38f (b1) adding b1 file |/ * 7f3b00e adding file 2 * df2fb7a adding file 1 Above tree structure should make things clear. Notice a clear branch/fork on commit 7f3b00e. This is how we create branches. Now they both are two separate lines of history on which feature development can be done independently. To reiterate, internally, git is just a tree of commits. Branch names (human readable) are pointers to those commits in the tree. We use various git commands to work with the tree structure and references. Git accordingly modifies contents of our repo.","title":"Working With Branches"},{"location":"git/branches/#merges","text":"Now say the feature you were working on branch b1 is complete and you need to merge it on master branch, where all the final version of code goes. So first you will checkout to branch master and then you pull the latest code from upstream (eg: GitHub). Then you need to merge your code from b1 into master. There could be two ways this can be done. Here is the current history: spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 60dc441 (HEAD -> master) adding master.txt file | * 872a38f (b1) adding b1 file |/ * 7f3b00e adding file 2 * df2fb7a adding file 1 Option 1: Directly merge the branch. Merging the branch b1 into master will result in a new merge commit. This will merge changes from two different lines of history and create a new commit of the result. spatel1-mn1:school-of-sre spatel1$ git merge b1 Merge made by the 'recursive' strategy. b1.txt | 1 + 1 file changed, 1 insertion(+) create mode 100644 b1.txt spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 8fc28f9 (HEAD -> master) Merge branch 'b1' |\\ | * 872a38f (b1) adding b1 file * | 60dc441 adding master.txt file |/ * 7f3b00e adding file 2 * df2fb7a adding file 1 You can see a new merge commit created (8fc28f9). You will be prompted for the commit message. If there are a lot of branches in the repo, this result will end-up with a lot of merge commits. Which looks ugly compared to a single line of history of development. So let's look at an alternative approach First let's reset our last merge and go to the previous state. spatel1-mn1:school-of-sre spatel1$ git reset --hard 60dc441 HEAD is now at 60dc441 adding master.txt file spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 60dc441 (HEAD -> master) adding master.txt file | * 872a38f (b1) adding b1 file |/ * 7f3b00e adding file 2 * df2fb7a adding file 1 Option 2: Rebase. Now, instead of merging two branches which has a similar base (commit: 7f3b00e), let us rebase branch b1 on to current master. What this means is take branch b1 (from commit 7f3b00e to commit 872a38f) and rebase (put them on top of) master (60dc441). # Switch to b1 spatel1-mn1:school-of-sre spatel1$ git checkout b1 Switched to branch 'b1' # Rebase (b1 which is current branch) on master spatel1-mn1:school-of-sre spatel1$ git rebase master First, rewinding head to replay your work on top of it... Applying: adding b1 file # The result spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 5372c8f (HEAD -> b1) adding b1 file * 60dc441 (master) adding master.txt file * 7f3b00e adding file 2 * df2fb7a adding file 1 You can see b1 which had 1 commit. That commit's parent was 7f3b00e . But since we rebase it on master ( 60dc441 ). That becomes the parent now. As a side effect, you also see it has become a single line of history. Now if we were to merge b1 into master , it would simply mean change master to point to 5372c8f which is b1 . Let's try it: # checkout to master since we want to merge code into master spatel1-mn1:school-of-sre spatel1$ git checkout master Switched to branch 'master' # the current history, where b1 is based on master spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 5372c8f (b1) adding b1 file * 60dc441 (HEAD -> master) adding master.txt file * 7f3b00e adding file 2 * df2fb7a adding file 1 # Performing the merge, notice the \"fast-forward\" message spatel1-mn1:school-of-sre spatel1$ git merge b1 Updating 60dc441..5372c8f Fast-forward b1.txt | 1 + 1 file changed, 1 insertion(+) create mode 100644 b1.txt # The Result spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 5372c8f (HEAD -> master, b1) adding b1 file * 60dc441 adding master.txt file * 7f3b00e adding file 2 * df2fb7a adding file 1 Now you see both b1 and master are pointing to the same commit. Your code has been merged to the master branch and it can be pushed. Also we have clean line of history! :D","title":"Merges"},{"location":"git/conclusion/","text":"What next from here? There are a lot of git commands and features which we have not explored here. But with the base built-up, be sure to explore concepts like Cherrypick Squash Amend Stash Reset","title":"Conclusion"},{"location":"git/conclusion/#what-next-from-here","text":"There are a lot of git commands and features which we have not explored here. But with the base built-up, be sure to explore concepts like Cherrypick Squash Amend Stash Reset","title":"What next from here?"},{"location":"git/git-basics/","text":"Git Prerequisites Have Git installed https://git-scm.com/downloads Have taken any git high level tutorial or following LinkedIn learning courses https://www.linkedin.com/learning/git-essential-training-the-basics/ https://www.linkedin.com/learning/git-branches-merges-and-remotes/ The Official Git Docs What to expect from this course As an engineer in the field of computer science, having knowledge of version control tools becomes almost a requirement. While there are a lot of version control tools that exist today like SVN, Mercurial, etc, Git perhaps is the most used one and this course we will be working with Git. While this course does not start with Git 101 and expects basic knowledge of git as a prerequisite, it will reintroduce the git concepts known by you with details covering what is happening under the hood as you execute various git commands. So that next time you run a git command, you will be able to press enter more confidently! What is not covered under this course Advanced usage and specifics of internal implementation details of Git. Course Contents Git Basics Working with Branches Git with Github Hooks Git Basics Though you might be aware already, let's revisit why we need a version control system. As the project grows and multiple developers start working on it, an efficient method for collaboration is warranted. Git helps the team collaborate easily and also maintains the history of the changes happening with the codebase. Creating a Git Repo Any folder can be converted into a git repository. After executing the following command, we will see a .git folder within the folder, which makes our folder a git repository. All the magic that git does, .git folder is the enabler for the same. # creating an empty folder and changing current dir to it spatel1-mn1:~ spatel1$ cd /tmp spatel1-mn1:tmp spatel1$ mkdir school-of-sre spatel1-mn1:tmp spatel1$ cd school-of-sre/ # initialize a git repo spatel1-mn1:school-of-sre spatel1$ git init Initialized empty Git repository in /private/tmp/school-of-sre/.git/ As the output says, an empty git repo has been initialized in our folder. Let's take a look at what is there. spatel1-mn1:school-of-sre spatel1$ ls .git/ HEAD config description hooks info objects refs There are a bunch of folders and files in the .git folder. As I said, all these enables git to do its magic. We will look into some of these folders and files. But for now, what we have is an empty git repository. Tracking a File Now as you might already know, let us create a new file in our repo (we will refer to the folder as repo now.) And see git status spatel1-mn1:school-of-sre spatel1$ echo \"I am file 1\" > file1.txt spatel1-mn1:school-of-sre spatel1$ git status On branch master No commits yet Untracked files: (use \"git add <file>...\" to include in what will be committed) file1.txt nothing added to commit but untracked files present (use \"git add\" to track) The current git status says No commits yet and there is one untracked file. Since we just created the file, git is not tracking that file. We explicitly need to ask git to track files and folders. (also checkout gitignore ) And how we do that is via git add command as suggested in the above output. Then we go ahead and create a commit. spatel1-mn1:school-of-sre spatel1$ git add file1.txt spatel1-mn1:school-of-sre spatel1$ git status On branch master No commits yet Changes to be committed: (use \"git rm --cached <file>...\" to unstage) new file: file1.txt spatel1-mn1:school-of-sre spatel1$ git commit -m \"adding file 1\" [master (root-commit) df2fb7a] adding file 1 1 file changed, 1 insertion(+) create mode 100644 file1.txt Notice how after adding the file, git status says Changes to be committed: . What it means is whatever is listed there, will be included in the next commit. Then we go ahead and create a commit, with an attached messaged via -m . More About a Commit Commit is a snapshot of the repo. Whenever a commit is made, a snapshot of the current state of repo (the folder) is taken and saved. Each commit has a unique ID. ( df2fb7a for the commit we made in the previous step). As we keep adding/changing more and more contents and keep making commits, all those snapshots are stored by git. Again, all this magic happens inside the .git folder. This is where all this snapshot or versions are stored in an efficient manner. Adding More Changes Let us create one more file and commit the change. It would look the same as the previous commit we made. spatel1-mn1:school-of-sre spatel1$ echo \"I am file 2\" > file2.txt spatel1-mn1:school-of-sre spatel1$ git add file2.txt spatel1-mn1:school-of-sre spatel1$ git commit -m \"adding file 2\" [master 7f3b00e] adding file 2 1 file changed, 1 insertion(+) create mode 100644 file2.txt A new commit with ID 7f3b00e has been created. You can issue git status at any time to see the state of the repository. **IMPORTANT: Note that commit IDs are long string (SHA) but we can refer to a commit by its initial few (8 or more) characters too. We will interchangeably using shorter and longer commit IDs.** Now that we have two commits, let's visualize them: spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD -> master) adding file 2 * df2fb7a adding file 1 git log , as the name suggests, prints the log of all the git commits. Here you see two additional arguments, --oneline prints the shorter version of the log, ie: the commit message only and not the person who made the commit and when. --graph prints it in graph format. Now at this moment the commits might look like just one in each line but all commits are stored as a tree like data structure internally by git. That means there can be two or more children commits of a given commit. And not just a single line of commits. We will look more into this part when we get to the Branches section. For now this is our commit history: df2fb7a ===> 7f3b00e Are commits really linked? As I just said, the two commits we just made are linked via tree like data structure and we saw how they are linked. But let's actually verify it. Everything in git is an object. Newly created files are stored as an object. Changes to file are stored as an objects and even commits are objects. To view contents of an object we can use the following command with the object's ID. We will take a look at the contents of the second commit spatel1-mn1:school-of-sre spatel1$ git cat-file -p 7f3b00e tree ebf3af44d253e5328340026e45a9fa9ae3ea1982 parent df2fb7a61f5d40c1191e0fdeb0fc5d6e7969685a author Sanket Patel <spatel1@linkedin.com> 1603273316 -0700 committer Sanket Patel <spatel1@linkedin.com> 1603273316 -0700 adding file 2 Take a note of parent attribute in the above output. It points to the commit id of the first commit we made. So this proves that they are linked! Additionally you can see the second commit's message in this object. As I said all this magic is enabled by .git folder and the object to which we are looking at also is in that folder. spatel1-mn1:school-of-sre spatel1$ ls .git/objects/7f/3b00eaa957815884198e2fdfec29361108d6a9 .git/objects/7f/3b00eaa957815884198e2fdfec29361108d6a9 It is stored in .git/objects/ folder. All the files and changes to them as well are stored in this folder. The Version Control part of Git We already can see two commits (versions) in our git log. One thing a version control tool gives you is ability to browse back and forth in history. For example: some of your users are running an old version of code and they are reporting an issue. In order to debug the issue, you need access to the old code. The one in your current repo is the latest code. In this example, you are working on the second commit (7f3b00e) and someone reported an issue with the code snapshot at commit (df2fb7a). This is how you would get access to the code at any older commit # Current contents, two files present patel1-mn1:school-of-sre spatel1$ ls file1.txt file2.txt # checking out to (an older) commit spatel1-mn1:school-of-sre spatel1$ git checkout df2fb7a Note: checking out 'df2fb7a'. You are in 'detached HEAD' state. You can look around, make experimental changes and commit them, and you can discard any commits you make in this state without impacting any branches by performing another checkout. If you want to create a new branch to retain commits you create, you may do so (now or later) by using -b with the checkout command again. Example: git checkout -b <new-branch-name> HEAD is now at df2fb7a adding file 1 # checking contents, can verify it has old contents spatel1-mn1:school-of-sre spatel1$ ls file1.txt So this is how we would get access to old versions/snapshots. All we need is a reference to that snapshot. Upon executing git checkout ... , what git does for you is use the .git folder, see what was the state of things (files and folders) at that version/reference and replace the contents of current directory with those contents. The then-existing content will no longer be present in the local dir (repo) but we can and will still get access to them because they are tracked via git commit and .git folder has them stored/tracked. Reference I mention in the previous section that we need a reference to the version. By default, git repo is made of tree of commits. And each commit has a unique IDs. But the unique ID is not the only thing we can reference commits via. There are multiple ways to reference commits. For example: HEAD is a reference to current commit. Whatever commit your repo is checked out at, HEAD will point to that. HEAD~1 is reference to previous commit. So while checking out previous version in section above, we could have done git checkout HEAD~1 . Similarly, master is also a reference (to a branch). Since git uses tree like structure to store commits, there of course will be branches. And the default branch is called master . Master (or any branch reference) will point to the latest commit in the branch. Even though we have checked out to the previous commit in out repo, master still points to the latest commit. And we can get back to the latest version by checkout at master reference spatel1-mn1:school-of-sre spatel1$ git checkout master Previous HEAD position was df2fb7a adding file 1 Switched to branch 'master' # now we will see latest code, with two files spatel1-mn1:school-of-sre spatel1$ ls file1.txt file2.txt Note, instead of master in above command, we could have used commit's ID as well. References and The Magic Let's look at the state of things. Two commits, master and HEAD references are pointing to the latest commit spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD -> master) adding file 2 * df2fb7a adding file 1 The magic? Let's examine these files: spatel1-mn1:school-of-sre spatel1$ cat .git/refs/heads/master 7f3b00eaa957815884198e2fdfec29361108d6a9 Viola! Where master is pointing to is stored in a file. Whenever git needs to know where master reference is pointing to, or if git needs to update where master points, it just needs to update the file above. So when you create a new commit, a new commit is created on top of the current commit and the master file is updated with the new commit's ID. Similary, for HEAD reference: spatel1-mn1:school-of-sre spatel1$ cat .git/HEAD ref: refs/heads/master We can see HEAD is pointing to a reference called refs/heads/master . So HEAD will point where ever the master points. Little Adventure We discussed how git will update the files as we execute commands. But let's try to do it ourselves, by hand, and see what happens. spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD -> master) adding file 2 * df2fb7a adding file 1 Now let's change master to point to the previous/first commit. spatel1-mn1:school-of-sre spatel1$ echo df2fb7a61f5d40c1191e0fdeb0fc5d6e7969685a > .git/refs/heads/master spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * df2fb7a (HEAD -> master) adding file 1 # RESETTING TO ORIGINAL spatel1-mn1:school-of-sre spatel1$ echo 7f3b00eaa957815884198e2fdfec29361108d6a9 > .git/refs/heads/master spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD -> master) adding file 2 * df2fb7a adding file 1 We just edited the master reference file and now we can see only the first commit in git log. Undoing the change to the file brings the state back to original. Not so much of magic, is it?","title":"Git Basics"},{"location":"git/git-basics/#git","text":"","title":"Git"},{"location":"git/git-basics/#prerequisites","text":"Have Git installed https://git-scm.com/downloads Have taken any git high level tutorial or following LinkedIn learning courses https://www.linkedin.com/learning/git-essential-training-the-basics/ https://www.linkedin.com/learning/git-branches-merges-and-remotes/ The Official Git Docs","title":"Prerequisites"},{"location":"git/git-basics/#what-to-expect-from-this-course","text":"As an engineer in the field of computer science, having knowledge of version control tools becomes almost a requirement. While there are a lot of version control tools that exist today like SVN, Mercurial, etc, Git perhaps is the most used one and this course we will be working with Git. While this course does not start with Git 101 and expects basic knowledge of git as a prerequisite, it will reintroduce the git concepts known by you with details covering what is happening under the hood as you execute various git commands. So that next time you run a git command, you will be able to press enter more confidently!","title":"What to expect from this course"},{"location":"git/git-basics/#what-is-not-covered-under-this-course","text":"Advanced usage and specifics of internal implementation details of Git.","title":"What is not covered under this course"},{"location":"git/git-basics/#course-contents","text":"Git Basics Working with Branches Git with Github Hooks","title":"Course Contents"},{"location":"git/git-basics/#git-basics","text":"Though you might be aware already, let's revisit why we need a version control system. As the project grows and multiple developers start working on it, an efficient method for collaboration is warranted. Git helps the team collaborate easily and also maintains the history of the changes happening with the codebase.","title":"Git Basics"},{"location":"git/git-basics/#creating-a-git-repo","text":"Any folder can be converted into a git repository. After executing the following command, we will see a .git folder within the folder, which makes our folder a git repository. All the magic that git does, .git folder is the enabler for the same. # creating an empty folder and changing current dir to it spatel1-mn1:~ spatel1$ cd /tmp spatel1-mn1:tmp spatel1$ mkdir school-of-sre spatel1-mn1:tmp spatel1$ cd school-of-sre/ # initialize a git repo spatel1-mn1:school-of-sre spatel1$ git init Initialized empty Git repository in /private/tmp/school-of-sre/.git/ As the output says, an empty git repo has been initialized in our folder. Let's take a look at what is there. spatel1-mn1:school-of-sre spatel1$ ls .git/ HEAD config description hooks info objects refs There are a bunch of folders and files in the .git folder. As I said, all these enables git to do its magic. We will look into some of these folders and files. But for now, what we have is an empty git repository.","title":"Creating a Git Repo"},{"location":"git/git-basics/#tracking-a-file","text":"Now as you might already know, let us create a new file in our repo (we will refer to the folder as repo now.) And see git status spatel1-mn1:school-of-sre spatel1$ echo \"I am file 1\" > file1.txt spatel1-mn1:school-of-sre spatel1$ git status On branch master No commits yet Untracked files: (use \"git add <file>...\" to include in what will be committed) file1.txt nothing added to commit but untracked files present (use \"git add\" to track) The current git status says No commits yet and there is one untracked file. Since we just created the file, git is not tracking that file. We explicitly need to ask git to track files and folders. (also checkout gitignore ) And how we do that is via git add command as suggested in the above output. Then we go ahead and create a commit. spatel1-mn1:school-of-sre spatel1$ git add file1.txt spatel1-mn1:school-of-sre spatel1$ git status On branch master No commits yet Changes to be committed: (use \"git rm --cached <file>...\" to unstage) new file: file1.txt spatel1-mn1:school-of-sre spatel1$ git commit -m \"adding file 1\" [master (root-commit) df2fb7a] adding file 1 1 file changed, 1 insertion(+) create mode 100644 file1.txt Notice how after adding the file, git status says Changes to be committed: . What it means is whatever is listed there, will be included in the next commit. Then we go ahead and create a commit, with an attached messaged via -m .","title":"Tracking a File"},{"location":"git/git-basics/#more-about-a-commit","text":"Commit is a snapshot of the repo. Whenever a commit is made, a snapshot of the current state of repo (the folder) is taken and saved. Each commit has a unique ID. ( df2fb7a for the commit we made in the previous step). As we keep adding/changing more and more contents and keep making commits, all those snapshots are stored by git. Again, all this magic happens inside the .git folder. This is where all this snapshot or versions are stored in an efficient manner.","title":"More About a Commit"},{"location":"git/git-basics/#adding-more-changes","text":"Let us create one more file and commit the change. It would look the same as the previous commit we made. spatel1-mn1:school-of-sre spatel1$ echo \"I am file 2\" > file2.txt spatel1-mn1:school-of-sre spatel1$ git add file2.txt spatel1-mn1:school-of-sre spatel1$ git commit -m \"adding file 2\" [master 7f3b00e] adding file 2 1 file changed, 1 insertion(+) create mode 100644 file2.txt A new commit with ID 7f3b00e has been created. You can issue git status at any time to see the state of the repository. **IMPORTANT: Note that commit IDs are long string (SHA) but we can refer to a commit by its initial few (8 or more) characters too. We will interchangeably using shorter and longer commit IDs.** Now that we have two commits, let's visualize them: spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD -> master) adding file 2 * df2fb7a adding file 1 git log , as the name suggests, prints the log of all the git commits. Here you see two additional arguments, --oneline prints the shorter version of the log, ie: the commit message only and not the person who made the commit and when. --graph prints it in graph format. Now at this moment the commits might look like just one in each line but all commits are stored as a tree like data structure internally by git. That means there can be two or more children commits of a given commit. And not just a single line of commits. We will look more into this part when we get to the Branches section. For now this is our commit history: df2fb7a ===> 7f3b00e","title":"Adding More Changes"},{"location":"git/git-basics/#are-commits-really-linked","text":"As I just said, the two commits we just made are linked via tree like data structure and we saw how they are linked. But let's actually verify it. Everything in git is an object. Newly created files are stored as an object. Changes to file are stored as an objects and even commits are objects. To view contents of an object we can use the following command with the object's ID. We will take a look at the contents of the second commit spatel1-mn1:school-of-sre spatel1$ git cat-file -p 7f3b00e tree ebf3af44d253e5328340026e45a9fa9ae3ea1982 parent df2fb7a61f5d40c1191e0fdeb0fc5d6e7969685a author Sanket Patel <spatel1@linkedin.com> 1603273316 -0700 committer Sanket Patel <spatel1@linkedin.com> 1603273316 -0700 adding file 2 Take a note of parent attribute in the above output. It points to the commit id of the first commit we made. So this proves that they are linked! Additionally you can see the second commit's message in this object. As I said all this magic is enabled by .git folder and the object to which we are looking at also is in that folder. spatel1-mn1:school-of-sre spatel1$ ls .git/objects/7f/3b00eaa957815884198e2fdfec29361108d6a9 .git/objects/7f/3b00eaa957815884198e2fdfec29361108d6a9 It is stored in .git/objects/ folder. All the files and changes to them as well are stored in this folder.","title":"Are commits really linked?"},{"location":"git/git-basics/#the-version-control-part-of-git","text":"We already can see two commits (versions) in our git log. One thing a version control tool gives you is ability to browse back and forth in history. For example: some of your users are running an old version of code and they are reporting an issue. In order to debug the issue, you need access to the old code. The one in your current repo is the latest code. In this example, you are working on the second commit (7f3b00e) and someone reported an issue with the code snapshot at commit (df2fb7a). This is how you would get access to the code at any older commit # Current contents, two files present patel1-mn1:school-of-sre spatel1$ ls file1.txt file2.txt # checking out to (an older) commit spatel1-mn1:school-of-sre spatel1$ git checkout df2fb7a Note: checking out 'df2fb7a'. You are in 'detached HEAD' state. You can look around, make experimental changes and commit them, and you can discard any commits you make in this state without impacting any branches by performing another checkout. If you want to create a new branch to retain commits you create, you may do so (now or later) by using -b with the checkout command again. Example: git checkout -b <new-branch-name> HEAD is now at df2fb7a adding file 1 # checking contents, can verify it has old contents spatel1-mn1:school-of-sre spatel1$ ls file1.txt So this is how we would get access to old versions/snapshots. All we need is a reference to that snapshot. Upon executing git checkout ... , what git does for you is use the .git folder, see what was the state of things (files and folders) at that version/reference and replace the contents of current directory with those contents. The then-existing content will no longer be present in the local dir (repo) but we can and will still get access to them because they are tracked via git commit and .git folder has them stored/tracked.","title":"The Version Control part of Git"},{"location":"git/git-basics/#reference","text":"I mention in the previous section that we need a reference to the version. By default, git repo is made of tree of commits. And each commit has a unique IDs. But the unique ID is not the only thing we can reference commits via. There are multiple ways to reference commits. For example: HEAD is a reference to current commit. Whatever commit your repo is checked out at, HEAD will point to that. HEAD~1 is reference to previous commit. So while checking out previous version in section above, we could have done git checkout HEAD~1 . Similarly, master is also a reference (to a branch). Since git uses tree like structure to store commits, there of course will be branches. And the default branch is called master . Master (or any branch reference) will point to the latest commit in the branch. Even though we have checked out to the previous commit in out repo, master still points to the latest commit. And we can get back to the latest version by checkout at master reference spatel1-mn1:school-of-sre spatel1$ git checkout master Previous HEAD position was df2fb7a adding file 1 Switched to branch 'master' # now we will see latest code, with two files spatel1-mn1:school-of-sre spatel1$ ls file1.txt file2.txt Note, instead of master in above command, we could have used commit's ID as well.","title":"Reference"},{"location":"git/git-basics/#references-and-the-magic","text":"Let's look at the state of things. Two commits, master and HEAD references are pointing to the latest commit spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD -> master) adding file 2 * df2fb7a adding file 1 The magic? Let's examine these files: spatel1-mn1:school-of-sre spatel1$ cat .git/refs/heads/master 7f3b00eaa957815884198e2fdfec29361108d6a9 Viola! Where master is pointing to is stored in a file. Whenever git needs to know where master reference is pointing to, or if git needs to update where master points, it just needs to update the file above. So when you create a new commit, a new commit is created on top of the current commit and the master file is updated with the new commit's ID. Similary, for HEAD reference: spatel1-mn1:school-of-sre spatel1$ cat .git/HEAD ref: refs/heads/master We can see HEAD is pointing to a reference called refs/heads/master . So HEAD will point where ever the master points.","title":"References and The Magic"},{"location":"git/git-basics/#little-adventure","text":"We discussed how git will update the files as we execute commands. But let's try to do it ourselves, by hand, and see what happens. spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD -> master) adding file 2 * df2fb7a adding file 1 Now let's change master to point to the previous/first commit. spatel1-mn1:school-of-sre spatel1$ echo df2fb7a61f5d40c1191e0fdeb0fc5d6e7969685a > .git/refs/heads/master spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * df2fb7a (HEAD -> master) adding file 1 # RESETTING TO ORIGINAL spatel1-mn1:school-of-sre spatel1$ echo 7f3b00eaa957815884198e2fdfec29361108d6a9 > .git/refs/heads/master spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD -> master) adding file 2 * df2fb7a adding file 1 We just edited the master reference file and now we can see only the first commit in git log. Undoing the change to the file brings the state back to original. Not so much of magic, is it?","title":"Little Adventure"},{"location":"git/github-hooks/","text":"Git with Github Till now all the operations we did were in our local repo while git also helps us in a collaborative environment. GitHub is one place on the internet where you can centrally host your git repos and collaborate with other developers. Most of the workflow will remain the same as we discussed, with addition of couple of things: Pull: to pull latest changes from github (the central) repo Push: to push your changes to github repo so that it's available to all people GitHub has written nice guides and tutorials about this and you can refer them here: GitHub Hello World Git Handbook Hooks Git has another nice feature called hooks. Hooks are basically scripts which will be called when a certain event happens. Here is where hooks are located: spatel1-mn1:school-of-sre spatel1$ ls .git/hooks/ applypatch-msg.sample fsmonitor-watchman.sample pre-applypatch.sample pre-push.sample pre-receive.sample update.sample commit-msg.sample post-update.sample pre-commit.sample pre-rebase.sample prepare-commit-msg.sample Names are self explanatory. These hooks are useful when you want to do certain things when a certain event happens. If you want to run tests before pushing code, you would want to setup pre-push hooks. Let's try to create a pre commit hook. spatel1-mn1:school-of-sre spatel1$ echo \"echo this is from pre commit hook\" > .git/hooks/pre-commit spatel1-mn1:school-of-sre spatel1$ chmod +x .git/hooks/pre-commit We basically create a file called pre-commit in hooks folder and make it executable. Now if we make a commit, we should see the message getting printed. spatel1-mn1:school-of-sre spatel1$ echo \"sample file\" > sample.txt spatel1-mn1:school-of-sre spatel1$ git add sample.txt spatel1-mn1:school-of-sre spatel1$ git commit -m \"adding sample file\" this is from pre commit hook # <===== THE MESSAGE FROM HOOK EXECUTION [master 9894e05] adding sample file 1 file changed, 1 insertion(+) create mode 100644 sample.txt","title":"Github and Hooks"},{"location":"git/github-hooks/#git-with-github","text":"Till now all the operations we did were in our local repo while git also helps us in a collaborative environment. GitHub is one place on the internet where you can centrally host your git repos and collaborate with other developers. Most of the workflow will remain the same as we discussed, with addition of couple of things: Pull: to pull latest changes from github (the central) repo Push: to push your changes to github repo so that it's available to all people GitHub has written nice guides and tutorials about this and you can refer them here: GitHub Hello World Git Handbook","title":"Git with Github"},{"location":"git/github-hooks/#hooks","text":"Git has another nice feature called hooks. Hooks are basically scripts which will be called when a certain event happens. Here is where hooks are located: spatel1-mn1:school-of-sre spatel1$ ls .git/hooks/ applypatch-msg.sample fsmonitor-watchman.sample pre-applypatch.sample pre-push.sample pre-receive.sample update.sample commit-msg.sample post-update.sample pre-commit.sample pre-rebase.sample prepare-commit-msg.sample Names are self explanatory. These hooks are useful when you want to do certain things when a certain event happens. If you want to run tests before pushing code, you would want to setup pre-push hooks. Let's try to create a pre commit hook. spatel1-mn1:school-of-sre spatel1$ echo \"echo this is from pre commit hook\" > .git/hooks/pre-commit spatel1-mn1:school-of-sre spatel1$ chmod +x .git/hooks/pre-commit We basically create a file called pre-commit in hooks folder and make it executable. Now if we make a commit, we should see the message getting printed. spatel1-mn1:school-of-sre spatel1$ echo \"sample file\" > sample.txt spatel1-mn1:school-of-sre spatel1$ git add sample.txt spatel1-mn1:school-of-sre spatel1$ git commit -m \"adding sample file\" this is from pre commit hook # <===== THE MESSAGE FROM HOOK EXECUTION [master 9894e05] adding sample file 1 file changed, 1 insertion(+) create mode 100644 sample.txt","title":"Hooks"},{"location":"linux_basics/command_line_basics/","text":"Command Line Basics Lab Environment Setup One can use an online bash interpreter to run all the commands that are provided as examples in this course. This will also help you in getting a hands-on experience of various linux commands. REPL is one of the popular online bash interpreters for running linux commands. We will be using it for running all the commands mentioned in this course. What is a Command A command is a program that tells the operating system to perform specific work. Programs are stored as files in linux. Therefore, a command is also a file which is stored somewhere on the disk. Commands may also take additional arguments as input from the user. These arguments are called command line arguments. Knowing how to use the commands is important and there are many ways to get help in Linux, especially for commands. Almost every command will have some form of documentation, most commands will have a command-line argument -h or --help that will display a reasonable amount of documentation. But the most popular documentation system in Linux is called man pages - short for manual pages. Using --help to show the documentation for ls command. File System Organization The linux file system has a hierarchical (or tree-like) structure with its highest level directory called root ( denoted by / ). Directories present inside the root directory stores file related to the system. These directories in turn can either store system files or application files or user related files. bin | The executable program of most commonly used commands reside in bin directory sbin | This directory contains programs used for system administration. home | This directory contains user related files and directories. lib | This directory contains all the library files etc | This directory contains all the system configuration files proc | This directory contains files related to the running processes on the system dev | This directory contains files related to devices on the system mnt | This directory contains files related to mounted devices on the system tmp | This directory is used to store temporary files on the system usr | This directory is used to store application programs on the system Commands for Navigating the File System There are three basic commands which are used frequently to navigate the file system: ls pwd cd We will now try to understand what each command does and how to use these commands. You should also practice the given examples on the online bash shell. pwd (print working directory) At any given moment of time, we will be standing in a certain directory. To get the name of the directory in which we are standing, we can use the pwd command in linux. We will now use the cd command to move to a different directory and then print the working directory. cd (change directory) The cd command can be used to change the working directory. Using the command, you can move from one directory to another. In the below example, we are initially in the root directory. we have then used the cd command to change the directory. ls (list files and directories)** The ls command is used to list the contents of a directory. It will list down all the files and folders present in the given directory. If we just type ls in the shell, it will list all the files and directories present in the current directory. We can also provide the directory name as argument to ls command. It will then list all the files and directories inside the given directory. Commands for Manipulating Files There are four basic commands which are used frequently to manipulate files: touch mkdir cp mv rm We will now try to understand what each command does and how to use these commands. You should also practice the given examples on the online bash shell. touch (create new file) The touch command can be used to create an empty new file. This command is very useful for many other purposes but we will discuss the simplest use case of creating a new file. General syntax of using touch command touch <file_name> mkdir (create new directories) The mkdir command is used to create directories.You can use ls command to verify that the new directory is created. General syntax of using mkdir command mkdir <directory_name> rm (delete files and directories) The rm command can be used to delete files and directories. It is very important to note that this command permanently deletes the files and directories. It's almost impossible to recover these files and directories once you have executed rm command on them successfully. Do run this command with care. General syntax of using rm command: rm <file_name> Let's try to understand the rm command with an example. We will try to delete the file and directory we created using touch and mkdir command respectively. cp (copy files and directories) The cp command is used to copy files and directories from one location to another. Do note that the cp command doesn't do any change to the original files or directories. The original files or directories and their copy both co-exist after running cp command successfully. General syntax of using cp command: cp <source_path> <destination_path> We are currently in the '/home/runner' directory. We will use the mkdir command to create a new directory named \"test_directory\". We will now try to copy the \"_test_runner.py\" file to the directory we created just now. Do note that nothing happened to the original \"_test_runner.py\" file. It's still there in the current directory. A new copy of it got created inside the \"test_directory\". We can also use the cp command to copy the whole directory from one location to another. Let's try to understand this with an example. We again used the mkdir command to create a new directory called \"another_directory\". We then used the cp command along with an additional argument '-r' to copy the \"test_directory\". mv (move files and directories) The mv command can either be used to move files or directories from one location to another or it can be used to rename files or directories. Do note that moving files and copying them are very different. When you move the files or directories, the original copy is lost. General syntax of using mv command: mv <source_path> <destination_path> In this example, we will use the mv command to move the \"_test_runner.py\" file to \"test_directory\". In this case, this file already exists in \"test_directory\". The mv command will just replace it. Do note that the original file doesn't exist in the current directory after mv command ran successfully. We can also use the mv command to move a directory from one location to another. In this case, we do not need to use the '-r' flag that we did while using the cp command. Do note that the original directory will not exist if we use mv command. One of the important uses of the mv command is to rename files and directories. Let's see how we can use this command for renaming. We have first changed our location to \"test_directory\". We then use the mv command to rename the \"\"_test_runner.py\" file to \"test.py\". Commands for Viewing Files There are three basic commands which are used frequently to view the files: cat head tail We will now try to understand what each command does and how to use these commands. You should also practice the given examples on the online bash shell. We will create a new file called \"numbers.txt\" and insert numbers from 1 to 100 in this file. Each number will be in a separate line. Do not worry about the above command now. It's an advanced command which is used to generate numbers. We have then used a redirection operator to push these numbers to the file. We will be discussing I/O redirection in the later sections. cat The most simplest use of cat command is to print the contents of the file on your output screen. This command is very useful and can be used for many other purposes. We will study about other use cases later. You can try to run the above command and you will see numbers being printed from 1 to 100 on your screen. You will need to scroll up to view all the numbers. head The head command displays the first 10 lines of the file by default. We can include additional arguments to display as many lines as we want from the top. In this example, we are only able to see the first 10 lines from the file when we use the head command. By default, head command will only display the first 10 lines. If we want to specify the number of lines we want to see from start, use the '-n' argument to provide the input. tail The tail command displays the last 10 lines of the file by default. We can include additional arguments to display as many lines as we want from the end of the file. By default, the tail command will only display the last 10 lines. If we want to specify the number of lines we want to see from the end, use '-n' argument to provide the input. In this example, we are only able to see the last 5 lines from the file when we use the tail command with explicit -n option. Echo Command in Linux The echo command is one of the simplest commands that is used in the shell. This command is equivalent to what we have in other programming languages. The echo command prints the given input string on the screen. Text Processing Commands In the previous section, we learned how to view the content of a file. In many cases, we will be interested in performing the below operations: Print only the lines which contain a particular word(s) Replace a particular word with another word in a file Sort the lines in a particular order There are three basic commands which are used frequently to process texts: grep sed sort We will now try to understand what each command does and how to use these commands. You should also practice the given examples on the online bash shell. We will create a new file called \"numbers.txt\" and insert numbers from 1 to 10 in this file. Each number will be in a separate line. grep The grep command in its simplest form can be used to search particular words in a text file. It will display all the lines in a file that contains a particular input. The word we want to search is provided as an input to the grep command. General syntax of using grep command: grep <word_to_search> <file_name> In this example, we are trying to search for a string \"1\" in this file. The grep command outputs the lines where it found this string. sed The sed command in its simplest form can be used to replace a text in a file. General syntax of using the sed command for replacement: sed 's/<text_to_replace>/<replacement_text>/' <file_name> Let's try to replace each occurrence of \"1\" in the file with \"3\" using sed command. The content of the file will not change in the above example. To do so, we have to use an extra argument '-i' so that the changes are reflected back in the file. sort The sort command can be used to sort the input provided to it as an argument. By default, it will sort in increasing order. Let's first see the content of the file before trying to sort it. Now, we will try to sort the file using the sort command. The sort command sorts the content in lexicographical order. The content of the file will not change in the above example. I/O Redirection Each open file gets assigned a file descriptor. A file descriptor is an unique identifier for open files in the system. There are always three default files open, stdin (the keyboard), stdout (the screen), and stderr (error messages output to the screen). These files can be redirected. Everything is a file in linux - https://unix.stackexchange.com/questions/225537/everything-is-a-file Till now, we have displayed all the output on the screen which is the standard output. We can use some special operators to redirect the output of the command to files or even to the input of other commands. I/O redirection is a very powerful feature. In the below example, we have used the '>' operator to redirect the output of ls command to output.txt file. In the below example, we have redirected the output from echo command to a file. We can also redirect the output of a command as an input to another command. This is possible with the help of pipes. In the below example, we have passed the output of cat command as an input to grep command using pipe(|) operator. In the below example, we have passed the output of sort command as an input to uniq command using pipe(|) operator. The uniq command only prints the unique numbers from the input. I/O redirection - https://tldp.org/LDP/abs/html/io-redirection.html","title":"Command Line Basics"},{"location":"linux_basics/command_line_basics/#command-line-basics","text":"","title":"Command Line Basics"},{"location":"linux_basics/command_line_basics/#lab-environment-setup","text":"One can use an online bash interpreter to run all the commands that are provided as examples in this course. This will also help you in getting a hands-on experience of various linux commands. REPL is one of the popular online bash interpreters for running linux commands. We will be using it for running all the commands mentioned in this course.","title":"Lab Environment Setup"},{"location":"linux_basics/command_line_basics/#what-is-a-command","text":"A command is a program that tells the operating system to perform specific work. Programs are stored as files in linux. Therefore, a command is also a file which is stored somewhere on the disk. Commands may also take additional arguments as input from the user. These arguments are called command line arguments. Knowing how to use the commands is important and there are many ways to get help in Linux, especially for commands. Almost every command will have some form of documentation, most commands will have a command-line argument -h or --help that will display a reasonable amount of documentation. But the most popular documentation system in Linux is called man pages - short for manual pages. Using --help to show the documentation for ls command.","title":"What is a Command"},{"location":"linux_basics/command_line_basics/#file-system-organization","text":"The linux file system has a hierarchical (or tree-like) structure with its highest level directory called root ( denoted by / ). Directories present inside the root directory stores file related to the system. These directories in turn can either store system files or application files or user related files. bin | The executable program of most commonly used commands reside in bin directory sbin | This directory contains programs used for system administration. home | This directory contains user related files and directories. lib | This directory contains all the library files etc | This directory contains all the system configuration files proc | This directory contains files related to the running processes on the system dev | This directory contains files related to devices on the system mnt | This directory contains files related to mounted devices on the system tmp | This directory is used to store temporary files on the system usr | This directory is used to store application programs on the system","title":"File System Organization"},{"location":"linux_basics/command_line_basics/#commands-for-navigating-the-file-system","text":"There are three basic commands which are used frequently to navigate the file system: ls pwd cd We will now try to understand what each command does and how to use these commands. You should also practice the given examples on the online bash shell.","title":"Commands for Navigating the File System"},{"location":"linux_basics/command_line_basics/#pwd-print-working-directory","text":"At any given moment of time, we will be standing in a certain directory. To get the name of the directory in which we are standing, we can use the pwd command in linux. We will now use the cd command to move to a different directory and then print the working directory.","title":"pwd (print working directory)"},{"location":"linux_basics/command_line_basics/#cd-change-directory","text":"The cd command can be used to change the working directory. Using the command, you can move from one directory to another. In the below example, we are initially in the root directory. we have then used the cd command to change the directory.","title":"cd (change directory)"},{"location":"linux_basics/command_line_basics/#ls-list-files-and-directories","text":"The ls command is used to list the contents of a directory. It will list down all the files and folders present in the given directory. If we just type ls in the shell, it will list all the files and directories present in the current directory. We can also provide the directory name as argument to ls command. It will then list all the files and directories inside the given directory.","title":"ls (list files and directories)**"},{"location":"linux_basics/command_line_basics/#commands-for-manipulating-files","text":"There are four basic commands which are used frequently to manipulate files: touch mkdir cp mv rm We will now try to understand what each command does and how to use these commands. You should also practice the given examples on the online bash shell.","title":"Commands for Manipulating Files"},{"location":"linux_basics/command_line_basics/#touch-create-new-file","text":"The touch command can be used to create an empty new file. This command is very useful for many other purposes but we will discuss the simplest use case of creating a new file. General syntax of using touch command touch <file_name>","title":"touch (create new file)"},{"location":"linux_basics/command_line_basics/#mkdir-create-new-directories","text":"The mkdir command is used to create directories.You can use ls command to verify that the new directory is created. General syntax of using mkdir command mkdir <directory_name>","title":"mkdir (create new directories)"},{"location":"linux_basics/command_line_basics/#rm-delete-files-and-directories","text":"The rm command can be used to delete files and directories. It is very important to note that this command permanently deletes the files and directories. It's almost impossible to recover these files and directories once you have executed rm command on them successfully. Do run this command with care. General syntax of using rm command: rm <file_name> Let's try to understand the rm command with an example. We will try to delete the file and directory we created using touch and mkdir command respectively.","title":"rm (delete files and directories)"},{"location":"linux_basics/command_line_basics/#cp-copy-files-and-directories","text":"The cp command is used to copy files and directories from one location to another. Do note that the cp command doesn't do any change to the original files or directories. The original files or directories and their copy both co-exist after running cp command successfully. General syntax of using cp command: cp <source_path> <destination_path> We are currently in the '/home/runner' directory. We will use the mkdir command to create a new directory named \"test_directory\". We will now try to copy the \"_test_runner.py\" file to the directory we created just now. Do note that nothing happened to the original \"_test_runner.py\" file. It's still there in the current directory. A new copy of it got created inside the \"test_directory\". We can also use the cp command to copy the whole directory from one location to another. Let's try to understand this with an example. We again used the mkdir command to create a new directory called \"another_directory\". We then used the cp command along with an additional argument '-r' to copy the \"test_directory\". mv (move files and directories) The mv command can either be used to move files or directories from one location to another or it can be used to rename files or directories. Do note that moving files and copying them are very different. When you move the files or directories, the original copy is lost. General syntax of using mv command: mv <source_path> <destination_path> In this example, we will use the mv command to move the \"_test_runner.py\" file to \"test_directory\". In this case, this file already exists in \"test_directory\". The mv command will just replace it. Do note that the original file doesn't exist in the current directory after mv command ran successfully. We can also use the mv command to move a directory from one location to another. In this case, we do not need to use the '-r' flag that we did while using the cp command. Do note that the original directory will not exist if we use mv command. One of the important uses of the mv command is to rename files and directories. Let's see how we can use this command for renaming. We have first changed our location to \"test_directory\". We then use the mv command to rename the \"\"_test_runner.py\" file to \"test.py\".","title":"cp (copy files and directories)"},{"location":"linux_basics/command_line_basics/#commands-for-viewing-files","text":"There are three basic commands which are used frequently to view the files: cat head tail We will now try to understand what each command does and how to use these commands. You should also practice the given examples on the online bash shell. We will create a new file called \"numbers.txt\" and insert numbers from 1 to 100 in this file. Each number will be in a separate line. Do not worry about the above command now. It's an advanced command which is used to generate numbers. We have then used a redirection operator to push these numbers to the file. We will be discussing I/O redirection in the later sections.","title":"Commands for Viewing Files"},{"location":"linux_basics/command_line_basics/#cat","text":"The most simplest use of cat command is to print the contents of the file on your output screen. This command is very useful and can be used for many other purposes. We will study about other use cases later. You can try to run the above command and you will see numbers being printed from 1 to 100 on your screen. You will need to scroll up to view all the numbers.","title":"cat"},{"location":"linux_basics/command_line_basics/#head","text":"The head command displays the first 10 lines of the file by default. We can include additional arguments to display as many lines as we want from the top. In this example, we are only able to see the first 10 lines from the file when we use the head command. By default, head command will only display the first 10 lines. If we want to specify the number of lines we want to see from start, use the '-n' argument to provide the input.","title":"head"},{"location":"linux_basics/command_line_basics/#tail","text":"The tail command displays the last 10 lines of the file by default. We can include additional arguments to display as many lines as we want from the end of the file. By default, the tail command will only display the last 10 lines. If we want to specify the number of lines we want to see from the end, use '-n' argument to provide the input. In this example, we are only able to see the last 5 lines from the file when we use the tail command with explicit -n option.","title":"tail"},{"location":"linux_basics/command_line_basics/#echo-command-in-linux","text":"The echo command is one of the simplest commands that is used in the shell. This command is equivalent to what we have in other programming languages. The echo command prints the given input string on the screen.","title":"Echo Command in Linux"},{"location":"linux_basics/command_line_basics/#text-processing-commands","text":"In the previous section, we learned how to view the content of a file. In many cases, we will be interested in performing the below operations: Print only the lines which contain a particular word(s) Replace a particular word with another word in a file Sort the lines in a particular order There are three basic commands which are used frequently to process texts: grep sed sort We will now try to understand what each command does and how to use these commands. You should also practice the given examples on the online bash shell. We will create a new file called \"numbers.txt\" and insert numbers from 1 to 10 in this file. Each number will be in a separate line.","title":"Text Processing Commands"},{"location":"linux_basics/command_line_basics/#grep","text":"The grep command in its simplest form can be used to search particular words in a text file. It will display all the lines in a file that contains a particular input. The word we want to search is provided as an input to the grep command. General syntax of using grep command: grep <word_to_search> <file_name> In this example, we are trying to search for a string \"1\" in this file. The grep command outputs the lines where it found this string.","title":"grep"},{"location":"linux_basics/command_line_basics/#sed","text":"The sed command in its simplest form can be used to replace a text in a file. General syntax of using the sed command for replacement: sed 's/<text_to_replace>/<replacement_text>/' <file_name> Let's try to replace each occurrence of \"1\" in the file with \"3\" using sed command. The content of the file will not change in the above example. To do so, we have to use an extra argument '-i' so that the changes are reflected back in the file.","title":"sed"},{"location":"linux_basics/command_line_basics/#sort","text":"The sort command can be used to sort the input provided to it as an argument. By default, it will sort in increasing order. Let's first see the content of the file before trying to sort it. Now, we will try to sort the file using the sort command. The sort command sorts the content in lexicographical order. The content of the file will not change in the above example.","title":"sort"},{"location":"linux_basics/command_line_basics/#io-redirection","text":"Each open file gets assigned a file descriptor. A file descriptor is an unique identifier for open files in the system. There are always three default files open, stdin (the keyboard), stdout (the screen), and stderr (error messages output to the screen). These files can be redirected. Everything is a file in linux - https://unix.stackexchange.com/questions/225537/everything-is-a-file Till now, we have displayed all the output on the screen which is the standard output. We can use some special operators to redirect the output of the command to files or even to the input of other commands. I/O redirection is a very powerful feature. In the below example, we have used the '>' operator to redirect the output of ls command to output.txt file. In the below example, we have redirected the output from echo command to a file. We can also redirect the output of a command as an input to another command. This is possible with the help of pipes. In the below example, we have passed the output of cat command as an input to grep command using pipe(|) operator. In the below example, we have passed the output of sort command as an input to uniq command using pipe(|) operator. The uniq command only prints the unique numbers from the input. I/O redirection - https://tldp.org/LDP/abs/html/io-redirection.html","title":"I/O Redirection"},{"location":"linux_basics/conclusion/","text":"Conclusion We have covered the basics of Linux operating systems and basic commands used in linux. We have also covered the Linux server administration commands. We hope that this course will make it easier for you to operate on the command line. Applications in SRE Role As a SRE, you will be required to perform some general tasks on these linux servers. You will also be using the command line when you are troubleshooting issues. Moving from one location to another in the filesystem will require the help of ls, pwd and cd commands You may need to search some specific information in the log files. Grep command would be very useful here. I/O redirection will become handy if you want to store the output in a file or pass it as an input to another command. Tail command is very useful to view the latest data in the log file. Different users will have different permissions depending on their roles. We will also not want everyone in the company to access our servers for security reasons. Users permissions can be restricted with chown, chmod and chgrp commands. SSH is one of the most frequently used commands for a SRE. Logging into servers and troubleshooting along with performing basic administration tasks will only be possible if we are able to login into the server. What if we want to run an apache server or nginx on a server ? We will first install it using the package manager. Package management commands become important here. Managing services on servers is another critical responsibility of a SRE. Systemd related commands can help in troubleshooting issues. If a service goes down, we can start it using systemctl start command. We can also stop a service in case it is not needed. Monitoring is another core responsibility of a SRE. Memory and CPU are two important system level metrics which should be monitored. Commands like top and free are quite helpful here. If a service is throwing an error, how do we find out the root cause of the error ? We will certainly need to check logs to find out the whole stack trace of the error. The log file will also tell us the number of times the error has occurred along with time when it started. Useful Courses and tutorials Edx basic linux commands course Edx Red Hat Enterprise Linux Course https://linuxcommand.org/lc3_learning_the_shell.php","title":"Conclusion"},{"location":"linux_basics/conclusion/#conclusion","text":"We have covered the basics of Linux operating systems and basic commands used in linux. We have also covered the Linux server administration commands. We hope that this course will make it easier for you to operate on the command line.","title":"Conclusion"},{"location":"linux_basics/conclusion/#applications-in-sre-role","text":"As a SRE, you will be required to perform some general tasks on these linux servers. You will also be using the command line when you are troubleshooting issues. Moving from one location to another in the filesystem will require the help of ls, pwd and cd commands You may need to search some specific information in the log files. Grep command would be very useful here. I/O redirection will become handy if you want to store the output in a file or pass it as an input to another command. Tail command is very useful to view the latest data in the log file. Different users will have different permissions depending on their roles. We will also not want everyone in the company to access our servers for security reasons. Users permissions can be restricted with chown, chmod and chgrp commands. SSH is one of the most frequently used commands for a SRE. Logging into servers and troubleshooting along with performing basic administration tasks will only be possible if we are able to login into the server. What if we want to run an apache server or nginx on a server ? We will first install it using the package manager. Package management commands become important here. Managing services on servers is another critical responsibility of a SRE. Systemd related commands can help in troubleshooting issues. If a service goes down, we can start it using systemctl start command. We can also stop a service in case it is not needed. Monitoring is another core responsibility of a SRE. Memory and CPU are two important system level metrics which should be monitored. Commands like top and free are quite helpful here. If a service is throwing an error, how do we find out the root cause of the error ? We will certainly need to check logs to find out the whole stack trace of the error. The log file will also tell us the number of times the error has occurred along with time when it started.","title":"Applications in SRE Role"},{"location":"linux_basics/conclusion/#useful-courses-and-tutorials","text":"Edx basic linux commands course Edx Red Hat Enterprise Linux Course https://linuxcommand.org/lc3_learning_the_shell.php","title":"Useful Courses and tutorials"},{"location":"linux_basics/intro/","text":"Linux Basics Introduction Prerequisites Comfortable using any operating systems like Windows, Linux or Mac Fundamental knowledge of operating systems What to expect from this course This course is divided into three parts. In the first part, we cover the fundamentals of Linux operating systems. We will talk about Linux architecture, Linux distributions and uses of Linux operating systems. We will also talk about the difference between GUI and CLI. In the second part, we cover some basic commands used in Linux. We will focus on commands used for navigating the file system, viewing and manipulating files, I/O redirection etc. In the third part, we cover Linux system administration. This includes day to day tasks performed by Linux admins, like managing users/groups, managing file permissions, monitoring system performance, log files etc. In the second and third part, we will be taking examples to understand the concepts. What is not covered under this course We are not covering advanced Linux commands and bash scripting in this course. We will also not be covering Linux internals. Course Contents The following topics has been covered in this course: Introduction to Linux What are Linux Operating Systems What are popular Linux distributions Uses of Linux Operating Systems Linux Architecture Graphical user interface (GUI) vs Command line interface (CLI) Command Line Basics Lab Environment Setup What is a Command File System Organization Navigating File System Manipulating Files Viewing Files Echo Command Text Processing Commands I/O Redirection Linux system administration Lab Environment Setup User/Groups management Becoming a Superuser File Permissions SSH Command Package Management Process Management Memory Management Daemons and Systemd Logs Conclusion Applications in SRE Role Useful Courses and tutorials What are Linux operating systems Most of us are familiar with the Windows operating system used in more than 75% of the personal computers. The Windows operating systems are based on Windows NT kernel. A kernel is the most important part of an operating system - it performs important functions like process management, memory management, filesystem management etc. Linux operating systems are based on the Linux kernel. A Linux based operating system will consist of Linux kernel, GUI/CLI, system libraries and system utilities. The Linux kernel was independently developed and released by Linus Torvalds. The Linux kernel is free and open-source - https://github.com/torvalds/linux History of Linux - https://en.wikipedia.org/wiki/History_of_Linux What are popular Linux distributions A Linux distribution(distro) is an operating system based on the Linux kernel and a package management system. A package management system consists of tools that help in installing, upgrading, configuring and removing softwares on the operating system. Software are usually adopted to a distribution and are packaged in a distro specific format. These packages are available through a distro specific repository. Packages are installed and managed in the operating system by a package manager. List of popular Linux distributions: Fedora Ubuntu Debian Centos Red Hat Enterprise Linux Suse Arch Linux Packaging systems Distributions Package manager Debian style (.deb) Debian, Ubuntu APT Red Hat style (.rpm) Fedora, CentOS, Red Hat Enterprise Linux YUM Linux Architecture The Linux kernel is monolithic in nature. System calls are used to interact with the Linux kernel space. Kernel code can only be executed in the kernel mode. Non-kernel code is executed in the user mode. Device drivers are used to communicate with the hardware devices. Uses of Linux Operating Systems Operating system based on Linux kernel are widely used in: Personal computers Servers Mobile phones - Android is based on Linux operating system Embedded devices - watches, televisions, traffic lights etc Satelites Network devices - routers, switches etc. Graphical user interface (GUI) vs Command line interface (CLI) A user interacts with a computer with the help of user interfaces. The user interface can be either GUI or CLI. Graphical user interface allows a user to interact with the computer using graphics such as icons and images. When a user clicks on an icon to open an application on a computer, he or she is actually using the GUI. It's easy to perform tasks using GUI. Command line interface allows a user to interact with the computer using commands. A user types the command in a terminal and the system helps in executing these commands. A new user with experience on GUI may find it difficult to interact with CLI as he/she needs to be aware of the commands to perform a particular operation. Shell vs Terminal Shell is a program that takes commands from the users and gives them to the operating system for processing. Shell is an example of a CLI(command line interface). Bash is one of the most popular shell programs available on Linux servers. Other popular shell programs are zsh, ksh and tcsh. Terminal is a program that opens a window and lets you interact with the shell. Some popular examples of terminals are gnome-terminal, xterm, konsole etc. Linux users do use the terms shell, terminal, prompt, console etc. interchangeably. In simple terms, these all refer to a way of taking commands from the user.","title":"Introduction"},{"location":"linux_basics/intro/#linux-basics","text":"","title":"Linux Basics"},{"location":"linux_basics/intro/#introduction","text":"","title":"Introduction"},{"location":"linux_basics/intro/#prerequisites","text":"Comfortable using any operating systems like Windows, Linux or Mac Fundamental knowledge of operating systems","title":"Prerequisites"},{"location":"linux_basics/intro/#what-to-expect-from-this-course","text":"This course is divided into three parts. In the first part, we cover the fundamentals of Linux operating systems. We will talk about Linux architecture, Linux distributions and uses of Linux operating systems. We will also talk about the difference between GUI and CLI. In the second part, we cover some basic commands used in Linux. We will focus on commands used for navigating the file system, viewing and manipulating files, I/O redirection etc. In the third part, we cover Linux system administration. This includes day to day tasks performed by Linux admins, like managing users/groups, managing file permissions, monitoring system performance, log files etc. In the second and third part, we will be taking examples to understand the concepts.","title":"What to expect from this course"},{"location":"linux_basics/intro/#what-is-not-covered-under-this-course","text":"We are not covering advanced Linux commands and bash scripting in this course. We will also not be covering Linux internals.","title":"What is not covered under this course"},{"location":"linux_basics/intro/#course-contents","text":"The following topics has been covered in this course: Introduction to Linux What are Linux Operating Systems What are popular Linux distributions Uses of Linux Operating Systems Linux Architecture Graphical user interface (GUI) vs Command line interface (CLI) Command Line Basics Lab Environment Setup What is a Command File System Organization Navigating File System Manipulating Files Viewing Files Echo Command Text Processing Commands I/O Redirection Linux system administration Lab Environment Setup User/Groups management Becoming a Superuser File Permissions SSH Command Package Management Process Management Memory Management Daemons and Systemd Logs Conclusion Applications in SRE Role Useful Courses and tutorials","title":"Course Contents"},{"location":"linux_basics/intro/#what-are-linux-operating-systems","text":"Most of us are familiar with the Windows operating system used in more than 75% of the personal computers. The Windows operating systems are based on Windows NT kernel. A kernel is the most important part of an operating system - it performs important functions like process management, memory management, filesystem management etc. Linux operating systems are based on the Linux kernel. A Linux based operating system will consist of Linux kernel, GUI/CLI, system libraries and system utilities. The Linux kernel was independently developed and released by Linus Torvalds. The Linux kernel is free and open-source - https://github.com/torvalds/linux History of Linux - https://en.wikipedia.org/wiki/History_of_Linux","title":"What are Linux operating systems"},{"location":"linux_basics/intro/#what-are-popular-linux-distributions","text":"A Linux distribution(distro) is an operating system based on the Linux kernel and a package management system. A package management system consists of tools that help in installing, upgrading, configuring and removing softwares on the operating system. Software are usually adopted to a distribution and are packaged in a distro specific format. These packages are available through a distro specific repository. Packages are installed and managed in the operating system by a package manager. List of popular Linux distributions: Fedora Ubuntu Debian Centos Red Hat Enterprise Linux Suse Arch Linux Packaging systems Distributions Package manager Debian style (.deb) Debian, Ubuntu APT Red Hat style (.rpm) Fedora, CentOS, Red Hat Enterprise Linux YUM","title":"What are popular Linux distributions"},{"location":"linux_basics/intro/#linux-architecture","text":"The Linux kernel is monolithic in nature. System calls are used to interact with the Linux kernel space. Kernel code can only be executed in the kernel mode. Non-kernel code is executed in the user mode. Device drivers are used to communicate with the hardware devices.","title":"Linux Architecture"},{"location":"linux_basics/intro/#uses-of-linux-operating-systems","text":"Operating system based on Linux kernel are widely used in: Personal computers Servers Mobile phones - Android is based on Linux operating system Embedded devices - watches, televisions, traffic lights etc Satelites Network devices - routers, switches etc.","title":"Uses of Linux Operating Systems"},{"location":"linux_basics/intro/#graphical-user-interface-gui-vs-command-line-interface-cli","text":"A user interacts with a computer with the help of user interfaces. The user interface can be either GUI or CLI. Graphical user interface allows a user to interact with the computer using graphics such as icons and images. When a user clicks on an icon to open an application on a computer, he or she is actually using the GUI. It's easy to perform tasks using GUI. Command line interface allows a user to interact with the computer using commands. A user types the command in a terminal and the system helps in executing these commands. A new user with experience on GUI may find it difficult to interact with CLI as he/she needs to be aware of the commands to perform a particular operation.","title":"Graphical user interface (GUI) vs Command line interface (CLI)"},{"location":"linux_basics/intro/#shell-vs-terminal","text":"Shell is a program that takes commands from the users and gives them to the operating system for processing. Shell is an example of a CLI(command line interface). Bash is one of the most popular shell programs available on Linux servers. Other popular shell programs are zsh, ksh and tcsh. Terminal is a program that opens a window and lets you interact with the shell. Some popular examples of terminals are gnome-terminal, xterm, konsole etc. Linux users do use the terms shell, terminal, prompt, console etc. interchangeably. In simple terms, these all refer to a way of taking commands from the user.","title":"Shell vs Terminal"},{"location":"linux_basics/linux_server_administration/","text":"Linux Server Administration In this course will try to cover some of the common tasks that a linux server administrator performs. We will first try to understand what a particular command does and then try to understand the commands using examples. Do keep in mind that it's very important to practice the Linux commands on your own. Lab Environment Setup Install docker on your system - https://docs.docker.com/engine/install/ We will be running all the commands on Red Hat Enterprise Linux (RHEL) 8 system. We will run most of the commands used in this module in the above Docker container. Multi-User Operating Systems An operating system is considered as multi-user if it allows multiple people/users to use a computer and not affect each other's files and preferences. Linux based operating systems are multi-user in nature as it allows multiple users to access the system at the same time. A typical computer will only have one keyboard and monitor but multiple users can log in via SSH if the computer is connected to the network. We will cover more about SSH later. As a server administrator, we are mostly concerned with the Linux servers which are physically present at a very large distance from us. We can connect to these servers with the help of remote login methods like SSH. Since Linux supports multiple users, we need to have a method which can protect the users from each other. One user should not be able to access and modify files of other users User/Group Management Each user in Linux has an associated user ID called UID attached to him Each user also has a home directory and a login shell associated with him/her A group is a collection of one or more users. A group makes it easier to share permissions among a group of users. Each group has a group ID called GID associated with it. id command id command can be used to find the uid and gid associated with an user. It also lists down the groups to which the user belongs to. The uid and gid associated with the root user is 0. A good way to find out the current user in Linux is to use the whoami command. \"root\" user or superuser is the most privileged user with unrestricted access to all the resources on the system. It has UID 0 Important files associated with users/groups /etc/passwd Stores the user name, the uid, the gid, the home directory, the login shell etc /etc/shadow Stores the password associated with the users /etc/group Stores information about different groups on the system If you want to understand each filed discussed in the above outputs, you can go through below links: https://tldp.org/LDP/lame/LAME/linux-admin-made-easy/shadow-file-formats.html https://tldp.org/HOWTO/User-Authentication-HOWTO/x71.html Important commands for managing users Some of the commands which are used frequently to manage users/groups on Linux are following: useradd - Creates a new user passwd - Adds or modifies passwords for a user usermod - Modifies attributes of an user userdel - Deletes an user useradd The useradd command adds a new user in Linux. We will create a new user 'shivam'. We will also verify that the user has been created by tailing the /etc/passwd file. The uid and gid are 1000 for the newly created user. The home directory assigned to the user is /home/shivam and the login shell assigned is /bin/bash. Do note that the user home directory and login shell can be modified later on. If we do not specify any value for attributes like home directory or login shell, default values will be assigned to the user. We can also override these default values when creating a new user. passwd The passwd command is used to create or modify passwords for a user. In the above examples, we have not assigned any password for users 'shivam' or 'amit' while creating them. \\\"!!\\\" in an account entry in shadow means the account of an user has been created, but not yet given a password. Let's now try to create a password for user \"shivam\". Do remember the password as we will be later using examples where it will be useful. Also, let's change the password for the root user now. When we switch from a normal user to root user, it will request you for a password. Also, when you login using root user, the password will be asked. usermod The usermod command is used to modify the attributes of an user like the home directory or the shell. Let's try to modify the login shell of user \"amit\" to \"/bin/bash\". In a similar way, you can also modify many other attributes for a user. Try 'usermod -h' for a list of attributes you can modify. userdel The userdel command is used to remove a user on Linux. Once we remove a user, all the information related to that user will be removed. Let's try to delete the user \"amit\". After deleting the user, you will not find the entry for that user in \"/etc/passwd\" or \"/etc/shadow\" file. Important commands for managing groups Commands for managing groups are quite similar to the commands used for managing users. Each command is not explained in detail here as they are quite similar. You can try running these commands on your system. groupadd \\<group_name> Creates a new group groupmod \\<group_name> Modifies attributes of a group groupdel \\<group_name> Deletes a group gpasswd \\<group_name> Modifies password for group We will now try to add user \"shivam\" to the group we have created above. Becoming a Superuser Before running the below commands, do make sure that you have set up a password for user \"shivam\" and user \"root\" using the passwd command described in the above section. The su command can be used to switch users in Linux. Let's now try to switch to user \"shivam\". Let's now try to open the \"/etc/shadow\" file. The operating system didn't allow the user \"shivam\" to read the content of the \"/etc/shadow\" file. This is an important file in Linux which stores the passwords of users. This file can only be accessed by root or users who have the superuser privileges. The sudo command allows a user to run commands with the security privileges of the root user. Do remember that the root user has all the privileges on a system. We can also use su command to switch to the root user and open the above file but doing that will require the password of the root user. An alternative way which is preferred on most modern operating systems is to use sudo command for becoming a superuser. Using this way, a user has to enter his/her password and they need to be a part of the sudo group. How to provide superpriveleges to other users ? Let's first switch to the root user using su command. Do note that using the below command will need you to enter the password for the root user. In case, you forgot to set a password for the root user, type \"exit\" and you will be back as the root user. Now, set up a password using the passwd command. The file /etc/sudoers holds the names of users permitted to invoke sudo . In redhat operating systems, this file is not present by default. We will need to install sudo. We will discuss the yum command in detail in later sections. Try to open the \"/etc/sudoers\" file on the system. The file has a lot of information. This file stores the rules that users must follow when running the sudo command. For example, root is allowed to run any commands from anywhere. One easy way of providing root access to users is to add them to a group which has permissions to run all the commands. \"wheel\" is a group in redhat Linux with such privileges. Let's add the user \"shivam\" to this group so that it also has sudo privileges. Let's now switch back to user \"shivam\" and try to access the \"/etc/shadow\" file. We need to use sudo before running the command since it can only be accessed with the sudo privileges. We have already given sudo privileges to user \u201cshivam\u201d by adding him to the group \u201cwheel\u201d. File Permissions On a Linux operating system, each file and directory is assigned access permissions for the owner of the file, the members of a group of related users and everybody else. This is to make sure that one user is not allowed to access the files and resources of another user. To see the permissions of a file, we can use the ls command. Let's look at the permissions of /etc/passwd file. Let's go over some of the important fields in the output that are related to file permissions. Chmod command The chmod command is used to modify files and directories permissions in Linux. The chmod command accepts permissions in as a numerical argument. We can think of permission as a series of bits with 1 representing True or allowed and 0 representing False or not allowed. Permission rwx Binary Decimal Read, write and execute rwx 111 7 Read and write rw- 110 6 Read and execute r-x 101 5 Read only r-- 100 4 Write and execute -wx 011 3 Write only -w- 010 2 Execute only --x 001 1 None --- 000 0 We will now create a new file and check the permission of the file. The group owner doesn't have the permission to write to this file. Let's give the group owner or root the permission to write to it using chmod command. Chmod command can be also used to change the permissions of a directory in the similar way. Chown command The chown command is used to change the owner of files or directories in Linux. Command syntax: chown \\<new_owner> \\<file_name> In case, we do not have sudo privileges, we need to use sudo command . Let's switch to user 'shivam' and try changing the owner. We have also changed the owner of the file to root before running the below command. Chown command can also be used to change the owner of a directory in the similar way. Chgrp command The chgrp command can be used to change the group ownership of files or directories in Linux. The syntax is very similar to that of chown command. Chgrp command can also be used to change the owner of a directory in the similar way. SSH Command The ssh command is used for logging into the remote systems, transfer files between systems and for executing commands on a remote machine. SSH stands for secure shell and is used to provide an encrypted secured connection between two hosts over an insecure network like the internet. Reference: https://www.ssh.com/ssh/command/ We will now discuss passwordless authentication which is secure and most commonly used for ssh authentication. Passwordless Authentication Using SSH Using this method, we can ssh into hosts without entering the password. This method is also useful when we want some scripts to perform ssh-related tasks. Passwordless authentication requires the use of a public and private key pair. As the name implies, the public key can be shared with anyone but the private key should be kept private. Lets not get into the details of how this authentication works. You can read more about it here Steps for setting up a passwordless authentication with a remote host: Generating public-private key pair If we already have a key pair stored in \\~/.ssh directory, we will not need to generate keys again. Install openssh package which contains all the commands related to ssh. Generate a key pair using the ssh-keygen command. One can choose the default values for all prompts. After running the ssh-keygen command successfully, we should see two keys present in the \\~/.ssh directory. Id_rsa is the private key and id_rsa.pub is the public key. Do note that the private key can only be read and modified by you. Transferring the public key to the remote host There are multiple ways to transfer the public key to the remote server. We will look at one of the most common ways of doing it using the ssh-id-copy command. Install the openssh-clients package to use ssh-id-copy command. Use the ssh-id-copy command to copy your public key to the remote host. Now, ssh into the remote host using the password authentication. Our public key should be there in \\~/.ssh/authorized_keys now. \\~/.ssh/authorized_key contains a list of public keys. The users associated with these public keys have the ssh access into the remote host. How to run commands on a remote host ? General syntax: ssh \\<user>@\\<hostname/hostip> \\<command> How to transfer files from one host to another host ? General syntax: scp \\<source> \\<destination> Package Management Package management is the process of installing and managing software on the system. We can install the packages which we require from the Linux package distributor. Different distributors use different packaging systems. Packaging systems Distributions Debian style (.deb) Debian, Ubuntu Red Hat style (.rpm) Fedora, CentOS, Red Hat Enterprise Linux Popular Packaging Systems in Linux Command Description yum install \\<package_name> Installs a package on your system yum update \\<package_name> Updates a package to it's latest available version yum remove \\<package_name> Removes a package from your system yum search \\<keyword> Searches for a particular keyword DNF is the successor to YUM which is now used in Fedora for installing and managing packages. DNF may replace YUM in the future on all RPM based Linux distributions. We did find an exact match for the keyword httpd when we searched using yum search command. Let's now install the httpd package. After httpd is installed, we will use the yum remove command to remove httpd package. Process Management In this section, we will study about some useful commands that can be used to monitor the processes on Linux systems. ps (process status) The ps command is used to know the information of a process or list of processes. If you get an error \"ps command not found\" while running ps command, do install procps package. ps without any arguments is not very useful. Let's try to list all the processes on the system by using the below command. Reference: https://unix.stackexchange.com/questions/106847/what-does-aux-mean-in-ps-aux We can use an additional argument with ps command to list the information about the process with a specific process ID. We can use grep in combination with ps command to list only specific processes. top The top command is used to show information about Linux processes running on the system in real time. It also shows a summary of the system information. For each process, top lists down the process ID, owner, priority, state, cpu utilization, memory utilization and much more information. It also lists down the memory utilization and cpu utilization of the system as a whole along with system uptime and cpu load average. Memory Management In this section, we will study about some useful commands that can be used to view information about the system memory. free The free command is used to display the memory usage of the system. The command displays the total free and used space available in the RAM along with space occupied by the caches/buffers. free command by default shows the memory usage in kilobytes. We can use an additional argument to get the data in human-readable format. vmstat The vmstat command can be used to display the memory usage along with additional information about io and cpu usage. Checking Disk Space In this section, we will study about some useful commands that can be used to view disk space on Linux. df (disk free) The df command is used to display the free and available space for each mounted file system. du (disk usage) The du command is used to display disk usage of files and directories on the system. The below command can be used to display the top 5 largest directories in the root directory. Daemons A computer program that runs as a background process is called a daemon. Traditionally, the name of daemon processes ended with d - sshd, httpd etc. We cannot interact with a daemon process as they run in the background. Services and daemons are used interchangeably most of the time. Systemd Systemd is a system and service manager for Linux operating systems. Systemd units are the building blocks of systemd. These units are represented by unit configuration files. The below examples shows the unit configuration files available at /usr/lib/systemd/system which are distributed by installed RPM packages. We are more interested in the configuration file that ends with service as these are service units. Managing System Services Service units end with .service file extension. Systemctl command can be used to start/stop/restart the services managed by systemd. Command Description systemctl start name.service Starts a service systemctl stop name.service Stops a service systemctl restart name.service Restarts a service systemctl status name.service Check the status of a service systemctl reload name.service Reload the configuration of a service Logs In this section, we will talk about some important files and directories which can be very useful for viewing system logs and applications logs in Linux. These logs can be very useful when you are troubleshooting on the system.","title":"Server Administration"},{"location":"linux_basics/linux_server_administration/#linux-server-administration","text":"In this course will try to cover some of the common tasks that a linux server administrator performs. We will first try to understand what a particular command does and then try to understand the commands using examples. Do keep in mind that it's very important to practice the Linux commands on your own.","title":"Linux Server Administration"},{"location":"linux_basics/linux_server_administration/#lab-environment-setup","text":"Install docker on your system - https://docs.docker.com/engine/install/ We will be running all the commands on Red Hat Enterprise Linux (RHEL) 8 system. We will run most of the commands used in this module in the above Docker container.","title":"Lab Environment Setup"},{"location":"linux_basics/linux_server_administration/#multi-user-operating-systems","text":"An operating system is considered as multi-user if it allows multiple people/users to use a computer and not affect each other's files and preferences. Linux based operating systems are multi-user in nature as it allows multiple users to access the system at the same time. A typical computer will only have one keyboard and monitor but multiple users can log in via SSH if the computer is connected to the network. We will cover more about SSH later. As a server administrator, we are mostly concerned with the Linux servers which are physically present at a very large distance from us. We can connect to these servers with the help of remote login methods like SSH. Since Linux supports multiple users, we need to have a method which can protect the users from each other. One user should not be able to access and modify files of other users","title":"Multi-User Operating Systems"},{"location":"linux_basics/linux_server_administration/#usergroup-management","text":"Each user in Linux has an associated user ID called UID attached to him Each user also has a home directory and a login shell associated with him/her A group is a collection of one or more users. A group makes it easier to share permissions among a group of users. Each group has a group ID called GID associated with it.","title":"User/Group Management"},{"location":"linux_basics/linux_server_administration/#id-command","text":"id command can be used to find the uid and gid associated with an user. It also lists down the groups to which the user belongs to. The uid and gid associated with the root user is 0. A good way to find out the current user in Linux is to use the whoami command. \"root\" user or superuser is the most privileged user with unrestricted access to all the resources on the system. It has UID 0","title":"id command"},{"location":"linux_basics/linux_server_administration/#important-files-associated-with-usersgroups","text":"/etc/passwd Stores the user name, the uid, the gid, the home directory, the login shell etc /etc/shadow Stores the password associated with the users /etc/group Stores information about different groups on the system If you want to understand each filed discussed in the above outputs, you can go through below links: https://tldp.org/LDP/lame/LAME/linux-admin-made-easy/shadow-file-formats.html https://tldp.org/HOWTO/User-Authentication-HOWTO/x71.html","title":"Important files associated with users/groups"},{"location":"linux_basics/linux_server_administration/#important-commands-for-managing-users","text":"Some of the commands which are used frequently to manage users/groups on Linux are following: useradd - Creates a new user passwd - Adds or modifies passwords for a user usermod - Modifies attributes of an user userdel - Deletes an user","title":"Important commands for managing users"},{"location":"linux_basics/linux_server_administration/#useradd","text":"The useradd command adds a new user in Linux. We will create a new user 'shivam'. We will also verify that the user has been created by tailing the /etc/passwd file. The uid and gid are 1000 for the newly created user. The home directory assigned to the user is /home/shivam and the login shell assigned is /bin/bash. Do note that the user home directory and login shell can be modified later on. If we do not specify any value for attributes like home directory or login shell, default values will be assigned to the user. We can also override these default values when creating a new user.","title":"useradd"},{"location":"linux_basics/linux_server_administration/#passwd","text":"The passwd command is used to create or modify passwords for a user. In the above examples, we have not assigned any password for users 'shivam' or 'amit' while creating them. \\\"!!\\\" in an account entry in shadow means the account of an user has been created, but not yet given a password. Let's now try to create a password for user \"shivam\". Do remember the password as we will be later using examples where it will be useful. Also, let's change the password for the root user now. When we switch from a normal user to root user, it will request you for a password. Also, when you login using root user, the password will be asked.","title":"passwd"},{"location":"linux_basics/linux_server_administration/#usermod","text":"The usermod command is used to modify the attributes of an user like the home directory or the shell. Let's try to modify the login shell of user \"amit\" to \"/bin/bash\". In a similar way, you can also modify many other attributes for a user. Try 'usermod -h' for a list of attributes you can modify.","title":"usermod"},{"location":"linux_basics/linux_server_administration/#userdel","text":"The userdel command is used to remove a user on Linux. Once we remove a user, all the information related to that user will be removed. Let's try to delete the user \"amit\". After deleting the user, you will not find the entry for that user in \"/etc/passwd\" or \"/etc/shadow\" file.","title":"userdel"},{"location":"linux_basics/linux_server_administration/#important-commands-for-managing-groups","text":"Commands for managing groups are quite similar to the commands used for managing users. Each command is not explained in detail here as they are quite similar. You can try running these commands on your system. groupadd \\<group_name> Creates a new group groupmod \\<group_name> Modifies attributes of a group groupdel \\<group_name> Deletes a group gpasswd \\<group_name> Modifies password for group We will now try to add user \"shivam\" to the group we have created above.","title":"Important commands for managing groups"},{"location":"linux_basics/linux_server_administration/#becoming-a-superuser","text":"Before running the below commands, do make sure that you have set up a password for user \"shivam\" and user \"root\" using the passwd command described in the above section. The su command can be used to switch users in Linux. Let's now try to switch to user \"shivam\". Let's now try to open the \"/etc/shadow\" file. The operating system didn't allow the user \"shivam\" to read the content of the \"/etc/shadow\" file. This is an important file in Linux which stores the passwords of users. This file can only be accessed by root or users who have the superuser privileges. The sudo command allows a user to run commands with the security privileges of the root user. Do remember that the root user has all the privileges on a system. We can also use su command to switch to the root user and open the above file but doing that will require the password of the root user. An alternative way which is preferred on most modern operating systems is to use sudo command for becoming a superuser. Using this way, a user has to enter his/her password and they need to be a part of the sudo group. How to provide superpriveleges to other users ? Let's first switch to the root user using su command. Do note that using the below command will need you to enter the password for the root user. In case, you forgot to set a password for the root user, type \"exit\" and you will be back as the root user. Now, set up a password using the passwd command. The file /etc/sudoers holds the names of users permitted to invoke sudo . In redhat operating systems, this file is not present by default. We will need to install sudo. We will discuss the yum command in detail in later sections. Try to open the \"/etc/sudoers\" file on the system. The file has a lot of information. This file stores the rules that users must follow when running the sudo command. For example, root is allowed to run any commands from anywhere. One easy way of providing root access to users is to add them to a group which has permissions to run all the commands. \"wheel\" is a group in redhat Linux with such privileges. Let's add the user \"shivam\" to this group so that it also has sudo privileges. Let's now switch back to user \"shivam\" and try to access the \"/etc/shadow\" file. We need to use sudo before running the command since it can only be accessed with the sudo privileges. We have already given sudo privileges to user \u201cshivam\u201d by adding him to the group \u201cwheel\u201d.","title":"Becoming a Superuser"},{"location":"linux_basics/linux_server_administration/#file-permissions","text":"On a Linux operating system, each file and directory is assigned access permissions for the owner of the file, the members of a group of related users and everybody else. This is to make sure that one user is not allowed to access the files and resources of another user. To see the permissions of a file, we can use the ls command. Let's look at the permissions of /etc/passwd file. Let's go over some of the important fields in the output that are related to file permissions.","title":"File Permissions"},{"location":"linux_basics/linux_server_administration/#chmod-command","text":"The chmod command is used to modify files and directories permissions in Linux. The chmod command accepts permissions in as a numerical argument. We can think of permission as a series of bits with 1 representing True or allowed and 0 representing False or not allowed. Permission rwx Binary Decimal Read, write and execute rwx 111 7 Read and write rw- 110 6 Read and execute r-x 101 5 Read only r-- 100 4 Write and execute -wx 011 3 Write only -w- 010 2 Execute only --x 001 1 None --- 000 0 We will now create a new file and check the permission of the file. The group owner doesn't have the permission to write to this file. Let's give the group owner or root the permission to write to it using chmod command. Chmod command can be also used to change the permissions of a directory in the similar way.","title":"Chmod command"},{"location":"linux_basics/linux_server_administration/#chown-command","text":"The chown command is used to change the owner of files or directories in Linux. Command syntax: chown \\<new_owner> \\<file_name> In case, we do not have sudo privileges, we need to use sudo command . Let's switch to user 'shivam' and try changing the owner. We have also changed the owner of the file to root before running the below command. Chown command can also be used to change the owner of a directory in the similar way.","title":"Chown command"},{"location":"linux_basics/linux_server_administration/#chgrp-command","text":"The chgrp command can be used to change the group ownership of files or directories in Linux. The syntax is very similar to that of chown command. Chgrp command can also be used to change the owner of a directory in the similar way.","title":"Chgrp command"},{"location":"linux_basics/linux_server_administration/#ssh-command","text":"The ssh command is used for logging into the remote systems, transfer files between systems and for executing commands on a remote machine. SSH stands for secure shell and is used to provide an encrypted secured connection between two hosts over an insecure network like the internet. Reference: https://www.ssh.com/ssh/command/ We will now discuss passwordless authentication which is secure and most commonly used for ssh authentication.","title":"SSH Command"},{"location":"linux_basics/linux_server_administration/#passwordless-authentication-using-ssh","text":"Using this method, we can ssh into hosts without entering the password. This method is also useful when we want some scripts to perform ssh-related tasks. Passwordless authentication requires the use of a public and private key pair. As the name implies, the public key can be shared with anyone but the private key should be kept private. Lets not get into the details of how this authentication works. You can read more about it here Steps for setting up a passwordless authentication with a remote host: Generating public-private key pair If we already have a key pair stored in \\~/.ssh directory, we will not need to generate keys again. Install openssh package which contains all the commands related to ssh. Generate a key pair using the ssh-keygen command. One can choose the default values for all prompts. After running the ssh-keygen command successfully, we should see two keys present in the \\~/.ssh directory. Id_rsa is the private key and id_rsa.pub is the public key. Do note that the private key can only be read and modified by you. Transferring the public key to the remote host There are multiple ways to transfer the public key to the remote server. We will look at one of the most common ways of doing it using the ssh-id-copy command. Install the openssh-clients package to use ssh-id-copy command. Use the ssh-id-copy command to copy your public key to the remote host. Now, ssh into the remote host using the password authentication. Our public key should be there in \\~/.ssh/authorized_keys now. \\~/.ssh/authorized_key contains a list of public keys. The users associated with these public keys have the ssh access into the remote host.","title":"Passwordless Authentication Using SSH"},{"location":"linux_basics/linux_server_administration/#how-to-run-commands-on-a-remote-host","text":"General syntax: ssh \\<user>@\\<hostname/hostip> \\<command>","title":"How to run commands on a remote host ?"},{"location":"linux_basics/linux_server_administration/#how-to-transfer-files-from-one-host-to-another-host","text":"General syntax: scp \\<source> \\<destination>","title":"How to transfer files from one host to another host ?"},{"location":"linux_basics/linux_server_administration/#package-management","text":"Package management is the process of installing and managing software on the system. We can install the packages which we require from the Linux package distributor. Different distributors use different packaging systems. Packaging systems Distributions Debian style (.deb) Debian, Ubuntu Red Hat style (.rpm) Fedora, CentOS, Red Hat Enterprise Linux Popular Packaging Systems in Linux Command Description yum install \\<package_name> Installs a package on your system yum update \\<package_name> Updates a package to it's latest available version yum remove \\<package_name> Removes a package from your system yum search \\<keyword> Searches for a particular keyword DNF is the successor to YUM which is now used in Fedora for installing and managing packages. DNF may replace YUM in the future on all RPM based Linux distributions. We did find an exact match for the keyword httpd when we searched using yum search command. Let's now install the httpd package. After httpd is installed, we will use the yum remove command to remove httpd package.","title":"Package Management"},{"location":"linux_basics/linux_server_administration/#process-management","text":"In this section, we will study about some useful commands that can be used to monitor the processes on Linux systems.","title":"Process Management"},{"location":"linux_basics/linux_server_administration/#ps-process-status","text":"The ps command is used to know the information of a process or list of processes. If you get an error \"ps command not found\" while running ps command, do install procps package. ps without any arguments is not very useful. Let's try to list all the processes on the system by using the below command. Reference: https://unix.stackexchange.com/questions/106847/what-does-aux-mean-in-ps-aux We can use an additional argument with ps command to list the information about the process with a specific process ID. We can use grep in combination with ps command to list only specific processes.","title":"ps (process status)"},{"location":"linux_basics/linux_server_administration/#top","text":"The top command is used to show information about Linux processes running on the system in real time. It also shows a summary of the system information. For each process, top lists down the process ID, owner, priority, state, cpu utilization, memory utilization and much more information. It also lists down the memory utilization and cpu utilization of the system as a whole along with system uptime and cpu load average.","title":"top"},{"location":"linux_basics/linux_server_administration/#memory-management","text":"In this section, we will study about some useful commands that can be used to view information about the system memory.","title":"Memory Management"},{"location":"linux_basics/linux_server_administration/#free","text":"The free command is used to display the memory usage of the system. The command displays the total free and used space available in the RAM along with space occupied by the caches/buffers. free command by default shows the memory usage in kilobytes. We can use an additional argument to get the data in human-readable format.","title":"free"},{"location":"linux_basics/linux_server_administration/#vmstat","text":"The vmstat command can be used to display the memory usage along with additional information about io and cpu usage.","title":"vmstat"},{"location":"linux_basics/linux_server_administration/#checking-disk-space","text":"In this section, we will study about some useful commands that can be used to view disk space on Linux.","title":"Checking Disk Space"},{"location":"linux_basics/linux_server_administration/#df-disk-free","text":"The df command is used to display the free and available space for each mounted file system.","title":"df (disk free)"},{"location":"linux_basics/linux_server_administration/#du-disk-usage","text":"The du command is used to display disk usage of files and directories on the system. The below command can be used to display the top 5 largest directories in the root directory.","title":"du (disk usage)"},{"location":"linux_basics/linux_server_administration/#daemons","text":"A computer program that runs as a background process is called a daemon. Traditionally, the name of daemon processes ended with d - sshd, httpd etc. We cannot interact with a daemon process as they run in the background. Services and daemons are used interchangeably most of the time.","title":"Daemons"},{"location":"linux_basics/linux_server_administration/#systemd","text":"Systemd is a system and service manager for Linux operating systems. Systemd units are the building blocks of systemd. These units are represented by unit configuration files. The below examples shows the unit configuration files available at /usr/lib/systemd/system which are distributed by installed RPM packages. We are more interested in the configuration file that ends with service as these are service units.","title":"Systemd"},{"location":"linux_basics/linux_server_administration/#managing-system-services","text":"Service units end with .service file extension. Systemctl command can be used to start/stop/restart the services managed by systemd. Command Description systemctl start name.service Starts a service systemctl stop name.service Stops a service systemctl restart name.service Restarts a service systemctl status name.service Check the status of a service systemctl reload name.service Reload the configuration of a service","title":"Managing System Services"},{"location":"linux_basics/linux_server_administration/#logs","text":"In this section, we will talk about some important files and directories which can be very useful for viewing system logs and applications logs in Linux. These logs can be very useful when you are troubleshooting on the system.","title":"Logs"},{"location":"linux_networking/conclusion/","text":"Conclusion With this we have traversed through the TCP/IP stack completely. We hope there will be a different perspective when one opens any website in the browser post the course. During the course we have also dissected what are common tasks in this pipeline which falls under the ambit of SRE. Post Training Exercises Setup own DNS resolver in the dev environment which acts as an authoritative DNS server for example.com and forwarder for other domains. Update resolv.conf to use the new DNS resolver running in localhost Set up a site dummy.example.com in localhost and run a webserver with a self signed certificate. Update the trusted CAs or pass self signed CA\u2019s public key as a parameter so that curl https://dummy.example.com -v works properly without self signed cert warning Update the routing table to use another host(container/VM) in the same network as a gateway for 8.8.8.8/32 and run ping 8.8.8.8. Do the packet capture on the new gateway to see L3 hop is working as expected(might need to disable icmp_redirect)","title":"Conclusion"},{"location":"linux_networking/conclusion/#conclusion","text":"With this we have traversed through the TCP/IP stack completely. We hope there will be a different perspective when one opens any website in the browser post the course. During the course we have also dissected what are common tasks in this pipeline which falls under the ambit of SRE.","title":"Conclusion"},{"location":"linux_networking/conclusion/#post-training-exercises","text":"Setup own DNS resolver in the dev environment which acts as an authoritative DNS server for example.com and forwarder for other domains. Update resolv.conf to use the new DNS resolver running in localhost Set up a site dummy.example.com in localhost and run a webserver with a self signed certificate. Update the trusted CAs or pass self signed CA\u2019s public key as a parameter so that curl https://dummy.example.com -v works properly without self signed cert warning Update the routing table to use another host(container/VM) in the same network as a gateway for 8.8.8.8/32 and run ping 8.8.8.8. Do the packet capture on the new gateway to see L3 hop is working as expected(might need to disable icmp_redirect)","title":"Post Training Exercises"},{"location":"linux_networking/dns/","text":"DNS Domain Names are the simple human-readable names for websites. The Internet understands only IP addresses, but since memorizing incoherent numbers is not practical, domain names are used instead. These domain names are translated into IP addresses by the DNS infrastructure. When somebody tries to open www.linkedin.com in the browser, the browser tries to convert www.linkedin.com to an IP Address. This process is called DNS resolution. A simple pseudocode depicting this process looks this ip, err = getIPAddress(domainName) if err: print(\u201cunknown Host Exception while trying to resolve:%s\u201d.format(domainName)) Now let\u2019s try to understand what happens inside the getIPAddress function. The browser would have a DNS cache of its own where it checks if there is a mapping for the domainName to an IP Address already available, in which case the browser uses that IP address. If no such mapping exists, the browser calls gethostbyname syscall to ask the operating system to find the IP address for the given domainName def getIPAddress(domainName): resp, fail = lookupCache(domainName) If not fail: return resp else: resp, err = gethostbyname(domainName) if err: return null, err else: return resp Now lets understand what operating system kernel does when the gethostbyname function is called. The Linux operating system looks at the file /etc/nsswitch.conf file which usually has a line hosts: files dns This line means the OS has to look up first in file (/etc/hosts) and then use DNS protocol to do the resolution if there is no match in /etc/hosts. The file /etc/hosts is of format IPAddress FQDN [FQDN].* 127.0.0.1 localhost.localdomain localhost ::1 localhost.localdomain localhost If a match exists for a domain in this file then that IP address is returned by the OS. Lets add a line to this file 127.0.0.1 test.linkedin.com And then do ping test.linkedin.com ping test.linkedin.com -n PING test.linkedin.com (127.0.0.1) 56(84) bytes of data. 64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.047 ms 64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.036 ms 64 bytes from 127.0.0.1: icmp_seq=3 ttl=64 time=0.037 ms As mentioned earlier, if no match exists in /etc/hosts, the OS tries to do a DNS resolution using the DNS protocol. The linux system makes a DNS request to the first IP in /etc/resolv.conf. If there is no response, requests are sent to subsequent servers in resolv.conf. These servers in resolv.conf are called DNS resolvers. The DNS resolvers are populated by DHCP or statically configured by an administrator. Dig is a userspace DNS system which creates and sends request to DNS resolvers and prints the response it receives to the console. #run this command in one shell to capture all DNS requests sudo tcpdump -s 0 -A -i any port 53 #make a dig request from another shell dig linkedin.com 13:19:54.432507 IP 172.19.209.122.56497 > 172.23.195.101.53: 527+ [1au] A? linkedin.com. (41) ....E..E....@.n....z...e...5.1.:... .........linkedin.com.......)........ 13:19:54.485131 IP 172.23.195.101.53 > 172.19.209.122.56497: 527 1/0/1 A 108.174.10.10 (57) ....E..U..@.|. ....e...z.5...A...............linkedin.com..............3..l. ..)........ The packet capture shows a request is made to 172.23.195.101:53 (this is the resolver in /etc/resolv.conf) for linkedin.com and a response is received from 172.23.195.101 with the IP address of linkedin.com 108.174.10.10 Now let's try to understand how DNS resolver tries to find the IP address of linkedin.com. DNS resolver first looks at its cache. Since many devices in the network can query for the domain name linkedin.com, the name resolution result may already exist in the cache. If there is a cache miss, it starts the DNS resolution process. The DNS server breaks \u201clinkedin.com\u201d to \u201c.\u201d, \u201ccom.\u201d and \u201clinkedin.com.\u201d and starts DNS resolution from \u201c.\u201d. The \u201c.\u201d is called root domain and those IPs are known to the DNS resolver software. DNS resolver queries the root domain Nameservers to find the right nameservers which could respond regarding details for \"com.\". The address of the authoritative nameserver of \u201ccom.\u201d is returned. Now the DNS resolution service contacts the authoritative nameserver for \u201ccom.\u201d to fetch the authoritative nameserver for \u201clinkedin.com\u201d. Once an authoritative nameserver of \u201clinkedin.com\u201d is known, the resolver contacts Linkedin\u2019s nameserver to provide the IP address of \u201clinkedin.com\u201d. This whole process can be visualized by running dig +trace linkedin.com linkedin.com. 3600 IN A 108.174.10.10 This DNS response has 5 fields where the first field is the request and the last field is the response. The second field is the Time to Live which says how long the DNS response is valid in seconds. In this case this mapping of linkedin.com is valid for 1 hour. This is how the resolvers and application(browser) maintain their cache. Any request for linkedin.com beyond 1 hour will be treated as a cache miss as the mapping has expired its TTL and the whole process has to be redone. The 4th field says the type of DNS response/request. Some of the various DNS query types are A, AAAA, NS, TXT, PTR, MX and CNAME. - A record returns IPV4 address of the domain name - AAAA record returns the IPV6 address of the domain Name - NS record returns the authoritative nameserver for the domain name - CNAME records are aliases to the domain names. Some domains point to other domain names and resolving the latter domain name gives an IP which is used as an IP for the former domain name as well. Example www.linkedin.com\u2019s IP address is the same as 2-01-2c3e-005a.cdx.cedexis.net. - For the brevity we are not discussing other DNS record types, the RFC of each of these records are available here . dig A linkedin.com +short 108.174.10.10 dig AAAA linkedin.com +short 2620:109:c002::6cae:a0a dig NS linkedin.com +short dns3.p09.nsone.net. dns4.p09.nsone.net. dns2.p09.nsone.net. ns4.p43.dynect.net. ns1.p43.dynect.net. ns2.p43.dynect.net. ns3.p43.dynect.net. dns1.p09.nsone.net. dig www.linkedin.com CNAME +short 2-01-2c3e-005a.cdx.cedexis.net. Armed with these fundamentals of DNS lets see usecases where DNS is used by SREs. Applications in SRE role This section covers some of the common solutions SRE can derive from DNS 1. Every company has to have its internal DNS infrastructure for intranet sites and internal services like databases and other internal applications like wiki. So there has to be a DNS infrastructure maintained for those domain names by the infrastructure team. This DNS infrastructure has to be optimized and scaled so that it doesn\u2019t become a single point of failure. Failure of the internal DNS infrastructure can cause API calls of microservices to fail and other cascading effects. 2. DNS can also be used for discovering services. For example the hostname serviceb.internal.example.com could list instances which run service b internally in example.com company. Cloud providers provide options to enable DNS discovery( example ) 3. DNS is used by cloud provides and CDN providers to scale their services. In Azure/AWS, Load Balancers are given a CNAME instead of IPAddress. They update the IPAddress of the Loadbalancers as they scale by changing the IP Address of alias domain names. This is one of the reasons why A records of such alias domains are short lived like 1 minute. 4. DNS can also be used to make clients get IP addresses closer to their location so that their HTTP calls can be responded faster if the company has a presence geographically distributed. 5. SRE also has to understand since there is no verification in DNS infrastructure, these responses can be spoofed. This is safeguarded by other protocols like HTTPS(dealt later). DNSSEC protects from forged or manipulated DNS responses. 6. Stale DNS cache can be a problem. Some apps might still be using expired DNS records for their api calls. This is something SRE has to be wary of when doing maintenance. 7. DNS Loadbalancing and service discovery also has to understand TTL and the servers can be removed from the pool only after waiting till TTL post the changes are made to DNS records. If this is not done, a certain portion of the traffic will fail as the server is removed before the TTL.","title":"DNS"},{"location":"linux_networking/dns/#dns","text":"Domain Names are the simple human-readable names for websites. The Internet understands only IP addresses, but since memorizing incoherent numbers is not practical, domain names are used instead. These domain names are translated into IP addresses by the DNS infrastructure. When somebody tries to open www.linkedin.com in the browser, the browser tries to convert www.linkedin.com to an IP Address. This process is called DNS resolution. A simple pseudocode depicting this process looks this ip, err = getIPAddress(domainName) if err: print(\u201cunknown Host Exception while trying to resolve:%s\u201d.format(domainName)) Now let\u2019s try to understand what happens inside the getIPAddress function. The browser would have a DNS cache of its own where it checks if there is a mapping for the domainName to an IP Address already available, in which case the browser uses that IP address. If no such mapping exists, the browser calls gethostbyname syscall to ask the operating system to find the IP address for the given domainName def getIPAddress(domainName): resp, fail = lookupCache(domainName) If not fail: return resp else: resp, err = gethostbyname(domainName) if err: return null, err else: return resp Now lets understand what operating system kernel does when the gethostbyname function is called. The Linux operating system looks at the file /etc/nsswitch.conf file which usually has a line hosts: files dns This line means the OS has to look up first in file (/etc/hosts) and then use DNS protocol to do the resolution if there is no match in /etc/hosts. The file /etc/hosts is of format IPAddress FQDN [FQDN].* 127.0.0.1 localhost.localdomain localhost ::1 localhost.localdomain localhost If a match exists for a domain in this file then that IP address is returned by the OS. Lets add a line to this file 127.0.0.1 test.linkedin.com And then do ping test.linkedin.com ping test.linkedin.com -n PING test.linkedin.com (127.0.0.1) 56(84) bytes of data. 64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.047 ms 64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.036 ms 64 bytes from 127.0.0.1: icmp_seq=3 ttl=64 time=0.037 ms As mentioned earlier, if no match exists in /etc/hosts, the OS tries to do a DNS resolution using the DNS protocol. The linux system makes a DNS request to the first IP in /etc/resolv.conf. If there is no response, requests are sent to subsequent servers in resolv.conf. These servers in resolv.conf are called DNS resolvers. The DNS resolvers are populated by DHCP or statically configured by an administrator. Dig is a userspace DNS system which creates and sends request to DNS resolvers and prints the response it receives to the console. #run this command in one shell to capture all DNS requests sudo tcpdump -s 0 -A -i any port 53 #make a dig request from another shell dig linkedin.com 13:19:54.432507 IP 172.19.209.122.56497 > 172.23.195.101.53: 527+ [1au] A? linkedin.com. (41) ....E..E....@.n....z...e...5.1.:... .........linkedin.com.......)........ 13:19:54.485131 IP 172.23.195.101.53 > 172.19.209.122.56497: 527 1/0/1 A 108.174.10.10 (57) ....E..U..@.|. ....e...z.5...A...............linkedin.com..............3..l. ..)........ The packet capture shows a request is made to 172.23.195.101:53 (this is the resolver in /etc/resolv.conf) for linkedin.com and a response is received from 172.23.195.101 with the IP address of linkedin.com 108.174.10.10 Now let's try to understand how DNS resolver tries to find the IP address of linkedin.com. DNS resolver first looks at its cache. Since many devices in the network can query for the domain name linkedin.com, the name resolution result may already exist in the cache. If there is a cache miss, it starts the DNS resolution process. The DNS server breaks \u201clinkedin.com\u201d to \u201c.\u201d, \u201ccom.\u201d and \u201clinkedin.com.\u201d and starts DNS resolution from \u201c.\u201d. The \u201c.\u201d is called root domain and those IPs are known to the DNS resolver software. DNS resolver queries the root domain Nameservers to find the right nameservers which could respond regarding details for \"com.\". The address of the authoritative nameserver of \u201ccom.\u201d is returned. Now the DNS resolution service contacts the authoritative nameserver for \u201ccom.\u201d to fetch the authoritative nameserver for \u201clinkedin.com\u201d. Once an authoritative nameserver of \u201clinkedin.com\u201d is known, the resolver contacts Linkedin\u2019s nameserver to provide the IP address of \u201clinkedin.com\u201d. This whole process can be visualized by running dig +trace linkedin.com linkedin.com. 3600 IN A 108.174.10.10 This DNS response has 5 fields where the first field is the request and the last field is the response. The second field is the Time to Live which says how long the DNS response is valid in seconds. In this case this mapping of linkedin.com is valid for 1 hour. This is how the resolvers and application(browser) maintain their cache. Any request for linkedin.com beyond 1 hour will be treated as a cache miss as the mapping has expired its TTL and the whole process has to be redone. The 4th field says the type of DNS response/request. Some of the various DNS query types are A, AAAA, NS, TXT, PTR, MX and CNAME. - A record returns IPV4 address of the domain name - AAAA record returns the IPV6 address of the domain Name - NS record returns the authoritative nameserver for the domain name - CNAME records are aliases to the domain names. Some domains point to other domain names and resolving the latter domain name gives an IP which is used as an IP for the former domain name as well. Example www.linkedin.com\u2019s IP address is the same as 2-01-2c3e-005a.cdx.cedexis.net. - For the brevity we are not discussing other DNS record types, the RFC of each of these records are available here . dig A linkedin.com +short 108.174.10.10 dig AAAA linkedin.com +short 2620:109:c002::6cae:a0a dig NS linkedin.com +short dns3.p09.nsone.net. dns4.p09.nsone.net. dns2.p09.nsone.net. ns4.p43.dynect.net. ns1.p43.dynect.net. ns2.p43.dynect.net. ns3.p43.dynect.net. dns1.p09.nsone.net. dig www.linkedin.com CNAME +short 2-01-2c3e-005a.cdx.cedexis.net. Armed with these fundamentals of DNS lets see usecases where DNS is used by SREs.","title":"DNS"},{"location":"linux_networking/dns/#applications-in-sre-role","text":"This section covers some of the common solutions SRE can derive from DNS 1. Every company has to have its internal DNS infrastructure for intranet sites and internal services like databases and other internal applications like wiki. So there has to be a DNS infrastructure maintained for those domain names by the infrastructure team. This DNS infrastructure has to be optimized and scaled so that it doesn\u2019t become a single point of failure. Failure of the internal DNS infrastructure can cause API calls of microservices to fail and other cascading effects. 2. DNS can also be used for discovering services. For example the hostname serviceb.internal.example.com could list instances which run service b internally in example.com company. Cloud providers provide options to enable DNS discovery( example ) 3. DNS is used by cloud provides and CDN providers to scale their services. In Azure/AWS, Load Balancers are given a CNAME instead of IPAddress. They update the IPAddress of the Loadbalancers as they scale by changing the IP Address of alias domain names. This is one of the reasons why A records of such alias domains are short lived like 1 minute. 4. DNS can also be used to make clients get IP addresses closer to their location so that their HTTP calls can be responded faster if the company has a presence geographically distributed. 5. SRE also has to understand since there is no verification in DNS infrastructure, these responses can be spoofed. This is safeguarded by other protocols like HTTPS(dealt later). DNSSEC protects from forged or manipulated DNS responses. 6. Stale DNS cache can be a problem. Some apps might still be using expired DNS records for their api calls. This is something SRE has to be wary of when doing maintenance. 7. DNS Loadbalancing and service discovery also has to understand TTL and the servers can be removed from the pool only after waiting till TTL post the changes are made to DNS records. If this is not done, a certain portion of the traffic will fail as the server is removed before the TTL.","title":"Applications in SRE role"},{"location":"linux_networking/http/","text":"HTTP Till this point we have only got the IP address of linkedin.com. The HTML page of linkedin.com is served by HTTP protocol which the browser renders. Browser sends a HTTP request to the IP of the server determined above. Request has a verb GET, PUT, POST followed by a path and query parameters and lines of key value pair which gives information about the client and capabilities of the client like contents it can accept and a body (usually in POST or PUT) # Eg run the following in your container and have a look at the headers curl linkedin.com -v * Connected to linkedin.com (108.174.10.10) port 80 (#0) > GET / HTTP/1.1 > Host: linkedin.com > User-Agent: curl/7.64.1 > Accept: */* > < HTTP/1.1 301 Moved Permanently < Date: Mon, 09 Nov 2020 10:39:43 GMT < X-Li-Pop: prod-esv5 < X-LI-Proto: http/1.1 < Location: https://www.linkedin.com/ < Content-Length: 0 < * Connection #0 to host linkedin.com left intact * Closing connection 0 Here, in the first line GET is the verb, / is the path and 1.1 is the HTTP protocol version. Then there are key value pairs which give client capabilities and some details to the server. The server responds back with HTTP version, Status Code and Status message . Status codes 2xx means success, 3xx denotes redirection, 4xx denotes client side errors and 5xx server side errors. We will now jump in to see the difference between HTTP/1.0 and HTTP/1.1. #On the terminal type telnet www.linkedin.com 80 #Copy and paste the following with an empty new line at last in the telnet STDIN GET / HTTP/1.1 HOST:linkedin.com USER-AGENT: curl This would get server response and waits for next input as the underlying connection to www.linkedin.com can be reused for further queries. While going through TCP, we can understand the benefits of this. But in HTTP/1.0 this connection will be immediately closed after the response meaning new connection has to be opened for each query. HTTP/1.1 can have only one inflight request in an open connection but connection can be reused for multiple requests one after another. One of the benefits of HTTP/2.0 over HTTP/1.1 is we can have multiple inflight requests on the same connection. We are restricting our scope to generic HTTP and not jumping to the intricacies of each protocol version but they should be straight forward to understand post the course. HTTP is called stateless protocol . This section we will try to understand what stateless means. Say we logged in to linkedin.com, each request to linkedin.com from the client will have no context of the user and it makes no sense to prompt user to login for each page/resource. This problem of HTTP is solved by COOKIE . A user is created a session when a user logs in. This session identifier is sent to the browser via SET-COOKIE header. The browser stores the COOKIE till the expiry set by the server and sends the cookie for each request from hereon for linkedin.com. More details on cookies are available here . Cookies are a critical piece of information like password and since HTTP is a plain text protocol, any man in the middle can capture either password or cookies and can breach the privacy of the user. Similarly as discussed during DNS a spoofed IP of linkedin.com can cause a phishing attack on users where an user can give linkedin\u2019s password to login on the malicious site. To solve both problems HTTPs came in place and HTTPs has to be mandated. HTTPS has to provide server identification and encryption of data between client and server. The server administrator has to generate a private public key pair and certificate request. This certificate request has to be signed by a certificate authority which converts the certificate request to a certificate. The server administrator has to update the certificate and private key to the webserver. The certificate has details about the server (like domain name for which it serves, expiry date), public key of the server. The private key is a secret to the server and losing the private key loses the trust the server provides. When clients connect, the client sends a HELLO. The server sends its certificate to the client. The client checks the validity of the cert by seeing if it is within its expiry time, if it is signed by a trusted authority and the hostname in the cert is the same as the server. This validation makes sure the server is the right server and there is no phishing. Once that is validated, the client negotiates a symmetrical key and cipher with the server by encrypting the negotiation with the public key of the server. Nobody else other than the server who has the private key can understand this data. Once negotiation is complete, that symmetric key and algorithm is used for further encryption which can be decrypted only by client and server from thereon as they only know the symmetric key and algorithm. The switch to symmetric algorithm from asymmetric encryption algorithm is to not strain the resources of client devices as symmetric encryption is generally less resource intensive than asymmetric. #Try the following on your terminal to see the cert details like Subject Name(domain name), Issuer details, Expiry date curl https://www.linkedin.com -v * Connected to www.linkedin.com (13.107.42.14) port 443 (#0) * ALPN, offering h2 * ALPN, offering http/1.1 * successfully set certificate verify locations: * CAfile: /etc/ssl/cert.pem CApath: none * TLSv1.2 (OUT), TLS handshake, Client hello (1): } [230 bytes data] * TLSv1.2 (IN), TLS handshake, Server hello (2): { [90 bytes data] * TLSv1.2 (IN), TLS handshake, Certificate (11): { [3171 bytes data] * TLSv1.2 (IN), TLS handshake, Server key exchange (12): { [365 bytes data] * TLSv1.2 (IN), TLS handshake, Server finished (14): { [4 bytes data] * TLSv1.2 (OUT), TLS handshake, Client key exchange (16): } [102 bytes data] * TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1): } [1 bytes data] * TLSv1.2 (OUT), TLS handshake, Finished (20): } [16 bytes data] * TLSv1.2 (IN), TLS change cipher, Change cipher spec (1): { [1 bytes data] * TLSv1.2 (IN), TLS handshake, Finished (20): { [16 bytes data] * SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384 * ALPN, server accepted to use h2 * Server certificate: * subject: C=US; ST=California; L=Sunnyvale; O=LinkedIn Corporation; CN=www.linkedin.com * start date: Oct 2 00:00:00 2020 GMT * expire date: Apr 2 12:00:00 2021 GMT * subjectAltName: host \"www.linkedin.com\" matched cert's \"www.linkedin.com\" * issuer: C=US; O=DigiCert Inc; CN=DigiCert SHA2 Secure Server CA * SSL certificate verify ok. * Using HTTP2, server supports multi-use * Connection state changed (HTTP/2 confirmed) * Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0 * Using Stream ID: 1 (easy handle 0x7fb055808200) * Connection state changed (MAX_CONCURRENT_STREAMS == 100)! 0 82117 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0 * Connection #0 to host www.linkedin.com left intact HTTP/2 200 cache-control: no-cache, no-store pragma: no-cache content-length: 82117 content-type: text/html; charset=utf-8 expires: Thu, 01 Jan 1970 00:00:00 GMT set-cookie: JSESSIONID=ajax:2747059799136291014; SameSite=None; Path=/; Domain=.www.linkedin.com; Secure set-cookie: lang=v=2&lang=en-us; SameSite=None; Path=/; Domain=linkedin.com; Secure set-cookie: bcookie=\"v=2&70bd59e3-5a51-406c-8e0d-dd70befa8890\"; domain=.linkedin.com; Path=/; Secure; Expires=Wed, 09-Nov-2022 22:27:42 GMT; SameSite=None set-cookie: bscookie=\"v=1&202011091050107ae9b7ac-fe97-40fc-830d-d7a9ccf80659AQGib5iXwarbY8CCBP94Q39THkgUlx6J\"; domain=.www.linkedin.com; Path=/; Secure; Expires=Wed, 09-Nov-2022 22:27:42 GMT; HttpOnly; SameSite=None set-cookie: lissc=1; domain=.linkedin.com; Path=/; Secure; Expires=Tue, 09-Nov-2021 10:50:10 GMT; SameSite=None set-cookie: lidc=\"b=VGST04:s=V:r=V:g=2201:u=1:i=1604919010:t=1605005410:v=1:sig=AQHe-KzU8i_5Iy6MwnFEsgRct3c9Lh5R\"; Expires=Tue, 10 Nov 2020 10:50:10 GMT; domain=.linkedin.com; Path=/; SameSite=None; Secure x-fs-txn-id: 2b8d5409ba70 x-fs-uuid: 61bbf94956d14516302567fc882b0000 expect-ct: max-age=86400, report-uri=\"https://www.linkedin.com/platform-telemetry/ct\" x-xss-protection: 1; mode=block content-security-policy-report-only: default-src 'none'; connect-src 'self' www.linkedin.com www.google-analytics.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://linkedin.sc.omtrdc.net/b/ss/ static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com; script-src 'sha256-THuVhwbXPeTR0HszASqMOnIyxqEgvGyBwSPBKBF/iMc=' 'sha256-PyCXNcEkzRWqbiNr087fizmiBBrq9O6GGD8eV3P09Ik=' 'sha256-2SQ55Erm3CPCb+k03EpNxU9bdV3XL9TnVTriDs7INZ4=' 'sha256-S/KSPe186K/1B0JEjbIXcCdpB97krdzX05S+dHnQjUs=' platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'self' 'unsafe-inline' static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com; media-src dms.licdn.com; child-src blob: *; frame-src 'self' lnkd.demdex.net linkedin.cdn.qualaroo.com; manifest-src 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=g content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=l x-frame-options: sameorigin x-content-type-options: nosniff strict-transport-security: max-age=2592000 x-li-fabric: prod-lva1 x-li-pop: afd-prod-lva1 x-li-proto: http/2 x-li-uuid: Ybv5SVbRRRYwJWf8iCsAAA== x-msedge-ref: Ref A: CFB9AC1D2B0645DDB161CEE4A4909AEF Ref B: BOM02EDGE0712 Ref C: 2020-11-09T10:50:10Z date: Mon, 09 Nov 2020 10:50:10 GMT * Closing connection 0 Here my system has a list of certificate authorities it trusts in this file /etc/ssl/cert.pem. Curl validates the certificate is for www.linkedin.com by seeing the CN section of the subject part of the certificate. It also makes sure the certificate is not expired by seeing the expire date. It also validates the signature on the certificate by using the public key of issuer Digicert in /etc/ssl/cert.pem. Once this is done, using the public key of www.linkedin.com it negotiates cipher TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 with a symmetric key. Subsequent data transfer including first HTTP request uses the same cipher and symmetric key.","title":"HTTP"},{"location":"linux_networking/http/#http","text":"Till this point we have only got the IP address of linkedin.com. The HTML page of linkedin.com is served by HTTP protocol which the browser renders. Browser sends a HTTP request to the IP of the server determined above. Request has a verb GET, PUT, POST followed by a path and query parameters and lines of key value pair which gives information about the client and capabilities of the client like contents it can accept and a body (usually in POST or PUT) # Eg run the following in your container and have a look at the headers curl linkedin.com -v * Connected to linkedin.com (108.174.10.10) port 80 (#0) > GET / HTTP/1.1 > Host: linkedin.com > User-Agent: curl/7.64.1 > Accept: */* > < HTTP/1.1 301 Moved Permanently < Date: Mon, 09 Nov 2020 10:39:43 GMT < X-Li-Pop: prod-esv5 < X-LI-Proto: http/1.1 < Location: https://www.linkedin.com/ < Content-Length: 0 < * Connection #0 to host linkedin.com left intact * Closing connection 0 Here, in the first line GET is the verb, / is the path and 1.1 is the HTTP protocol version. Then there are key value pairs which give client capabilities and some details to the server. The server responds back with HTTP version, Status Code and Status message . Status codes 2xx means success, 3xx denotes redirection, 4xx denotes client side errors and 5xx server side errors. We will now jump in to see the difference between HTTP/1.0 and HTTP/1.1. #On the terminal type telnet www.linkedin.com 80 #Copy and paste the following with an empty new line at last in the telnet STDIN GET / HTTP/1.1 HOST:linkedin.com USER-AGENT: curl This would get server response and waits for next input as the underlying connection to www.linkedin.com can be reused for further queries. While going through TCP, we can understand the benefits of this. But in HTTP/1.0 this connection will be immediately closed after the response meaning new connection has to be opened for each query. HTTP/1.1 can have only one inflight request in an open connection but connection can be reused for multiple requests one after another. One of the benefits of HTTP/2.0 over HTTP/1.1 is we can have multiple inflight requests on the same connection. We are restricting our scope to generic HTTP and not jumping to the intricacies of each protocol version but they should be straight forward to understand post the course. HTTP is called stateless protocol . This section we will try to understand what stateless means. Say we logged in to linkedin.com, each request to linkedin.com from the client will have no context of the user and it makes no sense to prompt user to login for each page/resource. This problem of HTTP is solved by COOKIE . A user is created a session when a user logs in. This session identifier is sent to the browser via SET-COOKIE header. The browser stores the COOKIE till the expiry set by the server and sends the cookie for each request from hereon for linkedin.com. More details on cookies are available here . Cookies are a critical piece of information like password and since HTTP is a plain text protocol, any man in the middle can capture either password or cookies and can breach the privacy of the user. Similarly as discussed during DNS a spoofed IP of linkedin.com can cause a phishing attack on users where an user can give linkedin\u2019s password to login on the malicious site. To solve both problems HTTPs came in place and HTTPs has to be mandated. HTTPS has to provide server identification and encryption of data between client and server. The server administrator has to generate a private public key pair and certificate request. This certificate request has to be signed by a certificate authority which converts the certificate request to a certificate. The server administrator has to update the certificate and private key to the webserver. The certificate has details about the server (like domain name for which it serves, expiry date), public key of the server. The private key is a secret to the server and losing the private key loses the trust the server provides. When clients connect, the client sends a HELLO. The server sends its certificate to the client. The client checks the validity of the cert by seeing if it is within its expiry time, if it is signed by a trusted authority and the hostname in the cert is the same as the server. This validation makes sure the server is the right server and there is no phishing. Once that is validated, the client negotiates a symmetrical key and cipher with the server by encrypting the negotiation with the public key of the server. Nobody else other than the server who has the private key can understand this data. Once negotiation is complete, that symmetric key and algorithm is used for further encryption which can be decrypted only by client and server from thereon as they only know the symmetric key and algorithm. The switch to symmetric algorithm from asymmetric encryption algorithm is to not strain the resources of client devices as symmetric encryption is generally less resource intensive than asymmetric. #Try the following on your terminal to see the cert details like Subject Name(domain name), Issuer details, Expiry date curl https://www.linkedin.com -v * Connected to www.linkedin.com (13.107.42.14) port 443 (#0) * ALPN, offering h2 * ALPN, offering http/1.1 * successfully set certificate verify locations: * CAfile: /etc/ssl/cert.pem CApath: none * TLSv1.2 (OUT), TLS handshake, Client hello (1): } [230 bytes data] * TLSv1.2 (IN), TLS handshake, Server hello (2): { [90 bytes data] * TLSv1.2 (IN), TLS handshake, Certificate (11): { [3171 bytes data] * TLSv1.2 (IN), TLS handshake, Server key exchange (12): { [365 bytes data] * TLSv1.2 (IN), TLS handshake, Server finished (14): { [4 bytes data] * TLSv1.2 (OUT), TLS handshake, Client key exchange (16): } [102 bytes data] * TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1): } [1 bytes data] * TLSv1.2 (OUT), TLS handshake, Finished (20): } [16 bytes data] * TLSv1.2 (IN), TLS change cipher, Change cipher spec (1): { [1 bytes data] * TLSv1.2 (IN), TLS handshake, Finished (20): { [16 bytes data] * SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384 * ALPN, server accepted to use h2 * Server certificate: * subject: C=US; ST=California; L=Sunnyvale; O=LinkedIn Corporation; CN=www.linkedin.com * start date: Oct 2 00:00:00 2020 GMT * expire date: Apr 2 12:00:00 2021 GMT * subjectAltName: host \"www.linkedin.com\" matched cert's \"www.linkedin.com\" * issuer: C=US; O=DigiCert Inc; CN=DigiCert SHA2 Secure Server CA * SSL certificate verify ok. * Using HTTP2, server supports multi-use * Connection state changed (HTTP/2 confirmed) * Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0 * Using Stream ID: 1 (easy handle 0x7fb055808200) * Connection state changed (MAX_CONCURRENT_STREAMS == 100)! 0 82117 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0 * Connection #0 to host www.linkedin.com left intact HTTP/2 200 cache-control: no-cache, no-store pragma: no-cache content-length: 82117 content-type: text/html; charset=utf-8 expires: Thu, 01 Jan 1970 00:00:00 GMT set-cookie: JSESSIONID=ajax:2747059799136291014; SameSite=None; Path=/; Domain=.www.linkedin.com; Secure set-cookie: lang=v=2&lang=en-us; SameSite=None; Path=/; Domain=linkedin.com; Secure set-cookie: bcookie=\"v=2&70bd59e3-5a51-406c-8e0d-dd70befa8890\"; domain=.linkedin.com; Path=/; Secure; Expires=Wed, 09-Nov-2022 22:27:42 GMT; SameSite=None set-cookie: bscookie=\"v=1&202011091050107ae9b7ac-fe97-40fc-830d-d7a9ccf80659AQGib5iXwarbY8CCBP94Q39THkgUlx6J\"; domain=.www.linkedin.com; Path=/; Secure; Expires=Wed, 09-Nov-2022 22:27:42 GMT; HttpOnly; SameSite=None set-cookie: lissc=1; domain=.linkedin.com; Path=/; Secure; Expires=Tue, 09-Nov-2021 10:50:10 GMT; SameSite=None set-cookie: lidc=\"b=VGST04:s=V:r=V:g=2201:u=1:i=1604919010:t=1605005410:v=1:sig=AQHe-KzU8i_5Iy6MwnFEsgRct3c9Lh5R\"; Expires=Tue, 10 Nov 2020 10:50:10 GMT; domain=.linkedin.com; Path=/; SameSite=None; Secure x-fs-txn-id: 2b8d5409ba70 x-fs-uuid: 61bbf94956d14516302567fc882b0000 expect-ct: max-age=86400, report-uri=\"https://www.linkedin.com/platform-telemetry/ct\" x-xss-protection: 1; mode=block content-security-policy-report-only: default-src 'none'; connect-src 'self' www.linkedin.com www.google-analytics.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://linkedin.sc.omtrdc.net/b/ss/ static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com; script-src 'sha256-THuVhwbXPeTR0HszASqMOnIyxqEgvGyBwSPBKBF/iMc=' 'sha256-PyCXNcEkzRWqbiNr087fizmiBBrq9O6GGD8eV3P09Ik=' 'sha256-2SQ55Erm3CPCb+k03EpNxU9bdV3XL9TnVTriDs7INZ4=' 'sha256-S/KSPe186K/1B0JEjbIXcCdpB97krdzX05S+dHnQjUs=' platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'self' 'unsafe-inline' static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com; media-src dms.licdn.com; child-src blob: *; frame-src 'self' lnkd.demdex.net linkedin.cdn.qualaroo.com; manifest-src 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=g content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=l x-frame-options: sameorigin x-content-type-options: nosniff strict-transport-security: max-age=2592000 x-li-fabric: prod-lva1 x-li-pop: afd-prod-lva1 x-li-proto: http/2 x-li-uuid: Ybv5SVbRRRYwJWf8iCsAAA== x-msedge-ref: Ref A: CFB9AC1D2B0645DDB161CEE4A4909AEF Ref B: BOM02EDGE0712 Ref C: 2020-11-09T10:50:10Z date: Mon, 09 Nov 2020 10:50:10 GMT * Closing connection 0 Here my system has a list of certificate authorities it trusts in this file /etc/ssl/cert.pem. Curl validates the certificate is for www.linkedin.com by seeing the CN section of the subject part of the certificate. It also makes sure the certificate is not expired by seeing the expire date. It also validates the signature on the certificate by using the public key of issuer Digicert in /etc/ssl/cert.pem. Once this is done, using the public key of www.linkedin.com it negotiates cipher TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 with a symmetric key. Subsequent data transfer including first HTTP request uses the same cipher and symmetric key.","title":"HTTP"},{"location":"linux_networking/intro/","text":"Linux Networking Fundamentals Prerequisites High-level knowledge of commonly used jargon in TCP/IP stack like DNS, TCP, UDP and HTTP Linux Commandline Basics What to expect from this course Throughout the course, we cover how an SRE can optimize the system to improve their web stack performance and troubleshoot if there is an issue in any of the layers of the networking stack. This course tries to dig through each layer of traditional TCP/IP stack and expects an SRE to have a picture beyond the bird\u2019s eye view of the functioning of the Internet. What is not covered under this course This course spends time on the fundamentals. We are not covering concepts like HTTP/2.0 , QUIC , TCP congestion control protocols , Anycast , BGP , CDN , Tunnels and Multicast . We expect that this course will provide the relevant basics to understand such concepts Birds eye view of the course The course covers the question \u201cWhat happens when you open linkedin.com in your browser?\u201d The course follows the flow of TCP/IP stack.More specifically, the course covers topics of Application layer protocols DNS and HTTP, transport layer protocols UDP and TCP, networking layer protocol IP and Data Link Layer protocol Course Contents DNS UDP HTTP TCP IP Routing","title":"Introduction"},{"location":"linux_networking/intro/#linux-networking-fundamentals","text":"","title":"Linux Networking Fundamentals"},{"location":"linux_networking/intro/#prerequisites","text":"High-level knowledge of commonly used jargon in TCP/IP stack like DNS, TCP, UDP and HTTP Linux Commandline Basics","title":"Prerequisites"},{"location":"linux_networking/intro/#what-to-expect-from-this-course","text":"Throughout the course, we cover how an SRE can optimize the system to improve their web stack performance and troubleshoot if there is an issue in any of the layers of the networking stack. This course tries to dig through each layer of traditional TCP/IP stack and expects an SRE to have a picture beyond the bird\u2019s eye view of the functioning of the Internet.","title":"What to expect from this course"},{"location":"linux_networking/intro/#what-is-not-covered-under-this-course","text":"This course spends time on the fundamentals. We are not covering concepts like HTTP/2.0 , QUIC , TCP congestion control protocols , Anycast , BGP , CDN , Tunnels and Multicast . We expect that this course will provide the relevant basics to understand such concepts","title":"What is not covered under this course"},{"location":"linux_networking/intro/#birds-eye-view-of-the-course","text":"The course covers the question \u201cWhat happens when you open linkedin.com in your browser?\u201d The course follows the flow of TCP/IP stack.More specifically, the course covers topics of Application layer protocols DNS and HTTP, transport layer protocols UDP and TCP, networking layer protocol IP and Data Link Layer protocol","title":"Birds eye view of the course"},{"location":"linux_networking/intro/#course-contents","text":"DNS UDP HTTP TCP IP Routing","title":"Course Contents"},{"location":"linux_networking/ipr/","text":"IP Routing and Data Link Layer We will dig how packets that leave the client reach the server and vice versa. When the packet reaches the IP layer, the transport layer populates source port, destination port. IP/Network layer populates destination IP(discovered from DNS) and then looks up the route to the destination IP on the routing table. #Linux route -n command gives the default routing table route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 172.17.0.1 0.0.0.0 UG 0 0 0 eth0 172.17.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0 Here the destination IP is bitwise AND\u2019d with the Genmask and if the answer is the destination part of the table then that gateway and interface is picked for routing. Here linkedin.com\u2019s IP 108.174.10.10 is AND\u2019d with 255.255.255.0 and the answer we get is 108.174.10.0 which doesn\u2019t match with any destination in the routing table. Then Linux does an AND of destination IP with 0.0.0.0 and we get 0.0.0.0. This answer matches the default row Routing table is processed in the order of more octets of 1 set in genmask and genmask 0.0.0.0 is the default route if nothing matches. At the end of this operation Linux figured out that the packet has to be sent to next hop 172.17.0.1 via eth0. The source IP of the packet will be set as the IP of interface eth0. Now to send the packet to 172.17.0.1 linux has to figure out the MAC address of 172.17.0.1. MAC address is figured by looking at the internal arp cache which stores translation between IP address and MAC address. If there is a cache miss, Linux broadcasts ARP request within the internal network asking who has 172.17.0.1. The owner of the IP sends an ARP response which is cached by the kernel and the kernel sends the packet to the gateway by setting Source mac address as mac address of eth0 and destination mac address of 172.17.0.1 which we got just now. Similar routing lookup process is followed in each hop till the packet reaches the actual server. Transport layer and layers above it come to play only at end servers. During intermediate hops only till the IP/Network layer is involved. One weird gateway we saw in the routing table is 0.0.0.0. This gateway means no Layer3(Network layer) hop is needed to send the packet. Both source and destination are in the same network. Kernel has to figure out the mac of the destination and populate source and destination mac appropriately and send the packet out so that it reaches the destination without any Layer3 hop in the middle As we followed in other modules, lets complete this session with SRE usecases Applications in SRE role Generally the routing table is populated by DHCP and playing around is not a good practice. There can be reasons where one has to play around the routing table but take that path only when it's absolutely necessary Understanding error messages better like, \u201cNo route to host\u201d error can mean mac address of the destination host is not found and it can mean the destination host is down On rare cases looking at the ARP table can help us understand if there is a IP conflict where same IP is assigned to two hosts by mistake and this is causing unexpected behavior","title":"Routing"},{"location":"linux_networking/ipr/#ip-routing-and-data-link-layer","text":"We will dig how packets that leave the client reach the server and vice versa. When the packet reaches the IP layer, the transport layer populates source port, destination port. IP/Network layer populates destination IP(discovered from DNS) and then looks up the route to the destination IP on the routing table. #Linux route -n command gives the default routing table route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 172.17.0.1 0.0.0.0 UG 0 0 0 eth0 172.17.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0 Here the destination IP is bitwise AND\u2019d with the Genmask and if the answer is the destination part of the table then that gateway and interface is picked for routing. Here linkedin.com\u2019s IP 108.174.10.10 is AND\u2019d with 255.255.255.0 and the answer we get is 108.174.10.0 which doesn\u2019t match with any destination in the routing table. Then Linux does an AND of destination IP with 0.0.0.0 and we get 0.0.0.0. This answer matches the default row Routing table is processed in the order of more octets of 1 set in genmask and genmask 0.0.0.0 is the default route if nothing matches. At the end of this operation Linux figured out that the packet has to be sent to next hop 172.17.0.1 via eth0. The source IP of the packet will be set as the IP of interface eth0. Now to send the packet to 172.17.0.1 linux has to figure out the MAC address of 172.17.0.1. MAC address is figured by looking at the internal arp cache which stores translation between IP address and MAC address. If there is a cache miss, Linux broadcasts ARP request within the internal network asking who has 172.17.0.1. The owner of the IP sends an ARP response which is cached by the kernel and the kernel sends the packet to the gateway by setting Source mac address as mac address of eth0 and destination mac address of 172.17.0.1 which we got just now. Similar routing lookup process is followed in each hop till the packet reaches the actual server. Transport layer and layers above it come to play only at end servers. During intermediate hops only till the IP/Network layer is involved. One weird gateway we saw in the routing table is 0.0.0.0. This gateway means no Layer3(Network layer) hop is needed to send the packet. Both source and destination are in the same network. Kernel has to figure out the mac of the destination and populate source and destination mac appropriately and send the packet out so that it reaches the destination without any Layer3 hop in the middle As we followed in other modules, lets complete this session with SRE usecases","title":"IP Routing and Data Link Layer"},{"location":"linux_networking/ipr/#applications-in-sre-role","text":"Generally the routing table is populated by DHCP and playing around is not a good practice. There can be reasons where one has to play around the routing table but take that path only when it's absolutely necessary Understanding error messages better like, \u201cNo route to host\u201d error can mean mac address of the destination host is not found and it can mean the destination host is down On rare cases looking at the ARP table can help us understand if there is a IP conflict where same IP is assigned to two hosts by mistake and this is causing unexpected behavior","title":"Applications in SRE role"},{"location":"linux_networking/tcp/","text":"TCP TCP is a transport layer protocol like UDP but it guarantees reliability, flow control and congestion control. TCP guarantees reliable delivery by using sequence numbers. A TCP connection is established by a three way handshake. In our case, the client sends a SYN packet along with the starting sequence number it plans to use, the server acknowledges the SYN packet and sends a SYN with its sequence number. Once the client acknowledges the syn packet, the connection is established. Each data transferred from here on is considered delivered reliably once acknowledgement for that sequence is received by the concerned party #To understand handshake run packet capture on one bash session tcpdump -S -i any port 80 #Run curl on one bash session curl www.linkedin.com Here client sends a syn flag shown by [S] flag with a sequence number 1522264672. The server acknowledges receipt of SYN with an ack [.] flag and a Syn flag for its sequence number[S]. The server uses the sequence number 1063230400 and acknowledges the client it\u2019s expecting sequence number 1522264673 (client sequence+1). Client sends a zero length acknowledgement packet to the server(server sequence+1) and connection stands established. This is called three way handshake. The client sends a 76 bytes length packet after this and increments its sequence number by 76. Server sends a 170 byte response and closes the connection. This was the difference we were talking about between HTTP/1.1 and HTTP/1.0. In HTTP/1.1 this same connection can be reused which reduces overhead of 3 way handshake for each HTTP request. If a packet is missed between client and server, server won\u2019t send an ack to the client and client would retry sending the packet till the ACK is received. This guarantees reliability. The flow control is established by the win size field in each segment. The win size says available TCP buffer length in the kernel which can be used to buffer received segments. A size 0 means the receiver has a lot of lag to catch from its socket buffer and the sender has to pause sending packets so that receiver can cope up. This flow control protects from slow receiver and fast sender problem TCP also does congestion control which determines how many segments can be in transit without an ack. Linux provides us the ability to configure algorithms for congestion control which we are not covering here. While closing a connection, client/server calls a close syscall. Let's assume client do that. Client\u2019s kernel will send a FIN packet to the server. Server\u2019s kernel can\u2019t close the connection till the close syscall is called by the server application. Once server app calls close, server also sends a FIN packet and client enters into time wait state for 2*MSS(120s) so that this socket can\u2019t be reused for that time period to prevent any TCP state corruptions due to stray stale packets. Armed with our TCP and HTTP knowledge lets see how this is used by SREs in their role Applications in SRE role Scaling HTTP performance using load balancers need consistent knowledge about both TCP and HTTP. There are different kinds of load balancing like L4, L7 load balancing, Direct Server Return etc. HTTPs offloading can be done on Load balancer or directly on servers based on the performance and compliance needs. Tweaking sysctl variables for rmem and wmem like we did for UDP can improve throughput of sender and receiver. Sysctl variable tcp_max_syn_backlog and socket variable somax_conn determines how many connections for which the kernel can complete 3 way handshake before app calling accept syscall. This is much useful in single threaded applications. Once the backlog is full, new connections stay in SYN_RCVD state (when you run netstat) till the application calls accept syscall Apps can run out of file descriptors if there are too many short lived connections. Digging through tcp_reuse and tcp_recycle can help reduce time spent in the time wait state(it has its own risk). Making apps reuse a pool of connections instead of creating ad hoc connection can also help Understanding performance bottlenecks by seeing metrics and classifying whether its a problem in App or network side. Example too many sockets in Close_wait state is a problem on application whereas retransmissions can be a problem more on network or on OS stack than the application itself. Understanding the fundamentals can help us narrow down where the bottleneck is","title":"TCP"},{"location":"linux_networking/tcp/#tcp","text":"TCP is a transport layer protocol like UDP but it guarantees reliability, flow control and congestion control. TCP guarantees reliable delivery by using sequence numbers. A TCP connection is established by a three way handshake. In our case, the client sends a SYN packet along with the starting sequence number it plans to use, the server acknowledges the SYN packet and sends a SYN with its sequence number. Once the client acknowledges the syn packet, the connection is established. Each data transferred from here on is considered delivered reliably once acknowledgement for that sequence is received by the concerned party #To understand handshake run packet capture on one bash session tcpdump -S -i any port 80 #Run curl on one bash session curl www.linkedin.com Here client sends a syn flag shown by [S] flag with a sequence number 1522264672. The server acknowledges receipt of SYN with an ack [.] flag and a Syn flag for its sequence number[S]. The server uses the sequence number 1063230400 and acknowledges the client it\u2019s expecting sequence number 1522264673 (client sequence+1). Client sends a zero length acknowledgement packet to the server(server sequence+1) and connection stands established. This is called three way handshake. The client sends a 76 bytes length packet after this and increments its sequence number by 76. Server sends a 170 byte response and closes the connection. This was the difference we were talking about between HTTP/1.1 and HTTP/1.0. In HTTP/1.1 this same connection can be reused which reduces overhead of 3 way handshake for each HTTP request. If a packet is missed between client and server, server won\u2019t send an ack to the client and client would retry sending the packet till the ACK is received. This guarantees reliability. The flow control is established by the win size field in each segment. The win size says available TCP buffer length in the kernel which can be used to buffer received segments. A size 0 means the receiver has a lot of lag to catch from its socket buffer and the sender has to pause sending packets so that receiver can cope up. This flow control protects from slow receiver and fast sender problem TCP also does congestion control which determines how many segments can be in transit without an ack. Linux provides us the ability to configure algorithms for congestion control which we are not covering here. While closing a connection, client/server calls a close syscall. Let's assume client do that. Client\u2019s kernel will send a FIN packet to the server. Server\u2019s kernel can\u2019t close the connection till the close syscall is called by the server application. Once server app calls close, server also sends a FIN packet and client enters into time wait state for 2*MSS(120s) so that this socket can\u2019t be reused for that time period to prevent any TCP state corruptions due to stray stale packets. Armed with our TCP and HTTP knowledge lets see how this is used by SREs in their role","title":"TCP"},{"location":"linux_networking/tcp/#applications-in-sre-role","text":"Scaling HTTP performance using load balancers need consistent knowledge about both TCP and HTTP. There are different kinds of load balancing like L4, L7 load balancing, Direct Server Return etc. HTTPs offloading can be done on Load balancer or directly on servers based on the performance and compliance needs. Tweaking sysctl variables for rmem and wmem like we did for UDP can improve throughput of sender and receiver. Sysctl variable tcp_max_syn_backlog and socket variable somax_conn determines how many connections for which the kernel can complete 3 way handshake before app calling accept syscall. This is much useful in single threaded applications. Once the backlog is full, new connections stay in SYN_RCVD state (when you run netstat) till the application calls accept syscall Apps can run out of file descriptors if there are too many short lived connections. Digging through tcp_reuse and tcp_recycle can help reduce time spent in the time wait state(it has its own risk). Making apps reuse a pool of connections instead of creating ad hoc connection can also help Understanding performance bottlenecks by seeing metrics and classifying whether its a problem in App or network side. Example too many sockets in Close_wait state is a problem on application whereas retransmissions can be a problem more on network or on OS stack than the application itself. Understanding the fundamentals can help us narrow down where the bottleneck is","title":"Applications in SRE role"},{"location":"linux_networking/udp/","text":"UDP UDP is a transport layer protocol. DNS is an application layer protocol that runs on top of UDP(most of the times). Before jumping into UDP, let's try to understand what an application and transport layer is. DNS protocol is used by a DNS client(eg dig) and DNS server(eg named). The transport layer makes sure the DNS request reaches the DNS server process and similarly the response reaches the DNS client process. Multiple processes can run on a system and they can listen on any ports . DNS servers usually listen on port number 53. When a client makes a DNS request, after filling the necessary application payload, it passes the payload to the kernel via sendto system call. The kernel picks a random port number( >1024 ) as source port number and puts 53 as destination port number and sends the packet to lower layers. When the kernel on server side receives the packet, it checks the port number and queues the packet to the application buffer of the DNS server process which makes a recvfrom system call and reads the packet. This process by the kernel is called multiplexing(combining packets from multiple applications to same lower layers) and demultiplexing(segregating packets from single lower layer to multiple applications). Multiplexing and Demultiplexing is done by the Transport layer. UDP is one of the simplest transport layer protocol and it does only multiplexing and demultiplexing. Another common transport layer protocol TCP does a bunch of other things like reliable communication, flow control and congestion control. UDP is designed to be lightweight and handle communications with little overhead. So it doesn\u2019t do anything beyond multiplexing and demultiplexing. If applications running on top of UDP need any of the features of TCP, they have to implement that in their application This example from python wiki covers a sample UDP client and server where \u201cHello World\u201d is an application payload sent to server listening on port number 5005. The server receives the packet and prints the \u201cHello World\u201d string from the client Applications in SRE role If the underlying network is slow and the UDP layer is unable to queue packets down to the networking layer, sendto syscall from the application will hang till the kernel finds some of its buffer is freed. This can affect the throughput of the system. Increasing write memory buffer values using sysctl variables net.core.wmem_max and net.core.wmem_default provides some cushion to the application from the slow network Similarly if the receiver process is slow in consuming from its buffer, the kernel has to drop packets which it can\u2019t queue due to the buffer being full. Since UDP doesn\u2019t guarantee reliability these dropped packets can cause data loss unless tracked by the application layer. Increasing sysctl variables rmem_default and rmem_max can provide some cushion to slow applications from fast senders.","title":"UDP"},{"location":"linux_networking/udp/#udp","text":"UDP is a transport layer protocol. DNS is an application layer protocol that runs on top of UDP(most of the times). Before jumping into UDP, let's try to understand what an application and transport layer is. DNS protocol is used by a DNS client(eg dig) and DNS server(eg named). The transport layer makes sure the DNS request reaches the DNS server process and similarly the response reaches the DNS client process. Multiple processes can run on a system and they can listen on any ports . DNS servers usually listen on port number 53. When a client makes a DNS request, after filling the necessary application payload, it passes the payload to the kernel via sendto system call. The kernel picks a random port number( >1024 ) as source port number and puts 53 as destination port number and sends the packet to lower layers. When the kernel on server side receives the packet, it checks the port number and queues the packet to the application buffer of the DNS server process which makes a recvfrom system call and reads the packet. This process by the kernel is called multiplexing(combining packets from multiple applications to same lower layers) and demultiplexing(segregating packets from single lower layer to multiple applications). Multiplexing and Demultiplexing is done by the Transport layer. UDP is one of the simplest transport layer protocol and it does only multiplexing and demultiplexing. Another common transport layer protocol TCP does a bunch of other things like reliable communication, flow control and congestion control. UDP is designed to be lightweight and handle communications with little overhead. So it doesn\u2019t do anything beyond multiplexing and demultiplexing. If applications running on top of UDP need any of the features of TCP, they have to implement that in their application This example from python wiki covers a sample UDP client and server where \u201cHello World\u201d is an application payload sent to server listening on port number 5005. The server receives the packet and prints the \u201cHello World\u201d string from the client","title":"UDP"},{"location":"linux_networking/udp/#applications-in-sre-role","text":"If the underlying network is slow and the UDP layer is unable to queue packets down to the networking layer, sendto syscall from the application will hang till the kernel finds some of its buffer is freed. This can affect the throughput of the system. Increasing write memory buffer values using sysctl variables net.core.wmem_max and net.core.wmem_default provides some cushion to the application from the slow network Similarly if the receiver process is slow in consuming from its buffer, the kernel has to drop packets which it can\u2019t queue due to the buffer being full. Since UDP doesn\u2019t guarantee reliability these dropped packets can cause data loss unless tracked by the application layer. Increasing sysctl variables rmem_default and rmem_max can provide some cushion to slow applications from fast senders.","title":"Applications in SRE role"},{"location":"python_web/intro/","text":"Python and The Web Prerequisites Basic understanding of python language. Basic familiarity with flask framework. What to expect from this course This course is divided into two high level parts. In the first part, assuming familiarity with python language\u2019s basic operations and syntax usage, we will dive a little deeper into understanding python as a language. We will compare python with other programming languages that you might already know like Java and C. We will also explore concepts of Python objects and with help of that, explore python features like decorators. In the second part which will revolve around the web, and also assume familiarity with the Flask framework, we will start from the socket module and work with HTTP requests. This will demystify how frameworks like flask work internally. And to introduce SRE flavour to the course, we will design, develop and deploy (in theory) a URL shortening application. We will emphasize parts of the whole process that are more important as an SRE of the said app/service. What is not covered under this course Extensive knowledge of python internals and advanced python. Lab Environment Setup Have latest version of python installed Course Contents The Python Language Some Python Concepts Python Gotchas Python and Web Sockets Flask The URL Shortening App Design Scaling The App Monitoring The App The Python Language Assuming you know a little bit of C/C++ and Java, let's try to discuss the following questions in context of those two languages and python. You might have heard that C/C++ is a compiled language while python is an interpreted language. Generally, with compiled language we first compile the program and then run the executable while in case of python we run the source code directly like python hello_world.py . While Java, being an interpreted language, still has a separate compilation step and then its run. So what's really the difference? Compiled vs. Interpreted This might sound a little weird to you: python, in a way is a compiled language! Python has a compiler built-in! It is obvious in the case of java since we compile it using a separate command ie: javac helloWorld.java and it will produce a .class file which we know as a bytecode . Well, python is very similar to that. One difference here is that there is no separate compile command/binary needed to run a python program. What is the difference then, between java and python? Well, Java's compiler is more strict and sophisticated. As you might know Java is a statically typed language. So the compiler is written in a way that it can verify types related errors during compile time. While python being a dynamic language, types are not known until a program is run. So in a way, python compiler is dumb (or, less strict). But there indeed is a compile step involved when a python program is run. You might have seen python bytecode files with .pyc extension. Here is how you can see bytecode for a given python program. # Create a Hello World spatel1-mn1:tmp spatel1$ echo \"print('hello world')\" > hello_world.py # Making sure it runs spatel1-mn1:tmp spatel1$ python3 hello_world.py hello world # The bytecode of the given program spatel1-mn1:tmp spatel1$ python -m dis hello_world.py 1 0 LOAD_NAME 0 (print) 2 LOAD_CONST 0 ('hello world') 4 CALL_FUNCTION 1 6 POP_TOP 8 LOAD_CONST 1 (None) 10 RETURN_VALUE Read more about dis module here Now coming to C/C++, there of course is a compiler. But the output is different than what java/python compiler would produce. Compiling a C program would produce what we also know as machine code . As opposed to bytecode. Running The Programs We know compilation is involved in all 3 languages we are discussing. Just that the compilers are different in nature and they output different types of content. In case of C/C++, the output is machine code which can be directly read by your operating system. When you execute that program, your OS will know how exactly to run it. But this is not the case with bytecode. Those bytecodes are language specific. Python has its own set of bytecode defined (more in dis module) and so does java. So naturally, your operating system will not know how to run it. To run this bytecode, we have something called Virtual Machines. Ie: The JVM or the Python VM (CPython, Jython). These so called Virtual Machines are the programs which can read the bytecode and run it on a given operating system. Python has multiple VMs available. Cpython is a python VM implemented in C language, similarly Jython is a Java implementation of python VM. At the end of the day, what they should be capable of is to understand python language syntax, be able to compile it to bytecode and be able to run that bytecode. You can implement a python VM in any language! (And people do so, just because it can be done) The Operating System +------------------------------------+ | | | | | | hello_world.py Python bytecode | Python VM Process | | | +----------------+ +----------------+ | +----------------+ | |print(... | COMPILE |LOAD_CONST... | | |Reads bytecode | | | +--------------->+ +------------------->+line by line | | | | | | | |and executes. | | | | | | | | | | +----------------+ +----------------+ | +----------------+ | | | | | | | hello_world.c OS Specific machinecode | A New Process | | | +----------------+ +----------------+ | +----------------+ | |void main() { | COMPILE | binary contents| | | binary contents| | | +--------------->+ +------------------->+ | | | | | | | | | | | | | | | | | | +----------------+ +----------------+ | +----------------+ | | (binary contents | | runs as is) | | | | | +------------------------------------+ Two things to note for above diagram: Generally, when we run a python program, a python VM process is started which reads the python source code, compiles it to byte code and run it in a single step. Compiling is not a separate step. Shown only for illustration purpose. Binaries generated for C like languages are not exactly run as is. Since there are multiple types of binaries (eg: ELF), there are more complicated steps involved in order to run a binary but we will not go into that since all that is done at OS level.","title":"Introduction"},{"location":"python_web/intro/#python-and-the-web","text":"","title":"Python and The Web"},{"location":"python_web/intro/#prerequisites","text":"Basic understanding of python language. Basic familiarity with flask framework.","title":"Prerequisites"},{"location":"python_web/intro/#what-to-expect-from-this-course","text":"This course is divided into two high level parts. In the first part, assuming familiarity with python language\u2019s basic operations and syntax usage, we will dive a little deeper into understanding python as a language. We will compare python with other programming languages that you might already know like Java and C. We will also explore concepts of Python objects and with help of that, explore python features like decorators. In the second part which will revolve around the web, and also assume familiarity with the Flask framework, we will start from the socket module and work with HTTP requests. This will demystify how frameworks like flask work internally. And to introduce SRE flavour to the course, we will design, develop and deploy (in theory) a URL shortening application. We will emphasize parts of the whole process that are more important as an SRE of the said app/service.","title":"What to expect from this course"},{"location":"python_web/intro/#what-is-not-covered-under-this-course","text":"Extensive knowledge of python internals and advanced python.","title":"What is not covered under this course"},{"location":"python_web/intro/#lab-environment-setup","text":"Have latest version of python installed","title":"Lab Environment Setup"},{"location":"python_web/intro/#course-contents","text":"The Python Language Some Python Concepts Python Gotchas Python and Web Sockets Flask The URL Shortening App Design Scaling The App Monitoring The App","title":"Course Contents"},{"location":"python_web/intro/#the-python-language","text":"Assuming you know a little bit of C/C++ and Java, let's try to discuss the following questions in context of those two languages and python. You might have heard that C/C++ is a compiled language while python is an interpreted language. Generally, with compiled language we first compile the program and then run the executable while in case of python we run the source code directly like python hello_world.py . While Java, being an interpreted language, still has a separate compilation step and then its run. So what's really the difference?","title":"The Python Language"},{"location":"python_web/intro/#compiled-vs-interpreted","text":"This might sound a little weird to you: python, in a way is a compiled language! Python has a compiler built-in! It is obvious in the case of java since we compile it using a separate command ie: javac helloWorld.java and it will produce a .class file which we know as a bytecode . Well, python is very similar to that. One difference here is that there is no separate compile command/binary needed to run a python program. What is the difference then, between java and python? Well, Java's compiler is more strict and sophisticated. As you might know Java is a statically typed language. So the compiler is written in a way that it can verify types related errors during compile time. While python being a dynamic language, types are not known until a program is run. So in a way, python compiler is dumb (or, less strict). But there indeed is a compile step involved when a python program is run. You might have seen python bytecode files with .pyc extension. Here is how you can see bytecode for a given python program. # Create a Hello World spatel1-mn1:tmp spatel1$ echo \"print('hello world')\" > hello_world.py # Making sure it runs spatel1-mn1:tmp spatel1$ python3 hello_world.py hello world # The bytecode of the given program spatel1-mn1:tmp spatel1$ python -m dis hello_world.py 1 0 LOAD_NAME 0 (print) 2 LOAD_CONST 0 ('hello world') 4 CALL_FUNCTION 1 6 POP_TOP 8 LOAD_CONST 1 (None) 10 RETURN_VALUE Read more about dis module here Now coming to C/C++, there of course is a compiler. But the output is different than what java/python compiler would produce. Compiling a C program would produce what we also know as machine code . As opposed to bytecode.","title":"Compiled vs. Interpreted"},{"location":"python_web/intro/#running-the-programs","text":"We know compilation is involved in all 3 languages we are discussing. Just that the compilers are different in nature and they output different types of content. In case of C/C++, the output is machine code which can be directly read by your operating system. When you execute that program, your OS will know how exactly to run it. But this is not the case with bytecode. Those bytecodes are language specific. Python has its own set of bytecode defined (more in dis module) and so does java. So naturally, your operating system will not know how to run it. To run this bytecode, we have something called Virtual Machines. Ie: The JVM or the Python VM (CPython, Jython). These so called Virtual Machines are the programs which can read the bytecode and run it on a given operating system. Python has multiple VMs available. Cpython is a python VM implemented in C language, similarly Jython is a Java implementation of python VM. At the end of the day, what they should be capable of is to understand python language syntax, be able to compile it to bytecode and be able to run that bytecode. You can implement a python VM in any language! (And people do so, just because it can be done) The Operating System +------------------------------------+ | | | | | | hello_world.py Python bytecode | Python VM Process | | | +----------------+ +----------------+ | +----------------+ | |print(... | COMPILE |LOAD_CONST... | | |Reads bytecode | | | +--------------->+ +------------------->+line by line | | | | | | | |and executes. | | | | | | | | | | +----------------+ +----------------+ | +----------------+ | | | | | | | hello_world.c OS Specific machinecode | A New Process | | | +----------------+ +----------------+ | +----------------+ | |void main() { | COMPILE | binary contents| | | binary contents| | | +--------------->+ +------------------->+ | | | | | | | | | | | | | | | | | | +----------------+ +----------------+ | +----------------+ | | (binary contents | | runs as is) | | | | | +------------------------------------+ Two things to note for above diagram: Generally, when we run a python program, a python VM process is started which reads the python source code, compiles it to byte code and run it in a single step. Compiling is not a separate step. Shown only for illustration purpose. Binaries generated for C like languages are not exactly run as is. Since there are multiple types of binaries (eg: ELF), there are more complicated steps involved in order to run a binary but we will not go into that since all that is done at OS level.","title":"Running The Programs"},{"location":"python_web/python-concepts/","text":"Some Python Concepts Though you are expected to know python and its syntax at basic level, let us discuss some fundamental concepts that will help you understand the python language better. Everything in Python is an object. That includes the functions, lists, dicts, classes, modules, a running function (instance of function definition), everything. In the CPython, it would mean there is an underlying struct variable for each object. In python's current execution context, all the variables are stored in a dict. It'd be a string to object mapping. If you have a function and a float variable defined in the current context, here is how it is handled internally. >>> float_number=42.0 >>> def foo_func(): ... pass ... # NOTICE HOW VARIABLE NAMES ARE STRINGS, stored in a dict >>> locals() {'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': <class '_frozen_importlib.BuiltinImporter'>, '__spec__': None, '__annotations__': {}, '__builtins__': <module 'builtins' (built-in)>, 'float_number': 42.0, 'foo_func': <function foo_func at 0x1055847a0>} Python Functions Since functions too are objects, we can see what all attributes a function contains as following >>> def hello(name): ... print(f\"Hello, {name}!\") ... >>> dir(hello) ['__annotations__', '__call__', '__class__', '__closure__', '__code__', '__defaults__', '__delattr__', '__dict__', '__dir__', '__doc__', '__eq__', '__format__', '__ge__', '__get__', '__getattribute__', '__globals__', '__gt__', '__hash__', '__init__', '__init_subclass__', '__kwdefaults__', '__le__', '__lt__', '__module__', '__name__', '__ne__', '__new__', '__qualname__', '__reduce__', '__reduce_ex__', '__repr__', '__setattr__', '__sizeof__', '__str__', '__subclasshook__'] While there are a lot of them, let's look at some interesting ones globals This attribute, as the name suggests, has references of global variables. If you ever need to know what all global variables are in the scope of this function, this will tell you. See how the function start seeing the new variable in globals >>> hello.__globals__ {'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': <class '_frozen_importlib.BuiltinImporter'>, '__spec__': None, '__annotations__': {}, '__builtins__': <module 'builtins' (built-in)>, 'hello': <function hello at 0x7fe4e82554c0>} # adding new global variable >>> GLOBAL=\"g_val\" >>> hello.__globals__ {'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': <class '_frozen_importlib.BuiltinImporter'>, '__spec__': None, '__annotations__': {}, '__builtins__': <module 'builtins' (built-in)>, 'hello': <function hello at 0x7fe4e82554c0>, 'GLOBAL': 'g_val'} code This is an interesting one! As everything in python is an object, this includes the bytecode too. The compiled python bytecode is a python code object. Which is accessible via __code__ attribute here. A function has an associated code object which carries some interesting information. # the file in which function is defined # stdin here since this is run in an interpreter >>> hello.__code__.co_filename '<stdin>' # number of arguments the function takes >>> hello.__code__.co_argcount 1 # local variable names >>> hello.__code__.co_varnames ('name',) # the function code's compiled bytecode >>> hello.__code__.co_code b't\\x00d\\x01|\\x00\\x9b\\x00d\\x02\\x9d\\x03\\x83\\x01\\x01\\x00d\\x00S\\x00' There are more code attributes which you can enlist by >>> dir(hello.__code__) Decorators Related to functions, python has another feature called decorators. Let's see how that works, keeping everything is an object in mind. Here is a sample decorator: >>> def deco(func): ... def inner(): ... print(\"before\") ... func() ... print(\"after\") ... return inner ... >>> @deco ... def hello_world(): ... print(\"hello world\") ... >>> >>> hello_world() before hello world after Here @deco syntax is used to decorate the hello_world function. It is essentially same as doing >>> def hello_world(): ... print(\"hello world\") ... >>> hello_world = deco(hello_world) What goes inside the deco function might seem complex. Let's try to uncover it. Function hello_world is created It is passed to deco function deco create a new function This new function is calls hello_world function And does a couple other things deco returns the newly created function hello_world is replaced with above function Let's visualize it for better understanding BEFORE function_object (ID: 100) \"hello_world\" +--------------------+ + |print(\"hello_world\")| | | | +--------------> | | | | +--------------------+ WHAT DECORATOR DOES creates a new function (ID: 101) +---------------------------------+ |input arg: function with id: 100 | | | |print(\"before\") | |call function object with id 100 | |print(\"after\") | | | +---------------------------^-----+ | | AFTER | | | \"hello_world\" +-------------+ Note how the hello_world name points to a new function object but that new function object knows the reference (ID) of the original function. Some Gotchas While it is very quick to build prototypes in python and there are tons of libraries available, as the codebase complexity increases, type errors become more common and will get hard to deal with. (There are solutions to that problem like type annotations in python. Checkout mypy .) Because python is dynamically typed language, that means all types are determined at runtime. And that makes python run very slow compared to other statically typed languages. Python has something called GIL (global interpreter lock) which is a limiting factor for utilizing multiple CPI cores for parallel computation. Some weird things that python does: https://github.com/satwikkansal/wtfpython","title":"Some Python Concepts"},{"location":"python_web/python-concepts/#some-python-concepts","text":"Though you are expected to know python and its syntax at basic level, let us discuss some fundamental concepts that will help you understand the python language better. Everything in Python is an object. That includes the functions, lists, dicts, classes, modules, a running function (instance of function definition), everything. In the CPython, it would mean there is an underlying struct variable for each object. In python's current execution context, all the variables are stored in a dict. It'd be a string to object mapping. If you have a function and a float variable defined in the current context, here is how it is handled internally. >>> float_number=42.0 >>> def foo_func(): ... pass ... # NOTICE HOW VARIABLE NAMES ARE STRINGS, stored in a dict >>> locals() {'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': <class '_frozen_importlib.BuiltinImporter'>, '__spec__': None, '__annotations__': {}, '__builtins__': <module 'builtins' (built-in)>, 'float_number': 42.0, 'foo_func': <function foo_func at 0x1055847a0>}","title":"Some Python Concepts"},{"location":"python_web/python-concepts/#python-functions","text":"Since functions too are objects, we can see what all attributes a function contains as following >>> def hello(name): ... print(f\"Hello, {name}!\") ... >>> dir(hello) ['__annotations__', '__call__', '__class__', '__closure__', '__code__', '__defaults__', '__delattr__', '__dict__', '__dir__', '__doc__', '__eq__', '__format__', '__ge__', '__get__', '__getattribute__', '__globals__', '__gt__', '__hash__', '__init__', '__init_subclass__', '__kwdefaults__', '__le__', '__lt__', '__module__', '__name__', '__ne__', '__new__', '__qualname__', '__reduce__', '__reduce_ex__', '__repr__', '__setattr__', '__sizeof__', '__str__', '__subclasshook__'] While there are a lot of them, let's look at some interesting ones","title":"Python Functions"},{"location":"python_web/python-concepts/#globals","text":"This attribute, as the name suggests, has references of global variables. If you ever need to know what all global variables are in the scope of this function, this will tell you. See how the function start seeing the new variable in globals >>> hello.__globals__ {'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': <class '_frozen_importlib.BuiltinImporter'>, '__spec__': None, '__annotations__': {}, '__builtins__': <module 'builtins' (built-in)>, 'hello': <function hello at 0x7fe4e82554c0>} # adding new global variable >>> GLOBAL=\"g_val\" >>> hello.__globals__ {'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': <class '_frozen_importlib.BuiltinImporter'>, '__spec__': None, '__annotations__': {}, '__builtins__': <module 'builtins' (built-in)>, 'hello': <function hello at 0x7fe4e82554c0>, 'GLOBAL': 'g_val'}","title":"globals"},{"location":"python_web/python-concepts/#code","text":"This is an interesting one! As everything in python is an object, this includes the bytecode too. The compiled python bytecode is a python code object. Which is accessible via __code__ attribute here. A function has an associated code object which carries some interesting information. # the file in which function is defined # stdin here since this is run in an interpreter >>> hello.__code__.co_filename '<stdin>' # number of arguments the function takes >>> hello.__code__.co_argcount 1 # local variable names >>> hello.__code__.co_varnames ('name',) # the function code's compiled bytecode >>> hello.__code__.co_code b't\\x00d\\x01|\\x00\\x9b\\x00d\\x02\\x9d\\x03\\x83\\x01\\x01\\x00d\\x00S\\x00' There are more code attributes which you can enlist by >>> dir(hello.__code__)","title":"code"},{"location":"python_web/python-concepts/#decorators","text":"Related to functions, python has another feature called decorators. Let's see how that works, keeping everything is an object in mind. Here is a sample decorator: >>> def deco(func): ... def inner(): ... print(\"before\") ... func() ... print(\"after\") ... return inner ... >>> @deco ... def hello_world(): ... print(\"hello world\") ... >>> >>> hello_world() before hello world after Here @deco syntax is used to decorate the hello_world function. It is essentially same as doing >>> def hello_world(): ... print(\"hello world\") ... >>> hello_world = deco(hello_world) What goes inside the deco function might seem complex. Let's try to uncover it. Function hello_world is created It is passed to deco function deco create a new function This new function is calls hello_world function And does a couple other things deco returns the newly created function hello_world is replaced with above function Let's visualize it for better understanding BEFORE function_object (ID: 100) \"hello_world\" +--------------------+ + |print(\"hello_world\")| | | | +--------------> | | | | +--------------------+ WHAT DECORATOR DOES creates a new function (ID: 101) +---------------------------------+ |input arg: function with id: 100 | | | |print(\"before\") | |call function object with id 100 | |print(\"after\") | | | +---------------------------^-----+ | | AFTER | | | \"hello_world\" +-------------+ Note how the hello_world name points to a new function object but that new function object knows the reference (ID) of the original function.","title":"Decorators"},{"location":"python_web/python-concepts/#some-gotchas","text":"While it is very quick to build prototypes in python and there are tons of libraries available, as the codebase complexity increases, type errors become more common and will get hard to deal with. (There are solutions to that problem like type annotations in python. Checkout mypy .) Because python is dynamically typed language, that means all types are determined at runtime. And that makes python run very slow compared to other statically typed languages. Python has something called GIL (global interpreter lock) which is a limiting factor for utilizing multiple CPI cores for parallel computation. Some weird things that python does: https://github.com/satwikkansal/wtfpython","title":"Some Gotchas"},{"location":"python_web/python-web-flask/","text":"Python, Web and Flask Back in the old days, websites were simple. They were simple static html contents. A webserver would be listening on a defined port and according to the HTTP request received, it would read files from disk and return them in response. But since then, complexity has evolved and websites are now dynamic. Depending on the request, multiple operations need to be performed like reading from database or calling other API and finally returning some response (HTML data, JSON content etc.) Since serving web requests is no longer a simple task like reading files from disk and return contents, we need to process each http request, perform some operations programmatically and construct a response. Sockets Though we have frameworks like flask, HTTP is still a protocol that works over TCP protocol. So let us setup a TCP server and send an HTTP request and inspect the request's payload. Note that this is not a tutorial on socket programming but what we are doing here is inspecting HTTP protocol at its ground level and look at what its contents look like. (Ref: Socket Programming in Python (Guide) on RealPython ) import socket HOST = '127.0.0.1' # Standard loopback interface address (localhost) PORT = 65432 # Port to listen on (non-privileged ports are > 1023) with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s: s.bind((HOST, PORT)) s.listen() conn, addr = s.accept() with conn: print('Connected by', addr) while True: data = conn.recv(1024) if not data: break print(data) Then we open localhost:65432 in our web browser and following would be the output: Connected by ('127.0.0.1', 54719) b'GET / HTTP/1.1\\r\\nHost: localhost:65432\\r\\nConnection: keep-alive\\r\\nDNT: 1\\r\\nUpgrade-Insecure-Requests: 1\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36 Edg/85.0.564.44\\r\\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\\r\\nSec-Fetch-Site: none\\r\\nSec-Fetch-Mode: navigate\\r\\nSec-Fetch-User: ?1\\r\\nSec-Fetch-Dest: document\\r\\nAccept-Encoding: gzip, deflate, br\\r\\nAccept-Language: en-US,en;q=0.9\\r\\n\\r\\n' Examine closely and the content will look like the HTTP protocol's format. ie: HTTP_METHOD URI_PATH HTTP_VERSION HEADERS_SEPARATED_BY_SEPARATOR So though it's a blob of bytes, knowing http protocol specification , you can parse that string (ie: split by \\r\\n ) and get meaningful information out of it. Flask Flask, and other such frameworks does pretty much what we just discussed in the last section (with added more sophistication). They listen on a port on a TCP socket, receive an HTTP request, parse the data according to protocol format and make it available to you in a convenient manner. ie: you can access headers in flask by request.headers which is made available to you by splitting above payload by /r/n , as defined in http protocol. Another example: we register routes in flask by @app.route(\"/hello\") . What flask will do is maintain a registry internally which will map /hello with the function you decorated with. Now whenever a request comes with the /hello route (second component in the first line, split by space), flask calls the registered function and returns whatever the function returned. Same with all other web frameworks in other languages too. They all work on similar principles. What they basically do is understand the HTTP protocol, parses the HTTP request data and gives us programmers a nice interface to work with HTTP requests. Not so much of magic, innit?","title":"Python, Web and Flask"},{"location":"python_web/python-web-flask/#python-web-and-flask","text":"Back in the old days, websites were simple. They were simple static html contents. A webserver would be listening on a defined port and according to the HTTP request received, it would read files from disk and return them in response. But since then, complexity has evolved and websites are now dynamic. Depending on the request, multiple operations need to be performed like reading from database or calling other API and finally returning some response (HTML data, JSON content etc.) Since serving web requests is no longer a simple task like reading files from disk and return contents, we need to process each http request, perform some operations programmatically and construct a response.","title":"Python, Web and Flask"},{"location":"python_web/python-web-flask/#sockets","text":"Though we have frameworks like flask, HTTP is still a protocol that works over TCP protocol. So let us setup a TCP server and send an HTTP request and inspect the request's payload. Note that this is not a tutorial on socket programming but what we are doing here is inspecting HTTP protocol at its ground level and look at what its contents look like. (Ref: Socket Programming in Python (Guide) on RealPython ) import socket HOST = '127.0.0.1' # Standard loopback interface address (localhost) PORT = 65432 # Port to listen on (non-privileged ports are > 1023) with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s: s.bind((HOST, PORT)) s.listen() conn, addr = s.accept() with conn: print('Connected by', addr) while True: data = conn.recv(1024) if not data: break print(data) Then we open localhost:65432 in our web browser and following would be the output: Connected by ('127.0.0.1', 54719) b'GET / HTTP/1.1\\r\\nHost: localhost:65432\\r\\nConnection: keep-alive\\r\\nDNT: 1\\r\\nUpgrade-Insecure-Requests: 1\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36 Edg/85.0.564.44\\r\\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\\r\\nSec-Fetch-Site: none\\r\\nSec-Fetch-Mode: navigate\\r\\nSec-Fetch-User: ?1\\r\\nSec-Fetch-Dest: document\\r\\nAccept-Encoding: gzip, deflate, br\\r\\nAccept-Language: en-US,en;q=0.9\\r\\n\\r\\n' Examine closely and the content will look like the HTTP protocol's format. ie: HTTP_METHOD URI_PATH HTTP_VERSION HEADERS_SEPARATED_BY_SEPARATOR So though it's a blob of bytes, knowing http protocol specification , you can parse that string (ie: split by \\r\\n ) and get meaningful information out of it.","title":"Sockets"},{"location":"python_web/python-web-flask/#flask","text":"Flask, and other such frameworks does pretty much what we just discussed in the last section (with added more sophistication). They listen on a port on a TCP socket, receive an HTTP request, parse the data according to protocol format and make it available to you in a convenient manner. ie: you can access headers in flask by request.headers which is made available to you by splitting above payload by /r/n , as defined in http protocol. Another example: we register routes in flask by @app.route(\"/hello\") . What flask will do is maintain a registry internally which will map /hello with the function you decorated with. Now whenever a request comes with the /hello route (second component in the first line, split by space), flask calls the registered function and returns whatever the function returned. Same with all other web frameworks in other languages too. They all work on similar principles. What they basically do is understand the HTTP protocol, parses the HTTP request data and gives us programmers a nice interface to work with HTTP requests. Not so much of magic, innit?","title":"Flask"},{"location":"python_web/sre-conclusion/","text":"Conclusion Scaling The App The design and development is just a part of the journey. We will need to setup continuous integration and continuous delivery pipelines sooner or later. And we have to deploy this app somewhere. Initially we can start with deploying this app on one virtual machine on any cloud provider. But this is a Single point of failure which is something we never allow as an SRE (or even as an engineer). So an improvement here can be having multiple instances of applications deployed behind a load balancer. This certainly prevents problems of one machine going down. Scaling here would mean adding more instances behind the load balancer. But this is scalable upto only a certain point. After that, other bottlenecks in the system will start appearing. ie: DB will become the bottleneck, or perhaps the load balancer itself. How do you know what is the bottleneck? You need to have observability into each aspects of the application architecture. Only after you have metrics, you will be able to know what is going wrong where. What gets measured, gets fixed! Get deeper insights into scaling from School Of SRE's Scalability module and post going through it, apply your learnings and takeaways to this app. Think how will we make this app geographically distributed and highly available and scalable. Monitoring Strategy Once we have our application deployed. It will be working ok. But not forever. Reliability is in the title of our job and we make systems reliable by making the design in a certain way. But things still will go down. Machines will fail. Disks will behave weirdly. Buggy code will get pushed to production. And all these possible scenarios will make the system less reliable. So what do we do? We monitor! We keep an eye on the system's health and if anything is not going as expected, we want ourselves to get alerted. Now let's think in terms of the given url shortening app. We need to monitor it. And we would want to get notified in case something goes wrong. But we first need to decide what is that something that we want to keep an eye on. Since it's a web app serving HTTP requests, we want to keep an eye on HTTP Status codes and latencies Request volume again is a good candidate, if the app is receiving an unusual amount of traffic, something might be off. We also want to keep an eye on the database so depending on the database solution chosen. Query times, volumes, disk usage etc. Finally, there also needs to be some external monitoring which runs periodic tests from devices outside of your data centers. This emulates customers and ensures that from customer point of view, the system is working as expected. Applications in SRE role In the world of SRE, python is a widely used language. For small scripts and tooling developed for various purposes. Since tooling developed by SRE works with critical pieces of infrastructure and has great power (to bring things down), it is important to know what you are doing while using a programming language and its features. Also it is equally important to know the language and its characteristics while debugging the issues. As an SRE having a deeper understanding of python language, it has helped me a lot to debug very sneaky bugs and be generally more aware and informed while making certain design decisions. While developing tools may or may not be part of SRE job, supporting tools or services is more likely to be a daily duty. Building an application or tool is just a small part of productionization. While there is certainly that goes in the design of the application itself to make it more robust, as an SRE you are responsible for its reliability and stability once it is deployed and running. And to ensure that, you\u2019d need to understand the application first and then come up with a strategy to monitor it properly and be prepared for various failure scenarios. Optional Exercises Make a decorator that will cache function return values depending on input parameters. Host the URL shortening app on any cloud provider. Setup monitoring using many of the tools available like catchpoint, datadog etc. Create a minimal flask-like framework on top of TCP sockets. Conclusion This module, in the first part, aims to make you more aware of the things that will happen when you choose python as your programming language and what happens when you run a python program. With the knowledge of how python handles things internally as objects, lot of seemingly magic things in python will start to make more sense. The second part will first explain how a framework like flask works using the existing knowledge of protocols like TCP and HTTP. It then touches the whole lifecycle of an application development lifecycle including the SRE parts of it. While the design and areas in architecture considered will not be exhaustive, it will give a good overview of things that are also important being an SRE and why they are important.","title":"Conclusion"},{"location":"python_web/sre-conclusion/#conclusion","text":"","title":"Conclusion"},{"location":"python_web/sre-conclusion/#scaling-the-app","text":"The design and development is just a part of the journey. We will need to setup continuous integration and continuous delivery pipelines sooner or later. And we have to deploy this app somewhere. Initially we can start with deploying this app on one virtual machine on any cloud provider. But this is a Single point of failure which is something we never allow as an SRE (or even as an engineer). So an improvement here can be having multiple instances of applications deployed behind a load balancer. This certainly prevents problems of one machine going down. Scaling here would mean adding more instances behind the load balancer. But this is scalable upto only a certain point. After that, other bottlenecks in the system will start appearing. ie: DB will become the bottleneck, or perhaps the load balancer itself. How do you know what is the bottleneck? You need to have observability into each aspects of the application architecture. Only after you have metrics, you will be able to know what is going wrong where. What gets measured, gets fixed! Get deeper insights into scaling from School Of SRE's Scalability module and post going through it, apply your learnings and takeaways to this app. Think how will we make this app geographically distributed and highly available and scalable.","title":"Scaling The App"},{"location":"python_web/sre-conclusion/#monitoring-strategy","text":"Once we have our application deployed. It will be working ok. But not forever. Reliability is in the title of our job and we make systems reliable by making the design in a certain way. But things still will go down. Machines will fail. Disks will behave weirdly. Buggy code will get pushed to production. And all these possible scenarios will make the system less reliable. So what do we do? We monitor! We keep an eye on the system's health and if anything is not going as expected, we want ourselves to get alerted. Now let's think in terms of the given url shortening app. We need to monitor it. And we would want to get notified in case something goes wrong. But we first need to decide what is that something that we want to keep an eye on. Since it's a web app serving HTTP requests, we want to keep an eye on HTTP Status codes and latencies Request volume again is a good candidate, if the app is receiving an unusual amount of traffic, something might be off. We also want to keep an eye on the database so depending on the database solution chosen. Query times, volumes, disk usage etc. Finally, there also needs to be some external monitoring which runs periodic tests from devices outside of your data centers. This emulates customers and ensures that from customer point of view, the system is working as expected.","title":"Monitoring Strategy"},{"location":"python_web/sre-conclusion/#applications-in-sre-role","text":"In the world of SRE, python is a widely used language. For small scripts and tooling developed for various purposes. Since tooling developed by SRE works with critical pieces of infrastructure and has great power (to bring things down), it is important to know what you are doing while using a programming language and its features. Also it is equally important to know the language and its characteristics while debugging the issues. As an SRE having a deeper understanding of python language, it has helped me a lot to debug very sneaky bugs and be generally more aware and informed while making certain design decisions. While developing tools may or may not be part of SRE job, supporting tools or services is more likely to be a daily duty. Building an application or tool is just a small part of productionization. While there is certainly that goes in the design of the application itself to make it more robust, as an SRE you are responsible for its reliability and stability once it is deployed and running. And to ensure that, you\u2019d need to understand the application first and then come up with a strategy to monitor it properly and be prepared for various failure scenarios.","title":"Applications in SRE role"},{"location":"python_web/sre-conclusion/#optional-exercises","text":"Make a decorator that will cache function return values depending on input parameters. Host the URL shortening app on any cloud provider. Setup monitoring using many of the tools available like catchpoint, datadog etc. Create a minimal flask-like framework on top of TCP sockets.","title":"Optional Exercises"},{"location":"python_web/sre-conclusion/#conclusion_1","text":"This module, in the first part, aims to make you more aware of the things that will happen when you choose python as your programming language and what happens when you run a python program. With the knowledge of how python handles things internally as objects, lot of seemingly magic things in python will start to make more sense. The second part will first explain how a framework like flask works using the existing knowledge of protocols like TCP and HTTP. It then touches the whole lifecycle of an application development lifecycle including the SRE parts of it. While the design and areas in architecture considered will not be exhaustive, it will give a good overview of things that are also important being an SRE and why they are important.","title":"Conclusion"},{"location":"python_web/url-shorten-app/","text":"The URL Shortening App Let's build a very simple URL shortening app using flask and try to incorporate all aspects of the development process including the reliability aspects. We will not be building the UI and we will come up with a minimal set of API that will be enough for the app to function well. Design We don't jump directly to coding. First thing we do is gather requirements. Come up with an approach. Have the approach/design reviewed by peers. Evolve, iterate, document the decisions and tradeoffs. And then finally implement. While we will not do the full blown design document here, we will raise certain questions here that are important to the design. 1. High Level Operations and API Endpoints Since it's a URL shortening app, we will need an API for generating the shorten link given an original link. And an API/Endpoint which will accept the shorten link and redirect to original URL. We are not including the user aspect of the app to keep things minimal. These two API should make app functional and usable by anyone. 2. How to shorten? Given a url, we will need to generate a shortened version of it. One approach could be using random characters for each link. Another thing that can be done is to use some sort of hashing algorithm. The benefit here is we will reuse the same hash for the same link. ie: if lot of people are shortening https://www.linkedin.com they all will have the same value, compared to multiple entries in DB if chosen random characters. What about hash collisions? Even in random characters approach, though there is a less probability, hash collisions can happen. And we need to be mindful of them. In that case we might want to prepend/append the string with some random value to avoid conflict. Also, choice of hash algorithm matters. We will need to analyze algorithms. Their CPU requirements and their characteristics. Choose one that suits the most. 3. Is URL Valid? Given a URL to shorten, how do we verify if the URL is valid? Do we even verify or validate? One basic check that can be done is see if the URL matches a regex of a URL. To go even further we can try opening/visiting the URL. But there are certain gotchas here. We need to define success criteria. ie: HTTP 200 means it is valid. What is the URL is in private network? What if URL is temporarily down? 4. Storage Finally, storage. Where will we store the data that we will generate over time? There are multiple database solutions available and we will need to choose the one that suits this app the most. Relational database like MySQL would be a fair choice but be sure to checkout School of SRE's database section for deeper insights into making a more informed decision. 5. Other We are not accounting for users into our app and other possible features like rate limiting, customized links etc but it will eventually come up with time. Depending on the requirements, they too might need to get incorporated. The minimal working code is given below for reference but I'd encourage you to come up with your own. from flask import Flask, redirect, request from hashlib import md5 app = Flask(\"url_shortener\") mapping = {} @app.route(\"/shorten\", methods=[\"POST\"]) def shorten(): global mapping payload = request.json if \"url\" not in payload: return \"Missing URL Parameter\", 400 # TODO: check if URL is valid hash_ = md5() hash_.update(payload[\"url\"].encode()) digest = hash_.hexdigest()[:5] # limiting to 5 chars. Less the limit more the chances of collission if digest not in mapping: mapping[digest] = payload[\"url\"] return f\"Shortened: r/{digest}\\n\" else: # TODO: check for hash collission return f\"Already exists: r/{digest}\\n\" @app.route(\"/r/<hash_>\") def redirect_(hash_): if hash_ not in mapping: return \"URL Not Found\", 404 return redirect(mapping[hash_]) if __name__ == \"__main__\": app.run(debug=True) \"\"\" OUTPUT: ===> SHORTENING spatel1-mn1:tmp spatel1$ curl localhost:5000/shorten -H \"content-type: application/json\" --data '{\"url\":\"https://linkedin.com\"}' Shortened: r/a62a4 ===> REDIRECTING, notice the response code 302 and the location header spatel1-mn1:tmp spatel1$ curl localhost:5000/r/a62a4 -v * Uses proxy env variable NO_PROXY == '127.0.0.1' * Trying ::1... * TCP_NODELAY set * Connection failed * connect to ::1 port 5000 failed: Connection refused * Trying 127.0.0.1... * TCP_NODELAY set * Connected to localhost (127.0.0.1) port 5000 (#0) > GET /r/a62a4 HTTP/1.1 > Host: localhost:5000 > User-Agent: curl/7.64.1 > Accept: */* > * HTTP 1.0, assume close after body < HTTP/1.0 302 FOUND < Content-Type: text/html; charset=utf-8 < Content-Length: 247 < Location: https://linkedin.com < Server: Werkzeug/0.15.4 Python/3.7.7 < Date: Tue, 27 Oct 2020 09:37:12 GMT < <!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2 Final//EN\"> <title>Redirecting...</title> <h1>Redirecting...</h1> * Closing connection 0 <p>You should be redirected automatically to target URL: <a href=\"https://linkedin.com\">https://linkedin.com</a>. If not click the link. \"\"\"","title":"The URL Shortening App"},{"location":"python_web/url-shorten-app/#the-url-shortening-app","text":"Let's build a very simple URL shortening app using flask and try to incorporate all aspects of the development process including the reliability aspects. We will not be building the UI and we will come up with a minimal set of API that will be enough for the app to function well.","title":"The URL Shortening App"},{"location":"python_web/url-shorten-app/#design","text":"We don't jump directly to coding. First thing we do is gather requirements. Come up with an approach. Have the approach/design reviewed by peers. Evolve, iterate, document the decisions and tradeoffs. And then finally implement. While we will not do the full blown design document here, we will raise certain questions here that are important to the design.","title":"Design"},{"location":"python_web/url-shorten-app/#1-high-level-operations-and-api-endpoints","text":"Since it's a URL shortening app, we will need an API for generating the shorten link given an original link. And an API/Endpoint which will accept the shorten link and redirect to original URL. We are not including the user aspect of the app to keep things minimal. These two API should make app functional and usable by anyone.","title":"1. High Level Operations and API Endpoints"},{"location":"python_web/url-shorten-app/#2-how-to-shorten","text":"Given a url, we will need to generate a shortened version of it. One approach could be using random characters for each link. Another thing that can be done is to use some sort of hashing algorithm. The benefit here is we will reuse the same hash for the same link. ie: if lot of people are shortening https://www.linkedin.com they all will have the same value, compared to multiple entries in DB if chosen random characters. What about hash collisions? Even in random characters approach, though there is a less probability, hash collisions can happen. And we need to be mindful of them. In that case we might want to prepend/append the string with some random value to avoid conflict. Also, choice of hash algorithm matters. We will need to analyze algorithms. Their CPU requirements and their characteristics. Choose one that suits the most.","title":"2. How to shorten?"},{"location":"python_web/url-shorten-app/#3-is-url-valid","text":"Given a URL to shorten, how do we verify if the URL is valid? Do we even verify or validate? One basic check that can be done is see if the URL matches a regex of a URL. To go even further we can try opening/visiting the URL. But there are certain gotchas here. We need to define success criteria. ie: HTTP 200 means it is valid. What is the URL is in private network? What if URL is temporarily down?","title":"3. Is URL Valid?"},{"location":"python_web/url-shorten-app/#4-storage","text":"Finally, storage. Where will we store the data that we will generate over time? There are multiple database solutions available and we will need to choose the one that suits this app the most. Relational database like MySQL would be a fair choice but be sure to checkout School of SRE's database section for deeper insights into making a more informed decision.","title":"4. Storage"},{"location":"python_web/url-shorten-app/#5-other","text":"We are not accounting for users into our app and other possible features like rate limiting, customized links etc but it will eventually come up with time. Depending on the requirements, they too might need to get incorporated. The minimal working code is given below for reference but I'd encourage you to come up with your own. from flask import Flask, redirect, request from hashlib import md5 app = Flask(\"url_shortener\") mapping = {} @app.route(\"/shorten\", methods=[\"POST\"]) def shorten(): global mapping payload = request.json if \"url\" not in payload: return \"Missing URL Parameter\", 400 # TODO: check if URL is valid hash_ = md5() hash_.update(payload[\"url\"].encode()) digest = hash_.hexdigest()[:5] # limiting to 5 chars. Less the limit more the chances of collission if digest not in mapping: mapping[digest] = payload[\"url\"] return f\"Shortened: r/{digest}\\n\" else: # TODO: check for hash collission return f\"Already exists: r/{digest}\\n\" @app.route(\"/r/<hash_>\") def redirect_(hash_): if hash_ not in mapping: return \"URL Not Found\", 404 return redirect(mapping[hash_]) if __name__ == \"__main__\": app.run(debug=True) \"\"\" OUTPUT: ===> SHORTENING spatel1-mn1:tmp spatel1$ curl localhost:5000/shorten -H \"content-type: application/json\" --data '{\"url\":\"https://linkedin.com\"}' Shortened: r/a62a4 ===> REDIRECTING, notice the response code 302 and the location header spatel1-mn1:tmp spatel1$ curl localhost:5000/r/a62a4 -v * Uses proxy env variable NO_PROXY == '127.0.0.1' * Trying ::1... * TCP_NODELAY set * Connection failed * connect to ::1 port 5000 failed: Connection refused * Trying 127.0.0.1... * TCP_NODELAY set * Connected to localhost (127.0.0.1) port 5000 (#0) > GET /r/a62a4 HTTP/1.1 > Host: localhost:5000 > User-Agent: curl/7.64.1 > Accept: */* > * HTTP 1.0, assume close after body < HTTP/1.0 302 FOUND < Content-Type: text/html; charset=utf-8 < Content-Length: 247 < Location: https://linkedin.com < Server: Werkzeug/0.15.4 Python/3.7.7 < Date: Tue, 27 Oct 2020 09:37:12 GMT < <!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2 Final//EN\"> <title>Redirecting...</title> <h1>Redirecting...</h1> * Closing connection 0 <p>You should be redirected automatically to target URL: <a href=\"https://linkedin.com\">https://linkedin.com</a>. If not click the link. \"\"\"","title":"5. Other"},{"location":"security/conclusion/","text":"Conclusion Now that you have completed this course on Security you are now aware of the possible security threats to computer systems & networks. Not only that, but you are now better able to protect your systems as well as recommend security measures to others. This course provides fundamental everyday knowledge on security domain which will also help you keep security at the top of your priority. Other Resources Some books that would be a great resource Holistic Info-Sec for Web Developers https://holisticinfosecforwebdevelopers.com/ - Free and downloadable book series with very broad and deep coverage of what Web Developers and DevOps Engineers need to know in order to create robust, reliable, maintainable and secure software, networks and other, that are delivered continuously, on time, with no nasty surprises Docker Security - Quick Reference: For DevOps Engineers https://holisticinfosecforwebdevelopers.com/ - A book on understanding the Docker security defaults, how to improve them (theory and practical), along with many tools and techniques. How to Hack Like a Legend https://amzn.to/2uWh1Up - A hacker\u2019s tale breaking into a secretive offshore company, Sparc Flow, 2018 How to Investigate Like a Rockstar https://books2read.com/u/4jDWoZ - Live a real crisis to master the secrets of forensic analysis, Sparc Flow, 2017 Real World Cryptography https://www.manning.com/books/real-world-cryptography - This early-access book teaches you applied cryptographic techniques to understand and apply security at every level of your systems and applications. AWS Security https://www.manning.com/books/aws-security?utm_source=github&utm_medium=organic&utm_campaign=book_shields_aws_1_31_20 - This early-access book covers commong AWS security issues and best practices for access policies, data protection, auditing, continuous monitoring, and incident response. Post Training asks/ Further Reading CTF Events like : https://github.com/apsdehal/awesome-ctf Penetration Testing : https://github.com/enaqx/awesome-pentest Threat Intelligence : https://github.com/hslatman/awesome-threat-intelligence Threat Detection & Hunting : https://github.com/0x4D31/awesome-threat-detection Web Security: https://github.com/qazbnm456/awesome-web-security Building Secure and Reliable Systems : https://landing.google.com/sre/resources/foundationsandprinciples/srs-book/","title":"Conclusion"},{"location":"security/conclusion/#conclusion","text":"Now that you have completed this course on Security you are now aware of the possible security threats to computer systems & networks. Not only that, but you are now better able to protect your systems as well as recommend security measures to others. This course provides fundamental everyday knowledge on security domain which will also help you keep security at the top of your priority.","title":"Conclusion"},{"location":"security/conclusion/#other-resources","text":"Some books that would be a great resource Holistic Info-Sec for Web Developers https://holisticinfosecforwebdevelopers.com/ - Free and downloadable book series with very broad and deep coverage of what Web Developers and DevOps Engineers need to know in order to create robust, reliable, maintainable and secure software, networks and other, that are delivered continuously, on time, with no nasty surprises Docker Security - Quick Reference: For DevOps Engineers https://holisticinfosecforwebdevelopers.com/ - A book on understanding the Docker security defaults, how to improve them (theory and practical), along with many tools and techniques. How to Hack Like a Legend https://amzn.to/2uWh1Up - A hacker\u2019s tale breaking into a secretive offshore company, Sparc Flow, 2018 How to Investigate Like a Rockstar https://books2read.com/u/4jDWoZ - Live a real crisis to master the secrets of forensic analysis, Sparc Flow, 2017 Real World Cryptography https://www.manning.com/books/real-world-cryptography - This early-access book teaches you applied cryptographic techniques to understand and apply security at every level of your systems and applications. AWS Security https://www.manning.com/books/aws-security?utm_source=github&utm_medium=organic&utm_campaign=book_shields_aws_1_31_20 - This early-access book covers commong AWS security issues and best practices for access policies, data protection, auditing, continuous monitoring, and incident response.","title":"Other Resources"},{"location":"security/conclusion/#post-training-asks-further-reading","text":"CTF Events like : https://github.com/apsdehal/awesome-ctf Penetration Testing : https://github.com/enaqx/awesome-pentest Threat Intelligence : https://github.com/hslatman/awesome-threat-intelligence Threat Detection & Hunting : https://github.com/0x4D31/awesome-threat-detection Web Security: https://github.com/qazbnm456/awesome-web-security Building Secure and Reliable Systems : https://landing.google.com/sre/resources/foundationsandprinciples/srs-book/","title":"Post Training asks/ Further Reading"},{"location":"security/fundamentals/","text":"Part I: Fundamentals Introduction to Security Overview for SRE If you look closely, both Site Reliability Engineering and Security Engineering are concerned with keeping a system usable. Issues like broken releases, capacity shortages, and misconfigurations can make a system unusable (at least temporarily). Security or privacy incidents that break the trust of users also undermine the usefulness of a system. Consequently, system security should be top of mind for SREs. SREs should be involved in both significant design discussions and actual system changes. They have quite a big role in System design & hence are quite sometimes the first line of defence. SRE\u2019s help in preventing bad design & implementations which can affect the overall security of the infrastructure. Successfully designing, implementing, and maintaining systems requires a commitment to the full system lifecycle . This commitment is possible only when security and reliability are central elements in the architecture of systems. Core Pillars of Information Security : Confidentiality \u2013 only allow access to data for which the user is permitted Integrity \u2013 ensure data is not tampered or altered by unauthorized users Availability \u2013 ensure systems and data are available to authorized users when they need it Thinking like a Security Engineer When starting a new application or re-factoring an existing application, you should consider each functional feature, and consider: Is the process surrounding this feature as safe as possible? In other words, is this a flawed process? If I were evil, how would I abuse this feature? Or more specifically failing to address how a feature can be abused can cause design flaws. Is the feature required to be on by default? If so, are there limits or options that could help reduce the risk from this feature? Security Principles By OWASP (Open Web Application Security Project) Minimize attack surface area : Every feature that is added to an application adds a certain amount of risk to the overall application. The aim of secure development is to reduce the overall risk by reducing the attack surface area. For example, a web application implements online help with a search function. The search function may be vulnerable to SQL injection attacks. If the help feature was limited to authorized users, the attack likelihood is reduced. If the help feature\u2019s search function was gated through centralized data validation routines, the ability to perform SQL injection is dramatically reduced. However, if the help feature was re-written to eliminate the search function (through a better user interface, for example), this almost eliminates the attack surface area, even if the help feature was available to the Internet at large. Establish secure defaults: There are many ways to deliver an \u201cout of the box\u201d experience for users. However, by default, the experience should be secure, and it should be up to the user to reduce their security \u2013 if they are allowed. For example, by default, password ageing and complexity should be enabled. Users might be allowed to turn these two features off to simplify their use of the application and increase their risk. Default Passwords of routers, IoT devices should be changed Principle of Least privilege The principle of least privilege recommends that accounts have the least amount of privilege required to perform their business processes. This encompasses user rights, resource permissions such as CPU limits, memory, network, and file system permissions. For example, if a middleware server only requires access to the network, read access to a database table, and the ability to write to a log, this describes all the permissions that should be granted. Under no circumstances should the middleware be granted administrative privileges. Principle of Defense in depth The principle of defence in depth suggests that where one control would be reasonable, more controls that approach risks in different fashions are better. Controls, when used in depth, can make severe vulnerabilities extraordinarily difficult to exploit and thus unlikely to occur. With secure coding, this may take the form of tier-based validation, centralized auditing controls, and requiring users to be logged on all pages. For example, a flawed administrative interface is unlikely to be vulnerable to an anonymous attack if it correctly gates access to production management networks, checks for administrative user authorization, and logs all access. Fail securely Applications regularly fail to process transactions for many reasons. How they fail can determine if an application is secure or not. ``` is_admin = true; try { code_which_may_faile(); is_admin = is_user_assigned_role(\"Adminstrator\"); } catch (Exception err) { log.error(err.toString()); } ``` - If either codeWhichMayFail() or isUserInRole fails or throws an exception, the user is an admin by default. This is obviously a security risk. Don\u2019t trust services Many organizations utilize the processing capabilities of third-party partners, who more than likely have different security policies and posture than you. It is unlikely that you can influence or control any external third party, whether they are home users or major suppliers or partners. Therefore, the implicit trust of externally run systems is not warranted. All external systems should be treated similarly. For example, a loyalty program provider provides data that is used by Internet Banking, providing the number of reward points and a small list of potential redemption items. However, the data should be checked to ensure that it is safe to display to end-users and that the reward points are a positive number, and not improbably large. Separation of duties The key to fraud control is the separation of duties. For example, someone who requests a computer cannot also sign for it, nor should they directly receive the computer. This prevents the user from requesting many computers and claiming they never arrived. Certain roles have different levels of trust than normal users. In particular, administrators are different from normal users. In general, administrators should not be users of the application. For example, an administrator should be able to turn the system on or off, set password policy but shouldn\u2019t be able to log on to the storefront as a super privileged user, such as being able to \u201cbuy\u201d goods on behalf of other users. Avoid security by obscurity Security through obscurity is a weak security control, and nearly always fails when it is the only control. This is not to say that keeping secrets is a bad idea, it simply means that the security of systems should not be reliant upon keeping details hidden. For example, the security of an application should not rely upon knowledge of the source code being kept secret. The security should rely upon many other factors, including reasonable password policies, defence in depth, business transaction limits, solid network architecture, and fraud, and audit controls. A practical example is Linux. Linux\u2019s source code is widely available, and yet when properly secured, Linux is a secure and robust operating system. Keep security simple Attack surface area and simplicity go hand in hand. Certain software engineering practices prefer overly complex approaches to what would otherwise be a relatively straightforward and simple design. Developers should avoid the use of double negatives and complex architectures when a simpler approach would be faster and simpler. For example, although it might be fashionable to have a slew of singleton entity beans running on a separate middleware server, it is more secure and faster to simply use global variables with an appropriate mutex mechanism to protect against race conditions. Fix security issues correctly Once a security issue has been identified, it is important to develop a test for it and to understand the root cause of the issue. When design patterns are used, the security issue is likely widespread amongst all codebases, so developing the right fix without introducing regressions is essential. For example, a user has found that they can see another user\u2019s balance by adjusting their cookie. The fix seems to be relatively straightforward, but as the cookie handling code is shared among all applications, a change to just one application will trickle through to all other applications. The fix must, therefore, be tested on all affected applications. Reliability & Security Reliability and security are both crucial components of a truly trustworthy system, but building systems that are both reliable and secure is difficult. While the requirements for reliability and security share many common properties, they also require different design considerations. It is easy to miss the subtle interplay between reliability and security that can cause unexpected outcomes Ex: A password management application failure was triggered by a reliability problem i.e poor load-balancing and load-shedding strategies and its recovery were later complicated by multiple measures (HSM mechanism which needs to be plugged into server racks, which works as an authentication & the HSM token supposedly locked inside a case.. & the problem can be further elongated ) designed to increase the security of the system. Authentication vs Authorization Authentication is the act of validating that users are who they claim to be. Passwords are the most common authentication factor\u2014if a user enters the correct password, the system assumes the identity is valid and grants access. Other technologies such as One-Time Pins, authentication apps, and even biometrics can also be used to authenticate identity. In some instances, systems require the successful verification of more than one factor before granting access. This multi-factor authentication (MFA) requirement is often deployed to increase security beyond what passwords alone can provide. Authorization in system security is the process of giving the user permission to access a specific resource or function. This term is often used interchangeably with access control or client privilege. Giving someone permission to download a particular file on a server or providing individual users with administrative access to an application are good examples. In secure environments, authorization must always follow authentication, users should first prove that their identities are genuine before an organization\u2019s administrators grant them access to the requested resources. Common authentication flow (local authentication) The user registers using an identifier like username/email/mobile The application stores user credentials in the database The application sends a verification email/message to validate the registration Post successful registration, the user enters credentials for logging in On successful authentication, the user is allowed access to specific resources OpenID/OAuth OpenID is an authentication protocol that allows us to authenticate users without using a local auth system. In such a scenario, a user has to be registered with an OpenID Provider and the same provider should be integrated with the authentication flow of your application. To verify the details, we have to forward the authentication requests to the provider. On successful authentication, we receive a success message and/or profile details with which we can execute the necessary flow. OAuth is an authorization mechanism that allows your application user access to a provider(Gmail/Facebook/Instagram/etc). On successful response, we (your application) receive a token with which the application can access certain APIs on behalf of a user. OAuth is convenient in case your business use case requires some certain user-facing APIs like access to Google Drive or sending tweets on your behalf. Most OAuth 2.0 providers can be used for pseudo authentication. Having said that, it can get pretty complicated if you are using multiple OAuth providers to authenticate users on top of the local authentication system. Cryptography It is the science and study of hiding any text in such a way that only the intended recipients or authorized persons can read it and that any text can even use things such as invisible ink or the mechanical cryptography machines of the past. Cryptography is necessary for securing critical or proprietary information and is used to encode private data messages by converting some plain text into ciphertext. At its core, there are two ways of doing this, more advanced methods are all built upon. Ciphers Ciphers are the cornerstone of cryptography. A cipher is a set of algorithms that performs encryption or decryption on a message. An encryption algorithm (E) takes a secret key (k) and a message (m) and produces a ciphertext (c). Similarly, a Decryption algorithm (D) takes a secret key (K) and the previous resulting Ciphertext (C). They are represented as follows: E(k,m) = c D(k,c) = m This also means that for it to be a cipher, it must satisfy the consistency equation as follows, making it possible to decrypt. D(k,E(k,m)) = m Stream Ciphers: The message is broken into characters or bits and enciphered with a key or keystream(should be random and generated independently of the message stream) that is as long as the plaintext bitstream. If the keystream is random, this scheme would be unbreakable unless the keystream was acquired, making it unconditionally secure. The keystream must be provided to both parties in a secure way to prevent its release. Block Ciphers: Block ciphers \u2014 process messages in blocks, each of which is then encrypted or decrypted. A block cipher is a symmetric cipher in which blocks of plaintext are treated as a whole and used to produce ciphertext blocks. The block cipher takes blocks that are b bits long and encrypts them to blocks that are also b bits long. Block sizes are typically 64 or 128 bits long. Encryption Secret Key (Symmetric Key) : the same key is used for encryption and decryption Public Key (Asymmetric Key) in an asymmetric, the encryption and decryption keys are different but related. The encryption key is known as the public key and the decryption key is known as the private key. The public and private keys are known as a key pair. Symmetric Key Encryption DES The Data Encryption Standard (DES) has been the worldwide encryption standard for a long time. IBM developed DES in 1975, and it has held up remarkably well against years of cryptanalysis. DES is a symmetric encryption algorithm with a fixed key length of 56 bits. The algorithm is still good, but because of the short key length, it is susceptible to brute-force attacks that have sufficient resources. DES usually operates in block mode, whereby it encrypts data in 64-bit blocks. The same algorithm and key are used for both encryption and decryption. Because DES is based on simple mathematical functions, it can be easily implemented and accelerated in hardware. Triple DES With advances in computer processing power, the original 56-bit DES key became too short to withstand an attacker with even a limited budget. One way of increasing the effective key length of DES without changing the well-analyzed algorithm itself is to use the same algorithm with different keys several times in a row. The technique of applying DES three times in a row to a plain text block is called Triple DES (3DES). The 3DES technique is shown in Figure. Brute-force attacks on 3DES are considered unfeasible today. Because the basic algorithm has been tested in the field for more than 25 years, it is considered to be more trustworthy than its predecessor. AES On October 2, 2000, The U.S. National Institute of Standards and Technology (NIST) announced the selection of the Rijndael cipher as the AES algorithm. This cipher, developed by Joan Daemen and Vincent Rijmen, has a variable block length and key length. The algorithm currently specifies how to use keys with a length of 128, 192, or 256 bits to encrypt blocks with a length of 128, 192, or 256 bits (all nine combinations of key length and block length are possible). Both block and key lengths can be extended easily to multiples of 32 bits. AES was chosen to replace DES and 3DES because they are either too weak (DES, in terms of key length) or too slow (3DES) to run on modern, efficient hardware. AES is more efficient and much faster, usually by a factor of 5 compared to DES on the same hardware. AES is also more suitable for high throughput, especially if pure software encryption is used. However, AES is a relatively young algorithm, and as the golden rule of cryptography states, \u201cA more mature algorithm is always more trusted.\u201d Asymmetric Key Algorithm In a symmetric key system, Alice first puts the secret message in a box and then padlocks the box using a lock to which she has a key. She then sends the box to Bob through regular mail. When Bob receives the box, he uses an identical copy of Alice's key (which he has obtained previously) to open the box and read the message. In an asymmetric key system, instead of opening the box when he receives it, Bob simply adds his own personal lock to the box and returns the box through public mail to Alice. Alice uses her key to remove her lock and returns the box to Bob, with Bob's lock still in place. Finally, Bob uses his key to remove his lock and reads the message from Alice. The critical advantage in an asymmetric system is that Alice never needs to send a copy of her key to Bob. This reduces the possibility that a third party (for example, an unscrupulous postmaster) can copy the key while it is in transit to Bob, allowing that third party to spy on all future messages sent by Alice. In addition, if Bob is careless and allows someone else to copy his key, Alice's messages to Bob are compromised, but Alice's messages to other people remain secret NOTE : In terms of TLS key exchange, this is the common approach. Diffie-Hellman The protocol has two system parameters, p and g. They are both public and may be used by everybody. Parameter p is a prime number, and parameter g (usually called a generator) is an integer that is smaller than p, but with the following property: For every number n between 1 and p \u2013 1 inclusive, there is a power k of g such that n = gk mod p. Diffie Hellman algorithm is an asymmetric algorithm used to establish a shared secret for a symmetric key algorithm. Nowadays most of the people use hybrid cryptosystem i.e, a combination of symmetric and asymmetric encryption. Asymmetric Encryption is used as a technique in key exchange mechanism to share a secret key and after the key is shared between sender and receiver, the communication will take place using symmetric encryption. The shared secret key will be used to encrypt the communication. Refer: https://medium.com/@akhigbemmanuel/what-is-the-diffie-hellman-key-exchange-algorithm-84d60025a30d RSA The RSA algorithm is very flexible and has a variable key length where, if necessary, speed can be traded for the level of security of the algorithm. The RSA keys are usually 512 to 2048 bits long. RSA has withstood years of extensive cryptanalysis. Although those years neither proved nor disproved RSA's security, they attest to a confidence level in the algorithm. RSA security is based on the difficulty of factoring very large numbers. If an easy method of factoring these large numbers were discovered, the effectiveness of RSA would be destroyed. Refer: https://medium.com/curiositypapers/a-complete-explanation-of-rsa-asymmetric-encryption-742c5971e0f NOTE : RSA Keys can be used for key exchange just like Diffie Hellman Hashing Algorithms Hashing is one of the mechanisms used for data integrity assurance. Hashing is based on a one-way mathematical function, which is relatively easy to compute but significantly harder to reverse. A hash function, which is a one-way function to input data to produce a fixed-length digest (fingerprint) of output data. The digest is cryptographically strong; that is, it is impossible to recover input data from its digest. If the input data changes just a little, the digest (fingerprint) changes substantially in what is called an avalanche effect. More: https://medium.com/@rauljordan/the-state-of-hashing-algorithms-the-why-the-how-and-the-future-b21d5c0440de https://medium.com/@StevieCEllis/the-beautiful-hash-algorithm-f18d9d2b84fb MD5 MD5 is a one-way function with which it is easy to compute the hash from the given input data, but it is unfeasible to compute input data given only a hash. SHA-1 MD5 is considered less secure than SHA-1 because MD5 has some weaknesses. HA-1 also uses a stronger, 160-bit digest, which makes MD5 the second choice as hash methods are concerned. The algorithm takes a message of less than 264 bits in length and produces a 160-bit message digest. This algorithm is slightly slower than MD5. NOTE : SHA-1 is also recently demonstrated to be broken, Minimum current recommendation is SHA-256 Digital Certificates Digital signatures, provide a means to digitally authenticate devices and individual users. In public-key cryptography, such as the RSA encryption system, each user has a key-pair containing both a public key and a private key. The keys act as complements, and anything encrypted with one of the keys can be decrypted with the other. In simple terms, a signature is formed when data is encrypted with a user's private key. The receiver verifies the signature by decrypting the message with the sender's public key. Key management is often considered the most difficult task in designing and implementing cryptographic systems. Businesses can simplify some of the deployment and management issues that are encountered with secured data communications by employing a Public Key Infrastructure (PKI). Because corporations often move security-sensitive communications across the Internet, an effective mechanism must be implemented to protect sensitive information from the threats presented on the Internet. PKI provides a hierarchical framework for managing digital security attributes. Each PKI participant holds a digital certificate that has been issued by a CA (either public or private). The certificate contains several attributes that are used when parties negotiate a secure connection. These attributes must include the certificate validity period, end-host identity information, encryption keys that will be used for secure communications, and the signature of the issuing CA. Optional attributes may be included, depending on the requirements and capability of the PKI. A CA can be a trusted third party, such as VeriSign or Entrust, or a private (in-house) CA that you establish within your organization. The fact that the message could be decrypted using the sender's public key means that the holder of the private key created the message. This process relies on the receiver having a copy of the sender's public key and knowing with a high degree of certainty that it really does belong to the sender and not to someone pretending to be the sender. To validate the CA's signature, the receiver must know the CA's public key. Normally, this is handled out-of-band or through an operation performed during the installation of the certificate. For instance, most web browsers are configured with the root certificates of several CAs by default. CA Enrollment process The end host generates a private-public key pair. The end host generates a certificate request, which it forwards to the CA. Manual human intervention is required to approve the enrollment request, which is received by the CA. After the CA operator approves the request, the CA signs the certificate request with its private key and returns the completed certificate to the end host. The end host writes the certificate into a nonvolatile storage area (PC hard disk or NVRAM on Cisco routers). Refer : https://www.ssh.com/manuals/server-zos-product/55/ch06s03s01.html Login Security SSH SSH, the Secure Shell, is a popular, powerful, software-based approach to network security. Whenever data is sent by a computer to the network, SSH automatically encrypts (scrambles) it. Then, when the data reaches its intended recipient, SSH automatically decrypts (unscrambles) it. The result is transparent encryption: users can work normally, unaware that their communications are safely encrypted on the network. In addition, SSH can use modern, secure encryption algorithms based on how it's being configured and is effective enough to be found within mission-critical applications at major corporations. SSH has a client/server architecture An SSH server program, typically installed and run by a system administrator, accepts or rejects incoming connections to its host computer. Users then run SSH client programs, typically on other computers, to make requests of the SSH server, such as \u201cPlease log me in,\u201d \u201cPlease send me a file,\u201d or \u201cPlease execute this command.\u201d All communications between clients and servers are securely encrypted and protected from modification. What SSH is not: Although SSH stands for Secure Shell, it is not a true shell in the sense of the Unix Bourne shell and C shell. It is not a command interpreter, nor does it provide wildcard expansion, command history, and so forth. Rather, SSH creates a channel for running a shell on a remote computer, with end-to-end encryption between the two systems. The major features and guarantees of the SSH protocol are: Privacy of your data, via strong encryption Integrity of communications, guaranteeing they haven\u2019t been altered Authentication, i.e., proof of identity of senders and receivers Authorization, i.e., access control to accounts Forwarding or tunnelling to encrypt other TCP/IP-based sessions Kerberos According to Greek mythology Kerberos (Cerberus) was the gigantic, three-headed dog that guards the gates of the underworld to prevent the dead from leaving. So when it comes to Computer Science, Kerberos is a network authentication protocol and is currently the default authentication technology used by Microsoft Active Directory to authenticate users to services within a local area network. Kerberos uses symmetric-key cryptography and requires a trusted third-party authentication service to verify user identities. So they used the name of Kerberos for their computer network authentication protocol as the three heads of the Kerberos represent: a client: A user/ a service a server: Kerberos protected hosts reside - a Key Distribution Center (KDC), which acts as the trusted third-party authentication service. The KDC includes the following two servers: Authentication Server (AS) that performs the initial authentication and issues ticket-granting tickets (TGT) for users. Ticket-Granting Server (TGS) that issues service tickets that are based on the initial ticket-granting tickets (TGT). Certificate Chain The first part of the output of the OpenSSL command shows three certificates numbered 0, 1, and 2(not 2 anymore). Each certificate has a subject, s, and an issuer, i. The first certificate, number 0, is called the end-entity certificate. The subject line tells us it\u2019s valid for any subdomain of google.com because its subject is set to *.google.com. $ openssl s_client -connect www.google.com:443 -CApath /etc/ssl/certs CONNECTED(00000005) depth=2 OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign verify return:1 depth=1 C = US, O = Google Trust Services, CN = GTS CA 1O1 verify return:1 depth=0 C = US, ST = California, L = Mountain View, O = Google LLC, CN = www.google.com verify return:1 --- Certificate chain 0 s:/C=US/ST=California/L=Mountain View/O=Google LLC/CN=www.google.com i:/C=US/O=Google Trust Services/CN=GTS CA 1O1 1 s:/C=US/O=Google Trust Services/CN=GTS CA 1O1 i:/OU=GlobalSign Root CA - R2/O=GlobalSign/CN=GlobalSign --- Server certificate The issuer line indicates it\u2019s issued by Google Internet Authority G2, which also happens to be the subject of the second certificate, number 1 What the OpenSSL command line doesn\u2019t show here is the trust store that contains the list of CA certificates trusted by the system OpenSSL runs on. The public certificate of GlobalSign Authority must be present in the system\u2019s trust store to close the verification chain. This is called a chain of trust, and the figure below summarizes its behaviour at a high level. High-level view of the concept of chain of trust applied to verifying the authenticity of a website. The Root CA in the Firefox trust store provides the initial trust to verify the entire chain and trust the end-entity certificate. TLS Handshake The client sends a HELLO message to the server with a list of protocols and algorithms it supports. The server says HELLO back and sends its chain of certificates. Based on the capabilities of the client, the server picks a cipher suite. If the cipher suite supports ephemeral key exchange, like ECDHE does(ECDHE is an algorithm known as the Elliptic Curve Diffie-Hellman Exchange), the server and the client negotiate a pre-master key with the Diffie-Hellman algorithm. The pre-master key is never sent over the wire. The client and server create a session key that will be used to encrypt the data transiting through the connection. At the end of the handshake, both parties possess a secret session key used to encrypt data for the rest of the connection. This is what OpenSSL refers to as Master-Key NOTE There are 3 versions of TLS , TLS 1.0, 1.1 & 1.2 TLS 1.0 was released in 1999, making it a nearly two-decade-old protocol. It has been known to be vulnerable to attacks\u2014such as BEAST and POODLE\u2014for years, in addition to supporting weak cryptography, which doesn\u2019t keep modern-day connections sufficiently secure. TLS 1.1 is the forgotten \u201cmiddle child.\u201d It also has bad cryptography like its younger sibling. In most software, it was leapfrogged by TLS 1.2 and it\u2019s rare to see TLS 1.1 used. \u201cPerfect\u201d Forward Secrecy The term \u201cephemeral\u201d in the key exchange provides an important security feature mis-named perfect forward secrecy (PFS) or just \u201cForward Secrecy\u201d. In a non-ephemeral key exchange, the client sends the pre-master key to the server by encrypting it with the server\u2019s public key. The server then decrypts the pre-master key with its private key. If at a later point in time, the private key of the server is compromised, an attacker can go back to this handshake, decrypt the pre-master key, obtain the session key, and decrypt the entire traffic. Non-ephemeral key exchanges are vulnerable to attacks that may happen in the future on recorded traffic. And because people seldom change their password, decrypting data from the past may still be valuable for an attacker. An ephemeral key exchange like DHE, or its variant on elliptic curve, ECDHE, solves this problem by not transmitting the pre-master key over the wire. Instead, the pre-master key is computed by both the client and the server in isolation, using nonsensitive information exchanged publicly. Because the pre-master key can\u2019t be decrypted later by an attacker, the session key is safe from future attacks: hence, the term perfect forward secrecy. Keys are changed every X blocks along the stream. That prevents an attacker from simply sniffing the stream and applying brute force to crack the whole thing. \"Forward secrecy\" means that just because I can decrypt block M, does not mean that I can decrypt block Q Downside: The downside to PFS is that all those extra computational steps induce latency on the handshake and slow the user down. To avoid repeating this expensive work at every connection, both sides cache the session key for future use via a technique called session resumption. This is what the session-ID and TLS ticket are for: they allow a client and server that share a session ID to skip over the negotiation of a session key, because they already agreed on one previously, and go directly to exchanging data securely.","title":"Fundamentals of Security"},{"location":"security/fundamentals/#part-i-fundamentals","text":"","title":"Part I: Fundamentals"},{"location":"security/fundamentals/#introduction-to-security-overview-for-sre","text":"If you look closely, both Site Reliability Engineering and Security Engineering are concerned with keeping a system usable. Issues like broken releases, capacity shortages, and misconfigurations can make a system unusable (at least temporarily). Security or privacy incidents that break the trust of users also undermine the usefulness of a system. Consequently, system security should be top of mind for SREs. SREs should be involved in both significant design discussions and actual system changes. They have quite a big role in System design & hence are quite sometimes the first line of defence. SRE\u2019s help in preventing bad design & implementations which can affect the overall security of the infrastructure. Successfully designing, implementing, and maintaining systems requires a commitment to the full system lifecycle . This commitment is possible only when security and reliability are central elements in the architecture of systems. Core Pillars of Information Security : Confidentiality \u2013 only allow access to data for which the user is permitted Integrity \u2013 ensure data is not tampered or altered by unauthorized users Availability \u2013 ensure systems and data are available to authorized users when they need it Thinking like a Security Engineer When starting a new application or re-factoring an existing application, you should consider each functional feature, and consider: Is the process surrounding this feature as safe as possible? In other words, is this a flawed process? If I were evil, how would I abuse this feature? Or more specifically failing to address how a feature can be abused can cause design flaws. Is the feature required to be on by default? If so, are there limits or options that could help reduce the risk from this feature? Security Principles By OWASP (Open Web Application Security Project) Minimize attack surface area : Every feature that is added to an application adds a certain amount of risk to the overall application. The aim of secure development is to reduce the overall risk by reducing the attack surface area. For example, a web application implements online help with a search function. The search function may be vulnerable to SQL injection attacks. If the help feature was limited to authorized users, the attack likelihood is reduced. If the help feature\u2019s search function was gated through centralized data validation routines, the ability to perform SQL injection is dramatically reduced. However, if the help feature was re-written to eliminate the search function (through a better user interface, for example), this almost eliminates the attack surface area, even if the help feature was available to the Internet at large. Establish secure defaults: There are many ways to deliver an \u201cout of the box\u201d experience for users. However, by default, the experience should be secure, and it should be up to the user to reduce their security \u2013 if they are allowed. For example, by default, password ageing and complexity should be enabled. Users might be allowed to turn these two features off to simplify their use of the application and increase their risk. Default Passwords of routers, IoT devices should be changed Principle of Least privilege The principle of least privilege recommends that accounts have the least amount of privilege required to perform their business processes. This encompasses user rights, resource permissions such as CPU limits, memory, network, and file system permissions. For example, if a middleware server only requires access to the network, read access to a database table, and the ability to write to a log, this describes all the permissions that should be granted. Under no circumstances should the middleware be granted administrative privileges. Principle of Defense in depth The principle of defence in depth suggests that where one control would be reasonable, more controls that approach risks in different fashions are better. Controls, when used in depth, can make severe vulnerabilities extraordinarily difficult to exploit and thus unlikely to occur. With secure coding, this may take the form of tier-based validation, centralized auditing controls, and requiring users to be logged on all pages. For example, a flawed administrative interface is unlikely to be vulnerable to an anonymous attack if it correctly gates access to production management networks, checks for administrative user authorization, and logs all access. Fail securely Applications regularly fail to process transactions for many reasons. How they fail can determine if an application is secure or not. ``` is_admin = true; try { code_which_may_faile(); is_admin = is_user_assigned_role(\"Adminstrator\"); } catch (Exception err) { log.error(err.toString()); } ``` - If either codeWhichMayFail() or isUserInRole fails or throws an exception, the user is an admin by default. This is obviously a security risk. Don\u2019t trust services Many organizations utilize the processing capabilities of third-party partners, who more than likely have different security policies and posture than you. It is unlikely that you can influence or control any external third party, whether they are home users or major suppliers or partners. Therefore, the implicit trust of externally run systems is not warranted. All external systems should be treated similarly. For example, a loyalty program provider provides data that is used by Internet Banking, providing the number of reward points and a small list of potential redemption items. However, the data should be checked to ensure that it is safe to display to end-users and that the reward points are a positive number, and not improbably large. Separation of duties The key to fraud control is the separation of duties. For example, someone who requests a computer cannot also sign for it, nor should they directly receive the computer. This prevents the user from requesting many computers and claiming they never arrived. Certain roles have different levels of trust than normal users. In particular, administrators are different from normal users. In general, administrators should not be users of the application. For example, an administrator should be able to turn the system on or off, set password policy but shouldn\u2019t be able to log on to the storefront as a super privileged user, such as being able to \u201cbuy\u201d goods on behalf of other users. Avoid security by obscurity Security through obscurity is a weak security control, and nearly always fails when it is the only control. This is not to say that keeping secrets is a bad idea, it simply means that the security of systems should not be reliant upon keeping details hidden. For example, the security of an application should not rely upon knowledge of the source code being kept secret. The security should rely upon many other factors, including reasonable password policies, defence in depth, business transaction limits, solid network architecture, and fraud, and audit controls. A practical example is Linux. Linux\u2019s source code is widely available, and yet when properly secured, Linux is a secure and robust operating system. Keep security simple Attack surface area and simplicity go hand in hand. Certain software engineering practices prefer overly complex approaches to what would otherwise be a relatively straightforward and simple design. Developers should avoid the use of double negatives and complex architectures when a simpler approach would be faster and simpler. For example, although it might be fashionable to have a slew of singleton entity beans running on a separate middleware server, it is more secure and faster to simply use global variables with an appropriate mutex mechanism to protect against race conditions. Fix security issues correctly Once a security issue has been identified, it is important to develop a test for it and to understand the root cause of the issue. When design patterns are used, the security issue is likely widespread amongst all codebases, so developing the right fix without introducing regressions is essential. For example, a user has found that they can see another user\u2019s balance by adjusting their cookie. The fix seems to be relatively straightforward, but as the cookie handling code is shared among all applications, a change to just one application will trickle through to all other applications. The fix must, therefore, be tested on all affected applications. Reliability & Security Reliability and security are both crucial components of a truly trustworthy system, but building systems that are both reliable and secure is difficult. While the requirements for reliability and security share many common properties, they also require different design considerations. It is easy to miss the subtle interplay between reliability and security that can cause unexpected outcomes Ex: A password management application failure was triggered by a reliability problem i.e poor load-balancing and load-shedding strategies and its recovery were later complicated by multiple measures (HSM mechanism which needs to be plugged into server racks, which works as an authentication & the HSM token supposedly locked inside a case.. & the problem can be further elongated ) designed to increase the security of the system.","title":"Introduction to Security Overview for SRE"},{"location":"security/fundamentals/#authentication-vs-authorization","text":"Authentication is the act of validating that users are who they claim to be. Passwords are the most common authentication factor\u2014if a user enters the correct password, the system assumes the identity is valid and grants access. Other technologies such as One-Time Pins, authentication apps, and even biometrics can also be used to authenticate identity. In some instances, systems require the successful verification of more than one factor before granting access. This multi-factor authentication (MFA) requirement is often deployed to increase security beyond what passwords alone can provide. Authorization in system security is the process of giving the user permission to access a specific resource or function. This term is often used interchangeably with access control or client privilege. Giving someone permission to download a particular file on a server or providing individual users with administrative access to an application are good examples. In secure environments, authorization must always follow authentication, users should first prove that their identities are genuine before an organization\u2019s administrators grant them access to the requested resources.","title":"Authentication vs Authorization"},{"location":"security/fundamentals/#common-authentication-flow-local-authentication","text":"The user registers using an identifier like username/email/mobile The application stores user credentials in the database The application sends a verification email/message to validate the registration Post successful registration, the user enters credentials for logging in On successful authentication, the user is allowed access to specific resources","title":"Common authentication flow (local authentication)"},{"location":"security/fundamentals/#openidoauth","text":"OpenID is an authentication protocol that allows us to authenticate users without using a local auth system. In such a scenario, a user has to be registered with an OpenID Provider and the same provider should be integrated with the authentication flow of your application. To verify the details, we have to forward the authentication requests to the provider. On successful authentication, we receive a success message and/or profile details with which we can execute the necessary flow. OAuth is an authorization mechanism that allows your application user access to a provider(Gmail/Facebook/Instagram/etc). On successful response, we (your application) receive a token with which the application can access certain APIs on behalf of a user. OAuth is convenient in case your business use case requires some certain user-facing APIs like access to Google Drive or sending tweets on your behalf. Most OAuth 2.0 providers can be used for pseudo authentication. Having said that, it can get pretty complicated if you are using multiple OAuth providers to authenticate users on top of the local authentication system.","title":"OpenID/OAuth"},{"location":"security/fundamentals/#cryptography","text":"It is the science and study of hiding any text in such a way that only the intended recipients or authorized persons can read it and that any text can even use things such as invisible ink or the mechanical cryptography machines of the past. Cryptography is necessary for securing critical or proprietary information and is used to encode private data messages by converting some plain text into ciphertext. At its core, there are two ways of doing this, more advanced methods are all built upon.","title":"Cryptography"},{"location":"security/fundamentals/#ciphers","text":"Ciphers are the cornerstone of cryptography. A cipher is a set of algorithms that performs encryption or decryption on a message. An encryption algorithm (E) takes a secret key (k) and a message (m) and produces a ciphertext (c). Similarly, a Decryption algorithm (D) takes a secret key (K) and the previous resulting Ciphertext (C). They are represented as follows: E(k,m) = c D(k,c) = m This also means that for it to be a cipher, it must satisfy the consistency equation as follows, making it possible to decrypt. D(k,E(k,m)) = m Stream Ciphers: The message is broken into characters or bits and enciphered with a key or keystream(should be random and generated independently of the message stream) that is as long as the plaintext bitstream. If the keystream is random, this scheme would be unbreakable unless the keystream was acquired, making it unconditionally secure. The keystream must be provided to both parties in a secure way to prevent its release. Block Ciphers: Block ciphers \u2014 process messages in blocks, each of which is then encrypted or decrypted. A block cipher is a symmetric cipher in which blocks of plaintext are treated as a whole and used to produce ciphertext blocks. The block cipher takes blocks that are b bits long and encrypts them to blocks that are also b bits long. Block sizes are typically 64 or 128 bits long. Encryption Secret Key (Symmetric Key) : the same key is used for encryption and decryption Public Key (Asymmetric Key) in an asymmetric, the encryption and decryption keys are different but related. The encryption key is known as the public key and the decryption key is known as the private key. The public and private keys are known as a key pair. Symmetric Key Encryption DES The Data Encryption Standard (DES) has been the worldwide encryption standard for a long time. IBM developed DES in 1975, and it has held up remarkably well against years of cryptanalysis. DES is a symmetric encryption algorithm with a fixed key length of 56 bits. The algorithm is still good, but because of the short key length, it is susceptible to brute-force attacks that have sufficient resources. DES usually operates in block mode, whereby it encrypts data in 64-bit blocks. The same algorithm and key are used for both encryption and decryption. Because DES is based on simple mathematical functions, it can be easily implemented and accelerated in hardware. Triple DES With advances in computer processing power, the original 56-bit DES key became too short to withstand an attacker with even a limited budget. One way of increasing the effective key length of DES without changing the well-analyzed algorithm itself is to use the same algorithm with different keys several times in a row. The technique of applying DES three times in a row to a plain text block is called Triple DES (3DES). The 3DES technique is shown in Figure. Brute-force attacks on 3DES are considered unfeasible today. Because the basic algorithm has been tested in the field for more than 25 years, it is considered to be more trustworthy than its predecessor. AES On October 2, 2000, The U.S. National Institute of Standards and Technology (NIST) announced the selection of the Rijndael cipher as the AES algorithm. This cipher, developed by Joan Daemen and Vincent Rijmen, has a variable block length and key length. The algorithm currently specifies how to use keys with a length of 128, 192, or 256 bits to encrypt blocks with a length of 128, 192, or 256 bits (all nine combinations of key length and block length are possible). Both block and key lengths can be extended easily to multiples of 32 bits. AES was chosen to replace DES and 3DES because they are either too weak (DES, in terms of key length) or too slow (3DES) to run on modern, efficient hardware. AES is more efficient and much faster, usually by a factor of 5 compared to DES on the same hardware. AES is also more suitable for high throughput, especially if pure software encryption is used. However, AES is a relatively young algorithm, and as the golden rule of cryptography states, \u201cA more mature algorithm is always more trusted.\u201d Asymmetric Key Algorithm In a symmetric key system, Alice first puts the secret message in a box and then padlocks the box using a lock to which she has a key. She then sends the box to Bob through regular mail. When Bob receives the box, he uses an identical copy of Alice's key (which he has obtained previously) to open the box and read the message. In an asymmetric key system, instead of opening the box when he receives it, Bob simply adds his own personal lock to the box and returns the box through public mail to Alice. Alice uses her key to remove her lock and returns the box to Bob, with Bob's lock still in place. Finally, Bob uses his key to remove his lock and reads the message from Alice. The critical advantage in an asymmetric system is that Alice never needs to send a copy of her key to Bob. This reduces the possibility that a third party (for example, an unscrupulous postmaster) can copy the key while it is in transit to Bob, allowing that third party to spy on all future messages sent by Alice. In addition, if Bob is careless and allows someone else to copy his key, Alice's messages to Bob are compromised, but Alice's messages to other people remain secret NOTE : In terms of TLS key exchange, this is the common approach. Diffie-Hellman The protocol has two system parameters, p and g. They are both public and may be used by everybody. Parameter p is a prime number, and parameter g (usually called a generator) is an integer that is smaller than p, but with the following property: For every number n between 1 and p \u2013 1 inclusive, there is a power k of g such that n = gk mod p. Diffie Hellman algorithm is an asymmetric algorithm used to establish a shared secret for a symmetric key algorithm. Nowadays most of the people use hybrid cryptosystem i.e, a combination of symmetric and asymmetric encryption. Asymmetric Encryption is used as a technique in key exchange mechanism to share a secret key and after the key is shared between sender and receiver, the communication will take place using symmetric encryption. The shared secret key will be used to encrypt the communication. Refer: https://medium.com/@akhigbemmanuel/what-is-the-diffie-hellman-key-exchange-algorithm-84d60025a30d RSA The RSA algorithm is very flexible and has a variable key length where, if necessary, speed can be traded for the level of security of the algorithm. The RSA keys are usually 512 to 2048 bits long. RSA has withstood years of extensive cryptanalysis. Although those years neither proved nor disproved RSA's security, they attest to a confidence level in the algorithm. RSA security is based on the difficulty of factoring very large numbers. If an easy method of factoring these large numbers were discovered, the effectiveness of RSA would be destroyed. Refer: https://medium.com/curiositypapers/a-complete-explanation-of-rsa-asymmetric-encryption-742c5971e0f NOTE : RSA Keys can be used for key exchange just like Diffie Hellman Hashing Algorithms Hashing is one of the mechanisms used for data integrity assurance. Hashing is based on a one-way mathematical function, which is relatively easy to compute but significantly harder to reverse. A hash function, which is a one-way function to input data to produce a fixed-length digest (fingerprint) of output data. The digest is cryptographically strong; that is, it is impossible to recover input data from its digest. If the input data changes just a little, the digest (fingerprint) changes substantially in what is called an avalanche effect. More: https://medium.com/@rauljordan/the-state-of-hashing-algorithms-the-why-the-how-and-the-future-b21d5c0440de https://medium.com/@StevieCEllis/the-beautiful-hash-algorithm-f18d9d2b84fb MD5 MD5 is a one-way function with which it is easy to compute the hash from the given input data, but it is unfeasible to compute input data given only a hash. SHA-1 MD5 is considered less secure than SHA-1 because MD5 has some weaknesses. HA-1 also uses a stronger, 160-bit digest, which makes MD5 the second choice as hash methods are concerned. The algorithm takes a message of less than 264 bits in length and produces a 160-bit message digest. This algorithm is slightly slower than MD5. NOTE : SHA-1 is also recently demonstrated to be broken, Minimum current recommendation is SHA-256 Digital Certificates Digital signatures, provide a means to digitally authenticate devices and individual users. In public-key cryptography, such as the RSA encryption system, each user has a key-pair containing both a public key and a private key. The keys act as complements, and anything encrypted with one of the keys can be decrypted with the other. In simple terms, a signature is formed when data is encrypted with a user's private key. The receiver verifies the signature by decrypting the message with the sender's public key. Key management is often considered the most difficult task in designing and implementing cryptographic systems. Businesses can simplify some of the deployment and management issues that are encountered with secured data communications by employing a Public Key Infrastructure (PKI). Because corporations often move security-sensitive communications across the Internet, an effective mechanism must be implemented to protect sensitive information from the threats presented on the Internet. PKI provides a hierarchical framework for managing digital security attributes. Each PKI participant holds a digital certificate that has been issued by a CA (either public or private). The certificate contains several attributes that are used when parties negotiate a secure connection. These attributes must include the certificate validity period, end-host identity information, encryption keys that will be used for secure communications, and the signature of the issuing CA. Optional attributes may be included, depending on the requirements and capability of the PKI. A CA can be a trusted third party, such as VeriSign or Entrust, or a private (in-house) CA that you establish within your organization. The fact that the message could be decrypted using the sender's public key means that the holder of the private key created the message. This process relies on the receiver having a copy of the sender's public key and knowing with a high degree of certainty that it really does belong to the sender and not to someone pretending to be the sender. To validate the CA's signature, the receiver must know the CA's public key. Normally, this is handled out-of-band or through an operation performed during the installation of the certificate. For instance, most web browsers are configured with the root certificates of several CAs by default. CA Enrollment process The end host generates a private-public key pair. The end host generates a certificate request, which it forwards to the CA. Manual human intervention is required to approve the enrollment request, which is received by the CA. After the CA operator approves the request, the CA signs the certificate request with its private key and returns the completed certificate to the end host. The end host writes the certificate into a nonvolatile storage area (PC hard disk or NVRAM on Cisco routers). Refer : https://www.ssh.com/manuals/server-zos-product/55/ch06s03s01.html","title":"Ciphers"},{"location":"security/fundamentals/#login-security","text":"","title":"Login Security"},{"location":"security/fundamentals/#ssh","text":"SSH, the Secure Shell, is a popular, powerful, software-based approach to network security. Whenever data is sent by a computer to the network, SSH automatically encrypts (scrambles) it. Then, when the data reaches its intended recipient, SSH automatically decrypts (unscrambles) it. The result is transparent encryption: users can work normally, unaware that their communications are safely encrypted on the network. In addition, SSH can use modern, secure encryption algorithms based on how it's being configured and is effective enough to be found within mission-critical applications at major corporations. SSH has a client/server architecture An SSH server program, typically installed and run by a system administrator, accepts or rejects incoming connections to its host computer. Users then run SSH client programs, typically on other computers, to make requests of the SSH server, such as \u201cPlease log me in,\u201d \u201cPlease send me a file,\u201d or \u201cPlease execute this command.\u201d All communications between clients and servers are securely encrypted and protected from modification. What SSH is not: Although SSH stands for Secure Shell, it is not a true shell in the sense of the Unix Bourne shell and C shell. It is not a command interpreter, nor does it provide wildcard expansion, command history, and so forth. Rather, SSH creates a channel for running a shell on a remote computer, with end-to-end encryption between the two systems. The major features and guarantees of the SSH protocol are: Privacy of your data, via strong encryption Integrity of communications, guaranteeing they haven\u2019t been altered Authentication, i.e., proof of identity of senders and receivers Authorization, i.e., access control to accounts Forwarding or tunnelling to encrypt other TCP/IP-based sessions","title":"SSH"},{"location":"security/fundamentals/#kerberos","text":"According to Greek mythology Kerberos (Cerberus) was the gigantic, three-headed dog that guards the gates of the underworld to prevent the dead from leaving. So when it comes to Computer Science, Kerberos is a network authentication protocol and is currently the default authentication technology used by Microsoft Active Directory to authenticate users to services within a local area network. Kerberos uses symmetric-key cryptography and requires a trusted third-party authentication service to verify user identities. So they used the name of Kerberos for their computer network authentication protocol as the three heads of the Kerberos represent: a client: A user/ a service a server: Kerberos protected hosts reside - a Key Distribution Center (KDC), which acts as the trusted third-party authentication service. The KDC includes the following two servers: Authentication Server (AS) that performs the initial authentication and issues ticket-granting tickets (TGT) for users. Ticket-Granting Server (TGS) that issues service tickets that are based on the initial ticket-granting tickets (TGT).","title":"Kerberos"},{"location":"security/fundamentals/#certificate-chain","text":"The first part of the output of the OpenSSL command shows three certificates numbered 0, 1, and 2(not 2 anymore). Each certificate has a subject, s, and an issuer, i. The first certificate, number 0, is called the end-entity certificate. The subject line tells us it\u2019s valid for any subdomain of google.com because its subject is set to *.google.com. $ openssl s_client -connect www.google.com:443 -CApath /etc/ssl/certs CONNECTED(00000005) depth=2 OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign verify return:1 depth=1 C = US, O = Google Trust Services, CN = GTS CA 1O1 verify return:1 depth=0 C = US, ST = California, L = Mountain View, O = Google LLC, CN = www.google.com verify return:1 --- Certificate chain 0 s:/C=US/ST=California/L=Mountain View/O=Google LLC/CN=www.google.com i:/C=US/O=Google Trust Services/CN=GTS CA 1O1 1 s:/C=US/O=Google Trust Services/CN=GTS CA 1O1 i:/OU=GlobalSign Root CA - R2/O=GlobalSign/CN=GlobalSign --- Server certificate The issuer line indicates it\u2019s issued by Google Internet Authority G2, which also happens to be the subject of the second certificate, number 1 What the OpenSSL command line doesn\u2019t show here is the trust store that contains the list of CA certificates trusted by the system OpenSSL runs on. The public certificate of GlobalSign Authority must be present in the system\u2019s trust store to close the verification chain. This is called a chain of trust, and the figure below summarizes its behaviour at a high level. High-level view of the concept of chain of trust applied to verifying the authenticity of a website. The Root CA in the Firefox trust store provides the initial trust to verify the entire chain and trust the end-entity certificate.","title":"Certificate Chain"},{"location":"security/fundamentals/#tls-handshake","text":"The client sends a HELLO message to the server with a list of protocols and algorithms it supports. The server says HELLO back and sends its chain of certificates. Based on the capabilities of the client, the server picks a cipher suite. If the cipher suite supports ephemeral key exchange, like ECDHE does(ECDHE is an algorithm known as the Elliptic Curve Diffie-Hellman Exchange), the server and the client negotiate a pre-master key with the Diffie-Hellman algorithm. The pre-master key is never sent over the wire. The client and server create a session key that will be used to encrypt the data transiting through the connection. At the end of the handshake, both parties possess a secret session key used to encrypt data for the rest of the connection. This is what OpenSSL refers to as Master-Key NOTE There are 3 versions of TLS , TLS 1.0, 1.1 & 1.2 TLS 1.0 was released in 1999, making it a nearly two-decade-old protocol. It has been known to be vulnerable to attacks\u2014such as BEAST and POODLE\u2014for years, in addition to supporting weak cryptography, which doesn\u2019t keep modern-day connections sufficiently secure. TLS 1.1 is the forgotten \u201cmiddle child.\u201d It also has bad cryptography like its younger sibling. In most software, it was leapfrogged by TLS 1.2 and it\u2019s rare to see TLS 1.1 used.","title":"TLS Handshake"},{"location":"security/fundamentals/#perfect-forward-secrecy","text":"The term \u201cephemeral\u201d in the key exchange provides an important security feature mis-named perfect forward secrecy (PFS) or just \u201cForward Secrecy\u201d. In a non-ephemeral key exchange, the client sends the pre-master key to the server by encrypting it with the server\u2019s public key. The server then decrypts the pre-master key with its private key. If at a later point in time, the private key of the server is compromised, an attacker can go back to this handshake, decrypt the pre-master key, obtain the session key, and decrypt the entire traffic. Non-ephemeral key exchanges are vulnerable to attacks that may happen in the future on recorded traffic. And because people seldom change their password, decrypting data from the past may still be valuable for an attacker. An ephemeral key exchange like DHE, or its variant on elliptic curve, ECDHE, solves this problem by not transmitting the pre-master key over the wire. Instead, the pre-master key is computed by both the client and the server in isolation, using nonsensitive information exchanged publicly. Because the pre-master key can\u2019t be decrypted later by an attacker, the session key is safe from future attacks: hence, the term perfect forward secrecy. Keys are changed every X blocks along the stream. That prevents an attacker from simply sniffing the stream and applying brute force to crack the whole thing. \"Forward secrecy\" means that just because I can decrypt block M, does not mean that I can decrypt block Q Downside: The downside to PFS is that all those extra computational steps induce latency on the handshake and slow the user down. To avoid repeating this expensive work at every connection, both sides cache the session key for future use via a technique called session resumption. This is what the session-ID and TLS ticket are for: they allow a client and server that share a session ID to skip over the negotiation of a session key, because they already agreed on one previously, and go directly to exchanging data securely.","title":"\u201cPerfect\u201d Forward Secrecy"},{"location":"security/intro/","text":"Security Prerequisites Linux Basics Linux Networking What to expect from this course The course covers fundamentals of information security along with touching on subjects of system security, network & web security. This course aims to get you familiar with the basics of information security in day to day operations & then as an SRE develop the mindset of ensuring that security takes a front-seat while developing solutions. The course also serves as an introduction to common risks and best practices along with practical ways to find out vulnerable systems and loopholes which might become compromised if not secured. What is not covered under this course The courseware is not an ethical hacking workshop or a very deep dive into the fundamentals of the problems. The course does not deal with hacking or breaking into systems but rather an approach on how to ensure you don\u2019t get into those situations and also to make you aware of different ways a system can be compromised. Course Contents Fundamentals Network Security Threats, Attacks & Defence Writing Secure Code & More Conclusion","title":"Introduction"},{"location":"security/intro/#security","text":"","title":"Security"},{"location":"security/intro/#prerequisites","text":"Linux Basics Linux Networking","title":"Prerequisites"},{"location":"security/intro/#what-to-expect-from-this-course","text":"The course covers fundamentals of information security along with touching on subjects of system security, network & web security. This course aims to get you familiar with the basics of information security in day to day operations & then as an SRE develop the mindset of ensuring that security takes a front-seat while developing solutions. The course also serves as an introduction to common risks and best practices along with practical ways to find out vulnerable systems and loopholes which might become compromised if not secured.","title":"What to expect from this course"},{"location":"security/intro/#what-is-not-covered-under-this-course","text":"The courseware is not an ethical hacking workshop or a very deep dive into the fundamentals of the problems. The course does not deal with hacking or breaking into systems but rather an approach on how to ensure you don\u2019t get into those situations and also to make you aware of different ways a system can be compromised.","title":"What is not covered under this course"},{"location":"security/intro/#course-contents","text":"Fundamentals Network Security Threats, Attacks & Defence Writing Secure Code & More Conclusion","title":"Course Contents"},{"location":"security/network_security/","text":"Part II: Network Security Introduction TCP/IP is the dominant networking technology today. It is a five-layer architecture. These layers are, from top to bottom, the application layer, the transport layer (TCP), the network layer (IP), the data-link layer, and the physical layer. In addition to TCP/IP, there also are other networking technologies. For convenience, we use the OSI network model to represent non-TCP/IP network technologies. Different networks are interconnected using gateways. A gateway can be placed at any layer. The OSI model is a seven-layer architecture. The OSI architecture is similar to the TCP/IP architecture, except that the OSI model specifies two additional layers between the application layer and the transport layer in the TCP/IP architecture. These two layers are the presentation layer and the session layer. Figure 5.1 shows the relationship between the TCP/IP layers and the OSI layers. The application layer in TCP/IP corresponds to the application layer and the presentation layer in OSI. The transport layer in TCP/IP corresponds to the session layer and the transport layer in OSI. The remaining three layers in the TCP/IP architecture are one-to-one correspondent to the remaining three layers in the OSI model. Correspondence between layers of the TCP/IP architecture and the OSI model. Also shown are placements of cryptographic algorithms in network layers, where the dotted arrows indicate actual communications of cryptographic algorithms The functionalities of OSI layers are briefly described as follows: The application layer serves as an interface between applications and network programs. It supports application programs and end-user processing. Common application-layer programs include remote logins, file transfer, email, and Web browsing. The presentation layer is responsible for dealing with data that is formed differently. This protocol layer allows application-layer programs residing on different sides of a communication channel with different platforms to understand each other's data formats regardless of how they are presented. The session layer is responsible for creating, managing, and closing a communication connection. The transport layer is responsible for providing reliable connections, such as packet sequencing, traffic control, and congestion control. The network layer is responsible for routing device-independent data packets from the current hop to the next hop. The data-link layer is responsible for encapsulating device-independent data packets into device-dependent data frames. It has two sublayers: logical link control and media access control. The physical layer is responsible for transmitting device-dependent frames through some physical media. Starting from the application layer, data generated from an application program is passed down layer-by-layer to the physical layer. Data from the previous layer is enclosed in a new envelope at the current layer, where the data from the previous layer is also just an envelope containing the data from the layer before it. This is similar to enclosing a smaller envelope in a larger one. The envelope added at each layer contains sufficient information for handling the packet. Application-layer data are divided into blocks small enough to be encapsulated in an envelope at the next layer. Application data blocks are \u201cdressed up\u201d in the TCP/IP architecture according to the following basic steps. At the sending side, an application data block is encapsulated in a TCP packet when it is passed down to the TCP layer. In other words, a TCP packet consists of a header and a payload, where the header corresponds to the TCP envelope and the payload is the application data block. Likewise, the TCP packet will be encapsulated in an IP packet when it is passed down to the IP layer. An IP packet consists of a header and a payload, which is the TCP packet passed down from the TCP layer. The IP packet will be encapsulated in a device-dependent frame (e.g., an Ethernet frame) when it is passed down to the data-link layer. A frame has a header, and it may also have a trailer. For example, in addition to having a header, an Ethernet frame also has a 32-bit cyclic redundancy check (CRC) trailer. When it is passed down to the physical layer, a frame will be transformed into a sequence of media signals for transmission Flow Diagram of a Packet Generation At the destination side, the medium signals are converted by the physical layer into a frame, which is passed up to the data-link layer. The data-link layer passes the frame payload (i.e., the IP packet encapsulated in the frame) up to the IP layer. The IP layer passes the IP payload, namely, the TCP packet encapsulated in the IP packet, up to the TCP layer. The TCP layer passes the TCP payload, namely, the application data block, up to the application layer. When a packet arrives at a router, it only goes up to the IP layer, where certain fields in the IP header are modified (e.g., the value of TTL is decreased by 1). This modified packet is then passed back down layer-by-layer to the physical layer for further transmission. Public Key Infrastructure To deploy cryptographic algorithms in network applications, we need a way to distribute secret keys using open networks. Public-key cryptography is the best way to distribute these secret keys. To use public-key cryptography, we need to build a public-key infrastructure (PKI) to support and manage public-key certificates and certificate authority (CA) networks. In particular, PKIs are set up to perform the following functions: Determine the legitimacy of users before issuing public-key certificates to them. Issue public-key certificates upon user requests. Extend public-key certificates valid time upon user requests. Revoke public-key certificates upon users' requests or when the corresponding private keys are compromised. Store and manage public-key certificates. Prevent digital signature signers from denying their signatures. Support CA networks to allow different CAs to authenticate public-key certificates issued by other CAs. X.509: https://certificatedecoder.dev/?gclid=EAIaIQobChMI0M731O6G6gIVVSQrCh04bQaAEAAYASAAEgKRkPD_BwE IPsec: A Security Protocol at the Network Layer IPsec is a major security protocol at the network layer IPsec provides a potent platform for constructing virtual private networks (VPN). VPNs are private networks overlayed on public networks. The purpose of deploying cryptographic algorithms at the network layer is to encrypt or authenticate IP packets (either just the payloads or the whole packets). IPsec also specifies how to exchange keys. Thus, IPsec consists of authentication protocols, encryption protocols, and key exchange protocols. They are referred to, respectively, as authentication header (AH), encapsulating security payload (ESP), and Internet key exchange (IKE). PGP & S/MIME : Email Security There are several security protocols at the application layer. The most used of these protocols are email security protocols namely PGP and S/MIME. SMTP (\u201cSimple Mail Transfer Protocol\u201d) is used for sending and delivering from a client to a server via port 25: it\u2019s the outgoing server. On the contrary, POP (\u201cPost Office Protocol\u201d) allows the user to pick up the message and download it into his inbox: it\u2019s the incoming server. The latest version of the Post Office Protocol is named POP3, and it\u2019s been used since 1996; it uses port 110 PGP PGP implements all major cryptographic algorithms, the ZIP compression algorithm, and the Base64 encoding algorithm. It can be used to authenticate a message, encrypt a message, or both. PGP follows the following general process: authentication, ZIP compression, encryption, and Base64 encoding. The Base64 encoding procedure makes the message ready for SMTP transmission GPG (GnuPG) GnuPG is another free encryption standard that companies may use that is based on OpenPGP. GnuPG serves as a replacement for Symantec\u2019s PGP. The main difference is the supported algorithms. However, GnuPG plays nice with PGP by design. Because GnuPG is open, some businesses would prefer the technical support and the user interface that comes with Symantec\u2019s PGP. It is important to note that there are some nuances between the compatibility of GnuPG and PGP, such as the compatibility between certain algorithms, but in most applications such as email, there are workarounds. One such algorithm is the IDEA Module which isn\u2019t included in GnuPG out of the box due to patent issues. S/MIME SMTP can only handle 7-bit ASCII text (You can use UTF-8 extensions to alleviate these limitations, ) messages. While POP can handle other content types besides 7-bit ASCII, POP may, under a common default setting, download all the messages stored in the mail server to the user's local computer. After that, if POP removes these messages from the mail server. This makes it difficult for the user to read his messages from multiple computers. The Multipurpose Internet Mail Extension protocol (MIME) was designed to support sending and receiving email messages in various formats, including nontext files generated by word processors, graphics files, sound files, and video clips. Moreover, MIME allows a single message to include mixed types of data in any combination of these formats. The Internet Mail Access Protocol (IMAP), operated on TCP port 143(only for non-encrypted), stores (Configurable on both server & client just like PoP) incoming email messages in the mail server until the user deletes them deliberately. This allows the user to access his mailbox from multiple machines and download messages to a local machine without deleting it from the mailbox in the mail server. SSL/TLS SSL uses a PKI to decide if a server\u2019s public key is trustworthy by requiring servers to use a security certificate signed by a trusted CA. When Netscape Navigator 1.0 was released, it trusted a single CA operated by the RSA Data Security corporation. The server\u2019s public RSA keys were used to be stored in the security certificate, which can then be used by the browser to establish a secure communication channel. The security certificates we use today still rely on the same standard (named X.509) that Netscape Navigator 1.0 used back then. Netscape intended to train users(though this didn\u2019t work out later) to differentiate secure communications from insecure ones, so they put a lock icon next to the address bar. When the lock is open, the communication is insecure. A closed lock means communication has been secured with SSL, which required the server to provide a signed certificate. You\u2019re obviously familiar with this icon as it\u2019s been in every browser ever since. The engineers at Netscape truly created a standard for secure internet communications. A year after releasing SSL 2.0, Netscape fixed several security issues and released SSL 3.0, a protocol that, albeit being officially deprecated since June 2015, remains in use in certain parts of the world more than 20 years after its introduction. To standardize SSL, the Internet Engineering Task Force (IETF) created a slightly modified SSL 3.0 and, in 1999, unveiled it as Transport Layer Security (TLS) 1.0. The name change between SSL and TLS continues to confuse people today. Officially, TLS is the new SSL, but in practice, people use SSL and TLS interchangeably to talk about any version of the protocol. Must See: https://tls.ulfheim.net/ https://davidwong.fr/tls13/ Network Perimeter Security Let us see how we keep a check on the perimeter i.e the edges, the first layer of protection General Firewall Framework Firewalls are needed because encryption algorithms cannot effectively stop malicious packets from getting into an edge network. This is because IP packets, regardless of whether they are encrypted, can always be forwarded into an edge network. Firewalls that were developed in the 1990s are important instruments to help restrict network access. A firewall may be a hardware device, a software package, or a combination of both. Packets flowing into the internal network from the outside should be evaluated before they are allowed to enter. One of the critical elements of a firewall is its ability to examine packets without imposing a negative impact on communication speed while providing security protections for the internal network. The packet inspection that is carried out by firewalls can be done using several different methods. Based on the particular method used by the firewall, it can be characterized as either a packet filter, circuit gateway, application gateway, or dynamic packet filter. Packet Filters It inspects ingress packets coming to an internal network from outside and inspects egress packets going outside from an internal network Packing filtering only inspects IP headers and TCP headers, not the payloads generated at the application layer A packet-filtering firewall uses a set of rules to determine whether a packet should be allowed or denied to pass through. 2 types: Stateless It treats each packet as an independent object, and it does not keep track of any previously processed packets. In other words, stateless filtering inspects a packet when it arrives and makes a decision without leaving any record of the packet being inspected. Stateful Stateful filtering, also referred to as connection-state filtering, keeps track of connections between an internal host and an external host. A connection state (or state, for short) indicates whether it is a TCP connection or a UDP connection and whether the connection is established. Circuit Gateways Circuit gateways, also referred to as circuit-level gateways, are typically operated at the transportation layer They evaluate the information of the IP addresses and the port numbers contained in TCP (or UDP) headers and use it to determine whether to allow or to disallow an internal host and an external host to establish a connection. It is common practice to combine packet filters and circuit gateways to form a dynamic packet filter (DPF). Application Gateways(ALG) Aka PROXY Servers An Application Level Gateway (ALG) acts as a proxy for internal hosts, processing service requests from external clients. An ALG performs deep inspections on each IP packet (ingress or egress). In particular, an ALG inspects application program formats contained in the packet (e.g., MIME format or SQL format) and examines whether its payload is permitted. Thus, an ALG may be able to detect a computer virus contained in the payload. Because an ALG inspects packet payloads, it may be able to detect malicious code and quarantine suspicious packets, in addition to blocking packets with suspicious IP addresses and TCP ports. On the other hand, an ALG also incurs substantial computation and space overheads. Trusted Systems & Bastion Hosts A Trusted Operating System (TOS) is an operating system that meets a particular set of security requirements. Whether an operating system can be trusted or not depends on several elements. For example, for an operating system on a particular computer to be certified trusted, one needs to validate that, among other things, the following four requirements are satisfied: Its system design contains no defects; Its system software contains no loopholes; Its system is configured properly; and Its system management is appropriate. Bastion Hosts Bastion hosts are computers with strong defence mechanisms. They often serve as host computers for implementing application gateways, circuit gateways, and other types of firewalls. A bastion host is operated on a trusted operating system that must not contain unnecessary functionalities or programs. This measure helps to reduce error probabilities and makes it easier to conduct security checks. Only those network application programs that are necessary, for example, SSH, DNS, SMTP, and authentication programs, are installed on a bastion host. Bastion hosts are also primarily used as controlled ingress points so that the security monitoring can focus more narrowly on actions happening at a single point closely. Common Techniques & Scannings, Packet Capturing Scanning Ports with Nmap Nmap (\"Network Mapper\") is a free and open-source (license) utility for network discovery and security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. The best thing about Nmap is it\u2019s free and open-source and is very flexible and versatile Nmap is often used to determine alive hosts in a network, open ports on those hosts, services running on those open ports, and version identification of that service on that port. More at http://scanme.nmap.org/ nmap [scan type] [options] [target specification] Nmap uses 6 different port states: Open \u2014 An open port is one that is actively accepting TCP, UDP or SCTP connections. Open ports are what interests us the most because they are the ones that are vulnerable to attacks. Open ports also show the available services on a network. Closed \u2014 A port that receives and responds to Nmap probe packets but there is no application listening on that port. Useful for identifying that the host exists and for OS detection. Filtered \u2014 Nmap can\u2019t determine whether the port is open because packet filtering prevents its probes from reaching the port. Filtering could come from firewalls or router rules. Often little information is given from filtered ports during scans as the filters can drop the probes without responding or respond with useless error messages e.g. destination unreachable. Unfiltered \u2014 Port is accessible but Nmap doesn\u2019t know if it is open or closed. Only used in ACK scan which is used to map firewall rulesets. Other scan types can be used to identify whether the port is open. Open/filtered \u2014 Nmap is unable to determine between open and filtered. This happens when an open port gives no response. No response could mean that the probe was dropped by a packet filter or any response is blocked. Closed/filtered \u2014 Nmap is unable to determine whether a port is closed or filtered. Only used in the IP ID idle scan. Types of Nmap Scan: TCP Connect TCP Connect scan completes the 3-way handshake. If a port is open, the operating system completes the TCP three-way handshake and the port scanner immediately closes the connection to avoid DOS. This is \u201cnoisy\u201d because the services can log the sender IP address and might trigger Intrusion Detection Systems. UDP Scan This scan checks to see if any UDP ports are listening. Since UDP does not respond with a positive acknowledgement like TCP and only responds to an incoming UDP packet when the port is closed, SYN Scan SYN scan is another form of TCP scanning. This scan type is also known as \u201chalf-open scanning\u201d because it never actually opens a full TCP connection. The port scanner generates a SYN packet. If the target port is open, it will respond with an SYN-ACK packet. The scanner host responds with an RST packet, closing the connection before the handshake is completed. If the port is closed but unfiltered, the target will instantly respond with an RST packet. SYN scan has the advantage that the individual services never actually receive a connection. FIN Scan This is a stealthy scan, like the SYN scan, but sends a TCP FIN packet instead. ACK Scan Ack scanning determines whether the port is filtered or not. Null Scan Another very stealthy scan that sets all the TCP header flags to off or null. This is not normally a valid packet and some hosts will not know what to do with this. XMAS Scan Similar to the NULL scan except for all the flags in the TCP header is set to on RPC Scan This special type of scan looks for machine answering to RPC (Remote Procedure Call) services IDLE Scan It is a super stealthy method whereby the scan packets are bounced off an external host. You don\u2019t need to have control over the other host but it does have to set up and meet certain requirements. You must input the IP address of our \u201czombie\u201d host and what port number to use. It is one of the more controversial options in Nmap since it only has a use for malicious attacks. Scan Techniques A couple of scan techniques which can be used to gain more information about a system and its ports. You can read more at https://medium.com/infosec-adventures/nmap-cheatsheet-a423fcdda0ca OpenVAS OpenVAS is a full-featured vulnerability scanner. OpenVAS is a framework of services and tools that provides a comprehensive and powerful vulnerability scanning and management package OpenVAS, which is an open-source program, began as a fork of the once-more-popular scanning program, Nessus. OpenVAS is made up of three main parts. These are: a regularly updated feed of Network Vulnerability Tests (NVTs); a scanner, which runs the NVTs; and an SQLite 3 database for storing both your test configurations and the NVTs\u2019 results and configurations. https://www.greenbone.net/en/install_use_gce/ WireShark Wireshark is a protocol analyzer. This means Wireshark is designed to decode not only packet bits and bytes but also the relations between packets and protocols. Wireshark understands protocol sequences. A simple demo of Wireshark Capture only udp packets: Capture filter = \u201cudp\u201d Capture only tcp packets Capture filter = \u201ctcp\u201d TCP/IP 3 way Handshake Filter by IP address: displays all traffic from IP, be it source or destination ip.addr == 192.168.1.1 Filter by source address: display traffic only from IP source ip.src == 192.168.0.1 Filter by destination: display traffic only form IP destination ip.dst == 192.168.0.1 Filter by IP subnet: display traffic from subnet, be it source or destination ip.addr = 192.168.0.1/24 Filter by protocol: filter traffic by protocol name dns http ftp arp ssh telnet icmp Exclude IP address: remove traffic from and to IP address !ip.addr ==192.168.0.1 Display traffic between two specific subnet ip.addr == 192.168.0.1/24 and ip.addr == 192.168.1.1/24 Display traffic between two specific workstations ip.addr == 192.168.0.1 and ip.addr == 192.168.0.2 Filter by MAC eth.addr = 00:50:7f:c5:b6:78 Filter TCP port tcp.port == 80 Filter TCP port source tcp.srcport == 80 Filter TCP port destination tcp.dstport == 80 Find user agents http.user_agent contains Firefox !http.user_agent contains || !http.user_agent contains Chrome Filter broadcast traffic !(arp or icmp or dns) Filter IP address and port tcp.port == 80 && ip.addr == 192.168.0.1 Filter all http get requests http.request Filter all http get requests and responses http.request or http.response Filter three way handshake tcp.flags.syn==1 or (tcp.seq==1 and tcp.ack==1 and tcp.len==0 and tcp.analysis.initial_rtt) Find files by type frame contains \u201c(attachment|tar|exe|zip|pdf)\u201d Find traffic based on keyword tcp contains facebook frame contains facebook Detecting SYN Floods tcp.flags.syn == 1 and tcp.flags.ack == 0 Wireshark Promiscuous Mode - By default, Wireshark only captures packets going to and from the computer where it runs. By checking the box to run Wireshark in Promiscuous Mode in the Capture Settings, you can capture most of the traffic on the LAN. DumpCap Dumpcap is a network traffic dump tool. It captures packet data from a live network and writes the packets to a file. Dumpcap\u2019s native capture file format is pcapng, which is also the format used by Wireshark. By default, Dumpcap uses the pcap library to capture traffic from the first available network interface and writes the received raw packet data, along with the packets\u2019 time stamps into a pcapng file. The capture filter syntax follows the rules of the pcap library. The Wireshark command-line utility called 'dumpcap.exe' can be used to capture LAN traffic over an extended period of time. Wireshark itself can also be used, but dumpcap does not significantly utilize the computer's memory while capturing for long periods. DaemonLogger Daemonlogger is a packet logging application designed specifically for use in Network and Systems Management (NSM) environments. The biggest benefit Daemonlogger provides is that, like Dumpcap, it is simple to use for capturing packets. In order to begin capturing, you need only to invoke the command and specify an interface. daemonlogger \u2013i eth1 This option, by default, will begin capturing packets and logging them to the current working directory. Packets will be collected until the capture file size reaches 2 GB, and then a new file will be created. This will continue indefinitely until the process is halted. NetSniff-NG Netsniff-NG is a high-performance packet capture utility While the utilities we\u2019ve discussed to this point rely on Libpcap for capture, Netsniff-NG utilizes zero-copy mechanisms to capture packets. This is done with the intent to support full packet capture over high throughput links. To begin capturing packets with Netsniff-NG, we have to specify an input and output. In most cases, the input will be a network interface, and the output will be a file or folder on disk. netsniff-ng \u2013i eth1 \u2013o data.pcap Netflow NetFlow is a feature that was introduced on Cisco routers around 1996 that provides the ability to collect IP network traffic as it enters or exits an interface. By analyzing the data provided by NetFlow, a network administrator can determine things such as the source and destination of traffic, class of service, and the causes of congestion. A typical flow monitoring setup (using NetFlow) consists of three main components:[1] Flow exporter: aggregates packets into flows and exports flow records towards one or more flow collectors. Flow collector: responsible for reception, storage and pre-processing of flow data received from a flow exporter. Analysis application: analyzes received flow data in the context of intrusion detection or traffic profiling, for example. Routers and switches that support NetFlow can collect IP traffic statistics on all interfaces where NetFlow is enabled, and later export those statistics as NetFlow records toward at least one NetFlow collector\u2014typically a server that does the actual traffic analysis. IDS A security solution that detects security-related events in your environment but does not block them. IDS sensors can be software and hardware-based used to collect and analyze the network traffic. These sensors are available in two varieties, network IDS and host IDS. A host IDS is a server-specific agent running on a server with a minimum of overhead to monitor the operating system. A network IDS can be embedded in a networking device, a standalone appliance, or a module monitoring the network traffic. Signature Based IDS The signature-based IDS monitors the network traffic or observes the system and sends an alarm if a known malicious event is happening. It does so by comparing the data flow against a database of known attack patterns These signatures explicitly define what traffic or activity should be considered as malicious. Signature-based detection has been the bread and butter of network-based defensive security for over a decade, partially because it is very similar to how malicious activity is detected at the host level with antivirus utilities The formula is fairly simple: an analyst observes a malicious activity, derives indicators from the activity and develops them into signatures, and then those signatures will alert whenever the activity occurs again. ex: SNORT & SURICATA Policy-Based IDS The policy-based IDSs (mainly host IDSs) trigger an alarm whenever a violation occurs against the configured policy. This configured policy is or should be a representation of the security policies. This type of IDS is flexible and can be customized to a company's network requirements because it knows exactly what is permitted and what is not. On the other hand, the signature-based systems rely on vendor specifics and default settings. Anomaly Based IDS The anomaly-based IDS looks for traffic that deviates from the normal, but the definition of what is a normal network traffic pattern is the tricky part Two types of anomaly-based IDS exist: statistical and nonstatistical anomaly detection Statistical anomaly detection learns the traffic patterns interactively over a period of time. In the nonstatistical approach, the IDS has a predefined configuration of the supposedly acceptable and valid traffic patterns. Host-Based IDS & Network-Based IDS A host IDS can be described as a distributed agent residing on each server of the network that needs protection. These distributed agents are tied very closely to the underlying operating system. Network IDSs, on the other hand, can be described as intelligent sniffing devices. Data (raw packets) is captured from the network by a network IDS, whereas host IDSs capture the data from the host on which they are installed. Honeypots The use of decoy machines to direct intruders' attention away from the machines under protection is a major technique to preclude intrusion attacks. Any device, system, directory, or file used as a decoy to lure attackers away from important assets and to collect intrusion or abusive behaviours is referred to as a honeypot. A honeypot may be implemented as a physical device or as an emulation system. The idea is to set up decoy machines in a LAN, or decoy directories/files in a file system and make them appear important, but with several exploitable loopholes, to lure attackers to attack these machines or directories/files, so that other machines, directories, and files can evade intruders' attentions. A decoy machine may be a host computer or a server computer. Likewise, we may also set up decoy routers or even decoy LANs. Chinks In The Armour (TCP/IP Security Issues) IP Spoofing In this type of attack, the attacker replaces the IP address of the sender, or in some rare cases the destination, with a different address. IP spoofing is normally used to exploit a target host. In other cases, it is used to start a denial-of-service (DoS) attack. In a DoS attack, an attacker modifies the IP packet to mislead the target host into accepting the original packet as a packet sourced at a trusted host. The attacker must know the IP address of the trusted host to modify the packet headers (source IP address) so that it appears that the packets are coming from that host. IP Spoofing Detection Techniques Direct TTL Probes In this technique we send a packet to a host of suspect spoofed IP that triggers reply and compares TTL with suspect packet; if the TTL in the reply is not the same as the packet being checked; it is a spoofed packet. This Technique is successful when the attacker is in a different subnet from the victim. IP Identification Number. Send a probe to the host of suspect spoofed traffic that triggers a reply and compares IP ID with suspect traffic. If IP IDs are not in the near value of packet being checked, suspect traffic is spoofed TCP Flow Control Method Attackers sending spoofed TCP packets will not receive the target\u2019s SYN-ACK packets. Attackers cannot, therefore, be responsive to change in the congestion window size When the receiver still receives traffic even after a windows size is exhausted, most probably the packets are spoofed. Covert Channel A covert or clandestine channel can be best described as a pipe or communication channel between two entities that can be exploited by a process or application transferring information in a manner that violates the system's security specifications. More specifically for TCP/IP, in some instances, covert channels are established, and data can be secretly passed between two end systems. Ex: ICMP resides at the Internet layer of the TCP/IP protocol suite and is implemented in all TCP/IP hosts. Based on the specifications of the ICMP Protocol, an ICMP Echo Request message should have an 8-byte header and a 56-byte payload. The ICMP Echo Request packet should not carry any data in the payload. However, these packets are often used to carry secret information. The ICMP packets are altered slightly to carry secret data in the payload. This makes the size of the packet larger, but no control exists in the protocol stack to defeat this behaviour. The alteration of ICMP packets allows intruders to program specialized client-server pairs. These small pieces of code export confidential information without alerting the network administrator. ICMP can be leveraged for more than data exfiltration. For eg. some C&C tools such as Loki used ICMP channel to establish encrypted interactive session back in 1996. Deep packet inspection has since come a long way. A lot of IDS/IPS detect ICMP tunnelling. Check for echo responses that do not contain the same payload as request Check for the volume of ICMP traffic especially for volumes beyond an acceptable threshold IP Fragmentation Attack The TCP/IP protocol suite, or more specifically IP, allows the fragmentation of packets.(this is a feature & not a bug) IP fragmentation offset is used to keep track of the different parts of a datagram. The information or content in this field is used at the destination to reassemble the datagrams All such fragments have the same Identification field value, and the fragmentation offset indicates the position of the current fragment in the context of the original packet. Many access routers and firewalls do not perform packet reassembly. In normal operation, IP fragments do not overlap, but attackers can create artificially fragmented packets to mislead the routers or firewalls. Usually, these packets are small and almost impractical for end systems because of data and computational overhead. A good example of an IP fragmentation attack is the Ping of Death attack. The Ping of Death attack sends fragments that, when reassembled at the end station, create a larger packet than the maximum permissible length. TCP Flags Data exchange using TCP does not happen until a three-way handshake has been completed. This handshake uses different flags to influence the way TCP segments are processed. There are 6 bits in the TCP header that are often called flags. Namely: 6 different flags are part of the TCP header: Urgent pointer field (URG), Acknowledgment field (ACK), Push function (PSH), Reset the connection (RST), Synchronize sequence numbers (SYN), and the sender is finished with this connection (FIN). Abuse of the normal operation or settings of these flags can be used by attackers to launch DoS attacks. This causes network servers or web servers to crash or hang. | SYN | FIN | PSH | RST | Validity| |------|------|-------|------|---------| | 1 |1 |0 |0 |Illegal Combination | 1 |1 |1 |0 |Illegal Combination | 1 |1 |0 |1 |Illegal Combination | 1 |1 |1 |1 |Illegal Combination The attacker's ultimate goal is to write special programs or pieces of code that can construct these illegal combinations resulting in an efficient DoS attack. SYN FLOOD The timers (or lack of certain timers) in 3 way handshake are often used and exploited by attackers to disable services or even to enter systems. After step 2 of the three-way handshake, no limit is set on the time to wait after receiving a SYN. The attacker initiates many connection requests to the webserver of Company XYZ (almost certainly with a spoofed IP address). The SYN+ACK packets (Step 2) sent by the web server back to the originating source IP address are not replied to. This leaves a TCP session half-open on the webserver. Multiple packets cause multiple TCP sessions to stay open. Based on the hardware limitations of the server, a limited number of TCP sessions can stay open, and as a result, the webserver refuses further connection establishments attempts from any host as soon as a certain limit is reached. These half-open connections need to be completed or timed out before new connections can be established. FIN Attack In normal operation, the sender sets the TCP FIN flag indicating that no more data will be transmitted and the connection can be closed down. This is a four-way handshake mechanism, with both sender and receiver expected to send an acknowledgement on a received FIN packet. During an attack that is trying to kill connections, a spoofed FIN packet is constructed. This packet also has the correct sequence number, so the packets are seen as valid by the targeted host. These sequence numbers are easy to predict. This process is referred to as TCP sequence number prediction, whereby the attacker either sniffs the current Sequence and Acknowledgment (SEQ/ACK) numbers of the connection or can algorithmically predict these numbers. Connection Hijacking An authorized user (Employee X) sends HTTP requests over a TCP session with the webserver. The web server accepts the packets from Employee X only when the packet has the correct SEQ/ACK numbers. As seen previously, these numbers are important for the webserver to distinguish between different sessions and to make sure it is still talking to Employee X. Imagine that the cracker starts sending packets to the web server spoofing the IP address of Employee X, using the correct SEQ/ACK combination. The web server accepts the packet and increments the ACK number. In the meantime, Employee X continues to send packets but with incorrect SEQ/ACK numbers. As a result of sending unsynchronized packets, all data from Employee X is discarded when received by the webserver. The attacker pretends to be Employee X using the correct numbers. This finally results in the cracker hijacking the connection, whereby Employee X is completely confused and the webserver replies assuming the cracker is sending correct synchronized data. STEPS: The attacker examines the traffic flows with a network monitor and notices traffic from Employee X to a web server. The web server returns or echoes data back to the origination station (Employee X). Employee X acknowledges the packet. The cracker launches a spoofed packet to the server. The web server responds to the cracker. The cracker starts verifying SEQ/ACK numbers to double-check success. At this time, the cracker takes over the session from Employee X, which results in a session hanging for Employee X. The cracker can start sending traffic to the webserver. The web server returns the requested data to confirm delivery with the correct ACK number. The cracker can continue to send data (keeping track of the correct SEQ/ACK numbers) until eventually setting the FIN flag to terminate the session. Buffer Overflow A buffer is a temporary data storage area used to store program code and data. When a program or process tries to store more data in a buffer than it was originally anticipated to hold, a buffer overflow occurs. Buffers are temporary storage locations in memory (memory or buffer sizes are often measured in bytes) that can store a fixed amount of data in bytes. When more data is retrieved than can be stored in a buffer location, the additional information must go into an adjacent buffer, resulting in overwriting the valid data held in them. Mechanism: Buffer overflow vulnerabilities exist in different types. But the overall goal for all buffer overflow attacks is to take over the control of a privileged program and, if possible, the host. The attacker has two tasks to achieve this goal. First, the dirty code needs to be available in the program's code address space. Second, the privileged program should jump to that particular part of the code, which ensures that the proper parameters are loaded into memory. The first task can be achieved in two ways: by injecting the code in the right address space or by using the existing code and modifying certain parameters slightly. The second task is a little more complex because the program's control flow needs to be modified to make the program jump to the dirty code. CounterMeasure: The most important approach is to have a concerted focus on writing correct code. A second method is to make the data buffers (memory locations) address space of the program code non-executable. This type of address space makes it impossible to execute code, which might be infiltrated in the program's buffers during an attack. More Spoofing Address Resolution Protocol Spoofing The Address Resolution Protocol (ARP) provides a mechanism to resolve, or map, a known IP address to a MAC sublayer address. Using ARP spoofing, the cracker can exploit this hardware address authentication mechanism by spoofing the hardware address of Host B. Basically, the attacker can convince any host or network device on the local network that the cracker's workstation is the host to be trusted. This is a common method used in a switched environment. ARP spoofing can be prevented with the implementation of static ARP tables in all the hosts and routers of your network. Alternatively, you can implement an ARP server that responds to ARP requests on behalf of the target host. DNS Spoofing DNS spoofing is the method whereby the hacker convinces the target machine that the system it wants to connect to is the machine of the cracker. The cracker modifies some records so that name entries of hosts correspond to the attacker's IP address. There have been instances in which the complete DNS server was compromised by an attack. To counter DNS spoofing, the reverse lookup detects these attacks. The reverse lookup is a mechanism to verify the IP address against a name. The IP address and name files are usually kept on different servers to make compromise much more difficult","title":"Network Security"},{"location":"security/network_security/#part-ii-network-security","text":"","title":"Part II: Network Security"},{"location":"security/network_security/#introduction","text":"TCP/IP is the dominant networking technology today. It is a five-layer architecture. These layers are, from top to bottom, the application layer, the transport layer (TCP), the network layer (IP), the data-link layer, and the physical layer. In addition to TCP/IP, there also are other networking technologies. For convenience, we use the OSI network model to represent non-TCP/IP network technologies. Different networks are interconnected using gateways. A gateway can be placed at any layer. The OSI model is a seven-layer architecture. The OSI architecture is similar to the TCP/IP architecture, except that the OSI model specifies two additional layers between the application layer and the transport layer in the TCP/IP architecture. These two layers are the presentation layer and the session layer. Figure 5.1 shows the relationship between the TCP/IP layers and the OSI layers. The application layer in TCP/IP corresponds to the application layer and the presentation layer in OSI. The transport layer in TCP/IP corresponds to the session layer and the transport layer in OSI. The remaining three layers in the TCP/IP architecture are one-to-one correspondent to the remaining three layers in the OSI model. Correspondence between layers of the TCP/IP architecture and the OSI model. Also shown are placements of cryptographic algorithms in network layers, where the dotted arrows indicate actual communications of cryptographic algorithms The functionalities of OSI layers are briefly described as follows: The application layer serves as an interface between applications and network programs. It supports application programs and end-user processing. Common application-layer programs include remote logins, file transfer, email, and Web browsing. The presentation layer is responsible for dealing with data that is formed differently. This protocol layer allows application-layer programs residing on different sides of a communication channel with different platforms to understand each other's data formats regardless of how they are presented. The session layer is responsible for creating, managing, and closing a communication connection. The transport layer is responsible for providing reliable connections, such as packet sequencing, traffic control, and congestion control. The network layer is responsible for routing device-independent data packets from the current hop to the next hop. The data-link layer is responsible for encapsulating device-independent data packets into device-dependent data frames. It has two sublayers: logical link control and media access control. The physical layer is responsible for transmitting device-dependent frames through some physical media. Starting from the application layer, data generated from an application program is passed down layer-by-layer to the physical layer. Data from the previous layer is enclosed in a new envelope at the current layer, where the data from the previous layer is also just an envelope containing the data from the layer before it. This is similar to enclosing a smaller envelope in a larger one. The envelope added at each layer contains sufficient information for handling the packet. Application-layer data are divided into blocks small enough to be encapsulated in an envelope at the next layer. Application data blocks are \u201cdressed up\u201d in the TCP/IP architecture according to the following basic steps. At the sending side, an application data block is encapsulated in a TCP packet when it is passed down to the TCP layer. In other words, a TCP packet consists of a header and a payload, where the header corresponds to the TCP envelope and the payload is the application data block. Likewise, the TCP packet will be encapsulated in an IP packet when it is passed down to the IP layer. An IP packet consists of a header and a payload, which is the TCP packet passed down from the TCP layer. The IP packet will be encapsulated in a device-dependent frame (e.g., an Ethernet frame) when it is passed down to the data-link layer. A frame has a header, and it may also have a trailer. For example, in addition to having a header, an Ethernet frame also has a 32-bit cyclic redundancy check (CRC) trailer. When it is passed down to the physical layer, a frame will be transformed into a sequence of media signals for transmission Flow Diagram of a Packet Generation At the destination side, the medium signals are converted by the physical layer into a frame, which is passed up to the data-link layer. The data-link layer passes the frame payload (i.e., the IP packet encapsulated in the frame) up to the IP layer. The IP layer passes the IP payload, namely, the TCP packet encapsulated in the IP packet, up to the TCP layer. The TCP layer passes the TCP payload, namely, the application data block, up to the application layer. When a packet arrives at a router, it only goes up to the IP layer, where certain fields in the IP header are modified (e.g., the value of TTL is decreased by 1). This modified packet is then passed back down layer-by-layer to the physical layer for further transmission.","title":"Introduction"},{"location":"security/network_security/#public-key-infrastructure","text":"To deploy cryptographic algorithms in network applications, we need a way to distribute secret keys using open networks. Public-key cryptography is the best way to distribute these secret keys. To use public-key cryptography, we need to build a public-key infrastructure (PKI) to support and manage public-key certificates and certificate authority (CA) networks. In particular, PKIs are set up to perform the following functions: Determine the legitimacy of users before issuing public-key certificates to them. Issue public-key certificates upon user requests. Extend public-key certificates valid time upon user requests. Revoke public-key certificates upon users' requests or when the corresponding private keys are compromised. Store and manage public-key certificates. Prevent digital signature signers from denying their signatures. Support CA networks to allow different CAs to authenticate public-key certificates issued by other CAs. X.509: https://certificatedecoder.dev/?gclid=EAIaIQobChMI0M731O6G6gIVVSQrCh04bQaAEAAYASAAEgKRkPD_BwE","title":"Public Key Infrastructure"},{"location":"security/network_security/#ipsec-a-security-protocol-at-the-network-layer","text":"IPsec is a major security protocol at the network layer IPsec provides a potent platform for constructing virtual private networks (VPN). VPNs are private networks overlayed on public networks. The purpose of deploying cryptographic algorithms at the network layer is to encrypt or authenticate IP packets (either just the payloads or the whole packets). IPsec also specifies how to exchange keys. Thus, IPsec consists of authentication protocols, encryption protocols, and key exchange protocols. They are referred to, respectively, as authentication header (AH), encapsulating security payload (ESP), and Internet key exchange (IKE).","title":"IPsec: A Security Protocol at the Network Layer"},{"location":"security/network_security/#pgp-smime-email-security","text":"There are several security protocols at the application layer. The most used of these protocols are email security protocols namely PGP and S/MIME. SMTP (\u201cSimple Mail Transfer Protocol\u201d) is used for sending and delivering from a client to a server via port 25: it\u2019s the outgoing server. On the contrary, POP (\u201cPost Office Protocol\u201d) allows the user to pick up the message and download it into his inbox: it\u2019s the incoming server. The latest version of the Post Office Protocol is named POP3, and it\u2019s been used since 1996; it uses port 110 PGP PGP implements all major cryptographic algorithms, the ZIP compression algorithm, and the Base64 encoding algorithm. It can be used to authenticate a message, encrypt a message, or both. PGP follows the following general process: authentication, ZIP compression, encryption, and Base64 encoding. The Base64 encoding procedure makes the message ready for SMTP transmission GPG (GnuPG) GnuPG is another free encryption standard that companies may use that is based on OpenPGP. GnuPG serves as a replacement for Symantec\u2019s PGP. The main difference is the supported algorithms. However, GnuPG plays nice with PGP by design. Because GnuPG is open, some businesses would prefer the technical support and the user interface that comes with Symantec\u2019s PGP. It is important to note that there are some nuances between the compatibility of GnuPG and PGP, such as the compatibility between certain algorithms, but in most applications such as email, there are workarounds. One such algorithm is the IDEA Module which isn\u2019t included in GnuPG out of the box due to patent issues. S/MIME SMTP can only handle 7-bit ASCII text (You can use UTF-8 extensions to alleviate these limitations, ) messages. While POP can handle other content types besides 7-bit ASCII, POP may, under a common default setting, download all the messages stored in the mail server to the user's local computer. After that, if POP removes these messages from the mail server. This makes it difficult for the user to read his messages from multiple computers. The Multipurpose Internet Mail Extension protocol (MIME) was designed to support sending and receiving email messages in various formats, including nontext files generated by word processors, graphics files, sound files, and video clips. Moreover, MIME allows a single message to include mixed types of data in any combination of these formats. The Internet Mail Access Protocol (IMAP), operated on TCP port 143(only for non-encrypted), stores (Configurable on both server & client just like PoP) incoming email messages in the mail server until the user deletes them deliberately. This allows the user to access his mailbox from multiple machines and download messages to a local machine without deleting it from the mailbox in the mail server. SSL/TLS SSL uses a PKI to decide if a server\u2019s public key is trustworthy by requiring servers to use a security certificate signed by a trusted CA. When Netscape Navigator 1.0 was released, it trusted a single CA operated by the RSA Data Security corporation. The server\u2019s public RSA keys were used to be stored in the security certificate, which can then be used by the browser to establish a secure communication channel. The security certificates we use today still rely on the same standard (named X.509) that Netscape Navigator 1.0 used back then. Netscape intended to train users(though this didn\u2019t work out later) to differentiate secure communications from insecure ones, so they put a lock icon next to the address bar. When the lock is open, the communication is insecure. A closed lock means communication has been secured with SSL, which required the server to provide a signed certificate. You\u2019re obviously familiar with this icon as it\u2019s been in every browser ever since. The engineers at Netscape truly created a standard for secure internet communications. A year after releasing SSL 2.0, Netscape fixed several security issues and released SSL 3.0, a protocol that, albeit being officially deprecated since June 2015, remains in use in certain parts of the world more than 20 years after its introduction. To standardize SSL, the Internet Engineering Task Force (IETF) created a slightly modified SSL 3.0 and, in 1999, unveiled it as Transport Layer Security (TLS) 1.0. The name change between SSL and TLS continues to confuse people today. Officially, TLS is the new SSL, but in practice, people use SSL and TLS interchangeably to talk about any version of the protocol. Must See: https://tls.ulfheim.net/ https://davidwong.fr/tls13/","title":"PGP &amp; S/MIME : Email Security"},{"location":"security/network_security/#network-perimeter-security","text":"Let us see how we keep a check on the perimeter i.e the edges, the first layer of protection","title":"Network  Perimeter Security"},{"location":"security/network_security/#general-firewall-framework","text":"Firewalls are needed because encryption algorithms cannot effectively stop malicious packets from getting into an edge network. This is because IP packets, regardless of whether they are encrypted, can always be forwarded into an edge network. Firewalls that were developed in the 1990s are important instruments to help restrict network access. A firewall may be a hardware device, a software package, or a combination of both. Packets flowing into the internal network from the outside should be evaluated before they are allowed to enter. One of the critical elements of a firewall is its ability to examine packets without imposing a negative impact on communication speed while providing security protections for the internal network. The packet inspection that is carried out by firewalls can be done using several different methods. Based on the particular method used by the firewall, it can be characterized as either a packet filter, circuit gateway, application gateway, or dynamic packet filter.","title":"General Firewall Framework"},{"location":"security/network_security/#packet-filters","text":"It inspects ingress packets coming to an internal network from outside and inspects egress packets going outside from an internal network Packing filtering only inspects IP headers and TCP headers, not the payloads generated at the application layer A packet-filtering firewall uses a set of rules to determine whether a packet should be allowed or denied to pass through. 2 types: Stateless It treats each packet as an independent object, and it does not keep track of any previously processed packets. In other words, stateless filtering inspects a packet when it arrives and makes a decision without leaving any record of the packet being inspected. Stateful Stateful filtering, also referred to as connection-state filtering, keeps track of connections between an internal host and an external host. A connection state (or state, for short) indicates whether it is a TCP connection or a UDP connection and whether the connection is established.","title":"Packet Filters"},{"location":"security/network_security/#circuit-gateways","text":"Circuit gateways, also referred to as circuit-level gateways, are typically operated at the transportation layer They evaluate the information of the IP addresses and the port numbers contained in TCP (or UDP) headers and use it to determine whether to allow or to disallow an internal host and an external host to establish a connection. It is common practice to combine packet filters and circuit gateways to form a dynamic packet filter (DPF).","title":"Circuit Gateways"},{"location":"security/network_security/#application-gatewaysalg","text":"Aka PROXY Servers An Application Level Gateway (ALG) acts as a proxy for internal hosts, processing service requests from external clients. An ALG performs deep inspections on each IP packet (ingress or egress). In particular, an ALG inspects application program formats contained in the packet (e.g., MIME format or SQL format) and examines whether its payload is permitted. Thus, an ALG may be able to detect a computer virus contained in the payload. Because an ALG inspects packet payloads, it may be able to detect malicious code and quarantine suspicious packets, in addition to blocking packets with suspicious IP addresses and TCP ports. On the other hand, an ALG also incurs substantial computation and space overheads.","title":"Application Gateways(ALG)"},{"location":"security/network_security/#trusted-systems-bastion-hosts","text":"A Trusted Operating System (TOS) is an operating system that meets a particular set of security requirements. Whether an operating system can be trusted or not depends on several elements. For example, for an operating system on a particular computer to be certified trusted, one needs to validate that, among other things, the following four requirements are satisfied: Its system design contains no defects; Its system software contains no loopholes; Its system is configured properly; and Its system management is appropriate. Bastion Hosts Bastion hosts are computers with strong defence mechanisms. They often serve as host computers for implementing application gateways, circuit gateways, and other types of firewalls. A bastion host is operated on a trusted operating system that must not contain unnecessary functionalities or programs. This measure helps to reduce error probabilities and makes it easier to conduct security checks. Only those network application programs that are necessary, for example, SSH, DNS, SMTP, and authentication programs, are installed on a bastion host. Bastion hosts are also primarily used as controlled ingress points so that the security monitoring can focus more narrowly on actions happening at a single point closely.","title":"Trusted Systems &amp; Bastion Hosts"},{"location":"security/network_security/#common-techniques-scannings-packet-capturing","text":"","title":"Common Techniques &amp; Scannings, Packet Capturing"},{"location":"security/network_security/#scanning-ports-with-nmap","text":"Nmap (\"Network Mapper\") is a free and open-source (license) utility for network discovery and security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. The best thing about Nmap is it\u2019s free and open-source and is very flexible and versatile Nmap is often used to determine alive hosts in a network, open ports on those hosts, services running on those open ports, and version identification of that service on that port. More at http://scanme.nmap.org/ nmap [scan type] [options] [target specification] Nmap uses 6 different port states: Open \u2014 An open port is one that is actively accepting TCP, UDP or SCTP connections. Open ports are what interests us the most because they are the ones that are vulnerable to attacks. Open ports also show the available services on a network. Closed \u2014 A port that receives and responds to Nmap probe packets but there is no application listening on that port. Useful for identifying that the host exists and for OS detection. Filtered \u2014 Nmap can\u2019t determine whether the port is open because packet filtering prevents its probes from reaching the port. Filtering could come from firewalls or router rules. Often little information is given from filtered ports during scans as the filters can drop the probes without responding or respond with useless error messages e.g. destination unreachable. Unfiltered \u2014 Port is accessible but Nmap doesn\u2019t know if it is open or closed. Only used in ACK scan which is used to map firewall rulesets. Other scan types can be used to identify whether the port is open. Open/filtered \u2014 Nmap is unable to determine between open and filtered. This happens when an open port gives no response. No response could mean that the probe was dropped by a packet filter or any response is blocked. Closed/filtered \u2014 Nmap is unable to determine whether a port is closed or filtered. Only used in the IP ID idle scan.","title":"Scanning Ports with Nmap"},{"location":"security/network_security/#types-of-nmap-scan","text":"TCP Connect TCP Connect scan completes the 3-way handshake. If a port is open, the operating system completes the TCP three-way handshake and the port scanner immediately closes the connection to avoid DOS. This is \u201cnoisy\u201d because the services can log the sender IP address and might trigger Intrusion Detection Systems. UDP Scan This scan checks to see if any UDP ports are listening. Since UDP does not respond with a positive acknowledgement like TCP and only responds to an incoming UDP packet when the port is closed, SYN Scan SYN scan is another form of TCP scanning. This scan type is also known as \u201chalf-open scanning\u201d because it never actually opens a full TCP connection. The port scanner generates a SYN packet. If the target port is open, it will respond with an SYN-ACK packet. The scanner host responds with an RST packet, closing the connection before the handshake is completed. If the port is closed but unfiltered, the target will instantly respond with an RST packet. SYN scan has the advantage that the individual services never actually receive a connection. FIN Scan This is a stealthy scan, like the SYN scan, but sends a TCP FIN packet instead. ACK Scan Ack scanning determines whether the port is filtered or not. Null Scan Another very stealthy scan that sets all the TCP header flags to off or null. This is not normally a valid packet and some hosts will not know what to do with this. XMAS Scan Similar to the NULL scan except for all the flags in the TCP header is set to on RPC Scan This special type of scan looks for machine answering to RPC (Remote Procedure Call) services IDLE Scan It is a super stealthy method whereby the scan packets are bounced off an external host. You don\u2019t need to have control over the other host but it does have to set up and meet certain requirements. You must input the IP address of our \u201czombie\u201d host and what port number to use. It is one of the more controversial options in Nmap since it only has a use for malicious attacks. Scan Techniques A couple of scan techniques which can be used to gain more information about a system and its ports. You can read more at https://medium.com/infosec-adventures/nmap-cheatsheet-a423fcdda0ca","title":"Types of Nmap Scan:"},{"location":"security/network_security/#openvas","text":"OpenVAS is a full-featured vulnerability scanner. OpenVAS is a framework of services and tools that provides a comprehensive and powerful vulnerability scanning and management package OpenVAS, which is an open-source program, began as a fork of the once-more-popular scanning program, Nessus. OpenVAS is made up of three main parts. These are: a regularly updated feed of Network Vulnerability Tests (NVTs); a scanner, which runs the NVTs; and an SQLite 3 database for storing both your test configurations and the NVTs\u2019 results and configurations. https://www.greenbone.net/en/install_use_gce/","title":"OpenVAS"},{"location":"security/network_security/#wireshark","text":"Wireshark is a protocol analyzer. This means Wireshark is designed to decode not only packet bits and bytes but also the relations between packets and protocols. Wireshark understands protocol sequences. A simple demo of Wireshark Capture only udp packets: Capture filter = \u201cudp\u201d Capture only tcp packets Capture filter = \u201ctcp\u201d TCP/IP 3 way Handshake Filter by IP address: displays all traffic from IP, be it source or destination ip.addr == 192.168.1.1 Filter by source address: display traffic only from IP source ip.src == 192.168.0.1 Filter by destination: display traffic only form IP destination ip.dst == 192.168.0.1 Filter by IP subnet: display traffic from subnet, be it source or destination ip.addr = 192.168.0.1/24 Filter by protocol: filter traffic by protocol name dns http ftp arp ssh telnet icmp Exclude IP address: remove traffic from and to IP address !ip.addr ==192.168.0.1 Display traffic between two specific subnet ip.addr == 192.168.0.1/24 and ip.addr == 192.168.1.1/24 Display traffic between two specific workstations ip.addr == 192.168.0.1 and ip.addr == 192.168.0.2 Filter by MAC eth.addr = 00:50:7f:c5:b6:78 Filter TCP port tcp.port == 80 Filter TCP port source tcp.srcport == 80 Filter TCP port destination tcp.dstport == 80 Find user agents http.user_agent contains Firefox !http.user_agent contains || !http.user_agent contains Chrome Filter broadcast traffic !(arp or icmp or dns) Filter IP address and port tcp.port == 80 && ip.addr == 192.168.0.1 Filter all http get requests http.request Filter all http get requests and responses http.request or http.response Filter three way handshake tcp.flags.syn==1 or (tcp.seq==1 and tcp.ack==1 and tcp.len==0 and tcp.analysis.initial_rtt) Find files by type frame contains \u201c(attachment|tar|exe|zip|pdf)\u201d Find traffic based on keyword tcp contains facebook frame contains facebook Detecting SYN Floods tcp.flags.syn == 1 and tcp.flags.ack == 0 Wireshark Promiscuous Mode - By default, Wireshark only captures packets going to and from the computer where it runs. By checking the box to run Wireshark in Promiscuous Mode in the Capture Settings, you can capture most of the traffic on the LAN.","title":"WireShark"},{"location":"security/network_security/#dumpcap","text":"Dumpcap is a network traffic dump tool. It captures packet data from a live network and writes the packets to a file. Dumpcap\u2019s native capture file format is pcapng, which is also the format used by Wireshark. By default, Dumpcap uses the pcap library to capture traffic from the first available network interface and writes the received raw packet data, along with the packets\u2019 time stamps into a pcapng file. The capture filter syntax follows the rules of the pcap library. The Wireshark command-line utility called 'dumpcap.exe' can be used to capture LAN traffic over an extended period of time. Wireshark itself can also be used, but dumpcap does not significantly utilize the computer's memory while capturing for long periods.","title":"DumpCap"},{"location":"security/network_security/#daemonlogger","text":"Daemonlogger is a packet logging application designed specifically for use in Network and Systems Management (NSM) environments. The biggest benefit Daemonlogger provides is that, like Dumpcap, it is simple to use for capturing packets. In order to begin capturing, you need only to invoke the command and specify an interface. daemonlogger \u2013i eth1 This option, by default, will begin capturing packets and logging them to the current working directory. Packets will be collected until the capture file size reaches 2 GB, and then a new file will be created. This will continue indefinitely until the process is halted.","title":"DaemonLogger"},{"location":"security/network_security/#netsniff-ng","text":"Netsniff-NG is a high-performance packet capture utility While the utilities we\u2019ve discussed to this point rely on Libpcap for capture, Netsniff-NG utilizes zero-copy mechanisms to capture packets. This is done with the intent to support full packet capture over high throughput links. To begin capturing packets with Netsniff-NG, we have to specify an input and output. In most cases, the input will be a network interface, and the output will be a file or folder on disk. netsniff-ng \u2013i eth1 \u2013o data.pcap","title":"NetSniff-NG"},{"location":"security/network_security/#netflow","text":"NetFlow is a feature that was introduced on Cisco routers around 1996 that provides the ability to collect IP network traffic as it enters or exits an interface. By analyzing the data provided by NetFlow, a network administrator can determine things such as the source and destination of traffic, class of service, and the causes of congestion. A typical flow monitoring setup (using NetFlow) consists of three main components:[1] Flow exporter: aggregates packets into flows and exports flow records towards one or more flow collectors. Flow collector: responsible for reception, storage and pre-processing of flow data received from a flow exporter. Analysis application: analyzes received flow data in the context of intrusion detection or traffic profiling, for example. Routers and switches that support NetFlow can collect IP traffic statistics on all interfaces where NetFlow is enabled, and later export those statistics as NetFlow records toward at least one NetFlow collector\u2014typically a server that does the actual traffic analysis.","title":"Netflow"},{"location":"security/network_security/#ids","text":"A security solution that detects security-related events in your environment but does not block them. IDS sensors can be software and hardware-based used to collect and analyze the network traffic. These sensors are available in two varieties, network IDS and host IDS. A host IDS is a server-specific agent running on a server with a minimum of overhead to monitor the operating system. A network IDS can be embedded in a networking device, a standalone appliance, or a module monitoring the network traffic. Signature Based IDS The signature-based IDS monitors the network traffic or observes the system and sends an alarm if a known malicious event is happening. It does so by comparing the data flow against a database of known attack patterns These signatures explicitly define what traffic or activity should be considered as malicious. Signature-based detection has been the bread and butter of network-based defensive security for over a decade, partially because it is very similar to how malicious activity is detected at the host level with antivirus utilities The formula is fairly simple: an analyst observes a malicious activity, derives indicators from the activity and develops them into signatures, and then those signatures will alert whenever the activity occurs again. ex: SNORT & SURICATA Policy-Based IDS The policy-based IDSs (mainly host IDSs) trigger an alarm whenever a violation occurs against the configured policy. This configured policy is or should be a representation of the security policies. This type of IDS is flexible and can be customized to a company's network requirements because it knows exactly what is permitted and what is not. On the other hand, the signature-based systems rely on vendor specifics and default settings. Anomaly Based IDS The anomaly-based IDS looks for traffic that deviates from the normal, but the definition of what is a normal network traffic pattern is the tricky part Two types of anomaly-based IDS exist: statistical and nonstatistical anomaly detection Statistical anomaly detection learns the traffic patterns interactively over a period of time. In the nonstatistical approach, the IDS has a predefined configuration of the supposedly acceptable and valid traffic patterns. Host-Based IDS & Network-Based IDS A host IDS can be described as a distributed agent residing on each server of the network that needs protection. These distributed agents are tied very closely to the underlying operating system. Network IDSs, on the other hand, can be described as intelligent sniffing devices. Data (raw packets) is captured from the network by a network IDS, whereas host IDSs capture the data from the host on which they are installed. Honeypots The use of decoy machines to direct intruders' attention away from the machines under protection is a major technique to preclude intrusion attacks. Any device, system, directory, or file used as a decoy to lure attackers away from important assets and to collect intrusion or abusive behaviours is referred to as a honeypot. A honeypot may be implemented as a physical device or as an emulation system. The idea is to set up decoy machines in a LAN, or decoy directories/files in a file system and make them appear important, but with several exploitable loopholes, to lure attackers to attack these machines or directories/files, so that other machines, directories, and files can evade intruders' attentions. A decoy machine may be a host computer or a server computer. Likewise, we may also set up decoy routers or even decoy LANs.","title":"IDS"},{"location":"security/network_security/#chinks-in-the-armour-tcpip-security-issues","text":"","title":"Chinks In The Armour (TCP/IP Security Issues)"},{"location":"security/network_security/#ip-spoofing","text":"In this type of attack, the attacker replaces the IP address of the sender, or in some rare cases the destination, with a different address. IP spoofing is normally used to exploit a target host. In other cases, it is used to start a denial-of-service (DoS) attack. In a DoS attack, an attacker modifies the IP packet to mislead the target host into accepting the original packet as a packet sourced at a trusted host. The attacker must know the IP address of the trusted host to modify the packet headers (source IP address) so that it appears that the packets are coming from that host. IP Spoofing Detection Techniques Direct TTL Probes In this technique we send a packet to a host of suspect spoofed IP that triggers reply and compares TTL with suspect packet; if the TTL in the reply is not the same as the packet being checked; it is a spoofed packet. This Technique is successful when the attacker is in a different subnet from the victim. IP Identification Number. Send a probe to the host of suspect spoofed traffic that triggers a reply and compares IP ID with suspect traffic. If IP IDs are not in the near value of packet being checked, suspect traffic is spoofed TCP Flow Control Method Attackers sending spoofed TCP packets will not receive the target\u2019s SYN-ACK packets. Attackers cannot, therefore, be responsive to change in the congestion window size When the receiver still receives traffic even after a windows size is exhausted, most probably the packets are spoofed.","title":"IP Spoofing"},{"location":"security/network_security/#covert-channel","text":"A covert or clandestine channel can be best described as a pipe or communication channel between two entities that can be exploited by a process or application transferring information in a manner that violates the system's security specifications. More specifically for TCP/IP, in some instances, covert channels are established, and data can be secretly passed between two end systems. Ex: ICMP resides at the Internet layer of the TCP/IP protocol suite and is implemented in all TCP/IP hosts. Based on the specifications of the ICMP Protocol, an ICMP Echo Request message should have an 8-byte header and a 56-byte payload. The ICMP Echo Request packet should not carry any data in the payload. However, these packets are often used to carry secret information. The ICMP packets are altered slightly to carry secret data in the payload. This makes the size of the packet larger, but no control exists in the protocol stack to defeat this behaviour. The alteration of ICMP packets allows intruders to program specialized client-server pairs. These small pieces of code export confidential information without alerting the network administrator. ICMP can be leveraged for more than data exfiltration. For eg. some C&C tools such as Loki used ICMP channel to establish encrypted interactive session back in 1996. Deep packet inspection has since come a long way. A lot of IDS/IPS detect ICMP tunnelling. Check for echo responses that do not contain the same payload as request Check for the volume of ICMP traffic especially for volumes beyond an acceptable threshold","title":"Covert Channel"},{"location":"security/network_security/#ip-fragmentation-attack","text":"The TCP/IP protocol suite, or more specifically IP, allows the fragmentation of packets.(this is a feature & not a bug) IP fragmentation offset is used to keep track of the different parts of a datagram. The information or content in this field is used at the destination to reassemble the datagrams All such fragments have the same Identification field value, and the fragmentation offset indicates the position of the current fragment in the context of the original packet. Many access routers and firewalls do not perform packet reassembly. In normal operation, IP fragments do not overlap, but attackers can create artificially fragmented packets to mislead the routers or firewalls. Usually, these packets are small and almost impractical for end systems because of data and computational overhead. A good example of an IP fragmentation attack is the Ping of Death attack. The Ping of Death attack sends fragments that, when reassembled at the end station, create a larger packet than the maximum permissible length. TCP Flags Data exchange using TCP does not happen until a three-way handshake has been completed. This handshake uses different flags to influence the way TCP segments are processed. There are 6 bits in the TCP header that are often called flags. Namely: 6 different flags are part of the TCP header: Urgent pointer field (URG), Acknowledgment field (ACK), Push function (PSH), Reset the connection (RST), Synchronize sequence numbers (SYN), and the sender is finished with this connection (FIN). Abuse of the normal operation or settings of these flags can be used by attackers to launch DoS attacks. This causes network servers or web servers to crash or hang. | SYN | FIN | PSH | RST | Validity| |------|------|-------|------|---------| | 1 |1 |0 |0 |Illegal Combination | 1 |1 |1 |0 |Illegal Combination | 1 |1 |0 |1 |Illegal Combination | 1 |1 |1 |1 |Illegal Combination The attacker's ultimate goal is to write special programs or pieces of code that can construct these illegal combinations resulting in an efficient DoS attack. SYN FLOOD The timers (or lack of certain timers) in 3 way handshake are often used and exploited by attackers to disable services or even to enter systems. After step 2 of the three-way handshake, no limit is set on the time to wait after receiving a SYN. The attacker initiates many connection requests to the webserver of Company XYZ (almost certainly with a spoofed IP address). The SYN+ACK packets (Step 2) sent by the web server back to the originating source IP address are not replied to. This leaves a TCP session half-open on the webserver. Multiple packets cause multiple TCP sessions to stay open. Based on the hardware limitations of the server, a limited number of TCP sessions can stay open, and as a result, the webserver refuses further connection establishments attempts from any host as soon as a certain limit is reached. These half-open connections need to be completed or timed out before new connections can be established. FIN Attack In normal operation, the sender sets the TCP FIN flag indicating that no more data will be transmitted and the connection can be closed down. This is a four-way handshake mechanism, with both sender and receiver expected to send an acknowledgement on a received FIN packet. During an attack that is trying to kill connections, a spoofed FIN packet is constructed. This packet also has the correct sequence number, so the packets are seen as valid by the targeted host. These sequence numbers are easy to predict. This process is referred to as TCP sequence number prediction, whereby the attacker either sniffs the current Sequence and Acknowledgment (SEQ/ACK) numbers of the connection or can algorithmically predict these numbers.","title":"IP Fragmentation Attack"},{"location":"security/network_security/#connection-hijacking","text":"An authorized user (Employee X) sends HTTP requests over a TCP session with the webserver. The web server accepts the packets from Employee X only when the packet has the correct SEQ/ACK numbers. As seen previously, these numbers are important for the webserver to distinguish between different sessions and to make sure it is still talking to Employee X. Imagine that the cracker starts sending packets to the web server spoofing the IP address of Employee X, using the correct SEQ/ACK combination. The web server accepts the packet and increments the ACK number. In the meantime, Employee X continues to send packets but with incorrect SEQ/ACK numbers. As a result of sending unsynchronized packets, all data from Employee X is discarded when received by the webserver. The attacker pretends to be Employee X using the correct numbers. This finally results in the cracker hijacking the connection, whereby Employee X is completely confused and the webserver replies assuming the cracker is sending correct synchronized data. STEPS: The attacker examines the traffic flows with a network monitor and notices traffic from Employee X to a web server. The web server returns or echoes data back to the origination station (Employee X). Employee X acknowledges the packet. The cracker launches a spoofed packet to the server. The web server responds to the cracker. The cracker starts verifying SEQ/ACK numbers to double-check success. At this time, the cracker takes over the session from Employee X, which results in a session hanging for Employee X. The cracker can start sending traffic to the webserver. The web server returns the requested data to confirm delivery with the correct ACK number. The cracker can continue to send data (keeping track of the correct SEQ/ACK numbers) until eventually setting the FIN flag to terminate the session.","title":"Connection Hijacking"},{"location":"security/network_security/#buffer-overflow","text":"A buffer is a temporary data storage area used to store program code and data. When a program or process tries to store more data in a buffer than it was originally anticipated to hold, a buffer overflow occurs. Buffers are temporary storage locations in memory (memory or buffer sizes are often measured in bytes) that can store a fixed amount of data in bytes. When more data is retrieved than can be stored in a buffer location, the additional information must go into an adjacent buffer, resulting in overwriting the valid data held in them. Mechanism: Buffer overflow vulnerabilities exist in different types. But the overall goal for all buffer overflow attacks is to take over the control of a privileged program and, if possible, the host. The attacker has two tasks to achieve this goal. First, the dirty code needs to be available in the program's code address space. Second, the privileged program should jump to that particular part of the code, which ensures that the proper parameters are loaded into memory. The first task can be achieved in two ways: by injecting the code in the right address space or by using the existing code and modifying certain parameters slightly. The second task is a little more complex because the program's control flow needs to be modified to make the program jump to the dirty code. CounterMeasure: The most important approach is to have a concerted focus on writing correct code. A second method is to make the data buffers (memory locations) address space of the program code non-executable. This type of address space makes it impossible to execute code, which might be infiltrated in the program's buffers during an attack.","title":"Buffer Overflow"},{"location":"security/network_security/#more-spoofing","text":"Address Resolution Protocol Spoofing The Address Resolution Protocol (ARP) provides a mechanism to resolve, or map, a known IP address to a MAC sublayer address. Using ARP spoofing, the cracker can exploit this hardware address authentication mechanism by spoofing the hardware address of Host B. Basically, the attacker can convince any host or network device on the local network that the cracker's workstation is the host to be trusted. This is a common method used in a switched environment. ARP spoofing can be prevented with the implementation of static ARP tables in all the hosts and routers of your network. Alternatively, you can implement an ARP server that responds to ARP requests on behalf of the target host. DNS Spoofing DNS spoofing is the method whereby the hacker convinces the target machine that the system it wants to connect to is the machine of the cracker. The cracker modifies some records so that name entries of hosts correspond to the attacker's IP address. There have been instances in which the complete DNS server was compromised by an attack. To counter DNS spoofing, the reverse lookup detects these attacks. The reverse lookup is a mechanism to verify the IP address against a name. The IP address and name files are usually kept on different servers to make compromise much more difficult","title":"More Spoofing"},{"location":"security/threats_attacks_defences/","text":"Part III: Threats, Attacks & Defense DNS Protection Cache Poisoning Attack Since DNS responses are cached, a quick response can be provided for repeated translations. DNS negative queries are also cached, e.g., misspelt words, and all cached data periodically times out. Cache poisoning is an issue in what is known as pharming. This term is used to describe a hacker\u2019s attack in which a website\u2019s traffic is redirected to a bogus website by forging the DNS mapping. In this case, an attacker attempts to insert a fake address record for an Internet domain into the DNS. If the server accepts the fake record, the cache is poisoned and subsequent requests for the address of the domain are answered with the address of a server controlled by the attacker. As long as the fake entry is cached by the server, browsers or e-mail servers will automatically go to the address provided by the compromised DNS server. the typical time to live (TTL) for cached entries is a couple of hours, thereby permitting ample time for numerous users to be affected by the attack. DNSSEC (Security Extension) The long-term solution to these DNS problems is authentication. If a resolver cannot distinguish between valid and invalid data in a response, then add source authentication to verify that the data received in response is equal to the data entered by the zone administrator DNS Security Extensions (DNSSEC) protects against data spoofing and corruption and provides mechanisms to authenticate servers and requests, as well as mechanisms to establish authenticity and integrity. When authenticating DNS responses, each DNS zone signs its data using a private key. It is recommended that this signing be done offline and in advance. The query for a particular record returns the requested resource record set (RRset) and signature (RRSIG) of the requested resource record set. The resolver then authenticates the response using a public key, which is pre-configured or learned via a sequence of key records in the DNS hierarchy. The goals of DNSSEC are to provide authentication and integrity for DNS responses without confidentiality or DDoS protection. BGP BGP stands for border gateway protocol. It is a routing protocol that exchanges routing information among multiple Autonomous Systems (AS) An Autonomous System is a collection of routers or networks with the same network policy usually under single administrative control. BGP tells routers which hop to use in order to reach the destination network. BGP is used for both communicating information among routers in an AS (interior) and between multiple ASes (exterior). How BGP Works BGP is responsible for finding a path to a destination router & the path it chooses should be the shortest and most reliable one. This decision is done through a protocol known as Link state. With the link-state protocol, each router broadcasts to all other routers in the network the state of its links and IP subnets. Each router then receives information from the other routers and constructs a complete topology view of the entire network. The next-hop routing table is based on this topology view. The link-state protocol uses a famous algorithm in the field of computer science, Dijkstra\u2019s shortest path algorithm: We start from our router considering the path cost to all our direct neighbours. The shortest path is then taken We then re-look at all our neighbours that we can reach and update our link state table with the cost information. We then continue taking the shortest path until every router has been visited. BGP Vulnerabilities By corrupting the BGP routing table we are able to influence the direction traffic flows on the internet! This action is known as BGP hijacking. Injecting bogus route advertising information into the BGP-distributed routing database by malicious sources, accidentally or routers can disrupt Internet backbone operations. Blackholing traffic: Blackhole route is a network route, i.e., routing table entry, that goes nowhere and packets matching the route prefix are dropped or ignored. Blackhole routes can only be detected by monitoring the lost traffic. Blackhole routes are the best defence against many common viral attacks where the traffic is dropped from infected machines to/from command & control masters. Infamous BGP Injection attack on Youtube EX: In 2008, Pakistan decided to block YouTube by creating a BGP route that led into a black hole. Instead, this routing information got transmitted to a hong kong ISP and from there accidentally got propagated to the rest of the world meaning millions were routed through to this black hole and therefore unable to access YouTube. Potentially, the greatest risk to BGP occurs in a denial of service attack in which a router is flooded with more packets than it can handle. Network overload and router resource exhaustion happen when the network begins carrying an excessive number of BGP messages, overloading the router control processors, memory, routing table and reducing the bandwidth available for data traffic. Refer: https://medium.com/bugbountywriteup/bgp-the-weak-link-in-the-internet-what-is-bgp-and-how-do-hackers-exploit-it-d899a68ba5bb Router flapping is another type of attack. Route flapping refers to repetitive changes to the BGP routing table, often several times a minute. Withdrawing and re-advertising at a high-rate can cause a serious problem for routers since they propagate the announcements of routes. If these route flaps happen fast enough, e.g., 30 to 50 times per second, the router becomes overloaded, which eventually prevents convergence on valid routes. The potential impact for Internet users is a slowdown in message delivery, and in some cases, packets may not be delivered at all. BGP Security Border Gateway Protocol Security recommends the use of BGP peer authentication since it is one of the strongest mechanisms for preventing malicious activity. The authentication mechanisms are Internet Protocol Security (IPsec) or BGP MD5. Another method, known as prefix limits, can be used to avoid filling router tables. In this approach, routers should be configured to disable or terminate a BGP peering session, and issue warning messages to administrators when a neighbour sends in excess of a preset number of prefixes. IETF is currently working on improving this space Web-Based Attacks HTTP Response Splitting Attacks HTTP response splitting attack may happen where the server script embeds user data in HTTP response headers without appropriate sanitation. This typically happens when the script embeds user data in the redirection URL of a redirection response (HTTP status code 3xx), or when the script embeds user data in a cookie value or name when the response sets a cookie. HTTP response splitting attacks can be used to perform web cache poisoning and cross-site scripting attacks. HTTP response splitting is the attacker\u2019s ability to send a single HTTP request that forces the webserver to form an output stream, which is then interpreted by the target as two HTTP responses instead of one response. Cross-Site Request Forgery (CSRF or XSRF) A Cross-Site Request Forgery attack tricks the victim\u2019s browser into issuing a command to a vulnerable web application. Vulnerability is caused by browsers automatically including user authentication data, session ID, IP address, Windows domain credentials, etc. with each request. Attackers typically use CSRF to initiate transactions such as transfer funds, login/logout user, close account, access sensitive data, and change account details. The vulnerability is caused by web browsers that automatically include credentials with each request, even for requests caused by a form, script, or image on another site. CSRF can also be dynamically constructed as part of a payload for a cross-site scripting attack All sites relying on automatic credentials are vulnerable. Popular browsers cannot prevent cross-site request forgery. Logging out of high-value sites as soon as possible can mitigate CSRF risk. It is recommended that a high-value website must require a client to manually provide authentication data in the same HTTP request used to perform any operation with security implications. Limiting the lifetime of session cookies can also reduce the chance of being used by other malicious sites. OWASP recommends website developers include a required security token in HTTP requests associated with sensitive business functions in order to mitigate CSRF attacks Cross-Site Scripting (XSS) Attacks Cross-Site Scripting occurs when dynamically generated web pages display user input, such as login information, that is not properly validated, allowing an attacker to embed malicious scripts into the generated page and then execute the script on the machine of any user that views the site. If successful, Cross-Site Scripting vulnerabilities can be exploited to manipulate or steal cookies, create requests that can be mistaken for those of a valid user, compromise confidential information, or execute malicious code on end-user systems. Cross-Site Scripting (XSS or CSS) attacks involve the execution of malicious scripts on the victim\u2019s browser. The victim is simply a user\u2019s host and not the server. XSS results from a failure to validate user input by a web-based application. Document Object Model (DOM) XSS Attacks The Document Object Model (DOM) based XSS does not require the webserver to receive the XSS payload for a successful attack. The attacker abuses the runtime by embedding their data on the client-side. An attacker can force the client (browser) to render the page with parts of the DOM controlled by the attacker. When the page is rendered and the data is processed by the page, typically by a client-side HTML-embedded script such as JavaScript, the page\u2019s code may insecurely embed the data in the page itself, thus delivering the cross-site scripting payload. There are several DOM objects which can serve as an attack vehicle for delivering malicious script to victims browser. Clickjacking The technique works by hiding malicious link/scripts under the cover of the content of a legitimate site. Buttons on a website actually contain invisible links, placed there by the attacker. So, an individual who clicks on an object they can visually see is actually being duped into visiting a malicious page or executing a malicious script. When mouseover is used together with clickjacking, the outcome is devastating. Facebook users have been hit by a clickjacking attack, which tricks people into \u201cliking\u201d a particular Facebook page, thus enabling the attack to spread since Memorial Day 2010. There is not yet effective defence against clickjacking, and disabling JavaScript is the only viable method DataBase Attacks & Defenses SQL injection Attacks It exploits improper input validation in database queries. A successful exploit will allow attackers to access, modify, or delete information in the database. It permits attackers to steal sensitive information stored within the backend databases of affected websites, which may include such things as user credentials, email addresses, personal information, and credit card numbers SELECT USERNAME,PASSWORD from USERS where USERNAME='<username>' AND PASSWORD='<password>'; Here the username & password is the input provided by the user. Suppose an attacker gives the input as \" OR '1'='1'\" in both fields. Therefore the SQL query will look like: SELECT USERNAME,PASSWORD from USERS where USERNAME='' OR '1'='1' AND PASSOWRD='' OR '1'='1'; This query results in a true statement & the user gets logged in. This example depicts the bost basic type of SQL injection SQL Injection Attack Defenses SQL injection can be protected by filtering the query to eliminate malicious syntax, which involves the employment of some tools in order to (a) scan the source code. In addition, the input fields should be restricted to the absolute minimum, typically anywhere from 7-12 characters, and validate any data, e.g., if a user inputs an age make sure the input is an integer with a maximum of 3 digits. VPN A virtual private network (VPN) is a service that offers a secure, reliable connection over a shared public infrastructure such as the Internet. Cisco defines a VPN as an encrypted connection between private networks over a public network. To date, there are three types of VPNs: Remote access Site-to-site Firewall-based Security Breach In spite of the most aggressive steps to protect computers from attacks, attackers sometimes get through. Any event that results in a violation of any of the confidentiality, integrity, or availability (CIA) security tenets is a security breach. Denial of Service Attacks Denial of service (DoS) attacks result in downtime or inability of a user to access a system. DoS attacks impact the availability of tenet of information systems security. A DoS attack is a coordinated attempt to deny service by occupying a computer to perform large amounts of unnecessary tasks. This excessive activity makes the system unavailable to perform legitimate operations Two common types of DoS attacks are as follows: Logic attacks\u2014Logic attacks use software flaws to crash or seriously hinder the performance of remote servers. You can prevent many of these attacks by installing the latest patches to keep your software up to date. Flooding attacks\u2014Flooding attacks overwhelm the victim computer\u2019s CPU, memory, or network resources by sending large numbers of useless requests to the machine. Most DoS attacks target weaknesses in the overall system architecture rather than a software bug or security flaw One popular technique for launching a packet flood is a SYN flood. One of the best defences against DoS attacks is to use intrusion prevention system (IPS) software or devices to detect and stop the attack. Distributed Denial of Service Attacks DDoS attacks differ from regular DoS attacks in their scope. In a DDoS attack, attackers hijack hundreds or even thousands of Internet computers, planting automated attack agents on those systems. The attacker then instructs the agents to bombard the target site with forged messages. This overloads the site and blocks legitimate traffic. The key here is strength in numbers. The attacker does more damage by distributing the attack across multiple computers. Wiretapping Although the term wiretapping is generally associated with voice telephone communications, attackers can also use wiretapping to intercept data communications. Attackers can tap telephone lines and data communication lines. Wiretapping can be active, where the attacker makes modifications to the line. It can also be passive, where an unauthorized user simply listens to the transmission without changing the contents. Passive intrusion can include the copying of data for a subsequent active attack. Two methods of active wiretapping are as follows: Between-the-lines wiretapping\u2014This type of wiretapping does not alter the messages sent by the legitimate user but inserts additional messages into the communication line when the legitimate user pauses. Piggyback-entry wiretapping\u2014This type of wiretapping intercepts and modifies the original message by breaking the communications line and routing the message to another computer that acts as a host. Backdoors Software developers sometimes include hidden access methods, called backdoors, in their programs. Backdoors give developers or support personnel easy access to a system without having to struggle with security controls. The problem is that backdoors don\u2019t always stay hidden. When an attacker discovers a backdoor, he or she can use it to bypass existing security controls such as passwords, encryption, and so on. Where legitimate users log on through front doors using a user ID and password, attackers use backdoors to bypass these normal access controls. Malicious Attacks Birthday Attack Once an attacker compromises a hashed password file, a birthday attack is performed. A birthday attack is a type of cryptographic attack that is used to make a brute-force attack of one-way hashes easier. It is a mathematical exploit that is based on the birthday problem in probability theory. Further Reading: https://www.sciencedirect.com/topics/computer-science/birthday-attack https://www.internetsecurity.tips/birthday-attack/ Brute-Force Password Attacks In a brute-force password attack, the attacker tries different passwords on a system until one of them is successful. Usually, the attacker employs a software program to try all possible combinations of a likely password, user ID, or security code until it locates a match. This occurs rapidly and in sequence. This type of attack is called a brute-force password attack because the attacker simply hammers away at the code. There is no skill or stealth involved\u2014just brute force that eventually breaks the code. Further Reading: https://owasp.org/www-community/attacks/Brute_force_attack https://owasp.org/www-community/controls/Blocking_Brute_Force_Attacks Dictionary Password Attacks A dictionary password attack is a simple attack that relies on users making poor password choices. In a dictionary password attack, a simple password-cracker program takes all the words from a dictionary file and attempts to log on by entering each dictionary entry as a password. Further Reading: https://capec.mitre.org/data/definitions/16.html Replay Attacks Replay attacks involve capturing data packets from a network and retransmitting them to produce an unauthorized effect. The receipt of duplicate, authenticated IP packets may disrupt service or have some other undesired consequence. Systems can be broken through replay attacks when attackers reuse old messages or parts of old messages to deceive system users. This helps intruders to gain information that allows unauthorized access into a system. Further reading: https://study.com/academy/lesson/replay-attack-definition-examples-prevention.html Man-in-the-Middle Attacks A man-in-the-middle attack takes advantage of the multihop process used by many types of networks. In this type of attack, an attacker intercepts messages between two parties before transferring them on to their intended destination. Web spoofing is a type of man-in-the-middle attack in which the user believes a secure session exists with a particular web server. In reality, the secure connection exists only with the attacker, not the webserver. The attacker then establishes a secure connection with the webserver, acting as an invisible go-between. The attacker passes traffic between the user and the webserver. In this way, the attacker can trick the user into supplying passwords, credit card information, and other private data. Further Reading: https://owasp.org/www-community/attacks/Man-in-the-middle_attack Masquerading In a masquerade attack, one user or computer pretends to be another user or computer. Masquerade attacks usually include one of the other forms of active attacks, such as IP address spoofing or replaying. Attackers can capture authentication sequences and then replay them later to log on again to an application or operating system. For example, an attacker might monitor usernames and passwords sent to a weak web application. The attacker could then use the intercepted credentials to log on to the web application and impersonate the user. Further Reading: https://dl.acm.org/doi/book/10.5555/2521792 https://ieeexplore.ieee.org/document/1653228 Eavesdropping Eavesdropping, or sniffing, occurs when a host sets its network interface on promiscuous mode and copies packets that pass by for later analysis. Promiscuous mode enables a network device to intercept and read each network packet(of course given some conditions) given sec, even if the packet\u2019s address doesn\u2019t match the network device. It is possible to attach hardware and software to monitor and analyze all packets on that segment of the transmission media without alerting any other users. Candidates for eavesdropping include satellite, wireless, mobile, and other transmission methods. Social Engineering Attackers often use a deception technique called social engineering to gain access to resources in an IT infrastructure. In nearly all cases, social engineering involves tricking authorized users into carrying out actions for unauthorized users. The success of social engineering attacks depends on the basic tendency of people to want to be helpful. Phreaking Phone phreaking, or simply phreaking, is a slang term that describes the activity of a subculture of people who study, experiment with, or explore telephone systems, telephone company equipment, and systems connected to public telephone networks. Phreaking is the art of exploiting bugs and glitches that exist in the telephone system. Phishing Phishing is a type of fraud in which an attacker attempts to trick the victim into providing private information such as credit card numbers, passwords, dates of birth, bank account numbers, automated teller machine (ATM) PINs, and Social Security numbers. Pharming Pharming is another type of attack that seeks to obtain personal or private financial information through domain spoofing. A pharming attack doesn\u2019t use messages to trick victims into visiting spoofed websites that appear legitimate, however. Instead, pharming \u201cpoisons\u201d a domain name on the domain name server (DNS), a process known as DNS poisoning. The result is that when a user enters the poisoned server\u2019s web address into his or her address bar, that user navigates to the attacker\u2019s site. The user\u2019s browser still shows the correct website, which makes pharming difficult to detect\u2014and therefore more serious. Where phishing attempts to scam people one at a time with an email or instant message, pharming enables scammers to target large groups of people at one time through domain spoofing.","title":"Threat, Attacks & Defences"},{"location":"security/threats_attacks_defences/#part-iii-threats-attacks-defense","text":"","title":"Part III: Threats, Attacks &amp; Defense"},{"location":"security/threats_attacks_defences/#dns-protection","text":"","title":"DNS Protection"},{"location":"security/threats_attacks_defences/#cache-poisoning-attack","text":"Since DNS responses are cached, a quick response can be provided for repeated translations. DNS negative queries are also cached, e.g., misspelt words, and all cached data periodically times out. Cache poisoning is an issue in what is known as pharming. This term is used to describe a hacker\u2019s attack in which a website\u2019s traffic is redirected to a bogus website by forging the DNS mapping. In this case, an attacker attempts to insert a fake address record for an Internet domain into the DNS. If the server accepts the fake record, the cache is poisoned and subsequent requests for the address of the domain are answered with the address of a server controlled by the attacker. As long as the fake entry is cached by the server, browsers or e-mail servers will automatically go to the address provided by the compromised DNS server. the typical time to live (TTL) for cached entries is a couple of hours, thereby permitting ample time for numerous users to be affected by the attack.","title":"Cache Poisoning Attack"},{"location":"security/threats_attacks_defences/#dnssec-security-extension","text":"The long-term solution to these DNS problems is authentication. If a resolver cannot distinguish between valid and invalid data in a response, then add source authentication to verify that the data received in response is equal to the data entered by the zone administrator DNS Security Extensions (DNSSEC) protects against data spoofing and corruption and provides mechanisms to authenticate servers and requests, as well as mechanisms to establish authenticity and integrity. When authenticating DNS responses, each DNS zone signs its data using a private key. It is recommended that this signing be done offline and in advance. The query for a particular record returns the requested resource record set (RRset) and signature (RRSIG) of the requested resource record set. The resolver then authenticates the response using a public key, which is pre-configured or learned via a sequence of key records in the DNS hierarchy. The goals of DNSSEC are to provide authentication and integrity for DNS responses without confidentiality or DDoS protection.","title":"DNSSEC (Security Extension)"},{"location":"security/threats_attacks_defences/#bgp","text":"BGP stands for border gateway protocol. It is a routing protocol that exchanges routing information among multiple Autonomous Systems (AS) An Autonomous System is a collection of routers or networks with the same network policy usually under single administrative control. BGP tells routers which hop to use in order to reach the destination network. BGP is used for both communicating information among routers in an AS (interior) and between multiple ASes (exterior).","title":"BGP"},{"location":"security/threats_attacks_defences/#how-bgp-works","text":"BGP is responsible for finding a path to a destination router & the path it chooses should be the shortest and most reliable one. This decision is done through a protocol known as Link state. With the link-state protocol, each router broadcasts to all other routers in the network the state of its links and IP subnets. Each router then receives information from the other routers and constructs a complete topology view of the entire network. The next-hop routing table is based on this topology view. The link-state protocol uses a famous algorithm in the field of computer science, Dijkstra\u2019s shortest path algorithm: We start from our router considering the path cost to all our direct neighbours. The shortest path is then taken We then re-look at all our neighbours that we can reach and update our link state table with the cost information. We then continue taking the shortest path until every router has been visited.","title":"How BGP Works"},{"location":"security/threats_attacks_defences/#bgp-vulnerabilities","text":"By corrupting the BGP routing table we are able to influence the direction traffic flows on the internet! This action is known as BGP hijacking. Injecting bogus route advertising information into the BGP-distributed routing database by malicious sources, accidentally or routers can disrupt Internet backbone operations. Blackholing traffic: Blackhole route is a network route, i.e., routing table entry, that goes nowhere and packets matching the route prefix are dropped or ignored. Blackhole routes can only be detected by monitoring the lost traffic. Blackhole routes are the best defence against many common viral attacks where the traffic is dropped from infected machines to/from command & control masters. Infamous BGP Injection attack on Youtube EX: In 2008, Pakistan decided to block YouTube by creating a BGP route that led into a black hole. Instead, this routing information got transmitted to a hong kong ISP and from there accidentally got propagated to the rest of the world meaning millions were routed through to this black hole and therefore unable to access YouTube. Potentially, the greatest risk to BGP occurs in a denial of service attack in which a router is flooded with more packets than it can handle. Network overload and router resource exhaustion happen when the network begins carrying an excessive number of BGP messages, overloading the router control processors, memory, routing table and reducing the bandwidth available for data traffic. Refer: https://medium.com/bugbountywriteup/bgp-the-weak-link-in-the-internet-what-is-bgp-and-how-do-hackers-exploit-it-d899a68ba5bb Router flapping is another type of attack. Route flapping refers to repetitive changes to the BGP routing table, often several times a minute. Withdrawing and re-advertising at a high-rate can cause a serious problem for routers since they propagate the announcements of routes. If these route flaps happen fast enough, e.g., 30 to 50 times per second, the router becomes overloaded, which eventually prevents convergence on valid routes. The potential impact for Internet users is a slowdown in message delivery, and in some cases, packets may not be delivered at all. BGP Security Border Gateway Protocol Security recommends the use of BGP peer authentication since it is one of the strongest mechanisms for preventing malicious activity. The authentication mechanisms are Internet Protocol Security (IPsec) or BGP MD5. Another method, known as prefix limits, can be used to avoid filling router tables. In this approach, routers should be configured to disable or terminate a BGP peering session, and issue warning messages to administrators when a neighbour sends in excess of a preset number of prefixes. IETF is currently working on improving this space","title":"BGP Vulnerabilities"},{"location":"security/threats_attacks_defences/#web-based-attacks","text":"","title":"Web-Based Attacks"},{"location":"security/threats_attacks_defences/#http-response-splitting-attacks","text":"HTTP response splitting attack may happen where the server script embeds user data in HTTP response headers without appropriate sanitation. This typically happens when the script embeds user data in the redirection URL of a redirection response (HTTP status code 3xx), or when the script embeds user data in a cookie value or name when the response sets a cookie. HTTP response splitting attacks can be used to perform web cache poisoning and cross-site scripting attacks. HTTP response splitting is the attacker\u2019s ability to send a single HTTP request that forces the webserver to form an output stream, which is then interpreted by the target as two HTTP responses instead of one response.","title":"HTTP Response Splitting Attacks"},{"location":"security/threats_attacks_defences/#cross-site-request-forgery-csrf-or-xsrf","text":"A Cross-Site Request Forgery attack tricks the victim\u2019s browser into issuing a command to a vulnerable web application. Vulnerability is caused by browsers automatically including user authentication data, session ID, IP address, Windows domain credentials, etc. with each request. Attackers typically use CSRF to initiate transactions such as transfer funds, login/logout user, close account, access sensitive data, and change account details. The vulnerability is caused by web browsers that automatically include credentials with each request, even for requests caused by a form, script, or image on another site. CSRF can also be dynamically constructed as part of a payload for a cross-site scripting attack All sites relying on automatic credentials are vulnerable. Popular browsers cannot prevent cross-site request forgery. Logging out of high-value sites as soon as possible can mitigate CSRF risk. It is recommended that a high-value website must require a client to manually provide authentication data in the same HTTP request used to perform any operation with security implications. Limiting the lifetime of session cookies can also reduce the chance of being used by other malicious sites. OWASP recommends website developers include a required security token in HTTP requests associated with sensitive business functions in order to mitigate CSRF attacks","title":"Cross-Site Request Forgery (CSRF or XSRF)"},{"location":"security/threats_attacks_defences/#cross-site-scripting-xss-attacks","text":"Cross-Site Scripting occurs when dynamically generated web pages display user input, such as login information, that is not properly validated, allowing an attacker to embed malicious scripts into the generated page and then execute the script on the machine of any user that views the site. If successful, Cross-Site Scripting vulnerabilities can be exploited to manipulate or steal cookies, create requests that can be mistaken for those of a valid user, compromise confidential information, or execute malicious code on end-user systems. Cross-Site Scripting (XSS or CSS) attacks involve the execution of malicious scripts on the victim\u2019s browser. The victim is simply a user\u2019s host and not the server. XSS results from a failure to validate user input by a web-based application.","title":"Cross-Site Scripting (XSS) Attacks"},{"location":"security/threats_attacks_defences/#document-object-model-dom-xss-attacks","text":"The Document Object Model (DOM) based XSS does not require the webserver to receive the XSS payload for a successful attack. The attacker abuses the runtime by embedding their data on the client-side. An attacker can force the client (browser) to render the page with parts of the DOM controlled by the attacker. When the page is rendered and the data is processed by the page, typically by a client-side HTML-embedded script such as JavaScript, the page\u2019s code may insecurely embed the data in the page itself, thus delivering the cross-site scripting payload. There are several DOM objects which can serve as an attack vehicle for delivering malicious script to victims browser.","title":"Document Object Model (DOM) XSS Attacks"},{"location":"security/threats_attacks_defences/#clickjacking","text":"The technique works by hiding malicious link/scripts under the cover of the content of a legitimate site. Buttons on a website actually contain invisible links, placed there by the attacker. So, an individual who clicks on an object they can visually see is actually being duped into visiting a malicious page or executing a malicious script. When mouseover is used together with clickjacking, the outcome is devastating. Facebook users have been hit by a clickjacking attack, which tricks people into \u201cliking\u201d a particular Facebook page, thus enabling the attack to spread since Memorial Day 2010. There is not yet effective defence against clickjacking, and disabling JavaScript is the only viable method","title":"Clickjacking"},{"location":"security/threats_attacks_defences/#database-attacks-defenses","text":"","title":"DataBase Attacks &amp; Defenses"},{"location":"security/threats_attacks_defences/#sql-injection-attacks","text":"It exploits improper input validation in database queries. A successful exploit will allow attackers to access, modify, or delete information in the database. It permits attackers to steal sensitive information stored within the backend databases of affected websites, which may include such things as user credentials, email addresses, personal information, and credit card numbers SELECT USERNAME,PASSWORD from USERS where USERNAME='<username>' AND PASSWORD='<password>'; Here the username & password is the input provided by the user. Suppose an attacker gives the input as \" OR '1'='1'\" in both fields. Therefore the SQL query will look like: SELECT USERNAME,PASSWORD from USERS where USERNAME='' OR '1'='1' AND PASSOWRD='' OR '1'='1'; This query results in a true statement & the user gets logged in. This example depicts the bost basic type of SQL injection","title":"SQL injection Attacks"},{"location":"security/threats_attacks_defences/#sql-injection-attack-defenses","text":"SQL injection can be protected by filtering the query to eliminate malicious syntax, which involves the employment of some tools in order to (a) scan the source code. In addition, the input fields should be restricted to the absolute minimum, typically anywhere from 7-12 characters, and validate any data, e.g., if a user inputs an age make sure the input is an integer with a maximum of 3 digits.","title":"SQL Injection Attack Defenses"},{"location":"security/threats_attacks_defences/#vpn","text":"A virtual private network (VPN) is a service that offers a secure, reliable connection over a shared public infrastructure such as the Internet. Cisco defines a VPN as an encrypted connection between private networks over a public network. To date, there are three types of VPNs: Remote access Site-to-site Firewall-based","title":"VPN"},{"location":"security/threats_attacks_defences/#security-breach","text":"In spite of the most aggressive steps to protect computers from attacks, attackers sometimes get through. Any event that results in a violation of any of the confidentiality, integrity, or availability (CIA) security tenets is a security breach.","title":"Security Breach"},{"location":"security/threats_attacks_defences/#denial-of-service-attacks","text":"Denial of service (DoS) attacks result in downtime or inability of a user to access a system. DoS attacks impact the availability of tenet of information systems security. A DoS attack is a coordinated attempt to deny service by occupying a computer to perform large amounts of unnecessary tasks. This excessive activity makes the system unavailable to perform legitimate operations Two common types of DoS attacks are as follows: Logic attacks\u2014Logic attacks use software flaws to crash or seriously hinder the performance of remote servers. You can prevent many of these attacks by installing the latest patches to keep your software up to date. Flooding attacks\u2014Flooding attacks overwhelm the victim computer\u2019s CPU, memory, or network resources by sending large numbers of useless requests to the machine. Most DoS attacks target weaknesses in the overall system architecture rather than a software bug or security flaw One popular technique for launching a packet flood is a SYN flood. One of the best defences against DoS attacks is to use intrusion prevention system (IPS) software or devices to detect and stop the attack.","title":"Denial of Service Attacks"},{"location":"security/threats_attacks_defences/#distributed-denial-of-service-attacks","text":"DDoS attacks differ from regular DoS attacks in their scope. In a DDoS attack, attackers hijack hundreds or even thousands of Internet computers, planting automated attack agents on those systems. The attacker then instructs the agents to bombard the target site with forged messages. This overloads the site and blocks legitimate traffic. The key here is strength in numbers. The attacker does more damage by distributing the attack across multiple computers.","title":"Distributed Denial of Service Attacks"},{"location":"security/threats_attacks_defences/#wiretapping","text":"Although the term wiretapping is generally associated with voice telephone communications, attackers can also use wiretapping to intercept data communications. Attackers can tap telephone lines and data communication lines. Wiretapping can be active, where the attacker makes modifications to the line. It can also be passive, where an unauthorized user simply listens to the transmission without changing the contents. Passive intrusion can include the copying of data for a subsequent active attack. Two methods of active wiretapping are as follows: Between-the-lines wiretapping\u2014This type of wiretapping does not alter the messages sent by the legitimate user but inserts additional messages into the communication line when the legitimate user pauses. Piggyback-entry wiretapping\u2014This type of wiretapping intercepts and modifies the original message by breaking the communications line and routing the message to another computer that acts as a host.","title":"Wiretapping"},{"location":"security/threats_attacks_defences/#backdoors","text":"Software developers sometimes include hidden access methods, called backdoors, in their programs. Backdoors give developers or support personnel easy access to a system without having to struggle with security controls. The problem is that backdoors don\u2019t always stay hidden. When an attacker discovers a backdoor, he or she can use it to bypass existing security controls such as passwords, encryption, and so on. Where legitimate users log on through front doors using a user ID and password, attackers use backdoors to bypass these normal access controls.","title":"Backdoors"},{"location":"security/threats_attacks_defences/#malicious-attacks","text":"","title":"Malicious Attacks"},{"location":"security/threats_attacks_defences/#birthday-attack","text":"Once an attacker compromises a hashed password file, a birthday attack is performed. A birthday attack is a type of cryptographic attack that is used to make a brute-force attack of one-way hashes easier. It is a mathematical exploit that is based on the birthday problem in probability theory. Further Reading: https://www.sciencedirect.com/topics/computer-science/birthday-attack https://www.internetsecurity.tips/birthday-attack/","title":"Birthday Attack"},{"location":"security/threats_attacks_defences/#brute-force-password-attacks","text":"In a brute-force password attack, the attacker tries different passwords on a system until one of them is successful. Usually, the attacker employs a software program to try all possible combinations of a likely password, user ID, or security code until it locates a match. This occurs rapidly and in sequence. This type of attack is called a brute-force password attack because the attacker simply hammers away at the code. There is no skill or stealth involved\u2014just brute force that eventually breaks the code. Further Reading: https://owasp.org/www-community/attacks/Brute_force_attack https://owasp.org/www-community/controls/Blocking_Brute_Force_Attacks","title":"Brute-Force Password Attacks"},{"location":"security/threats_attacks_defences/#dictionary-password-attacks","text":"A dictionary password attack is a simple attack that relies on users making poor password choices. In a dictionary password attack, a simple password-cracker program takes all the words from a dictionary file and attempts to log on by entering each dictionary entry as a password. Further Reading: https://capec.mitre.org/data/definitions/16.html","title":"Dictionary Password Attacks"},{"location":"security/threats_attacks_defences/#replay-attacks","text":"Replay attacks involve capturing data packets from a network and retransmitting them to produce an unauthorized effect. The receipt of duplicate, authenticated IP packets may disrupt service or have some other undesired consequence. Systems can be broken through replay attacks when attackers reuse old messages or parts of old messages to deceive system users. This helps intruders to gain information that allows unauthorized access into a system. Further reading: https://study.com/academy/lesson/replay-attack-definition-examples-prevention.html","title":"Replay Attacks"},{"location":"security/threats_attacks_defences/#man-in-the-middle-attacks","text":"A man-in-the-middle attack takes advantage of the multihop process used by many types of networks. In this type of attack, an attacker intercepts messages between two parties before transferring them on to their intended destination. Web spoofing is a type of man-in-the-middle attack in which the user believes a secure session exists with a particular web server. In reality, the secure connection exists only with the attacker, not the webserver. The attacker then establishes a secure connection with the webserver, acting as an invisible go-between. The attacker passes traffic between the user and the webserver. In this way, the attacker can trick the user into supplying passwords, credit card information, and other private data. Further Reading: https://owasp.org/www-community/attacks/Man-in-the-middle_attack","title":"Man-in-the-Middle Attacks"},{"location":"security/threats_attacks_defences/#masquerading","text":"In a masquerade attack, one user or computer pretends to be another user or computer. Masquerade attacks usually include one of the other forms of active attacks, such as IP address spoofing or replaying. Attackers can capture authentication sequences and then replay them later to log on again to an application or operating system. For example, an attacker might monitor usernames and passwords sent to a weak web application. The attacker could then use the intercepted credentials to log on to the web application and impersonate the user. Further Reading: https://dl.acm.org/doi/book/10.5555/2521792 https://ieeexplore.ieee.org/document/1653228","title":"Masquerading"},{"location":"security/threats_attacks_defences/#eavesdropping","text":"Eavesdropping, or sniffing, occurs when a host sets its network interface on promiscuous mode and copies packets that pass by for later analysis. Promiscuous mode enables a network device to intercept and read each network packet(of course given some conditions) given sec, even if the packet\u2019s address doesn\u2019t match the network device. It is possible to attach hardware and software to monitor and analyze all packets on that segment of the transmission media without alerting any other users. Candidates for eavesdropping include satellite, wireless, mobile, and other transmission methods.","title":"Eavesdropping"},{"location":"security/threats_attacks_defences/#social-engineering","text":"Attackers often use a deception technique called social engineering to gain access to resources in an IT infrastructure. In nearly all cases, social engineering involves tricking authorized users into carrying out actions for unauthorized users. The success of social engineering attacks depends on the basic tendency of people to want to be helpful.","title":"Social Engineering"},{"location":"security/threats_attacks_defences/#phreaking","text":"Phone phreaking, or simply phreaking, is a slang term that describes the activity of a subculture of people who study, experiment with, or explore telephone systems, telephone company equipment, and systems connected to public telephone networks. Phreaking is the art of exploiting bugs and glitches that exist in the telephone system.","title":"Phreaking"},{"location":"security/threats_attacks_defences/#phishing","text":"Phishing is a type of fraud in which an attacker attempts to trick the victim into providing private information such as credit card numbers, passwords, dates of birth, bank account numbers, automated teller machine (ATM) PINs, and Social Security numbers.","title":"Phishing"},{"location":"security/threats_attacks_defences/#pharming","text":"Pharming is another type of attack that seeks to obtain personal or private financial information through domain spoofing. A pharming attack doesn\u2019t use messages to trick victims into visiting spoofed websites that appear legitimate, however. Instead, pharming \u201cpoisons\u201d a domain name on the domain name server (DNS), a process known as DNS poisoning. The result is that when a user enters the poisoned server\u2019s web address into his or her address bar, that user navigates to the attacker\u2019s site. The user\u2019s browser still shows the correct website, which makes pharming difficult to detect\u2014and therefore more serious. Where phishing attempts to scam people one at a time with an email or instant message, pharming enables scammers to target large groups of people at one time through domain spoofing.","title":"Pharming"},{"location":"security/writing_secure_code/","text":"PART IV: Writing Secure Code & More The first and most important step in reducing security and reliability issues is to educate developers. However, even the best-trained engineers make mistakes, security experts can write insecure code and SREs can miss reliability issues. It\u2019s difficult to keep the many considerations and tradeoffs involved in building secure and reliable systems in mind simultaneously, especially if you\u2019re also responsible for producing software. Use frameworks to enforce security and reliability while writing code A better approach is to handle security and reliability in common frameworks, languages, and libraries. Ideally, libraries only expose an interface that makes writing code with common classes of security vulnerabilities impossible. Multiple applications can use each library or framework. When domain experts fix an issue, they remove it from all the applications the framework supports, allowing this engineering approach to scale better. Common Security Vulnerabilities In large codebases, a handful of classes account for the majority of security vulnerabilities, despite ongoing efforts to educate developers and introduce code review. OWASP and SANS publish lists of common vulnerability classes Write Simple Code Try to keep your code clean and simple. Avoid Multi-Level Nesting Multilevel nesting is a common anti-pattern that can lead to simple mistakes. If the error is in the most common code path, it will likely be captured by the unit tests. However, unit tests don\u2019t always check error handling paths in multilevel nested code. The error might result in decreased reliability (for example, if the service crashes when it mishandles an error) or a security vulnerability (like a mishandled authorization check error). Eliminate YAGNI Smells Sometimes developers overengineer solutions by adding functionality that may be useful in the future, \u201cjust in case.\u201d This goes against the YAGNI (You Aren\u2019t Gonna Need It) principle, which recommends implementing only the code that you need. YAGNI code adds unnecessary complexity because it needs to be documented, tested, and maintained. To summarize, avoiding YAGNI code leads to improved reliability, and simpler code leads to fewer security bugs, fewer opportunities to make mistakes, and less developer time spent maintaining unused code. Repay Technical Debt It is a common practice for developers to mark places that require further attention with TODO or FIXME annotations. In the short term, this habit can accelerate the delivery velocity for the most critical functionality, and allow a team to meet early deadlines\u2014but it also incurs technical debt. Still, it\u2019s not necessarily a bad practice, as long as you have a clear process (and allocate time) for repaying such debt. Refactoring Refactoring is the most effective way to keep a codebase clean and simple. Even a healthy codebase occasionally needs to be Regardless of the reasons behind refactoring, you should always follow one golden rule: never mix refactoring and functional changes in a single commit to the code repository. Refactoring changes are typically significant and can be difficult to understand. If a commit also includes functional changes, there\u2019s a higher risk that an author or reviewer might overlook bugs. Unit Testing Unit testing can increase system security and reliability by pinpointing a wide range of bugs in individual software components before a release. This technique involves breaking software components into smaller, self-contained \u201cunits\u201d that have no external dependencies, and then testing each unit. Fuzz Testing Fuzz testing is a technique that complements the previously mentioned testing techniques. Fuzzing involves using a fuzzing engine to generate a large number of candidate inputs that are then passed through a fuzz driver to the fuzz target. The fuzzer then analyzes how the system handles the input. Complex inputs handled by all kinds of software are popular targets for fuzzing - for example, file parsers, compression algorithms, network protocol implementation and audio codec. Integration Testing Integration testing moves beyond individual units and abstractions, replacing fake or stubbed-out implementations of abstractions like databases or network services with real implementations. As a result, integration tests exercise more complete code paths. Because you must initialize and configure these other dependencies, integration testing may be slower and flakier than unit testing\u2014to execute the test, this approach incorporates real-world variables like network latency as services communicate end-to-end. As you move from testing individual low-level units of code to testing how they interact when composed together, the net result is a higher degree of confidence that the system is behaving as expected. Last But not the least Code Reviews Rely on Automation Don\u2019t check in Secrets Verifiable Builds","title":"Writing Secure code"},{"location":"security/writing_secure_code/#part-iv-writing-secure-code-more","text":"The first and most important step in reducing security and reliability issues is to educate developers. However, even the best-trained engineers make mistakes, security experts can write insecure code and SREs can miss reliability issues. It\u2019s difficult to keep the many considerations and tradeoffs involved in building secure and reliable systems in mind simultaneously, especially if you\u2019re also responsible for producing software.","title":"PART IV: Writing Secure Code &amp; More"},{"location":"security/writing_secure_code/#use-frameworks-to-enforce-security-and-reliability-while-writing-code","text":"A better approach is to handle security and reliability in common frameworks, languages, and libraries. Ideally, libraries only expose an interface that makes writing code with common classes of security vulnerabilities impossible. Multiple applications can use each library or framework. When domain experts fix an issue, they remove it from all the applications the framework supports, allowing this engineering approach to scale better.","title":"Use frameworks to enforce security and reliability while writing code"},{"location":"security/writing_secure_code/#common-security-vulnerabilities","text":"In large codebases, a handful of classes account for the majority of security vulnerabilities, despite ongoing efforts to educate developers and introduce code review. OWASP and SANS publish lists of common vulnerability classes","title":"Common Security Vulnerabilities"},{"location":"security/writing_secure_code/#write-simple-code","text":"Try to keep your code clean and simple.","title":"Write Simple Code"},{"location":"security/writing_secure_code/#avoid-multi-level-nesting","text":"Multilevel nesting is a common anti-pattern that can lead to simple mistakes. If the error is in the most common code path, it will likely be captured by the unit tests. However, unit tests don\u2019t always check error handling paths in multilevel nested code. The error might result in decreased reliability (for example, if the service crashes when it mishandles an error) or a security vulnerability (like a mishandled authorization check error).","title":"Avoid Multi-Level Nesting"},{"location":"security/writing_secure_code/#eliminate-yagni-smells","text":"Sometimes developers overengineer solutions by adding functionality that may be useful in the future, \u201cjust in case.\u201d This goes against the YAGNI (You Aren\u2019t Gonna Need It) principle, which recommends implementing only the code that you need. YAGNI code adds unnecessary complexity because it needs to be documented, tested, and maintained. To summarize, avoiding YAGNI code leads to improved reliability, and simpler code leads to fewer security bugs, fewer opportunities to make mistakes, and less developer time spent maintaining unused code.","title":"Eliminate YAGNI Smells"},{"location":"security/writing_secure_code/#repay-technical-debt","text":"It is a common practice for developers to mark places that require further attention with TODO or FIXME annotations. In the short term, this habit can accelerate the delivery velocity for the most critical functionality, and allow a team to meet early deadlines\u2014but it also incurs technical debt. Still, it\u2019s not necessarily a bad practice, as long as you have a clear process (and allocate time) for repaying such debt.","title":"Repay Technical Debt"},{"location":"security/writing_secure_code/#refactoring","text":"Refactoring is the most effective way to keep a codebase clean and simple. Even a healthy codebase occasionally needs to be Regardless of the reasons behind refactoring, you should always follow one golden rule: never mix refactoring and functional changes in a single commit to the code repository. Refactoring changes are typically significant and can be difficult to understand. If a commit also includes functional changes, there\u2019s a higher risk that an author or reviewer might overlook bugs.","title":"Refactoring"},{"location":"security/writing_secure_code/#unit-testing","text":"Unit testing can increase system security and reliability by pinpointing a wide range of bugs in individual software components before a release. This technique involves breaking software components into smaller, self-contained \u201cunits\u201d that have no external dependencies, and then testing each unit.","title":"Unit Testing"},{"location":"security/writing_secure_code/#fuzz-testing","text":"Fuzz testing is a technique that complements the previously mentioned testing techniques. Fuzzing involves using a fuzzing engine to generate a large number of candidate inputs that are then passed through a fuzz driver to the fuzz target. The fuzzer then analyzes how the system handles the input. Complex inputs handled by all kinds of software are popular targets for fuzzing - for example, file parsers, compression algorithms, network protocol implementation and audio codec.","title":"Fuzz Testing"},{"location":"security/writing_secure_code/#integration-testing","text":"Integration testing moves beyond individual units and abstractions, replacing fake or stubbed-out implementations of abstractions like databases or network services with real implementations. As a result, integration tests exercise more complete code paths. Because you must initialize and configure these other dependencies, integration testing may be slower and flakier than unit testing\u2014to execute the test, this approach incorporates real-world variables like network latency as services communicate end-to-end. As you move from testing individual low-level units of code to testing how they interact when composed together, the net result is a higher degree of confidence that the system is behaving as expected.","title":"Integration Testing"},{"location":"security/writing_secure_code/#last-but-not-the-least","text":"Code Reviews Rely on Automation Don\u2019t check in Secrets Verifiable Builds","title":"Last But not the least"},{"location":"systems_design/availability/","text":"HA - Availability - Common \u201cNines\u201d Availability is generally expressed as \u201cNines\u201d, common \u2018Nines\u2019 are listed below. Availability % Downtime per year Downtime per month Downtime per week Downtime per day 99%(Two Nines) 3.65 days 7.31 hours 1.68 hours 14.40 minutes 99.5%(Two and a half Nines) 1.83 days 3.65 hours 50.40 minutes 7.20 minutes 99.9%(Three Nines) 8.77 hours 43.83 minutes 10.08 minutes 1.44 minutes 99.95%(Three and a half Nines) 4.38 hours 21.92 minutes 5.04 minutes 43.20 seconds 99.99%(Four Nines) 52.60 minutes 4.38 minutes 1.01 minutes 8.64 seconds 99.995%(Four and a half Nines) 26.30 minutes 2.19 minutes 30.24 seconds 4.32 seconds 99.999%(Five Nines) 5.26 minutes 26.30 seconds 6.05 seconds 864.0 ms Refer https://en.wikipedia.org/wiki/High_availability#Percentage_calculation HA - Availability Serial Components A System with components is operating in the series If the failure of a part leads to the combination becoming inoperable. For example, if LB in our architecture fails, all access to app tiers will fail. LB and app tiers are connected serially. The combined availability of the system is the product of individual components availability A = Ax x Ay x \u2026.. Refer http://www.eventhelix.com/RealtimeMantra/FaultHandling/system_reliability_availability.htm HA - Availability Parallel Components A System with components is operating in parallel If the failure of a part leads to the other part taking over the operations of the failed part. If we have more than one LB and if the rest of the LBs can take over the traffic during one LB failure then LBs are operating in parallel The combined availability of the system is A = 1 - ( (1-Ax) x (1-Ax) x \u2026.. ) Refer http://www.eventhelix.com/RealtimeMantra/FaultHandling/system_reliability_availability.htm HA - Core Principles Elimination of single points of failure (SPOF) This means adding redundancy to the system so that the failure of a component does not mean failure of the entire system. Reliable crossover In redundant systems, the crossover point itself tends to become a single point of failure. Reliable systems must provide for reliable crossover. Detection of failures as they occur If the two principles above are observed, then a user may never see a failure Refer https://en.wikipedia.org/wiki/High_availability#Principles HA - SPOF WHAT: Never implement and always eliminate single points of failure. WHEN TO USE: During architecture reviews and new designs. HOW TO USE: Identify single instances on architectural diagrams. Strive for active/active configurations. At the very least we should have a standby to take control when active instances fail. WHY: Maximize availability through multiple instances. KEY TAKEAWAYS: Strive for active/active rather than active/passive solutions. Use load balancers to balance traffic across instances of a service. Use control services with active/passive instances for patterns that require singletons. HA - Reliable Crossover WHAT: Ensure when system components failover they do so reliably. WHEN TO USE: During architecture reviews, failure modeling, and designs. HOW TO USE: Identify how available a system is during the crossover and ensure it is within acceptable limits. WHY: Maximize availability and ensure data handling semantics are preserved. KEY TAKEAWAYS: Strive for active/active rather than active/passive solutions, they have a lesser risk of cross over being unreliable. Use LB and the right load balancing methods to ensure reliable failover. Model and build your data systems to ensure data is correctly handled when crossover happens. Generally, DB systems follow active/passive semantics for writes. Masters accept writes and when the master goes down, the follower is promoted to master(active from being passive) to accept writes. We have to be careful here that the cutover never introduces more than one master. This problem is called a split brain. Applications in SRE role SRE works on deciding an acceptable SLA and make sure the system is available to achieve the SLA SRE is involved in architecture design right from building the data center to make sure the site is not affected by a network switch, hardware, power, or software failures SRE also run mock drills of failures to see how the system behaves in uncharted territory and comes up with a plan to improve availability if there are misses. https://engineering.linkedin.com/blog/2017/11/resilience-engineering-at-linkedin-with-project-waterbear Post our understanding about HA, our architecture diagram looks something like this below","title":"Availability"},{"location":"systems_design/availability/#ha-availability-common-nines","text":"Availability is generally expressed as \u201cNines\u201d, common \u2018Nines\u2019 are listed below. Availability % Downtime per year Downtime per month Downtime per week Downtime per day 99%(Two Nines) 3.65 days 7.31 hours 1.68 hours 14.40 minutes 99.5%(Two and a half Nines) 1.83 days 3.65 hours 50.40 minutes 7.20 minutes 99.9%(Three Nines) 8.77 hours 43.83 minutes 10.08 minutes 1.44 minutes 99.95%(Three and a half Nines) 4.38 hours 21.92 minutes 5.04 minutes 43.20 seconds 99.99%(Four Nines) 52.60 minutes 4.38 minutes 1.01 minutes 8.64 seconds 99.995%(Four and a half Nines) 26.30 minutes 2.19 minutes 30.24 seconds 4.32 seconds 99.999%(Five Nines) 5.26 minutes 26.30 seconds 6.05 seconds 864.0 ms","title":"HA - Availability - Common \u201cNines\u201d"},{"location":"systems_design/availability/#refer","text":"https://en.wikipedia.org/wiki/High_availability#Percentage_calculation","title":"Refer"},{"location":"systems_design/availability/#ha-availability-serial-components","text":"A System with components is operating in the series If the failure of a part leads to the combination becoming inoperable. For example, if LB in our architecture fails, all access to app tiers will fail. LB and app tiers are connected serially. The combined availability of the system is the product of individual components availability A = Ax x Ay x \u2026..","title":"HA - Availability Serial Components"},{"location":"systems_design/availability/#refer_1","text":"http://www.eventhelix.com/RealtimeMantra/FaultHandling/system_reliability_availability.htm","title":"Refer"},{"location":"systems_design/availability/#ha-availability-parallel-components","text":"A System with components is operating in parallel If the failure of a part leads to the other part taking over the operations of the failed part. If we have more than one LB and if the rest of the LBs can take over the traffic during one LB failure then LBs are operating in parallel The combined availability of the system is A = 1 - ( (1-Ax) x (1-Ax) x \u2026.. )","title":"HA - Availability Parallel Components"},{"location":"systems_design/availability/#refer_2","text":"http://www.eventhelix.com/RealtimeMantra/FaultHandling/system_reliability_availability.htm","title":"Refer"},{"location":"systems_design/availability/#ha-core-principles","text":"Elimination of single points of failure (SPOF) This means adding redundancy to the system so that the failure of a component does not mean failure of the entire system. Reliable crossover In redundant systems, the crossover point itself tends to become a single point of failure. Reliable systems must provide for reliable crossover. Detection of failures as they occur If the two principles above are observed, then a user may never see a failure","title":"HA - Core Principles"},{"location":"systems_design/availability/#refer_3","text":"https://en.wikipedia.org/wiki/High_availability#Principles","title":"Refer"},{"location":"systems_design/availability/#ha-spof","text":"WHAT: Never implement and always eliminate single points of failure. WHEN TO USE: During architecture reviews and new designs. HOW TO USE: Identify single instances on architectural diagrams. Strive for active/active configurations. At the very least we should have a standby to take control when active instances fail. WHY: Maximize availability through multiple instances. KEY TAKEAWAYS: Strive for active/active rather than active/passive solutions. Use load balancers to balance traffic across instances of a service. Use control services with active/passive instances for patterns that require singletons.","title":"HA - SPOF"},{"location":"systems_design/availability/#ha-reliable-crossover","text":"WHAT: Ensure when system components failover they do so reliably. WHEN TO USE: During architecture reviews, failure modeling, and designs. HOW TO USE: Identify how available a system is during the crossover and ensure it is within acceptable limits. WHY: Maximize availability and ensure data handling semantics are preserved. KEY TAKEAWAYS: Strive for active/active rather than active/passive solutions, they have a lesser risk of cross over being unreliable. Use LB and the right load balancing methods to ensure reliable failover. Model and build your data systems to ensure data is correctly handled when crossover happens. Generally, DB systems follow active/passive semantics for writes. Masters accept writes and when the master goes down, the follower is promoted to master(active from being passive) to accept writes. We have to be careful here that the cutover never introduces more than one master. This problem is called a split brain.","title":"HA - Reliable Crossover"},{"location":"systems_design/availability/#applications-in-sre-role","text":"SRE works on deciding an acceptable SLA and make sure the system is available to achieve the SLA SRE is involved in architecture design right from building the data center to make sure the site is not affected by a network switch, hardware, power, or software failures SRE also run mock drills of failures to see how the system behaves in uncharted territory and comes up with a plan to improve availability if there are misses. https://engineering.linkedin.com/blog/2017/11/resilience-engineering-at-linkedin-with-project-waterbear Post our understanding about HA, our architecture diagram looks something like this below","title":"Applications in SRE role"},{"location":"systems_design/conclusion/","text":"Conclusion Armed with these principles, we hope the course will give a fresh perspective to design software systems. It might be over-engineering to get all this on day zero. But some are really important from day 0 like eliminating single points of failure, making scalable services by just increasing replicas. As a bottleneck is reached, we can split code by services, shard data to scale. As the organization matures, bringing in chaos engineering to measure how systems react to failure will help in designing robust software systems.","title":"Conclusion"},{"location":"systems_design/conclusion/#conclusion","text":"Armed with these principles, we hope the course will give a fresh perspective to design software systems. It might be over-engineering to get all this on day zero. But some are really important from day 0 like eliminating single points of failure, making scalable services by just increasing replicas. As a bottleneck is reached, we can split code by services, shard data to scale. As the organization matures, bringing in chaos engineering to measure how systems react to failure will help in designing robust software systems.","title":"Conclusion"},{"location":"systems_design/fault-tolerance/","text":"Fault Tolerance Failures are not avoidable in any system and will happen all the time, hence we need to build systems that can tolerate failures or recover from them. In systems, failure is the norm rather than the exception. \"Anything that can go wrong will go wrong\u201d -- Murphy\u2019s Law \u201cComplex systems contain changing mixtures of failures latent within them\u201d -- How Complex Systems Fail. Fault Tolerance - Failure Metrics Common failure metrics that get measured and tracked for any system. Mean time to repair (MTTR): The average time to repair and restore a failed system. Mean time between failures (MTBF): The average operational time between one device failure or system breakdown and the next. Mean time to failure (MTTF): The average time a device or system is expected to function before it fails. Mean time to detect (MTTD): The average time between the onset of a problem and when the organization detects it. Mean time to investigate (MTTI): The average time between the detection of an incident and when the organization begins to investigate its cause and solution. Mean time to restore service (MTRS): The average elapsed time from the detection of an incident until the affected system or component is again available to users. Mean time between system incidents (MTBSI): The average elapsed time between the detection of two consecutive incidents. MTBSI can be calculated by adding MTBF and MTRS (MTBSI = MTBF + MTRS). Failure rate: Another reliability metric, which measures the frequency with which a component or system fails. It is expressed as a number of failures over a unit of time. Refer https://www.splunk.com/en_us/data-insider/what-is-mean-time-to-repair.html Fault Tolerance - Fault Isolation Terms Systems should have a short circuit. Say in our content sharing system, if \u201cNotifications\u201d is not working, the site should gracefully handle that failure by removing the functionality instead of taking the whole site down. Swimlane is one of the commonly used fault isolation methodologies. Swimlane adds a barrier to the service from other services so that failure on either of them won\u2019t affect the other. Say we roll out a new feature \u2018Advertisement\u2019 in our content sharing app. We can have two architectures If Ads are generated on the fly synchronously during each Newsfeed request, the faults in the Ads feature get propagated to the Newsfeed feature. Instead if we swimlane the \u201cGeneration of Ads\u201d service and use a shared storage to populate Newsfeed App, Ads failures won\u2019t cascade to Newsfeed, and worst case if Ads don\u2019t meet SLA , we can have Newsfeed without Ads. Let's take another example, we have come up with a new model for our Content sharing App. Here we roll out an enterprise content sharing App where enterprises pay for the service and the content should never be shared outside the enterprise. Swimlane Principles Principle 1: Nothing is shared (also known as \u201cshare as little as possible\u201d). The less that is shared within a swim lane, the more fault isolative the swim lane becomes. (as shown in Enterprise use-case) Principle 2: Nothing crosses a swim lane boundary. Synchronous (defined by expecting a request\u2014not the transfer protocol) communication never crosses a swim lane boundary; if it does, the boundary is drawn incorrectly. (as shown in Ads feature) Swimlane Approaches Approach 1: Swim lane the money-maker. Never allow your cash register to be compromised by other systems. (Tier 1 vs Tier 2 in enterprise use case) Approach 2: Swim lane the biggest sources of incidents. Identify the recurring causes of pain and isolate them. (if Ads feature is in code yellow, swim laning it is the best option) Approach 3: Swim lane natural barriers. Customer boundaries make good swim lanes. (Public vs Enterprise customers) Refer https://learning.oreilly.com/library/view/the-art-of/9780134031408/ch21.html#ch21 Applications in SRE role Work with the DC tech or cloud team to distribute infrastructure such that its immune to switch or power failures by creating fault zones within a Data Center https://docs.microsoft.com/en-us/azure/virtual-machines/manage-availability#use-availability-zones-to-protect-from-datacenter-level-failures Work with the partners and design interaction between services such that one service breakdown is not amplified in a cascading fashion to all upstreams","title":"Fault Tolerance"},{"location":"systems_design/fault-tolerance/#fault-tolerance","text":"Failures are not avoidable in any system and will happen all the time, hence we need to build systems that can tolerate failures or recover from them. In systems, failure is the norm rather than the exception. \"Anything that can go wrong will go wrong\u201d -- Murphy\u2019s Law \u201cComplex systems contain changing mixtures of failures latent within them\u201d -- How Complex Systems Fail.","title":"Fault Tolerance"},{"location":"systems_design/fault-tolerance/#fault-tolerance-failure-metrics","text":"Common failure metrics that get measured and tracked for any system. Mean time to repair (MTTR): The average time to repair and restore a failed system. Mean time between failures (MTBF): The average operational time between one device failure or system breakdown and the next. Mean time to failure (MTTF): The average time a device or system is expected to function before it fails. Mean time to detect (MTTD): The average time between the onset of a problem and when the organization detects it. Mean time to investigate (MTTI): The average time between the detection of an incident and when the organization begins to investigate its cause and solution. Mean time to restore service (MTRS): The average elapsed time from the detection of an incident until the affected system or component is again available to users. Mean time between system incidents (MTBSI): The average elapsed time between the detection of two consecutive incidents. MTBSI can be calculated by adding MTBF and MTRS (MTBSI = MTBF + MTRS). Failure rate: Another reliability metric, which measures the frequency with which a component or system fails. It is expressed as a number of failures over a unit of time.","title":"Fault Tolerance - Failure Metrics"},{"location":"systems_design/fault-tolerance/#refer","text":"https://www.splunk.com/en_us/data-insider/what-is-mean-time-to-repair.html","title":"Refer"},{"location":"systems_design/fault-tolerance/#fault-tolerance-fault-isolation-terms","text":"Systems should have a short circuit. Say in our content sharing system, if \u201cNotifications\u201d is not working, the site should gracefully handle that failure by removing the functionality instead of taking the whole site down. Swimlane is one of the commonly used fault isolation methodologies. Swimlane adds a barrier to the service from other services so that failure on either of them won\u2019t affect the other. Say we roll out a new feature \u2018Advertisement\u2019 in our content sharing app. We can have two architectures If Ads are generated on the fly synchronously during each Newsfeed request, the faults in the Ads feature get propagated to the Newsfeed feature. Instead if we swimlane the \u201cGeneration of Ads\u201d service and use a shared storage to populate Newsfeed App, Ads failures won\u2019t cascade to Newsfeed, and worst case if Ads don\u2019t meet SLA , we can have Newsfeed without Ads. Let's take another example, we have come up with a new model for our Content sharing App. Here we roll out an enterprise content sharing App where enterprises pay for the service and the content should never be shared outside the enterprise.","title":"Fault Tolerance - Fault Isolation Terms"},{"location":"systems_design/fault-tolerance/#swimlane-principles","text":"Principle 1: Nothing is shared (also known as \u201cshare as little as possible\u201d). The less that is shared within a swim lane, the more fault isolative the swim lane becomes. (as shown in Enterprise use-case) Principle 2: Nothing crosses a swim lane boundary. Synchronous (defined by expecting a request\u2014not the transfer protocol) communication never crosses a swim lane boundary; if it does, the boundary is drawn incorrectly. (as shown in Ads feature)","title":"Swimlane Principles"},{"location":"systems_design/fault-tolerance/#swimlane-approaches","text":"Approach 1: Swim lane the money-maker. Never allow your cash register to be compromised by other systems. (Tier 1 vs Tier 2 in enterprise use case) Approach 2: Swim lane the biggest sources of incidents. Identify the recurring causes of pain and isolate them. (if Ads feature is in code yellow, swim laning it is the best option) Approach 3: Swim lane natural barriers. Customer boundaries make good swim lanes. (Public vs Enterprise customers)","title":"Swimlane Approaches"},{"location":"systems_design/fault-tolerance/#refer_1","text":"https://learning.oreilly.com/library/view/the-art-of/9780134031408/ch21.html#ch21","title":"Refer"},{"location":"systems_design/fault-tolerance/#applications-in-sre-role","text":"Work with the DC tech or cloud team to distribute infrastructure such that its immune to switch or power failures by creating fault zones within a Data Center https://docs.microsoft.com/en-us/azure/virtual-machines/manage-availability#use-availability-zones-to-protect-from-datacenter-level-failures Work with the partners and design interaction between services such that one service breakdown is not amplified in a cascading fashion to all upstreams","title":"Applications in SRE role"},{"location":"systems_design/intro/","text":"Systems Design Prerequisites Fundamentals of common software system components: Linux Basics Linux Networking Databases RDBMS NoSQL Concepts What to expect from this course Thinking about and designing for scalability, availability, and reliability of large scale software systems. What is not covered under this course Individual software components\u2019 scalability and reliability concerns like e.g. Databases, while the same scalability principles and thinking can be applied, these individual components have their own specific nuances when scaling them and thinking about their reliability. More light will be shed on concepts rather than on setting up and configuring components like Loadbalancers to achieve scalability, availability, and reliability of systems Course Contents Introduction Scalability High Availability Fault Tolerance Introduction So, how do you go about learning to design a system? \u201d Like most great questions, it showed a level of naivety that was breathtaking. The only short answer I could give was, essentially, that you learned how to design a system by designing systems and finding out what works and what doesn\u2019t work.\u201d Jim Waldo, Sun Microsystems, On System Design As software and hardware systems have multiple moving parts, we need to think about how those parts will grow, their failure modes, their inter-dependencies, how it will impact the users and the business. There is no one-shot method or way to learn or do system design, we only learn to design systems by designing and iterating on them. This course will be a starter to make one think about scalability, availability, and fault tolerance during systems design. Backstory Let\u2019s design a simple content sharing application where users can share photos, media in our application which can be liked by their friends. Let\u2019s start with a simple design of the application and evolve it as we learn system design concepts","title":"Introduction"},{"location":"systems_design/intro/#systems-design","text":"","title":"Systems Design"},{"location":"systems_design/intro/#prerequisites","text":"Fundamentals of common software system components: Linux Basics Linux Networking Databases RDBMS NoSQL Concepts","title":"Prerequisites"},{"location":"systems_design/intro/#what-to-expect-from-this-course","text":"Thinking about and designing for scalability, availability, and reliability of large scale software systems.","title":"What to expect from this course"},{"location":"systems_design/intro/#what-is-not-covered-under-this-course","text":"Individual software components\u2019 scalability and reliability concerns like e.g. Databases, while the same scalability principles and thinking can be applied, these individual components have their own specific nuances when scaling them and thinking about their reliability. More light will be shed on concepts rather than on setting up and configuring components like Loadbalancers to achieve scalability, availability, and reliability of systems","title":"What is not covered under this course"},{"location":"systems_design/intro/#course-contents","text":"Introduction Scalability High Availability Fault Tolerance","title":"Course Contents"},{"location":"systems_design/intro/#introduction","text":"So, how do you go about learning to design a system? \u201d Like most great questions, it showed a level of naivety that was breathtaking. The only short answer I could give was, essentially, that you learned how to design a system by designing systems and finding out what works and what doesn\u2019t work.\u201d Jim Waldo, Sun Microsystems, On System Design As software and hardware systems have multiple moving parts, we need to think about how those parts will grow, their failure modes, their inter-dependencies, how it will impact the users and the business. There is no one-shot method or way to learn or do system design, we only learn to design systems by designing and iterating on them. This course will be a starter to make one think about scalability, availability, and fault tolerance during systems design.","title":"Introduction"},{"location":"systems_design/intro/#backstory","text":"Let\u2019s design a simple content sharing application where users can share photos, media in our application which can be liked by their friends. Let\u2019s start with a simple design of the application and evolve it as we learn system design concepts","title":"Backstory"},{"location":"systems_design/scalability/","text":"Scalability What does scalability mean for a system/service? A system is composed of services/components, each service/component scalability needs to be tackled separately, and the scalability of the system as a whole. A service is said to be scalable if, as resources are added to the system, it results in increased performance in a manner proportional to resources added An always-on service is said to be scalable if adding resources to facilitate redundancy does not result in a loss of performance Refer https://www.allthingsdistributed.com/2006/03/a_word_on_scalability.html Scalability - AKF Scale Cube The Scale Cube is a model for segmenting services, defining microservices, and scaling products. It also creates a common language for teams to discuss scale related options in designing solutions. The following section talks about certain scaling patterns based on our inferences from the AKF cube Scalability - Horizontal scaling Horizontal scaling stands for cloning of an application or service such that work can easily be distributed across instances with absolutely no bias. Let's see how our monolithic application improves with this principle Here DB is scaled separately from the application. This is to let you know each component\u2019s scaling capabilities can be different. Usually, web applications can be scaled by adding resources unless there is no state stored inside the application. But DBs can be scaled only for Reads by adding more followers but Writes have to go to only one master to make sure data is consistent. There are some DBs that support multi-master writes but we are keeping them out of scope at this point. Apps should be able to differentiate between Reads and Writes to choose appropriate DB servers. Load balancers can split traffic between identical servers transparently. WHAT: Duplication of services or databases to spread transaction load. WHEN TO USE: Databases with a very high read-to-write ratio (5:1 or greater\u2014the higher the better). Because only read replicas of DBs can be scaled, not the Master. HOW TO USE: Simply clone services and implement a load balancer. For databases, ensure that the accessing code understands the difference between a read and a write. WHY: Allows for the fast scale of transactions at the cost of duplicated data and functionality. KEY TAKEAWAYS: This is fast to implement, is a low cost from a developer effort perspective, and can scale transaction volumes nicely. However, they tend to be high cost from the perspective of the operational cost of data. The cost here means if we have 3 followers and 1 Master DB, the same database will be stored as 4 copies in the 4 servers. Hence added storage cost Refer https://learning.oreilly.com/library/view/the-art-of/9780134031408/ch23.html Scalability Pattern - Load Balancing Improves the distribution of workloads across multiple computing resources, such as computers, a computer cluster, network links, central processing units, or disk drives. A commonly used technique is load balancing traffic across identical server clusters. A similar philosophy is used to load balance traffic across network links by ECMP , disk drives by RAID ,etc Aims to optimize resource use, maximize throughput, minimize response time, and avoid overload of any single resource. Using multiple components with load balancing instead of a single component may increase reliability and availability through redundancy. In our updated architecture diagram we have 4 servers to handle app traffic instead of a single server The device or system that performs load balancing is called a load balancer, abbreviated as LB. Refer https://en.wikipedia.org/wiki/Load_balancing_(computing) https://blog.envoyproxy.io/introduction-to-modern-network-load-balancing-and-proxying-a57f6ff80236 https://learning.oreilly.com/library/view/load-balancing-in/9781492038009/ https://learning.oreilly.com/library/view/practical-load-balancing/9781430236801/ http://shop.oreilly.com/product/9780596000509.do Scalability Pattern - LB Tasks What does an LB do? Service discovery: What backends are available in the system? In our architecture, 4 servers are available to serve App traffic. LB acts as a single endpoint that clients can use transparently to reach one of the 4 servers. Health checking: What backends are currently healthy and available to accept requests? If one out of the 4 App servers turns bad, LB should automatically short circuit the path so that clients don\u2019t sense any application downtime Load balancing: What algorithm should be used to balance individual requests across the healthy backends? There are many algorithms to distribute traffic across one of the four servers. Based on observations/experience, SRE can pick the algorithm that suits their pattern Scalability Pattern - LB Methods Common Load Balancing Methods Least Connection Method directs traffic to the server with the fewest active connections. Most useful when there are a large number of persistent connections in the traffic unevenly distributed between the servers. Works if clients maintain long-lived connections Least Response Time Method directs traffic to the server with the fewest active connections and the lowest average response time. Here response time is used to provide feedback of the server\u2019s health Round Robin Method rotates servers by directing traffic to the first available server and then moves that server to the bottom of the queue. Most useful when servers are of equal specification and there are not many persistent connections. IP Hash the IP address of the client determines which server receives the request. This can sometimes cause skewness in distribution but is useful if apps store some state locally and need some stickiness More advanced client/server-side example techniques - https://docs.nginx.com/nginx/admin-guide/load-balancer/ - http://cbonte.github.io/haproxy-dconv/2.2/intro.html#3.3.5 - https://twitter.github.io/finagle/guide/Clients.html#load-balancing Scalability Pattern - Caching - Content Delivery Networks (CDN) CDNs are added closer to the client\u2019s location. If the app has static data like images, Javascript, CSS which don\u2019t change very often, they can be cached. Since our example is a content sharing site, static content can be cached in CDNs with a suitable expiry. WHAT: Use CDNs (content delivery networks) to offload traffic from your site. WHEN TO USE: When speed improvements and scale warrant the additional cost. HOW TO USE: Most CDNs leverage DNS to serve content on your site\u2019s behalf. Thus you may need to make minor DNS changes or additions and move content to be served from new subdomains. Eg media-exp1.licdn.com is a domain used by Linkedin to serve static content Here a CNAME points the domain to the DNS of the CDN provider dig media-exp1.licdn.com +short 2-01-2c3e-005c.cdx.cedexis.net. WHY: CDNs help offload traffic spikes and are often economical ways to scale parts of a site\u2019s traffic. They also often substantially improve page download times. KEY TAKEAWAYS: CDNs are a fast and simple way to offset the spikiness of traffic as well as traffic growth in general. Make sure you perform a cost-benefit analysis and monitor the CDN usage. If CDNs have a lot of cache misses, then we don\u2019t gain much from CDN and are still serving requests using our compute resources. Scalability - Microservices This pattern represents the separation of work by service or function within the application. Microservices are meant to address the issues associated with growth and complexity in the code base and data sets. The intent is to create fault isolation as well as to reduce response times. Microservices can scale transactions, data sizes, and codebase sizes. They are most effective in scaling the size and complexity of your codebase. They tend to cost a bit more than horizontal scaling because the engineering team needs to rewrite services or, at the very least, disaggregate them from the original monolithic application. WHAT: Sometimes referred to as scale through services or resources, this rule focuses on scaling by splitting data sets, transactions, and engineering teams along verb (services) or noun (resources) boundaries. WHEN TO USE: Very large data sets where relations between data are not necessary. Large, complex systems where scaling engineering resources requires specialization. HOW TO USE: Split up actions by using verbs, or resources by using nouns, or use a mix. Split both the services and the data along the lines defined by the verb/noun approach. WHY: Allows for efficient scaling of not only transactions but also very large data sets associated with those transactions. It also allows for the efficient scaling of teams. KEY TAKEAWAYS: Microservices allow for efficient scaling of transactions, large data sets, and can help with fault isolation. It helps reduce the communication overhead of teams. The codebase becomes less complex as disjoint features are decoupled and spun as new services thereby letting each service scale independently specific to its requirement. Refer https://learning.oreilly.com/library/view/the-art-of/9780134031408/ch23.html Scalability - Sharding This pattern represents the separation of work based on attributes that are looked up to or determined at the time of the transaction. Most often, these are implemented as splits by requestor, customer, or client. Very often, a lookup service or deterministic algorithm will need to be written for these types of splits. Sharding aids in scaling transaction growth, scaling instruction sets, and decreasing processing time (the last by limiting the data necessary to perform any transaction). This is more effective at scaling growth in customers or clients. It can aid with disaster recovery efforts, and limit the impact of incidents to only a specific segment of customers. Here the auth data is sharded based on user names so that DBs can respond faster as the amount of data DBs have to work on has drastically reduced during queries. There can be other ways to split Here the whole data center is split and replicated and clients are directed to a data center based on their geography. This helps in improving performance as clients are directed to the closest data center and performance increases as we add more data centers. There are some replication and consistency overhead with this approach one needs to be aware of. This also gives fault tolerance by rolling out test features to one site and rollback if there is an impact to that geography WHAT: This is very often a split by some unique aspect of the customer such as customer ID, name, geography, and so on. WHEN TO USE: Very large, similar data sets such as large and rapidly growing customer bases or when the response time for a geographically distributed customer base is important. HOW TO USE: Identify something you know about the customer, such as customer ID, last name, geography, or device, and split or partition both data and services based on that attribute. WHY: Rapid customer growth exceeds other forms of data growth, or you have the need to perform fault isolation between certain customer groups as you scale. KEY TAKEAWAYS: Shards are effective at helping you to scale customer bases but can also be applied to other very large data sets that can\u2019t be pulled apart using the microservices methodology. Refer https://learning.oreilly.com/library/view/the-art-of/9780134031408/ch23.html Applications in SRE role SREs in coordination with the network team work on how to map users' traffic to a particular site. https://engineering.linkedin.com/blog/2017/05/trafficshift--load-testing-at-scale SREs work closely with the Dev team to split monoliths to multiple microservices that are easy to run and manage SREs work on improving Load Balancers' reliability, service discovery, and performance SREs work closely to split Data into shards and manage data integrity and consistency. https://engineering.linkedin.com/espresso/introducing-espresso-linkedins-hot-new-distributed-document-store SREs work to set up, configure, and improve the CDN cache hit rate.","title":"Scalability"},{"location":"systems_design/scalability/#scalability","text":"What does scalability mean for a system/service? A system is composed of services/components, each service/component scalability needs to be tackled separately, and the scalability of the system as a whole. A service is said to be scalable if, as resources are added to the system, it results in increased performance in a manner proportional to resources added An always-on service is said to be scalable if adding resources to facilitate redundancy does not result in a loss of performance","title":"Scalability"},{"location":"systems_design/scalability/#refer","text":"https://www.allthingsdistributed.com/2006/03/a_word_on_scalability.html","title":"Refer"},{"location":"systems_design/scalability/#scalability-akf-scale-cube","text":"The Scale Cube is a model for segmenting services, defining microservices, and scaling products. It also creates a common language for teams to discuss scale related options in designing solutions. The following section talks about certain scaling patterns based on our inferences from the AKF cube","title":"Scalability - AKF Scale Cube"},{"location":"systems_design/scalability/#scalability-horizontal-scaling","text":"Horizontal scaling stands for cloning of an application or service such that work can easily be distributed across instances with absolutely no bias. Let's see how our monolithic application improves with this principle Here DB is scaled separately from the application. This is to let you know each component\u2019s scaling capabilities can be different. Usually, web applications can be scaled by adding resources unless there is no state stored inside the application. But DBs can be scaled only for Reads by adding more followers but Writes have to go to only one master to make sure data is consistent. There are some DBs that support multi-master writes but we are keeping them out of scope at this point. Apps should be able to differentiate between Reads and Writes to choose appropriate DB servers. Load balancers can split traffic between identical servers transparently. WHAT: Duplication of services or databases to spread transaction load. WHEN TO USE: Databases with a very high read-to-write ratio (5:1 or greater\u2014the higher the better). Because only read replicas of DBs can be scaled, not the Master. HOW TO USE: Simply clone services and implement a load balancer. For databases, ensure that the accessing code understands the difference between a read and a write. WHY: Allows for the fast scale of transactions at the cost of duplicated data and functionality. KEY TAKEAWAYS: This is fast to implement, is a low cost from a developer effort perspective, and can scale transaction volumes nicely. However, they tend to be high cost from the perspective of the operational cost of data. The cost here means if we have 3 followers and 1 Master DB, the same database will be stored as 4 copies in the 4 servers. Hence added storage cost","title":"Scalability - Horizontal scaling"},{"location":"systems_design/scalability/#refer_1","text":"https://learning.oreilly.com/library/view/the-art-of/9780134031408/ch23.html","title":"Refer"},{"location":"systems_design/scalability/#scalability-pattern-load-balancing","text":"Improves the distribution of workloads across multiple computing resources, such as computers, a computer cluster, network links, central processing units, or disk drives. A commonly used technique is load balancing traffic across identical server clusters. A similar philosophy is used to load balance traffic across network links by ECMP , disk drives by RAID ,etc Aims to optimize resource use, maximize throughput, minimize response time, and avoid overload of any single resource. Using multiple components with load balancing instead of a single component may increase reliability and availability through redundancy. In our updated architecture diagram we have 4 servers to handle app traffic instead of a single server The device or system that performs load balancing is called a load balancer, abbreviated as LB.","title":"Scalability Pattern - Load Balancing"},{"location":"systems_design/scalability/#refer_2","text":"https://en.wikipedia.org/wiki/Load_balancing_(computing) https://blog.envoyproxy.io/introduction-to-modern-network-load-balancing-and-proxying-a57f6ff80236 https://learning.oreilly.com/library/view/load-balancing-in/9781492038009/ https://learning.oreilly.com/library/view/practical-load-balancing/9781430236801/ http://shop.oreilly.com/product/9780596000509.do","title":"Refer"},{"location":"systems_design/scalability/#scalability-pattern-lb-tasks","text":"What does an LB do?","title":"Scalability Pattern - LB Tasks"},{"location":"systems_design/scalability/#service-discovery","text":"What backends are available in the system? In our architecture, 4 servers are available to serve App traffic. LB acts as a single endpoint that clients can use transparently to reach one of the 4 servers.","title":"Service discovery:"},{"location":"systems_design/scalability/#health-checking","text":"What backends are currently healthy and available to accept requests? If one out of the 4 App servers turns bad, LB should automatically short circuit the path so that clients don\u2019t sense any application downtime","title":"Health checking:"},{"location":"systems_design/scalability/#load-balancing","text":"What algorithm should be used to balance individual requests across the healthy backends? There are many algorithms to distribute traffic across one of the four servers. Based on observations/experience, SRE can pick the algorithm that suits their pattern","title":"Load balancing:"},{"location":"systems_design/scalability/#scalability-pattern-lb-methods","text":"Common Load Balancing Methods","title":"Scalability Pattern - LB Methods"},{"location":"systems_design/scalability/#least-connection-method","text":"directs traffic to the server with the fewest active connections. Most useful when there are a large number of persistent connections in the traffic unevenly distributed between the servers. Works if clients maintain long-lived connections","title":"Least Connection Method"},{"location":"systems_design/scalability/#least-response-time-method","text":"directs traffic to the server with the fewest active connections and the lowest average response time. Here response time is used to provide feedback of the server\u2019s health","title":"Least Response Time Method"},{"location":"systems_design/scalability/#round-robin-method","text":"rotates servers by directing traffic to the first available server and then moves that server to the bottom of the queue. Most useful when servers are of equal specification and there are not many persistent connections.","title":"Round Robin Method"},{"location":"systems_design/scalability/#ip-hash","text":"the IP address of the client determines which server receives the request. This can sometimes cause skewness in distribution but is useful if apps store some state locally and need some stickiness More advanced client/server-side example techniques - https://docs.nginx.com/nginx/admin-guide/load-balancer/ - http://cbonte.github.io/haproxy-dconv/2.2/intro.html#3.3.5 - https://twitter.github.io/finagle/guide/Clients.html#load-balancing","title":"IP Hash"},{"location":"systems_design/scalability/#scalability-pattern-caching-content-delivery-networks-cdn","text":"CDNs are added closer to the client\u2019s location. If the app has static data like images, Javascript, CSS which don\u2019t change very often, they can be cached. Since our example is a content sharing site, static content can be cached in CDNs with a suitable expiry. WHAT: Use CDNs (content delivery networks) to offload traffic from your site. WHEN TO USE: When speed improvements and scale warrant the additional cost. HOW TO USE: Most CDNs leverage DNS to serve content on your site\u2019s behalf. Thus you may need to make minor DNS changes or additions and move content to be served from new subdomains. Eg media-exp1.licdn.com is a domain used by Linkedin to serve static content Here a CNAME points the domain to the DNS of the CDN provider dig media-exp1.licdn.com +short 2-01-2c3e-005c.cdx.cedexis.net. WHY: CDNs help offload traffic spikes and are often economical ways to scale parts of a site\u2019s traffic. They also often substantially improve page download times. KEY TAKEAWAYS: CDNs are a fast and simple way to offset the spikiness of traffic as well as traffic growth in general. Make sure you perform a cost-benefit analysis and monitor the CDN usage. If CDNs have a lot of cache misses, then we don\u2019t gain much from CDN and are still serving requests using our compute resources.","title":"Scalability Pattern - Caching - Content Delivery Networks (CDN)"},{"location":"systems_design/scalability/#scalability-microservices","text":"This pattern represents the separation of work by service or function within the application. Microservices are meant to address the issues associated with growth and complexity in the code base and data sets. The intent is to create fault isolation as well as to reduce response times. Microservices can scale transactions, data sizes, and codebase sizes. They are most effective in scaling the size and complexity of your codebase. They tend to cost a bit more than horizontal scaling because the engineering team needs to rewrite services or, at the very least, disaggregate them from the original monolithic application. WHAT: Sometimes referred to as scale through services or resources, this rule focuses on scaling by splitting data sets, transactions, and engineering teams along verb (services) or noun (resources) boundaries. WHEN TO USE: Very large data sets where relations between data are not necessary. Large, complex systems where scaling engineering resources requires specialization. HOW TO USE: Split up actions by using verbs, or resources by using nouns, or use a mix. Split both the services and the data along the lines defined by the verb/noun approach. WHY: Allows for efficient scaling of not only transactions but also very large data sets associated with those transactions. It also allows for the efficient scaling of teams. KEY TAKEAWAYS: Microservices allow for efficient scaling of transactions, large data sets, and can help with fault isolation. It helps reduce the communication overhead of teams. The codebase becomes less complex as disjoint features are decoupled and spun as new services thereby letting each service scale independently specific to its requirement.","title":"Scalability - Microservices"},{"location":"systems_design/scalability/#refer_3","text":"https://learning.oreilly.com/library/view/the-art-of/9780134031408/ch23.html","title":"Refer"},{"location":"systems_design/scalability/#scalability-sharding","text":"This pattern represents the separation of work based on attributes that are looked up to or determined at the time of the transaction. Most often, these are implemented as splits by requestor, customer, or client. Very often, a lookup service or deterministic algorithm will need to be written for these types of splits. Sharding aids in scaling transaction growth, scaling instruction sets, and decreasing processing time (the last by limiting the data necessary to perform any transaction). This is more effective at scaling growth in customers or clients. It can aid with disaster recovery efforts, and limit the impact of incidents to only a specific segment of customers. Here the auth data is sharded based on user names so that DBs can respond faster as the amount of data DBs have to work on has drastically reduced during queries. There can be other ways to split Here the whole data center is split and replicated and clients are directed to a data center based on their geography. This helps in improving performance as clients are directed to the closest data center and performance increases as we add more data centers. There are some replication and consistency overhead with this approach one needs to be aware of. This also gives fault tolerance by rolling out test features to one site and rollback if there is an impact to that geography WHAT: This is very often a split by some unique aspect of the customer such as customer ID, name, geography, and so on. WHEN TO USE: Very large, similar data sets such as large and rapidly growing customer bases or when the response time for a geographically distributed customer base is important. HOW TO USE: Identify something you know about the customer, such as customer ID, last name, geography, or device, and split or partition both data and services based on that attribute. WHY: Rapid customer growth exceeds other forms of data growth, or you have the need to perform fault isolation between certain customer groups as you scale. KEY TAKEAWAYS: Shards are effective at helping you to scale customer bases but can also be applied to other very large data sets that can\u2019t be pulled apart using the microservices methodology.","title":"Scalability - Sharding"},{"location":"systems_design/scalability/#refer_4","text":"https://learning.oreilly.com/library/view/the-art-of/9780134031408/ch23.html","title":"Refer"},{"location":"systems_design/scalability/#applications-in-sre-role","text":"SREs in coordination with the network team work on how to map users' traffic to a particular site. https://engineering.linkedin.com/blog/2017/05/trafficshift--load-testing-at-scale SREs work closely with the Dev team to split monoliths to multiple microservices that are easy to run and manage SREs work on improving Load Balancers' reliability, service discovery, and performance SREs work closely to split Data into shards and manage data integrity and consistency. https://engineering.linkedin.com/espresso/introducing-espresso-linkedins-hot-new-distributed-document-store SREs work to set up, configure, and improve the CDN cache hit rate.","title":"Applications in SRE role"}]}
\ No newline at end of file
+{"config":{"lang":["en"],"min_search_length":3,"prebuild_index":false,"separator":"[\\s\\-]+"},"docs":[{"location":"","text":"School of SRE In early 2019, we started visiting campuses across India to recruit the best and brightest minds to ensure LinkedIn, and all the services that make up its complex technology stack, is always available for everyone. This critical function at Linkedin falls under the purview of the Site Engineering team and Site Reliability Engineers (SREs) who are Software Engineers specializing in reliability. SREs apply the principles of computer science and engineering to the design, development and operation of computer systems: generally, large scale, distributed ones As we continued on this journey we started getting a lot of questions from these campuses on what exactly the site reliability engineering role entails? And, how could someone learn the skills and the disciplines involved to become a successful site reliability engineer? Fast forward a few months, and a few of these campus students had joined LinkedIn either as interns or as full-time engineers to become a part of the Site Engineering team; we also had a few lateral hires who joined our organization who were not from a traditional SRE background. That's when a few of us got together and started to think about how we can onboard new graduate engineers to the Site Engineering team. There is a vast amount of resources scattered throughout the web on what the roles and responsibilities of SREs are, how to monitor site health, production incidents, define SLO/SLI etc. But there are very few resources out there guiding someone on the basic skill sets one has to acquire as a beginner. Because of the lack of these resources, we felt that individuals have a tough time getting into open positions in the industry. We created the School Of SRE as a starting point for anyone wanting to build their career as an SRE. In this course, we are focusing on building strong foundational skills. The course is structured in a way to provide more real life examples and how learning each of these topics can play an important role in day to day SRE life. Currently we are covering the following topics under the School Of SRE: Fundamentals Series Linux Basics Git Linux Networking Python and Web Data Relational databases(MySQL) NoSQL concepts Big Data Systems Design Security We believe continuous learning will help in acquiring deeper knowledge and competencies in order to expand your skill sets, every module has added references which could be a guide for further learning. Our hope is that by going through these modules we should be able to build the essential skills required for a Site Reliability Engineer. At Linkedin, we are using this curriculum for onboarding our non-traditional hires and new college grads into the SRE role. We had multiple rounds of successful onboarding experience with new employees and the course helped them be productive in a very short period of time. This motivated us to open source the content for helping other organizations in onboarding new engineers into the role and provide guidance for aspiring individuals to get into the role. We realize that the initial content we created is just a starting point and we hope that the community can help in the journey of refining and expanding the content.","title":"Home"},{"location":"#school-of-sre","text":"In early 2019, we started visiting campuses across India to recruit the best and brightest minds to ensure LinkedIn, and all the services that make up its complex technology stack, is always available for everyone. This critical function at Linkedin falls under the purview of the Site Engineering team and Site Reliability Engineers (SREs) who are Software Engineers specializing in reliability. SREs apply the principles of computer science and engineering to the design, development and operation of computer systems: generally, large scale, distributed ones As we continued on this journey we started getting a lot of questions from these campuses on what exactly the site reliability engineering role entails? And, how could someone learn the skills and the disciplines involved to become a successful site reliability engineer? Fast forward a few months, and a few of these campus students had joined LinkedIn either as interns or as full-time engineers to become a part of the Site Engineering team; we also had a few lateral hires who joined our organization who were not from a traditional SRE background. That's when a few of us got together and started to think about how we can onboard new graduate engineers to the Site Engineering team. There is a vast amount of resources scattered throughout the web on what the roles and responsibilities of SREs are, how to monitor site health, production incidents, define SLO/SLI etc. But there are very few resources out there guiding someone on the basic skill sets one has to acquire as a beginner. Because of the lack of these resources, we felt that individuals have a tough time getting into open positions in the industry. We created the School Of SRE as a starting point for anyone wanting to build their career as an SRE. In this course, we are focusing on building strong foundational skills. The course is structured in a way to provide more real life examples and how learning each of these topics can play an important role in day to day SRE life. Currently we are covering the following topics under the School Of SRE: Fundamentals Series Linux Basics Git Linux Networking Python and Web Data Relational databases(MySQL) NoSQL concepts Big Data Systems Design Security We believe continuous learning will help in acquiring deeper knowledge and competencies in order to expand your skill sets, every module has added references which could be a guide for further learning. Our hope is that by going through these modules we should be able to build the essential skills required for a Site Reliability Engineer. At Linkedin, we are using this curriculum for onboarding our non-traditional hires and new college grads into the SRE role. We had multiple rounds of successful onboarding experience with new employees and the course helped them be productive in a very short period of time. This motivated us to open source the content for helping other organizations in onboarding new engineers into the role and provide guidance for aspiring individuals to get into the role. We realize that the initial content we created is just a starting point and we hope that the community can help in the journey of refining and expanding the content.","title":"School of SRE"},{"location":"CONTRIBUTING/","text":"We realise that the initial content we created is just a starting point and our hope is that the community can help in the journey refining and extending the contents. As a contributor, you represent that the content you submit is not plagiarised. By submitting the content, you (and, if applicable, your employer) are licensing the submitted content to LinkedIn and the open source community subject to the BSD 2-Clause license. We suggest to open an issue first and seek advice for your changes before submitting a pull request. Repository URL : https://github.com/linkedin/school-of-sre Building and testing locally Run the following commands to build and view the site locally before opening a PR. pip install -r requirements.txt mkdocs build mkdocs serve","title":"Contribute"},{"location":"CONTRIBUTING/#building-and-testing-locally","text":"Run the following commands to build and view the site locally before opening a PR. pip install -r requirements.txt mkdocs build mkdocs serve","title":"Building and testing locally"},{"location":"big_data/evolution/","text":"Evolution of Hadoop Architecture of Hadoop HDFS The Hadoop Distributed File System (HDFS) is a distributed file system designed to run on commodity hardware. It has many similarities with existing distributed file systems. However, the differences from other distributed file systems are significant. HDFS is highly fault-tolerant and is designed to be deployed on low-cost hardware. HDFS provides high throughput access to application data and is suitable for applications that have large data sets. HDFS is part of the Apache Hadoop Core project . NameNode: is the arbitrator and central repository of file namespace in the cluster. The NameNode executes the operations such as opening, closing, and renaming files and directories. DataNode: manages the storage attached to the node on which it runs. It is responsible for serving all the read and writes requests. It performs operations on instructions on NameNode such as creation, deletion, and replications of blocks. Client: Responsible for getting the required metadata from the namenode and then communicating with the datanodes for reads and writes. YARN YARN stands for \u201cYet Another Resource Negotiator\u201c. It was introduced in Hadoop 2.0 to remove the bottleneck on Job Tracker which was present in Hadoop 1.0. YARN was described as a \u201cRedesigned Resource Manager\u201d at the time of its launching, but it has now evolved to be known as a large-scale distributed operating system used for Big Data processing. The main components of YARN architecture include: Client: It submits map-reduce(MR) jobs to the resource manager. Resource Manager: It is the master daemon of YARN and is responsible for resource assignment and management among all the applications. Whenever it receives a processing request, it forwards it to the corresponding node manager and allocates resources for the completion of the request accordingly. It has two major components: Scheduler: It performs scheduling based on the allocated application and available resources. It is a pure scheduler, which means that it does not perform other tasks such as monitoring or tracking and does not guarantee a restart if a task fails. The YARN scheduler supports plugins such as Capacity Scheduler and Fair Scheduler to partition the cluster resources. Application manager: It is responsible for accepting the application and negotiating the first container from the resource manager. It also restarts the Application Manager container if a task fails. Node Manager: It takes care of individual nodes on the Hadoop cluster and manages application and workflow and that particular node. Its primary job is to keep up with the Node Manager. It monitors resource usage, performs log management, and also kills a container based on directions from the resource manager. It is also responsible for creating the container process and starting it at the request of the Application master. Application Master: An application is a single job submitted to a framework. The application manager is responsible for negotiating resources with the resource manager, tracking the status, and monitoring the progress of a single application. The application master requests the container from the node manager by sending a Container Launch Context(CLC) which includes everything an application needs to run. Once the application is started, it sends the health report to the resource manager from time-to-time. Container: It is a collection of physical resources such as RAM, CPU cores, and disk on a single node. The containers are invoked by Container Launch Context(CLC) which is a record that contains information such as environment variables, security tokens, dependencies, etc. MapReduce framework The term MapReduce represents two separate and distinct tasks Hadoop programs perform-Map Job and Reduce Job. Map jobs take data sets as input and process them to produce key-value pairs. Reduce job takes the output of the Map job i.e. the key-value pairs and aggregates them to produce desired results. Hadoop MapReduce (Hadoop Map/Reduce) is a software framework for distributed processing of large data sets on computing clusters. Mapreduce helps to split the input data set into a number of parts and run a program on all data parts parallel at once. Please find the below Word count example demonstrating the usage of the MapReduce framework: Other tooling around Hadoop Hive Uses a language called HQL which is very SQL like. Gives non-programmers the ability to query and analyze data in Hadoop. Is basically an abstraction layer on top of map-reduce. Ex. HQL query: SELECT pet.name, comment FROM pet JOIN event ON (pet.name = event.name); In mysql: SELECT pet.name, comment FROM pet, event WHERE pet.name = event.name; Pig Uses a scripting language called Pig Latin, which is more workflow driven. Don't need to be an expert Java programmer but need a few coding skills. Is also an abstraction layer on top of map-reduce. Here is a quick question for you: What is the output of running the pig queries in the right column against the data present in the left column in the below image? Output: mysql 7,Komal,Nayak,24,9848022334,trivendram 8,Bharathi,Nambiayar,24,9848022333,Chennai 5,Trupthi,Mohanthy,23,9848022336,Bhuwaneshwar 6,Archana,Mishra,23,9848022335,Chennai 3. Spark 1. Spark provides primitives for in-memory cluster computing that allows user programs to load data into a cluster\u2019s memory and query it repeatedly, making it well suited to machine learning algorithms. 4. Presto 1. Presto is a high performance, distributed SQL query engine for Big Data. 2. Its architecture allows users to query a variety of data sources such as Hadoop, AWS S3, Alluxio, MySQL, Cassandra, Kafka, and MongoDB. 3. Example presto query: mysql use studentDB; show tables; SELECT roll_no, name FROM studentDB.studentDetails where section=\u2019A\u2019 limit 5; Data Serialisation and storage In order to transport the data over the network or to store on some persistent storage, we use the process of translating data structures or objects state into binary or textual form. We call this process serialization.. Avro data is stored in a container file (a .avro file) and its schema (the .avsc file) is stored with the data file. Apache Hive provides support to store a table as Avro and can also query data in this serialisation format.","title":"Evolution and Architecture of Hadoop"},{"location":"big_data/evolution/#evolution-of-hadoop","text":"","title":"Evolution of Hadoop"},{"location":"big_data/evolution/#architecture-of-hadoop","text":"HDFS The Hadoop Distributed File System (HDFS) is a distributed file system designed to run on commodity hardware. It has many similarities with existing distributed file systems. However, the differences from other distributed file systems are significant. HDFS is highly fault-tolerant and is designed to be deployed on low-cost hardware. HDFS provides high throughput access to application data and is suitable for applications that have large data sets. HDFS is part of the Apache Hadoop Core project . NameNode: is the arbitrator and central repository of file namespace in the cluster. The NameNode executes the operations such as opening, closing, and renaming files and directories. DataNode: manages the storage attached to the node on which it runs. It is responsible for serving all the read and writes requests. It performs operations on instructions on NameNode such as creation, deletion, and replications of blocks. Client: Responsible for getting the required metadata from the namenode and then communicating with the datanodes for reads and writes. YARN YARN stands for \u201cYet Another Resource Negotiator\u201c. It was introduced in Hadoop 2.0 to remove the bottleneck on Job Tracker which was present in Hadoop 1.0. YARN was described as a \u201cRedesigned Resource Manager\u201d at the time of its launching, but it has now evolved to be known as a large-scale distributed operating system used for Big Data processing. The main components of YARN architecture include: Client: It submits map-reduce(MR) jobs to the resource manager. Resource Manager: It is the master daemon of YARN and is responsible for resource assignment and management among all the applications. Whenever it receives a processing request, it forwards it to the corresponding node manager and allocates resources for the completion of the request accordingly. It has two major components: Scheduler: It performs scheduling based on the allocated application and available resources. It is a pure scheduler, which means that it does not perform other tasks such as monitoring or tracking and does not guarantee a restart if a task fails. The YARN scheduler supports plugins such as Capacity Scheduler and Fair Scheduler to partition the cluster resources. Application manager: It is responsible for accepting the application and negotiating the first container from the resource manager. It also restarts the Application Manager container if a task fails. Node Manager: It takes care of individual nodes on the Hadoop cluster and manages application and workflow and that particular node. Its primary job is to keep up with the Node Manager. It monitors resource usage, performs log management, and also kills a container based on directions from the resource manager. It is also responsible for creating the container process and starting it at the request of the Application master. Application Master: An application is a single job submitted to a framework. The application manager is responsible for negotiating resources with the resource manager, tracking the status, and monitoring the progress of a single application. The application master requests the container from the node manager by sending a Container Launch Context(CLC) which includes everything an application needs to run. Once the application is started, it sends the health report to the resource manager from time-to-time. Container: It is a collection of physical resources such as RAM, CPU cores, and disk on a single node. The containers are invoked by Container Launch Context(CLC) which is a record that contains information such as environment variables, security tokens, dependencies, etc.","title":"Architecture of Hadoop"},{"location":"big_data/evolution/#mapreduce-framework","text":"The term MapReduce represents two separate and distinct tasks Hadoop programs perform-Map Job and Reduce Job. Map jobs take data sets as input and process them to produce key-value pairs. Reduce job takes the output of the Map job i.e. the key-value pairs and aggregates them to produce desired results. Hadoop MapReduce (Hadoop Map/Reduce) is a software framework for distributed processing of large data sets on computing clusters. Mapreduce helps to split the input data set into a number of parts and run a program on all data parts parallel at once. Please find the below Word count example demonstrating the usage of the MapReduce framework:","title":"MapReduce framework"},{"location":"big_data/evolution/#other-tooling-around-hadoop","text":"Hive Uses a language called HQL which is very SQL like. Gives non-programmers the ability to query and analyze data in Hadoop. Is basically an abstraction layer on top of map-reduce. Ex. HQL query: SELECT pet.name, comment FROM pet JOIN event ON (pet.name = event.name); In mysql: SELECT pet.name, comment FROM pet, event WHERE pet.name = event.name; Pig Uses a scripting language called Pig Latin, which is more workflow driven. Don't need to be an expert Java programmer but need a few coding skills. Is also an abstraction layer on top of map-reduce. Here is a quick question for you: What is the output of running the pig queries in the right column against the data present in the left column in the below image? Output: mysql 7,Komal,Nayak,24,9848022334,trivendram 8,Bharathi,Nambiayar,24,9848022333,Chennai 5,Trupthi,Mohanthy,23,9848022336,Bhuwaneshwar 6,Archana,Mishra,23,9848022335,Chennai 3. Spark 1. Spark provides primitives for in-memory cluster computing that allows user programs to load data into a cluster\u2019s memory and query it repeatedly, making it well suited to machine learning algorithms. 4. Presto 1. Presto is a high performance, distributed SQL query engine for Big Data. 2. Its architecture allows users to query a variety of data sources such as Hadoop, AWS S3, Alluxio, MySQL, Cassandra, Kafka, and MongoDB. 3. Example presto query: mysql use studentDB; show tables; SELECT roll_no, name FROM studentDB.studentDetails where section=\u2019A\u2019 limit 5;","title":"Other tooling around Hadoop"},{"location":"big_data/evolution/#data-serialisation-and-storage","text":"In order to transport the data over the network or to store on some persistent storage, we use the process of translating data structures or objects state into binary or textual form. We call this process serialization.. Avro data is stored in a container file (a .avro file) and its schema (the .avsc file) is stored with the data file. Apache Hive provides support to store a table as Avro and can also query data in this serialisation format.","title":"Data Serialisation and storage"},{"location":"big_data/intro/","text":"Big Data Prerequisites Basics of Linux File systems. Basic understanding of System Design. What to expect from this course This course covers the basics of Big Data and how it has evolved to become what it is today. We will take a look at a few realistic scenarios where Big Data would be a perfect fit. An interesting assignment on designing a Big Data system is followed by understanding the architecture of Hadoop and the tooling around it. What is not covered under this course Writing programs to draw analytics from data. Course Contents Overview of Big Data Usage of Big Data techniques Evolution of Hadoop Architecture of hadoop HDFS Yarn MapReduce framework Other tooling around hadoop Hive Pig Spark Presto Data Serialisation and storage Overview of Big Data Big Data is a collection of large datasets that cannot be processed using traditional computing techniques. It is not a single technique or a tool, rather it has become a complete subject, which involves various tools, techniques, and frameworks. Big Data could consist of Structured data Unstructured data Semi-structured data Characteristics of Big Data: Volume Variety Velocity Variability Examples of Big Data generation include stock exchanges, social media sites, jet engines, etc. Usage of Big Data Techniques Take the example of the traffic lights problem. There are more than 300,000 traffic lights in the US as of 2018. Let us assume that we placed a device on each of them to collect metrics and send it to a central metrics collection system. If each of the IoT devices sends 10 events per minute, we have 300000x10x60x24 = 432x10^7 events per day. How would you go about processing that and telling me how many of the signals were \u201cgreen\u201d at 10:45 am on a particular day? Consider the next example on Unified Payments Interface (UPI) transactions: We had about 1.15 billion UPI transactions in the month of October 2019 in India. If we try to extrapolate this data to about a year and try to find out some common payments that were happening through a particular UPI ID, how do you suggest we go about that?","title":"Introduction"},{"location":"big_data/intro/#big-data","text":"","title":"Big Data"},{"location":"big_data/intro/#prerequisites","text":"Basics of Linux File systems. Basic understanding of System Design.","title":"Prerequisites"},{"location":"big_data/intro/#what-to-expect-from-this-course","text":"This course covers the basics of Big Data and how it has evolved to become what it is today. We will take a look at a few realistic scenarios where Big Data would be a perfect fit. An interesting assignment on designing a Big Data system is followed by understanding the architecture of Hadoop and the tooling around it.","title":"What to expect from this course"},{"location":"big_data/intro/#what-is-not-covered-under-this-course","text":"Writing programs to draw analytics from data.","title":"What is not covered under this course"},{"location":"big_data/intro/#course-contents","text":"Overview of Big Data Usage of Big Data techniques Evolution of Hadoop Architecture of hadoop HDFS Yarn MapReduce framework Other tooling around hadoop Hive Pig Spark Presto Data Serialisation and storage","title":"Course Contents"},{"location":"big_data/intro/#overview-of-big-data","text":"Big Data is a collection of large datasets that cannot be processed using traditional computing techniques. It is not a single technique or a tool, rather it has become a complete subject, which involves various tools, techniques, and frameworks. Big Data could consist of Structured data Unstructured data Semi-structured data Characteristics of Big Data: Volume Variety Velocity Variability Examples of Big Data generation include stock exchanges, social media sites, jet engines, etc.","title":"Overview of Big Data"},{"location":"big_data/intro/#usage-of-big-data-techniques","text":"Take the example of the traffic lights problem. There are more than 300,000 traffic lights in the US as of 2018. Let us assume that we placed a device on each of them to collect metrics and send it to a central metrics collection system. If each of the IoT devices sends 10 events per minute, we have 300000x10x60x24 = 432x10^7 events per day. How would you go about processing that and telling me how many of the signals were \u201cgreen\u201d at 10:45 am on a particular day? Consider the next example on Unified Payments Interface (UPI) transactions: We had about 1.15 billion UPI transactions in the month of October 2019 in India. If we try to extrapolate this data to about a year and try to find out some common payments that were happening through a particular UPI ID, how do you suggest we go about that?","title":"Usage of Big Data Techniques"},{"location":"big_data/tasks/","text":"Tasks and conclusion Post-training tasks: Try setting up your own 3 node Hadoop cluster. A VM based solution can be found here Write a simple spark/MR job of your choice and understand how to generate analytics from data. Sample dataset can be found here References: Hadoop documentation HDFS Architecture YARN Architecture Google GFS paper","title":"Conclusion"},{"location":"big_data/tasks/#tasks-and-conclusion","text":"","title":"Tasks and conclusion"},{"location":"big_data/tasks/#post-training-tasks","text":"Try setting up your own 3 node Hadoop cluster. A VM based solution can be found here Write a simple spark/MR job of your choice and understand how to generate analytics from data. Sample dataset can be found here","title":"Post-training tasks:"},{"location":"big_data/tasks/#references","text":"Hadoop documentation HDFS Architecture YARN Architecture Google GFS paper","title":"References:"},{"location":"databases_nosql/further_reading/","text":"Conclusion We have covered basic concepts of NoSQL databases. There is much more to learn and do. We hope this course gives you a good start and inspires you to explore further. Further reading NoSQL: https://hostingdata.co.uk/nosql-database/ https://www.mongodb.com/nosql-explained https://www.mongodb.com/nosql-explained/nosql-vs-sql Cap Theorem http://www.julianbrowne.com/article/brewers-cap-theorem Scalability http://www.slideshare.net/jboner/scalability-availability-stability-patterns Eventual Consistency https://www.allthingsdistributed.com/2008/12/eventually_consistent.html https://www.toptal.com/big-data/consistent-hashing https://web.stanford.edu/class/cs244/papers/chord_TON_2003.pdf","title":"Conclusion"},{"location":"databases_nosql/further_reading/#conclusion","text":"We have covered basic concepts of NoSQL databases. There is much more to learn and do. We hope this course gives you a good start and inspires you to explore further.","title":"Conclusion"},{"location":"databases_nosql/further_reading/#further-reading","text":"NoSQL: https://hostingdata.co.uk/nosql-database/ https://www.mongodb.com/nosql-explained https://www.mongodb.com/nosql-explained/nosql-vs-sql Cap Theorem http://www.julianbrowne.com/article/brewers-cap-theorem Scalability http://www.slideshare.net/jboner/scalability-availability-stability-patterns Eventual Consistency https://www.allthingsdistributed.com/2008/12/eventually_consistent.html https://www.toptal.com/big-data/consistent-hashing https://web.stanford.edu/class/cs244/papers/chord_TON_2003.pdf","title":"Further reading"},{"location":"databases_nosql/intro/","text":"NoSQL Concepts Prerequisites Relational Databases What to expect from this course At the end of training, you will have an understanding of what a NoSQL database is, what kind of advantages or disadvantages it has over traditional RDBMS, learn about different types of NoSQL databases and understand some of the underlying concepts & trade offs w.r.t to NoSQL. What is not covered under this course We will not be deep diving into any specific NoSQL Database. Course Contents Introduction to NoSQL CAP Theorem Data versioning Partitioning Hashing Quorum Introduction When people use the term \u201cNoSQL database\u201d, they typically use it to refer to any non-relational database. Some say the term \u201cNoSQL\u201d stands for \u201cnon SQL\u201d while others say it stands for \u201cnot only SQL.\u201d Either way, most agree that NoSQL databases are databases that store data in a format other than relational tables. A common misconception is that NoSQL databases or non-relational databases don\u2019t store relationship data well. NoSQL databases can store relationship data\u2014they just store it differently than relational databases do. In fact, when compared with SQL databases, many find modeling relationship data in NoSQL databases to be easier , because related data doesn\u2019t have to be split between tables. Such databases have existed since the late 1960s, but the name \"NoSQL\" was only coined in the early 21st century. NASA used a NoSQL database to track inventory for the Apollo mission. NoSQL databases emerged in the late 2000s as the cost of storage dramatically decreased. Gone were the days of needing to create a complex, difficult-to-manage data model simply for the purposes of reducing data duplication. Developers (rather than storage) were becoming the primary cost of software development, so NoSQL databases optimized for developer productivity. With the rise of Agile development methodology, NoSQL databases were developed with a focus on scaling, fast performance and at the same time allowed for frequent application changes and made programming easier. Types of NoSQL databases: Over time due to the way these NoSQL databases were developed to suit requirements at different companies, we ended up with quite a few types of them. However, they can be broadly classified into 4 types. Some of the databases can overlap between different types. They are Document databases: They store data in documents similar to JSON (JavaScript Object Notation) objects. Each document contains pairs of fields and values. The values can typically be a variety of types including things like strings, numbers, booleans, arrays, or objects, and their structures typically align with objects developers are working with in code. The advantages include intuitive data model & flexible schemas. Because of their variety of field value types and powerful query languages, document databases are great for a wide variety of use cases and can be used as a general purpose database. They can horizontally scale-out to accomodate large data volumes. Ex: MongoDB, Couchbase Key-Value databases: These are a simpler type of databases where each item contains keys and values. A value can typically only be retrieved by referencing its value, so learning how to query for a specific key-value pair is typically simple. Key-value databases are great for use cases where you need to store large amounts of data but you don\u2019t need to perform complex queries to retrieve it. Common use cases include storing user preferences or caching. Ex: Redis , DynamoDB , Voldemort / Venice (Linkedin), Wide-Column stores: They store data in tables, rows, and dynamic columns. Wide-column stores provide a lot of flexibility over relational databases because each row is not required to have the same columns. Many consider wide-column stores to be two-dimensional key-value databases. Wide-column stores are great for when you need to store large amounts of data and you can predict what your query patterns will be. Wide-column stores are commonly used for storing Internet of Things data and user profile data. Cassandra and HBase are two of the most popular wide-column stores. Graph Databases: These databases store data in nodes and edges. Nodes typically store information about people, places, and things while edges store information about the relationships between the nodes. The underlying storage mechanism of graph databases can vary. Some depend on a relational engine and \u201cstore\u201d the graph data in a table (although a table is a logical element, therefore this approach imposes another level of abstraction between the graph database, the graph database management system and the physical devices where the data is actually stored). Others use a key-value store or document-oriented database for storage, making them inherently NoSQL structures. Graph databases excel in use cases where you need to traverse relationships to look for patterns such as social networks, fraud detection, and recommendation engines. Ex: Neo4j Comparison Performance Scalability Flexibility Complexity Functionality Key Value high high high none Variable Document stores high Variable (high) high low Variable (low) Column DB high high moderate low minimal Graph Variable Variable high high Graph theory Differences between SQL and NoSQL The table below summarizes the main differences between SQL and NoSQL databases. SQL Databases NoSQL Databases Data Storage Model Tables with fixed rows and columns Document: JSON documents, Key-value: key-value pairs, Wide-column: tables with rows and dynamic columns, Graph: nodes and edges Primary Purpose General purpose Document: general purpose, Key-value: large amounts of data with simple lookup queries, Wide-column: large amounts of data with predictable query patterns, Graph: analyzing and traversing relationships between connected data Schemas Rigid Flexible Scaling Vertical (scale-up with a larger server) Horizontal (scale-out across commodity servers) Multi-Record ACID Transactions Supported Most do not support multi-record ACID transactions. However, some\u2014like MongoDB\u2014do. Joins Typically required Typically not required Data to Object Mapping Requires ORM (object-relational mapping) Many do not require ORMs. Document DB documents map directly to data structures in most popular programming languages. Advantages Flexible Data Models Most NoSQL systems feature flexible schemas. A flexible schema means you can easily modify your database schema to add or remove fields to support for evolving application requirements. This facilitates with continuous application development of new features without database operation overhead. Horizontal Scaling Most NoSQL systems allow you to scale horizontally, which means you can add in cheaper & commodity hardware, whenever you want to scale a system. On the other hand SQL systems generally scale Vertically (a more powerful server). NoSQL systems can also host huge data sets when compared to traditional SQL systems. Fast Queries NoSQL can generally be a lot faster than traditional SQL systems due to data denormalization and horizontal scaling. Most NoSQL systems also tend to store similar data together facilitating faster query responses. Developer productivity NoSQL systems tend to map data based on the programming data structures. As a result developers need to perform fewer data transformations leading to increased productivity & fewer bugs.","title":"Introduction"},{"location":"databases_nosql/intro/#nosql-concepts","text":"","title":"NoSQL Concepts"},{"location":"databases_nosql/intro/#prerequisites","text":"Relational Databases","title":"Prerequisites"},{"location":"databases_nosql/intro/#what-to-expect-from-this-course","text":"At the end of training, you will have an understanding of what a NoSQL database is, what kind of advantages or disadvantages it has over traditional RDBMS, learn about different types of NoSQL databases and understand some of the underlying concepts & trade offs w.r.t to NoSQL.","title":"What to expect from this course"},{"location":"databases_nosql/intro/#what-is-not-covered-under-this-course","text":"We will not be deep diving into any specific NoSQL Database.","title":"What is not covered under this course"},{"location":"databases_nosql/intro/#course-contents","text":"Introduction to NoSQL CAP Theorem Data versioning Partitioning Hashing Quorum","title":"Course Contents"},{"location":"databases_nosql/intro/#introduction","text":"When people use the term \u201cNoSQL database\u201d, they typically use it to refer to any non-relational database. Some say the term \u201cNoSQL\u201d stands for \u201cnon SQL\u201d while others say it stands for \u201cnot only SQL.\u201d Either way, most agree that NoSQL databases are databases that store data in a format other than relational tables. A common misconception is that NoSQL databases or non-relational databases don\u2019t store relationship data well. NoSQL databases can store relationship data\u2014they just store it differently than relational databases do. In fact, when compared with SQL databases, many find modeling relationship data in NoSQL databases to be easier , because related data doesn\u2019t have to be split between tables. Such databases have existed since the late 1960s, but the name \"NoSQL\" was only coined in the early 21st century. NASA used a NoSQL database to track inventory for the Apollo mission. NoSQL databases emerged in the late 2000s as the cost of storage dramatically decreased. Gone were the days of needing to create a complex, difficult-to-manage data model simply for the purposes of reducing data duplication. Developers (rather than storage) were becoming the primary cost of software development, so NoSQL databases optimized for developer productivity. With the rise of Agile development methodology, NoSQL databases were developed with a focus on scaling, fast performance and at the same time allowed for frequent application changes and made programming easier.","title":"Introduction"},{"location":"databases_nosql/intro/#types-of-nosql-databases","text":"Over time due to the way these NoSQL databases were developed to suit requirements at different companies, we ended up with quite a few types of them. However, they can be broadly classified into 4 types. Some of the databases can overlap between different types. They are Document databases: They store data in documents similar to JSON (JavaScript Object Notation) objects. Each document contains pairs of fields and values. The values can typically be a variety of types including things like strings, numbers, booleans, arrays, or objects, and their structures typically align with objects developers are working with in code. The advantages include intuitive data model & flexible schemas. Because of their variety of field value types and powerful query languages, document databases are great for a wide variety of use cases and can be used as a general purpose database. They can horizontally scale-out to accomodate large data volumes. Ex: MongoDB, Couchbase Key-Value databases: These are a simpler type of databases where each item contains keys and values. A value can typically only be retrieved by referencing its value, so learning how to query for a specific key-value pair is typically simple. Key-value databases are great for use cases where you need to store large amounts of data but you don\u2019t need to perform complex queries to retrieve it. Common use cases include storing user preferences or caching. Ex: Redis , DynamoDB , Voldemort / Venice (Linkedin), Wide-Column stores: They store data in tables, rows, and dynamic columns. Wide-column stores provide a lot of flexibility over relational databases because each row is not required to have the same columns. Many consider wide-column stores to be two-dimensional key-value databases. Wide-column stores are great for when you need to store large amounts of data and you can predict what your query patterns will be. Wide-column stores are commonly used for storing Internet of Things data and user profile data. Cassandra and HBase are two of the most popular wide-column stores. Graph Databases: These databases store data in nodes and edges. Nodes typically store information about people, places, and things while edges store information about the relationships between the nodes. The underlying storage mechanism of graph databases can vary. Some depend on a relational engine and \u201cstore\u201d the graph data in a table (although a table is a logical element, therefore this approach imposes another level of abstraction between the graph database, the graph database management system and the physical devices where the data is actually stored). Others use a key-value store or document-oriented database for storage, making them inherently NoSQL structures. Graph databases excel in use cases where you need to traverse relationships to look for patterns such as social networks, fraud detection, and recommendation engines. Ex: Neo4j","title":"Types of NoSQL databases:"},{"location":"databases_nosql/intro/#comparison","text":"Performance Scalability Flexibility Complexity Functionality Key Value high high high none Variable Document stores high Variable (high) high low Variable (low) Column DB high high moderate low minimal Graph Variable Variable high high Graph theory","title":"Comparison"},{"location":"databases_nosql/intro/#differences-between-sql-and-nosql","text":"The table below summarizes the main differences between SQL and NoSQL databases. SQL Databases NoSQL Databases Data Storage Model Tables with fixed rows and columns Document: JSON documents, Key-value: key-value pairs, Wide-column: tables with rows and dynamic columns, Graph: nodes and edges Primary Purpose General purpose Document: general purpose, Key-value: large amounts of data with simple lookup queries, Wide-column: large amounts of data with predictable query patterns, Graph: analyzing and traversing relationships between connected data Schemas Rigid Flexible Scaling Vertical (scale-up with a larger server) Horizontal (scale-out across commodity servers) Multi-Record ACID Transactions Supported Most do not support multi-record ACID transactions. However, some\u2014like MongoDB\u2014do. Joins Typically required Typically not required Data to Object Mapping Requires ORM (object-relational mapping) Many do not require ORMs. Document DB documents map directly to data structures in most popular programming languages.","title":"Differences between SQL and NoSQL"},{"location":"databases_nosql/intro/#advantages","text":"Flexible Data Models Most NoSQL systems feature flexible schemas. A flexible schema means you can easily modify your database schema to add or remove fields to support for evolving application requirements. This facilitates with continuous application development of new features without database operation overhead. Horizontal Scaling Most NoSQL systems allow you to scale horizontally, which means you can add in cheaper & commodity hardware, whenever you want to scale a system. On the other hand SQL systems generally scale Vertically (a more powerful server). NoSQL systems can also host huge data sets when compared to traditional SQL systems. Fast Queries NoSQL can generally be a lot faster than traditional SQL systems due to data denormalization and horizontal scaling. Most NoSQL systems also tend to store similar data together facilitating faster query responses. Developer productivity NoSQL systems tend to map data based on the programming data structures. As a result developers need to perform fewer data transformations leading to increased productivity & fewer bugs.","title":"Advantages"},{"location":"databases_nosql/key_concepts/","text":"Key Concepts Lets looks at some of the key concepts when we talk about NoSQL or distributed systems CAP Theorem In a keynote titled \u201c Towards Robust Distributed Systems \u201d at ACM\u2019s PODC symposium in 2000 Eric Brewer came up with the so-called CAP-theorem which is widely adopted today by large web companies as well as in the NoSQL community. The CAP acronym stands for C onsistency, A vailability & P artition Tolerance. Consistency It refers to how consistent a system is after an execution. A distributed system is called consistent when a write made by a source is available for all readers of that shared data. Different NoSQL systems support different levels of consistency. Availability It refers to how a system responds to loss of functionality of different systems due to hardware and software failures. A high availability implies that a system is still available to handle operations (reads and writes) when a certain part of the system is down due to a failure or upgrade. Partition Tolerance It is the ability of the system to continue operations in the event of a network partition. A network partition occurs when a failure causes two or more islands of networks where the systems can\u2019t talk to each other across the islands temporarily or permanently. Brewer alleges that one can at most choose two of these three characteristics in a shared-data system. The CAP-theorem states that a choice can only be made for two options out of consistency, availability and partition tolerance. A growing number of use cases in large scale applications tend to value reliability implying that availability & redundancy are more valuable than consistency. As a result these systems struggle to meet ACID properties. They attain this by loosening on the consistency requirement i.e Eventual Consistency. Eventual Consistency means that all readers will see writes, as time goes on: \u201cIn a steady state, the system will eventually return the last written value\u201d. Clients therefore may face an inconsistent state of data as updates are in progress. For instance, in a replicated database updates may go to one node which replicates the latest version to all other nodes that contain a replica of the modified dataset so that the replica nodes eventually will have the latest version. NoSQL systems support different levels of eventual consistency models. For example: Read Your Own Writes Consistency Clients will see their updates immediately after they are written. The reads can hit nodes other than the one where it was written. However they might not see updates by other clients immediately. Session Consistency Clients will see the updates to their data within a session scope. This generally indicates that reads & writes occur on the same server. Other clients using the same nodes will receive the same updates. Casual Consistency A system provides causal consistency if the following condition holds: write operations that are related by potential causality are seen by each process of the system in order. Different processes may observe concurrent writes in different orders Eventual consistency is useful if concurrent updates of the same partitions of data are unlikely and if clients do not immediately depend on reading updates issued by themselves or by other clients. Depending on what consistency model was chosen for the system (or parts of it), determines where the requests are routed, ex: replicas. CAP alternatives illustration Choice Traits Examples Consistency + Availability (Forfeit Partitions) 2-phase commits Cache invalidation protocols Single-site databases Cluster databases LDAP xFS file system Consistency + Partition tolerance (Forfeit Availability) Pessimistic locking Make minority partitions unavailable Distributed databases Distributed locking Majority protocols Availability + Partition tolerance (Forfeit Consistency) expirations/leases conflict resolution optimistic DNS Web caching Versioning of Data in distributed systems When data is distributed across nodes, it can be modified on different nodes at the same time (assuming strict consistency is enforced). Questions arise on conflict resolution for concurrent updates. Some of the popular conflict resolution mechanism are Timestamps This is the most obvious solution. You sort updates based on chronological order and choose the latest update. However this relies on clock synchronization across different parts of the infrastructure. This gets even more complicated when parts of systems are spread across different geographic locations. Optimistic Locking You associate a unique value like a clock or counter with every data update. When a client wants to update data, it has to specify which version of data needs to be updated. This would mean you need to keep track of history of the data versions. Vector Clocks A vector clock is defined as a tuple of clock values from each node. In a distributed environment, each node maintains a tuple of such clock values which represent the state of the nodes itself and its peers/replicas. A clock value may be real timestamps derived from local clock or version no. Vector clocks illustration Vector clocks have the following advantages over other conflict resolution mechanism No dependency on synchronized clocks No total ordering of revision nos required for casual reasoning No need to store and maintain multiple versions of the data on different nodes. Partitioning When the amount of data crosses the capacity of a single node, we need to think of splitting data, creating replicas for load balancing & disaster recovery. Depending on how dynamic the infrastructure is, we have a few approaches that we can take. Memory cached These are partitioned in-memory databases that are primarily used for transient data. These databases are generally used as a front for traditional RDBMS. Most frequently used data is replicated from a rdbms into a memory database to facilitate fast queries and to take the load off from backend DB\u2019s. A very common example is memcached or couchbase. Clustering Traditional cluster mechanisms abstract away the cluster topology from clients. A client need not know where the actual data is residing and which node it is talking to. Clustering is very commonly used in traditional RDBMS where it can help scaling the persistent layer to a certain extent. Separating reads from writes In this method, you will have multiple replicas hosting the same data. The incoming writes are typically sent to a single node (Leader) or multiple nodes (multi-Leader), while the rest of the replicas (Follower) handle reads requests. The leader replicates writes asynchronously to all followers. However the write lag can\u2019t be completely avoided. Sometimes a leader can crash before it replicates all the data to a follower. When this happens, a follower with the most consistent data can be turned into a leader. As you can realize now, it is hard to enforce full consistency in this model. You also need to consider the ratio of read vs write traffic. This model won\u2019t make sense when writes are higher than reads. The replication methods can also vary widely. Some systems do a complete transfer of state periodically, while others use a delta state transfer approach. You could also transfer the state by transferring the operations in order. The followers can then apply the same operations as the leader to catch up. Sharding Sharing refers to dividing data in such a way that data is distributed evenly (both in terms of storage & processing power) across a cluster of nodes. It can also imply data locality, which means similar & related data is stored together to facilitate faster access. A shard in turn can be further replicated to meet load balancing or disaster recovery requirements. A single shard replica might take in all writes (single leader) or multiple replicas can take writes (multi-leader). Reads can be distributed across multiple replicas. Since data is now distributed across multiple nodes, clients should be able to consistently figure out where data is hosted. We will look at some of the common techniques below. The downside of sharding is that joins between shards is not possible. So an upstream/downstream application has to aggregate the results from multiple shards. Sharding example Hashing A hash function is a function that maps one piece of data\u2014typically describing some kind of object, often of arbitrary size\u2014to another piece of data, typically an integer, known as hash code , or simply hash . In a partitioned database, it is important to consistently map a key to a server/replica. For ex: you can use a very simple hash as a modulo function. _p = k mod n_ Where p -> partition, k -> primary key n -> no of nodes The downside of this simple hash is that, whenever the cluster topology changes, the data distribution also changes. When you are dealing with memory caches, it will be easy to distribute partitions around. Whenever a node joins/leaves a topology, partitions can reorder themselves, a cache miss can be re-populated from backend DB. However when you look at persistent data, it is not possible as the new node doesn\u2019t have the data needed to serve it. This brings us to consistent hashing. Consistent Hashing Consistent hashing is a distributed hashing scheme that operates independently of the number of servers or objects in a distributed hash table by assigning them a position on an abstract circle, or hash ring . This allows servers and objects to scale without affecting the overall system. Say that our hash function h() generates a 32-bit integer. Then, to determine to which server we will send a key k, we find the server s whose hash h(s) is the smallest integer that is larger than h(k). To make the process simpler, we assume the table is circular, which means that if we cannot find a server with a hash larger than h(k), we wrap around and start looking from the beginning of the array. Consistent hashing illustration In consistent hashing when a server is removed or added then only the keys from that server are relocated. For example, if server S3 is removed then, all keys from server S3 will be moved to server S4 but keys stored on server S4 and S2 are not relocated. But there is one problem, when server S3 is removed then keys from S3 are not equally distributed among remaining servers S4 and S2. They are only assigned to server S4 which increases the load on server S4. To evenly distribute the load among servers when a server is added or removed, it creates a fixed number of replicas ( known as virtual nodes) of each server and distributes it along the circle. So instead of server labels S1, S2 and S3, we will have S10 S11\u2026S19, S20 S21\u2026S29 and S30 S31\u2026S39. The factor for a number of replicas is also known as weight , depending on the situation. All keys which are mapped to replicas Sij are stored on server Si. To find a key we do the same thing, find the position of the key on the circle and then move forward until you find a server replica. If the server replica is Sij then the key is stored in server Si. Suppose server S3 is removed, then all S3 replicas with labels S30 S31 \u2026 S39 must be removed. Now the objects keys adjacent to S3X labels will be automatically re-assigned to S1X, S2X and S4X. All keys originally assigned to S1, S2 & S4 will not be moved. Similar things happen if we add a server. Suppose we want to add a server S5 as a replacement of S3 then we need to add labels S50 S51 \u2026 S59. In the ideal case, one-fourth of keys from S1, S2 and S4 will be reassigned to S5. When applied to persistent storages, further issues arise: if a node has left the scene, data stored on this node becomes unavailable, unless it has been replicated to other nodes before; in the opposite case of a new node joining the others, adjacent nodes are no longer responsible for some pieces of data which they still store but not get asked for anymore as the corresponding objects are no longer hashed to them by requesting clients. In order to address this issue, a replication factor (r) can be introduced. Introducing replicas in a partitioning scheme\u2014besides reliability benefits\u2014also makes it possible to spread workload for read requests that can go to any physical node responsible for a requested piece of data. Scalability doesn\u2019t work if the clients have to decide between multiple versions of the dataset, because they need to read from a quorum of servers which in turn reduces the efficiency of load balancing. Quorum Quorum is the minimum number of nodes in a cluster that must be online and be able to communicate with each other. If any additional node failure occurs beyond this threshold, the cluster will stop running. To attain a quorum, you need a majority of the nodes. Commonly it is (N/2 + 1), where N is the total no of nodes in the system. For ex, In a 3 node cluster, you need 2 nodes for a majority, In a 5 node cluster, you need 3 nodes for a majority, In a 6 node cluster, you need 4 nodes for a majority. Quorum example Network problems can cause communication failures among cluster nodes. One set of nodes might be able to communicate together across a functioning part of a network but not be able to communicate with a different set of nodes in another part of the network. This is known as split brain in cluster or cluster partitioning. Now the partition which has quorum is allowed to continue running the application. The other partitions are removed from the cluster. Eg: In a 5 node cluster, consider what happens if nodes 1, 2, and 3 can communicate with each other but not with nodes 4 and 5. Nodes 1, 2, and 3 constitute a majority, and they continue running as a cluster. Nodes 4 and 5, being a minority, stop running as a cluster. If node 3 loses communication with other nodes, all nodes stop running as a cluster. However, all functioning nodes will continue to listen for communication, so that when the network begins working again, the cluster can form and begin to run. Below diagram demonstrates Quorum selection on a cluster partitioned into two sets. Cluster Quorum example","title":"Key Concepts"},{"location":"databases_nosql/key_concepts/#key-concepts","text":"Lets looks at some of the key concepts when we talk about NoSQL or distributed systems","title":"Key Concepts"},{"location":"databases_nosql/key_concepts/#cap-theorem","text":"In a keynote titled \u201c Towards Robust Distributed Systems \u201d at ACM\u2019s PODC symposium in 2000 Eric Brewer came up with the so-called CAP-theorem which is widely adopted today by large web companies as well as in the NoSQL community. The CAP acronym stands for C onsistency, A vailability & P artition Tolerance. Consistency It refers to how consistent a system is after an execution. A distributed system is called consistent when a write made by a source is available for all readers of that shared data. Different NoSQL systems support different levels of consistency. Availability It refers to how a system responds to loss of functionality of different systems due to hardware and software failures. A high availability implies that a system is still available to handle operations (reads and writes) when a certain part of the system is down due to a failure or upgrade. Partition Tolerance It is the ability of the system to continue operations in the event of a network partition. A network partition occurs when a failure causes two or more islands of networks where the systems can\u2019t talk to each other across the islands temporarily or permanently. Brewer alleges that one can at most choose two of these three characteristics in a shared-data system. The CAP-theorem states that a choice can only be made for two options out of consistency, availability and partition tolerance. A growing number of use cases in large scale applications tend to value reliability implying that availability & redundancy are more valuable than consistency. As a result these systems struggle to meet ACID properties. They attain this by loosening on the consistency requirement i.e Eventual Consistency. Eventual Consistency means that all readers will see writes, as time goes on: \u201cIn a steady state, the system will eventually return the last written value\u201d. Clients therefore may face an inconsistent state of data as updates are in progress. For instance, in a replicated database updates may go to one node which replicates the latest version to all other nodes that contain a replica of the modified dataset so that the replica nodes eventually will have the latest version. NoSQL systems support different levels of eventual consistency models. For example: Read Your Own Writes Consistency Clients will see their updates immediately after they are written. The reads can hit nodes other than the one where it was written. However they might not see updates by other clients immediately. Session Consistency Clients will see the updates to their data within a session scope. This generally indicates that reads & writes occur on the same server. Other clients using the same nodes will receive the same updates. Casual Consistency A system provides causal consistency if the following condition holds: write operations that are related by potential causality are seen by each process of the system in order. Different processes may observe concurrent writes in different orders Eventual consistency is useful if concurrent updates of the same partitions of data are unlikely and if clients do not immediately depend on reading updates issued by themselves or by other clients. Depending on what consistency model was chosen for the system (or parts of it), determines where the requests are routed, ex: replicas. CAP alternatives illustration Choice Traits Examples Consistency + Availability (Forfeit Partitions) 2-phase commits Cache invalidation protocols Single-site databases Cluster databases LDAP xFS file system Consistency + Partition tolerance (Forfeit Availability) Pessimistic locking Make minority partitions unavailable Distributed databases Distributed locking Majority protocols Availability + Partition tolerance (Forfeit Consistency) expirations/leases conflict resolution optimistic DNS Web caching","title":"CAP Theorem"},{"location":"databases_nosql/key_concepts/#versioning-of-data-in-distributed-systems","text":"When data is distributed across nodes, it can be modified on different nodes at the same time (assuming strict consistency is enforced). Questions arise on conflict resolution for concurrent updates. Some of the popular conflict resolution mechanism are Timestamps This is the most obvious solution. You sort updates based on chronological order and choose the latest update. However this relies on clock synchronization across different parts of the infrastructure. This gets even more complicated when parts of systems are spread across different geographic locations. Optimistic Locking You associate a unique value like a clock or counter with every data update. When a client wants to update data, it has to specify which version of data needs to be updated. This would mean you need to keep track of history of the data versions. Vector Clocks A vector clock is defined as a tuple of clock values from each node. In a distributed environment, each node maintains a tuple of such clock values which represent the state of the nodes itself and its peers/replicas. A clock value may be real timestamps derived from local clock or version no. Vector clocks illustration Vector clocks have the following advantages over other conflict resolution mechanism No dependency on synchronized clocks No total ordering of revision nos required for casual reasoning No need to store and maintain multiple versions of the data on different nodes.","title":"Versioning of Data in distributed systems"},{"location":"databases_nosql/key_concepts/#partitioning","text":"When the amount of data crosses the capacity of a single node, we need to think of splitting data, creating replicas for load balancing & disaster recovery. Depending on how dynamic the infrastructure is, we have a few approaches that we can take. Memory cached These are partitioned in-memory databases that are primarily used for transient data. These databases are generally used as a front for traditional RDBMS. Most frequently used data is replicated from a rdbms into a memory database to facilitate fast queries and to take the load off from backend DB\u2019s. A very common example is memcached or couchbase. Clustering Traditional cluster mechanisms abstract away the cluster topology from clients. A client need not know where the actual data is residing and which node it is talking to. Clustering is very commonly used in traditional RDBMS where it can help scaling the persistent layer to a certain extent. Separating reads from writes In this method, you will have multiple replicas hosting the same data. The incoming writes are typically sent to a single node (Leader) or multiple nodes (multi-Leader), while the rest of the replicas (Follower) handle reads requests. The leader replicates writes asynchronously to all followers. However the write lag can\u2019t be completely avoided. Sometimes a leader can crash before it replicates all the data to a follower. When this happens, a follower with the most consistent data can be turned into a leader. As you can realize now, it is hard to enforce full consistency in this model. You also need to consider the ratio of read vs write traffic. This model won\u2019t make sense when writes are higher than reads. The replication methods can also vary widely. Some systems do a complete transfer of state periodically, while others use a delta state transfer approach. You could also transfer the state by transferring the operations in order. The followers can then apply the same operations as the leader to catch up. Sharding Sharing refers to dividing data in such a way that data is distributed evenly (both in terms of storage & processing power) across a cluster of nodes. It can also imply data locality, which means similar & related data is stored together to facilitate faster access. A shard in turn can be further replicated to meet load balancing or disaster recovery requirements. A single shard replica might take in all writes (single leader) or multiple replicas can take writes (multi-leader). Reads can be distributed across multiple replicas. Since data is now distributed across multiple nodes, clients should be able to consistently figure out where data is hosted. We will look at some of the common techniques below. The downside of sharding is that joins between shards is not possible. So an upstream/downstream application has to aggregate the results from multiple shards. Sharding example","title":"Partitioning"},{"location":"databases_nosql/key_concepts/#hashing","text":"A hash function is a function that maps one piece of data\u2014typically describing some kind of object, often of arbitrary size\u2014to another piece of data, typically an integer, known as hash code , or simply hash . In a partitioned database, it is important to consistently map a key to a server/replica. For ex: you can use a very simple hash as a modulo function. _p = k mod n_ Where p -> partition, k -> primary key n -> no of nodes The downside of this simple hash is that, whenever the cluster topology changes, the data distribution also changes. When you are dealing with memory caches, it will be easy to distribute partitions around. Whenever a node joins/leaves a topology, partitions can reorder themselves, a cache miss can be re-populated from backend DB. However when you look at persistent data, it is not possible as the new node doesn\u2019t have the data needed to serve it. This brings us to consistent hashing.","title":"Hashing"},{"location":"databases_nosql/key_concepts/#consistent-hashing","text":"Consistent hashing is a distributed hashing scheme that operates independently of the number of servers or objects in a distributed hash table by assigning them a position on an abstract circle, or hash ring . This allows servers and objects to scale without affecting the overall system. Say that our hash function h() generates a 32-bit integer. Then, to determine to which server we will send a key k, we find the server s whose hash h(s) is the smallest integer that is larger than h(k). To make the process simpler, we assume the table is circular, which means that if we cannot find a server with a hash larger than h(k), we wrap around and start looking from the beginning of the array. Consistent hashing illustration In consistent hashing when a server is removed or added then only the keys from that server are relocated. For example, if server S3 is removed then, all keys from server S3 will be moved to server S4 but keys stored on server S4 and S2 are not relocated. But there is one problem, when server S3 is removed then keys from S3 are not equally distributed among remaining servers S4 and S2. They are only assigned to server S4 which increases the load on server S4. To evenly distribute the load among servers when a server is added or removed, it creates a fixed number of replicas ( known as virtual nodes) of each server and distributes it along the circle. So instead of server labels S1, S2 and S3, we will have S10 S11\u2026S19, S20 S21\u2026S29 and S30 S31\u2026S39. The factor for a number of replicas is also known as weight , depending on the situation. All keys which are mapped to replicas Sij are stored on server Si. To find a key we do the same thing, find the position of the key on the circle and then move forward until you find a server replica. If the server replica is Sij then the key is stored in server Si. Suppose server S3 is removed, then all S3 replicas with labels S30 S31 \u2026 S39 must be removed. Now the objects keys adjacent to S3X labels will be automatically re-assigned to S1X, S2X and S4X. All keys originally assigned to S1, S2 & S4 will not be moved. Similar things happen if we add a server. Suppose we want to add a server S5 as a replacement of S3 then we need to add labels S50 S51 \u2026 S59. In the ideal case, one-fourth of keys from S1, S2 and S4 will be reassigned to S5. When applied to persistent storages, further issues arise: if a node has left the scene, data stored on this node becomes unavailable, unless it has been replicated to other nodes before; in the opposite case of a new node joining the others, adjacent nodes are no longer responsible for some pieces of data which they still store but not get asked for anymore as the corresponding objects are no longer hashed to them by requesting clients. In order to address this issue, a replication factor (r) can be introduced. Introducing replicas in a partitioning scheme\u2014besides reliability benefits\u2014also makes it possible to spread workload for read requests that can go to any physical node responsible for a requested piece of data. Scalability doesn\u2019t work if the clients have to decide between multiple versions of the dataset, because they need to read from a quorum of servers which in turn reduces the efficiency of load balancing.","title":"Consistent Hashing"},{"location":"databases_nosql/key_concepts/#quorum","text":"Quorum is the minimum number of nodes in a cluster that must be online and be able to communicate with each other. If any additional node failure occurs beyond this threshold, the cluster will stop running. To attain a quorum, you need a majority of the nodes. Commonly it is (N/2 + 1), where N is the total no of nodes in the system. For ex, In a 3 node cluster, you need 2 nodes for a majority, In a 5 node cluster, you need 3 nodes for a majority, In a 6 node cluster, you need 4 nodes for a majority. Quorum example Network problems can cause communication failures among cluster nodes. One set of nodes might be able to communicate together across a functioning part of a network but not be able to communicate with a different set of nodes in another part of the network. This is known as split brain in cluster or cluster partitioning. Now the partition which has quorum is allowed to continue running the application. The other partitions are removed from the cluster. Eg: In a 5 node cluster, consider what happens if nodes 1, 2, and 3 can communicate with each other but not with nodes 4 and 5. Nodes 1, 2, and 3 constitute a majority, and they continue running as a cluster. Nodes 4 and 5, being a minority, stop running as a cluster. If node 3 loses communication with other nodes, all nodes stop running as a cluster. However, all functioning nodes will continue to listen for communication, so that when the network begins working again, the cluster can form and begin to run. Below diagram demonstrates Quorum selection on a cluster partitioned into two sets. Cluster Quorum example","title":"Quorum"},{"location":"databases_sql/concepts/","text":"Relational DBs are used for data storage. Even a file can be used to store data, but relational DBs are designed with specific goals: Efficiency Ease of access and management Organized Handle relations between data (represented as tables) Transaction: a unit of work that can comprise multiple statements, executed together ACID properties Set of properties that guarantee data integrity of DB transactions Atomicity: Each transaction is atomic (succeeds or fails completely) Consistency: Transactions only result in valid state (which includes rules, constraints, triggers etc.) Isolation: Each transaction is executed independently of others safely within a concurrent system Durability: Completed transactions will not be lost due to any later failures Let\u2019s take some examples to illustrate the above properties. Account A has a balance of \u20b9200 & B has \u20b9400. Account A is transferring \u20b9100 to Account B. This transaction has a deduction from sender and an addition into the recipient\u2019s balance. If the first operation passes successfully while the second fails, A\u2019s balance would be \u20b9100 while B would be having \u20b9400 instead of \u20b9500. Atomicity in a DB ensures this partially failed transaction is rolled back. If the second operation above fails, it leaves the DB inconsistent (sum of balance of accounts before and after the operation is not the same). Consistency ensures that this does not happen. There are three operations, one to calculate interest for A\u2019s account, another to add that to A\u2019s account, then transfer \u20b9100 from B to A. Without isolation guarantees, concurrent execution of these 3 operations may lead to a different outcome every time. What happens if the system crashes before the transactions are written to disk? Durability ensures that the changes are applied correctly during recovery. Relational data Tables represent relations Columns (fields) represent attributes Rows are individual records Schema describes the structure of DB SQL A query language to interact with and manage data. CRUD operations - create, read, update, delete queries Management operations - create DBs/tables/indexes etc, backup, import/export, users, access controls Exercise: Classify the below queries into the four types - DDL (definition), DML(manipulation), DCL(control) and TCL(transactions) and explain in detail. insert, create, drop, delete, update, commit, rollback, truncate, alter, grant, revoke You can practise these in the lab section . Constraints Rules for data that can be stored. Query fails if you violate any of these defined on a table. Primary key: one or more columns that contain UNIQUE values, and cannot contain NULL values. A table can have only ONE primary key. An index on it is created by default. Foreign key: links two tables together. Its value(s) match a primary key in a different table \\ Not null: Does not allow null values \\ Unique: Value of column must be unique across all rows \\ Default: Provides a default value for a column if none is specified during insert Check: Allows only particular values (like Balance >= 0) Indexes Most indexes use B+ tree structure. Why use them: Speeds up queries (in large tables that fetch only a few rows, min/max queries, by eliminating rows from consideration etc) Types of indexes: unique, primary key, fulltext, secondary Write-heavy loads, mostly full table scans or accessing large number of rows etc. do not benefit from indexes Joins Allows you to fetch related data from multiple tables, linking them together with some common field. Powerful but also resource-intensive and makes scaling databases difficult. This is the cause of many slow performing queries when run at scale, and the solution is almost always to find ways to reduce the joins. Access control DBs have privileged accounts for admin tasks, and regular accounts for clients. There are finegrained controls on what actions(DDL, DML etc. discussed earlier )are allowed for these accounts. DB first verifies the user credentials (authentication), and then examines whether this user is permitted to perform the request (authorization) by looking up these information in some internal tables. Other controls include activity auditing that allows examining the history of actions done by a user, and resource limits which define the number of queries, connections etc. allowed. Popular databases Commercial, closed source - Oracle, Microsoft SQL Server, IBM DB2 Open source with optional paid support - MySQL, MariaDB, PostgreSQL Individuals and small companies have always preferred open source DBs because of the huge cost associated with commercial software. In recent times, even large organizations have moved away from commercial software to open source alternatives because of the flexibility and cost savings associated with it. Lack of support is no longer a concern because of the paid support available from the developer and third parties. MySQL is the most widely used open source DB, and it is widely supported by hosting providers, making it easy for anyone to use. It is part of the popular Linux-Apache-MySQL-PHP ( LAMP ) stack that became popular in the 2000s. We have many more choices for a programming language, but the rest of that stack is still widely used.","title":"Key Concepts"},{"location":"databases_sql/concepts/#popular-databases","text":"Commercial, closed source - Oracle, Microsoft SQL Server, IBM DB2 Open source with optional paid support - MySQL, MariaDB, PostgreSQL Individuals and small companies have always preferred open source DBs because of the huge cost associated with commercial software. In recent times, even large organizations have moved away from commercial software to open source alternatives because of the flexibility and cost savings associated with it. Lack of support is no longer a concern because of the paid support available from the developer and third parties. MySQL is the most widely used open source DB, and it is widely supported by hosting providers, making it easy for anyone to use. It is part of the popular Linux-Apache-MySQL-PHP ( LAMP ) stack that became popular in the 2000s. We have many more choices for a programming language, but the rest of that stack is still widely used.","title":"Popular databases"},{"location":"databases_sql/conclusion/","text":"Conclusion We have covered basic concepts of SQL databases. We have also covered some of the tasks that an SRE may be responsible for - there is so much more to learn and do. We hope this course gives you a good start and inspires you to explore further. Further reading More practice with online resources like this one Normalization Routines , triggers Views Transaction isolation levels Sharding Setting up HA , monitoring , backups","title":"Conclusion"},{"location":"databases_sql/conclusion/#conclusion","text":"We have covered basic concepts of SQL databases. We have also covered some of the tasks that an SRE may be responsible for - there is so much more to learn and do. We hope this course gives you a good start and inspires you to explore further.","title":"Conclusion"},{"location":"databases_sql/conclusion/#further-reading","text":"More practice with online resources like this one Normalization Routines , triggers Views Transaction isolation levels Sharding Setting up HA , monitoring , backups","title":"Further reading"},{"location":"databases_sql/innodb/","text":"Why should you use this? General purpose, row level locking, ACID support, transactions, crash recovery and multi-version concurrency control etc. Architecture Key components: Memory: Buffer pool: LRU cache of frequently used data(table and index) to be processed directly from memory, which speeds up processing. Important for tuning performance. Change buffer: Caches changes to secondary index pages when those pages are not in the buffer pool and merges it when they are fetched. Merging may take a long time and impact live queries. It also takes up part of the buffer pool. Avoids the extra I/O to read secondary indexes in. Adaptive hash index: Supplements InnoDB\u2019s B-Tree indexes with fast hash lookup tables like a cache. Slight performance penalty for misses, also adds maintenance overhead of updating it. Hash collisions cause AHI rebuilding for large DBs. Log buffer: Holds log data before flush to disk. Size of each above memory is configurable, and impacts performance a lot. Requires careful analysis of workload, available resources, benchmarking and tuning for optimal performance. Disk: Tables: Stores data within rows and columns. Indexes: Helps find rows with specific column values quickly, avoids full table scans. Redo Logs: all transactions are written to them, and after a crash, the recovery process corrects data written by incomplete transactions and replays any pending ones. Undo Logs: Records associated with a single transaction that contains information about how to undo the latest change by a transaction.","title":"InnoDB"},{"location":"databases_sql/innodb/#why-should-you-use-this","text":"General purpose, row level locking, ACID support, transactions, crash recovery and multi-version concurrency control etc.","title":"Why should you use this?"},{"location":"databases_sql/innodb/#architecture","text":"","title":"Architecture"},{"location":"databases_sql/innodb/#key-components","text":"Memory: Buffer pool: LRU cache of frequently used data(table and index) to be processed directly from memory, which speeds up processing. Important for tuning performance. Change buffer: Caches changes to secondary index pages when those pages are not in the buffer pool and merges it when they are fetched. Merging may take a long time and impact live queries. It also takes up part of the buffer pool. Avoids the extra I/O to read secondary indexes in. Adaptive hash index: Supplements InnoDB\u2019s B-Tree indexes with fast hash lookup tables like a cache. Slight performance penalty for misses, also adds maintenance overhead of updating it. Hash collisions cause AHI rebuilding for large DBs. Log buffer: Holds log data before flush to disk. Size of each above memory is configurable, and impacts performance a lot. Requires careful analysis of workload, available resources, benchmarking and tuning for optimal performance. Disk: Tables: Stores data within rows and columns. Indexes: Helps find rows with specific column values quickly, avoids full table scans. Redo Logs: all transactions are written to them, and after a crash, the recovery process corrects data written by incomplete transactions and replays any pending ones. Undo Logs: Records associated with a single transaction that contains information about how to undo the latest change by a transaction.","title":"Key components:"},{"location":"databases_sql/intro/","text":"Relational Databases Prerequisites Complete Linux course Install Docker (for lab section) What to expect from this course You will have an understanding of what relational databases are, their advantages, and some MySQL specific concepts. What is not covered under this course In depth implementation details Advanced topics like normalization, sharding Specific tools for administration Introduction The main purpose of database systems is to manage data. This includes storage, adding new data, deleting unused data, updating existing data, retrieving data within a reasonable response time, other maintenance tasks to keep the system running etc. Pre-reads RDBMS Concepts Course Contents Key Concepts MySQL Architecture InnoDB Operational Concepts Lab Further Reading","title":"Introduction"},{"location":"databases_sql/intro/#relational-databases","text":"","title":"Relational Databases"},{"location":"databases_sql/intro/#prerequisites","text":"Complete Linux course Install Docker (for lab section)","title":"Prerequisites"},{"location":"databases_sql/intro/#what-to-expect-from-this-course","text":"You will have an understanding of what relational databases are, their advantages, and some MySQL specific concepts.","title":"What to expect from this course"},{"location":"databases_sql/intro/#what-is-not-covered-under-this-course","text":"In depth implementation details Advanced topics like normalization, sharding Specific tools for administration","title":"What is not covered under this course"},{"location":"databases_sql/intro/#introduction","text":"The main purpose of database systems is to manage data. This includes storage, adding new data, deleting unused data, updating existing data, retrieving data within a reasonable response time, other maintenance tasks to keep the system running etc.","title":"Introduction"},{"location":"databases_sql/intro/#pre-reads","text":"RDBMS Concepts","title":"Pre-reads"},{"location":"databases_sql/intro/#course-contents","text":"Key Concepts MySQL Architecture InnoDB Operational Concepts Lab Further Reading","title":"Course Contents"},{"location":"databases_sql/lab/","text":"Prerequisites Install Docker Setup Create a working directory named sos or something similar, and cd into it. Enter the following into a file named my.cnf under a directory named custom. sos $ cat custom/my.cnf [mysqld] # These settings apply to MySQL server # You can set port, socket path, buffer size etc. # Below, we are configuring slow query settings slow_query_log=1 slow_query_log_file=/var/log/mysqlslow.log long_query_time=0.1 Start a container and enable slow query log with the following: sos $ docker run --name db -v custom:/etc/mysql/conf.d -e MYSQL_ROOT_PASSWORD=realsecret -d mysql:8 sos $ docker cp custom/mysqld.cnf $(docker ps -qf \"name=db\"):/etc/mysql/conf.d/custom.cnf sos $ docker restart $(docker ps -qf \"name=db\") Import a sample database sos $ git clone git@github.com:datacharmer/test_db.git sos $ docker cp test_db $(docker ps -qf \"name=db\"):/home/test_db/ sos $ docker exec -it $(docker ps -qf \"name=db\") bash root@3ab5b18b0c7d:/# cd /home/test_db/ root@3ab5b18b0c7d:/# mysql -uroot -prealsecret mysql < employees.sql root@3ab5b18b0c7d:/etc# touch /var/log/mysqlslow.log root@3ab5b18b0c7d:/etc# chown mysql:mysql /var/log/mysqlslow.log Workshop 1: Run some sample queries Run the following $ mysql -uroot -prealsecret mysql mysql> # inspect DBs and tables # the last 4 are MySQL internal DBs mysql> show databases; +--------------------+ | Database | +--------------------+ | employees | | information_schema | | mysql | | performance_schema | | sys | +--------------------+ > use employees; mysql> show tables; +----------------------+ | Tables_in_employees | +----------------------+ | current_dept_emp | | departments | | dept_emp | | dept_emp_latest_date | | dept_manager | | employees | | salaries | | titles | +----------------------+ # read a few rows mysql> select * from employees limit 5; # filter data by conditions mysql> select count(*) from employees where gender = 'M' limit 5; # find count of particular data mysql> select count(*) from employees where first_name = 'Sachin'; Workshop 2: Use explain and explain analyze to profile a query, identify and add indexes required for improving performance # View all indexes on table #(\\G is to output horizontally, replace it with a ; to get table output) mysql> show index from employees from employees\\G *************************** 1. row *************************** Table: employees Non_unique: 0 Key_name: PRIMARY Seq_in_index: 1 Column_name: emp_no Collation: A Cardinality: 299113 Sub_part: NULL Packed: NULL Null: Index_type: BTREE Comment: Index_comment: Visible: YES Expression: NULL # This query uses an index, idenitfied by 'key' field # By prefixing explain keyword to the command, # we get query plan (including key used) mysql> explain select * from employees where emp_no < 10005\\G *************************** 1. row *************************** id: 1 select_type: SIMPLE table: employees partitions: NULL type: range possible_keys: PRIMARY key: PRIMARY key_len: 4 ref: NULL rows: 4 filtered: 100.00 Extra: Using where # Compare that to the next query which does not utilize any index mysql> explain select first_name, last_name from employees where first_name = 'Sachin'\\G *************************** 1. row *************************** id: 1 select_type: SIMPLE table: employees partitions: NULL type: ALL possible_keys: NULL key: NULL key_len: NULL ref: NULL rows: 299113 filtered: 10.00 Extra: Using where # Let's see how much time this query takes mysql> explain analyze select first_name, last_name from employees where first_name = 'Sachin'\\G *************************** 1. row *************************** EXPLAIN: -> Filter: (employees.first_name = 'Sachin') (cost=30143.55 rows=29911) (actual time=28.284..3952.428 rows=232 loops=1) -> Table scan on employees (cost=30143.55 rows=299113) (actual time=0.095..1996.092 rows=300024 loops=1) # Cost(estimated by query planner) is 30143.55 # actual time=28.284ms for first row, 3952.428 for all rows # Now lets try adding an index and running the query again mysql> create index idx_firstname on employees(first_name); Query OK, 0 rows affected (1.25 sec) Records: 0 Duplicates: 0 Warnings: 0 mysql> explain analyze select first_name, last_name from employees where first_name = 'Sachin'; +--------------------------------------------------------------------------------------------------------------------------------------------+ | EXPLAIN | +--------------------------------------------------------------------------------------------------------------------------------------------+ | -> Index lookup on employees using idx_firstname (first_name='Sachin') (cost=81.20 rows=232) (actual time=0.551..2.934 rows=232 loops=1) | +--------------------------------------------------------------------------------------------------------------------------------------------+ 1 row in set (0.01 sec) # Actual time=0.551ms for first row # 2.934ms for all rows. A huge improvement! # Also notice that the query involves only an index lookup, # and no table scan (reading all rows of table) # ..which vastly reduces load on the DB. Workshop 3: Identify slow queries on a MySQL server # Run the command below in two terminal tabs to open two shells into the container. docker exec -it $(docker ps -qf \"name=db\") bash # Open a mysql prompt in one of them and execute this command # We have configured to log queries that take longer than 1s, # so this sleep(3) will be logged mysql -uroot -prealsecret mysql mysql> sleep(3); # Now, in the other terminal, tail the slow log to find details about the query root@62c92c89234d:/etc# tail -f /var/log/mysqlslow.log /usr/sbin/mysqld, Version: 8.0.21 (MySQL Community Server - GPL). started with: Tcp port: 3306 Unix socket: /var/run/mysqld/mysqld.sock Time Id Command Argument # Time: 2020-11-26T14:53:44.822348Z # User@Host: root[root] @ localhost [] Id: 9 # Query_time: 5.404938 Lock_time: 0.000000 Rows_sent: 1 Rows_examined: 1 use employees; # Time: 2020-11-26T14:53:58.015736Z # User@Host: root[root] @ localhost [] Id: 9 # Query_time: 10.000225 Lock_time: 0.000000 Rows_sent: 1 Rows_examined: 1 SET timestamp=1606402428; select sleep(3); These were simulated examples with minimal complexity. In real life, the queries would be much more complex and the explain/analyze and slow query logs would have more details.","title":"Lab"},{"location":"databases_sql/mysql/","text":"MySQL architecture MySQL architecture enables you to select the right storage engine for your needs, and abstracts away all implementation details from the end users (application engineers and DBA ) who only need to know a consistent stable API. Application layer: Connection handling - each client gets its own connection which is cached for the duration of access) Authentication - server checks (username,password,host) info of client and allows/rejects connection Security: server determines whether the client has privileges to execute each query (check with show privileges command) Server layer: Services and utilities - backup/restore, replication, cluster etc SQL interface - clients run queries for data access and manipulation SQL parser - creates a parse tree from the query (lexical/syntactic/semantic analysis and code generation) Optimizer - optimizes queries using various algorithms and data available to it(table level stats), modifies queries, order of scanning, indexes to use etc. (check with explain command) Caches and buffers - cache stores query results, buffer pool(InnoDB) stores table and index data in LRU fashion Storage engine options: InnoDB: most widely used, transaction support, ACID compliant, supports row-level locking, crash recovery and multi-version concurrency control. Default since MySQL 5.5+. MyISAM: fast, does not support transactions, provides table-level locking, great for read-heavy workloads, mostly in web and data warehousing. Default upto MySQL 5.1. Archive: optimised for high speed inserts, compresses data as it is inserted, does not support transactions, ideal for storing and retrieving large amounts of seldom referenced historical, archived data Memory: tables in memory. Fastest engine, supports table-level locking, does not support transactions, ideal for creating temporary tables or quick lookups, data is lost after a shutdown CSV: stores data in CSV files, great for integrating into other applications that use this format \u2026 etc. It is possible to migrate from one storage engine to another. But this migration locks tables for all operations and is not online, as it changes the physical layout of the data. It takes a long time and is generally not recommended. Hence, choosing the right storage engine at the beginning is important. General guideline is to use InnoDB unless you have a specific need for one of the other storage engines. Running mysql> SHOW ENGINES; shows you the supported engines on your MySQL server.","title":"MySQL"},{"location":"databases_sql/mysql/#mysql-architecture","text":"MySQL architecture enables you to select the right storage engine for your needs, and abstracts away all implementation details from the end users (application engineers and DBA ) who only need to know a consistent stable API. Application layer: Connection handling - each client gets its own connection which is cached for the duration of access) Authentication - server checks (username,password,host) info of client and allows/rejects connection Security: server determines whether the client has privileges to execute each query (check with show privileges command) Server layer: Services and utilities - backup/restore, replication, cluster etc SQL interface - clients run queries for data access and manipulation SQL parser - creates a parse tree from the query (lexical/syntactic/semantic analysis and code generation) Optimizer - optimizes queries using various algorithms and data available to it(table level stats), modifies queries, order of scanning, indexes to use etc. (check with explain command) Caches and buffers - cache stores query results, buffer pool(InnoDB) stores table and index data in LRU fashion Storage engine options: InnoDB: most widely used, transaction support, ACID compliant, supports row-level locking, crash recovery and multi-version concurrency control. Default since MySQL 5.5+. MyISAM: fast, does not support transactions, provides table-level locking, great for read-heavy workloads, mostly in web and data warehousing. Default upto MySQL 5.1. Archive: optimised for high speed inserts, compresses data as it is inserted, does not support transactions, ideal for storing and retrieving large amounts of seldom referenced historical, archived data Memory: tables in memory. Fastest engine, supports table-level locking, does not support transactions, ideal for creating temporary tables or quick lookups, data is lost after a shutdown CSV: stores data in CSV files, great for integrating into other applications that use this format \u2026 etc. It is possible to migrate from one storage engine to another. But this migration locks tables for all operations and is not online, as it changes the physical layout of the data. It takes a long time and is generally not recommended. Hence, choosing the right storage engine at the beginning is important. General guideline is to use InnoDB unless you have a specific need for one of the other storage engines. Running mysql> SHOW ENGINES; shows you the supported engines on your MySQL server.","title":"MySQL architecture"},{"location":"databases_sql/operations/","text":"Explain and explain+analyze EXPLAIN <query> analyzes query plans from the optimizer, including how tables are joined, which tables/rows are scanned etc. Explain analyze shows the above and additional info like execution cost, number of rows returned, time taken etc. This knowledge is useful to tweak queries and add indexes. Watch this performance tuning tutorial video . Checkout the lab section for a hands-on about indexes. Slow query logs Used to identify slow queries (configurable threshold), enabled in config or dynamically with a query Checkout the lab section about identifying slow queries. User management This includes creation and changes to users, like managing privileges, changing password etc. Backup and restore strategies, pros and cons Logical backup using mysqldump - slower but can be done online Physical backup (copy data directory or use xtrabackup) - quick backup/recovery. Copying data directory requires locking or shut down. xtrabackup is an improvement because it supports backups without shutting down (hot backup). Others - PITR, snapshots etc. Crash recovery process using redo logs After a crash, when you restart server it reads redo logs and replays modifications to recover Monitoring MySQL Key MySQL metrics: reads, writes, query runtime, errors, slow queries, connections, running threads, InnoDB metrics Key OS metrics: CPU, load, memory, disk I/O, network Replication Copies data from one instance to one or more instances. Helps in horizontal scaling, data protection, analytics and performance. Binlog dump thread on primary, replication I/O and SQL threads on secondary. Strategies include the standard async, semi async or group replication. High Availability Ability to cope with failure at software, hardware and network level. Essential for anyone who needs 99.9%+ uptime. Can be implemented with replication or clustering solutions from MySQL, Percona, Oracle etc. Requires expertise to setup and maintain. Failover can be manual, scripted or using tools like Orchestrator. Data directory Data is stored in a particular directory, with nested directories for the data contained in each database. There are also MySQL log files, InnoDB log files, server process ID file and some other configs. The data directory is configurable. MySQL configuration This can be done by passing parameters during startup , or in a file . There are a few standard paths where MySQL looks for config files, /etc/my.cnf is one of the commonly used paths. These options are organized under headers (mysqld for server and mysql for client), you can explore them more in the lab that follows. Logs MySQL has logs for various purposes - general query log, errors, binary logs (for replication), slow query log. Only error log is enabled by default (to reduce I/O and storage requirement), the others can be enabled when required - by specifying config parameters at startup or running commands at runtime. Log destination can also be tweaked with config parameters.","title":"Operational Concepts"},{"location":"git/branches/","text":"Working With Branches Coming back to our local repo which has two commits. So far, what we have is a single line of history. Commits are chained in a single line. But sometimes you may have a need to work on two different features in parallel in the same repo. Now one option here could be making a new folder/repo with the same code and use that for another feature development. But there's a better way. Use branches. Since git follows tree like structure for commits, we can use branches to work on different sets of features. From a commit, two or more branches can be created and branches can also be merged. Using branches, there can exist multiple lines of histories and we can checkout to any of them and work on it. Checking out, as we discussed earlier, would simply mean replacing contents of the directory (repo) with the snapshot at the checked out version. Let's create a branch and see how it looks like: spatel1-mn1:school-of-sre spatel1$ git branch b1 spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD -> master, b1) adding file 2 * df2fb7a adding file 1 We create a branch called b1 . Git log tells us that b1 also points to the last commit (7f3b00e) but the HEAD is still pointing to master. If you remember, HEAD points to the commit/reference wherever you are checkout to. So if we checkout to b1 , HEAD should point to that. Let's confirm: spatel1-mn1:school-of-sre spatel1$ git checkout b1 Switched to branch 'b1' spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD -> b1, master) adding file 2 * df2fb7a adding file 1 b1 still points to the same commit but HEAD now points to b1 . Since we create a branch at commit 7f3b00e , there will be two lines of histories starting this commit. Depending on which branch you are checked out on, the line of history will progress. At this moment, we are checked out on branch b1 , so making a new commit will advance branch reference b1 to that commit and current b1 commit will become its parent. Let's do that. # Creating a file and making a commit spatel1-mn1:school-of-sre spatel1$ echo \"I am a file in b1 branch\" > b1.txt spatel1-mn1:school-of-sre spatel1$ git add b1.txt spatel1-mn1:school-of-sre spatel1$ git commit -m \"adding b1 file\" [b1 872a38f] adding b1 file 1 file changed, 1 insertion(+) create mode 100644 b1.txt # The new line of history spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 872a38f (HEAD -> b1) adding b1 file * 7f3b00e (master) adding file 2 * df2fb7a adding file 1 spatel1-mn1:school-of-sre spatel1$ Do note that master is still pointing to the old commit it was pointing to. We can now checkout to master branch and make commits there. This will result in another line of history starting from commit 7f3b00e. # checkout to master branch spatel1-mn1:school-of-sre spatel1$ git checkout master Switched to branch 'master' # Creating a new commit on master branch spatel1-mn1:school-of-sre spatel1$ echo \"new file in master branch\" > master.txt spatel1-mn1:school-of-sre spatel1$ git add master.txt spatel1-mn1:school-of-sre spatel1$ git commit -m \"adding master.txt file\" [master 60dc441] adding master.txt file 1 file changed, 1 insertion(+) create mode 100644 master.txt # The history line spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 60dc441 (HEAD -> master) adding master.txt file * 7f3b00e adding file 2 * df2fb7a adding file 1 Notice how branch b1 is not visible here since we are on the master. Let's try to visualize both to get the whole picture: spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 60dc441 (HEAD -> master) adding master.txt file | * 872a38f (b1) adding b1 file |/ * 7f3b00e adding file 2 * df2fb7a adding file 1 Above tree structure should make things clear. Notice a clear branch/fork on commit 7f3b00e. This is how we create branches. Now they both are two separate lines of history on which feature development can be done independently. To reiterate, internally, git is just a tree of commits. Branch names (human readable) are pointers to those commits in the tree. We use various git commands to work with the tree structure and references. Git accordingly modifies contents of our repo. Merges Now say the feature you were working on branch b1 is complete and you need to merge it on master branch, where all the final version of code goes. So first you will checkout to branch master and then you pull the latest code from upstream (eg: GitHub). Then you need to merge your code from b1 into master. There could be two ways this can be done. Here is the current history: spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 60dc441 (HEAD -> master) adding master.txt file | * 872a38f (b1) adding b1 file |/ * 7f3b00e adding file 2 * df2fb7a adding file 1 Option 1: Directly merge the branch. Merging the branch b1 into master will result in a new merge commit. This will merge changes from two different lines of history and create a new commit of the result. spatel1-mn1:school-of-sre spatel1$ git merge b1 Merge made by the 'recursive' strategy. b1.txt | 1 + 1 file changed, 1 insertion(+) create mode 100644 b1.txt spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 8fc28f9 (HEAD -> master) Merge branch 'b1' |\\ | * 872a38f (b1) adding b1 file * | 60dc441 adding master.txt file |/ * 7f3b00e adding file 2 * df2fb7a adding file 1 You can see a new merge commit created (8fc28f9). You will be prompted for the commit message. If there are a lot of branches in the repo, this result will end-up with a lot of merge commits. Which looks ugly compared to a single line of history of development. So let's look at an alternative approach First let's reset our last merge and go to the previous state. spatel1-mn1:school-of-sre spatel1$ git reset --hard 60dc441 HEAD is now at 60dc441 adding master.txt file spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 60dc441 (HEAD -> master) adding master.txt file | * 872a38f (b1) adding b1 file |/ * 7f3b00e adding file 2 * df2fb7a adding file 1 Option 2: Rebase. Now, instead of merging two branches which has a similar base (commit: 7f3b00e), let us rebase branch b1 on to current master. What this means is take branch b1 (from commit 7f3b00e to commit 872a38f) and rebase (put them on top of) master (60dc441). # Switch to b1 spatel1-mn1:school-of-sre spatel1$ git checkout b1 Switched to branch 'b1' # Rebase (b1 which is current branch) on master spatel1-mn1:school-of-sre spatel1$ git rebase master First, rewinding head to replay your work on top of it... Applying: adding b1 file # The result spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 5372c8f (HEAD -> b1) adding b1 file * 60dc441 (master) adding master.txt file * 7f3b00e adding file 2 * df2fb7a adding file 1 You can see b1 which had 1 commit. That commit's parent was 7f3b00e . But since we rebase it on master ( 60dc441 ). That becomes the parent now. As a side effect, you also see it has become a single line of history. Now if we were to merge b1 into master , it would simply mean change master to point to 5372c8f which is b1 . Let's try it: # checkout to master since we want to merge code into master spatel1-mn1:school-of-sre spatel1$ git checkout master Switched to branch 'master' # the current history, where b1 is based on master spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 5372c8f (b1) adding b1 file * 60dc441 (HEAD -> master) adding master.txt file * 7f3b00e adding file 2 * df2fb7a adding file 1 # Performing the merge, notice the \"fast-forward\" message spatel1-mn1:school-of-sre spatel1$ git merge b1 Updating 60dc441..5372c8f Fast-forward b1.txt | 1 + 1 file changed, 1 insertion(+) create mode 100644 b1.txt # The Result spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 5372c8f (HEAD -> master, b1) adding b1 file * 60dc441 adding master.txt file * 7f3b00e adding file 2 * df2fb7a adding file 1 Now you see both b1 and master are pointing to the same commit. Your code has been merged to the master branch and it can be pushed. Also we have clean line of history! :D","title":"Working With Branches"},{"location":"git/branches/#working-with-branches","text":"Coming back to our local repo which has two commits. So far, what we have is a single line of history. Commits are chained in a single line. But sometimes you may have a need to work on two different features in parallel in the same repo. Now one option here could be making a new folder/repo with the same code and use that for another feature development. But there's a better way. Use branches. Since git follows tree like structure for commits, we can use branches to work on different sets of features. From a commit, two or more branches can be created and branches can also be merged. Using branches, there can exist multiple lines of histories and we can checkout to any of them and work on it. Checking out, as we discussed earlier, would simply mean replacing contents of the directory (repo) with the snapshot at the checked out version. Let's create a branch and see how it looks like: spatel1-mn1:school-of-sre spatel1$ git branch b1 spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD -> master, b1) adding file 2 * df2fb7a adding file 1 We create a branch called b1 . Git log tells us that b1 also points to the last commit (7f3b00e) but the HEAD is still pointing to master. If you remember, HEAD points to the commit/reference wherever you are checkout to. So if we checkout to b1 , HEAD should point to that. Let's confirm: spatel1-mn1:school-of-sre spatel1$ git checkout b1 Switched to branch 'b1' spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD -> b1, master) adding file 2 * df2fb7a adding file 1 b1 still points to the same commit but HEAD now points to b1 . Since we create a branch at commit 7f3b00e , there will be two lines of histories starting this commit. Depending on which branch you are checked out on, the line of history will progress. At this moment, we are checked out on branch b1 , so making a new commit will advance branch reference b1 to that commit and current b1 commit will become its parent. Let's do that. # Creating a file and making a commit spatel1-mn1:school-of-sre spatel1$ echo \"I am a file in b1 branch\" > b1.txt spatel1-mn1:school-of-sre spatel1$ git add b1.txt spatel1-mn1:school-of-sre spatel1$ git commit -m \"adding b1 file\" [b1 872a38f] adding b1 file 1 file changed, 1 insertion(+) create mode 100644 b1.txt # The new line of history spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 872a38f (HEAD -> b1) adding b1 file * 7f3b00e (master) adding file 2 * df2fb7a adding file 1 spatel1-mn1:school-of-sre spatel1$ Do note that master is still pointing to the old commit it was pointing to. We can now checkout to master branch and make commits there. This will result in another line of history starting from commit 7f3b00e. # checkout to master branch spatel1-mn1:school-of-sre spatel1$ git checkout master Switched to branch 'master' # Creating a new commit on master branch spatel1-mn1:school-of-sre spatel1$ echo \"new file in master branch\" > master.txt spatel1-mn1:school-of-sre spatel1$ git add master.txt spatel1-mn1:school-of-sre spatel1$ git commit -m \"adding master.txt file\" [master 60dc441] adding master.txt file 1 file changed, 1 insertion(+) create mode 100644 master.txt # The history line spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 60dc441 (HEAD -> master) adding master.txt file * 7f3b00e adding file 2 * df2fb7a adding file 1 Notice how branch b1 is not visible here since we are on the master. Let's try to visualize both to get the whole picture: spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 60dc441 (HEAD -> master) adding master.txt file | * 872a38f (b1) adding b1 file |/ * 7f3b00e adding file 2 * df2fb7a adding file 1 Above tree structure should make things clear. Notice a clear branch/fork on commit 7f3b00e. This is how we create branches. Now they both are two separate lines of history on which feature development can be done independently. To reiterate, internally, git is just a tree of commits. Branch names (human readable) are pointers to those commits in the tree. We use various git commands to work with the tree structure and references. Git accordingly modifies contents of our repo.","title":"Working With Branches"},{"location":"git/branches/#merges","text":"Now say the feature you were working on branch b1 is complete and you need to merge it on master branch, where all the final version of code goes. So first you will checkout to branch master and then you pull the latest code from upstream (eg: GitHub). Then you need to merge your code from b1 into master. There could be two ways this can be done. Here is the current history: spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 60dc441 (HEAD -> master) adding master.txt file | * 872a38f (b1) adding b1 file |/ * 7f3b00e adding file 2 * df2fb7a adding file 1 Option 1: Directly merge the branch. Merging the branch b1 into master will result in a new merge commit. This will merge changes from two different lines of history and create a new commit of the result. spatel1-mn1:school-of-sre spatel1$ git merge b1 Merge made by the 'recursive' strategy. b1.txt | 1 + 1 file changed, 1 insertion(+) create mode 100644 b1.txt spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 8fc28f9 (HEAD -> master) Merge branch 'b1' |\\ | * 872a38f (b1) adding b1 file * | 60dc441 adding master.txt file |/ * 7f3b00e adding file 2 * df2fb7a adding file 1 You can see a new merge commit created (8fc28f9). You will be prompted for the commit message. If there are a lot of branches in the repo, this result will end-up with a lot of merge commits. Which looks ugly compared to a single line of history of development. So let's look at an alternative approach First let's reset our last merge and go to the previous state. spatel1-mn1:school-of-sre spatel1$ git reset --hard 60dc441 HEAD is now at 60dc441 adding master.txt file spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 60dc441 (HEAD -> master) adding master.txt file | * 872a38f (b1) adding b1 file |/ * 7f3b00e adding file 2 * df2fb7a adding file 1 Option 2: Rebase. Now, instead of merging two branches which has a similar base (commit: 7f3b00e), let us rebase branch b1 on to current master. What this means is take branch b1 (from commit 7f3b00e to commit 872a38f) and rebase (put them on top of) master (60dc441). # Switch to b1 spatel1-mn1:school-of-sre spatel1$ git checkout b1 Switched to branch 'b1' # Rebase (b1 which is current branch) on master spatel1-mn1:school-of-sre spatel1$ git rebase master First, rewinding head to replay your work on top of it... Applying: adding b1 file # The result spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 5372c8f (HEAD -> b1) adding b1 file * 60dc441 (master) adding master.txt file * 7f3b00e adding file 2 * df2fb7a adding file 1 You can see b1 which had 1 commit. That commit's parent was 7f3b00e . But since we rebase it on master ( 60dc441 ). That becomes the parent now. As a side effect, you also see it has become a single line of history. Now if we were to merge b1 into master , it would simply mean change master to point to 5372c8f which is b1 . Let's try it: # checkout to master since we want to merge code into master spatel1-mn1:school-of-sre spatel1$ git checkout master Switched to branch 'master' # the current history, where b1 is based on master spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 5372c8f (b1) adding b1 file * 60dc441 (HEAD -> master) adding master.txt file * 7f3b00e adding file 2 * df2fb7a adding file 1 # Performing the merge, notice the \"fast-forward\" message spatel1-mn1:school-of-sre spatel1$ git merge b1 Updating 60dc441..5372c8f Fast-forward b1.txt | 1 + 1 file changed, 1 insertion(+) create mode 100644 b1.txt # The Result spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph --all * 5372c8f (HEAD -> master, b1) adding b1 file * 60dc441 adding master.txt file * 7f3b00e adding file 2 * df2fb7a adding file 1 Now you see both b1 and master are pointing to the same commit. Your code has been merged to the master branch and it can be pushed. Also we have clean line of history! :D","title":"Merges"},{"location":"git/conclusion/","text":"What next from here? There are a lot of git commands and features which we have not explored here. But with the base built-up, be sure to explore concepts like Cherrypick Squash Amend Stash Reset","title":"Conclusion"},{"location":"git/conclusion/#what-next-from-here","text":"There are a lot of git commands and features which we have not explored here. But with the base built-up, be sure to explore concepts like Cherrypick Squash Amend Stash Reset","title":"What next from here?"},{"location":"git/git-basics/","text":"Git Prerequisites Have Git installed https://git-scm.com/downloads Have taken any git high level tutorial or following LinkedIn learning courses https://www.linkedin.com/learning/git-essential-training-the-basics/ https://www.linkedin.com/learning/git-branches-merges-and-remotes/ The Official Git Docs What to expect from this course As an engineer in the field of computer science, having knowledge of version control tools becomes almost a requirement. While there are a lot of version control tools that exist today like SVN, Mercurial, etc, Git perhaps is the most used one and this course we will be working with Git. While this course does not start with Git 101 and expects basic knowledge of git as a prerequisite, it will reintroduce the git concepts known by you with details covering what is happening under the hood as you execute various git commands. So that next time you run a git command, you will be able to press enter more confidently! What is not covered under this course Advanced usage and specifics of internal implementation details of Git. Course Contents Git Basics Working with Branches Git with Github Hooks Git Basics Though you might be aware already, let's revisit why we need a version control system. As the project grows and multiple developers start working on it, an efficient method for collaboration is warranted. Git helps the team collaborate easily and also maintains the history of the changes happening with the codebase. Creating a Git Repo Any folder can be converted into a git repository. After executing the following command, we will see a .git folder within the folder, which makes our folder a git repository. All the magic that git does, .git folder is the enabler for the same. # creating an empty folder and changing current dir to it spatel1-mn1:~ spatel1$ cd /tmp spatel1-mn1:tmp spatel1$ mkdir school-of-sre spatel1-mn1:tmp spatel1$ cd school-of-sre/ # initialize a git repo spatel1-mn1:school-of-sre spatel1$ git init Initialized empty Git repository in /private/tmp/school-of-sre/.git/ As the output says, an empty git repo has been initialized in our folder. Let's take a look at what is there. spatel1-mn1:school-of-sre spatel1$ ls .git/ HEAD config description hooks info objects refs There are a bunch of folders and files in the .git folder. As I said, all these enables git to do its magic. We will look into some of these folders and files. But for now, what we have is an empty git repository. Tracking a File Now as you might already know, let us create a new file in our repo (we will refer to the folder as repo now.) And see git status spatel1-mn1:school-of-sre spatel1$ echo \"I am file 1\" > file1.txt spatel1-mn1:school-of-sre spatel1$ git status On branch master No commits yet Untracked files: (use \"git add <file>...\" to include in what will be committed) file1.txt nothing added to commit but untracked files present (use \"git add\" to track) The current git status says No commits yet and there is one untracked file. Since we just created the file, git is not tracking that file. We explicitly need to ask git to track files and folders. (also checkout gitignore ) And how we do that is via git add command as suggested in the above output. Then we go ahead and create a commit. spatel1-mn1:school-of-sre spatel1$ git add file1.txt spatel1-mn1:school-of-sre spatel1$ git status On branch master No commits yet Changes to be committed: (use \"git rm --cached <file>...\" to unstage) new file: file1.txt spatel1-mn1:school-of-sre spatel1$ git commit -m \"adding file 1\" [master (root-commit) df2fb7a] adding file 1 1 file changed, 1 insertion(+) create mode 100644 file1.txt Notice how after adding the file, git status says Changes to be committed: . What it means is whatever is listed there, will be included in the next commit. Then we go ahead and create a commit, with an attached messaged via -m . More About a Commit Commit is a snapshot of the repo. Whenever a commit is made, a snapshot of the current state of repo (the folder) is taken and saved. Each commit has a unique ID. ( df2fb7a for the commit we made in the previous step). As we keep adding/changing more and more contents and keep making commits, all those snapshots are stored by git. Again, all this magic happens inside the .git folder. This is where all this snapshot or versions are stored in an efficient manner. Adding More Changes Let us create one more file and commit the change. It would look the same as the previous commit we made. spatel1-mn1:school-of-sre spatel1$ echo \"I am file 2\" > file2.txt spatel1-mn1:school-of-sre spatel1$ git add file2.txt spatel1-mn1:school-of-sre spatel1$ git commit -m \"adding file 2\" [master 7f3b00e] adding file 2 1 file changed, 1 insertion(+) create mode 100644 file2.txt A new commit with ID 7f3b00e has been created. You can issue git status at any time to see the state of the repository. **IMPORTANT: Note that commit IDs are long string (SHA) but we can refer to a commit by its initial few (8 or more) characters too. We will interchangeably using shorter and longer commit IDs.** Now that we have two commits, let's visualize them: spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD -> master) adding file 2 * df2fb7a adding file 1 git log , as the name suggests, prints the log of all the git commits. Here you see two additional arguments, --oneline prints the shorter version of the log, ie: the commit message only and not the person who made the commit and when. --graph prints it in graph format. Now at this moment the commits might look like just one in each line but all commits are stored as a tree like data structure internally by git. That means there can be two or more children commits of a given commit. And not just a single line of commits. We will look more into this part when we get to the Branches section. For now this is our commit history: df2fb7a ===> 7f3b00e Are commits really linked? As I just said, the two commits we just made are linked via tree like data structure and we saw how they are linked. But let's actually verify it. Everything in git is an object. Newly created files are stored as an object. Changes to file are stored as an objects and even commits are objects. To view contents of an object we can use the following command with the object's ID. We will take a look at the contents of the second commit spatel1-mn1:school-of-sre spatel1$ git cat-file -p 7f3b00e tree ebf3af44d253e5328340026e45a9fa9ae3ea1982 parent df2fb7a61f5d40c1191e0fdeb0fc5d6e7969685a author Sanket Patel <spatel1@linkedin.com> 1603273316 -0700 committer Sanket Patel <spatel1@linkedin.com> 1603273316 -0700 adding file 2 Take a note of parent attribute in the above output. It points to the commit id of the first commit we made. So this proves that they are linked! Additionally you can see the second commit's message in this object. As I said all this magic is enabled by .git folder and the object to which we are looking at also is in that folder. spatel1-mn1:school-of-sre spatel1$ ls .git/objects/7f/3b00eaa957815884198e2fdfec29361108d6a9 .git/objects/7f/3b00eaa957815884198e2fdfec29361108d6a9 It is stored in .git/objects/ folder. All the files and changes to them as well are stored in this folder. The Version Control part of Git We already can see two commits (versions) in our git log. One thing a version control tool gives you is ability to browse back and forth in history. For example: some of your users are running an old version of code and they are reporting an issue. In order to debug the issue, you need access to the old code. The one in your current repo is the latest code. In this example, you are working on the second commit (7f3b00e) and someone reported an issue with the code snapshot at commit (df2fb7a). This is how you would get access to the code at any older commit # Current contents, two files present patel1-mn1:school-of-sre spatel1$ ls file1.txt file2.txt # checking out to (an older) commit spatel1-mn1:school-of-sre spatel1$ git checkout df2fb7a Note: checking out 'df2fb7a'. You are in 'detached HEAD' state. You can look around, make experimental changes and commit them, and you can discard any commits you make in this state without impacting any branches by performing another checkout. If you want to create a new branch to retain commits you create, you may do so (now or later) by using -b with the checkout command again. Example: git checkout -b <new-branch-name> HEAD is now at df2fb7a adding file 1 # checking contents, can verify it has old contents spatel1-mn1:school-of-sre spatel1$ ls file1.txt So this is how we would get access to old versions/snapshots. All we need is a reference to that snapshot. Upon executing git checkout ... , what git does for you is use the .git folder, see what was the state of things (files and folders) at that version/reference and replace the contents of current directory with those contents. The then-existing content will no longer be present in the local dir (repo) but we can and will still get access to them because they are tracked via git commit and .git folder has them stored/tracked. Reference I mention in the previous section that we need a reference to the version. By default, git repo is made of tree of commits. And each commit has a unique IDs. But the unique ID is not the only thing we can reference commits via. There are multiple ways to reference commits. For example: HEAD is a reference to current commit. Whatever commit your repo is checked out at, HEAD will point to that. HEAD~1 is reference to previous commit. So while checking out previous version in section above, we could have done git checkout HEAD~1 . Similarly, master is also a reference (to a branch). Since git uses tree like structure to store commits, there of course will be branches. And the default branch is called master . Master (or any branch reference) will point to the latest commit in the branch. Even though we have checked out to the previous commit in out repo, master still points to the latest commit. And we can get back to the latest version by checkout at master reference spatel1-mn1:school-of-sre spatel1$ git checkout master Previous HEAD position was df2fb7a adding file 1 Switched to branch 'master' # now we will see latest code, with two files spatel1-mn1:school-of-sre spatel1$ ls file1.txt file2.txt Note, instead of master in above command, we could have used commit's ID as well. References and The Magic Let's look at the state of things. Two commits, master and HEAD references are pointing to the latest commit spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD -> master) adding file 2 * df2fb7a adding file 1 The magic? Let's examine these files: spatel1-mn1:school-of-sre spatel1$ cat .git/refs/heads/master 7f3b00eaa957815884198e2fdfec29361108d6a9 Viola! Where master is pointing to is stored in a file. Whenever git needs to know where master reference is pointing to, or if git needs to update where master points, it just needs to update the file above. So when you create a new commit, a new commit is created on top of the current commit and the master file is updated with the new commit's ID. Similary, for HEAD reference: spatel1-mn1:school-of-sre spatel1$ cat .git/HEAD ref: refs/heads/master We can see HEAD is pointing to a reference called refs/heads/master . So HEAD will point where ever the master points. Little Adventure We discussed how git will update the files as we execute commands. But let's try to do it ourselves, by hand, and see what happens. spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD -> master) adding file 2 * df2fb7a adding file 1 Now let's change master to point to the previous/first commit. spatel1-mn1:school-of-sre spatel1$ echo df2fb7a61f5d40c1191e0fdeb0fc5d6e7969685a > .git/refs/heads/master spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * df2fb7a (HEAD -> master) adding file 1 # RESETTING TO ORIGINAL spatel1-mn1:school-of-sre spatel1$ echo 7f3b00eaa957815884198e2fdfec29361108d6a9 > .git/refs/heads/master spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD -> master) adding file 2 * df2fb7a adding file 1 We just edited the master reference file and now we can see only the first commit in git log. Undoing the change to the file brings the state back to original. Not so much of magic, is it?","title":"Git Basics"},{"location":"git/git-basics/#git","text":"","title":"Git"},{"location":"git/git-basics/#prerequisites","text":"Have Git installed https://git-scm.com/downloads Have taken any git high level tutorial or following LinkedIn learning courses https://www.linkedin.com/learning/git-essential-training-the-basics/ https://www.linkedin.com/learning/git-branches-merges-and-remotes/ The Official Git Docs","title":"Prerequisites"},{"location":"git/git-basics/#what-to-expect-from-this-course","text":"As an engineer in the field of computer science, having knowledge of version control tools becomes almost a requirement. While there are a lot of version control tools that exist today like SVN, Mercurial, etc, Git perhaps is the most used one and this course we will be working with Git. While this course does not start with Git 101 and expects basic knowledge of git as a prerequisite, it will reintroduce the git concepts known by you with details covering what is happening under the hood as you execute various git commands. So that next time you run a git command, you will be able to press enter more confidently!","title":"What to expect from this course"},{"location":"git/git-basics/#what-is-not-covered-under-this-course","text":"Advanced usage and specifics of internal implementation details of Git.","title":"What is not covered under this course"},{"location":"git/git-basics/#course-contents","text":"Git Basics Working with Branches Git with Github Hooks","title":"Course Contents"},{"location":"git/git-basics/#git-basics","text":"Though you might be aware already, let's revisit why we need a version control system. As the project grows and multiple developers start working on it, an efficient method for collaboration is warranted. Git helps the team collaborate easily and also maintains the history of the changes happening with the codebase.","title":"Git Basics"},{"location":"git/git-basics/#creating-a-git-repo","text":"Any folder can be converted into a git repository. After executing the following command, we will see a .git folder within the folder, which makes our folder a git repository. All the magic that git does, .git folder is the enabler for the same. # creating an empty folder and changing current dir to it spatel1-mn1:~ spatel1$ cd /tmp spatel1-mn1:tmp spatel1$ mkdir school-of-sre spatel1-mn1:tmp spatel1$ cd school-of-sre/ # initialize a git repo spatel1-mn1:school-of-sre spatel1$ git init Initialized empty Git repository in /private/tmp/school-of-sre/.git/ As the output says, an empty git repo has been initialized in our folder. Let's take a look at what is there. spatel1-mn1:school-of-sre spatel1$ ls .git/ HEAD config description hooks info objects refs There are a bunch of folders and files in the .git folder. As I said, all these enables git to do its magic. We will look into some of these folders and files. But for now, what we have is an empty git repository.","title":"Creating a Git Repo"},{"location":"git/git-basics/#tracking-a-file","text":"Now as you might already know, let us create a new file in our repo (we will refer to the folder as repo now.) And see git status spatel1-mn1:school-of-sre spatel1$ echo \"I am file 1\" > file1.txt spatel1-mn1:school-of-sre spatel1$ git status On branch master No commits yet Untracked files: (use \"git add <file>...\" to include in what will be committed) file1.txt nothing added to commit but untracked files present (use \"git add\" to track) The current git status says No commits yet and there is one untracked file. Since we just created the file, git is not tracking that file. We explicitly need to ask git to track files and folders. (also checkout gitignore ) And how we do that is via git add command as suggested in the above output. Then we go ahead and create a commit. spatel1-mn1:school-of-sre spatel1$ git add file1.txt spatel1-mn1:school-of-sre spatel1$ git status On branch master No commits yet Changes to be committed: (use \"git rm --cached <file>...\" to unstage) new file: file1.txt spatel1-mn1:school-of-sre spatel1$ git commit -m \"adding file 1\" [master (root-commit) df2fb7a] adding file 1 1 file changed, 1 insertion(+) create mode 100644 file1.txt Notice how after adding the file, git status says Changes to be committed: . What it means is whatever is listed there, will be included in the next commit. Then we go ahead and create a commit, with an attached messaged via -m .","title":"Tracking a File"},{"location":"git/git-basics/#more-about-a-commit","text":"Commit is a snapshot of the repo. Whenever a commit is made, a snapshot of the current state of repo (the folder) is taken and saved. Each commit has a unique ID. ( df2fb7a for the commit we made in the previous step). As we keep adding/changing more and more contents and keep making commits, all those snapshots are stored by git. Again, all this magic happens inside the .git folder. This is where all this snapshot or versions are stored in an efficient manner.","title":"More About a Commit"},{"location":"git/git-basics/#adding-more-changes","text":"Let us create one more file and commit the change. It would look the same as the previous commit we made. spatel1-mn1:school-of-sre spatel1$ echo \"I am file 2\" > file2.txt spatel1-mn1:school-of-sre spatel1$ git add file2.txt spatel1-mn1:school-of-sre spatel1$ git commit -m \"adding file 2\" [master 7f3b00e] adding file 2 1 file changed, 1 insertion(+) create mode 100644 file2.txt A new commit with ID 7f3b00e has been created. You can issue git status at any time to see the state of the repository. **IMPORTANT: Note that commit IDs are long string (SHA) but we can refer to a commit by its initial few (8 or more) characters too. We will interchangeably using shorter and longer commit IDs.** Now that we have two commits, let's visualize them: spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD -> master) adding file 2 * df2fb7a adding file 1 git log , as the name suggests, prints the log of all the git commits. Here you see two additional arguments, --oneline prints the shorter version of the log, ie: the commit message only and not the person who made the commit and when. --graph prints it in graph format. Now at this moment the commits might look like just one in each line but all commits are stored as a tree like data structure internally by git. That means there can be two or more children commits of a given commit. And not just a single line of commits. We will look more into this part when we get to the Branches section. For now this is our commit history: df2fb7a ===> 7f3b00e","title":"Adding More Changes"},{"location":"git/git-basics/#are-commits-really-linked","text":"As I just said, the two commits we just made are linked via tree like data structure and we saw how they are linked. But let's actually verify it. Everything in git is an object. Newly created files are stored as an object. Changes to file are stored as an objects and even commits are objects. To view contents of an object we can use the following command with the object's ID. We will take a look at the contents of the second commit spatel1-mn1:school-of-sre spatel1$ git cat-file -p 7f3b00e tree ebf3af44d253e5328340026e45a9fa9ae3ea1982 parent df2fb7a61f5d40c1191e0fdeb0fc5d6e7969685a author Sanket Patel <spatel1@linkedin.com> 1603273316 -0700 committer Sanket Patel <spatel1@linkedin.com> 1603273316 -0700 adding file 2 Take a note of parent attribute in the above output. It points to the commit id of the first commit we made. So this proves that they are linked! Additionally you can see the second commit's message in this object. As I said all this magic is enabled by .git folder and the object to which we are looking at also is in that folder. spatel1-mn1:school-of-sre spatel1$ ls .git/objects/7f/3b00eaa957815884198e2fdfec29361108d6a9 .git/objects/7f/3b00eaa957815884198e2fdfec29361108d6a9 It is stored in .git/objects/ folder. All the files and changes to them as well are stored in this folder.","title":"Are commits really linked?"},{"location":"git/git-basics/#the-version-control-part-of-git","text":"We already can see two commits (versions) in our git log. One thing a version control tool gives you is ability to browse back and forth in history. For example: some of your users are running an old version of code and they are reporting an issue. In order to debug the issue, you need access to the old code. The one in your current repo is the latest code. In this example, you are working on the second commit (7f3b00e) and someone reported an issue with the code snapshot at commit (df2fb7a). This is how you would get access to the code at any older commit # Current contents, two files present patel1-mn1:school-of-sre spatel1$ ls file1.txt file2.txt # checking out to (an older) commit spatel1-mn1:school-of-sre spatel1$ git checkout df2fb7a Note: checking out 'df2fb7a'. You are in 'detached HEAD' state. You can look around, make experimental changes and commit them, and you can discard any commits you make in this state without impacting any branches by performing another checkout. If you want to create a new branch to retain commits you create, you may do so (now or later) by using -b with the checkout command again. Example: git checkout -b <new-branch-name> HEAD is now at df2fb7a adding file 1 # checking contents, can verify it has old contents spatel1-mn1:school-of-sre spatel1$ ls file1.txt So this is how we would get access to old versions/snapshots. All we need is a reference to that snapshot. Upon executing git checkout ... , what git does for you is use the .git folder, see what was the state of things (files and folders) at that version/reference and replace the contents of current directory with those contents. The then-existing content will no longer be present in the local dir (repo) but we can and will still get access to them because they are tracked via git commit and .git folder has them stored/tracked.","title":"The Version Control part of Git"},{"location":"git/git-basics/#reference","text":"I mention in the previous section that we need a reference to the version. By default, git repo is made of tree of commits. And each commit has a unique IDs. But the unique ID is not the only thing we can reference commits via. There are multiple ways to reference commits. For example: HEAD is a reference to current commit. Whatever commit your repo is checked out at, HEAD will point to that. HEAD~1 is reference to previous commit. So while checking out previous version in section above, we could have done git checkout HEAD~1 . Similarly, master is also a reference (to a branch). Since git uses tree like structure to store commits, there of course will be branches. And the default branch is called master . Master (or any branch reference) will point to the latest commit in the branch. Even though we have checked out to the previous commit in out repo, master still points to the latest commit. And we can get back to the latest version by checkout at master reference spatel1-mn1:school-of-sre spatel1$ git checkout master Previous HEAD position was df2fb7a adding file 1 Switched to branch 'master' # now we will see latest code, with two files spatel1-mn1:school-of-sre spatel1$ ls file1.txt file2.txt Note, instead of master in above command, we could have used commit's ID as well.","title":"Reference"},{"location":"git/git-basics/#references-and-the-magic","text":"Let's look at the state of things. Two commits, master and HEAD references are pointing to the latest commit spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD -> master) adding file 2 * df2fb7a adding file 1 The magic? Let's examine these files: spatel1-mn1:school-of-sre spatel1$ cat .git/refs/heads/master 7f3b00eaa957815884198e2fdfec29361108d6a9 Viola! Where master is pointing to is stored in a file. Whenever git needs to know where master reference is pointing to, or if git needs to update where master points, it just needs to update the file above. So when you create a new commit, a new commit is created on top of the current commit and the master file is updated with the new commit's ID. Similary, for HEAD reference: spatel1-mn1:school-of-sre spatel1$ cat .git/HEAD ref: refs/heads/master We can see HEAD is pointing to a reference called refs/heads/master . So HEAD will point where ever the master points.","title":"References and The Magic"},{"location":"git/git-basics/#little-adventure","text":"We discussed how git will update the files as we execute commands. But let's try to do it ourselves, by hand, and see what happens. spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD -> master) adding file 2 * df2fb7a adding file 1 Now let's change master to point to the previous/first commit. spatel1-mn1:school-of-sre spatel1$ echo df2fb7a61f5d40c1191e0fdeb0fc5d6e7969685a > .git/refs/heads/master spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * df2fb7a (HEAD -> master) adding file 1 # RESETTING TO ORIGINAL spatel1-mn1:school-of-sre spatel1$ echo 7f3b00eaa957815884198e2fdfec29361108d6a9 > .git/refs/heads/master spatel1-mn1:school-of-sre spatel1$ git log --oneline --graph * 7f3b00e (HEAD -> master) adding file 2 * df2fb7a adding file 1 We just edited the master reference file and now we can see only the first commit in git log. Undoing the change to the file brings the state back to original. Not so much of magic, is it?","title":"Little Adventure"},{"location":"git/github-hooks/","text":"Git with Github Till now all the operations we did were in our local repo while git also helps us in a collaborative environment. GitHub is one place on the internet where you can centrally host your git repos and collaborate with other developers. Most of the workflow will remain the same as we discussed, with addition of couple of things: Pull: to pull latest changes from github (the central) repo Push: to push your changes to github repo so that it's available to all people GitHub has written nice guides and tutorials about this and you can refer them here: GitHub Hello World Git Handbook Hooks Git has another nice feature called hooks. Hooks are basically scripts which will be called when a certain event happens. Here is where hooks are located: spatel1-mn1:school-of-sre spatel1$ ls .git/hooks/ applypatch-msg.sample fsmonitor-watchman.sample pre-applypatch.sample pre-push.sample pre-receive.sample update.sample commit-msg.sample post-update.sample pre-commit.sample pre-rebase.sample prepare-commit-msg.sample Names are self explanatory. These hooks are useful when you want to do certain things when a certain event happens. If you want to run tests before pushing code, you would want to setup pre-push hooks. Let's try to create a pre commit hook. spatel1-mn1:school-of-sre spatel1$ echo \"echo this is from pre commit hook\" > .git/hooks/pre-commit spatel1-mn1:school-of-sre spatel1$ chmod +x .git/hooks/pre-commit We basically create a file called pre-commit in hooks folder and make it executable. Now if we make a commit, we should see the message getting printed. spatel1-mn1:school-of-sre spatel1$ echo \"sample file\" > sample.txt spatel1-mn1:school-of-sre spatel1$ git add sample.txt spatel1-mn1:school-of-sre spatel1$ git commit -m \"adding sample file\" this is from pre commit hook # <===== THE MESSAGE FROM HOOK EXECUTION [master 9894e05] adding sample file 1 file changed, 1 insertion(+) create mode 100644 sample.txt","title":"Github and Hooks"},{"location":"git/github-hooks/#git-with-github","text":"Till now all the operations we did were in our local repo while git also helps us in a collaborative environment. GitHub is one place on the internet where you can centrally host your git repos and collaborate with other developers. Most of the workflow will remain the same as we discussed, with addition of couple of things: Pull: to pull latest changes from github (the central) repo Push: to push your changes to github repo so that it's available to all people GitHub has written nice guides and tutorials about this and you can refer them here: GitHub Hello World Git Handbook","title":"Git with Github"},{"location":"git/github-hooks/#hooks","text":"Git has another nice feature called hooks. Hooks are basically scripts which will be called when a certain event happens. Here is where hooks are located: spatel1-mn1:school-of-sre spatel1$ ls .git/hooks/ applypatch-msg.sample fsmonitor-watchman.sample pre-applypatch.sample pre-push.sample pre-receive.sample update.sample commit-msg.sample post-update.sample pre-commit.sample pre-rebase.sample prepare-commit-msg.sample Names are self explanatory. These hooks are useful when you want to do certain things when a certain event happens. If you want to run tests before pushing code, you would want to setup pre-push hooks. Let's try to create a pre commit hook. spatel1-mn1:school-of-sre spatel1$ echo \"echo this is from pre commit hook\" > .git/hooks/pre-commit spatel1-mn1:school-of-sre spatel1$ chmod +x .git/hooks/pre-commit We basically create a file called pre-commit in hooks folder and make it executable. Now if we make a commit, we should see the message getting printed. spatel1-mn1:school-of-sre spatel1$ echo \"sample file\" > sample.txt spatel1-mn1:school-of-sre spatel1$ git add sample.txt spatel1-mn1:school-of-sre spatel1$ git commit -m \"adding sample file\" this is from pre commit hook # <===== THE MESSAGE FROM HOOK EXECUTION [master 9894e05] adding sample file 1 file changed, 1 insertion(+) create mode 100644 sample.txt","title":"Hooks"},{"location":"linux_basics/command_line_basics/","text":"Command Line Basics Lab Environment Setup One can use an online bash interpreter to run all the commands that are provided as examples in this course. This will also help you in getting a hands-on experience of various linux commands. REPL is one of the popular online bash interpreters for running linux commands. We will be using it for running all the commands mentioned in this course. What is a Command A command is a program that tells the operating system to perform specific work. Programs are stored as files in linux. Therefore, a command is also a file which is stored somewhere on the disk. Commands may also take additional arguments as input from the user. These arguments are called command line arguments. Knowing how to use the commands is important and there are many ways to get help in Linux, especially for commands. Almost every command will have some form of documentation, most commands will have a command-line argument -h or --help that will display a reasonable amount of documentation. But the most popular documentation system in Linux is called man pages - short for manual pages. Using --help to show the documentation for ls command. File System Organization The linux file system has a hierarchical (or tree-like) structure with its highest level directory called root ( denoted by / ). Directories present inside the root directory stores file related to the system. These directories in turn can either store system files or application files or user related files. bin | The executable program of most commonly used commands reside in bin directory sbin | This directory contains programs used for system administration. home | This directory contains user related files and directories. lib | This directory contains all the library files etc | This directory contains all the system configuration files proc | This directory contains files related to the running processes on the system dev | This directory contains files related to devices on the system mnt | This directory contains files related to mounted devices on the system tmp | This directory is used to store temporary files on the system usr | This directory is used to store application programs on the system Commands for Navigating the File System There are three basic commands which are used frequently to navigate the file system: ls pwd cd We will now try to understand what each command does and how to use these commands. You should also practice the given examples on the online bash shell. pwd (print working directory) At any given moment of time, we will be standing in a certain directory. To get the name of the directory in which we are standing, we can use the pwd command in linux. We will now use the cd command to move to a different directory and then print the working directory. cd (change directory) The cd command can be used to change the working directory. Using the command, you can move from one directory to another. In the below example, we are initially in the root directory. we have then used the cd command to change the directory. ls (list files and directories)** The ls command is used to list the contents of a directory. It will list down all the files and folders present in the given directory. If we just type ls in the shell, it will list all the files and directories present in the current directory. We can also provide the directory name as argument to ls command. It will then list all the files and directories inside the given directory. Commands for Manipulating Files There are four basic commands which are used frequently to manipulate files: touch mkdir cp mv rm We will now try to understand what each command does and how to use these commands. You should also practice the given examples on the online bash shell. touch (create new file) The touch command can be used to create an empty new file. This command is very useful for many other purposes but we will discuss the simplest use case of creating a new file. General syntax of using touch command touch <file_name> mkdir (create new directories) The mkdir command is used to create directories.You can use ls command to verify that the new directory is created. General syntax of using mkdir command mkdir <directory_name> rm (delete files and directories) The rm command can be used to delete files and directories. It is very important to note that this command permanently deletes the files and directories. It's almost impossible to recover these files and directories once you have executed rm command on them successfully. Do run this command with care. General syntax of using rm command: rm <file_name> Let's try to understand the rm command with an example. We will try to delete the file and directory we created using touch and mkdir command respectively. cp (copy files and directories) The cp command is used to copy files and directories from one location to another. Do note that the cp command doesn't do any change to the original files or directories. The original files or directories and their copy both co-exist after running cp command successfully. General syntax of using cp command: cp <source_path> <destination_path> We are currently in the '/home/runner' directory. We will use the mkdir command to create a new directory named \"test_directory\". We will now try to copy the \"_test_runner.py\" file to the directory we created just now. Do note that nothing happened to the original \"_test_runner.py\" file. It's still there in the current directory. A new copy of it got created inside the \"test_directory\". We can also use the cp command to copy the whole directory from one location to another. Let's try to understand this with an example. We again used the mkdir command to create a new directory called \"another_directory\". We then used the cp command along with an additional argument '-r' to copy the \"test_directory\". mv (move files and directories) The mv command can either be used to move files or directories from one location to another or it can be used to rename files or directories. Do note that moving files and copying them are very different. When you move the files or directories, the original copy is lost. General syntax of using mv command: mv <source_path> <destination_path> In this example, we will use the mv command to move the \"_test_runner.py\" file to \"test_directory\". In this case, this file already exists in \"test_directory\". The mv command will just replace it. Do note that the original file doesn't exist in the current directory after mv command ran successfully. We can also use the mv command to move a directory from one location to another. In this case, we do not need to use the '-r' flag that we did while using the cp command. Do note that the original directory will not exist if we use mv command. One of the important uses of the mv command is to rename files and directories. Let's see how we can use this command for renaming. We have first changed our location to \"test_directory\". We then use the mv command to rename the \"\"_test_runner.py\" file to \"test.py\". Commands for Viewing Files There are three basic commands which are used frequently to view the files: cat head tail We will now try to understand what each command does and how to use these commands. You should also practice the given examples on the online bash shell. We will create a new file called \"numbers.txt\" and insert numbers from 1 to 100 in this file. Each number will be in a separate line. Do not worry about the above command now. It's an advanced command which is used to generate numbers. We have then used a redirection operator to push these numbers to the file. We will be discussing I/O redirection in the later sections. cat The most simplest use of cat command is to print the contents of the file on your output screen. This command is very useful and can be used for many other purposes. We will study about other use cases later. You can try to run the above command and you will see numbers being printed from 1 to 100 on your screen. You will need to scroll up to view all the numbers. head The head command displays the first 10 lines of the file by default. We can include additional arguments to display as many lines as we want from the top. In this example, we are only able to see the first 10 lines from the file when we use the head command. By default, head command will only display the first 10 lines. If we want to specify the number of lines we want to see from start, use the '-n' argument to provide the input. tail The tail command displays the last 10 lines of the file by default. We can include additional arguments to display as many lines as we want from the end of the file. By default, the tail command will only display the last 10 lines. If we want to specify the number of lines we want to see from the end, use '-n' argument to provide the input. In this example, we are only able to see the last 5 lines from the file when we use the tail command with explicit -n option. Echo Command in Linux The echo command is one of the simplest commands that is used in the shell. This command is equivalent to what we have in other programming languages. The echo command prints the given input string on the screen. Text Processing Commands In the previous section, we learned how to view the content of a file. In many cases, we will be interested in performing the below operations: Print only the lines which contain a particular word(s) Replace a particular word with another word in a file Sort the lines in a particular order There are three basic commands which are used frequently to process texts: grep sed sort We will now try to understand what each command does and how to use these commands. You should also practice the given examples on the online bash shell. We will create a new file called \"numbers.txt\" and insert numbers from 1 to 10 in this file. Each number will be in a separate line. grep The grep command in its simplest form can be used to search particular words in a text file. It will display all the lines in a file that contains a particular input. The word we want to search is provided as an input to the grep command. General syntax of using grep command: grep <word_to_search> <file_name> In this example, we are trying to search for a string \"1\" in this file. The grep command outputs the lines where it found this string. sed The sed command in its simplest form can be used to replace a text in a file. General syntax of using the sed command for replacement: sed 's/<text_to_replace>/<replacement_text>/' <file_name> Let's try to replace each occurrence of \"1\" in the file with \"3\" using sed command. The content of the file will not change in the above example. To do so, we have to use an extra argument '-i' so that the changes are reflected back in the file. sort The sort command can be used to sort the input provided to it as an argument. By default, it will sort in increasing order. Let's first see the content of the file before trying to sort it. Now, we will try to sort the file using the sort command. The sort command sorts the content in lexicographical order. The content of the file will not change in the above example. I/O Redirection Each open file gets assigned a file descriptor. A file descriptor is an unique identifier for open files in the system. There are always three default files open, stdin (the keyboard), stdout (the screen), and stderr (error messages output to the screen). These files can be redirected. Everything is a file in linux - https://unix.stackexchange.com/questions/225537/everything-is-a-file Till now, we have displayed all the output on the screen which is the standard output. We can use some special operators to redirect the output of the command to files or even to the input of other commands. I/O redirection is a very powerful feature. In the below example, we have used the '>' operator to redirect the output of ls command to output.txt file. In the below example, we have redirected the output from echo command to a file. We can also redirect the output of a command as an input to another command. This is possible with the help of pipes. In the below example, we have passed the output of cat command as an input to grep command using pipe(|) operator. In the below example, we have passed the output of sort command as an input to uniq command using pipe(|) operator. The uniq command only prints the unique numbers from the input. I/O redirection - https://tldp.org/LDP/abs/html/io-redirection.html","title":"Command Line Basics"},{"location":"linux_basics/command_line_basics/#command-line-basics","text":"","title":"Command Line Basics"},{"location":"linux_basics/command_line_basics/#lab-environment-setup","text":"One can use an online bash interpreter to run all the commands that are provided as examples in this course. This will also help you in getting a hands-on experience of various linux commands. REPL is one of the popular online bash interpreters for running linux commands. We will be using it for running all the commands mentioned in this course.","title":"Lab Environment Setup"},{"location":"linux_basics/command_line_basics/#what-is-a-command","text":"A command is a program that tells the operating system to perform specific work. Programs are stored as files in linux. Therefore, a command is also a file which is stored somewhere on the disk. Commands may also take additional arguments as input from the user. These arguments are called command line arguments. Knowing how to use the commands is important and there are many ways to get help in Linux, especially for commands. Almost every command will have some form of documentation, most commands will have a command-line argument -h or --help that will display a reasonable amount of documentation. But the most popular documentation system in Linux is called man pages - short for manual pages. Using --help to show the documentation for ls command.","title":"What is a Command"},{"location":"linux_basics/command_line_basics/#file-system-organization","text":"The linux file system has a hierarchical (or tree-like) structure with its highest level directory called root ( denoted by / ). Directories present inside the root directory stores file related to the system. These directories in turn can either store system files or application files or user related files. bin | The executable program of most commonly used commands reside in bin directory sbin | This directory contains programs used for system administration. home | This directory contains user related files and directories. lib | This directory contains all the library files etc | This directory contains all the system configuration files proc | This directory contains files related to the running processes on the system dev | This directory contains files related to devices on the system mnt | This directory contains files related to mounted devices on the system tmp | This directory is used to store temporary files on the system usr | This directory is used to store application programs on the system","title":"File System Organization"},{"location":"linux_basics/command_line_basics/#commands-for-navigating-the-file-system","text":"There are three basic commands which are used frequently to navigate the file system: ls pwd cd We will now try to understand what each command does and how to use these commands. You should also practice the given examples on the online bash shell.","title":"Commands for Navigating the File System"},{"location":"linux_basics/command_line_basics/#pwd-print-working-directory","text":"At any given moment of time, we will be standing in a certain directory. To get the name of the directory in which we are standing, we can use the pwd command in linux. We will now use the cd command to move to a different directory and then print the working directory.","title":"pwd (print working directory)"},{"location":"linux_basics/command_line_basics/#cd-change-directory","text":"The cd command can be used to change the working directory. Using the command, you can move from one directory to another. In the below example, we are initially in the root directory. we have then used the cd command to change the directory.","title":"cd (change directory)"},{"location":"linux_basics/command_line_basics/#ls-list-files-and-directories","text":"The ls command is used to list the contents of a directory. It will list down all the files and folders present in the given directory. If we just type ls in the shell, it will list all the files and directories present in the current directory. We can also provide the directory name as argument to ls command. It will then list all the files and directories inside the given directory.","title":"ls (list files and directories)**"},{"location":"linux_basics/command_line_basics/#commands-for-manipulating-files","text":"There are four basic commands which are used frequently to manipulate files: touch mkdir cp mv rm We will now try to understand what each command does and how to use these commands. You should also practice the given examples on the online bash shell.","title":"Commands for Manipulating Files"},{"location":"linux_basics/command_line_basics/#touch-create-new-file","text":"The touch command can be used to create an empty new file. This command is very useful for many other purposes but we will discuss the simplest use case of creating a new file. General syntax of using touch command touch <file_name>","title":"touch (create new file)"},{"location":"linux_basics/command_line_basics/#mkdir-create-new-directories","text":"The mkdir command is used to create directories.You can use ls command to verify that the new directory is created. General syntax of using mkdir command mkdir <directory_name>","title":"mkdir (create new directories)"},{"location":"linux_basics/command_line_basics/#rm-delete-files-and-directories","text":"The rm command can be used to delete files and directories. It is very important to note that this command permanently deletes the files and directories. It's almost impossible to recover these files and directories once you have executed rm command on them successfully. Do run this command with care. General syntax of using rm command: rm <file_name> Let's try to understand the rm command with an example. We will try to delete the file and directory we created using touch and mkdir command respectively.","title":"rm (delete files and directories)"},{"location":"linux_basics/command_line_basics/#cp-copy-files-and-directories","text":"The cp command is used to copy files and directories from one location to another. Do note that the cp command doesn't do any change to the original files or directories. The original files or directories and their copy both co-exist after running cp command successfully. General syntax of using cp command: cp <source_path> <destination_path> We are currently in the '/home/runner' directory. We will use the mkdir command to create a new directory named \"test_directory\". We will now try to copy the \"_test_runner.py\" file to the directory we created just now. Do note that nothing happened to the original \"_test_runner.py\" file. It's still there in the current directory. A new copy of it got created inside the \"test_directory\". We can also use the cp command to copy the whole directory from one location to another. Let's try to understand this with an example. We again used the mkdir command to create a new directory called \"another_directory\". We then used the cp command along with an additional argument '-r' to copy the \"test_directory\". mv (move files and directories) The mv command can either be used to move files or directories from one location to another or it can be used to rename files or directories. Do note that moving files and copying them are very different. When you move the files or directories, the original copy is lost. General syntax of using mv command: mv <source_path> <destination_path> In this example, we will use the mv command to move the \"_test_runner.py\" file to \"test_directory\". In this case, this file already exists in \"test_directory\". The mv command will just replace it. Do note that the original file doesn't exist in the current directory after mv command ran successfully. We can also use the mv command to move a directory from one location to another. In this case, we do not need to use the '-r' flag that we did while using the cp command. Do note that the original directory will not exist if we use mv command. One of the important uses of the mv command is to rename files and directories. Let's see how we can use this command for renaming. We have first changed our location to \"test_directory\". We then use the mv command to rename the \"\"_test_runner.py\" file to \"test.py\".","title":"cp (copy files and directories)"},{"location":"linux_basics/command_line_basics/#commands-for-viewing-files","text":"There are three basic commands which are used frequently to view the files: cat head tail We will now try to understand what each command does and how to use these commands. You should also practice the given examples on the online bash shell. We will create a new file called \"numbers.txt\" and insert numbers from 1 to 100 in this file. Each number will be in a separate line. Do not worry about the above command now. It's an advanced command which is used to generate numbers. We have then used a redirection operator to push these numbers to the file. We will be discussing I/O redirection in the later sections.","title":"Commands for Viewing Files"},{"location":"linux_basics/command_line_basics/#cat","text":"The most simplest use of cat command is to print the contents of the file on your output screen. This command is very useful and can be used for many other purposes. We will study about other use cases later. You can try to run the above command and you will see numbers being printed from 1 to 100 on your screen. You will need to scroll up to view all the numbers.","title":"cat"},{"location":"linux_basics/command_line_basics/#head","text":"The head command displays the first 10 lines of the file by default. We can include additional arguments to display as many lines as we want from the top. In this example, we are only able to see the first 10 lines from the file when we use the head command. By default, head command will only display the first 10 lines. If we want to specify the number of lines we want to see from start, use the '-n' argument to provide the input.","title":"head"},{"location":"linux_basics/command_line_basics/#tail","text":"The tail command displays the last 10 lines of the file by default. We can include additional arguments to display as many lines as we want from the end of the file. By default, the tail command will only display the last 10 lines. If we want to specify the number of lines we want to see from the end, use '-n' argument to provide the input. In this example, we are only able to see the last 5 lines from the file when we use the tail command with explicit -n option.","title":"tail"},{"location":"linux_basics/command_line_basics/#echo-command-in-linux","text":"The echo command is one of the simplest commands that is used in the shell. This command is equivalent to what we have in other programming languages. The echo command prints the given input string on the screen.","title":"Echo Command in Linux"},{"location":"linux_basics/command_line_basics/#text-processing-commands","text":"In the previous section, we learned how to view the content of a file. In many cases, we will be interested in performing the below operations: Print only the lines which contain a particular word(s) Replace a particular word with another word in a file Sort the lines in a particular order There are three basic commands which are used frequently to process texts: grep sed sort We will now try to understand what each command does and how to use these commands. You should also practice the given examples on the online bash shell. We will create a new file called \"numbers.txt\" and insert numbers from 1 to 10 in this file. Each number will be in a separate line.","title":"Text Processing Commands"},{"location":"linux_basics/command_line_basics/#grep","text":"The grep command in its simplest form can be used to search particular words in a text file. It will display all the lines in a file that contains a particular input. The word we want to search is provided as an input to the grep command. General syntax of using grep command: grep <word_to_search> <file_name> In this example, we are trying to search for a string \"1\" in this file. The grep command outputs the lines where it found this string.","title":"grep"},{"location":"linux_basics/command_line_basics/#sed","text":"The sed command in its simplest form can be used to replace a text in a file. General syntax of using the sed command for replacement: sed 's/<text_to_replace>/<replacement_text>/' <file_name> Let's try to replace each occurrence of \"1\" in the file with \"3\" using sed command. The content of the file will not change in the above example. To do so, we have to use an extra argument '-i' so that the changes are reflected back in the file.","title":"sed"},{"location":"linux_basics/command_line_basics/#sort","text":"The sort command can be used to sort the input provided to it as an argument. By default, it will sort in increasing order. Let's first see the content of the file before trying to sort it. Now, we will try to sort the file using the sort command. The sort command sorts the content in lexicographical order. The content of the file will not change in the above example.","title":"sort"},{"location":"linux_basics/command_line_basics/#io-redirection","text":"Each open file gets assigned a file descriptor. A file descriptor is an unique identifier for open files in the system. There are always three default files open, stdin (the keyboard), stdout (the screen), and stderr (error messages output to the screen). These files can be redirected. Everything is a file in linux - https://unix.stackexchange.com/questions/225537/everything-is-a-file Till now, we have displayed all the output on the screen which is the standard output. We can use some special operators to redirect the output of the command to files or even to the input of other commands. I/O redirection is a very powerful feature. In the below example, we have used the '>' operator to redirect the output of ls command to output.txt file. In the below example, we have redirected the output from echo command to a file. We can also redirect the output of a command as an input to another command. This is possible with the help of pipes. In the below example, we have passed the output of cat command as an input to grep command using pipe(|) operator. In the below example, we have passed the output of sort command as an input to uniq command using pipe(|) operator. The uniq command only prints the unique numbers from the input. I/O redirection - https://tldp.org/LDP/abs/html/io-redirection.html","title":"I/O Redirection"},{"location":"linux_basics/conclusion/","text":"Conclusion We have covered the basics of Linux operating systems and basic commands used in linux. We have also covered the Linux server administration commands. We hope that this course will make it easier for you to operate on the command line. Applications in SRE Role As a SRE, you will be required to perform some general tasks on these linux servers. You will also be using the command line when you are troubleshooting issues. Moving from one location to another in the filesystem will require the help of ls, pwd and cd commands You may need to search some specific information in the log files. Grep command would be very useful here. I/O redirection will become handy if you want to store the output in a file or pass it as an input to another command. Tail command is very useful to view the latest data in the log file. Different users will have different permissions depending on their roles. We will also not want everyone in the company to access our servers for security reasons. Users permissions can be restricted with chown, chmod and chgrp commands. SSH is one of the most frequently used commands for a SRE. Logging into servers and troubleshooting along with performing basic administration tasks will only be possible if we are able to login into the server. What if we want to run an apache server or nginx on a server ? We will first install it using the package manager. Package management commands become important here. Managing services on servers is another critical responsibility of a SRE. Systemd related commands can help in troubleshooting issues. If a service goes down, we can start it using systemctl start command. We can also stop a service in case it is not needed. Monitoring is another core responsibility of a SRE. Memory and CPU are two important system level metrics which should be monitored. Commands like top and free are quite helpful here. If a service is throwing an error, how do we find out the root cause of the error ? We will certainly need to check logs to find out the whole stack trace of the error. The log file will also tell us the number of times the error has occurred along with time when it started. Useful Courses and tutorials Edx basic linux commands course Edx Red Hat Enterprise Linux Course https://linuxcommand.org/lc3_learning_the_shell.php","title":"Conclusion"},{"location":"linux_basics/conclusion/#conclusion","text":"We have covered the basics of Linux operating systems and basic commands used in linux. We have also covered the Linux server administration commands. We hope that this course will make it easier for you to operate on the command line.","title":"Conclusion"},{"location":"linux_basics/conclusion/#applications-in-sre-role","text":"As a SRE, you will be required to perform some general tasks on these linux servers. You will also be using the command line when you are troubleshooting issues. Moving from one location to another in the filesystem will require the help of ls, pwd and cd commands You may need to search some specific information in the log files. Grep command would be very useful here. I/O redirection will become handy if you want to store the output in a file or pass it as an input to another command. Tail command is very useful to view the latest data in the log file. Different users will have different permissions depending on their roles. We will also not want everyone in the company to access our servers for security reasons. Users permissions can be restricted with chown, chmod and chgrp commands. SSH is one of the most frequently used commands for a SRE. Logging into servers and troubleshooting along with performing basic administration tasks will only be possible if we are able to login into the server. What if we want to run an apache server or nginx on a server ? We will first install it using the package manager. Package management commands become important here. Managing services on servers is another critical responsibility of a SRE. Systemd related commands can help in troubleshooting issues. If a service goes down, we can start it using systemctl start command. We can also stop a service in case it is not needed. Monitoring is another core responsibility of a SRE. Memory and CPU are two important system level metrics which should be monitored. Commands like top and free are quite helpful here. If a service is throwing an error, how do we find out the root cause of the error ? We will certainly need to check logs to find out the whole stack trace of the error. The log file will also tell us the number of times the error has occurred along with time when it started.","title":"Applications in SRE Role"},{"location":"linux_basics/conclusion/#useful-courses-and-tutorials","text":"Edx basic linux commands course Edx Red Hat Enterprise Linux Course https://linuxcommand.org/lc3_learning_the_shell.php","title":"Useful Courses and tutorials"},{"location":"linux_basics/intro/","text":"Linux Basics Introduction Prerequisites Comfortable using any operating systems like Windows, Linux or Mac Fundamental knowledge of operating systems What to expect from this course This course is divided into three parts. In the first part, we cover the fundamentals of Linux operating systems. We will talk about Linux architecture, Linux distributions and uses of Linux operating systems. We will also talk about the difference between GUI and CLI. In the second part, we cover some basic commands used in Linux. We will focus on commands used for navigating the file system, viewing and manipulating files, I/O redirection etc. In the third part, we cover Linux system administration. This includes day to day tasks performed by Linux admins, like managing users/groups, managing file permissions, monitoring system performance, log files etc. In the second and third part, we will be taking examples to understand the concepts. What is not covered under this course We are not covering advanced Linux commands and bash scripting in this course. We will also not be covering Linux internals. Course Contents The following topics has been covered in this course: Introduction to Linux What are Linux Operating Systems What are popular Linux distributions Uses of Linux Operating Systems Linux Architecture Graphical user interface (GUI) vs Command line interface (CLI) Command Line Basics Lab Environment Setup What is a Command File System Organization Navigating File System Manipulating Files Viewing Files Echo Command Text Processing Commands I/O Redirection Linux system administration Lab Environment Setup User/Groups management Becoming a Superuser File Permissions SSH Command Package Management Process Management Memory Management Daemons and Systemd Logs Conclusion Applications in SRE Role Useful Courses and tutorials What are Linux operating systems Most of us are familiar with the Windows operating system used in more than 75% of the personal computers. The Windows operating systems are based on Windows NT kernel. A kernel is the most important part of an operating system - it performs important functions like process management, memory management, filesystem management etc. Linux operating systems are based on the Linux kernel. A Linux based operating system will consist of Linux kernel, GUI/CLI, system libraries and system utilities. The Linux kernel was independently developed and released by Linus Torvalds. The Linux kernel is free and open-source - https://github.com/torvalds/linux History of Linux - https://en.wikipedia.org/wiki/History_of_Linux What are popular Linux distributions A Linux distribution(distro) is an operating system based on the Linux kernel and a package management system. A package management system consists of tools that help in installing, upgrading, configuring and removing softwares on the operating system. Software are usually adopted to a distribution and are packaged in a distro specific format. These packages are available through a distro specific repository. Packages are installed and managed in the operating system by a package manager. List of popular Linux distributions: Fedora Ubuntu Debian Centos Red Hat Enterprise Linux Suse Arch Linux Packaging systems Distributions Package manager Debian style (.deb) Debian, Ubuntu APT Red Hat style (.rpm) Fedora, CentOS, Red Hat Enterprise Linux YUM Linux Architecture The Linux kernel is monolithic in nature. System calls are used to interact with the Linux kernel space. Kernel code can only be executed in the kernel mode. Non-kernel code is executed in the user mode. Device drivers are used to communicate with the hardware devices. Uses of Linux Operating Systems Operating system based on Linux kernel are widely used in: Personal computers Servers Mobile phones - Android is based on Linux operating system Embedded devices - watches, televisions, traffic lights etc Satelites Network devices - routers, switches etc. Graphical user interface (GUI) vs Command line interface (CLI) A user interacts with a computer with the help of user interfaces. The user interface can be either GUI or CLI. Graphical user interface allows a user to interact with the computer using graphics such as icons and images. When a user clicks on an icon to open an application on a computer, he or she is actually using the GUI. It's easy to perform tasks using GUI. Command line interface allows a user to interact with the computer using commands. A user types the command in a terminal and the system helps in executing these commands. A new user with experience on GUI may find it difficult to interact with CLI as he/she needs to be aware of the commands to perform a particular operation. Shell vs Terminal Shell is a program that takes commands from the users and gives them to the operating system for processing. Shell is an example of a CLI(command line interface). Bash is one of the most popular shell programs available on Linux servers. Other popular shell programs are zsh, ksh and tcsh. Terminal is a program that opens a window and lets you interact with the shell. Some popular examples of terminals are gnome-terminal, xterm, konsole etc. Linux users do use the terms shell, terminal, prompt, console etc. interchangeably. In simple terms, these all refer to a way of taking commands from the user.","title":"Introduction"},{"location":"linux_basics/intro/#linux-basics","text":"","title":"Linux Basics"},{"location":"linux_basics/intro/#introduction","text":"","title":"Introduction"},{"location":"linux_basics/intro/#prerequisites","text":"Comfortable using any operating systems like Windows, Linux or Mac Fundamental knowledge of operating systems","title":"Prerequisites"},{"location":"linux_basics/intro/#what-to-expect-from-this-course","text":"This course is divided into three parts. In the first part, we cover the fundamentals of Linux operating systems. We will talk about Linux architecture, Linux distributions and uses of Linux operating systems. We will also talk about the difference between GUI and CLI. In the second part, we cover some basic commands used in Linux. We will focus on commands used for navigating the file system, viewing and manipulating files, I/O redirection etc. In the third part, we cover Linux system administration. This includes day to day tasks performed by Linux admins, like managing users/groups, managing file permissions, monitoring system performance, log files etc. In the second and third part, we will be taking examples to understand the concepts.","title":"What to expect from this course"},{"location":"linux_basics/intro/#what-is-not-covered-under-this-course","text":"We are not covering advanced Linux commands and bash scripting in this course. We will also not be covering Linux internals.","title":"What is not covered under this course"},{"location":"linux_basics/intro/#course-contents","text":"The following topics has been covered in this course: Introduction to Linux What are Linux Operating Systems What are popular Linux distributions Uses of Linux Operating Systems Linux Architecture Graphical user interface (GUI) vs Command line interface (CLI) Command Line Basics Lab Environment Setup What is a Command File System Organization Navigating File System Manipulating Files Viewing Files Echo Command Text Processing Commands I/O Redirection Linux system administration Lab Environment Setup User/Groups management Becoming a Superuser File Permissions SSH Command Package Management Process Management Memory Management Daemons and Systemd Logs Conclusion Applications in SRE Role Useful Courses and tutorials","title":"Course Contents"},{"location":"linux_basics/intro/#what-are-linux-operating-systems","text":"Most of us are familiar with the Windows operating system used in more than 75% of the personal computers. The Windows operating systems are based on Windows NT kernel. A kernel is the most important part of an operating system - it performs important functions like process management, memory management, filesystem management etc. Linux operating systems are based on the Linux kernel. A Linux based operating system will consist of Linux kernel, GUI/CLI, system libraries and system utilities. The Linux kernel was independently developed and released by Linus Torvalds. The Linux kernel is free and open-source - https://github.com/torvalds/linux History of Linux - https://en.wikipedia.org/wiki/History_of_Linux","title":"What are Linux operating systems"},{"location":"linux_basics/intro/#what-are-popular-linux-distributions","text":"A Linux distribution(distro) is an operating system based on the Linux kernel and a package management system. A package management system consists of tools that help in installing, upgrading, configuring and removing softwares on the operating system. Software are usually adopted to a distribution and are packaged in a distro specific format. These packages are available through a distro specific repository. Packages are installed and managed in the operating system by a package manager. List of popular Linux distributions: Fedora Ubuntu Debian Centos Red Hat Enterprise Linux Suse Arch Linux Packaging systems Distributions Package manager Debian style (.deb) Debian, Ubuntu APT Red Hat style (.rpm) Fedora, CentOS, Red Hat Enterprise Linux YUM","title":"What are popular Linux distributions"},{"location":"linux_basics/intro/#linux-architecture","text":"The Linux kernel is monolithic in nature. System calls are used to interact with the Linux kernel space. Kernel code can only be executed in the kernel mode. Non-kernel code is executed in the user mode. Device drivers are used to communicate with the hardware devices.","title":"Linux Architecture"},{"location":"linux_basics/intro/#uses-of-linux-operating-systems","text":"Operating system based on Linux kernel are widely used in: Personal computers Servers Mobile phones - Android is based on Linux operating system Embedded devices - watches, televisions, traffic lights etc Satelites Network devices - routers, switches etc.","title":"Uses of Linux Operating Systems"},{"location":"linux_basics/intro/#graphical-user-interface-gui-vs-command-line-interface-cli","text":"A user interacts with a computer with the help of user interfaces. The user interface can be either GUI or CLI. Graphical user interface allows a user to interact with the computer using graphics such as icons and images. When a user clicks on an icon to open an application on a computer, he or she is actually using the GUI. It's easy to perform tasks using GUI. Command line interface allows a user to interact with the computer using commands. A user types the command in a terminal and the system helps in executing these commands. A new user with experience on GUI may find it difficult to interact with CLI as he/she needs to be aware of the commands to perform a particular operation.","title":"Graphical user interface (GUI) vs Command line interface (CLI)"},{"location":"linux_basics/intro/#shell-vs-terminal","text":"Shell is a program that takes commands from the users and gives them to the operating system for processing. Shell is an example of a CLI(command line interface). Bash is one of the most popular shell programs available on Linux servers. Other popular shell programs are zsh, ksh and tcsh. Terminal is a program that opens a window and lets you interact with the shell. Some popular examples of terminals are gnome-terminal, xterm, konsole etc. Linux users do use the terms shell, terminal, prompt, console etc. interchangeably. In simple terms, these all refer to a way of taking commands from the user.","title":"Shell vs Terminal"},{"location":"linux_basics/linux_server_administration/","text":"Linux Server Administration In this course will try to cover some of the common tasks that a linux server administrator performs. We will first try to understand what a particular command does and then try to understand the commands using examples. Do keep in mind that it's very important to practice the Linux commands on your own. Lab Environment Setup Install docker on your system - https://docs.docker.com/engine/install/ We will be running all the commands on Red Hat Enterprise Linux (RHEL) 8 system. We will run most of the commands used in this module in the above Docker container. Multi-User Operating Systems An operating system is considered as multi-user if it allows multiple people/users to use a computer and not affect each other's files and preferences. Linux based operating systems are multi-user in nature as it allows multiple users to access the system at the same time. A typical computer will only have one keyboard and monitor but multiple users can log in via SSH if the computer is connected to the network. We will cover more about SSH later. As a server administrator, we are mostly concerned with the Linux servers which are physically present at a very large distance from us. We can connect to these servers with the help of remote login methods like SSH. Since Linux supports multiple users, we need to have a method which can protect the users from each other. One user should not be able to access and modify files of other users User/Group Management Users in Linux has an associated user ID called UID attached to them. Users also has a home directory and a login shell associated with them. A group is a collection of one or more users. A group makes it easier to share permissions among a group of users. Each group has a group ID called GID associated with it. id command id command can be used to find the uid and gid associated with an user. It also lists down the groups to which the user belongs to. The uid and gid associated with the root user is 0. A good way to find out the current user in Linux is to use the whoami command. \"root\" user or superuser is the most privileged user with unrestricted access to all the resources on the system. It has UID 0 Important files associated with users/groups /etc/passwd Stores the user name, the uid, the gid, the home directory, the login shell etc /etc/shadow Stores the password associated with the users /etc/group Stores information about different groups on the system If you want to understand each filed discussed in the above outputs, you can go through below links: https://tldp.org/LDP/lame/LAME/linux-admin-made-easy/shadow-file-formats.html https://tldp.org/HOWTO/User-Authentication-HOWTO/x71.html Important commands for managing users Some of the commands which are used frequently to manage users/groups on Linux are following: useradd - Creates a new user passwd - Adds or modifies passwords for a user usermod - Modifies attributes of an user userdel - Deletes an user useradd The useradd command adds a new user in Linux. We will create a new user 'shivam'. We will also verify that the user has been created by tailing the /etc/passwd file. The uid and gid are 1000 for the newly created user. The home directory assigned to the user is /home/shivam and the login shell assigned is /bin/bash. Do note that the user home directory and login shell can be modified later on. If we do not specify any value for attributes like home directory or login shell, default values will be assigned to the user. We can also override these default values when creating a new user. passwd The passwd command is used to create or modify passwords for a user. In the above examples, we have not assigned any password for users 'shivam' or 'amit' while creating them. \\\"!!\\\" in an account entry in shadow means the account of an user has been created, but not yet given a password. Let's now try to create a password for user \"shivam\". Do remember the password as we will be later using examples where it will be useful. Also, let's change the password for the root user now. When we switch from a normal user to root user, it will request you for a password. Also, when you login using root user, the password will be asked. usermod The usermod command is used to modify the attributes of an user like the home directory or the shell. Let's try to modify the login shell of user \"amit\" to \"/bin/bash\". In a similar way, you can also modify many other attributes for a user. Try 'usermod -h' for a list of attributes you can modify. userdel The userdel command is used to remove a user on Linux. Once we remove a user, all the information related to that user will be removed. Let's try to delete the user \"amit\". After deleting the user, you will not find the entry for that user in \"/etc/passwd\" or \"/etc/shadow\" file. Important commands for managing groups Commands for managing groups are quite similar to the commands used for managing users. Each command is not explained in detail here as they are quite similar. You can try running these commands on your system. groupadd \\<group_name> Creates a new group groupmod \\<group_name> Modifies attributes of a group groupdel \\<group_name> Deletes a group gpasswd \\<group_name> Modifies password for group We will now try to add user \"shivam\" to the group we have created above. Becoming a Superuser Before running the below commands, do make sure that you have set up a password for user \"shivam\" and user \"root\" using the passwd command described in the above section. The su command can be used to switch users in Linux. Let's now try to switch to user \"shivam\". Let's now try to open the \"/etc/shadow\" file. The operating system didn't allow the user \"shivam\" to read the content of the \"/etc/shadow\" file. This is an important file in Linux which stores the passwords of users. This file can only be accessed by root or users who have the superuser privileges. The sudo command allows a user to run commands with the security privileges of the root user. Do remember that the root user has all the privileges on a system. We can also use su command to switch to the root user and open the above file but doing that will require the password of the root user. An alternative way which is preferred on most modern operating systems is to use sudo command for becoming a superuser. Using this way, a user has to enter his/her password and they need to be a part of the sudo group. How to provide superpriveleges to other users ? Let's first switch to the root user using su command. Do note that using the below command will need you to enter the password for the root user. In case, you forgot to set a password for the root user, type \"exit\" and you will be back as the root user. Now, set up a password using the passwd command. The file /etc/sudoers holds the names of users permitted to invoke sudo . In redhat operating systems, this file is not present by default. We will need to install sudo. We will discuss the yum command in detail in later sections. Try to open the \"/etc/sudoers\" file on the system. The file has a lot of information. This file stores the rules that users must follow when running the sudo command. For example, root is allowed to run any commands from anywhere. One easy way of providing root access to users is to add them to a group which has permissions to run all the commands. \"wheel\" is a group in redhat Linux with such privileges. Let's add the user \"shivam\" to this group so that it also has sudo privileges. Let's now switch back to user \"shivam\" and try to access the \"/etc/shadow\" file. We need to use sudo before running the command since it can only be accessed with the sudo privileges. We have already given sudo privileges to user \u201cshivam\u201d by adding him to the group \u201cwheel\u201d. File Permissions On a Linux operating system, each file and directory is assigned access permissions for the owner of the file, the members of a group of related users and everybody else. This is to make sure that one user is not allowed to access the files and resources of another user. To see the permissions of a file, we can use the ls command. Let's look at the permissions of /etc/passwd file. Let's go over some of the important fields in the output that are related to file permissions. Chmod command The chmod command is used to modify files and directories permissions in Linux. The chmod command accepts permissions in as a numerical argument. We can think of permission as a series of bits with 1 representing True or allowed and 0 representing False or not allowed. Permission rwx Binary Decimal Read, write and execute rwx 111 7 Read and write rw- 110 6 Read and execute r-x 101 5 Read only r-- 100 4 Write and execute -wx 011 3 Write only -w- 010 2 Execute only --x 001 1 None --- 000 0 We will now create a new file and check the permission of the file. The group owner doesn't have the permission to write to this file. Let's give the group owner or root the permission to write to it using chmod command. Chmod command can be also used to change the permissions of a directory in the similar way. Chown command The chown command is used to change the owner of files or directories in Linux. Command syntax: chown \\<new_owner> \\<file_name> In case, we do not have sudo privileges, we need to use sudo command . Let's switch to user 'shivam' and try changing the owner. We have also changed the owner of the file to root before running the below command. Chown command can also be used to change the owner of a directory in the similar way. Chgrp command The chgrp command can be used to change the group ownership of files or directories in Linux. The syntax is very similar to that of chown command. Chgrp command can also be used to change the owner of a directory in the similar way. SSH Command The ssh command is used for logging into the remote systems, transfer files between systems and for executing commands on a remote machine. SSH stands for secure shell and is used to provide an encrypted secured connection between two hosts over an insecure network like the internet. Reference: https://www.ssh.com/ssh/command/ We will now discuss passwordless authentication which is secure and most commonly used for ssh authentication. Passwordless Authentication Using SSH Using this method, we can ssh into hosts without entering the password. This method is also useful when we want some scripts to perform ssh-related tasks. Passwordless authentication requires the use of a public and private key pair. As the name implies, the public key can be shared with anyone but the private key should be kept private. Lets not get into the details of how this authentication works. You can read more about it here Steps for setting up a passwordless authentication with a remote host: Generating public-private key pair If we already have a key pair stored in \\~/.ssh directory, we will not need to generate keys again. Install openssh package which contains all the commands related to ssh. Generate a key pair using the ssh-keygen command. One can choose the default values for all prompts. After running the ssh-keygen command successfully, we should see two keys present in the \\~/.ssh directory. Id_rsa is the private key and id_rsa.pub is the public key. Do note that the private key can only be read and modified by you. Transferring the public key to the remote host There are multiple ways to transfer the public key to the remote server. We will look at one of the most common ways of doing it using the ssh-id-copy command. Install the openssh-clients package to use ssh-id-copy command. Use the ssh-id-copy command to copy your public key to the remote host. Now, ssh into the remote host using the password authentication. Our public key should be there in \\~/.ssh/authorized_keys now. \\~/.ssh/authorized_key contains a list of public keys. The users associated with these public keys have the ssh access into the remote host. How to run commands on a remote host ? General syntax: ssh \\<user>@\\<hostname/hostip> \\<command> How to transfer files from one host to another host ? General syntax: scp \\<source> \\<destination> Package Management Package management is the process of installing and managing software on the system. We can install the packages which we require from the Linux package distributor. Different distributors use different packaging systems. Packaging systems Distributions Debian style (.deb) Debian, Ubuntu Red Hat style (.rpm) Fedora, CentOS, Red Hat Enterprise Linux Popular Packaging Systems in Linux Command Description yum install \\<package_name> Installs a package on your system yum update \\<package_name> Updates a package to it's latest available version yum remove \\<package_name> Removes a package from your system yum search \\<keyword> Searches for a particular keyword DNF is the successor to YUM which is now used in Fedora for installing and managing packages. DNF may replace YUM in the future on all RPM based Linux distributions. We did find an exact match for the keyword httpd when we searched using yum search command. Let's now install the httpd package. After httpd is installed, we will use the yum remove command to remove httpd package. Process Management In this section, we will study about some useful commands that can be used to monitor the processes on Linux systems. ps (process status) The ps command is used to know the information of a process or list of processes. If you get an error \"ps command not found\" while running ps command, do install procps package. ps without any arguments is not very useful. Let's try to list all the processes on the system by using the below command. Reference: https://unix.stackexchange.com/questions/106847/what-does-aux-mean-in-ps-aux We can use an additional argument with ps command to list the information about the process with a specific process ID. We can use grep in combination with ps command to list only specific processes. top The top command is used to show information about Linux processes running on the system in real time. It also shows a summary of the system information. For each process, top lists down the process ID, owner, priority, state, cpu utilization, memory utilization and much more information. It also lists down the memory utilization and cpu utilization of the system as a whole along with system uptime and cpu load average. Memory Management In this section, we will study about some useful commands that can be used to view information about the system memory. free The free command is used to display the memory usage of the system. The command displays the total free and used space available in the RAM along with space occupied by the caches/buffers. free command by default shows the memory usage in kilobytes. We can use an additional argument to get the data in human-readable format. vmstat The vmstat command can be used to display the memory usage along with additional information about io and cpu usage. Checking Disk Space In this section, we will study about some useful commands that can be used to view disk space on Linux. df (disk free) The df command is used to display the free and available space for each mounted file system. du (disk usage) The du command is used to display disk usage of files and directories on the system. The below command can be used to display the top 5 largest directories in the root directory. Daemons A computer program that runs as a background process is called a daemon. Traditionally, the name of daemon processes ended with d - sshd, httpd etc. We cannot interact with a daemon process as they run in the background. Services and daemons are used interchangeably most of the time. Systemd Systemd is a system and service manager for Linux operating systems. Systemd units are the building blocks of systemd. These units are represented by unit configuration files. The below examples shows the unit configuration files available at /usr/lib/systemd/system which are distributed by installed RPM packages. We are more interested in the configuration file that ends with service as these are service units. Managing System Services Service units end with .service file extension. Systemctl command can be used to start/stop/restart the services managed by systemd. Command Description systemctl start name.service Starts a service systemctl stop name.service Stops a service systemctl restart name.service Restarts a service systemctl status name.service Check the status of a service systemctl reload name.service Reload the configuration of a service Logs In this section, we will talk about some important files and directories which can be very useful for viewing system logs and applications logs in Linux. These logs can be very useful when you are troubleshooting on the system.","title":"Server Administration"},{"location":"linux_basics/linux_server_administration/#linux-server-administration","text":"In this course will try to cover some of the common tasks that a linux server administrator performs. We will first try to understand what a particular command does and then try to understand the commands using examples. Do keep in mind that it's very important to practice the Linux commands on your own.","title":"Linux Server Administration"},{"location":"linux_basics/linux_server_administration/#lab-environment-setup","text":"Install docker on your system - https://docs.docker.com/engine/install/ We will be running all the commands on Red Hat Enterprise Linux (RHEL) 8 system. We will run most of the commands used in this module in the above Docker container.","title":"Lab Environment Setup"},{"location":"linux_basics/linux_server_administration/#multi-user-operating-systems","text":"An operating system is considered as multi-user if it allows multiple people/users to use a computer and not affect each other's files and preferences. Linux based operating systems are multi-user in nature as it allows multiple users to access the system at the same time. A typical computer will only have one keyboard and monitor but multiple users can log in via SSH if the computer is connected to the network. We will cover more about SSH later. As a server administrator, we are mostly concerned with the Linux servers which are physically present at a very large distance from us. We can connect to these servers with the help of remote login methods like SSH. Since Linux supports multiple users, we need to have a method which can protect the users from each other. One user should not be able to access and modify files of other users","title":"Multi-User Operating Systems"},{"location":"linux_basics/linux_server_administration/#usergroup-management","text":"Users in Linux has an associated user ID called UID attached to them. Users also has a home directory and a login shell associated with them. A group is a collection of one or more users. A group makes it easier to share permissions among a group of users. Each group has a group ID called GID associated with it.","title":"User/Group Management"},{"location":"linux_basics/linux_server_administration/#id-command","text":"id command can be used to find the uid and gid associated with an user. It also lists down the groups to which the user belongs to. The uid and gid associated with the root user is 0. A good way to find out the current user in Linux is to use the whoami command. \"root\" user or superuser is the most privileged user with unrestricted access to all the resources on the system. It has UID 0","title":"id command"},{"location":"linux_basics/linux_server_administration/#important-files-associated-with-usersgroups","text":"/etc/passwd Stores the user name, the uid, the gid, the home directory, the login shell etc /etc/shadow Stores the password associated with the users /etc/group Stores information about different groups on the system If you want to understand each filed discussed in the above outputs, you can go through below links: https://tldp.org/LDP/lame/LAME/linux-admin-made-easy/shadow-file-formats.html https://tldp.org/HOWTO/User-Authentication-HOWTO/x71.html","title":"Important files associated with users/groups"},{"location":"linux_basics/linux_server_administration/#important-commands-for-managing-users","text":"Some of the commands which are used frequently to manage users/groups on Linux are following: useradd - Creates a new user passwd - Adds or modifies passwords for a user usermod - Modifies attributes of an user userdel - Deletes an user","title":"Important commands for managing users"},{"location":"linux_basics/linux_server_administration/#useradd","text":"The useradd command adds a new user in Linux. We will create a new user 'shivam'. We will also verify that the user has been created by tailing the /etc/passwd file. The uid and gid are 1000 for the newly created user. The home directory assigned to the user is /home/shivam and the login shell assigned is /bin/bash. Do note that the user home directory and login shell can be modified later on. If we do not specify any value for attributes like home directory or login shell, default values will be assigned to the user. We can also override these default values when creating a new user.","title":"useradd"},{"location":"linux_basics/linux_server_administration/#passwd","text":"The passwd command is used to create or modify passwords for a user. In the above examples, we have not assigned any password for users 'shivam' or 'amit' while creating them. \\\"!!\\\" in an account entry in shadow means the account of an user has been created, but not yet given a password. Let's now try to create a password for user \"shivam\". Do remember the password as we will be later using examples where it will be useful. Also, let's change the password for the root user now. When we switch from a normal user to root user, it will request you for a password. Also, when you login using root user, the password will be asked.","title":"passwd"},{"location":"linux_basics/linux_server_administration/#usermod","text":"The usermod command is used to modify the attributes of an user like the home directory or the shell. Let's try to modify the login shell of user \"amit\" to \"/bin/bash\". In a similar way, you can also modify many other attributes for a user. Try 'usermod -h' for a list of attributes you can modify.","title":"usermod"},{"location":"linux_basics/linux_server_administration/#userdel","text":"The userdel command is used to remove a user on Linux. Once we remove a user, all the information related to that user will be removed. Let's try to delete the user \"amit\". After deleting the user, you will not find the entry for that user in \"/etc/passwd\" or \"/etc/shadow\" file.","title":"userdel"},{"location":"linux_basics/linux_server_administration/#important-commands-for-managing-groups","text":"Commands for managing groups are quite similar to the commands used for managing users. Each command is not explained in detail here as they are quite similar. You can try running these commands on your system. groupadd \\<group_name> Creates a new group groupmod \\<group_name> Modifies attributes of a group groupdel \\<group_name> Deletes a group gpasswd \\<group_name> Modifies password for group We will now try to add user \"shivam\" to the group we have created above.","title":"Important commands for managing groups"},{"location":"linux_basics/linux_server_administration/#becoming-a-superuser","text":"Before running the below commands, do make sure that you have set up a password for user \"shivam\" and user \"root\" using the passwd command described in the above section. The su command can be used to switch users in Linux. Let's now try to switch to user \"shivam\". Let's now try to open the \"/etc/shadow\" file. The operating system didn't allow the user \"shivam\" to read the content of the \"/etc/shadow\" file. This is an important file in Linux which stores the passwords of users. This file can only be accessed by root or users who have the superuser privileges. The sudo command allows a user to run commands with the security privileges of the root user. Do remember that the root user has all the privileges on a system. We can also use su command to switch to the root user and open the above file but doing that will require the password of the root user. An alternative way which is preferred on most modern operating systems is to use sudo command for becoming a superuser. Using this way, a user has to enter his/her password and they need to be a part of the sudo group. How to provide superpriveleges to other users ? Let's first switch to the root user using su command. Do note that using the below command will need you to enter the password for the root user. In case, you forgot to set a password for the root user, type \"exit\" and you will be back as the root user. Now, set up a password using the passwd command. The file /etc/sudoers holds the names of users permitted to invoke sudo . In redhat operating systems, this file is not present by default. We will need to install sudo. We will discuss the yum command in detail in later sections. Try to open the \"/etc/sudoers\" file on the system. The file has a lot of information. This file stores the rules that users must follow when running the sudo command. For example, root is allowed to run any commands from anywhere. One easy way of providing root access to users is to add them to a group which has permissions to run all the commands. \"wheel\" is a group in redhat Linux with such privileges. Let's add the user \"shivam\" to this group so that it also has sudo privileges. Let's now switch back to user \"shivam\" and try to access the \"/etc/shadow\" file. We need to use sudo before running the command since it can only be accessed with the sudo privileges. We have already given sudo privileges to user \u201cshivam\u201d by adding him to the group \u201cwheel\u201d.","title":"Becoming a Superuser"},{"location":"linux_basics/linux_server_administration/#file-permissions","text":"On a Linux operating system, each file and directory is assigned access permissions for the owner of the file, the members of a group of related users and everybody else. This is to make sure that one user is not allowed to access the files and resources of another user. To see the permissions of a file, we can use the ls command. Let's look at the permissions of /etc/passwd file. Let's go over some of the important fields in the output that are related to file permissions.","title":"File Permissions"},{"location":"linux_basics/linux_server_administration/#chmod-command","text":"The chmod command is used to modify files and directories permissions in Linux. The chmod command accepts permissions in as a numerical argument. We can think of permission as a series of bits with 1 representing True or allowed and 0 representing False or not allowed. Permission rwx Binary Decimal Read, write and execute rwx 111 7 Read and write rw- 110 6 Read and execute r-x 101 5 Read only r-- 100 4 Write and execute -wx 011 3 Write only -w- 010 2 Execute only --x 001 1 None --- 000 0 We will now create a new file and check the permission of the file. The group owner doesn't have the permission to write to this file. Let's give the group owner or root the permission to write to it using chmod command. Chmod command can be also used to change the permissions of a directory in the similar way.","title":"Chmod command"},{"location":"linux_basics/linux_server_administration/#chown-command","text":"The chown command is used to change the owner of files or directories in Linux. Command syntax: chown \\<new_owner> \\<file_name> In case, we do not have sudo privileges, we need to use sudo command . Let's switch to user 'shivam' and try changing the owner. We have also changed the owner of the file to root before running the below command. Chown command can also be used to change the owner of a directory in the similar way.","title":"Chown command"},{"location":"linux_basics/linux_server_administration/#chgrp-command","text":"The chgrp command can be used to change the group ownership of files or directories in Linux. The syntax is very similar to that of chown command. Chgrp command can also be used to change the owner of a directory in the similar way.","title":"Chgrp command"},{"location":"linux_basics/linux_server_administration/#ssh-command","text":"The ssh command is used for logging into the remote systems, transfer files between systems and for executing commands on a remote machine. SSH stands for secure shell and is used to provide an encrypted secured connection between two hosts over an insecure network like the internet. Reference: https://www.ssh.com/ssh/command/ We will now discuss passwordless authentication which is secure and most commonly used for ssh authentication.","title":"SSH Command"},{"location":"linux_basics/linux_server_administration/#passwordless-authentication-using-ssh","text":"Using this method, we can ssh into hosts without entering the password. This method is also useful when we want some scripts to perform ssh-related tasks. Passwordless authentication requires the use of a public and private key pair. As the name implies, the public key can be shared with anyone but the private key should be kept private. Lets not get into the details of how this authentication works. You can read more about it here Steps for setting up a passwordless authentication with a remote host: Generating public-private key pair If we already have a key pair stored in \\~/.ssh directory, we will not need to generate keys again. Install openssh package which contains all the commands related to ssh. Generate a key pair using the ssh-keygen command. One can choose the default values for all prompts. After running the ssh-keygen command successfully, we should see two keys present in the \\~/.ssh directory. Id_rsa is the private key and id_rsa.pub is the public key. Do note that the private key can only be read and modified by you. Transferring the public key to the remote host There are multiple ways to transfer the public key to the remote server. We will look at one of the most common ways of doing it using the ssh-id-copy command. Install the openssh-clients package to use ssh-id-copy command. Use the ssh-id-copy command to copy your public key to the remote host. Now, ssh into the remote host using the password authentication. Our public key should be there in \\~/.ssh/authorized_keys now. \\~/.ssh/authorized_key contains a list of public keys. The users associated with these public keys have the ssh access into the remote host.","title":"Passwordless Authentication Using SSH"},{"location":"linux_basics/linux_server_administration/#how-to-run-commands-on-a-remote-host","text":"General syntax: ssh \\<user>@\\<hostname/hostip> \\<command>","title":"How to run commands on a remote host ?"},{"location":"linux_basics/linux_server_administration/#how-to-transfer-files-from-one-host-to-another-host","text":"General syntax: scp \\<source> \\<destination>","title":"How to transfer files from one host to another host ?"},{"location":"linux_basics/linux_server_administration/#package-management","text":"Package management is the process of installing and managing software on the system. We can install the packages which we require from the Linux package distributor. Different distributors use different packaging systems. Packaging systems Distributions Debian style (.deb) Debian, Ubuntu Red Hat style (.rpm) Fedora, CentOS, Red Hat Enterprise Linux Popular Packaging Systems in Linux Command Description yum install \\<package_name> Installs a package on your system yum update \\<package_name> Updates a package to it's latest available version yum remove \\<package_name> Removes a package from your system yum search \\<keyword> Searches for a particular keyword DNF is the successor to YUM which is now used in Fedora for installing and managing packages. DNF may replace YUM in the future on all RPM based Linux distributions. We did find an exact match for the keyword httpd when we searched using yum search command. Let's now install the httpd package. After httpd is installed, we will use the yum remove command to remove httpd package.","title":"Package Management"},{"location":"linux_basics/linux_server_administration/#process-management","text":"In this section, we will study about some useful commands that can be used to monitor the processes on Linux systems.","title":"Process Management"},{"location":"linux_basics/linux_server_administration/#ps-process-status","text":"The ps command is used to know the information of a process or list of processes. If you get an error \"ps command not found\" while running ps command, do install procps package. ps without any arguments is not very useful. Let's try to list all the processes on the system by using the below command. Reference: https://unix.stackexchange.com/questions/106847/what-does-aux-mean-in-ps-aux We can use an additional argument with ps command to list the information about the process with a specific process ID. We can use grep in combination with ps command to list only specific processes.","title":"ps (process status)"},{"location":"linux_basics/linux_server_administration/#top","text":"The top command is used to show information about Linux processes running on the system in real time. It also shows a summary of the system information. For each process, top lists down the process ID, owner, priority, state, cpu utilization, memory utilization and much more information. It also lists down the memory utilization and cpu utilization of the system as a whole along with system uptime and cpu load average.","title":"top"},{"location":"linux_basics/linux_server_administration/#memory-management","text":"In this section, we will study about some useful commands that can be used to view information about the system memory.","title":"Memory Management"},{"location":"linux_basics/linux_server_administration/#free","text":"The free command is used to display the memory usage of the system. The command displays the total free and used space available in the RAM along with space occupied by the caches/buffers. free command by default shows the memory usage in kilobytes. We can use an additional argument to get the data in human-readable format.","title":"free"},{"location":"linux_basics/linux_server_administration/#vmstat","text":"The vmstat command can be used to display the memory usage along with additional information about io and cpu usage.","title":"vmstat"},{"location":"linux_basics/linux_server_administration/#checking-disk-space","text":"In this section, we will study about some useful commands that can be used to view disk space on Linux.","title":"Checking Disk Space"},{"location":"linux_basics/linux_server_administration/#df-disk-free","text":"The df command is used to display the free and available space for each mounted file system.","title":"df (disk free)"},{"location":"linux_basics/linux_server_administration/#du-disk-usage","text":"The du command is used to display disk usage of files and directories on the system. The below command can be used to display the top 5 largest directories in the root directory.","title":"du (disk usage)"},{"location":"linux_basics/linux_server_administration/#daemons","text":"A computer program that runs as a background process is called a daemon. Traditionally, the name of daemon processes ended with d - sshd, httpd etc. We cannot interact with a daemon process as they run in the background. Services and daemons are used interchangeably most of the time.","title":"Daemons"},{"location":"linux_basics/linux_server_administration/#systemd","text":"Systemd is a system and service manager for Linux operating systems. Systemd units are the building blocks of systemd. These units are represented by unit configuration files. The below examples shows the unit configuration files available at /usr/lib/systemd/system which are distributed by installed RPM packages. We are more interested in the configuration file that ends with service as these are service units.","title":"Systemd"},{"location":"linux_basics/linux_server_administration/#managing-system-services","text":"Service units end with .service file extension. Systemctl command can be used to start/stop/restart the services managed by systemd. Command Description systemctl start name.service Starts a service systemctl stop name.service Stops a service systemctl restart name.service Restarts a service systemctl status name.service Check the status of a service systemctl reload name.service Reload the configuration of a service","title":"Managing System Services"},{"location":"linux_basics/linux_server_administration/#logs","text":"In this section, we will talk about some important files and directories which can be very useful for viewing system logs and applications logs in Linux. These logs can be very useful when you are troubleshooting on the system.","title":"Logs"},{"location":"linux_networking/conclusion/","text":"Conclusion With this we have traversed through the TCP/IP stack completely. We hope there will be a different perspective when one opens any website in the browser post the course. During the course we have also dissected what are common tasks in this pipeline which falls under the ambit of SRE. Post Training Exercises Setup own DNS resolver in the dev environment which acts as an authoritative DNS server for example.com and forwarder for other domains. Update resolv.conf to use the new DNS resolver running in localhost Set up a site dummy.example.com in localhost and run a webserver with a self signed certificate. Update the trusted CAs or pass self signed CA\u2019s public key as a parameter so that curl https://dummy.example.com -v works properly without self signed cert warning Update the routing table to use another host(container/VM) in the same network as a gateway for 8.8.8.8/32 and run ping 8.8.8.8. Do the packet capture on the new gateway to see L3 hop is working as expected(might need to disable icmp_redirect)","title":"Conclusion"},{"location":"linux_networking/conclusion/#conclusion","text":"With this we have traversed through the TCP/IP stack completely. We hope there will be a different perspective when one opens any website in the browser post the course. During the course we have also dissected what are common tasks in this pipeline which falls under the ambit of SRE.","title":"Conclusion"},{"location":"linux_networking/conclusion/#post-training-exercises","text":"Setup own DNS resolver in the dev environment which acts as an authoritative DNS server for example.com and forwarder for other domains. Update resolv.conf to use the new DNS resolver running in localhost Set up a site dummy.example.com in localhost and run a webserver with a self signed certificate. Update the trusted CAs or pass self signed CA\u2019s public key as a parameter so that curl https://dummy.example.com -v works properly without self signed cert warning Update the routing table to use another host(container/VM) in the same network as a gateway for 8.8.8.8/32 and run ping 8.8.8.8. Do the packet capture on the new gateway to see L3 hop is working as expected(might need to disable icmp_redirect)","title":"Post Training Exercises"},{"location":"linux_networking/dns/","text":"DNS Domain Names are the simple human-readable names for websites. The Internet understands only IP addresses, but since memorizing incoherent numbers is not practical, domain names are used instead. These domain names are translated into IP addresses by the DNS infrastructure. When somebody tries to open www.linkedin.com in the browser, the browser tries to convert www.linkedin.com to an IP Address. This process is called DNS resolution. A simple pseudocode depicting this process looks this ip, err = getIPAddress(domainName) if err: print(\u201cunknown Host Exception while trying to resolve:%s\u201d.format(domainName)) Now let\u2019s try to understand what happens inside the getIPAddress function. The browser would have a DNS cache of its own where it checks if there is a mapping for the domainName to an IP Address already available, in which case the browser uses that IP address. If no such mapping exists, the browser calls gethostbyname syscall to ask the operating system to find the IP address for the given domainName def getIPAddress(domainName): resp, fail = lookupCache(domainName) If not fail: return resp else: resp, err = gethostbyname(domainName) if err: return null, err else: return resp Now lets understand what operating system kernel does when the gethostbyname function is called. The Linux operating system looks at the file /etc/nsswitch.conf file which usually has a line hosts: files dns This line means the OS has to look up first in file (/etc/hosts) and then use DNS protocol to do the resolution if there is no match in /etc/hosts. The file /etc/hosts is of format IPAddress FQDN [FQDN].* 127.0.0.1 localhost.localdomain localhost ::1 localhost.localdomain localhost If a match exists for a domain in this file then that IP address is returned by the OS. Lets add a line to this file 127.0.0.1 test.linkedin.com And then do ping test.linkedin.com ping test.linkedin.com -n PING test.linkedin.com (127.0.0.1) 56(84) bytes of data. 64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.047 ms 64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.036 ms 64 bytes from 127.0.0.1: icmp_seq=3 ttl=64 time=0.037 ms As mentioned earlier, if no match exists in /etc/hosts, the OS tries to do a DNS resolution using the DNS protocol. The linux system makes a DNS request to the first IP in /etc/resolv.conf. If there is no response, requests are sent to subsequent servers in resolv.conf. These servers in resolv.conf are called DNS resolvers. The DNS resolvers are populated by DHCP or statically configured by an administrator. Dig is a userspace DNS system which creates and sends request to DNS resolvers and prints the response it receives to the console. #run this command in one shell to capture all DNS requests sudo tcpdump -s 0 -A -i any port 53 #make a dig request from another shell dig linkedin.com 13:19:54.432507 IP 172.19.209.122.56497 > 172.23.195.101.53: 527+ [1au] A? linkedin.com. (41) ....E..E....@.n....z...e...5.1.:... .........linkedin.com.......)........ 13:19:54.485131 IP 172.23.195.101.53 > 172.19.209.122.56497: 527 1/0/1 A 108.174.10.10 (57) ....E..U..@.|. ....e...z.5...A...............linkedin.com..............3..l. ..)........ The packet capture shows a request is made to 172.23.195.101:53 (this is the resolver in /etc/resolv.conf) for linkedin.com and a response is received from 172.23.195.101 with the IP address of linkedin.com 108.174.10.10 Now let's try to understand how DNS resolver tries to find the IP address of linkedin.com. DNS resolver first looks at its cache. Since many devices in the network can query for the domain name linkedin.com, the name resolution result may already exist in the cache. If there is a cache miss, it starts the DNS resolution process. The DNS server breaks \u201clinkedin.com\u201d to \u201c.\u201d, \u201ccom.\u201d and \u201clinkedin.com.\u201d and starts DNS resolution from \u201c.\u201d. The \u201c.\u201d is called root domain and those IPs are known to the DNS resolver software. DNS resolver queries the root domain Nameservers to find the right nameservers which could respond regarding details for \"com.\". The address of the authoritative nameserver of \u201ccom.\u201d is returned. Now the DNS resolution service contacts the authoritative nameserver for \u201ccom.\u201d to fetch the authoritative nameserver for \u201clinkedin.com\u201d. Once an authoritative nameserver of \u201clinkedin.com\u201d is known, the resolver contacts Linkedin\u2019s nameserver to provide the IP address of \u201clinkedin.com\u201d. This whole process can be visualized by running dig +trace linkedin.com linkedin.com. 3600 IN A 108.174.10.10 This DNS response has 5 fields where the first field is the request and the last field is the response. The second field is the Time to Live which says how long the DNS response is valid in seconds. In this case this mapping of linkedin.com is valid for 1 hour. This is how the resolvers and application(browser) maintain their cache. Any request for linkedin.com beyond 1 hour will be treated as a cache miss as the mapping has expired its TTL and the whole process has to be redone. The 4th field says the type of DNS response/request. Some of the various DNS query types are A, AAAA, NS, TXT, PTR, MX and CNAME. - A record returns IPV4 address of the domain name - AAAA record returns the IPV6 address of the domain Name - NS record returns the authoritative nameserver for the domain name - CNAME records are aliases to the domain names. Some domains point to other domain names and resolving the latter domain name gives an IP which is used as an IP for the former domain name as well. Example www.linkedin.com\u2019s IP address is the same as 2-01-2c3e-005a.cdx.cedexis.net. - For the brevity we are not discussing other DNS record types, the RFC of each of these records are available here . dig A linkedin.com +short 108.174.10.10 dig AAAA linkedin.com +short 2620:109:c002::6cae:a0a dig NS linkedin.com +short dns3.p09.nsone.net. dns4.p09.nsone.net. dns2.p09.nsone.net. ns4.p43.dynect.net. ns1.p43.dynect.net. ns2.p43.dynect.net. ns3.p43.dynect.net. dns1.p09.nsone.net. dig www.linkedin.com CNAME +short 2-01-2c3e-005a.cdx.cedexis.net. Armed with these fundamentals of DNS lets see usecases where DNS is used by SREs. Applications in SRE role This section covers some of the common solutions SRE can derive from DNS 1. Every company has to have its internal DNS infrastructure for intranet sites and internal services like databases and other internal applications like wiki. So there has to be a DNS infrastructure maintained for those domain names by the infrastructure team. This DNS infrastructure has to be optimized and scaled so that it doesn\u2019t become a single point of failure. Failure of the internal DNS infrastructure can cause API calls of microservices to fail and other cascading effects. 2. DNS can also be used for discovering services. For example the hostname serviceb.internal.example.com could list instances which run service b internally in example.com company. Cloud providers provide options to enable DNS discovery( example ) 3. DNS is used by cloud provides and CDN providers to scale their services. In Azure/AWS, Load Balancers are given a CNAME instead of IPAddress. They update the IPAddress of the Loadbalancers as they scale by changing the IP Address of alias domain names. This is one of the reasons why A records of such alias domains are short lived like 1 minute. 4. DNS can also be used to make clients get IP addresses closer to their location so that their HTTP calls can be responded faster if the company has a presence geographically distributed. 5. SRE also has to understand since there is no verification in DNS infrastructure, these responses can be spoofed. This is safeguarded by other protocols like HTTPS(dealt later). DNSSEC protects from forged or manipulated DNS responses. 6. Stale DNS cache can be a problem. Some apps might still be using expired DNS records for their api calls. This is something SRE has to be wary of when doing maintenance. 7. DNS Loadbalancing and service discovery also has to understand TTL and the servers can be removed from the pool only after waiting till TTL post the changes are made to DNS records. If this is not done, a certain portion of the traffic will fail as the server is removed before the TTL.","title":"DNS"},{"location":"linux_networking/dns/#dns","text":"Domain Names are the simple human-readable names for websites. The Internet understands only IP addresses, but since memorizing incoherent numbers is not practical, domain names are used instead. These domain names are translated into IP addresses by the DNS infrastructure. When somebody tries to open www.linkedin.com in the browser, the browser tries to convert www.linkedin.com to an IP Address. This process is called DNS resolution. A simple pseudocode depicting this process looks this ip, err = getIPAddress(domainName) if err: print(\u201cunknown Host Exception while trying to resolve:%s\u201d.format(domainName)) Now let\u2019s try to understand what happens inside the getIPAddress function. The browser would have a DNS cache of its own where it checks if there is a mapping for the domainName to an IP Address already available, in which case the browser uses that IP address. If no such mapping exists, the browser calls gethostbyname syscall to ask the operating system to find the IP address for the given domainName def getIPAddress(domainName): resp, fail = lookupCache(domainName) If not fail: return resp else: resp, err = gethostbyname(domainName) if err: return null, err else: return resp Now lets understand what operating system kernel does when the gethostbyname function is called. The Linux operating system looks at the file /etc/nsswitch.conf file which usually has a line hosts: files dns This line means the OS has to look up first in file (/etc/hosts) and then use DNS protocol to do the resolution if there is no match in /etc/hosts. The file /etc/hosts is of format IPAddress FQDN [FQDN].* 127.0.0.1 localhost.localdomain localhost ::1 localhost.localdomain localhost If a match exists for a domain in this file then that IP address is returned by the OS. Lets add a line to this file 127.0.0.1 test.linkedin.com And then do ping test.linkedin.com ping test.linkedin.com -n PING test.linkedin.com (127.0.0.1) 56(84) bytes of data. 64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.047 ms 64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.036 ms 64 bytes from 127.0.0.1: icmp_seq=3 ttl=64 time=0.037 ms As mentioned earlier, if no match exists in /etc/hosts, the OS tries to do a DNS resolution using the DNS protocol. The linux system makes a DNS request to the first IP in /etc/resolv.conf. If there is no response, requests are sent to subsequent servers in resolv.conf. These servers in resolv.conf are called DNS resolvers. The DNS resolvers are populated by DHCP or statically configured by an administrator. Dig is a userspace DNS system which creates and sends request to DNS resolvers and prints the response it receives to the console. #run this command in one shell to capture all DNS requests sudo tcpdump -s 0 -A -i any port 53 #make a dig request from another shell dig linkedin.com 13:19:54.432507 IP 172.19.209.122.56497 > 172.23.195.101.53: 527+ [1au] A? linkedin.com. (41) ....E..E....@.n....z...e...5.1.:... .........linkedin.com.......)........ 13:19:54.485131 IP 172.23.195.101.53 > 172.19.209.122.56497: 527 1/0/1 A 108.174.10.10 (57) ....E..U..@.|. ....e...z.5...A...............linkedin.com..............3..l. ..)........ The packet capture shows a request is made to 172.23.195.101:53 (this is the resolver in /etc/resolv.conf) for linkedin.com and a response is received from 172.23.195.101 with the IP address of linkedin.com 108.174.10.10 Now let's try to understand how DNS resolver tries to find the IP address of linkedin.com. DNS resolver first looks at its cache. Since many devices in the network can query for the domain name linkedin.com, the name resolution result may already exist in the cache. If there is a cache miss, it starts the DNS resolution process. The DNS server breaks \u201clinkedin.com\u201d to \u201c.\u201d, \u201ccom.\u201d and \u201clinkedin.com.\u201d and starts DNS resolution from \u201c.\u201d. The \u201c.\u201d is called root domain and those IPs are known to the DNS resolver software. DNS resolver queries the root domain Nameservers to find the right nameservers which could respond regarding details for \"com.\". The address of the authoritative nameserver of \u201ccom.\u201d is returned. Now the DNS resolution service contacts the authoritative nameserver for \u201ccom.\u201d to fetch the authoritative nameserver for \u201clinkedin.com\u201d. Once an authoritative nameserver of \u201clinkedin.com\u201d is known, the resolver contacts Linkedin\u2019s nameserver to provide the IP address of \u201clinkedin.com\u201d. This whole process can be visualized by running dig +trace linkedin.com linkedin.com. 3600 IN A 108.174.10.10 This DNS response has 5 fields where the first field is the request and the last field is the response. The second field is the Time to Live which says how long the DNS response is valid in seconds. In this case this mapping of linkedin.com is valid for 1 hour. This is how the resolvers and application(browser) maintain their cache. Any request for linkedin.com beyond 1 hour will be treated as a cache miss as the mapping has expired its TTL and the whole process has to be redone. The 4th field says the type of DNS response/request. Some of the various DNS query types are A, AAAA, NS, TXT, PTR, MX and CNAME. - A record returns IPV4 address of the domain name - AAAA record returns the IPV6 address of the domain Name - NS record returns the authoritative nameserver for the domain name - CNAME records are aliases to the domain names. Some domains point to other domain names and resolving the latter domain name gives an IP which is used as an IP for the former domain name as well. Example www.linkedin.com\u2019s IP address is the same as 2-01-2c3e-005a.cdx.cedexis.net. - For the brevity we are not discussing other DNS record types, the RFC of each of these records are available here . dig A linkedin.com +short 108.174.10.10 dig AAAA linkedin.com +short 2620:109:c002::6cae:a0a dig NS linkedin.com +short dns3.p09.nsone.net. dns4.p09.nsone.net. dns2.p09.nsone.net. ns4.p43.dynect.net. ns1.p43.dynect.net. ns2.p43.dynect.net. ns3.p43.dynect.net. dns1.p09.nsone.net. dig www.linkedin.com CNAME +short 2-01-2c3e-005a.cdx.cedexis.net. Armed with these fundamentals of DNS lets see usecases where DNS is used by SREs.","title":"DNS"},{"location":"linux_networking/dns/#applications-in-sre-role","text":"This section covers some of the common solutions SRE can derive from DNS 1. Every company has to have its internal DNS infrastructure for intranet sites and internal services like databases and other internal applications like wiki. So there has to be a DNS infrastructure maintained for those domain names by the infrastructure team. This DNS infrastructure has to be optimized and scaled so that it doesn\u2019t become a single point of failure. Failure of the internal DNS infrastructure can cause API calls of microservices to fail and other cascading effects. 2. DNS can also be used for discovering services. For example the hostname serviceb.internal.example.com could list instances which run service b internally in example.com company. Cloud providers provide options to enable DNS discovery( example ) 3. DNS is used by cloud provides and CDN providers to scale their services. In Azure/AWS, Load Balancers are given a CNAME instead of IPAddress. They update the IPAddress of the Loadbalancers as they scale by changing the IP Address of alias domain names. This is one of the reasons why A records of such alias domains are short lived like 1 minute. 4. DNS can also be used to make clients get IP addresses closer to their location so that their HTTP calls can be responded faster if the company has a presence geographically distributed. 5. SRE also has to understand since there is no verification in DNS infrastructure, these responses can be spoofed. This is safeguarded by other protocols like HTTPS(dealt later). DNSSEC protects from forged or manipulated DNS responses. 6. Stale DNS cache can be a problem. Some apps might still be using expired DNS records for their api calls. This is something SRE has to be wary of when doing maintenance. 7. DNS Loadbalancing and service discovery also has to understand TTL and the servers can be removed from the pool only after waiting till TTL post the changes are made to DNS records. If this is not done, a certain portion of the traffic will fail as the server is removed before the TTL.","title":"Applications in SRE role"},{"location":"linux_networking/http/","text":"HTTP Till this point we have only got the IP address of linkedin.com. The HTML page of linkedin.com is served by HTTP protocol which the browser renders. Browser sends a HTTP request to the IP of the server determined above. Request has a verb GET, PUT, POST followed by a path and query parameters and lines of key value pair which gives information about the client and capabilities of the client like contents it can accept and a body (usually in POST or PUT) # Eg run the following in your container and have a look at the headers curl linkedin.com -v * Connected to linkedin.com (108.174.10.10) port 80 (#0) > GET / HTTP/1.1 > Host: linkedin.com > User-Agent: curl/7.64.1 > Accept: */* > < HTTP/1.1 301 Moved Permanently < Date: Mon, 09 Nov 2020 10:39:43 GMT < X-Li-Pop: prod-esv5 < X-LI-Proto: http/1.1 < Location: https://www.linkedin.com/ < Content-Length: 0 < * Connection #0 to host linkedin.com left intact * Closing connection 0 Here, in the first line GET is the verb, / is the path and 1.1 is the HTTP protocol version. Then there are key value pairs which give client capabilities and some details to the server. The server responds back with HTTP version, Status Code and Status message . Status codes 2xx means success, 3xx denotes redirection, 4xx denotes client side errors and 5xx server side errors. We will now jump in to see the difference between HTTP/1.0 and HTTP/1.1. #On the terminal type telnet www.linkedin.com 80 #Copy and paste the following with an empty new line at last in the telnet STDIN GET / HTTP/1.1 HOST:linkedin.com USER-AGENT: curl This would get server response and waits for next input as the underlying connection to www.linkedin.com can be reused for further queries. While going through TCP, we can understand the benefits of this. But in HTTP/1.0 this connection will be immediately closed after the response meaning new connection has to be opened for each query. HTTP/1.1 can have only one inflight request in an open connection but connection can be reused for multiple requests one after another. One of the benefits of HTTP/2.0 over HTTP/1.1 is we can have multiple inflight requests on the same connection. We are restricting our scope to generic HTTP and not jumping to the intricacies of each protocol version but they should be straight forward to understand post the course. HTTP is called stateless protocol . This section we will try to understand what stateless means. Say we logged in to linkedin.com, each request to linkedin.com from the client will have no context of the user and it makes no sense to prompt user to login for each page/resource. This problem of HTTP is solved by COOKIE . A user is created a session when a user logs in. This session identifier is sent to the browser via SET-COOKIE header. The browser stores the COOKIE till the expiry set by the server and sends the cookie for each request from hereon for linkedin.com. More details on cookies are available here . Cookies are a critical piece of information like password and since HTTP is a plain text protocol, any man in the middle can capture either password or cookies and can breach the privacy of the user. Similarly as discussed during DNS a spoofed IP of linkedin.com can cause a phishing attack on users where an user can give linkedin\u2019s password to login on the malicious site. To solve both problems HTTPs came in place and HTTPs has to be mandated. HTTPS has to provide server identification and encryption of data between client and server. The server administrator has to generate a private public key pair and certificate request. This certificate request has to be signed by a certificate authority which converts the certificate request to a certificate. The server administrator has to update the certificate and private key to the webserver. The certificate has details about the server (like domain name for which it serves, expiry date), public key of the server. The private key is a secret to the server and losing the private key loses the trust the server provides. When clients connect, the client sends a HELLO. The server sends its certificate to the client. The client checks the validity of the cert by seeing if it is within its expiry time, if it is signed by a trusted authority and the hostname in the cert is the same as the server. This validation makes sure the server is the right server and there is no phishing. Once that is validated, the client negotiates a symmetrical key and cipher with the server by encrypting the negotiation with the public key of the server. Nobody else other than the server who has the private key can understand this data. Once negotiation is complete, that symmetric key and algorithm is used for further encryption which can be decrypted only by client and server from thereon as they only know the symmetric key and algorithm. The switch to symmetric algorithm from asymmetric encryption algorithm is to not strain the resources of client devices as symmetric encryption is generally less resource intensive than asymmetric. #Try the following on your terminal to see the cert details like Subject Name(domain name), Issuer details, Expiry date curl https://www.linkedin.com -v * Connected to www.linkedin.com (13.107.42.14) port 443 (#0) * ALPN, offering h2 * ALPN, offering http/1.1 * successfully set certificate verify locations: * CAfile: /etc/ssl/cert.pem CApath: none * TLSv1.2 (OUT), TLS handshake, Client hello (1): } [230 bytes data] * TLSv1.2 (IN), TLS handshake, Server hello (2): { [90 bytes data] * TLSv1.2 (IN), TLS handshake, Certificate (11): { [3171 bytes data] * TLSv1.2 (IN), TLS handshake, Server key exchange (12): { [365 bytes data] * TLSv1.2 (IN), TLS handshake, Server finished (14): { [4 bytes data] * TLSv1.2 (OUT), TLS handshake, Client key exchange (16): } [102 bytes data] * TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1): } [1 bytes data] * TLSv1.2 (OUT), TLS handshake, Finished (20): } [16 bytes data] * TLSv1.2 (IN), TLS change cipher, Change cipher spec (1): { [1 bytes data] * TLSv1.2 (IN), TLS handshake, Finished (20): { [16 bytes data] * SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384 * ALPN, server accepted to use h2 * Server certificate: * subject: C=US; ST=California; L=Sunnyvale; O=LinkedIn Corporation; CN=www.linkedin.com * start date: Oct 2 00:00:00 2020 GMT * expire date: Apr 2 12:00:00 2021 GMT * subjectAltName: host \"www.linkedin.com\" matched cert's \"www.linkedin.com\" * issuer: C=US; O=DigiCert Inc; CN=DigiCert SHA2 Secure Server CA * SSL certificate verify ok. * Using HTTP2, server supports multi-use * Connection state changed (HTTP/2 confirmed) * Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0 * Using Stream ID: 1 (easy handle 0x7fb055808200) * Connection state changed (MAX_CONCURRENT_STREAMS == 100)! 0 82117 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0 * Connection #0 to host www.linkedin.com left intact HTTP/2 200 cache-control: no-cache, no-store pragma: no-cache content-length: 82117 content-type: text/html; charset=utf-8 expires: Thu, 01 Jan 1970 00:00:00 GMT set-cookie: JSESSIONID=ajax:2747059799136291014; SameSite=None; Path=/; Domain=.www.linkedin.com; Secure set-cookie: lang=v=2&lang=en-us; SameSite=None; Path=/; Domain=linkedin.com; Secure set-cookie: bcookie=\"v=2&70bd59e3-5a51-406c-8e0d-dd70befa8890\"; domain=.linkedin.com; Path=/; Secure; Expires=Wed, 09-Nov-2022 22:27:42 GMT; SameSite=None set-cookie: bscookie=\"v=1&202011091050107ae9b7ac-fe97-40fc-830d-d7a9ccf80659AQGib5iXwarbY8CCBP94Q39THkgUlx6J\"; domain=.www.linkedin.com; Path=/; Secure; Expires=Wed, 09-Nov-2022 22:27:42 GMT; HttpOnly; SameSite=None set-cookie: lissc=1; domain=.linkedin.com; Path=/; Secure; Expires=Tue, 09-Nov-2021 10:50:10 GMT; SameSite=None set-cookie: lidc=\"b=VGST04:s=V:r=V:g=2201:u=1:i=1604919010:t=1605005410:v=1:sig=AQHe-KzU8i_5Iy6MwnFEsgRct3c9Lh5R\"; Expires=Tue, 10 Nov 2020 10:50:10 GMT; domain=.linkedin.com; Path=/; SameSite=None; Secure x-fs-txn-id: 2b8d5409ba70 x-fs-uuid: 61bbf94956d14516302567fc882b0000 expect-ct: max-age=86400, report-uri=\"https://www.linkedin.com/platform-telemetry/ct\" x-xss-protection: 1; mode=block content-security-policy-report-only: default-src 'none'; connect-src 'self' www.linkedin.com www.google-analytics.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://linkedin.sc.omtrdc.net/b/ss/ static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com; script-src 'sha256-THuVhwbXPeTR0HszASqMOnIyxqEgvGyBwSPBKBF/iMc=' 'sha256-PyCXNcEkzRWqbiNr087fizmiBBrq9O6GGD8eV3P09Ik=' 'sha256-2SQ55Erm3CPCb+k03EpNxU9bdV3XL9TnVTriDs7INZ4=' 'sha256-S/KSPe186K/1B0JEjbIXcCdpB97krdzX05S+dHnQjUs=' platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'self' 'unsafe-inline' static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com; media-src dms.licdn.com; child-src blob: *; frame-src 'self' lnkd.demdex.net linkedin.cdn.qualaroo.com; manifest-src 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=g content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=l x-frame-options: sameorigin x-content-type-options: nosniff strict-transport-security: max-age=2592000 x-li-fabric: prod-lva1 x-li-pop: afd-prod-lva1 x-li-proto: http/2 x-li-uuid: Ybv5SVbRRRYwJWf8iCsAAA== x-msedge-ref: Ref A: CFB9AC1D2B0645DDB161CEE4A4909AEF Ref B: BOM02EDGE0712 Ref C: 2020-11-09T10:50:10Z date: Mon, 09 Nov 2020 10:50:10 GMT * Closing connection 0 Here my system has a list of certificate authorities it trusts in this file /etc/ssl/cert.pem. Curl validates the certificate is for www.linkedin.com by seeing the CN section of the subject part of the certificate. It also makes sure the certificate is not expired by seeing the expire date. It also validates the signature on the certificate by using the public key of issuer Digicert in /etc/ssl/cert.pem. Once this is done, using the public key of www.linkedin.com it negotiates cipher TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 with a symmetric key. Subsequent data transfer including first HTTP request uses the same cipher and symmetric key.","title":"HTTP"},{"location":"linux_networking/http/#http","text":"Till this point we have only got the IP address of linkedin.com. The HTML page of linkedin.com is served by HTTP protocol which the browser renders. Browser sends a HTTP request to the IP of the server determined above. Request has a verb GET, PUT, POST followed by a path and query parameters and lines of key value pair which gives information about the client and capabilities of the client like contents it can accept and a body (usually in POST or PUT) # Eg run the following in your container and have a look at the headers curl linkedin.com -v * Connected to linkedin.com (108.174.10.10) port 80 (#0) > GET / HTTP/1.1 > Host: linkedin.com > User-Agent: curl/7.64.1 > Accept: */* > < HTTP/1.1 301 Moved Permanently < Date: Mon, 09 Nov 2020 10:39:43 GMT < X-Li-Pop: prod-esv5 < X-LI-Proto: http/1.1 < Location: https://www.linkedin.com/ < Content-Length: 0 < * Connection #0 to host linkedin.com left intact * Closing connection 0 Here, in the first line GET is the verb, / is the path and 1.1 is the HTTP protocol version. Then there are key value pairs which give client capabilities and some details to the server. The server responds back with HTTP version, Status Code and Status message . Status codes 2xx means success, 3xx denotes redirection, 4xx denotes client side errors and 5xx server side errors. We will now jump in to see the difference between HTTP/1.0 and HTTP/1.1. #On the terminal type telnet www.linkedin.com 80 #Copy and paste the following with an empty new line at last in the telnet STDIN GET / HTTP/1.1 HOST:linkedin.com USER-AGENT: curl This would get server response and waits for next input as the underlying connection to www.linkedin.com can be reused for further queries. While going through TCP, we can understand the benefits of this. But in HTTP/1.0 this connection will be immediately closed after the response meaning new connection has to be opened for each query. HTTP/1.1 can have only one inflight request in an open connection but connection can be reused for multiple requests one after another. One of the benefits of HTTP/2.0 over HTTP/1.1 is we can have multiple inflight requests on the same connection. We are restricting our scope to generic HTTP and not jumping to the intricacies of each protocol version but they should be straight forward to understand post the course. HTTP is called stateless protocol . This section we will try to understand what stateless means. Say we logged in to linkedin.com, each request to linkedin.com from the client will have no context of the user and it makes no sense to prompt user to login for each page/resource. This problem of HTTP is solved by COOKIE . A user is created a session when a user logs in. This session identifier is sent to the browser via SET-COOKIE header. The browser stores the COOKIE till the expiry set by the server and sends the cookie for each request from hereon for linkedin.com. More details on cookies are available here . Cookies are a critical piece of information like password and since HTTP is a plain text protocol, any man in the middle can capture either password or cookies and can breach the privacy of the user. Similarly as discussed during DNS a spoofed IP of linkedin.com can cause a phishing attack on users where an user can give linkedin\u2019s password to login on the malicious site. To solve both problems HTTPs came in place and HTTPs has to be mandated. HTTPS has to provide server identification and encryption of data between client and server. The server administrator has to generate a private public key pair and certificate request. This certificate request has to be signed by a certificate authority which converts the certificate request to a certificate. The server administrator has to update the certificate and private key to the webserver. The certificate has details about the server (like domain name for which it serves, expiry date), public key of the server. The private key is a secret to the server and losing the private key loses the trust the server provides. When clients connect, the client sends a HELLO. The server sends its certificate to the client. The client checks the validity of the cert by seeing if it is within its expiry time, if it is signed by a trusted authority and the hostname in the cert is the same as the server. This validation makes sure the server is the right server and there is no phishing. Once that is validated, the client negotiates a symmetrical key and cipher with the server by encrypting the negotiation with the public key of the server. Nobody else other than the server who has the private key can understand this data. Once negotiation is complete, that symmetric key and algorithm is used for further encryption which can be decrypted only by client and server from thereon as they only know the symmetric key and algorithm. The switch to symmetric algorithm from asymmetric encryption algorithm is to not strain the resources of client devices as symmetric encryption is generally less resource intensive than asymmetric. #Try the following on your terminal to see the cert details like Subject Name(domain name), Issuer details, Expiry date curl https://www.linkedin.com -v * Connected to www.linkedin.com (13.107.42.14) port 443 (#0) * ALPN, offering h2 * ALPN, offering http/1.1 * successfully set certificate verify locations: * CAfile: /etc/ssl/cert.pem CApath: none * TLSv1.2 (OUT), TLS handshake, Client hello (1): } [230 bytes data] * TLSv1.2 (IN), TLS handshake, Server hello (2): { [90 bytes data] * TLSv1.2 (IN), TLS handshake, Certificate (11): { [3171 bytes data] * TLSv1.2 (IN), TLS handshake, Server key exchange (12): { [365 bytes data] * TLSv1.2 (IN), TLS handshake, Server finished (14): { [4 bytes data] * TLSv1.2 (OUT), TLS handshake, Client key exchange (16): } [102 bytes data] * TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1): } [1 bytes data] * TLSv1.2 (OUT), TLS handshake, Finished (20): } [16 bytes data] * TLSv1.2 (IN), TLS change cipher, Change cipher spec (1): { [1 bytes data] * TLSv1.2 (IN), TLS handshake, Finished (20): { [16 bytes data] * SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384 * ALPN, server accepted to use h2 * Server certificate: * subject: C=US; ST=California; L=Sunnyvale; O=LinkedIn Corporation; CN=www.linkedin.com * start date: Oct 2 00:00:00 2020 GMT * expire date: Apr 2 12:00:00 2021 GMT * subjectAltName: host \"www.linkedin.com\" matched cert's \"www.linkedin.com\" * issuer: C=US; O=DigiCert Inc; CN=DigiCert SHA2 Secure Server CA * SSL certificate verify ok. * Using HTTP2, server supports multi-use * Connection state changed (HTTP/2 confirmed) * Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0 * Using Stream ID: 1 (easy handle 0x7fb055808200) * Connection state changed (MAX_CONCURRENT_STREAMS == 100)! 0 82117 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0 * Connection #0 to host www.linkedin.com left intact HTTP/2 200 cache-control: no-cache, no-store pragma: no-cache content-length: 82117 content-type: text/html; charset=utf-8 expires: Thu, 01 Jan 1970 00:00:00 GMT set-cookie: JSESSIONID=ajax:2747059799136291014; SameSite=None; Path=/; Domain=.www.linkedin.com; Secure set-cookie: lang=v=2&lang=en-us; SameSite=None; Path=/; Domain=linkedin.com; Secure set-cookie: bcookie=\"v=2&70bd59e3-5a51-406c-8e0d-dd70befa8890\"; domain=.linkedin.com; Path=/; Secure; Expires=Wed, 09-Nov-2022 22:27:42 GMT; SameSite=None set-cookie: bscookie=\"v=1&202011091050107ae9b7ac-fe97-40fc-830d-d7a9ccf80659AQGib5iXwarbY8CCBP94Q39THkgUlx6J\"; domain=.www.linkedin.com; Path=/; Secure; Expires=Wed, 09-Nov-2022 22:27:42 GMT; HttpOnly; SameSite=None set-cookie: lissc=1; domain=.linkedin.com; Path=/; Secure; Expires=Tue, 09-Nov-2021 10:50:10 GMT; SameSite=None set-cookie: lidc=\"b=VGST04:s=V:r=V:g=2201:u=1:i=1604919010:t=1605005410:v=1:sig=AQHe-KzU8i_5Iy6MwnFEsgRct3c9Lh5R\"; Expires=Tue, 10 Nov 2020 10:50:10 GMT; domain=.linkedin.com; Path=/; SameSite=None; Secure x-fs-txn-id: 2b8d5409ba70 x-fs-uuid: 61bbf94956d14516302567fc882b0000 expect-ct: max-age=86400, report-uri=\"https://www.linkedin.com/platform-telemetry/ct\" x-xss-protection: 1; mode=block content-security-policy-report-only: default-src 'none'; connect-src 'self' www.linkedin.com www.google-analytics.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://linkedin.sc.omtrdc.net/b/ss/ static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com; script-src 'sha256-THuVhwbXPeTR0HszASqMOnIyxqEgvGyBwSPBKBF/iMc=' 'sha256-PyCXNcEkzRWqbiNr087fizmiBBrq9O6GGD8eV3P09Ik=' 'sha256-2SQ55Erm3CPCb+k03EpNxU9bdV3XL9TnVTriDs7INZ4=' 'sha256-S/KSPe186K/1B0JEjbIXcCdpB97krdzX05S+dHnQjUs=' platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'self' 'unsafe-inline' static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com; media-src dms.licdn.com; child-src blob: *; frame-src 'self' lnkd.demdex.net linkedin.cdn.qualaroo.com; manifest-src 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=g content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=l x-frame-options: sameorigin x-content-type-options: nosniff strict-transport-security: max-age=2592000 x-li-fabric: prod-lva1 x-li-pop: afd-prod-lva1 x-li-proto: http/2 x-li-uuid: Ybv5SVbRRRYwJWf8iCsAAA== x-msedge-ref: Ref A: CFB9AC1D2B0645DDB161CEE4A4909AEF Ref B: BOM02EDGE0712 Ref C: 2020-11-09T10:50:10Z date: Mon, 09 Nov 2020 10:50:10 GMT * Closing connection 0 Here my system has a list of certificate authorities it trusts in this file /etc/ssl/cert.pem. Curl validates the certificate is for www.linkedin.com by seeing the CN section of the subject part of the certificate. It also makes sure the certificate is not expired by seeing the expire date. It also validates the signature on the certificate by using the public key of issuer Digicert in /etc/ssl/cert.pem. Once this is done, using the public key of www.linkedin.com it negotiates cipher TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 with a symmetric key. Subsequent data transfer including first HTTP request uses the same cipher and symmetric key.","title":"HTTP"},{"location":"linux_networking/intro/","text":"Linux Networking Fundamentals Prerequisites High-level knowledge of commonly used jargon in TCP/IP stack like DNS, TCP, UDP and HTTP Linux Commandline Basics What to expect from this course Throughout the course, we cover how an SRE can optimize the system to improve their web stack performance and troubleshoot if there is an issue in any of the layers of the networking stack. This course tries to dig through each layer of traditional TCP/IP stack and expects an SRE to have a picture beyond the bird\u2019s eye view of the functioning of the Internet. What is not covered under this course This course spends time on the fundamentals. We are not covering concepts like HTTP/2.0 , QUIC , TCP congestion control protocols , Anycast , BGP , CDN , Tunnels and Multicast . We expect that this course will provide the relevant basics to understand such concepts Birds eye view of the course The course covers the question \u201cWhat happens when you open linkedin.com in your browser?\u201d The course follows the flow of TCP/IP stack.More specifically, the course covers topics of Application layer protocols DNS and HTTP, transport layer protocols UDP and TCP, networking layer protocol IP and Data Link Layer protocol Course Contents DNS UDP HTTP TCP IP Routing","title":"Introduction"},{"location":"linux_networking/intro/#linux-networking-fundamentals","text":"","title":"Linux Networking Fundamentals"},{"location":"linux_networking/intro/#prerequisites","text":"High-level knowledge of commonly used jargon in TCP/IP stack like DNS, TCP, UDP and HTTP Linux Commandline Basics","title":"Prerequisites"},{"location":"linux_networking/intro/#what-to-expect-from-this-course","text":"Throughout the course, we cover how an SRE can optimize the system to improve their web stack performance and troubleshoot if there is an issue in any of the layers of the networking stack. This course tries to dig through each layer of traditional TCP/IP stack and expects an SRE to have a picture beyond the bird\u2019s eye view of the functioning of the Internet.","title":"What to expect from this course"},{"location":"linux_networking/intro/#what-is-not-covered-under-this-course","text":"This course spends time on the fundamentals. We are not covering concepts like HTTP/2.0 , QUIC , TCP congestion control protocols , Anycast , BGP , CDN , Tunnels and Multicast . We expect that this course will provide the relevant basics to understand such concepts","title":"What is not covered under this course"},{"location":"linux_networking/intro/#birds-eye-view-of-the-course","text":"The course covers the question \u201cWhat happens when you open linkedin.com in your browser?\u201d The course follows the flow of TCP/IP stack.More specifically, the course covers topics of Application layer protocols DNS and HTTP, transport layer protocols UDP and TCP, networking layer protocol IP and Data Link Layer protocol","title":"Birds eye view of the course"},{"location":"linux_networking/intro/#course-contents","text":"DNS UDP HTTP TCP IP Routing","title":"Course Contents"},{"location":"linux_networking/ipr/","text":"IP Routing and Data Link Layer We will dig how packets that leave the client reach the server and vice versa. When the packet reaches the IP layer, the transport layer populates source port, destination port. IP/Network layer populates destination IP(discovered from DNS) and then looks up the route to the destination IP on the routing table. #Linux route -n command gives the default routing table route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 172.17.0.1 0.0.0.0 UG 0 0 0 eth0 172.17.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0 Here the destination IP is bitwise AND\u2019d with the Genmask and if the answer is the destination part of the table then that gateway and interface is picked for routing. Here linkedin.com\u2019s IP 108.174.10.10 is AND\u2019d with 255.255.255.0 and the answer we get is 108.174.10.0 which doesn\u2019t match with any destination in the routing table. Then Linux does an AND of destination IP with 0.0.0.0 and we get 0.0.0.0. This answer matches the default row Routing table is processed in the order of more octets of 1 set in genmask and genmask 0.0.0.0 is the default route if nothing matches. At the end of this operation Linux figured out that the packet has to be sent to next hop 172.17.0.1 via eth0. The source IP of the packet will be set as the IP of interface eth0. Now to send the packet to 172.17.0.1 linux has to figure out the MAC address of 172.17.0.1. MAC address is figured by looking at the internal arp cache which stores translation between IP address and MAC address. If there is a cache miss, Linux broadcasts ARP request within the internal network asking who has 172.17.0.1. The owner of the IP sends an ARP response which is cached by the kernel and the kernel sends the packet to the gateway by setting Source mac address as mac address of eth0 and destination mac address of 172.17.0.1 which we got just now. Similar routing lookup process is followed in each hop till the packet reaches the actual server. Transport layer and layers above it come to play only at end servers. During intermediate hops only till the IP/Network layer is involved. One weird gateway we saw in the routing table is 0.0.0.0. This gateway means no Layer3(Network layer) hop is needed to send the packet. Both source and destination are in the same network. Kernel has to figure out the mac of the destination and populate source and destination mac appropriately and send the packet out so that it reaches the destination without any Layer3 hop in the middle As we followed in other modules, lets complete this session with SRE usecases Applications in SRE role Generally the routing table is populated by DHCP and playing around is not a good practice. There can be reasons where one has to play around the routing table but take that path only when it's absolutely necessary Understanding error messages better like, \u201cNo route to host\u201d error can mean mac address of the destination host is not found and it can mean the destination host is down On rare cases looking at the ARP table can help us understand if there is a IP conflict where same IP is assigned to two hosts by mistake and this is causing unexpected behavior","title":"Routing"},{"location":"linux_networking/ipr/#ip-routing-and-data-link-layer","text":"We will dig how packets that leave the client reach the server and vice versa. When the packet reaches the IP layer, the transport layer populates source port, destination port. IP/Network layer populates destination IP(discovered from DNS) and then looks up the route to the destination IP on the routing table. #Linux route -n command gives the default routing table route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 172.17.0.1 0.0.0.0 UG 0 0 0 eth0 172.17.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0 Here the destination IP is bitwise AND\u2019d with the Genmask and if the answer is the destination part of the table then that gateway and interface is picked for routing. Here linkedin.com\u2019s IP 108.174.10.10 is AND\u2019d with 255.255.255.0 and the answer we get is 108.174.10.0 which doesn\u2019t match with any destination in the routing table. Then Linux does an AND of destination IP with 0.0.0.0 and we get 0.0.0.0. This answer matches the default row Routing table is processed in the order of more octets of 1 set in genmask and genmask 0.0.0.0 is the default route if nothing matches. At the end of this operation Linux figured out that the packet has to be sent to next hop 172.17.0.1 via eth0. The source IP of the packet will be set as the IP of interface eth0. Now to send the packet to 172.17.0.1 linux has to figure out the MAC address of 172.17.0.1. MAC address is figured by looking at the internal arp cache which stores translation between IP address and MAC address. If there is a cache miss, Linux broadcasts ARP request within the internal network asking who has 172.17.0.1. The owner of the IP sends an ARP response which is cached by the kernel and the kernel sends the packet to the gateway by setting Source mac address as mac address of eth0 and destination mac address of 172.17.0.1 which we got just now. Similar routing lookup process is followed in each hop till the packet reaches the actual server. Transport layer and layers above it come to play only at end servers. During intermediate hops only till the IP/Network layer is involved. One weird gateway we saw in the routing table is 0.0.0.0. This gateway means no Layer3(Network layer) hop is needed to send the packet. Both source and destination are in the same network. Kernel has to figure out the mac of the destination and populate source and destination mac appropriately and send the packet out so that it reaches the destination without any Layer3 hop in the middle As we followed in other modules, lets complete this session with SRE usecases","title":"IP Routing and Data Link Layer"},{"location":"linux_networking/ipr/#applications-in-sre-role","text":"Generally the routing table is populated by DHCP and playing around is not a good practice. There can be reasons where one has to play around the routing table but take that path only when it's absolutely necessary Understanding error messages better like, \u201cNo route to host\u201d error can mean mac address of the destination host is not found and it can mean the destination host is down On rare cases looking at the ARP table can help us understand if there is a IP conflict where same IP is assigned to two hosts by mistake and this is causing unexpected behavior","title":"Applications in SRE role"},{"location":"linux_networking/tcp/","text":"TCP TCP is a transport layer protocol like UDP but it guarantees reliability, flow control and congestion control. TCP guarantees reliable delivery by using sequence numbers. A TCP connection is established by a three way handshake. In our case, the client sends a SYN packet along with the starting sequence number it plans to use, the server acknowledges the SYN packet and sends a SYN with its sequence number. Once the client acknowledges the syn packet, the connection is established. Each data transferred from here on is considered delivered reliably once acknowledgement for that sequence is received by the concerned party #To understand handshake run packet capture on one bash session tcpdump -S -i any port 80 #Run curl on one bash session curl www.linkedin.com Here client sends a syn flag shown by [S] flag with a sequence number 1522264672. The server acknowledges receipt of SYN with an ack [.] flag and a Syn flag for its sequence number[S]. The server uses the sequence number 1063230400 and acknowledges the client it\u2019s expecting sequence number 1522264673 (client sequence+1). Client sends a zero length acknowledgement packet to the server(server sequence+1) and connection stands established. This is called three way handshake. The client sends a 76 bytes length packet after this and increments its sequence number by 76. Server sends a 170 byte response and closes the connection. This was the difference we were talking about between HTTP/1.1 and HTTP/1.0. In HTTP/1.1 this same connection can be reused which reduces overhead of 3 way handshake for each HTTP request. If a packet is missed between client and server, server won\u2019t send an ack to the client and client would retry sending the packet till the ACK is received. This guarantees reliability. The flow control is established by the win size field in each segment. The win size says available TCP buffer length in the kernel which can be used to buffer received segments. A size 0 means the receiver has a lot of lag to catch from its socket buffer and the sender has to pause sending packets so that receiver can cope up. This flow control protects from slow receiver and fast sender problem TCP also does congestion control which determines how many segments can be in transit without an ack. Linux provides us the ability to configure algorithms for congestion control which we are not covering here. While closing a connection, client/server calls a close syscall. Let's assume client do that. Client\u2019s kernel will send a FIN packet to the server. Server\u2019s kernel can\u2019t close the connection till the close syscall is called by the server application. Once server app calls close, server also sends a FIN packet and client enters into time wait state for 2*MSS(120s) so that this socket can\u2019t be reused for that time period to prevent any TCP state corruptions due to stray stale packets. Armed with our TCP and HTTP knowledge lets see how this is used by SREs in their role Applications in SRE role Scaling HTTP performance using load balancers need consistent knowledge about both TCP and HTTP. There are different kinds of load balancing like L4, L7 load balancing, Direct Server Return etc. HTTPs offloading can be done on Load balancer or directly on servers based on the performance and compliance needs. Tweaking sysctl variables for rmem and wmem like we did for UDP can improve throughput of sender and receiver. Sysctl variable tcp_max_syn_backlog and socket variable somax_conn determines how many connections for which the kernel can complete 3 way handshake before app calling accept syscall. This is much useful in single threaded applications. Once the backlog is full, new connections stay in SYN_RCVD state (when you run netstat) till the application calls accept syscall Apps can run out of file descriptors if there are too many short lived connections. Digging through tcp_reuse and tcp_recycle can help reduce time spent in the time wait state(it has its own risk). Making apps reuse a pool of connections instead of creating ad hoc connection can also help Understanding performance bottlenecks by seeing metrics and classifying whether its a problem in App or network side. Example too many sockets in Close_wait state is a problem on application whereas retransmissions can be a problem more on network or on OS stack than the application itself. Understanding the fundamentals can help us narrow down where the bottleneck is","title":"TCP"},{"location":"linux_networking/tcp/#tcp","text":"TCP is a transport layer protocol like UDP but it guarantees reliability, flow control and congestion control. TCP guarantees reliable delivery by using sequence numbers. A TCP connection is established by a three way handshake. In our case, the client sends a SYN packet along with the starting sequence number it plans to use, the server acknowledges the SYN packet and sends a SYN with its sequence number. Once the client acknowledges the syn packet, the connection is established. Each data transferred from here on is considered delivered reliably once acknowledgement for that sequence is received by the concerned party #To understand handshake run packet capture on one bash session tcpdump -S -i any port 80 #Run curl on one bash session curl www.linkedin.com Here client sends a syn flag shown by [S] flag with a sequence number 1522264672. The server acknowledges receipt of SYN with an ack [.] flag and a Syn flag for its sequence number[S]. The server uses the sequence number 1063230400 and acknowledges the client it\u2019s expecting sequence number 1522264673 (client sequence+1). Client sends a zero length acknowledgement packet to the server(server sequence+1) and connection stands established. This is called three way handshake. The client sends a 76 bytes length packet after this and increments its sequence number by 76. Server sends a 170 byte response and closes the connection. This was the difference we were talking about between HTTP/1.1 and HTTP/1.0. In HTTP/1.1 this same connection can be reused which reduces overhead of 3 way handshake for each HTTP request. If a packet is missed between client and server, server won\u2019t send an ack to the client and client would retry sending the packet till the ACK is received. This guarantees reliability. The flow control is established by the win size field in each segment. The win size says available TCP buffer length in the kernel which can be used to buffer received segments. A size 0 means the receiver has a lot of lag to catch from its socket buffer and the sender has to pause sending packets so that receiver can cope up. This flow control protects from slow receiver and fast sender problem TCP also does congestion control which determines how many segments can be in transit without an ack. Linux provides us the ability to configure algorithms for congestion control which we are not covering here. While closing a connection, client/server calls a close syscall. Let's assume client do that. Client\u2019s kernel will send a FIN packet to the server. Server\u2019s kernel can\u2019t close the connection till the close syscall is called by the server application. Once server app calls close, server also sends a FIN packet and client enters into time wait state for 2*MSS(120s) so that this socket can\u2019t be reused for that time period to prevent any TCP state corruptions due to stray stale packets. Armed with our TCP and HTTP knowledge lets see how this is used by SREs in their role","title":"TCP"},{"location":"linux_networking/tcp/#applications-in-sre-role","text":"Scaling HTTP performance using load balancers need consistent knowledge about both TCP and HTTP. There are different kinds of load balancing like L4, L7 load balancing, Direct Server Return etc. HTTPs offloading can be done on Load balancer or directly on servers based on the performance and compliance needs. Tweaking sysctl variables for rmem and wmem like we did for UDP can improve throughput of sender and receiver. Sysctl variable tcp_max_syn_backlog and socket variable somax_conn determines how many connections for which the kernel can complete 3 way handshake before app calling accept syscall. This is much useful in single threaded applications. Once the backlog is full, new connections stay in SYN_RCVD state (when you run netstat) till the application calls accept syscall Apps can run out of file descriptors if there are too many short lived connections. Digging through tcp_reuse and tcp_recycle can help reduce time spent in the time wait state(it has its own risk). Making apps reuse a pool of connections instead of creating ad hoc connection can also help Understanding performance bottlenecks by seeing metrics and classifying whether its a problem in App or network side. Example too many sockets in Close_wait state is a problem on application whereas retransmissions can be a problem more on network or on OS stack than the application itself. Understanding the fundamentals can help us narrow down where the bottleneck is","title":"Applications in SRE role"},{"location":"linux_networking/udp/","text":"UDP UDP is a transport layer protocol. DNS is an application layer protocol that runs on top of UDP(most of the times). Before jumping into UDP, let's try to understand what an application and transport layer is. DNS protocol is used by a DNS client(eg dig) and DNS server(eg named). The transport layer makes sure the DNS request reaches the DNS server process and similarly the response reaches the DNS client process. Multiple processes can run on a system and they can listen on any ports . DNS servers usually listen on port number 53. When a client makes a DNS request, after filling the necessary application payload, it passes the payload to the kernel via sendto system call. The kernel picks a random port number( >1024 ) as source port number and puts 53 as destination port number and sends the packet to lower layers. When the kernel on server side receives the packet, it checks the port number and queues the packet to the application buffer of the DNS server process which makes a recvfrom system call and reads the packet. This process by the kernel is called multiplexing(combining packets from multiple applications to same lower layers) and demultiplexing(segregating packets from single lower layer to multiple applications). Multiplexing and Demultiplexing is done by the Transport layer. UDP is one of the simplest transport layer protocol and it does only multiplexing and demultiplexing. Another common transport layer protocol TCP does a bunch of other things like reliable communication, flow control and congestion control. UDP is designed to be lightweight and handle communications with little overhead. So it doesn\u2019t do anything beyond multiplexing and demultiplexing. If applications running on top of UDP need any of the features of TCP, they have to implement that in their application This example from python wiki covers a sample UDP client and server where \u201cHello World\u201d is an application payload sent to server listening on port number 5005. The server receives the packet and prints the \u201cHello World\u201d string from the client Applications in SRE role If the underlying network is slow and the UDP layer is unable to queue packets down to the networking layer, sendto syscall from the application will hang till the kernel finds some of its buffer is freed. This can affect the throughput of the system. Increasing write memory buffer values using sysctl variables net.core.wmem_max and net.core.wmem_default provides some cushion to the application from the slow network Similarly if the receiver process is slow in consuming from its buffer, the kernel has to drop packets which it can\u2019t queue due to the buffer being full. Since UDP doesn\u2019t guarantee reliability these dropped packets can cause data loss unless tracked by the application layer. Increasing sysctl variables rmem_default and rmem_max can provide some cushion to slow applications from fast senders.","title":"UDP"},{"location":"linux_networking/udp/#udp","text":"UDP is a transport layer protocol. DNS is an application layer protocol that runs on top of UDP(most of the times). Before jumping into UDP, let's try to understand what an application and transport layer is. DNS protocol is used by a DNS client(eg dig) and DNS server(eg named). The transport layer makes sure the DNS request reaches the DNS server process and similarly the response reaches the DNS client process. Multiple processes can run on a system and they can listen on any ports . DNS servers usually listen on port number 53. When a client makes a DNS request, after filling the necessary application payload, it passes the payload to the kernel via sendto system call. The kernel picks a random port number( >1024 ) as source port number and puts 53 as destination port number and sends the packet to lower layers. When the kernel on server side receives the packet, it checks the port number and queues the packet to the application buffer of the DNS server process which makes a recvfrom system call and reads the packet. This process by the kernel is called multiplexing(combining packets from multiple applications to same lower layers) and demultiplexing(segregating packets from single lower layer to multiple applications). Multiplexing and Demultiplexing is done by the Transport layer. UDP is one of the simplest transport layer protocol and it does only multiplexing and demultiplexing. Another common transport layer protocol TCP does a bunch of other things like reliable communication, flow control and congestion control. UDP is designed to be lightweight and handle communications with little overhead. So it doesn\u2019t do anything beyond multiplexing and demultiplexing. If applications running on top of UDP need any of the features of TCP, they have to implement that in their application This example from python wiki covers a sample UDP client and server where \u201cHello World\u201d is an application payload sent to server listening on port number 5005. The server receives the packet and prints the \u201cHello World\u201d string from the client","title":"UDP"},{"location":"linux_networking/udp/#applications-in-sre-role","text":"If the underlying network is slow and the UDP layer is unable to queue packets down to the networking layer, sendto syscall from the application will hang till the kernel finds some of its buffer is freed. This can affect the throughput of the system. Increasing write memory buffer values using sysctl variables net.core.wmem_max and net.core.wmem_default provides some cushion to the application from the slow network Similarly if the receiver process is slow in consuming from its buffer, the kernel has to drop packets which it can\u2019t queue due to the buffer being full. Since UDP doesn\u2019t guarantee reliability these dropped packets can cause data loss unless tracked by the application layer. Increasing sysctl variables rmem_default and rmem_max can provide some cushion to slow applications from fast senders.","title":"Applications in SRE role"},{"location":"python_web/intro/","text":"Python and The Web Prerequisites Basic understanding of python language. Basic familiarity with flask framework. What to expect from this course This course is divided into two high level parts. In the first part, assuming familiarity with python language\u2019s basic operations and syntax usage, we will dive a little deeper into understanding python as a language. We will compare python with other programming languages that you might already know like Java and C. We will also explore concepts of Python objects and with help of that, explore python features like decorators. In the second part which will revolve around the web, and also assume familiarity with the Flask framework, we will start from the socket module and work with HTTP requests. This will demystify how frameworks like flask work internally. And to introduce SRE flavour to the course, we will design, develop and deploy (in theory) a URL shortening application. We will emphasize parts of the whole process that are more important as an SRE of the said app/service. What is not covered under this course Extensive knowledge of python internals and advanced python. Lab Environment Setup Have latest version of python installed Course Contents The Python Language Some Python Concepts Python Gotchas Python and Web Sockets Flask The URL Shortening App Design Scaling The App Monitoring The App The Python Language Assuming you know a little bit of C/C++ and Java, let's try to discuss the following questions in context of those two languages and python. You might have heard that C/C++ is a compiled language while python is an interpreted language. Generally, with compiled language we first compile the program and then run the executable while in case of python we run the source code directly like python hello_world.py . While Java, being an interpreted language, still has a separate compilation step and then its run. So what's really the difference? Compiled vs. Interpreted This might sound a little weird to you: python, in a way is a compiled language! Python has a compiler built-in! It is obvious in the case of java since we compile it using a separate command ie: javac helloWorld.java and it will produce a .class file which we know as a bytecode . Well, python is very similar to that. One difference here is that there is no separate compile command/binary needed to run a python program. What is the difference then, between java and python? Well, Java's compiler is more strict and sophisticated. As you might know Java is a statically typed language. So the compiler is written in a way that it can verify types related errors during compile time. While python being a dynamic language, types are not known until a program is run. So in a way, python compiler is dumb (or, less strict). But there indeed is a compile step involved when a python program is run. You might have seen python bytecode files with .pyc extension. Here is how you can see bytecode for a given python program. # Create a Hello World spatel1-mn1:tmp spatel1$ echo \"print('hello world')\" > hello_world.py # Making sure it runs spatel1-mn1:tmp spatel1$ python3 hello_world.py hello world # The bytecode of the given program spatel1-mn1:tmp spatel1$ python -m dis hello_world.py 1 0 LOAD_NAME 0 (print) 2 LOAD_CONST 0 ('hello world') 4 CALL_FUNCTION 1 6 POP_TOP 8 LOAD_CONST 1 (None) 10 RETURN_VALUE Read more about dis module here Now coming to C/C++, there of course is a compiler. But the output is different than what java/python compiler would produce. Compiling a C program would produce what we also know as machine code . As opposed to bytecode. Running The Programs We know compilation is involved in all 3 languages we are discussing. Just that the compilers are different in nature and they output different types of content. In case of C/C++, the output is machine code which can be directly read by your operating system. When you execute that program, your OS will know how exactly to run it. But this is not the case with bytecode. Those bytecodes are language specific. Python has its own set of bytecode defined (more in dis module) and so does java. So naturally, your operating system will not know how to run it. To run this bytecode, we have something called Virtual Machines. Ie: The JVM or the Python VM (CPython, Jython). These so called Virtual Machines are the programs which can read the bytecode and run it on a given operating system. Python has multiple VMs available. Cpython is a python VM implemented in C language, similarly Jython is a Java implementation of python VM. At the end of the day, what they should be capable of is to understand python language syntax, be able to compile it to bytecode and be able to run that bytecode. You can implement a python VM in any language! (And people do so, just because it can be done) The Operating System +------------------------------------+ | | | | | | hello_world.py Python bytecode | Python VM Process | | | +----------------+ +----------------+ | +----------------+ | |print(... | COMPILE |LOAD_CONST... | | |Reads bytecode | | | +--------------->+ +------------------->+line by line | | | | | | | |and executes. | | | | | | | | | | +----------------+ +----------------+ | +----------------+ | | | | | | | hello_world.c OS Specific machinecode | A New Process | | | +----------------+ +----------------+ | +----------------+ | |void main() { | COMPILE | binary contents| | | binary contents| | | +--------------->+ +------------------->+ | | | | | | | | | | | | | | | | | | +----------------+ +----------------+ | +----------------+ | | (binary contents | | runs as is) | | | | | +------------------------------------+ Two things to note for above diagram: Generally, when we run a python program, a python VM process is started which reads the python source code, compiles it to byte code and run it in a single step. Compiling is not a separate step. Shown only for illustration purpose. Binaries generated for C like languages are not exactly run as is. Since there are multiple types of binaries (eg: ELF), there are more complicated steps involved in order to run a binary but we will not go into that since all that is done at OS level.","title":"Introduction"},{"location":"python_web/intro/#python-and-the-web","text":"","title":"Python and The Web"},{"location":"python_web/intro/#prerequisites","text":"Basic understanding of python language. Basic familiarity with flask framework.","title":"Prerequisites"},{"location":"python_web/intro/#what-to-expect-from-this-course","text":"This course is divided into two high level parts. In the first part, assuming familiarity with python language\u2019s basic operations and syntax usage, we will dive a little deeper into understanding python as a language. We will compare python with other programming languages that you might already know like Java and C. We will also explore concepts of Python objects and with help of that, explore python features like decorators. In the second part which will revolve around the web, and also assume familiarity with the Flask framework, we will start from the socket module and work with HTTP requests. This will demystify how frameworks like flask work internally. And to introduce SRE flavour to the course, we will design, develop and deploy (in theory) a URL shortening application. We will emphasize parts of the whole process that are more important as an SRE of the said app/service.","title":"What to expect from this course"},{"location":"python_web/intro/#what-is-not-covered-under-this-course","text":"Extensive knowledge of python internals and advanced python.","title":"What is not covered under this course"},{"location":"python_web/intro/#lab-environment-setup","text":"Have latest version of python installed","title":"Lab Environment Setup"},{"location":"python_web/intro/#course-contents","text":"The Python Language Some Python Concepts Python Gotchas Python and Web Sockets Flask The URL Shortening App Design Scaling The App Monitoring The App","title":"Course Contents"},{"location":"python_web/intro/#the-python-language","text":"Assuming you know a little bit of C/C++ and Java, let's try to discuss the following questions in context of those two languages and python. You might have heard that C/C++ is a compiled language while python is an interpreted language. Generally, with compiled language we first compile the program and then run the executable while in case of python we run the source code directly like python hello_world.py . While Java, being an interpreted language, still has a separate compilation step and then its run. So what's really the difference?","title":"The Python Language"},{"location":"python_web/intro/#compiled-vs-interpreted","text":"This might sound a little weird to you: python, in a way is a compiled language! Python has a compiler built-in! It is obvious in the case of java since we compile it using a separate command ie: javac helloWorld.java and it will produce a .class file which we know as a bytecode . Well, python is very similar to that. One difference here is that there is no separate compile command/binary needed to run a python program. What is the difference then, between java and python? Well, Java's compiler is more strict and sophisticated. As you might know Java is a statically typed language. So the compiler is written in a way that it can verify types related errors during compile time. While python being a dynamic language, types are not known until a program is run. So in a way, python compiler is dumb (or, less strict). But there indeed is a compile step involved when a python program is run. You might have seen python bytecode files with .pyc extension. Here is how you can see bytecode for a given python program. # Create a Hello World spatel1-mn1:tmp spatel1$ echo \"print('hello world')\" > hello_world.py # Making sure it runs spatel1-mn1:tmp spatel1$ python3 hello_world.py hello world # The bytecode of the given program spatel1-mn1:tmp spatel1$ python -m dis hello_world.py 1 0 LOAD_NAME 0 (print) 2 LOAD_CONST 0 ('hello world') 4 CALL_FUNCTION 1 6 POP_TOP 8 LOAD_CONST 1 (None) 10 RETURN_VALUE Read more about dis module here Now coming to C/C++, there of course is a compiler. But the output is different than what java/python compiler would produce. Compiling a C program would produce what we also know as machine code . As opposed to bytecode.","title":"Compiled vs. Interpreted"},{"location":"python_web/intro/#running-the-programs","text":"We know compilation is involved in all 3 languages we are discussing. Just that the compilers are different in nature and they output different types of content. In case of C/C++, the output is machine code which can be directly read by your operating system. When you execute that program, your OS will know how exactly to run it. But this is not the case with bytecode. Those bytecodes are language specific. Python has its own set of bytecode defined (more in dis module) and so does java. So naturally, your operating system will not know how to run it. To run this bytecode, we have something called Virtual Machines. Ie: The JVM or the Python VM (CPython, Jython). These so called Virtual Machines are the programs which can read the bytecode and run it on a given operating system. Python has multiple VMs available. Cpython is a python VM implemented in C language, similarly Jython is a Java implementation of python VM. At the end of the day, what they should be capable of is to understand python language syntax, be able to compile it to bytecode and be able to run that bytecode. You can implement a python VM in any language! (And people do so, just because it can be done) The Operating System +------------------------------------+ | | | | | | hello_world.py Python bytecode | Python VM Process | | | +----------------+ +----------------+ | +----------------+ | |print(... | COMPILE |LOAD_CONST... | | |Reads bytecode | | | +--------------->+ +------------------->+line by line | | | | | | | |and executes. | | | | | | | | | | +----------------+ +----------------+ | +----------------+ | | | | | | | hello_world.c OS Specific machinecode | A New Process | | | +----------------+ +----------------+ | +----------------+ | |void main() { | COMPILE | binary contents| | | binary contents| | | +--------------->+ +------------------->+ | | | | | | | | | | | | | | | | | | +----------------+ +----------------+ | +----------------+ | | (binary contents | | runs as is) | | | | | +------------------------------------+ Two things to note for above diagram: Generally, when we run a python program, a python VM process is started which reads the python source code, compiles it to byte code and run it in a single step. Compiling is not a separate step. Shown only for illustration purpose. Binaries generated for C like languages are not exactly run as is. Since there are multiple types of binaries (eg: ELF), there are more complicated steps involved in order to run a binary but we will not go into that since all that is done at OS level.","title":"Running The Programs"},{"location":"python_web/python-concepts/","text":"Some Python Concepts Though you are expected to know python and its syntax at basic level, let us discuss some fundamental concepts that will help you understand the python language better. Everything in Python is an object. That includes the functions, lists, dicts, classes, modules, a running function (instance of function definition), everything. In the CPython, it would mean there is an underlying struct variable for each object. In python's current execution context, all the variables are stored in a dict. It'd be a string to object mapping. If you have a function and a float variable defined in the current context, here is how it is handled internally. >>> float_number=42.0 >>> def foo_func(): ... pass ... # NOTICE HOW VARIABLE NAMES ARE STRINGS, stored in a dict >>> locals() {'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': <class '_frozen_importlib.BuiltinImporter'>, '__spec__': None, '__annotations__': {}, '__builtins__': <module 'builtins' (built-in)>, 'float_number': 42.0, 'foo_func': <function foo_func at 0x1055847a0>} Python Functions Since functions too are objects, we can see what all attributes a function contains as following >>> def hello(name): ... print(f\"Hello, {name}!\") ... >>> dir(hello) ['__annotations__', '__call__', '__class__', '__closure__', '__code__', '__defaults__', '__delattr__', '__dict__', '__dir__', '__doc__', '__eq__', '__format__', '__ge__', '__get__', '__getattribute__', '__globals__', '__gt__', '__hash__', '__init__', '__init_subclass__', '__kwdefaults__', '__le__', '__lt__', '__module__', '__name__', '__ne__', '__new__', '__qualname__', '__reduce__', '__reduce_ex__', '__repr__', '__setattr__', '__sizeof__', '__str__', '__subclasshook__'] While there are a lot of them, let's look at some interesting ones globals This attribute, as the name suggests, has references of global variables. If you ever need to know what all global variables are in the scope of this function, this will tell you. See how the function start seeing the new variable in globals >>> hello.__globals__ {'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': <class '_frozen_importlib.BuiltinImporter'>, '__spec__': None, '__annotations__': {}, '__builtins__': <module 'builtins' (built-in)>, 'hello': <function hello at 0x7fe4e82554c0>} # adding new global variable >>> GLOBAL=\"g_val\" >>> hello.__globals__ {'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': <class '_frozen_importlib.BuiltinImporter'>, '__spec__': None, '__annotations__': {}, '__builtins__': <module 'builtins' (built-in)>, 'hello': <function hello at 0x7fe4e82554c0>, 'GLOBAL': 'g_val'} code This is an interesting one! As everything in python is an object, this includes the bytecode too. The compiled python bytecode is a python code object. Which is accessible via __code__ attribute here. A function has an associated code object which carries some interesting information. # the file in which function is defined # stdin here since this is run in an interpreter >>> hello.__code__.co_filename '<stdin>' # number of arguments the function takes >>> hello.__code__.co_argcount 1 # local variable names >>> hello.__code__.co_varnames ('name',) # the function code's compiled bytecode >>> hello.__code__.co_code b't\\x00d\\x01|\\x00\\x9b\\x00d\\x02\\x9d\\x03\\x83\\x01\\x01\\x00d\\x00S\\x00' There are more code attributes which you can enlist by >>> dir(hello.__code__) Decorators Related to functions, python has another feature called decorators. Let's see how that works, keeping everything is an object in mind. Here is a sample decorator: >>> def deco(func): ... def inner(): ... print(\"before\") ... func() ... print(\"after\") ... return inner ... >>> @deco ... def hello_world(): ... print(\"hello world\") ... >>> >>> hello_world() before hello world after Here @deco syntax is used to decorate the hello_world function. It is essentially same as doing >>> def hello_world(): ... print(\"hello world\") ... >>> hello_world = deco(hello_world) What goes inside the deco function might seem complex. Let's try to uncover it. Function hello_world is created It is passed to deco function deco create a new function This new function is calls hello_world function And does a couple other things deco returns the newly created function hello_world is replaced with above function Let's visualize it for better understanding BEFORE function_object (ID: 100) \"hello_world\" +--------------------+ + |print(\"hello_world\")| | | | +--------------> | | | | +--------------------+ WHAT DECORATOR DOES creates a new function (ID: 101) +---------------------------------+ |input arg: function with id: 100 | | | |print(\"before\") | |call function object with id 100 | |print(\"after\") | | | +---------------------------^-----+ | | AFTER | | | \"hello_world\" +-------------+ Note how the hello_world name points to a new function object but that new function object knows the reference (ID) of the original function. Some Gotchas While it is very quick to build prototypes in python and there are tons of libraries available, as the codebase complexity increases, type errors become more common and will get hard to deal with. (There are solutions to that problem like type annotations in python. Checkout mypy .) Because python is dynamically typed language, that means all types are determined at runtime. And that makes python run very slow compared to other statically typed languages. Python has something called GIL (global interpreter lock) which is a limiting factor for utilizing multiple CPI cores for parallel computation. Some weird things that python does: https://github.com/satwikkansal/wtfpython","title":"Some Python Concepts"},{"location":"python_web/python-concepts/#some-python-concepts","text":"Though you are expected to know python and its syntax at basic level, let us discuss some fundamental concepts that will help you understand the python language better. Everything in Python is an object. That includes the functions, lists, dicts, classes, modules, a running function (instance of function definition), everything. In the CPython, it would mean there is an underlying struct variable for each object. In python's current execution context, all the variables are stored in a dict. It'd be a string to object mapping. If you have a function and a float variable defined in the current context, here is how it is handled internally. >>> float_number=42.0 >>> def foo_func(): ... pass ... # NOTICE HOW VARIABLE NAMES ARE STRINGS, stored in a dict >>> locals() {'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': <class '_frozen_importlib.BuiltinImporter'>, '__spec__': None, '__annotations__': {}, '__builtins__': <module 'builtins' (built-in)>, 'float_number': 42.0, 'foo_func': <function foo_func at 0x1055847a0>}","title":"Some Python Concepts"},{"location":"python_web/python-concepts/#python-functions","text":"Since functions too are objects, we can see what all attributes a function contains as following >>> def hello(name): ... print(f\"Hello, {name}!\") ... >>> dir(hello) ['__annotations__', '__call__', '__class__', '__closure__', '__code__', '__defaults__', '__delattr__', '__dict__', '__dir__', '__doc__', '__eq__', '__format__', '__ge__', '__get__', '__getattribute__', '__globals__', '__gt__', '__hash__', '__init__', '__init_subclass__', '__kwdefaults__', '__le__', '__lt__', '__module__', '__name__', '__ne__', '__new__', '__qualname__', '__reduce__', '__reduce_ex__', '__repr__', '__setattr__', '__sizeof__', '__str__', '__subclasshook__'] While there are a lot of them, let's look at some interesting ones","title":"Python Functions"},{"location":"python_web/python-concepts/#globals","text":"This attribute, as the name suggests, has references of global variables. If you ever need to know what all global variables are in the scope of this function, this will tell you. See how the function start seeing the new variable in globals >>> hello.__globals__ {'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': <class '_frozen_importlib.BuiltinImporter'>, '__spec__': None, '__annotations__': {}, '__builtins__': <module 'builtins' (built-in)>, 'hello': <function hello at 0x7fe4e82554c0>} # adding new global variable >>> GLOBAL=\"g_val\" >>> hello.__globals__ {'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': <class '_frozen_importlib.BuiltinImporter'>, '__spec__': None, '__annotations__': {}, '__builtins__': <module 'builtins' (built-in)>, 'hello': <function hello at 0x7fe4e82554c0>, 'GLOBAL': 'g_val'}","title":"globals"},{"location":"python_web/python-concepts/#code","text":"This is an interesting one! As everything in python is an object, this includes the bytecode too. The compiled python bytecode is a python code object. Which is accessible via __code__ attribute here. A function has an associated code object which carries some interesting information. # the file in which function is defined # stdin here since this is run in an interpreter >>> hello.__code__.co_filename '<stdin>' # number of arguments the function takes >>> hello.__code__.co_argcount 1 # local variable names >>> hello.__code__.co_varnames ('name',) # the function code's compiled bytecode >>> hello.__code__.co_code b't\\x00d\\x01|\\x00\\x9b\\x00d\\x02\\x9d\\x03\\x83\\x01\\x01\\x00d\\x00S\\x00' There are more code attributes which you can enlist by >>> dir(hello.__code__)","title":"code"},{"location":"python_web/python-concepts/#decorators","text":"Related to functions, python has another feature called decorators. Let's see how that works, keeping everything is an object in mind. Here is a sample decorator: >>> def deco(func): ... def inner(): ... print(\"before\") ... func() ... print(\"after\") ... return inner ... >>> @deco ... def hello_world(): ... print(\"hello world\") ... >>> >>> hello_world() before hello world after Here @deco syntax is used to decorate the hello_world function. It is essentially same as doing >>> def hello_world(): ... print(\"hello world\") ... >>> hello_world = deco(hello_world) What goes inside the deco function might seem complex. Let's try to uncover it. Function hello_world is created It is passed to deco function deco create a new function This new function is calls hello_world function And does a couple other things deco returns the newly created function hello_world is replaced with above function Let's visualize it for better understanding BEFORE function_object (ID: 100) \"hello_world\" +--------------------+ + |print(\"hello_world\")| | | | +--------------> | | | | +--------------------+ WHAT DECORATOR DOES creates a new function (ID: 101) +---------------------------------+ |input arg: function with id: 100 | | | |print(\"before\") | |call function object with id 100 | |print(\"after\") | | | +---------------------------^-----+ | | AFTER | | | \"hello_world\" +-------------+ Note how the hello_world name points to a new function object but that new function object knows the reference (ID) of the original function.","title":"Decorators"},{"location":"python_web/python-concepts/#some-gotchas","text":"While it is very quick to build prototypes in python and there are tons of libraries available, as the codebase complexity increases, type errors become more common and will get hard to deal with. (There are solutions to that problem like type annotations in python. Checkout mypy .) Because python is dynamically typed language, that means all types are determined at runtime. And that makes python run very slow compared to other statically typed languages. Python has something called GIL (global interpreter lock) which is a limiting factor for utilizing multiple CPI cores for parallel computation. Some weird things that python does: https://github.com/satwikkansal/wtfpython","title":"Some Gotchas"},{"location":"python_web/python-web-flask/","text":"Python, Web and Flask Back in the old days, websites were simple. They were simple static html contents. A webserver would be listening on a defined port and according to the HTTP request received, it would read files from disk and return them in response. But since then, complexity has evolved and websites are now dynamic. Depending on the request, multiple operations need to be performed like reading from database or calling other API and finally returning some response (HTML data, JSON content etc.) Since serving web requests is no longer a simple task like reading files from disk and return contents, we need to process each http request, perform some operations programmatically and construct a response. Sockets Though we have frameworks like flask, HTTP is still a protocol that works over TCP protocol. So let us setup a TCP server and send an HTTP request and inspect the request's payload. Note that this is not a tutorial on socket programming but what we are doing here is inspecting HTTP protocol at its ground level and look at what its contents look like. (Ref: Socket Programming in Python (Guide) on RealPython ) import socket HOST = '127.0.0.1' # Standard loopback interface address (localhost) PORT = 65432 # Port to listen on (non-privileged ports are > 1023) with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s: s.bind((HOST, PORT)) s.listen() conn, addr = s.accept() with conn: print('Connected by', addr) while True: data = conn.recv(1024) if not data: break print(data) Then we open localhost:65432 in our web browser and following would be the output: Connected by ('127.0.0.1', 54719) b'GET / HTTP/1.1\\r\\nHost: localhost:65432\\r\\nConnection: keep-alive\\r\\nDNT: 1\\r\\nUpgrade-Insecure-Requests: 1\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36 Edg/85.0.564.44\\r\\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\\r\\nSec-Fetch-Site: none\\r\\nSec-Fetch-Mode: navigate\\r\\nSec-Fetch-User: ?1\\r\\nSec-Fetch-Dest: document\\r\\nAccept-Encoding: gzip, deflate, br\\r\\nAccept-Language: en-US,en;q=0.9\\r\\n\\r\\n' Examine closely and the content will look like the HTTP protocol's format. ie: HTTP_METHOD URI_PATH HTTP_VERSION HEADERS_SEPARATED_BY_SEPARATOR So though it's a blob of bytes, knowing http protocol specification , you can parse that string (ie: split by \\r\\n ) and get meaningful information out of it. Flask Flask, and other such frameworks does pretty much what we just discussed in the last section (with added more sophistication). They listen on a port on a TCP socket, receive an HTTP request, parse the data according to protocol format and make it available to you in a convenient manner. ie: you can access headers in flask by request.headers which is made available to you by splitting above payload by /r/n , as defined in http protocol. Another example: we register routes in flask by @app.route(\"/hello\") . What flask will do is maintain a registry internally which will map /hello with the function you decorated with. Now whenever a request comes with the /hello route (second component in the first line, split by space), flask calls the registered function and returns whatever the function returned. Same with all other web frameworks in other languages too. They all work on similar principles. What they basically do is understand the HTTP protocol, parses the HTTP request data and gives us programmers a nice interface to work with HTTP requests. Not so much of magic, innit?","title":"Python, Web and Flask"},{"location":"python_web/python-web-flask/#python-web-and-flask","text":"Back in the old days, websites were simple. They were simple static html contents. A webserver would be listening on a defined port and according to the HTTP request received, it would read files from disk and return them in response. But since then, complexity has evolved and websites are now dynamic. Depending on the request, multiple operations need to be performed like reading from database or calling other API and finally returning some response (HTML data, JSON content etc.) Since serving web requests is no longer a simple task like reading files from disk and return contents, we need to process each http request, perform some operations programmatically and construct a response.","title":"Python, Web and Flask"},{"location":"python_web/python-web-flask/#sockets","text":"Though we have frameworks like flask, HTTP is still a protocol that works over TCP protocol. So let us setup a TCP server and send an HTTP request and inspect the request's payload. Note that this is not a tutorial on socket programming but what we are doing here is inspecting HTTP protocol at its ground level and look at what its contents look like. (Ref: Socket Programming in Python (Guide) on RealPython ) import socket HOST = '127.0.0.1' # Standard loopback interface address (localhost) PORT = 65432 # Port to listen on (non-privileged ports are > 1023) with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s: s.bind((HOST, PORT)) s.listen() conn, addr = s.accept() with conn: print('Connected by', addr) while True: data = conn.recv(1024) if not data: break print(data) Then we open localhost:65432 in our web browser and following would be the output: Connected by ('127.0.0.1', 54719) b'GET / HTTP/1.1\\r\\nHost: localhost:65432\\r\\nConnection: keep-alive\\r\\nDNT: 1\\r\\nUpgrade-Insecure-Requests: 1\\r\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36 Edg/85.0.564.44\\r\\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\\r\\nSec-Fetch-Site: none\\r\\nSec-Fetch-Mode: navigate\\r\\nSec-Fetch-User: ?1\\r\\nSec-Fetch-Dest: document\\r\\nAccept-Encoding: gzip, deflate, br\\r\\nAccept-Language: en-US,en;q=0.9\\r\\n\\r\\n' Examine closely and the content will look like the HTTP protocol's format. ie: HTTP_METHOD URI_PATH HTTP_VERSION HEADERS_SEPARATED_BY_SEPARATOR So though it's a blob of bytes, knowing http protocol specification , you can parse that string (ie: split by \\r\\n ) and get meaningful information out of it.","title":"Sockets"},{"location":"python_web/python-web-flask/#flask","text":"Flask, and other such frameworks does pretty much what we just discussed in the last section (with added more sophistication). They listen on a port on a TCP socket, receive an HTTP request, parse the data according to protocol format and make it available to you in a convenient manner. ie: you can access headers in flask by request.headers which is made available to you by splitting above payload by /r/n , as defined in http protocol. Another example: we register routes in flask by @app.route(\"/hello\") . What flask will do is maintain a registry internally which will map /hello with the function you decorated with. Now whenever a request comes with the /hello route (second component in the first line, split by space), flask calls the registered function and returns whatever the function returned. Same with all other web frameworks in other languages too. They all work on similar principles. What they basically do is understand the HTTP protocol, parses the HTTP request data and gives us programmers a nice interface to work with HTTP requests. Not so much of magic, innit?","title":"Flask"},{"location":"python_web/sre-conclusion/","text":"Conclusion Scaling The App The design and development is just a part of the journey. We will need to setup continuous integration and continuous delivery pipelines sooner or later. And we have to deploy this app somewhere. Initially we can start with deploying this app on one virtual machine on any cloud provider. But this is a Single point of failure which is something we never allow as an SRE (or even as an engineer). So an improvement here can be having multiple instances of applications deployed behind a load balancer. This certainly prevents problems of one machine going down. Scaling here would mean adding more instances behind the load balancer. But this is scalable upto only a certain point. After that, other bottlenecks in the system will start appearing. ie: DB will become the bottleneck, or perhaps the load balancer itself. How do you know what is the bottleneck? You need to have observability into each aspects of the application architecture. Only after you have metrics, you will be able to know what is going wrong where. What gets measured, gets fixed! Get deeper insights into scaling from School Of SRE's Scalability module and post going through it, apply your learnings and takeaways to this app. Think how will we make this app geographically distributed and highly available and scalable. Monitoring Strategy Once we have our application deployed. It will be working ok. But not forever. Reliability is in the title of our job and we make systems reliable by making the design in a certain way. But things still will go down. Machines will fail. Disks will behave weirdly. Buggy code will get pushed to production. And all these possible scenarios will make the system less reliable. So what do we do? We monitor! We keep an eye on the system's health and if anything is not going as expected, we want ourselves to get alerted. Now let's think in terms of the given url shortening app. We need to monitor it. And we would want to get notified in case something goes wrong. But we first need to decide what is that something that we want to keep an eye on. Since it's a web app serving HTTP requests, we want to keep an eye on HTTP Status codes and latencies Request volume again is a good candidate, if the app is receiving an unusual amount of traffic, something might be off. We also want to keep an eye on the database so depending on the database solution chosen. Query times, volumes, disk usage etc. Finally, there also needs to be some external monitoring which runs periodic tests from devices outside of your data centers. This emulates customers and ensures that from customer point of view, the system is working as expected. Applications in SRE role In the world of SRE, python is a widely used language. For small scripts and tooling developed for various purposes. Since tooling developed by SRE works with critical pieces of infrastructure and has great power (to bring things down), it is important to know what you are doing while using a programming language and its features. Also it is equally important to know the language and its characteristics while debugging the issues. As an SRE having a deeper understanding of python language, it has helped me a lot to debug very sneaky bugs and be generally more aware and informed while making certain design decisions. While developing tools may or may not be part of SRE job, supporting tools or services is more likely to be a daily duty. Building an application or tool is just a small part of productionization. While there is certainly that goes in the design of the application itself to make it more robust, as an SRE you are responsible for its reliability and stability once it is deployed and running. And to ensure that, you\u2019d need to understand the application first and then come up with a strategy to monitor it properly and be prepared for various failure scenarios. Optional Exercises Make a decorator that will cache function return values depending on input parameters. Host the URL shortening app on any cloud provider. Setup monitoring using many of the tools available like catchpoint, datadog etc. Create a minimal flask-like framework on top of TCP sockets. Conclusion This module, in the first part, aims to make you more aware of the things that will happen when you choose python as your programming language and what happens when you run a python program. With the knowledge of how python handles things internally as objects, lot of seemingly magic things in python will start to make more sense. The second part will first explain how a framework like flask works using the existing knowledge of protocols like TCP and HTTP. It then touches the whole lifecycle of an application development lifecycle including the SRE parts of it. While the design and areas in architecture considered will not be exhaustive, it will give a good overview of things that are also important being an SRE and why they are important.","title":"Conclusion"},{"location":"python_web/sre-conclusion/#conclusion","text":"","title":"Conclusion"},{"location":"python_web/sre-conclusion/#scaling-the-app","text":"The design and development is just a part of the journey. We will need to setup continuous integration and continuous delivery pipelines sooner or later. And we have to deploy this app somewhere. Initially we can start with deploying this app on one virtual machine on any cloud provider. But this is a Single point of failure which is something we never allow as an SRE (or even as an engineer). So an improvement here can be having multiple instances of applications deployed behind a load balancer. This certainly prevents problems of one machine going down. Scaling here would mean adding more instances behind the load balancer. But this is scalable upto only a certain point. After that, other bottlenecks in the system will start appearing. ie: DB will become the bottleneck, or perhaps the load balancer itself. How do you know what is the bottleneck? You need to have observability into each aspects of the application architecture. Only after you have metrics, you will be able to know what is going wrong where. What gets measured, gets fixed! Get deeper insights into scaling from School Of SRE's Scalability module and post going through it, apply your learnings and takeaways to this app. Think how will we make this app geographically distributed and highly available and scalable.","title":"Scaling The App"},{"location":"python_web/sre-conclusion/#monitoring-strategy","text":"Once we have our application deployed. It will be working ok. But not forever. Reliability is in the title of our job and we make systems reliable by making the design in a certain way. But things still will go down. Machines will fail. Disks will behave weirdly. Buggy code will get pushed to production. And all these possible scenarios will make the system less reliable. So what do we do? We monitor! We keep an eye on the system's health and if anything is not going as expected, we want ourselves to get alerted. Now let's think in terms of the given url shortening app. We need to monitor it. And we would want to get notified in case something goes wrong. But we first need to decide what is that something that we want to keep an eye on. Since it's a web app serving HTTP requests, we want to keep an eye on HTTP Status codes and latencies Request volume again is a good candidate, if the app is receiving an unusual amount of traffic, something might be off. We also want to keep an eye on the database so depending on the database solution chosen. Query times, volumes, disk usage etc. Finally, there also needs to be some external monitoring which runs periodic tests from devices outside of your data centers. This emulates customers and ensures that from customer point of view, the system is working as expected.","title":"Monitoring Strategy"},{"location":"python_web/sre-conclusion/#applications-in-sre-role","text":"In the world of SRE, python is a widely used language. For small scripts and tooling developed for various purposes. Since tooling developed by SRE works with critical pieces of infrastructure and has great power (to bring things down), it is important to know what you are doing while using a programming language and its features. Also it is equally important to know the language and its characteristics while debugging the issues. As an SRE having a deeper understanding of python language, it has helped me a lot to debug very sneaky bugs and be generally more aware and informed while making certain design decisions. While developing tools may or may not be part of SRE job, supporting tools or services is more likely to be a daily duty. Building an application or tool is just a small part of productionization. While there is certainly that goes in the design of the application itself to make it more robust, as an SRE you are responsible for its reliability and stability once it is deployed and running. And to ensure that, you\u2019d need to understand the application first and then come up with a strategy to monitor it properly and be prepared for various failure scenarios.","title":"Applications in SRE role"},{"location":"python_web/sre-conclusion/#optional-exercises","text":"Make a decorator that will cache function return values depending on input parameters. Host the URL shortening app on any cloud provider. Setup monitoring using many of the tools available like catchpoint, datadog etc. Create a minimal flask-like framework on top of TCP sockets.","title":"Optional Exercises"},{"location":"python_web/sre-conclusion/#conclusion_1","text":"This module, in the first part, aims to make you more aware of the things that will happen when you choose python as your programming language and what happens when you run a python program. With the knowledge of how python handles things internally as objects, lot of seemingly magic things in python will start to make more sense. The second part will first explain how a framework like flask works using the existing knowledge of protocols like TCP and HTTP. It then touches the whole lifecycle of an application development lifecycle including the SRE parts of it. While the design and areas in architecture considered will not be exhaustive, it will give a good overview of things that are also important being an SRE and why they are important.","title":"Conclusion"},{"location":"python_web/url-shorten-app/","text":"The URL Shortening App Let's build a very simple URL shortening app using flask and try to incorporate all aspects of the development process including the reliability aspects. We will not be building the UI and we will come up with a minimal set of API that will be enough for the app to function well. Design We don't jump directly to coding. First thing we do is gather requirements. Come up with an approach. Have the approach/design reviewed by peers. Evolve, iterate, document the decisions and tradeoffs. And then finally implement. While we will not do the full blown design document here, we will raise certain questions here that are important to the design. 1. High Level Operations and API Endpoints Since it's a URL shortening app, we will need an API for generating the shorten link given an original link. And an API/Endpoint which will accept the shorten link and redirect to original URL. We are not including the user aspect of the app to keep things minimal. These two API should make app functional and usable by anyone. 2. How to shorten? Given a url, we will need to generate a shortened version of it. One approach could be using random characters for each link. Another thing that can be done is to use some sort of hashing algorithm. The benefit here is we will reuse the same hash for the same link. ie: if lot of people are shortening https://www.linkedin.com they all will have the same value, compared to multiple entries in DB if chosen random characters. What about hash collisions? Even in random characters approach, though there is a less probability, hash collisions can happen. And we need to be mindful of them. In that case we might want to prepend/append the string with some random value to avoid conflict. Also, choice of hash algorithm matters. We will need to analyze algorithms. Their CPU requirements and their characteristics. Choose one that suits the most. 3. Is URL Valid? Given a URL to shorten, how do we verify if the URL is valid? Do we even verify or validate? One basic check that can be done is see if the URL matches a regex of a URL. To go even further we can try opening/visiting the URL. But there are certain gotchas here. We need to define success criteria. ie: HTTP 200 means it is valid. What is the URL is in private network? What if URL is temporarily down? 4. Storage Finally, storage. Where will we store the data that we will generate over time? There are multiple database solutions available and we will need to choose the one that suits this app the most. Relational database like MySQL would be a fair choice but be sure to checkout School of SRE's database section for deeper insights into making a more informed decision. 5. Other We are not accounting for users into our app and other possible features like rate limiting, customized links etc but it will eventually come up with time. Depending on the requirements, they too might need to get incorporated. The minimal working code is given below for reference but I'd encourage you to come up with your own. from flask import Flask, redirect, request from hashlib import md5 app = Flask(\"url_shortener\") mapping = {} @app.route(\"/shorten\", methods=[\"POST\"]) def shorten(): global mapping payload = request.json if \"url\" not in payload: return \"Missing URL Parameter\", 400 # TODO: check if URL is valid hash_ = md5() hash_.update(payload[\"url\"].encode()) digest = hash_.hexdigest()[:5] # limiting to 5 chars. Less the limit more the chances of collission if digest not in mapping: mapping[digest] = payload[\"url\"] return f\"Shortened: r/{digest}\\n\" else: # TODO: check for hash collission return f\"Already exists: r/{digest}\\n\" @app.route(\"/r/<hash_>\") def redirect_(hash_): if hash_ not in mapping: return \"URL Not Found\", 404 return redirect(mapping[hash_]) if __name__ == \"__main__\": app.run(debug=True) \"\"\" OUTPUT: ===> SHORTENING spatel1-mn1:tmp spatel1$ curl localhost:5000/shorten -H \"content-type: application/json\" --data '{\"url\":\"https://linkedin.com\"}' Shortened: r/a62a4 ===> REDIRECTING, notice the response code 302 and the location header spatel1-mn1:tmp spatel1$ curl localhost:5000/r/a62a4 -v * Uses proxy env variable NO_PROXY == '127.0.0.1' * Trying ::1... * TCP_NODELAY set * Connection failed * connect to ::1 port 5000 failed: Connection refused * Trying 127.0.0.1... * TCP_NODELAY set * Connected to localhost (127.0.0.1) port 5000 (#0) > GET /r/a62a4 HTTP/1.1 > Host: localhost:5000 > User-Agent: curl/7.64.1 > Accept: */* > * HTTP 1.0, assume close after body < HTTP/1.0 302 FOUND < Content-Type: text/html; charset=utf-8 < Content-Length: 247 < Location: https://linkedin.com < Server: Werkzeug/0.15.4 Python/3.7.7 < Date: Tue, 27 Oct 2020 09:37:12 GMT < <!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2 Final//EN\"> <title>Redirecting...</title> <h1>Redirecting...</h1> * Closing connection 0 <p>You should be redirected automatically to target URL: <a href=\"https://linkedin.com\">https://linkedin.com</a>. If not click the link. \"\"\"","title":"The URL Shortening App"},{"location":"python_web/url-shorten-app/#the-url-shortening-app","text":"Let's build a very simple URL shortening app using flask and try to incorporate all aspects of the development process including the reliability aspects. We will not be building the UI and we will come up with a minimal set of API that will be enough for the app to function well.","title":"The URL Shortening App"},{"location":"python_web/url-shorten-app/#design","text":"We don't jump directly to coding. First thing we do is gather requirements. Come up with an approach. Have the approach/design reviewed by peers. Evolve, iterate, document the decisions and tradeoffs. And then finally implement. While we will not do the full blown design document here, we will raise certain questions here that are important to the design.","title":"Design"},{"location":"python_web/url-shorten-app/#1-high-level-operations-and-api-endpoints","text":"Since it's a URL shortening app, we will need an API for generating the shorten link given an original link. And an API/Endpoint which will accept the shorten link and redirect to original URL. We are not including the user aspect of the app to keep things minimal. These two API should make app functional and usable by anyone.","title":"1. High Level Operations and API Endpoints"},{"location":"python_web/url-shorten-app/#2-how-to-shorten","text":"Given a url, we will need to generate a shortened version of it. One approach could be using random characters for each link. Another thing that can be done is to use some sort of hashing algorithm. The benefit here is we will reuse the same hash for the same link. ie: if lot of people are shortening https://www.linkedin.com they all will have the same value, compared to multiple entries in DB if chosen random characters. What about hash collisions? Even in random characters approach, though there is a less probability, hash collisions can happen. And we need to be mindful of them. In that case we might want to prepend/append the string with some random value to avoid conflict. Also, choice of hash algorithm matters. We will need to analyze algorithms. Their CPU requirements and their characteristics. Choose one that suits the most.","title":"2. How to shorten?"},{"location":"python_web/url-shorten-app/#3-is-url-valid","text":"Given a URL to shorten, how do we verify if the URL is valid? Do we even verify or validate? One basic check that can be done is see if the URL matches a regex of a URL. To go even further we can try opening/visiting the URL. But there are certain gotchas here. We need to define success criteria. ie: HTTP 200 means it is valid. What is the URL is in private network? What if URL is temporarily down?","title":"3. Is URL Valid?"},{"location":"python_web/url-shorten-app/#4-storage","text":"Finally, storage. Where will we store the data that we will generate over time? There are multiple database solutions available and we will need to choose the one that suits this app the most. Relational database like MySQL would be a fair choice but be sure to checkout School of SRE's database section for deeper insights into making a more informed decision.","title":"4. Storage"},{"location":"python_web/url-shorten-app/#5-other","text":"We are not accounting for users into our app and other possible features like rate limiting, customized links etc but it will eventually come up with time. Depending on the requirements, they too might need to get incorporated. The minimal working code is given below for reference but I'd encourage you to come up with your own. from flask import Flask, redirect, request from hashlib import md5 app = Flask(\"url_shortener\") mapping = {} @app.route(\"/shorten\", methods=[\"POST\"]) def shorten(): global mapping payload = request.json if \"url\" not in payload: return \"Missing URL Parameter\", 400 # TODO: check if URL is valid hash_ = md5() hash_.update(payload[\"url\"].encode()) digest = hash_.hexdigest()[:5] # limiting to 5 chars. Less the limit more the chances of collission if digest not in mapping: mapping[digest] = payload[\"url\"] return f\"Shortened: r/{digest}\\n\" else: # TODO: check for hash collission return f\"Already exists: r/{digest}\\n\" @app.route(\"/r/<hash_>\") def redirect_(hash_): if hash_ not in mapping: return \"URL Not Found\", 404 return redirect(mapping[hash_]) if __name__ == \"__main__\": app.run(debug=True) \"\"\" OUTPUT: ===> SHORTENING spatel1-mn1:tmp spatel1$ curl localhost:5000/shorten -H \"content-type: application/json\" --data '{\"url\":\"https://linkedin.com\"}' Shortened: r/a62a4 ===> REDIRECTING, notice the response code 302 and the location header spatel1-mn1:tmp spatel1$ curl localhost:5000/r/a62a4 -v * Uses proxy env variable NO_PROXY == '127.0.0.1' * Trying ::1... * TCP_NODELAY set * Connection failed * connect to ::1 port 5000 failed: Connection refused * Trying 127.0.0.1... * TCP_NODELAY set * Connected to localhost (127.0.0.1) port 5000 (#0) > GET /r/a62a4 HTTP/1.1 > Host: localhost:5000 > User-Agent: curl/7.64.1 > Accept: */* > * HTTP 1.0, assume close after body < HTTP/1.0 302 FOUND < Content-Type: text/html; charset=utf-8 < Content-Length: 247 < Location: https://linkedin.com < Server: Werkzeug/0.15.4 Python/3.7.7 < Date: Tue, 27 Oct 2020 09:37:12 GMT < <!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2 Final//EN\"> <title>Redirecting...</title> <h1>Redirecting...</h1> * Closing connection 0 <p>You should be redirected automatically to target URL: <a href=\"https://linkedin.com\">https://linkedin.com</a>. If not click the link. \"\"\"","title":"5. Other"},{"location":"security/conclusion/","text":"Conclusion Now that you have completed this course on Security you are now aware of the possible security threats to computer systems & networks. Not only that, but you are now better able to protect your systems as well as recommend security measures to others. This course provides fundamental everyday knowledge on security domain which will also help you keep security at the top of your priority. Other Resources Some books that would be a great resource Holistic Info-Sec for Web Developers https://holisticinfosecforwebdevelopers.com/ - Free and downloadable book series with very broad and deep coverage of what Web Developers and DevOps Engineers need to know in order to create robust, reliable, maintainable and secure software, networks and other, that are delivered continuously, on time, with no nasty surprises Docker Security - Quick Reference: For DevOps Engineers https://holisticinfosecforwebdevelopers.com/ - A book on understanding the Docker security defaults, how to improve them (theory and practical), along with many tools and techniques. How to Hack Like a Legend https://amzn.to/2uWh1Up - A hacker\u2019s tale breaking into a secretive offshore company, Sparc Flow, 2018 How to Investigate Like a Rockstar https://books2read.com/u/4jDWoZ - Live a real crisis to master the secrets of forensic analysis, Sparc Flow, 2017 Real World Cryptography https://www.manning.com/books/real-world-cryptography - This early-access book teaches you applied cryptographic techniques to understand and apply security at every level of your systems and applications. AWS Security https://www.manning.com/books/aws-security?utm_source=github&utm_medium=organic&utm_campaign=book_shields_aws_1_31_20 - This early-access book covers commong AWS security issues and best practices for access policies, data protection, auditing, continuous monitoring, and incident response. Post Training asks/ Further Reading CTF Events like : https://github.com/apsdehal/awesome-ctf Penetration Testing : https://github.com/enaqx/awesome-pentest Threat Intelligence : https://github.com/hslatman/awesome-threat-intelligence Threat Detection & Hunting : https://github.com/0x4D31/awesome-threat-detection Web Security: https://github.com/qazbnm456/awesome-web-security Building Secure and Reliable Systems : https://landing.google.com/sre/resources/foundationsandprinciples/srs-book/","title":"Conclusion"},{"location":"security/conclusion/#conclusion","text":"Now that you have completed this course on Security you are now aware of the possible security threats to computer systems & networks. Not only that, but you are now better able to protect your systems as well as recommend security measures to others. This course provides fundamental everyday knowledge on security domain which will also help you keep security at the top of your priority.","title":"Conclusion"},{"location":"security/conclusion/#other-resources","text":"Some books that would be a great resource Holistic Info-Sec for Web Developers https://holisticinfosecforwebdevelopers.com/ - Free and downloadable book series with very broad and deep coverage of what Web Developers and DevOps Engineers need to know in order to create robust, reliable, maintainable and secure software, networks and other, that are delivered continuously, on time, with no nasty surprises Docker Security - Quick Reference: For DevOps Engineers https://holisticinfosecforwebdevelopers.com/ - A book on understanding the Docker security defaults, how to improve them (theory and practical), along with many tools and techniques. How to Hack Like a Legend https://amzn.to/2uWh1Up - A hacker\u2019s tale breaking into a secretive offshore company, Sparc Flow, 2018 How to Investigate Like a Rockstar https://books2read.com/u/4jDWoZ - Live a real crisis to master the secrets of forensic analysis, Sparc Flow, 2017 Real World Cryptography https://www.manning.com/books/real-world-cryptography - This early-access book teaches you applied cryptographic techniques to understand and apply security at every level of your systems and applications. AWS Security https://www.manning.com/books/aws-security?utm_source=github&utm_medium=organic&utm_campaign=book_shields_aws_1_31_20 - This early-access book covers commong AWS security issues and best practices for access policies, data protection, auditing, continuous monitoring, and incident response.","title":"Other Resources"},{"location":"security/conclusion/#post-training-asks-further-reading","text":"CTF Events like : https://github.com/apsdehal/awesome-ctf Penetration Testing : https://github.com/enaqx/awesome-pentest Threat Intelligence : https://github.com/hslatman/awesome-threat-intelligence Threat Detection & Hunting : https://github.com/0x4D31/awesome-threat-detection Web Security: https://github.com/qazbnm456/awesome-web-security Building Secure and Reliable Systems : https://landing.google.com/sre/resources/foundationsandprinciples/srs-book/","title":"Post Training asks/ Further Reading"},{"location":"security/fundamentals/","text":"Part I: Fundamentals Introduction to Security Overview for SRE If you look closely, both Site Reliability Engineering and Security Engineering are concerned with keeping a system usable. Issues like broken releases, capacity shortages, and misconfigurations can make a system unusable (at least temporarily). Security or privacy incidents that break the trust of users also undermine the usefulness of a system. Consequently, system security should be top of mind for SREs. SREs should be involved in both significant design discussions and actual system changes. They have quite a big role in System design & hence are quite sometimes the first line of defence. SRE\u2019s help in preventing bad design & implementations which can affect the overall security of the infrastructure. Successfully designing, implementing, and maintaining systems requires a commitment to the full system lifecycle . This commitment is possible only when security and reliability are central elements in the architecture of systems. Core Pillars of Information Security : Confidentiality \u2013 only allow access to data for which the user is permitted Integrity \u2013 ensure data is not tampered or altered by unauthorized users Availability \u2013 ensure systems and data are available to authorized users when they need it Thinking like a Security Engineer When starting a new application or re-factoring an existing application, you should consider each functional feature, and consider: Is the process surrounding this feature as safe as possible? In other words, is this a flawed process? If I were evil, how would I abuse this feature? Or more specifically failing to address how a feature can be abused can cause design flaws. Is the feature required to be on by default? If so, are there limits or options that could help reduce the risk from this feature? Security Principles By OWASP (Open Web Application Security Project) Minimize attack surface area : Every feature that is added to an application adds a certain amount of risk to the overall application. The aim of secure development is to reduce the overall risk by reducing the attack surface area. For example, a web application implements online help with a search function. The search function may be vulnerable to SQL injection attacks. If the help feature was limited to authorized users, the attack likelihood is reduced. If the help feature\u2019s search function was gated through centralized data validation routines, the ability to perform SQL injection is dramatically reduced. However, if the help feature was re-written to eliminate the search function (through a better user interface, for example), this almost eliminates the attack surface area, even if the help feature was available to the Internet at large. Establish secure defaults: There are many ways to deliver an \u201cout of the box\u201d experience for users. However, by default, the experience should be secure, and it should be up to the user to reduce their security \u2013 if they are allowed. For example, by default, password ageing and complexity should be enabled. Users might be allowed to turn these two features off to simplify their use of the application and increase their risk. Default Passwords of routers, IoT devices should be changed Principle of Least privilege The principle of least privilege recommends that accounts have the least amount of privilege required to perform their business processes. This encompasses user rights, resource permissions such as CPU limits, memory, network, and file system permissions. For example, if a middleware server only requires access to the network, read access to a database table, and the ability to write to a log, this describes all the permissions that should be granted. Under no circumstances should the middleware be granted administrative privileges. Principle of Defense in depth The principle of defence in depth suggests that where one control would be reasonable, more controls that approach risks in different fashions are better. Controls, when used in depth, can make severe vulnerabilities extraordinarily difficult to exploit and thus unlikely to occur. With secure coding, this may take the form of tier-based validation, centralized auditing controls, and requiring users to be logged on all pages. For example, a flawed administrative interface is unlikely to be vulnerable to an anonymous attack if it correctly gates access to production management networks, checks for administrative user authorization, and logs all access. Fail securely Applications regularly fail to process transactions for many reasons. How they fail can determine if an application is secure or not. ``` is_admin = true; try { code_which_may_faile(); is_admin = is_user_assigned_role(\"Adminstrator\"); } catch (Exception err) { log.error(err.toString()); } ``` - If either codeWhichMayFail() or isUserInRole fails or throws an exception, the user is an admin by default. This is obviously a security risk. Don\u2019t trust services Many organizations utilize the processing capabilities of third-party partners, who more than likely have different security policies and posture than you. It is unlikely that you can influence or control any external third party, whether they are home users or major suppliers or partners. Therefore, the implicit trust of externally run systems is not warranted. All external systems should be treated similarly. For example, a loyalty program provider provides data that is used by Internet Banking, providing the number of reward points and a small list of potential redemption items. However, the data should be checked to ensure that it is safe to display to end-users and that the reward points are a positive number, and not improbably large. Separation of duties The key to fraud control is the separation of duties. For example, someone who requests a computer cannot also sign for it, nor should they directly receive the computer. This prevents the user from requesting many computers and claiming they never arrived. Certain roles have different levels of trust than normal users. In particular, administrators are different from normal users. In general, administrators should not be users of the application. For example, an administrator should be able to turn the system on or off, set password policy but shouldn\u2019t be able to log on to the storefront as a super privileged user, such as being able to \u201cbuy\u201d goods on behalf of other users. Avoid security by obscurity Security through obscurity is a weak security control, and nearly always fails when it is the only control. This is not to say that keeping secrets is a bad idea, it simply means that the security of systems should not be reliant upon keeping details hidden. For example, the security of an application should not rely upon knowledge of the source code being kept secret. The security should rely upon many other factors, including reasonable password policies, defence in depth, business transaction limits, solid network architecture, and fraud, and audit controls. A practical example is Linux. Linux\u2019s source code is widely available, and yet when properly secured, Linux is a secure and robust operating system. Keep security simple Attack surface area and simplicity go hand in hand. Certain software engineering practices prefer overly complex approaches to what would otherwise be a relatively straightforward and simple design. Developers should avoid the use of double negatives and complex architectures when a simpler approach would be faster and simpler. For example, although it might be fashionable to have a slew of singleton entity beans running on a separate middleware server, it is more secure and faster to simply use global variables with an appropriate mutex mechanism to protect against race conditions. Fix security issues correctly Once a security issue has been identified, it is important to develop a test for it and to understand the root cause of the issue. When design patterns are used, the security issue is likely widespread amongst all codebases, so developing the right fix without introducing regressions is essential. For example, a user has found that they can see another user\u2019s balance by adjusting their cookie. The fix seems to be relatively straightforward, but as the cookie handling code is shared among all applications, a change to just one application will trickle through to all other applications. The fix must, therefore, be tested on all affected applications. Reliability & Security Reliability and security are both crucial components of a truly trustworthy system, but building systems that are both reliable and secure is difficult. While the requirements for reliability and security share many common properties, they also require different design considerations. It is easy to miss the subtle interplay between reliability and security that can cause unexpected outcomes Ex: A password management application failure was triggered by a reliability problem i.e poor load-balancing and load-shedding strategies and its recovery were later complicated by multiple measures (HSM mechanism which needs to be plugged into server racks, which works as an authentication & the HSM token supposedly locked inside a case.. & the problem can be further elongated ) designed to increase the security of the system. Authentication vs Authorization Authentication is the act of validating that users are who they claim to be. Passwords are the most common authentication factor\u2014if a user enters the correct password, the system assumes the identity is valid and grants access. Other technologies such as One-Time Pins, authentication apps, and even biometrics can also be used to authenticate identity. In some instances, systems require the successful verification of more than one factor before granting access. This multi-factor authentication (MFA) requirement is often deployed to increase security beyond what passwords alone can provide. Authorization in system security is the process of giving the user permission to access a specific resource or function. This term is often used interchangeably with access control or client privilege. Giving someone permission to download a particular file on a server or providing individual users with administrative access to an application are good examples. In secure environments, authorization must always follow authentication, users should first prove that their identities are genuine before an organization\u2019s administrators grant them access to the requested resources. Common authentication flow (local authentication) The user registers using an identifier like username/email/mobile The application stores user credentials in the database The application sends a verification email/message to validate the registration Post successful registration, the user enters credentials for logging in On successful authentication, the user is allowed access to specific resources OpenID/OAuth OpenID is an authentication protocol that allows us to authenticate users without using a local auth system. In such a scenario, a user has to be registered with an OpenID Provider and the same provider should be integrated with the authentication flow of your application. To verify the details, we have to forward the authentication requests to the provider. On successful authentication, we receive a success message and/or profile details with which we can execute the necessary flow. OAuth is an authorization mechanism that allows your application user access to a provider(Gmail/Facebook/Instagram/etc). On successful response, we (your application) receive a token with which the application can access certain APIs on behalf of a user. OAuth is convenient in case your business use case requires some certain user-facing APIs like access to Google Drive or sending tweets on your behalf. Most OAuth 2.0 providers can be used for pseudo authentication. Having said that, it can get pretty complicated if you are using multiple OAuth providers to authenticate users on top of the local authentication system. Cryptography It is the science and study of hiding any text in such a way that only the intended recipients or authorized persons can read it and that any text can even use things such as invisible ink or the mechanical cryptography machines of the past. Cryptography is necessary for securing critical or proprietary information and is used to encode private data messages by converting some plain text into ciphertext. At its core, there are two ways of doing this, more advanced methods are all built upon. Ciphers Ciphers are the cornerstone of cryptography. A cipher is a set of algorithms that performs encryption or decryption on a message. An encryption algorithm (E) takes a secret key (k) and a message (m) and produces a ciphertext (c). Similarly, a Decryption algorithm (D) takes a secret key (K) and the previous resulting Ciphertext (C). They are represented as follows: E(k,m) = c D(k,c) = m This also means that for it to be a cipher, it must satisfy the consistency equation as follows, making it possible to decrypt. D(k,E(k,m)) = m Stream Ciphers: The message is broken into characters or bits and enciphered with a key or keystream(should be random and generated independently of the message stream) that is as long as the plaintext bitstream. If the keystream is random, this scheme would be unbreakable unless the keystream was acquired, making it unconditionally secure. The keystream must be provided to both parties in a secure way to prevent its release. Block Ciphers: Block ciphers \u2014 process messages in blocks, each of which is then encrypted or decrypted. A block cipher is a symmetric cipher in which blocks of plaintext are treated as a whole and used to produce ciphertext blocks. The block cipher takes blocks that are b bits long and encrypts them to blocks that are also b bits long. Block sizes are typically 64 or 128 bits long. Encryption Secret Key (Symmetric Key) : the same key is used for encryption and decryption Public Key (Asymmetric Key) in an asymmetric, the encryption and decryption keys are different but related. The encryption key is known as the public key and the decryption key is known as the private key. The public and private keys are known as a key pair. Symmetric Key Encryption DES The Data Encryption Standard (DES) has been the worldwide encryption standard for a long time. IBM developed DES in 1975, and it has held up remarkably well against years of cryptanalysis. DES is a symmetric encryption algorithm with a fixed key length of 56 bits. The algorithm is still good, but because of the short key length, it is susceptible to brute-force attacks that have sufficient resources. DES usually operates in block mode, whereby it encrypts data in 64-bit blocks. The same algorithm and key are used for both encryption and decryption. Because DES is based on simple mathematical functions, it can be easily implemented and accelerated in hardware. Triple DES With advances in computer processing power, the original 56-bit DES key became too short to withstand an attacker with even a limited budget. One way of increasing the effective key length of DES without changing the well-analyzed algorithm itself is to use the same algorithm with different keys several times in a row. The technique of applying DES three times in a row to a plain text block is called Triple DES (3DES). The 3DES technique is shown in Figure. Brute-force attacks on 3DES are considered unfeasible today. Because the basic algorithm has been tested in the field for more than 25 years, it is considered to be more trustworthy than its predecessor. AES On October 2, 2000, The U.S. National Institute of Standards and Technology (NIST) announced the selection of the Rijndael cipher as the AES algorithm. This cipher, developed by Joan Daemen and Vincent Rijmen, has a variable block length and key length. The algorithm currently specifies how to use keys with a length of 128, 192, or 256 bits to encrypt blocks with a length of 128, 192, or 256 bits (all nine combinations of key length and block length are possible). Both block and key lengths can be extended easily to multiples of 32 bits. AES was chosen to replace DES and 3DES because they are either too weak (DES, in terms of key length) or too slow (3DES) to run on modern, efficient hardware. AES is more efficient and much faster, usually by a factor of 5 compared to DES on the same hardware. AES is also more suitable for high throughput, especially if pure software encryption is used. However, AES is a relatively young algorithm, and as the golden rule of cryptography states, \u201cA more mature algorithm is always more trusted.\u201d Asymmetric Key Algorithm In a symmetric key system, Alice first puts the secret message in a box and then padlocks the box using a lock to which she has a key. She then sends the box to Bob through regular mail. When Bob receives the box, he uses an identical copy of Alice's key (which he has obtained previously) to open the box and read the message. In an asymmetric key system, instead of opening the box when he receives it, Bob simply adds his own personal lock to the box and returns the box through public mail to Alice. Alice uses her key to remove her lock and returns the box to Bob, with Bob's lock still in place. Finally, Bob uses his key to remove his lock and reads the message from Alice. The critical advantage in an asymmetric system is that Alice never needs to send a copy of her key to Bob. This reduces the possibility that a third party (for example, an unscrupulous postmaster) can copy the key while it is in transit to Bob, allowing that third party to spy on all future messages sent by Alice. In addition, if Bob is careless and allows someone else to copy his key, Alice's messages to Bob are compromised, but Alice's messages to other people remain secret NOTE : In terms of TLS key exchange, this is the common approach. Diffie-Hellman The protocol has two system parameters, p and g. They are both public and may be used by everybody. Parameter p is a prime number, and parameter g (usually called a generator) is an integer that is smaller than p, but with the following property: For every number n between 1 and p \u2013 1 inclusive, there is a power k of g such that n = gk mod p. Diffie Hellman algorithm is an asymmetric algorithm used to establish a shared secret for a symmetric key algorithm. Nowadays most of the people use hybrid cryptosystem i.e, a combination of symmetric and asymmetric encryption. Asymmetric Encryption is used as a technique in key exchange mechanism to share a secret key and after the key is shared between sender and receiver, the communication will take place using symmetric encryption. The shared secret key will be used to encrypt the communication. Refer: https://medium.com/@akhigbemmanuel/what-is-the-diffie-hellman-key-exchange-algorithm-84d60025a30d RSA The RSA algorithm is very flexible and has a variable key length where, if necessary, speed can be traded for the level of security of the algorithm. The RSA keys are usually 512 to 2048 bits long. RSA has withstood years of extensive cryptanalysis. Although those years neither proved nor disproved RSA's security, they attest to a confidence level in the algorithm. RSA security is based on the difficulty of factoring very large numbers. If an easy method of factoring these large numbers were discovered, the effectiveness of RSA would be destroyed. Refer: https://medium.com/curiositypapers/a-complete-explanation-of-rsa-asymmetric-encryption-742c5971e0f NOTE : RSA Keys can be used for key exchange just like Diffie Hellman Hashing Algorithms Hashing is one of the mechanisms used for data integrity assurance. Hashing is based on a one-way mathematical function, which is relatively easy to compute but significantly harder to reverse. A hash function, which is a one-way function to input data to produce a fixed-length digest (fingerprint) of output data. The digest is cryptographically strong; that is, it is impossible to recover input data from its digest. If the input data changes just a little, the digest (fingerprint) changes substantially in what is called an avalanche effect. More: https://medium.com/@rauljordan/the-state-of-hashing-algorithms-the-why-the-how-and-the-future-b21d5c0440de https://medium.com/@StevieCEllis/the-beautiful-hash-algorithm-f18d9d2b84fb MD5 MD5 is a one-way function with which it is easy to compute the hash from the given input data, but it is unfeasible to compute input data given only a hash. SHA-1 MD5 is considered less secure than SHA-1 because MD5 has some weaknesses. HA-1 also uses a stronger, 160-bit digest, which makes MD5 the second choice as hash methods are concerned. The algorithm takes a message of less than 264 bits in length and produces a 160-bit message digest. This algorithm is slightly slower than MD5. NOTE : SHA-1 is also recently demonstrated to be broken, Minimum current recommendation is SHA-256 Digital Certificates Digital signatures, provide a means to digitally authenticate devices and individual users. In public-key cryptography, such as the RSA encryption system, each user has a key-pair containing both a public key and a private key. The keys act as complements, and anything encrypted with one of the keys can be decrypted with the other. In simple terms, a signature is formed when data is encrypted with a user's private key. The receiver verifies the signature by decrypting the message with the sender's public key. Key management is often considered the most difficult task in designing and implementing cryptographic systems. Businesses can simplify some of the deployment and management issues that are encountered with secured data communications by employing a Public Key Infrastructure (PKI). Because corporations often move security-sensitive communications across the Internet, an effective mechanism must be implemented to protect sensitive information from the threats presented on the Internet. PKI provides a hierarchical framework for managing digital security attributes. Each PKI participant holds a digital certificate that has been issued by a CA (either public or private). The certificate contains several attributes that are used when parties negotiate a secure connection. These attributes must include the certificate validity period, end-host identity information, encryption keys that will be used for secure communications, and the signature of the issuing CA. Optional attributes may be included, depending on the requirements and capability of the PKI. A CA can be a trusted third party, such as VeriSign or Entrust, or a private (in-house) CA that you establish within your organization. The fact that the message could be decrypted using the sender's public key means that the holder of the private key created the message. This process relies on the receiver having a copy of the sender's public key and knowing with a high degree of certainty that it really does belong to the sender and not to someone pretending to be the sender. To validate the CA's signature, the receiver must know the CA's public key. Normally, this is handled out-of-band or through an operation performed during the installation of the certificate. For instance, most web browsers are configured with the root certificates of several CAs by default. CA Enrollment process The end host generates a private-public key pair. The end host generates a certificate request, which it forwards to the CA. Manual human intervention is required to approve the enrollment request, which is received by the CA. After the CA operator approves the request, the CA signs the certificate request with its private key and returns the completed certificate to the end host. The end host writes the certificate into a nonvolatile storage area (PC hard disk or NVRAM on Cisco routers). Refer : https://www.ssh.com/manuals/server-zos-product/55/ch06s03s01.html Login Security SSH SSH, the Secure Shell, is a popular, powerful, software-based approach to network security. Whenever data is sent by a computer to the network, SSH automatically encrypts (scrambles) it. Then, when the data reaches its intended recipient, SSH automatically decrypts (unscrambles) it. The result is transparent encryption: users can work normally, unaware that their communications are safely encrypted on the network. In addition, SSH can use modern, secure encryption algorithms based on how it's being configured and is effective enough to be found within mission-critical applications at major corporations. SSH has a client/server architecture An SSH server program, typically installed and run by a system administrator, accepts or rejects incoming connections to its host computer. Users then run SSH client programs, typically on other computers, to make requests of the SSH server, such as \u201cPlease log me in,\u201d \u201cPlease send me a file,\u201d or \u201cPlease execute this command.\u201d All communications between clients and servers are securely encrypted and protected from modification. What SSH is not: Although SSH stands for Secure Shell, it is not a true shell in the sense of the Unix Bourne shell and C shell. It is not a command interpreter, nor does it provide wildcard expansion, command history, and so forth. Rather, SSH creates a channel for running a shell on a remote computer, with end-to-end encryption between the two systems. The major features and guarantees of the SSH protocol are: Privacy of your data, via strong encryption Integrity of communications, guaranteeing they haven\u2019t been altered Authentication, i.e., proof of identity of senders and receivers Authorization, i.e., access control to accounts Forwarding or tunnelling to encrypt other TCP/IP-based sessions Kerberos According to Greek mythology Kerberos (Cerberus) was the gigantic, three-headed dog that guards the gates of the underworld to prevent the dead from leaving. So when it comes to Computer Science, Kerberos is a network authentication protocol and is currently the default authentication technology used by Microsoft Active Directory to authenticate users to services within a local area network. Kerberos uses symmetric-key cryptography and requires a trusted third-party authentication service to verify user identities. So they used the name of Kerberos for their computer network authentication protocol as the three heads of the Kerberos represent: a client: A user/ a service a server: Kerberos protected hosts reside - a Key Distribution Center (KDC), which acts as the trusted third-party authentication service. The KDC includes the following two servers: Authentication Server (AS) that performs the initial authentication and issues ticket-granting tickets (TGT) for users. Ticket-Granting Server (TGS) that issues service tickets that are based on the initial ticket-granting tickets (TGT). Certificate Chain The first part of the output of the OpenSSL command shows three certificates numbered 0, 1, and 2(not 2 anymore). Each certificate has a subject, s, and an issuer, i. The first certificate, number 0, is called the end-entity certificate. The subject line tells us it\u2019s valid for any subdomain of google.com because its subject is set to *.google.com. $ openssl s_client -connect www.google.com:443 -CApath /etc/ssl/certs CONNECTED(00000005) depth=2 OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign verify return:1 depth=1 C = US, O = Google Trust Services, CN = GTS CA 1O1 verify return:1 depth=0 C = US, ST = California, L = Mountain View, O = Google LLC, CN = www.google.com verify return:1 --- Certificate chain 0 s:/C=US/ST=California/L=Mountain View/O=Google LLC/CN=www.google.com i:/C=US/O=Google Trust Services/CN=GTS CA 1O1 1 s:/C=US/O=Google Trust Services/CN=GTS CA 1O1 i:/OU=GlobalSign Root CA - R2/O=GlobalSign/CN=GlobalSign --- Server certificate The issuer line indicates it\u2019s issued by Google Internet Authority G2, which also happens to be the subject of the second certificate, number 1 What the OpenSSL command line doesn\u2019t show here is the trust store that contains the list of CA certificates trusted by the system OpenSSL runs on. The public certificate of GlobalSign Authority must be present in the system\u2019s trust store to close the verification chain. This is called a chain of trust, and the figure below summarizes its behaviour at a high level. High-level view of the concept of chain of trust applied to verifying the authenticity of a website. The Root CA in the Firefox trust store provides the initial trust to verify the entire chain and trust the end-entity certificate. TLS Handshake The client sends a HELLO message to the server with a list of protocols and algorithms it supports. The server says HELLO back and sends its chain of certificates. Based on the capabilities of the client, the server picks a cipher suite. If the cipher suite supports ephemeral key exchange, like ECDHE does(ECDHE is an algorithm known as the Elliptic Curve Diffie-Hellman Exchange), the server and the client negotiate a pre-master key with the Diffie-Hellman algorithm. The pre-master key is never sent over the wire. The client and server create a session key that will be used to encrypt the data transiting through the connection. At the end of the handshake, both parties possess a secret session key used to encrypt data for the rest of the connection. This is what OpenSSL refers to as Master-Key NOTE There are 3 versions of TLS , TLS 1.0, 1.1 & 1.2 TLS 1.0 was released in 1999, making it a nearly two-decade-old protocol. It has been known to be vulnerable to attacks\u2014such as BEAST and POODLE\u2014for years, in addition to supporting weak cryptography, which doesn\u2019t keep modern-day connections sufficiently secure. TLS 1.1 is the forgotten \u201cmiddle child.\u201d It also has bad cryptography like its younger sibling. In most software, it was leapfrogged by TLS 1.2 and it\u2019s rare to see TLS 1.1 used. \u201cPerfect\u201d Forward Secrecy The term \u201cephemeral\u201d in the key exchange provides an important security feature mis-named perfect forward secrecy (PFS) or just \u201cForward Secrecy\u201d. In a non-ephemeral key exchange, the client sends the pre-master key to the server by encrypting it with the server\u2019s public key. The server then decrypts the pre-master key with its private key. If at a later point in time, the private key of the server is compromised, an attacker can go back to this handshake, decrypt the pre-master key, obtain the session key, and decrypt the entire traffic. Non-ephemeral key exchanges are vulnerable to attacks that may happen in the future on recorded traffic. And because people seldom change their password, decrypting data from the past may still be valuable for an attacker. An ephemeral key exchange like DHE, or its variant on elliptic curve, ECDHE, solves this problem by not transmitting the pre-master key over the wire. Instead, the pre-master key is computed by both the client and the server in isolation, using nonsensitive information exchanged publicly. Because the pre-master key can\u2019t be decrypted later by an attacker, the session key is safe from future attacks: hence, the term perfect forward secrecy. Keys are changed every X blocks along the stream. That prevents an attacker from simply sniffing the stream and applying brute force to crack the whole thing. \"Forward secrecy\" means that just because I can decrypt block M, does not mean that I can decrypt block Q Downside: The downside to PFS is that all those extra computational steps induce latency on the handshake and slow the user down. To avoid repeating this expensive work at every connection, both sides cache the session key for future use via a technique called session resumption. This is what the session-ID and TLS ticket are for: they allow a client and server that share a session ID to skip over the negotiation of a session key, because they already agreed on one previously, and go directly to exchanging data securely.","title":"Fundamentals of Security"},{"location":"security/fundamentals/#part-i-fundamentals","text":"","title":"Part I: Fundamentals"},{"location":"security/fundamentals/#introduction-to-security-overview-for-sre","text":"If you look closely, both Site Reliability Engineering and Security Engineering are concerned with keeping a system usable. Issues like broken releases, capacity shortages, and misconfigurations can make a system unusable (at least temporarily). Security or privacy incidents that break the trust of users also undermine the usefulness of a system. Consequently, system security should be top of mind for SREs. SREs should be involved in both significant design discussions and actual system changes. They have quite a big role in System design & hence are quite sometimes the first line of defence. SRE\u2019s help in preventing bad design & implementations which can affect the overall security of the infrastructure. Successfully designing, implementing, and maintaining systems requires a commitment to the full system lifecycle . This commitment is possible only when security and reliability are central elements in the architecture of systems. Core Pillars of Information Security : Confidentiality \u2013 only allow access to data for which the user is permitted Integrity \u2013 ensure data is not tampered or altered by unauthorized users Availability \u2013 ensure systems and data are available to authorized users when they need it Thinking like a Security Engineer When starting a new application or re-factoring an existing application, you should consider each functional feature, and consider: Is the process surrounding this feature as safe as possible? In other words, is this a flawed process? If I were evil, how would I abuse this feature? Or more specifically failing to address how a feature can be abused can cause design flaws. Is the feature required to be on by default? If so, are there limits or options that could help reduce the risk from this feature? Security Principles By OWASP (Open Web Application Security Project) Minimize attack surface area : Every feature that is added to an application adds a certain amount of risk to the overall application. The aim of secure development is to reduce the overall risk by reducing the attack surface area. For example, a web application implements online help with a search function. The search function may be vulnerable to SQL injection attacks. If the help feature was limited to authorized users, the attack likelihood is reduced. If the help feature\u2019s search function was gated through centralized data validation routines, the ability to perform SQL injection is dramatically reduced. However, if the help feature was re-written to eliminate the search function (through a better user interface, for example), this almost eliminates the attack surface area, even if the help feature was available to the Internet at large. Establish secure defaults: There are many ways to deliver an \u201cout of the box\u201d experience for users. However, by default, the experience should be secure, and it should be up to the user to reduce their security \u2013 if they are allowed. For example, by default, password ageing and complexity should be enabled. Users might be allowed to turn these two features off to simplify their use of the application and increase their risk. Default Passwords of routers, IoT devices should be changed Principle of Least privilege The principle of least privilege recommends that accounts have the least amount of privilege required to perform their business processes. This encompasses user rights, resource permissions such as CPU limits, memory, network, and file system permissions. For example, if a middleware server only requires access to the network, read access to a database table, and the ability to write to a log, this describes all the permissions that should be granted. Under no circumstances should the middleware be granted administrative privileges. Principle of Defense in depth The principle of defence in depth suggests that where one control would be reasonable, more controls that approach risks in different fashions are better. Controls, when used in depth, can make severe vulnerabilities extraordinarily difficult to exploit and thus unlikely to occur. With secure coding, this may take the form of tier-based validation, centralized auditing controls, and requiring users to be logged on all pages. For example, a flawed administrative interface is unlikely to be vulnerable to an anonymous attack if it correctly gates access to production management networks, checks for administrative user authorization, and logs all access. Fail securely Applications regularly fail to process transactions for many reasons. How they fail can determine if an application is secure or not. ``` is_admin = true; try { code_which_may_faile(); is_admin = is_user_assigned_role(\"Adminstrator\"); } catch (Exception err) { log.error(err.toString()); } ``` - If either codeWhichMayFail() or isUserInRole fails or throws an exception, the user is an admin by default. This is obviously a security risk. Don\u2019t trust services Many organizations utilize the processing capabilities of third-party partners, who more than likely have different security policies and posture than you. It is unlikely that you can influence or control any external third party, whether they are home users or major suppliers or partners. Therefore, the implicit trust of externally run systems is not warranted. All external systems should be treated similarly. For example, a loyalty program provider provides data that is used by Internet Banking, providing the number of reward points and a small list of potential redemption items. However, the data should be checked to ensure that it is safe to display to end-users and that the reward points are a positive number, and not improbably large. Separation of duties The key to fraud control is the separation of duties. For example, someone who requests a computer cannot also sign for it, nor should they directly receive the computer. This prevents the user from requesting many computers and claiming they never arrived. Certain roles have different levels of trust than normal users. In particular, administrators are different from normal users. In general, administrators should not be users of the application. For example, an administrator should be able to turn the system on or off, set password policy but shouldn\u2019t be able to log on to the storefront as a super privileged user, such as being able to \u201cbuy\u201d goods on behalf of other users. Avoid security by obscurity Security through obscurity is a weak security control, and nearly always fails when it is the only control. This is not to say that keeping secrets is a bad idea, it simply means that the security of systems should not be reliant upon keeping details hidden. For example, the security of an application should not rely upon knowledge of the source code being kept secret. The security should rely upon many other factors, including reasonable password policies, defence in depth, business transaction limits, solid network architecture, and fraud, and audit controls. A practical example is Linux. Linux\u2019s source code is widely available, and yet when properly secured, Linux is a secure and robust operating system. Keep security simple Attack surface area and simplicity go hand in hand. Certain software engineering practices prefer overly complex approaches to what would otherwise be a relatively straightforward and simple design. Developers should avoid the use of double negatives and complex architectures when a simpler approach would be faster and simpler. For example, although it might be fashionable to have a slew of singleton entity beans running on a separate middleware server, it is more secure and faster to simply use global variables with an appropriate mutex mechanism to protect against race conditions. Fix security issues correctly Once a security issue has been identified, it is important to develop a test for it and to understand the root cause of the issue. When design patterns are used, the security issue is likely widespread amongst all codebases, so developing the right fix without introducing regressions is essential. For example, a user has found that they can see another user\u2019s balance by adjusting their cookie. The fix seems to be relatively straightforward, but as the cookie handling code is shared among all applications, a change to just one application will trickle through to all other applications. The fix must, therefore, be tested on all affected applications. Reliability & Security Reliability and security are both crucial components of a truly trustworthy system, but building systems that are both reliable and secure is difficult. While the requirements for reliability and security share many common properties, they also require different design considerations. It is easy to miss the subtle interplay between reliability and security that can cause unexpected outcomes Ex: A password management application failure was triggered by a reliability problem i.e poor load-balancing and load-shedding strategies and its recovery were later complicated by multiple measures (HSM mechanism which needs to be plugged into server racks, which works as an authentication & the HSM token supposedly locked inside a case.. & the problem can be further elongated ) designed to increase the security of the system.","title":"Introduction to Security Overview for SRE"},{"location":"security/fundamentals/#authentication-vs-authorization","text":"Authentication is the act of validating that users are who they claim to be. Passwords are the most common authentication factor\u2014if a user enters the correct password, the system assumes the identity is valid and grants access. Other technologies such as One-Time Pins, authentication apps, and even biometrics can also be used to authenticate identity. In some instances, systems require the successful verification of more than one factor before granting access. This multi-factor authentication (MFA) requirement is often deployed to increase security beyond what passwords alone can provide. Authorization in system security is the process of giving the user permission to access a specific resource or function. This term is often used interchangeably with access control or client privilege. Giving someone permission to download a particular file on a server or providing individual users with administrative access to an application are good examples. In secure environments, authorization must always follow authentication, users should first prove that their identities are genuine before an organization\u2019s administrators grant them access to the requested resources.","title":"Authentication vs Authorization"},{"location":"security/fundamentals/#common-authentication-flow-local-authentication","text":"The user registers using an identifier like username/email/mobile The application stores user credentials in the database The application sends a verification email/message to validate the registration Post successful registration, the user enters credentials for logging in On successful authentication, the user is allowed access to specific resources","title":"Common authentication flow (local authentication)"},{"location":"security/fundamentals/#openidoauth","text":"OpenID is an authentication protocol that allows us to authenticate users without using a local auth system. In such a scenario, a user has to be registered with an OpenID Provider and the same provider should be integrated with the authentication flow of your application. To verify the details, we have to forward the authentication requests to the provider. On successful authentication, we receive a success message and/or profile details with which we can execute the necessary flow. OAuth is an authorization mechanism that allows your application user access to a provider(Gmail/Facebook/Instagram/etc). On successful response, we (your application) receive a token with which the application can access certain APIs on behalf of a user. OAuth is convenient in case your business use case requires some certain user-facing APIs like access to Google Drive or sending tweets on your behalf. Most OAuth 2.0 providers can be used for pseudo authentication. Having said that, it can get pretty complicated if you are using multiple OAuth providers to authenticate users on top of the local authentication system.","title":"OpenID/OAuth"},{"location":"security/fundamentals/#cryptography","text":"It is the science and study of hiding any text in such a way that only the intended recipients or authorized persons can read it and that any text can even use things such as invisible ink or the mechanical cryptography machines of the past. Cryptography is necessary for securing critical or proprietary information and is used to encode private data messages by converting some plain text into ciphertext. At its core, there are two ways of doing this, more advanced methods are all built upon.","title":"Cryptography"},{"location":"security/fundamentals/#ciphers","text":"Ciphers are the cornerstone of cryptography. A cipher is a set of algorithms that performs encryption or decryption on a message. An encryption algorithm (E) takes a secret key (k) and a message (m) and produces a ciphertext (c). Similarly, a Decryption algorithm (D) takes a secret key (K) and the previous resulting Ciphertext (C). They are represented as follows: E(k,m) = c D(k,c) = m This also means that for it to be a cipher, it must satisfy the consistency equation as follows, making it possible to decrypt. D(k,E(k,m)) = m Stream Ciphers: The message is broken into characters or bits and enciphered with a key or keystream(should be random and generated independently of the message stream) that is as long as the plaintext bitstream. If the keystream is random, this scheme would be unbreakable unless the keystream was acquired, making it unconditionally secure. The keystream must be provided to both parties in a secure way to prevent its release. Block Ciphers: Block ciphers \u2014 process messages in blocks, each of which is then encrypted or decrypted. A block cipher is a symmetric cipher in which blocks of plaintext are treated as a whole and used to produce ciphertext blocks. The block cipher takes blocks that are b bits long and encrypts them to blocks that are also b bits long. Block sizes are typically 64 or 128 bits long. Encryption Secret Key (Symmetric Key) : the same key is used for encryption and decryption Public Key (Asymmetric Key) in an asymmetric, the encryption and decryption keys are different but related. The encryption key is known as the public key and the decryption key is known as the private key. The public and private keys are known as a key pair. Symmetric Key Encryption DES The Data Encryption Standard (DES) has been the worldwide encryption standard for a long time. IBM developed DES in 1975, and it has held up remarkably well against years of cryptanalysis. DES is a symmetric encryption algorithm with a fixed key length of 56 bits. The algorithm is still good, but because of the short key length, it is susceptible to brute-force attacks that have sufficient resources. DES usually operates in block mode, whereby it encrypts data in 64-bit blocks. The same algorithm and key are used for both encryption and decryption. Because DES is based on simple mathematical functions, it can be easily implemented and accelerated in hardware. Triple DES With advances in computer processing power, the original 56-bit DES key became too short to withstand an attacker with even a limited budget. One way of increasing the effective key length of DES without changing the well-analyzed algorithm itself is to use the same algorithm with different keys several times in a row. The technique of applying DES three times in a row to a plain text block is called Triple DES (3DES). The 3DES technique is shown in Figure. Brute-force attacks on 3DES are considered unfeasible today. Because the basic algorithm has been tested in the field for more than 25 years, it is considered to be more trustworthy than its predecessor. AES On October 2, 2000, The U.S. National Institute of Standards and Technology (NIST) announced the selection of the Rijndael cipher as the AES algorithm. This cipher, developed by Joan Daemen and Vincent Rijmen, has a variable block length and key length. The algorithm currently specifies how to use keys with a length of 128, 192, or 256 bits to encrypt blocks with a length of 128, 192, or 256 bits (all nine combinations of key length and block length are possible). Both block and key lengths can be extended easily to multiples of 32 bits. AES was chosen to replace DES and 3DES because they are either too weak (DES, in terms of key length) or too slow (3DES) to run on modern, efficient hardware. AES is more efficient and much faster, usually by a factor of 5 compared to DES on the same hardware. AES is also more suitable for high throughput, especially if pure software encryption is used. However, AES is a relatively young algorithm, and as the golden rule of cryptography states, \u201cA more mature algorithm is always more trusted.\u201d Asymmetric Key Algorithm In a symmetric key system, Alice first puts the secret message in a box and then padlocks the box using a lock to which she has a key. She then sends the box to Bob through regular mail. When Bob receives the box, he uses an identical copy of Alice's key (which he has obtained previously) to open the box and read the message. In an asymmetric key system, instead of opening the box when he receives it, Bob simply adds his own personal lock to the box and returns the box through public mail to Alice. Alice uses her key to remove her lock and returns the box to Bob, with Bob's lock still in place. Finally, Bob uses his key to remove his lock and reads the message from Alice. The critical advantage in an asymmetric system is that Alice never needs to send a copy of her key to Bob. This reduces the possibility that a third party (for example, an unscrupulous postmaster) can copy the key while it is in transit to Bob, allowing that third party to spy on all future messages sent by Alice. In addition, if Bob is careless and allows someone else to copy his key, Alice's messages to Bob are compromised, but Alice's messages to other people remain secret NOTE : In terms of TLS key exchange, this is the common approach. Diffie-Hellman The protocol has two system parameters, p and g. They are both public and may be used by everybody. Parameter p is a prime number, and parameter g (usually called a generator) is an integer that is smaller than p, but with the following property: For every number n between 1 and p \u2013 1 inclusive, there is a power k of g such that n = gk mod p. Diffie Hellman algorithm is an asymmetric algorithm used to establish a shared secret for a symmetric key algorithm. Nowadays most of the people use hybrid cryptosystem i.e, a combination of symmetric and asymmetric encryption. Asymmetric Encryption is used as a technique in key exchange mechanism to share a secret key and after the key is shared between sender and receiver, the communication will take place using symmetric encryption. The shared secret key will be used to encrypt the communication. Refer: https://medium.com/@akhigbemmanuel/what-is-the-diffie-hellman-key-exchange-algorithm-84d60025a30d RSA The RSA algorithm is very flexible and has a variable key length where, if necessary, speed can be traded for the level of security of the algorithm. The RSA keys are usually 512 to 2048 bits long. RSA has withstood years of extensive cryptanalysis. Although those years neither proved nor disproved RSA's security, they attest to a confidence level in the algorithm. RSA security is based on the difficulty of factoring very large numbers. If an easy method of factoring these large numbers were discovered, the effectiveness of RSA would be destroyed. Refer: https://medium.com/curiositypapers/a-complete-explanation-of-rsa-asymmetric-encryption-742c5971e0f NOTE : RSA Keys can be used for key exchange just like Diffie Hellman Hashing Algorithms Hashing is one of the mechanisms used for data integrity assurance. Hashing is based on a one-way mathematical function, which is relatively easy to compute but significantly harder to reverse. A hash function, which is a one-way function to input data to produce a fixed-length digest (fingerprint) of output data. The digest is cryptographically strong; that is, it is impossible to recover input data from its digest. If the input data changes just a little, the digest (fingerprint) changes substantially in what is called an avalanche effect. More: https://medium.com/@rauljordan/the-state-of-hashing-algorithms-the-why-the-how-and-the-future-b21d5c0440de https://medium.com/@StevieCEllis/the-beautiful-hash-algorithm-f18d9d2b84fb MD5 MD5 is a one-way function with which it is easy to compute the hash from the given input data, but it is unfeasible to compute input data given only a hash. SHA-1 MD5 is considered less secure than SHA-1 because MD5 has some weaknesses. HA-1 also uses a stronger, 160-bit digest, which makes MD5 the second choice as hash methods are concerned. The algorithm takes a message of less than 264 bits in length and produces a 160-bit message digest. This algorithm is slightly slower than MD5. NOTE : SHA-1 is also recently demonstrated to be broken, Minimum current recommendation is SHA-256 Digital Certificates Digital signatures, provide a means to digitally authenticate devices and individual users. In public-key cryptography, such as the RSA encryption system, each user has a key-pair containing both a public key and a private key. The keys act as complements, and anything encrypted with one of the keys can be decrypted with the other. In simple terms, a signature is formed when data is encrypted with a user's private key. The receiver verifies the signature by decrypting the message with the sender's public key. Key management is often considered the most difficult task in designing and implementing cryptographic systems. Businesses can simplify some of the deployment and management issues that are encountered with secured data communications by employing a Public Key Infrastructure (PKI). Because corporations often move security-sensitive communications across the Internet, an effective mechanism must be implemented to protect sensitive information from the threats presented on the Internet. PKI provides a hierarchical framework for managing digital security attributes. Each PKI participant holds a digital certificate that has been issued by a CA (either public or private). The certificate contains several attributes that are used when parties negotiate a secure connection. These attributes must include the certificate validity period, end-host identity information, encryption keys that will be used for secure communications, and the signature of the issuing CA. Optional attributes may be included, depending on the requirements and capability of the PKI. A CA can be a trusted third party, such as VeriSign or Entrust, or a private (in-house) CA that you establish within your organization. The fact that the message could be decrypted using the sender's public key means that the holder of the private key created the message. This process relies on the receiver having a copy of the sender's public key and knowing with a high degree of certainty that it really does belong to the sender and not to someone pretending to be the sender. To validate the CA's signature, the receiver must know the CA's public key. Normally, this is handled out-of-band or through an operation performed during the installation of the certificate. For instance, most web browsers are configured with the root certificates of several CAs by default. CA Enrollment process The end host generates a private-public key pair. The end host generates a certificate request, which it forwards to the CA. Manual human intervention is required to approve the enrollment request, which is received by the CA. After the CA operator approves the request, the CA signs the certificate request with its private key and returns the completed certificate to the end host. The end host writes the certificate into a nonvolatile storage area (PC hard disk or NVRAM on Cisco routers). Refer : https://www.ssh.com/manuals/server-zos-product/55/ch06s03s01.html","title":"Ciphers"},{"location":"security/fundamentals/#login-security","text":"","title":"Login Security"},{"location":"security/fundamentals/#ssh","text":"SSH, the Secure Shell, is a popular, powerful, software-based approach to network security. Whenever data is sent by a computer to the network, SSH automatically encrypts (scrambles) it. Then, when the data reaches its intended recipient, SSH automatically decrypts (unscrambles) it. The result is transparent encryption: users can work normally, unaware that their communications are safely encrypted on the network. In addition, SSH can use modern, secure encryption algorithms based on how it's being configured and is effective enough to be found within mission-critical applications at major corporations. SSH has a client/server architecture An SSH server program, typically installed and run by a system administrator, accepts or rejects incoming connections to its host computer. Users then run SSH client programs, typically on other computers, to make requests of the SSH server, such as \u201cPlease log me in,\u201d \u201cPlease send me a file,\u201d or \u201cPlease execute this command.\u201d All communications between clients and servers are securely encrypted and protected from modification. What SSH is not: Although SSH stands for Secure Shell, it is not a true shell in the sense of the Unix Bourne shell and C shell. It is not a command interpreter, nor does it provide wildcard expansion, command history, and so forth. Rather, SSH creates a channel for running a shell on a remote computer, with end-to-end encryption between the two systems. The major features and guarantees of the SSH protocol are: Privacy of your data, via strong encryption Integrity of communications, guaranteeing they haven\u2019t been altered Authentication, i.e., proof of identity of senders and receivers Authorization, i.e., access control to accounts Forwarding or tunnelling to encrypt other TCP/IP-based sessions","title":"SSH"},{"location":"security/fundamentals/#kerberos","text":"According to Greek mythology Kerberos (Cerberus) was the gigantic, three-headed dog that guards the gates of the underworld to prevent the dead from leaving. So when it comes to Computer Science, Kerberos is a network authentication protocol and is currently the default authentication technology used by Microsoft Active Directory to authenticate users to services within a local area network. Kerberos uses symmetric-key cryptography and requires a trusted third-party authentication service to verify user identities. So they used the name of Kerberos for their computer network authentication protocol as the three heads of the Kerberos represent: a client: A user/ a service a server: Kerberos protected hosts reside - a Key Distribution Center (KDC), which acts as the trusted third-party authentication service. The KDC includes the following two servers: Authentication Server (AS) that performs the initial authentication and issues ticket-granting tickets (TGT) for users. Ticket-Granting Server (TGS) that issues service tickets that are based on the initial ticket-granting tickets (TGT).","title":"Kerberos"},{"location":"security/fundamentals/#certificate-chain","text":"The first part of the output of the OpenSSL command shows three certificates numbered 0, 1, and 2(not 2 anymore). Each certificate has a subject, s, and an issuer, i. The first certificate, number 0, is called the end-entity certificate. The subject line tells us it\u2019s valid for any subdomain of google.com because its subject is set to *.google.com. $ openssl s_client -connect www.google.com:443 -CApath /etc/ssl/certs CONNECTED(00000005) depth=2 OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign verify return:1 depth=1 C = US, O = Google Trust Services, CN = GTS CA 1O1 verify return:1 depth=0 C = US, ST = California, L = Mountain View, O = Google LLC, CN = www.google.com verify return:1 --- Certificate chain 0 s:/C=US/ST=California/L=Mountain View/O=Google LLC/CN=www.google.com i:/C=US/O=Google Trust Services/CN=GTS CA 1O1 1 s:/C=US/O=Google Trust Services/CN=GTS CA 1O1 i:/OU=GlobalSign Root CA - R2/O=GlobalSign/CN=GlobalSign --- Server certificate The issuer line indicates it\u2019s issued by Google Internet Authority G2, which also happens to be the subject of the second certificate, number 1 What the OpenSSL command line doesn\u2019t show here is the trust store that contains the list of CA certificates trusted by the system OpenSSL runs on. The public certificate of GlobalSign Authority must be present in the system\u2019s trust store to close the verification chain. This is called a chain of trust, and the figure below summarizes its behaviour at a high level. High-level view of the concept of chain of trust applied to verifying the authenticity of a website. The Root CA in the Firefox trust store provides the initial trust to verify the entire chain and trust the end-entity certificate.","title":"Certificate Chain"},{"location":"security/fundamentals/#tls-handshake","text":"The client sends a HELLO message to the server with a list of protocols and algorithms it supports. The server says HELLO back and sends its chain of certificates. Based on the capabilities of the client, the server picks a cipher suite. If the cipher suite supports ephemeral key exchange, like ECDHE does(ECDHE is an algorithm known as the Elliptic Curve Diffie-Hellman Exchange), the server and the client negotiate a pre-master key with the Diffie-Hellman algorithm. The pre-master key is never sent over the wire. The client and server create a session key that will be used to encrypt the data transiting through the connection. At the end of the handshake, both parties possess a secret session key used to encrypt data for the rest of the connection. This is what OpenSSL refers to as Master-Key NOTE There are 3 versions of TLS , TLS 1.0, 1.1 & 1.2 TLS 1.0 was released in 1999, making it a nearly two-decade-old protocol. It has been known to be vulnerable to attacks\u2014such as BEAST and POODLE\u2014for years, in addition to supporting weak cryptography, which doesn\u2019t keep modern-day connections sufficiently secure. TLS 1.1 is the forgotten \u201cmiddle child.\u201d It also has bad cryptography like its younger sibling. In most software, it was leapfrogged by TLS 1.2 and it\u2019s rare to see TLS 1.1 used.","title":"TLS Handshake"},{"location":"security/fundamentals/#perfect-forward-secrecy","text":"The term \u201cephemeral\u201d in the key exchange provides an important security feature mis-named perfect forward secrecy (PFS) or just \u201cForward Secrecy\u201d. In a non-ephemeral key exchange, the client sends the pre-master key to the server by encrypting it with the server\u2019s public key. The server then decrypts the pre-master key with its private key. If at a later point in time, the private key of the server is compromised, an attacker can go back to this handshake, decrypt the pre-master key, obtain the session key, and decrypt the entire traffic. Non-ephemeral key exchanges are vulnerable to attacks that may happen in the future on recorded traffic. And because people seldom change their password, decrypting data from the past may still be valuable for an attacker. An ephemeral key exchange like DHE, or its variant on elliptic curve, ECDHE, solves this problem by not transmitting the pre-master key over the wire. Instead, the pre-master key is computed by both the client and the server in isolation, using nonsensitive information exchanged publicly. Because the pre-master key can\u2019t be decrypted later by an attacker, the session key is safe from future attacks: hence, the term perfect forward secrecy. Keys are changed every X blocks along the stream. That prevents an attacker from simply sniffing the stream and applying brute force to crack the whole thing. \"Forward secrecy\" means that just because I can decrypt block M, does not mean that I can decrypt block Q Downside: The downside to PFS is that all those extra computational steps induce latency on the handshake and slow the user down. To avoid repeating this expensive work at every connection, both sides cache the session key for future use via a technique called session resumption. This is what the session-ID and TLS ticket are for: they allow a client and server that share a session ID to skip over the negotiation of a session key, because they already agreed on one previously, and go directly to exchanging data securely.","title":"\u201cPerfect\u201d Forward Secrecy"},{"location":"security/intro/","text":"Security Prerequisites Linux Basics Linux Networking What to expect from this course The course covers fundamentals of information security along with touching on subjects of system security, network & web security. This course aims to get you familiar with the basics of information security in day to day operations & then as an SRE develop the mindset of ensuring that security takes a front-seat while developing solutions. The course also serves as an introduction to common risks and best practices along with practical ways to find out vulnerable systems and loopholes which might become compromised if not secured. What is not covered under this course The courseware is not an ethical hacking workshop or a very deep dive into the fundamentals of the problems. The course does not deal with hacking or breaking into systems but rather an approach on how to ensure you don\u2019t get into those situations and also to make you aware of different ways a system can be compromised. Course Contents Fundamentals Network Security Threats, Attacks & Defence Writing Secure Code & More Conclusion","title":"Introduction"},{"location":"security/intro/#security","text":"","title":"Security"},{"location":"security/intro/#prerequisites","text":"Linux Basics Linux Networking","title":"Prerequisites"},{"location":"security/intro/#what-to-expect-from-this-course","text":"The course covers fundamentals of information security along with touching on subjects of system security, network & web security. This course aims to get you familiar with the basics of information security in day to day operations & then as an SRE develop the mindset of ensuring that security takes a front-seat while developing solutions. The course also serves as an introduction to common risks and best practices along with practical ways to find out vulnerable systems and loopholes which might become compromised if not secured.","title":"What to expect from this course"},{"location":"security/intro/#what-is-not-covered-under-this-course","text":"The courseware is not an ethical hacking workshop or a very deep dive into the fundamentals of the problems. The course does not deal with hacking or breaking into systems but rather an approach on how to ensure you don\u2019t get into those situations and also to make you aware of different ways a system can be compromised.","title":"What is not covered under this course"},{"location":"security/intro/#course-contents","text":"Fundamentals Network Security Threats, Attacks & Defence Writing Secure Code & More Conclusion","title":"Course Contents"},{"location":"security/network_security/","text":"Part II: Network Security Introduction TCP/IP is the dominant networking technology today. It is a five-layer architecture. These layers are, from top to bottom, the application layer, the transport layer (TCP), the network layer (IP), the data-link layer, and the physical layer. In addition to TCP/IP, there also are other networking technologies. For convenience, we use the OSI network model to represent non-TCP/IP network technologies. Different networks are interconnected using gateways. A gateway can be placed at any layer. The OSI model is a seven-layer architecture. The OSI architecture is similar to the TCP/IP architecture, except that the OSI model specifies two additional layers between the application layer and the transport layer in the TCP/IP architecture. These two layers are the presentation layer and the session layer. Figure 5.1 shows the relationship between the TCP/IP layers and the OSI layers. The application layer in TCP/IP corresponds to the application layer and the presentation layer in OSI. The transport layer in TCP/IP corresponds to the session layer and the transport layer in OSI. The remaining three layers in the TCP/IP architecture are one-to-one correspondent to the remaining three layers in the OSI model. Correspondence between layers of the TCP/IP architecture and the OSI model. Also shown are placements of cryptographic algorithms in network layers, where the dotted arrows indicate actual communications of cryptographic algorithms The functionalities of OSI layers are briefly described as follows: The application layer serves as an interface between applications and network programs. It supports application programs and end-user processing. Common application-layer programs include remote logins, file transfer, email, and Web browsing. The presentation layer is responsible for dealing with data that is formed differently. This protocol layer allows application-layer programs residing on different sides of a communication channel with different platforms to understand each other's data formats regardless of how they are presented. The session layer is responsible for creating, managing, and closing a communication connection. The transport layer is responsible for providing reliable connections, such as packet sequencing, traffic control, and congestion control. The network layer is responsible for routing device-independent data packets from the current hop to the next hop. The data-link layer is responsible for encapsulating device-independent data packets into device-dependent data frames. It has two sublayers: logical link control and media access control. The physical layer is responsible for transmitting device-dependent frames through some physical media. Starting from the application layer, data generated from an application program is passed down layer-by-layer to the physical layer. Data from the previous layer is enclosed in a new envelope at the current layer, where the data from the previous layer is also just an envelope containing the data from the layer before it. This is similar to enclosing a smaller envelope in a larger one. The envelope added at each layer contains sufficient information for handling the packet. Application-layer data are divided into blocks small enough to be encapsulated in an envelope at the next layer. Application data blocks are \u201cdressed up\u201d in the TCP/IP architecture according to the following basic steps. At the sending side, an application data block is encapsulated in a TCP packet when it is passed down to the TCP layer. In other words, a TCP packet consists of a header and a payload, where the header corresponds to the TCP envelope and the payload is the application data block. Likewise, the TCP packet will be encapsulated in an IP packet when it is passed down to the IP layer. An IP packet consists of a header and a payload, which is the TCP packet passed down from the TCP layer. The IP packet will be encapsulated in a device-dependent frame (e.g., an Ethernet frame) when it is passed down to the data-link layer. A frame has a header, and it may also have a trailer. For example, in addition to having a header, an Ethernet frame also has a 32-bit cyclic redundancy check (CRC) trailer. When it is passed down to the physical layer, a frame will be transformed into a sequence of media signals for transmission Flow Diagram of a Packet Generation At the destination side, the medium signals are converted by the physical layer into a frame, which is passed up to the data-link layer. The data-link layer passes the frame payload (i.e., the IP packet encapsulated in the frame) up to the IP layer. The IP layer passes the IP payload, namely, the TCP packet encapsulated in the IP packet, up to the TCP layer. The TCP layer passes the TCP payload, namely, the application data block, up to the application layer. When a packet arrives at a router, it only goes up to the IP layer, where certain fields in the IP header are modified (e.g., the value of TTL is decreased by 1). This modified packet is then passed back down layer-by-layer to the physical layer for further transmission. Public Key Infrastructure To deploy cryptographic algorithms in network applications, we need a way to distribute secret keys using open networks. Public-key cryptography is the best way to distribute these secret keys. To use public-key cryptography, we need to build a public-key infrastructure (PKI) to support and manage public-key certificates and certificate authority (CA) networks. In particular, PKIs are set up to perform the following functions: Determine the legitimacy of users before issuing public-key certificates to them. Issue public-key certificates upon user requests. Extend public-key certificates valid time upon user requests. Revoke public-key certificates upon users' requests or when the corresponding private keys are compromised. Store and manage public-key certificates. Prevent digital signature signers from denying their signatures. Support CA networks to allow different CAs to authenticate public-key certificates issued by other CAs. X.509: https://certificatedecoder.dev/?gclid=EAIaIQobChMI0M731O6G6gIVVSQrCh04bQaAEAAYASAAEgKRkPD_BwE IPsec: A Security Protocol at the Network Layer IPsec is a major security protocol at the network layer IPsec provides a potent platform for constructing virtual private networks (VPN). VPNs are private networks overlayed on public networks. The purpose of deploying cryptographic algorithms at the network layer is to encrypt or authenticate IP packets (either just the payloads or the whole packets). IPsec also specifies how to exchange keys. Thus, IPsec consists of authentication protocols, encryption protocols, and key exchange protocols. They are referred to, respectively, as authentication header (AH), encapsulating security payload (ESP), and Internet key exchange (IKE). PGP & S/MIME : Email Security There are several security protocols at the application layer. The most used of these protocols are email security protocols namely PGP and S/MIME. SMTP (\u201cSimple Mail Transfer Protocol\u201d) is used for sending and delivering from a client to a server via port 25: it\u2019s the outgoing server. On the contrary, POP (\u201cPost Office Protocol\u201d) allows the users to pick up the message and download it into their inbox: it\u2019s the incoming server. The latest version of the Post Office Protocol is named POP3, and it\u2019s been used since 1996; it uses port 110 PGP PGP implements all major cryptographic algorithms, the ZIP compression algorithm, and the Base64 encoding algorithm. It can be used to authenticate a message, encrypt a message, or both. PGP follows the following general process: authentication, ZIP compression, encryption, and Base64 encoding. The Base64 encoding procedure makes the message ready for SMTP transmission GPG (GnuPG) GnuPG is another free encryption standard that companies may use that is based on OpenPGP. GnuPG serves as a replacement for Symantec\u2019s PGP. The main difference is the supported algorithms. However, GnuPG plays nice with PGP by design. Because GnuPG is open, some businesses would prefer the technical support and the user interface that comes with Symantec\u2019s PGP. It is important to note that there are some nuances between the compatibility of GnuPG and PGP, such as the compatibility between certain algorithms, but in most applications such as email, there are workarounds. One such algorithm is the IDEA Module which isn\u2019t included in GnuPG out of the box due to patent issues. S/MIME SMTP can only handle 7-bit ASCII text (You can use UTF-8 extensions to alleviate these limitations, ) messages. While POP can handle other content types besides 7-bit ASCII, POP may, under a common default setting, download all the messages stored in the mail server to the user's local computer. After that, if POP removes these messages from the mail server. This makes it difficult for the users to read their messages from multiple computers. The Multipurpose Internet Mail Extension protocol (MIME) was designed to support sending and receiving email messages in various formats, including nontext files generated by word processors, graphics files, sound files, and video clips. Moreover, MIME allows a single message to include mixed types of data in any combination of these formats. The Internet Mail Access Protocol (IMAP), operated on TCP port 143(only for non-encrypted), stores (Configurable on both server & client just like PoP) incoming email messages in the mail server until the user deletes them deliberately. This allows the users to access their mailbox from multiple machines and download messages to a local machine without deleting it from the mailbox in the mail server. SSL/TLS SSL uses a PKI to decide if a server\u2019s public key is trustworthy by requiring servers to use a security certificate signed by a trusted CA. When Netscape Navigator 1.0 was released, it trusted a single CA operated by the RSA Data Security corporation. The server\u2019s public RSA keys were used to be stored in the security certificate, which can then be used by the browser to establish a secure communication channel. The security certificates we use today still rely on the same standard (named X.509) that Netscape Navigator 1.0 used back then. Netscape intended to train users(though this didn\u2019t work out later) to differentiate secure communications from insecure ones, so they put a lock icon next to the address bar. When the lock is open, the communication is insecure. A closed lock means communication has been secured with SSL, which required the server to provide a signed certificate. You\u2019re obviously familiar with this icon as it\u2019s been in every browser ever since. The engineers at Netscape truly created a standard for secure internet communications. A year after releasing SSL 2.0, Netscape fixed several security issues and released SSL 3.0, a protocol that, albeit being officially deprecated since June 2015, remains in use in certain parts of the world more than 20 years after its introduction. To standardize SSL, the Internet Engineering Task Force (IETF) created a slightly modified SSL 3.0 and, in 1999, unveiled it as Transport Layer Security (TLS) 1.0. The name change between SSL and TLS continues to confuse people today. Officially, TLS is the new SSL, but in practice, people use SSL and TLS interchangeably to talk about any version of the protocol. Must See: https://tls.ulfheim.net/ https://davidwong.fr/tls13/ Network Perimeter Security Let us see how we keep a check on the perimeter i.e the edges, the first layer of protection General Firewall Framework Firewalls are needed because encryption algorithms cannot effectively stop malicious packets from getting into an edge network. This is because IP packets, regardless of whether they are encrypted, can always be forwarded into an edge network. Firewalls that were developed in the 1990s are important instruments to help restrict network access. A firewall may be a hardware device, a software package, or a combination of both. Packets flowing into the internal network from the outside should be evaluated before they are allowed to enter. One of the critical elements of a firewall is its ability to examine packets without imposing a negative impact on communication speed while providing security protections for the internal network. The packet inspection that is carried out by firewalls can be done using several different methods. Based on the particular method used by the firewall, it can be characterized as either a packet filter, circuit gateway, application gateway, or dynamic packet filter. Packet Filters It inspects ingress packets coming to an internal network from outside and inspects egress packets going outside from an internal network Packing filtering only inspects IP headers and TCP headers, not the payloads generated at the application layer A packet-filtering firewall uses a set of rules to determine whether a packet should be allowed or denied to pass through. 2 types: Stateless It treats each packet as an independent object, and it does not keep track of any previously processed packets. In other words, stateless filtering inspects a packet when it arrives and makes a decision without leaving any record of the packet being inspected. Stateful Stateful filtering, also referred to as connection-state filtering, keeps track of connections between an internal host and an external host. A connection state (or state, for short) indicates whether it is a TCP connection or a UDP connection and whether the connection is established. Circuit Gateways Circuit gateways, also referred to as circuit-level gateways, are typically operated at the transportation layer They evaluate the information of the IP addresses and the port numbers contained in TCP (or UDP) headers and use it to determine whether to allow or to disallow an internal host and an external host to establish a connection. It is common practice to combine packet filters and circuit gateways to form a dynamic packet filter (DPF). Application Gateways(ALG) Aka PROXY Servers An Application Level Gateway (ALG) acts as a proxy for internal hosts, processing service requests from external clients. An ALG performs deep inspections on each IP packet (ingress or egress). In particular, an ALG inspects application program formats contained in the packet (e.g., MIME format or SQL format) and examines whether its payload is permitted. Thus, an ALG may be able to detect a computer virus contained in the payload. Because an ALG inspects packet payloads, it may be able to detect malicious code and quarantine suspicious packets, in addition to blocking packets with suspicious IP addresses and TCP ports. On the other hand, an ALG also incurs substantial computation and space overheads. Trusted Systems & Bastion Hosts A Trusted Operating System (TOS) is an operating system that meets a particular set of security requirements. Whether an operating system can be trusted or not depends on several elements. For example, for an operating system on a particular computer to be certified trusted, one needs to validate that, among other things, the following four requirements are satisfied: Its system design contains no defects; Its system software contains no loopholes; Its system is configured properly; and Its system management is appropriate. Bastion Hosts Bastion hosts are computers with strong defence mechanisms. They often serve as host computers for implementing application gateways, circuit gateways, and other types of firewalls. A bastion host is operated on a trusted operating system that must not contain unnecessary functionalities or programs. This measure helps to reduce error probabilities and makes it easier to conduct security checks. Only those network application programs that are necessary, for example, SSH, DNS, SMTP, and authentication programs, are installed on a bastion host. Bastion hosts are also primarily used as controlled ingress points so that the security monitoring can focus more narrowly on actions happening at a single point closely. Common Techniques & Scannings, Packet Capturing Scanning Ports with Nmap Nmap (\"Network Mapper\") is a free and open-source (license) utility for network discovery and security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. The best thing about Nmap is it\u2019s free and open-source and is very flexible and versatile Nmap is often used to determine alive hosts in a network, open ports on those hosts, services running on those open ports, and version identification of that service on that port. More at http://scanme.nmap.org/ nmap [scan type] [options] [target specification] Nmap uses 6 different port states: Open \u2014 An open port is one that is actively accepting TCP, UDP or SCTP connections. Open ports are what interests us the most because they are the ones that are vulnerable to attacks. Open ports also show the available services on a network. Closed \u2014 A port that receives and responds to Nmap probe packets but there is no application listening on that port. Useful for identifying that the host exists and for OS detection. Filtered \u2014 Nmap can\u2019t determine whether the port is open because packet filtering prevents its probes from reaching the port. Filtering could come from firewalls or router rules. Often little information is given from filtered ports during scans as the filters can drop the probes without responding or respond with useless error messages e.g. destination unreachable. Unfiltered \u2014 Port is accessible but Nmap doesn\u2019t know if it is open or closed. Only used in ACK scan which is used to map firewall rulesets. Other scan types can be used to identify whether the port is open. Open/filtered \u2014 Nmap is unable to determine between open and filtered. This happens when an open port gives no response. No response could mean that the probe was dropped by a packet filter or any response is blocked. Closed/filtered \u2014 Nmap is unable to determine whether a port is closed or filtered. Only used in the IP ID idle scan. Types of Nmap Scan: TCP Connect TCP Connect scan completes the 3-way handshake. If a port is open, the operating system completes the TCP three-way handshake and the port scanner immediately closes the connection to avoid DOS. This is \u201cnoisy\u201d because the services can log the sender IP address and might trigger Intrusion Detection Systems. UDP Scan This scan checks to see if any UDP ports are listening. Since UDP does not respond with a positive acknowledgement like TCP and only responds to an incoming UDP packet when the port is closed, SYN Scan SYN scan is another form of TCP scanning. This scan type is also known as \u201chalf-open scanning\u201d because it never actually opens a full TCP connection. The port scanner generates a SYN packet. If the target port is open, it will respond with an SYN-ACK packet. The scanner host responds with an RST packet, closing the connection before the handshake is completed. If the port is closed but unfiltered, the target will instantly respond with an RST packet. SYN scan has the advantage that the individual services never actually receive a connection. FIN Scan This is a stealthy scan, like the SYN scan, but sends a TCP FIN packet instead. ACK Scan Ack scanning determines whether the port is filtered or not. Null Scan Another very stealthy scan that sets all the TCP header flags to off or null. This is not normally a valid packet and some hosts will not know what to do with this. XMAS Scan Similar to the NULL scan except for all the flags in the TCP header is set to on RPC Scan This special type of scan looks for machine answering to RPC (Remote Procedure Call) services IDLE Scan It is a super stealthy method whereby the scan packets are bounced off an external host. You don\u2019t need to have control over the other host but it does have to set up and meet certain requirements. You must input the IP address of our \u201czombie\u201d host and what port number to use. It is one of the more controversial options in Nmap since it only has a use for malicious attacks. Scan Techniques A couple of scan techniques which can be used to gain more information about a system and its ports. You can read more at https://medium.com/infosec-adventures/nmap-cheatsheet-a423fcdda0ca OpenVAS OpenVAS is a full-featured vulnerability scanner. OpenVAS is a framework of services and tools that provides a comprehensive and powerful vulnerability scanning and management package OpenVAS, which is an open-source program, began as a fork of the once-more-popular scanning program, Nessus. OpenVAS is made up of three main parts. These are: a regularly updated feed of Network Vulnerability Tests (NVTs); a scanner, which runs the NVTs; and an SQLite 3 database for storing both your test configurations and the NVTs\u2019 results and configurations. https://www.greenbone.net/en/install_use_gce/ WireShark Wireshark is a protocol analyzer. This means Wireshark is designed to decode not only packet bits and bytes but also the relations between packets and protocols. Wireshark understands protocol sequences. A simple demo of Wireshark Capture only udp packets: Capture filter = \u201cudp\u201d Capture only tcp packets Capture filter = \u201ctcp\u201d TCP/IP 3 way Handshake Filter by IP address: displays all traffic from IP, be it source or destination ip.addr == 192.168.1.1 Filter by source address: display traffic only from IP source ip.src == 192.168.0.1 Filter by destination: display traffic only form IP destination ip.dst == 192.168.0.1 Filter by IP subnet: display traffic from subnet, be it source or destination ip.addr = 192.168.0.1/24 Filter by protocol: filter traffic by protocol name dns http ftp arp ssh telnet icmp Exclude IP address: remove traffic from and to IP address !ip.addr ==192.168.0.1 Display traffic between two specific subnet ip.addr == 192.168.0.1/24 and ip.addr == 192.168.1.1/24 Display traffic between two specific workstations ip.addr == 192.168.0.1 and ip.addr == 192.168.0.2 Filter by MAC eth.addr = 00:50:7f:c5:b6:78 Filter TCP port tcp.port == 80 Filter TCP port source tcp.srcport == 80 Filter TCP port destination tcp.dstport == 80 Find user agents http.user_agent contains Firefox !http.user_agent contains || !http.user_agent contains Chrome Filter broadcast traffic !(arp or icmp or dns) Filter IP address and port tcp.port == 80 && ip.addr == 192.168.0.1 Filter all http get requests http.request Filter all http get requests and responses http.request or http.response Filter three way handshake tcp.flags.syn==1 or (tcp.seq==1 and tcp.ack==1 and tcp.len==0 and tcp.analysis.initial_rtt) Find files by type frame contains \u201c(attachment|tar|exe|zip|pdf)\u201d Find traffic based on keyword tcp contains facebook frame contains facebook Detecting SYN Floods tcp.flags.syn == 1 and tcp.flags.ack == 0 Wireshark Promiscuous Mode - By default, Wireshark only captures packets going to and from the computer where it runs. By checking the box to run Wireshark in Promiscuous Mode in the Capture Settings, you can capture most of the traffic on the LAN. DumpCap Dumpcap is a network traffic dump tool. It captures packet data from a live network and writes the packets to a file. Dumpcap\u2019s native capture file format is pcapng, which is also the format used by Wireshark. By default, Dumpcap uses the pcap library to capture traffic from the first available network interface and writes the received raw packet data, along with the packets\u2019 time stamps into a pcapng file. The capture filter syntax follows the rules of the pcap library. The Wireshark command-line utility called 'dumpcap.exe' can be used to capture LAN traffic over an extended period of time. Wireshark itself can also be used, but dumpcap does not significantly utilize the computer's memory while capturing for long periods. DaemonLogger Daemonlogger is a packet logging application designed specifically for use in Network and Systems Management (NSM) environments. The biggest benefit Daemonlogger provides is that, like Dumpcap, it is simple to use for capturing packets. In order to begin capturing, you need only to invoke the command and specify an interface. daemonlogger \u2013i eth1 This option, by default, will begin capturing packets and logging them to the current working directory. Packets will be collected until the capture file size reaches 2 GB, and then a new file will be created. This will continue indefinitely until the process is halted. NetSniff-NG Netsniff-NG is a high-performance packet capture utility While the utilities we\u2019ve discussed to this point rely on Libpcap for capture, Netsniff-NG utilizes zero-copy mechanisms to capture packets. This is done with the intent to support full packet capture over high throughput links. To begin capturing packets with Netsniff-NG, we have to specify an input and output. In most cases, the input will be a network interface, and the output will be a file or folder on disk. netsniff-ng \u2013i eth1 \u2013o data.pcap Netflow NetFlow is a feature that was introduced on Cisco routers around 1996 that provides the ability to collect IP network traffic as it enters or exits an interface. By analyzing the data provided by NetFlow, a network administrator can determine things such as the source and destination of traffic, class of service, and the causes of congestion. A typical flow monitoring setup (using NetFlow) consists of three main components:[1] Flow exporter: aggregates packets into flows and exports flow records towards one or more flow collectors. Flow collector: responsible for reception, storage and pre-processing of flow data received from a flow exporter. Analysis application: analyzes received flow data in the context of intrusion detection or traffic profiling, for example. Routers and switches that support NetFlow can collect IP traffic statistics on all interfaces where NetFlow is enabled, and later export those statistics as NetFlow records toward at least one NetFlow collector\u2014typically a server that does the actual traffic analysis. IDS A security solution that detects security-related events in your environment but does not block them. IDS sensors can be software and hardware-based used to collect and analyze the network traffic. These sensors are available in two varieties, network IDS and host IDS. A host IDS is a server-specific agent running on a server with a minimum of overhead to monitor the operating system. A network IDS can be embedded in a networking device, a standalone appliance, or a module monitoring the network traffic. Signature Based IDS The signature-based IDS monitors the network traffic or observes the system and sends an alarm if a known malicious event is happening. It does so by comparing the data flow against a database of known attack patterns These signatures explicitly define what traffic or activity should be considered as malicious. Signature-based detection has been the bread and butter of network-based defensive security for over a decade, partially because it is very similar to how malicious activity is detected at the host level with antivirus utilities The formula is fairly simple: an analyst observes a malicious activity, derives indicators from the activity and develops them into signatures, and then those signatures will alert whenever the activity occurs again. ex: SNORT & SURICATA Policy-Based IDS The policy-based IDSs (mainly host IDSs) trigger an alarm whenever a violation occurs against the configured policy. This configured policy is or should be a representation of the security policies. This type of IDS is flexible and can be customized to a company's network requirements because it knows exactly what is permitted and what is not. On the other hand, the signature-based systems rely on vendor specifics and default settings. Anomaly Based IDS The anomaly-based IDS looks for traffic that deviates from the normal, but the definition of what is a normal network traffic pattern is the tricky part Two types of anomaly-based IDS exist: statistical and nonstatistical anomaly detection Statistical anomaly detection learns the traffic patterns interactively over a period of time. In the nonstatistical approach, the IDS has a predefined configuration of the supposedly acceptable and valid traffic patterns. Host-Based IDS & Network-Based IDS A host IDS can be described as a distributed agent residing on each server of the network that needs protection. These distributed agents are tied very closely to the underlying operating system. Network IDSs, on the other hand, can be described as intelligent sniffing devices. Data (raw packets) is captured from the network by a network IDS, whereas host IDSs capture the data from the host on which they are installed. Honeypots The use of decoy machines to direct intruders' attention away from the machines under protection is a major technique to preclude intrusion attacks. Any device, system, directory, or file used as a decoy to lure attackers away from important assets and to collect intrusion or abusive behaviours is referred to as a honeypot. A honeypot may be implemented as a physical device or as an emulation system. The idea is to set up decoy machines in a LAN, or decoy directories/files in a file system and make them appear important, but with several exploitable loopholes, to lure attackers to attack these machines or directories/files, so that other machines, directories, and files can evade intruders' attentions. A decoy machine may be a host computer or a server computer. Likewise, we may also set up decoy routers or even decoy LANs. Chinks In The Armour (TCP/IP Security Issues) IP Spoofing In this type of attack, the attacker replaces the IP address of the sender, or in some rare cases the destination, with a different address. IP spoofing is normally used to exploit a target host. In other cases, it is used to start a denial-of-service (DoS) attack. In a DoS attack, an attacker modifies the IP packet to mislead the target host into accepting the original packet as a packet sourced at a trusted host. The attacker must know the IP address of the trusted host to modify the packet headers (source IP address) so that it appears that the packets are coming from that host. IP Spoofing Detection Techniques Direct TTL Probes In this technique we send a packet to a host of suspect spoofed IP that triggers reply and compares TTL with suspect packet; if the TTL in the reply is not the same as the packet being checked; it is a spoofed packet. This Technique is successful when the attacker is in a different subnet from the victim. IP Identification Number. Send a probe to the host of suspect spoofed traffic that triggers a reply and compares IP ID with suspect traffic. If IP IDs are not in the near value of packet being checked, suspect traffic is spoofed TCP Flow Control Method Attackers sending spoofed TCP packets will not receive the target\u2019s SYN-ACK packets. Attackers cannot, therefore, be responsive to change in the congestion window size When the receiver still receives traffic even after a windows size is exhausted, most probably the packets are spoofed. Covert Channel A covert or clandestine channel can be best described as a pipe or communication channel between two entities that can be exploited by a process or application transferring information in a manner that violates the system's security specifications. More specifically for TCP/IP, in some instances, covert channels are established, and data can be secretly passed between two end systems. Ex: ICMP resides at the Internet layer of the TCP/IP protocol suite and is implemented in all TCP/IP hosts. Based on the specifications of the ICMP Protocol, an ICMP Echo Request message should have an 8-byte header and a 56-byte payload. The ICMP Echo Request packet should not carry any data in the payload. However, these packets are often used to carry secret information. The ICMP packets are altered slightly to carry secret data in the payload. This makes the size of the packet larger, but no control exists in the protocol stack to defeat this behaviour. The alteration of ICMP packets allows intruders to program specialized client-server pairs. These small pieces of code export confidential information without alerting the network administrator. ICMP can be leveraged for more than data exfiltration. For eg. some C&C tools such as Loki used ICMP channel to establish encrypted interactive session back in 1996. Deep packet inspection has since come a long way. A lot of IDS/IPS detect ICMP tunnelling. Check for echo responses that do not contain the same payload as request Check for the volume of ICMP traffic especially for volumes beyond an acceptable threshold IP Fragmentation Attack The TCP/IP protocol suite, or more specifically IP, allows the fragmentation of packets.(this is a feature & not a bug) IP fragmentation offset is used to keep track of the different parts of a datagram. The information or content in this field is used at the destination to reassemble the datagrams All such fragments have the same Identification field value, and the fragmentation offset indicates the position of the current fragment in the context of the original packet. Many access routers and firewalls do not perform packet reassembly. In normal operation, IP fragments do not overlap, but attackers can create artificially fragmented packets to mislead the routers or firewalls. Usually, these packets are small and almost impractical for end systems because of data and computational overhead. A good example of an IP fragmentation attack is the Ping of Death attack. The Ping of Death attack sends fragments that, when reassembled at the end station, create a larger packet than the maximum permissible length. TCP Flags Data exchange using TCP does not happen until a three-way handshake has been completed. This handshake uses different flags to influence the way TCP segments are processed. There are 6 bits in the TCP header that are often called flags. Namely: 6 different flags are part of the TCP header: Urgent pointer field (URG), Acknowledgment field (ACK), Push function (PSH), Reset the connection (RST), Synchronize sequence numbers (SYN), and the sender is finished with this connection (FIN). Abuse of the normal operation or settings of these flags can be used by attackers to launch DoS attacks. This causes network servers or web servers to crash or hang. | SYN | FIN | PSH | RST | Validity| |------|------|-------|------|---------| | 1 |1 |0 |0 |Illegal Combination | 1 |1 |1 |0 |Illegal Combination | 1 |1 |0 |1 |Illegal Combination | 1 |1 |1 |1 |Illegal Combination The attacker's ultimate goal is to write special programs or pieces of code that can construct these illegal combinations resulting in an efficient DoS attack. SYN FLOOD The timers (or lack of certain timers) in 3 way handshake are often used and exploited by attackers to disable services or even to enter systems. After step 2 of the three-way handshake, no limit is set on the time to wait after receiving a SYN. The attacker initiates many connection requests to the webserver of Company XYZ (almost certainly with a spoofed IP address). The SYN+ACK packets (Step 2) sent by the web server back to the originating source IP address are not replied to. This leaves a TCP session half-open on the webserver. Multiple packets cause multiple TCP sessions to stay open. Based on the hardware limitations of the server, a limited number of TCP sessions can stay open, and as a result, the webserver refuses further connection establishments attempts from any host as soon as a certain limit is reached. These half-open connections need to be completed or timed out before new connections can be established. FIN Attack In normal operation, the sender sets the TCP FIN flag indicating that no more data will be transmitted and the connection can be closed down. This is a four-way handshake mechanism, with both sender and receiver expected to send an acknowledgement on a received FIN packet. During an attack that is trying to kill connections, a spoofed FIN packet is constructed. This packet also has the correct sequence number, so the packets are seen as valid by the targeted host. These sequence numbers are easy to predict. This process is referred to as TCP sequence number prediction, whereby the attacker either sniffs the current Sequence and Acknowledgment (SEQ/ACK) numbers of the connection or can algorithmically predict these numbers. Connection Hijacking An authorized user (Employee X) sends HTTP requests over a TCP session with the webserver. The web server accepts the packets from Employee X only when the packet has the correct SEQ/ACK numbers. As seen previously, these numbers are important for the webserver to distinguish between different sessions and to make sure it is still talking to Employee X. Imagine that the cracker starts sending packets to the web server spoofing the IP address of Employee X, using the correct SEQ/ACK combination. The web server accepts the packet and increments the ACK number. In the meantime, Employee X continues to send packets but with incorrect SEQ/ACK numbers. As a result of sending unsynchronized packets, all data from Employee X is discarded when received by the webserver. The attacker pretends to be Employee X using the correct numbers. This finally results in the cracker hijacking the connection, whereby Employee X is completely confused and the webserver replies assuming the cracker is sending correct synchronized data. STEPS: The attacker examines the traffic flows with a network monitor and notices traffic from Employee X to a web server. The web server returns or echoes data back to the origination station (Employee X). Employee X acknowledges the packet. The cracker launches a spoofed packet to the server. The web server responds to the cracker. The cracker starts verifying SEQ/ACK numbers to double-check success. At this time, the cracker takes over the session from Employee X, which results in a session hanging for Employee X. The cracker can start sending traffic to the webserver. The web server returns the requested data to confirm delivery with the correct ACK number. The cracker can continue to send data (keeping track of the correct SEQ/ACK numbers) until eventually setting the FIN flag to terminate the session. Buffer Overflow A buffer is a temporary data storage area used to store program code and data. When a program or process tries to store more data in a buffer than it was originally anticipated to hold, a buffer overflow occurs. Buffers are temporary storage locations in memory (memory or buffer sizes are often measured in bytes) that can store a fixed amount of data in bytes. When more data is retrieved than can be stored in a buffer location, the additional information must go into an adjacent buffer, resulting in overwriting the valid data held in them. Mechanism: Buffer overflow vulnerabilities exist in different types. But the overall goal for all buffer overflow attacks is to take over the control of a privileged program and, if possible, the host. The attacker has two tasks to achieve this goal. First, the dirty code needs to be available in the program's code address space. Second, the privileged program should jump to that particular part of the code, which ensures that the proper parameters are loaded into memory. The first task can be achieved in two ways: by injecting the code in the right address space or by using the existing code and modifying certain parameters slightly. The second task is a little more complex because the program's control flow needs to be modified to make the program jump to the dirty code. CounterMeasure: The most important approach is to have a concerted focus on writing correct code. A second method is to make the data buffers (memory locations) address space of the program code non-executable. This type of address space makes it impossible to execute code, which might be infiltrated in the program's buffers during an attack. More Spoofing Address Resolution Protocol Spoofing The Address Resolution Protocol (ARP) provides a mechanism to resolve, or map, a known IP address to a MAC sublayer address. Using ARP spoofing, the cracker can exploit this hardware address authentication mechanism by spoofing the hardware address of Host B. Basically, the attacker can convince any host or network device on the local network that the cracker's workstation is the host to be trusted. This is a common method used in a switched environment. ARP spoofing can be prevented with the implementation of static ARP tables in all the hosts and routers of your network. Alternatively, you can implement an ARP server that responds to ARP requests on behalf of the target host. DNS Spoofing DNS spoofing is the method whereby the hacker convinces the target machine that the system it wants to connect to is the machine of the cracker. The cracker modifies some records so that name entries of hosts correspond to the attacker's IP address. There have been instances in which the complete DNS server was compromised by an attack. To counter DNS spoofing, the reverse lookup detects these attacks. The reverse lookup is a mechanism to verify the IP address against a name. The IP address and name files are usually kept on different servers to make compromise much more difficult","title":"Network Security"},{"location":"security/network_security/#part-ii-network-security","text":"","title":"Part II: Network Security"},{"location":"security/network_security/#introduction","text":"TCP/IP is the dominant networking technology today. It is a five-layer architecture. These layers are, from top to bottom, the application layer, the transport layer (TCP), the network layer (IP), the data-link layer, and the physical layer. In addition to TCP/IP, there also are other networking technologies. For convenience, we use the OSI network model to represent non-TCP/IP network technologies. Different networks are interconnected using gateways. A gateway can be placed at any layer. The OSI model is a seven-layer architecture. The OSI architecture is similar to the TCP/IP architecture, except that the OSI model specifies two additional layers between the application layer and the transport layer in the TCP/IP architecture. These two layers are the presentation layer and the session layer. Figure 5.1 shows the relationship between the TCP/IP layers and the OSI layers. The application layer in TCP/IP corresponds to the application layer and the presentation layer in OSI. The transport layer in TCP/IP corresponds to the session layer and the transport layer in OSI. The remaining three layers in the TCP/IP architecture are one-to-one correspondent to the remaining three layers in the OSI model. Correspondence between layers of the TCP/IP architecture and the OSI model. Also shown are placements of cryptographic algorithms in network layers, where the dotted arrows indicate actual communications of cryptographic algorithms The functionalities of OSI layers are briefly described as follows: The application layer serves as an interface between applications and network programs. It supports application programs and end-user processing. Common application-layer programs include remote logins, file transfer, email, and Web browsing. The presentation layer is responsible for dealing with data that is formed differently. This protocol layer allows application-layer programs residing on different sides of a communication channel with different platforms to understand each other's data formats regardless of how they are presented. The session layer is responsible for creating, managing, and closing a communication connection. The transport layer is responsible for providing reliable connections, such as packet sequencing, traffic control, and congestion control. The network layer is responsible for routing device-independent data packets from the current hop to the next hop. The data-link layer is responsible for encapsulating device-independent data packets into device-dependent data frames. It has two sublayers: logical link control and media access control. The physical layer is responsible for transmitting device-dependent frames through some physical media. Starting from the application layer, data generated from an application program is passed down layer-by-layer to the physical layer. Data from the previous layer is enclosed in a new envelope at the current layer, where the data from the previous layer is also just an envelope containing the data from the layer before it. This is similar to enclosing a smaller envelope in a larger one. The envelope added at each layer contains sufficient information for handling the packet. Application-layer data are divided into blocks small enough to be encapsulated in an envelope at the next layer. Application data blocks are \u201cdressed up\u201d in the TCP/IP architecture according to the following basic steps. At the sending side, an application data block is encapsulated in a TCP packet when it is passed down to the TCP layer. In other words, a TCP packet consists of a header and a payload, where the header corresponds to the TCP envelope and the payload is the application data block. Likewise, the TCP packet will be encapsulated in an IP packet when it is passed down to the IP layer. An IP packet consists of a header and a payload, which is the TCP packet passed down from the TCP layer. The IP packet will be encapsulated in a device-dependent frame (e.g., an Ethernet frame) when it is passed down to the data-link layer. A frame has a header, and it may also have a trailer. For example, in addition to having a header, an Ethernet frame also has a 32-bit cyclic redundancy check (CRC) trailer. When it is passed down to the physical layer, a frame will be transformed into a sequence of media signals for transmission Flow Diagram of a Packet Generation At the destination side, the medium signals are converted by the physical layer into a frame, which is passed up to the data-link layer. The data-link layer passes the frame payload (i.e., the IP packet encapsulated in the frame) up to the IP layer. The IP layer passes the IP payload, namely, the TCP packet encapsulated in the IP packet, up to the TCP layer. The TCP layer passes the TCP payload, namely, the application data block, up to the application layer. When a packet arrives at a router, it only goes up to the IP layer, where certain fields in the IP header are modified (e.g., the value of TTL is decreased by 1). This modified packet is then passed back down layer-by-layer to the physical layer for further transmission.","title":"Introduction"},{"location":"security/network_security/#public-key-infrastructure","text":"To deploy cryptographic algorithms in network applications, we need a way to distribute secret keys using open networks. Public-key cryptography is the best way to distribute these secret keys. To use public-key cryptography, we need to build a public-key infrastructure (PKI) to support and manage public-key certificates and certificate authority (CA) networks. In particular, PKIs are set up to perform the following functions: Determine the legitimacy of users before issuing public-key certificates to them. Issue public-key certificates upon user requests. Extend public-key certificates valid time upon user requests. Revoke public-key certificates upon users' requests or when the corresponding private keys are compromised. Store and manage public-key certificates. Prevent digital signature signers from denying their signatures. Support CA networks to allow different CAs to authenticate public-key certificates issued by other CAs. X.509: https://certificatedecoder.dev/?gclid=EAIaIQobChMI0M731O6G6gIVVSQrCh04bQaAEAAYASAAEgKRkPD_BwE","title":"Public Key Infrastructure"},{"location":"security/network_security/#ipsec-a-security-protocol-at-the-network-layer","text":"IPsec is a major security protocol at the network layer IPsec provides a potent platform for constructing virtual private networks (VPN). VPNs are private networks overlayed on public networks. The purpose of deploying cryptographic algorithms at the network layer is to encrypt or authenticate IP packets (either just the payloads or the whole packets). IPsec also specifies how to exchange keys. Thus, IPsec consists of authentication protocols, encryption protocols, and key exchange protocols. They are referred to, respectively, as authentication header (AH), encapsulating security payload (ESP), and Internet key exchange (IKE).","title":"IPsec: A Security Protocol at the Network Layer"},{"location":"security/network_security/#pgp-smime-email-security","text":"There are several security protocols at the application layer. The most used of these protocols are email security protocols namely PGP and S/MIME. SMTP (\u201cSimple Mail Transfer Protocol\u201d) is used for sending and delivering from a client to a server via port 25: it\u2019s the outgoing server. On the contrary, POP (\u201cPost Office Protocol\u201d) allows the users to pick up the message and download it into their inbox: it\u2019s the incoming server. The latest version of the Post Office Protocol is named POP3, and it\u2019s been used since 1996; it uses port 110 PGP PGP implements all major cryptographic algorithms, the ZIP compression algorithm, and the Base64 encoding algorithm. It can be used to authenticate a message, encrypt a message, or both. PGP follows the following general process: authentication, ZIP compression, encryption, and Base64 encoding. The Base64 encoding procedure makes the message ready for SMTP transmission GPG (GnuPG) GnuPG is another free encryption standard that companies may use that is based on OpenPGP. GnuPG serves as a replacement for Symantec\u2019s PGP. The main difference is the supported algorithms. However, GnuPG plays nice with PGP by design. Because GnuPG is open, some businesses would prefer the technical support and the user interface that comes with Symantec\u2019s PGP. It is important to note that there are some nuances between the compatibility of GnuPG and PGP, such as the compatibility between certain algorithms, but in most applications such as email, there are workarounds. One such algorithm is the IDEA Module which isn\u2019t included in GnuPG out of the box due to patent issues. S/MIME SMTP can only handle 7-bit ASCII text (You can use UTF-8 extensions to alleviate these limitations, ) messages. While POP can handle other content types besides 7-bit ASCII, POP may, under a common default setting, download all the messages stored in the mail server to the user's local computer. After that, if POP removes these messages from the mail server. This makes it difficult for the users to read their messages from multiple computers. The Multipurpose Internet Mail Extension protocol (MIME) was designed to support sending and receiving email messages in various formats, including nontext files generated by word processors, graphics files, sound files, and video clips. Moreover, MIME allows a single message to include mixed types of data in any combination of these formats. The Internet Mail Access Protocol (IMAP), operated on TCP port 143(only for non-encrypted), stores (Configurable on both server & client just like PoP) incoming email messages in the mail server until the user deletes them deliberately. This allows the users to access their mailbox from multiple machines and download messages to a local machine without deleting it from the mailbox in the mail server. SSL/TLS SSL uses a PKI to decide if a server\u2019s public key is trustworthy by requiring servers to use a security certificate signed by a trusted CA. When Netscape Navigator 1.0 was released, it trusted a single CA operated by the RSA Data Security corporation. The server\u2019s public RSA keys were used to be stored in the security certificate, which can then be used by the browser to establish a secure communication channel. The security certificates we use today still rely on the same standard (named X.509) that Netscape Navigator 1.0 used back then. Netscape intended to train users(though this didn\u2019t work out later) to differentiate secure communications from insecure ones, so they put a lock icon next to the address bar. When the lock is open, the communication is insecure. A closed lock means communication has been secured with SSL, which required the server to provide a signed certificate. You\u2019re obviously familiar with this icon as it\u2019s been in every browser ever since. The engineers at Netscape truly created a standard for secure internet communications. A year after releasing SSL 2.0, Netscape fixed several security issues and released SSL 3.0, a protocol that, albeit being officially deprecated since June 2015, remains in use in certain parts of the world more than 20 years after its introduction. To standardize SSL, the Internet Engineering Task Force (IETF) created a slightly modified SSL 3.0 and, in 1999, unveiled it as Transport Layer Security (TLS) 1.0. The name change between SSL and TLS continues to confuse people today. Officially, TLS is the new SSL, but in practice, people use SSL and TLS interchangeably to talk about any version of the protocol. Must See: https://tls.ulfheim.net/ https://davidwong.fr/tls13/","title":"PGP &amp; S/MIME : Email Security"},{"location":"security/network_security/#network-perimeter-security","text":"Let us see how we keep a check on the perimeter i.e the edges, the first layer of protection","title":"Network  Perimeter Security"},{"location":"security/network_security/#general-firewall-framework","text":"Firewalls are needed because encryption algorithms cannot effectively stop malicious packets from getting into an edge network. This is because IP packets, regardless of whether they are encrypted, can always be forwarded into an edge network. Firewalls that were developed in the 1990s are important instruments to help restrict network access. A firewall may be a hardware device, a software package, or a combination of both. Packets flowing into the internal network from the outside should be evaluated before they are allowed to enter. One of the critical elements of a firewall is its ability to examine packets without imposing a negative impact on communication speed while providing security protections for the internal network. The packet inspection that is carried out by firewalls can be done using several different methods. Based on the particular method used by the firewall, it can be characterized as either a packet filter, circuit gateway, application gateway, or dynamic packet filter.","title":"General Firewall Framework"},{"location":"security/network_security/#packet-filters","text":"It inspects ingress packets coming to an internal network from outside and inspects egress packets going outside from an internal network Packing filtering only inspects IP headers and TCP headers, not the payloads generated at the application layer A packet-filtering firewall uses a set of rules to determine whether a packet should be allowed or denied to pass through. 2 types: Stateless It treats each packet as an independent object, and it does not keep track of any previously processed packets. In other words, stateless filtering inspects a packet when it arrives and makes a decision without leaving any record of the packet being inspected. Stateful Stateful filtering, also referred to as connection-state filtering, keeps track of connections between an internal host and an external host. A connection state (or state, for short) indicates whether it is a TCP connection or a UDP connection and whether the connection is established.","title":"Packet Filters"},{"location":"security/network_security/#circuit-gateways","text":"Circuit gateways, also referred to as circuit-level gateways, are typically operated at the transportation layer They evaluate the information of the IP addresses and the port numbers contained in TCP (or UDP) headers and use it to determine whether to allow or to disallow an internal host and an external host to establish a connection. It is common practice to combine packet filters and circuit gateways to form a dynamic packet filter (DPF).","title":"Circuit Gateways"},{"location":"security/network_security/#application-gatewaysalg","text":"Aka PROXY Servers An Application Level Gateway (ALG) acts as a proxy for internal hosts, processing service requests from external clients. An ALG performs deep inspections on each IP packet (ingress or egress). In particular, an ALG inspects application program formats contained in the packet (e.g., MIME format or SQL format) and examines whether its payload is permitted. Thus, an ALG may be able to detect a computer virus contained in the payload. Because an ALG inspects packet payloads, it may be able to detect malicious code and quarantine suspicious packets, in addition to blocking packets with suspicious IP addresses and TCP ports. On the other hand, an ALG also incurs substantial computation and space overheads.","title":"Application Gateways(ALG)"},{"location":"security/network_security/#trusted-systems-bastion-hosts","text":"A Trusted Operating System (TOS) is an operating system that meets a particular set of security requirements. Whether an operating system can be trusted or not depends on several elements. For example, for an operating system on a particular computer to be certified trusted, one needs to validate that, among other things, the following four requirements are satisfied: Its system design contains no defects; Its system software contains no loopholes; Its system is configured properly; and Its system management is appropriate. Bastion Hosts Bastion hosts are computers with strong defence mechanisms. They often serve as host computers for implementing application gateways, circuit gateways, and other types of firewalls. A bastion host is operated on a trusted operating system that must not contain unnecessary functionalities or programs. This measure helps to reduce error probabilities and makes it easier to conduct security checks. Only those network application programs that are necessary, for example, SSH, DNS, SMTP, and authentication programs, are installed on a bastion host. Bastion hosts are also primarily used as controlled ingress points so that the security monitoring can focus more narrowly on actions happening at a single point closely.","title":"Trusted Systems &amp; Bastion Hosts"},{"location":"security/network_security/#common-techniques-scannings-packet-capturing","text":"","title":"Common Techniques &amp; Scannings, Packet Capturing"},{"location":"security/network_security/#scanning-ports-with-nmap","text":"Nmap (\"Network Mapper\") is a free and open-source (license) utility for network discovery and security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. The best thing about Nmap is it\u2019s free and open-source and is very flexible and versatile Nmap is often used to determine alive hosts in a network, open ports on those hosts, services running on those open ports, and version identification of that service on that port. More at http://scanme.nmap.org/ nmap [scan type] [options] [target specification] Nmap uses 6 different port states: Open \u2014 An open port is one that is actively accepting TCP, UDP or SCTP connections. Open ports are what interests us the most because they are the ones that are vulnerable to attacks. Open ports also show the available services on a network. Closed \u2014 A port that receives and responds to Nmap probe packets but there is no application listening on that port. Useful for identifying that the host exists and for OS detection. Filtered \u2014 Nmap can\u2019t determine whether the port is open because packet filtering prevents its probes from reaching the port. Filtering could come from firewalls or router rules. Often little information is given from filtered ports during scans as the filters can drop the probes without responding or respond with useless error messages e.g. destination unreachable. Unfiltered \u2014 Port is accessible but Nmap doesn\u2019t know if it is open or closed. Only used in ACK scan which is used to map firewall rulesets. Other scan types can be used to identify whether the port is open. Open/filtered \u2014 Nmap is unable to determine between open and filtered. This happens when an open port gives no response. No response could mean that the probe was dropped by a packet filter or any response is blocked. Closed/filtered \u2014 Nmap is unable to determine whether a port is closed or filtered. Only used in the IP ID idle scan.","title":"Scanning Ports with Nmap"},{"location":"security/network_security/#types-of-nmap-scan","text":"TCP Connect TCP Connect scan completes the 3-way handshake. If a port is open, the operating system completes the TCP three-way handshake and the port scanner immediately closes the connection to avoid DOS. This is \u201cnoisy\u201d because the services can log the sender IP address and might trigger Intrusion Detection Systems. UDP Scan This scan checks to see if any UDP ports are listening. Since UDP does not respond with a positive acknowledgement like TCP and only responds to an incoming UDP packet when the port is closed, SYN Scan SYN scan is another form of TCP scanning. This scan type is also known as \u201chalf-open scanning\u201d because it never actually opens a full TCP connection. The port scanner generates a SYN packet. If the target port is open, it will respond with an SYN-ACK packet. The scanner host responds with an RST packet, closing the connection before the handshake is completed. If the port is closed but unfiltered, the target will instantly respond with an RST packet. SYN scan has the advantage that the individual services never actually receive a connection. FIN Scan This is a stealthy scan, like the SYN scan, but sends a TCP FIN packet instead. ACK Scan Ack scanning determines whether the port is filtered or not. Null Scan Another very stealthy scan that sets all the TCP header flags to off or null. This is not normally a valid packet and some hosts will not know what to do with this. XMAS Scan Similar to the NULL scan except for all the flags in the TCP header is set to on RPC Scan This special type of scan looks for machine answering to RPC (Remote Procedure Call) services IDLE Scan It is a super stealthy method whereby the scan packets are bounced off an external host. You don\u2019t need to have control over the other host but it does have to set up and meet certain requirements. You must input the IP address of our \u201czombie\u201d host and what port number to use. It is one of the more controversial options in Nmap since it only has a use for malicious attacks. Scan Techniques A couple of scan techniques which can be used to gain more information about a system and its ports. You can read more at https://medium.com/infosec-adventures/nmap-cheatsheet-a423fcdda0ca","title":"Types of Nmap Scan:"},{"location":"security/network_security/#openvas","text":"OpenVAS is a full-featured vulnerability scanner. OpenVAS is a framework of services and tools that provides a comprehensive and powerful vulnerability scanning and management package OpenVAS, which is an open-source program, began as a fork of the once-more-popular scanning program, Nessus. OpenVAS is made up of three main parts. These are: a regularly updated feed of Network Vulnerability Tests (NVTs); a scanner, which runs the NVTs; and an SQLite 3 database for storing both your test configurations and the NVTs\u2019 results and configurations. https://www.greenbone.net/en/install_use_gce/","title":"OpenVAS"},{"location":"security/network_security/#wireshark","text":"Wireshark is a protocol analyzer. This means Wireshark is designed to decode not only packet bits and bytes but also the relations between packets and protocols. Wireshark understands protocol sequences. A simple demo of Wireshark Capture only udp packets: Capture filter = \u201cudp\u201d Capture only tcp packets Capture filter = \u201ctcp\u201d TCP/IP 3 way Handshake Filter by IP address: displays all traffic from IP, be it source or destination ip.addr == 192.168.1.1 Filter by source address: display traffic only from IP source ip.src == 192.168.0.1 Filter by destination: display traffic only form IP destination ip.dst == 192.168.0.1 Filter by IP subnet: display traffic from subnet, be it source or destination ip.addr = 192.168.0.1/24 Filter by protocol: filter traffic by protocol name dns http ftp arp ssh telnet icmp Exclude IP address: remove traffic from and to IP address !ip.addr ==192.168.0.1 Display traffic between two specific subnet ip.addr == 192.168.0.1/24 and ip.addr == 192.168.1.1/24 Display traffic between two specific workstations ip.addr == 192.168.0.1 and ip.addr == 192.168.0.2 Filter by MAC eth.addr = 00:50:7f:c5:b6:78 Filter TCP port tcp.port == 80 Filter TCP port source tcp.srcport == 80 Filter TCP port destination tcp.dstport == 80 Find user agents http.user_agent contains Firefox !http.user_agent contains || !http.user_agent contains Chrome Filter broadcast traffic !(arp or icmp or dns) Filter IP address and port tcp.port == 80 && ip.addr == 192.168.0.1 Filter all http get requests http.request Filter all http get requests and responses http.request or http.response Filter three way handshake tcp.flags.syn==1 or (tcp.seq==1 and tcp.ack==1 and tcp.len==0 and tcp.analysis.initial_rtt) Find files by type frame contains \u201c(attachment|tar|exe|zip|pdf)\u201d Find traffic based on keyword tcp contains facebook frame contains facebook Detecting SYN Floods tcp.flags.syn == 1 and tcp.flags.ack == 0 Wireshark Promiscuous Mode - By default, Wireshark only captures packets going to and from the computer where it runs. By checking the box to run Wireshark in Promiscuous Mode in the Capture Settings, you can capture most of the traffic on the LAN.","title":"WireShark"},{"location":"security/network_security/#dumpcap","text":"Dumpcap is a network traffic dump tool. It captures packet data from a live network and writes the packets to a file. Dumpcap\u2019s native capture file format is pcapng, which is also the format used by Wireshark. By default, Dumpcap uses the pcap library to capture traffic from the first available network interface and writes the received raw packet data, along with the packets\u2019 time stamps into a pcapng file. The capture filter syntax follows the rules of the pcap library. The Wireshark command-line utility called 'dumpcap.exe' can be used to capture LAN traffic over an extended period of time. Wireshark itself can also be used, but dumpcap does not significantly utilize the computer's memory while capturing for long periods.","title":"DumpCap"},{"location":"security/network_security/#daemonlogger","text":"Daemonlogger is a packet logging application designed specifically for use in Network and Systems Management (NSM) environments. The biggest benefit Daemonlogger provides is that, like Dumpcap, it is simple to use for capturing packets. In order to begin capturing, you need only to invoke the command and specify an interface. daemonlogger \u2013i eth1 This option, by default, will begin capturing packets and logging them to the current working directory. Packets will be collected until the capture file size reaches 2 GB, and then a new file will be created. This will continue indefinitely until the process is halted.","title":"DaemonLogger"},{"location":"security/network_security/#netsniff-ng","text":"Netsniff-NG is a high-performance packet capture utility While the utilities we\u2019ve discussed to this point rely on Libpcap for capture, Netsniff-NG utilizes zero-copy mechanisms to capture packets. This is done with the intent to support full packet capture over high throughput links. To begin capturing packets with Netsniff-NG, we have to specify an input and output. In most cases, the input will be a network interface, and the output will be a file or folder on disk. netsniff-ng \u2013i eth1 \u2013o data.pcap","title":"NetSniff-NG"},{"location":"security/network_security/#netflow","text":"NetFlow is a feature that was introduced on Cisco routers around 1996 that provides the ability to collect IP network traffic as it enters or exits an interface. By analyzing the data provided by NetFlow, a network administrator can determine things such as the source and destination of traffic, class of service, and the causes of congestion. A typical flow monitoring setup (using NetFlow) consists of three main components:[1] Flow exporter: aggregates packets into flows and exports flow records towards one or more flow collectors. Flow collector: responsible for reception, storage and pre-processing of flow data received from a flow exporter. Analysis application: analyzes received flow data in the context of intrusion detection or traffic profiling, for example. Routers and switches that support NetFlow can collect IP traffic statistics on all interfaces where NetFlow is enabled, and later export those statistics as NetFlow records toward at least one NetFlow collector\u2014typically a server that does the actual traffic analysis.","title":"Netflow"},{"location":"security/network_security/#ids","text":"A security solution that detects security-related events in your environment but does not block them. IDS sensors can be software and hardware-based used to collect and analyze the network traffic. These sensors are available in two varieties, network IDS and host IDS. A host IDS is a server-specific agent running on a server with a minimum of overhead to monitor the operating system. A network IDS can be embedded in a networking device, a standalone appliance, or a module monitoring the network traffic. Signature Based IDS The signature-based IDS monitors the network traffic or observes the system and sends an alarm if a known malicious event is happening. It does so by comparing the data flow against a database of known attack patterns These signatures explicitly define what traffic or activity should be considered as malicious. Signature-based detection has been the bread and butter of network-based defensive security for over a decade, partially because it is very similar to how malicious activity is detected at the host level with antivirus utilities The formula is fairly simple: an analyst observes a malicious activity, derives indicators from the activity and develops them into signatures, and then those signatures will alert whenever the activity occurs again. ex: SNORT & SURICATA Policy-Based IDS The policy-based IDSs (mainly host IDSs) trigger an alarm whenever a violation occurs against the configured policy. This configured policy is or should be a representation of the security policies. This type of IDS is flexible and can be customized to a company's network requirements because it knows exactly what is permitted and what is not. On the other hand, the signature-based systems rely on vendor specifics and default settings. Anomaly Based IDS The anomaly-based IDS looks for traffic that deviates from the normal, but the definition of what is a normal network traffic pattern is the tricky part Two types of anomaly-based IDS exist: statistical and nonstatistical anomaly detection Statistical anomaly detection learns the traffic patterns interactively over a period of time. In the nonstatistical approach, the IDS has a predefined configuration of the supposedly acceptable and valid traffic patterns. Host-Based IDS & Network-Based IDS A host IDS can be described as a distributed agent residing on each server of the network that needs protection. These distributed agents are tied very closely to the underlying operating system. Network IDSs, on the other hand, can be described as intelligent sniffing devices. Data (raw packets) is captured from the network by a network IDS, whereas host IDSs capture the data from the host on which they are installed. Honeypots The use of decoy machines to direct intruders' attention away from the machines under protection is a major technique to preclude intrusion attacks. Any device, system, directory, or file used as a decoy to lure attackers away from important assets and to collect intrusion or abusive behaviours is referred to as a honeypot. A honeypot may be implemented as a physical device or as an emulation system. The idea is to set up decoy machines in a LAN, or decoy directories/files in a file system and make them appear important, but with several exploitable loopholes, to lure attackers to attack these machines or directories/files, so that other machines, directories, and files can evade intruders' attentions. A decoy machine may be a host computer or a server computer. Likewise, we may also set up decoy routers or even decoy LANs.","title":"IDS"},{"location":"security/network_security/#chinks-in-the-armour-tcpip-security-issues","text":"","title":"Chinks In The Armour (TCP/IP Security Issues)"},{"location":"security/network_security/#ip-spoofing","text":"In this type of attack, the attacker replaces the IP address of the sender, or in some rare cases the destination, with a different address. IP spoofing is normally used to exploit a target host. In other cases, it is used to start a denial-of-service (DoS) attack. In a DoS attack, an attacker modifies the IP packet to mislead the target host into accepting the original packet as a packet sourced at a trusted host. The attacker must know the IP address of the trusted host to modify the packet headers (source IP address) so that it appears that the packets are coming from that host. IP Spoofing Detection Techniques Direct TTL Probes In this technique we send a packet to a host of suspect spoofed IP that triggers reply and compares TTL with suspect packet; if the TTL in the reply is not the same as the packet being checked; it is a spoofed packet. This Technique is successful when the attacker is in a different subnet from the victim. IP Identification Number. Send a probe to the host of suspect spoofed traffic that triggers a reply and compares IP ID with suspect traffic. If IP IDs are not in the near value of packet being checked, suspect traffic is spoofed TCP Flow Control Method Attackers sending spoofed TCP packets will not receive the target\u2019s SYN-ACK packets. Attackers cannot, therefore, be responsive to change in the congestion window size When the receiver still receives traffic even after a windows size is exhausted, most probably the packets are spoofed.","title":"IP Spoofing"},{"location":"security/network_security/#covert-channel","text":"A covert or clandestine channel can be best described as a pipe or communication channel between two entities that can be exploited by a process or application transferring information in a manner that violates the system's security specifications. More specifically for TCP/IP, in some instances, covert channels are established, and data can be secretly passed between two end systems. Ex: ICMP resides at the Internet layer of the TCP/IP protocol suite and is implemented in all TCP/IP hosts. Based on the specifications of the ICMP Protocol, an ICMP Echo Request message should have an 8-byte header and a 56-byte payload. The ICMP Echo Request packet should not carry any data in the payload. However, these packets are often used to carry secret information. The ICMP packets are altered slightly to carry secret data in the payload. This makes the size of the packet larger, but no control exists in the protocol stack to defeat this behaviour. The alteration of ICMP packets allows intruders to program specialized client-server pairs. These small pieces of code export confidential information without alerting the network administrator. ICMP can be leveraged for more than data exfiltration. For eg. some C&C tools such as Loki used ICMP channel to establish encrypted interactive session back in 1996. Deep packet inspection has since come a long way. A lot of IDS/IPS detect ICMP tunnelling. Check for echo responses that do not contain the same payload as request Check for the volume of ICMP traffic especially for volumes beyond an acceptable threshold","title":"Covert Channel"},{"location":"security/network_security/#ip-fragmentation-attack","text":"The TCP/IP protocol suite, or more specifically IP, allows the fragmentation of packets.(this is a feature & not a bug) IP fragmentation offset is used to keep track of the different parts of a datagram. The information or content in this field is used at the destination to reassemble the datagrams All such fragments have the same Identification field value, and the fragmentation offset indicates the position of the current fragment in the context of the original packet. Many access routers and firewalls do not perform packet reassembly. In normal operation, IP fragments do not overlap, but attackers can create artificially fragmented packets to mislead the routers or firewalls. Usually, these packets are small and almost impractical for end systems because of data and computational overhead. A good example of an IP fragmentation attack is the Ping of Death attack. The Ping of Death attack sends fragments that, when reassembled at the end station, create a larger packet than the maximum permissible length. TCP Flags Data exchange using TCP does not happen until a three-way handshake has been completed. This handshake uses different flags to influence the way TCP segments are processed. There are 6 bits in the TCP header that are often called flags. Namely: 6 different flags are part of the TCP header: Urgent pointer field (URG), Acknowledgment field (ACK), Push function (PSH), Reset the connection (RST), Synchronize sequence numbers (SYN), and the sender is finished with this connection (FIN). Abuse of the normal operation or settings of these flags can be used by attackers to launch DoS attacks. This causes network servers or web servers to crash or hang. | SYN | FIN | PSH | RST | Validity| |------|------|-------|------|---------| | 1 |1 |0 |0 |Illegal Combination | 1 |1 |1 |0 |Illegal Combination | 1 |1 |0 |1 |Illegal Combination | 1 |1 |1 |1 |Illegal Combination The attacker's ultimate goal is to write special programs or pieces of code that can construct these illegal combinations resulting in an efficient DoS attack. SYN FLOOD The timers (or lack of certain timers) in 3 way handshake are often used and exploited by attackers to disable services or even to enter systems. After step 2 of the three-way handshake, no limit is set on the time to wait after receiving a SYN. The attacker initiates many connection requests to the webserver of Company XYZ (almost certainly with a spoofed IP address). The SYN+ACK packets (Step 2) sent by the web server back to the originating source IP address are not replied to. This leaves a TCP session half-open on the webserver. Multiple packets cause multiple TCP sessions to stay open. Based on the hardware limitations of the server, a limited number of TCP sessions can stay open, and as a result, the webserver refuses further connection establishments attempts from any host as soon as a certain limit is reached. These half-open connections need to be completed or timed out before new connections can be established. FIN Attack In normal operation, the sender sets the TCP FIN flag indicating that no more data will be transmitted and the connection can be closed down. This is a four-way handshake mechanism, with both sender and receiver expected to send an acknowledgement on a received FIN packet. During an attack that is trying to kill connections, a spoofed FIN packet is constructed. This packet also has the correct sequence number, so the packets are seen as valid by the targeted host. These sequence numbers are easy to predict. This process is referred to as TCP sequence number prediction, whereby the attacker either sniffs the current Sequence and Acknowledgment (SEQ/ACK) numbers of the connection or can algorithmically predict these numbers.","title":"IP Fragmentation Attack"},{"location":"security/network_security/#connection-hijacking","text":"An authorized user (Employee X) sends HTTP requests over a TCP session with the webserver. The web server accepts the packets from Employee X only when the packet has the correct SEQ/ACK numbers. As seen previously, these numbers are important for the webserver to distinguish between different sessions and to make sure it is still talking to Employee X. Imagine that the cracker starts sending packets to the web server spoofing the IP address of Employee X, using the correct SEQ/ACK combination. The web server accepts the packet and increments the ACK number. In the meantime, Employee X continues to send packets but with incorrect SEQ/ACK numbers. As a result of sending unsynchronized packets, all data from Employee X is discarded when received by the webserver. The attacker pretends to be Employee X using the correct numbers. This finally results in the cracker hijacking the connection, whereby Employee X is completely confused and the webserver replies assuming the cracker is sending correct synchronized data. STEPS: The attacker examines the traffic flows with a network monitor and notices traffic from Employee X to a web server. The web server returns or echoes data back to the origination station (Employee X). Employee X acknowledges the packet. The cracker launches a spoofed packet to the server. The web server responds to the cracker. The cracker starts verifying SEQ/ACK numbers to double-check success. At this time, the cracker takes over the session from Employee X, which results in a session hanging for Employee X. The cracker can start sending traffic to the webserver. The web server returns the requested data to confirm delivery with the correct ACK number. The cracker can continue to send data (keeping track of the correct SEQ/ACK numbers) until eventually setting the FIN flag to terminate the session.","title":"Connection Hijacking"},{"location":"security/network_security/#buffer-overflow","text":"A buffer is a temporary data storage area used to store program code and data. When a program or process tries to store more data in a buffer than it was originally anticipated to hold, a buffer overflow occurs. Buffers are temporary storage locations in memory (memory or buffer sizes are often measured in bytes) that can store a fixed amount of data in bytes. When more data is retrieved than can be stored in a buffer location, the additional information must go into an adjacent buffer, resulting in overwriting the valid data held in them. Mechanism: Buffer overflow vulnerabilities exist in different types. But the overall goal for all buffer overflow attacks is to take over the control of a privileged program and, if possible, the host. The attacker has two tasks to achieve this goal. First, the dirty code needs to be available in the program's code address space. Second, the privileged program should jump to that particular part of the code, which ensures that the proper parameters are loaded into memory. The first task can be achieved in two ways: by injecting the code in the right address space or by using the existing code and modifying certain parameters slightly. The second task is a little more complex because the program's control flow needs to be modified to make the program jump to the dirty code. CounterMeasure: The most important approach is to have a concerted focus on writing correct code. A second method is to make the data buffers (memory locations) address space of the program code non-executable. This type of address space makes it impossible to execute code, which might be infiltrated in the program's buffers during an attack.","title":"Buffer Overflow"},{"location":"security/network_security/#more-spoofing","text":"Address Resolution Protocol Spoofing The Address Resolution Protocol (ARP) provides a mechanism to resolve, or map, a known IP address to a MAC sublayer address. Using ARP spoofing, the cracker can exploit this hardware address authentication mechanism by spoofing the hardware address of Host B. Basically, the attacker can convince any host or network device on the local network that the cracker's workstation is the host to be trusted. This is a common method used in a switched environment. ARP spoofing can be prevented with the implementation of static ARP tables in all the hosts and routers of your network. Alternatively, you can implement an ARP server that responds to ARP requests on behalf of the target host. DNS Spoofing DNS spoofing is the method whereby the hacker convinces the target machine that the system it wants to connect to is the machine of the cracker. The cracker modifies some records so that name entries of hosts correspond to the attacker's IP address. There have been instances in which the complete DNS server was compromised by an attack. To counter DNS spoofing, the reverse lookup detects these attacks. The reverse lookup is a mechanism to verify the IP address against a name. The IP address and name files are usually kept on different servers to make compromise much more difficult","title":"More Spoofing"},{"location":"security/threats_attacks_defences/","text":"Part III: Threats, Attacks & Defense DNS Protection Cache Poisoning Attack Since DNS responses are cached, a quick response can be provided for repeated translations. DNS negative queries are also cached, e.g., misspelt words, and all cached data periodically times out. Cache poisoning is an issue in what is known as pharming. This term is used to describe a hacker\u2019s attack in which a website\u2019s traffic is redirected to a bogus website by forging the DNS mapping. In this case, an attacker attempts to insert a fake address record for an Internet domain into the DNS. If the server accepts the fake record, the cache is poisoned and subsequent requests for the address of the domain are answered with the address of a server controlled by the attacker. As long as the fake entry is cached by the server, browsers or e-mail servers will automatically go to the address provided by the compromised DNS server. the typical time to live (TTL) for cached entries is a couple of hours, thereby permitting ample time for numerous users to be affected by the attack. DNSSEC (Security Extension) The long-term solution to these DNS problems is authentication. If a resolver cannot distinguish between valid and invalid data in a response, then add source authentication to verify that the data received in response is equal to the data entered by the zone administrator DNS Security Extensions (DNSSEC) protects against data spoofing and corruption and provides mechanisms to authenticate servers and requests, as well as mechanisms to establish authenticity and integrity. When authenticating DNS responses, each DNS zone signs its data using a private key. It is recommended that this signing be done offline and in advance. The query for a particular record returns the requested resource record set (RRset) and signature (RRSIG) of the requested resource record set. The resolver then authenticates the response using a public key, which is pre-configured or learned via a sequence of key records in the DNS hierarchy. The goals of DNSSEC are to provide authentication and integrity for DNS responses without confidentiality or DDoS protection. BGP BGP stands for border gateway protocol. It is a routing protocol that exchanges routing information among multiple Autonomous Systems (AS) An Autonomous System is a collection of routers or networks with the same network policy usually under single administrative control. BGP tells routers which hop to use in order to reach the destination network. BGP is used for both communicating information among routers in an AS (interior) and between multiple ASes (exterior). How BGP Works BGP is responsible for finding a path to a destination router & the path it chooses should be the shortest and most reliable one. This decision is done through a protocol known as Link state. With the link-state protocol, each router broadcasts to all other routers in the network the state of its links and IP subnets. Each router then receives information from the other routers and constructs a complete topology view of the entire network. The next-hop routing table is based on this topology view. The link-state protocol uses a famous algorithm in the field of computer science, Dijkstra\u2019s shortest path algorithm: We start from our router considering the path cost to all our direct neighbours. The shortest path is then taken We then re-look at all our neighbours that we can reach and update our link state table with the cost information. We then continue taking the shortest path until every router has been visited. BGP Vulnerabilities By corrupting the BGP routing table we are able to influence the direction traffic flows on the internet! This action is known as BGP hijacking. Injecting bogus route advertising information into the BGP-distributed routing database by malicious sources, accidentally or routers can disrupt Internet backbone operations. Blackholing traffic: Blackhole route is a network route, i.e., routing table entry, that goes nowhere and packets matching the route prefix are dropped or ignored. Blackhole routes can only be detected by monitoring the lost traffic. Blackhole routes are the best defence against many common viral attacks where the traffic is dropped from infected machines to/from command & control hosts. Infamous BGP Injection attack on Youtube Ex: In 2008, Pakistan decided to block YouTube by creating a BGP route that led into a black hole. Instead, this routing information got transmitted to a hong kong ISP and from there accidentally got propagated to the rest of the world meaning millions were routed through to this black hole and therefore unable to access YouTube. Potentially, the greatest risk to BGP occurs in a denial of service attack in which a router is flooded with more packets than it can handle. Network overload and router resource exhaustion happen when the network begins carrying an excessive number of BGP messages, overloading the router control processors, memory, routing table and reducing the bandwidth available for data traffic. Refer: https://medium.com/bugbountywriteup/bgp-the-weak-link-in-the-internet-what-is-bgp-and-how-do-hackers-exploit-it-d899a68ba5bb Router flapping is another type of attack. Route flapping refers to repetitive changes to the BGP routing table, often several times a minute. Withdrawing and re-advertising at a high-rate can cause a serious problem for routers since they propagate the announcements of routes. If these route flaps happen fast enough, e.g., 30 to 50 times per second, the router becomes overloaded, which eventually prevents convergence on valid routes. The potential impact for Internet users is a slowdown in message delivery, and in some cases, packets may not be delivered at all. BGP Security Border Gateway Protocol Security recommends the use of BGP peer authentication since it is one of the strongest mechanisms for preventing malicious activity. The authentication mechanisms are Internet Protocol Security (IPsec) or BGP MD5. Another method, known as prefix limits, can be used to avoid filling router tables. In this approach, routers should be configured to disable or terminate a BGP peering session, and issue warning messages to administrators when a neighbour sends in excess of a preset number of prefixes. IETF is currently working on improving this space Web-Based Attacks HTTP Response Splitting Attacks HTTP response splitting attack may happen where the server script embeds user data in HTTP response headers without appropriate sanitation. This typically happens when the script embeds user data in the redirection URL of a redirection response (HTTP status code 3xx), or when the script embeds user data in a cookie value or name when the response sets a cookie. HTTP response splitting attacks can be used to perform web cache poisoning and cross-site scripting attacks. HTTP response splitting is the attacker\u2019s ability to send a single HTTP request that forces the webserver to form an output stream, which is then interpreted by the target as two HTTP responses instead of one response. Cross-Site Request Forgery (CSRF or XSRF) A Cross-Site Request Forgery attack tricks the victim\u2019s browser into issuing a command to a vulnerable web application. Vulnerability is caused by browsers automatically including user authentication data, session ID, IP address, Windows domain credentials, etc. with each request. Attackers typically use CSRF to initiate transactions such as transfer funds, login/logout user, close account, access sensitive data, and change account details. The vulnerability is caused by web browsers that automatically include credentials with each request, even for requests caused by a form, script, or image on another site. CSRF can also be dynamically constructed as part of a payload for a cross-site scripting attack All sites relying on automatic credentials are vulnerable. Popular browsers cannot prevent cross-site request forgery. Logging out of high-value sites as soon as possible can mitigate CSRF risk. It is recommended that a high-value website must require a client to manually provide authentication data in the same HTTP request used to perform any operation with security implications. Limiting the lifetime of session cookies can also reduce the chance of being used by other malicious sites. OWASP recommends website developers include a required security token in HTTP requests associated with sensitive business functions in order to mitigate CSRF attacks Cross-Site Scripting (XSS) Attacks Cross-Site Scripting occurs when dynamically generated web pages display user input, such as login information, that is not properly validated, allowing an attacker to embed malicious scripts into the generated page and then execute the script on the machine of any user that views the site. If successful, Cross-Site Scripting vulnerabilities can be exploited to manipulate or steal cookies, create requests that can be mistaken for those of a valid user, compromise confidential information, or execute malicious code on end-user systems. Cross-Site Scripting (XSS or CSS) attacks involve the execution of malicious scripts on the victim\u2019s browser. The victim is simply a user\u2019s host and not the server. XSS results from a failure to validate user input by a web-based application. Document Object Model (DOM) XSS Attacks The Document Object Model (DOM) based XSS does not require the webserver to receive the XSS payload for a successful attack. The attacker abuses the runtime by embedding their data on the client-side. An attacker can force the client (browser) to render the page with parts of the DOM controlled by the attacker. When the page is rendered and the data is processed by the page, typically by a client-side HTML-embedded script such as JavaScript, the page\u2019s code may insecurely embed the data in the page itself, thus delivering the cross-site scripting payload. There are several DOM objects which can serve as an attack vehicle for delivering malicious script to victims browser. Clickjacking The technique works by hiding malicious link/scripts under the cover of the content of a legitimate site. Buttons on a website actually contain invisible links, placed there by the attacker. So, an individual who clicks on an object they can visually see is actually being duped into visiting a malicious page or executing a malicious script. When mouseover is used together with clickjacking, the outcome is devastating. Facebook users have been hit by a clickjacking attack, which tricks people into \u201cliking\u201d a particular Facebook page, thus enabling the attack to spread since Memorial Day 2010. There is not yet effective defence against clickjacking, and disabling JavaScript is the only viable method DataBase Attacks & Defenses SQL injection Attacks It exploits improper input validation in database queries. A successful exploit will allow attackers to access, modify, or delete information in the database. It permits attackers to steal sensitive information stored within the backend databases of affected websites, which may include such things as user credentials, email addresses, personal information, and credit card numbers SELECT USERNAME,PASSWORD from USERS where USERNAME='<username>' AND PASSWORD='<password>'; Here the username & password is the input provided by the user. Suppose an attacker gives the input as \" OR '1'='1'\" in both fields. Therefore the SQL query will look like: SELECT USERNAME,PASSWORD from USERS where USERNAME='' OR '1'='1' AND PASSOWRD='' OR '1'='1'; This query results in a true statement & the user gets logged in. This example depicts the bost basic type of SQL injection SQL Injection Attack Defenses SQL injection can be protected by filtering the query to eliminate malicious syntax, which involves the employment of some tools in order to (a) scan the source code. In addition, the input fields should be restricted to the absolute minimum, typically anywhere from 7-12 characters, and validate any data, e.g., if a user inputs an age make sure the input is an integer with a maximum of 3 digits. VPN A virtual private network (VPN) is a service that offers a secure, reliable connection over a shared public infrastructure such as the Internet. Cisco defines a VPN as an encrypted connection between private networks over a public network. To date, there are three types of VPNs: Remote access Site-to-site Firewall-based Security Breach In spite of the most aggressive steps to protect computers from attacks, attackers sometimes get through. Any event that results in a violation of any of the confidentiality, integrity, or availability (CIA) security tenets is a security breach. Denial of Service Attacks Denial of service (DoS) attacks result in downtime or inability of a user to access a system. DoS attacks impact the availability of tenet of information systems security. A DoS attack is a coordinated attempt to deny service by occupying a computer to perform large amounts of unnecessary tasks. This excessive activity makes the system unavailable to perform legitimate operations Two common types of DoS attacks are as follows: Logic attacks\u2014Logic attacks use software flaws to crash or seriously hinder the performance of remote servers. You can prevent many of these attacks by installing the latest patches to keep your software up to date. Flooding attacks\u2014Flooding attacks overwhelm the victim computer\u2019s CPU, memory, or network resources by sending large numbers of useless requests to the machine. Most DoS attacks target weaknesses in the overall system architecture rather than a software bug or security flaw One popular technique for launching a packet flood is a SYN flood. One of the best defences against DoS attacks is to use intrusion prevention system (IPS) software or devices to detect and stop the attack. Distributed Denial of Service Attacks DDoS attacks differ from regular DoS attacks in their scope. In a DDoS attack, attackers hijack hundreds or even thousands of Internet computers, planting automated attack agents on those systems. The attacker then instructs the agents to bombard the target site with forged messages. This overloads the site and blocks legitimate traffic. The key here is strength in numbers. The attacker does more damage by distributing the attack across multiple computers. Wiretapping Although the term wiretapping is generally associated with voice telephone communications, attackers can also use wiretapping to intercept data communications. Attackers can tap telephone lines and data communication lines. Wiretapping can be active, where the attacker makes modifications to the line. It can also be passive, where an unauthorized user simply listens to the transmission without changing the contents. Passive intrusion can include the copying of data for a subsequent active attack. Two methods of active wiretapping are as follows: Between-the-lines wiretapping\u2014This type of wiretapping does not alter the messages sent by the legitimate user but inserts additional messages into the communication line when the legitimate user pauses. Piggyback-entry wiretapping\u2014This type of wiretapping intercepts and modifies the original message by breaking the communications line and routing the message to another computer that acts as a host. Backdoors Software developers sometimes include hidden access methods, called backdoors, in their programs. Backdoors give developers or support personnel easy access to a system without having to struggle with security controls. The problem is that backdoors don\u2019t always stay hidden. When an attacker discovers a backdoor, he or she can use it to bypass existing security controls such as passwords, encryption, and so on. Where legitimate users log on through front doors using a user ID and password, attackers use backdoors to bypass these normal access controls. Malicious Attacks Birthday Attack Once an attacker compromises a hashed password file, a birthday attack is performed. A birthday attack is a type of cryptographic attack that is used to make a brute-force attack of one-way hashes easier. It is a mathematical exploit that is based on the birthday problem in probability theory. Further Reading: https://www.sciencedirect.com/topics/computer-science/birthday-attack https://www.internetsecurity.tips/birthday-attack/ Brute-Force Password Attacks In a brute-force password attack, the attacker tries different passwords on a system until one of them is successful. Usually, the attacker employs a software program to try all possible combinations of a likely password, user ID, or security code until it locates a match. This occurs rapidly and in sequence. This type of attack is called a brute-force password attack because the attacker simply hammers away at the code. There is no skill or stealth involved\u2014just brute force that eventually breaks the code. Further Reading: https://owasp.org/www-community/attacks/Brute_force_attack https://owasp.org/www-community/controls/Blocking_Brute_Force_Attacks Dictionary Password Attacks A dictionary password attack is a simple attack that relies on users making poor password choices. In a dictionary password attack, a simple password-cracker program takes all the words from a dictionary file and attempts to log on by entering each dictionary entry as a password. Further Reading: https://capec.mitre.org/data/definitions/16.html Replay Attacks Replay attacks involve capturing data packets from a network and retransmitting them to produce an unauthorized effect. The receipt of duplicate, authenticated IP packets may disrupt service or have some other undesired consequence. Systems can be broken through replay attacks when attackers reuse old messages or parts of old messages to deceive system users. This helps intruders to gain information that allows unauthorized access into a system. Further reading: https://study.com/academy/lesson/replay-attack-definition-examples-prevention.html Man-in-the-Middle Attacks A man-in-the-middle attack takes advantage of the multihop process used by many types of networks. In this type of attack, an attacker intercepts messages between two parties before transferring them on to their intended destination. Web spoofing is a type of man-in-the-middle attack in which the user believes a secure session exists with a particular web server. In reality, the secure connection exists only with the attacker, not the webserver. The attacker then establishes a secure connection with the webserver, acting as an invisible go-between. The attacker passes traffic between the user and the webserver. In this way, the attacker can trick the user into supplying passwords, credit card information, and other private data. Further Reading: https://owasp.org/www-community/attacks/Man-in-the-middle_attack Masquerading In a masquerade attack, one user or computer pretends to be another user or computer. Masquerade attacks usually include one of the other forms of active attacks, such as IP address spoofing or replaying. Attackers can capture authentication sequences and then replay them later to log on again to an application or operating system. For example, an attacker might monitor usernames and passwords sent to a weak web application. The attacker could then use the intercepted credentials to log on to the web application and impersonate the user. Further Reading: https://dl.acm.org/doi/book/10.5555/2521792 https://ieeexplore.ieee.org/document/1653228 Eavesdropping Eavesdropping, or sniffing, occurs when a host sets its network interface on promiscuous mode and copies packets that pass by for later analysis. Promiscuous mode enables a network device to intercept and read each network packet(of course given some conditions) given sec, even if the packet\u2019s address doesn\u2019t match the network device. It is possible to attach hardware and software to monitor and analyze all packets on that segment of the transmission media without alerting any other users. Candidates for eavesdropping include satellite, wireless, mobile, and other transmission methods. Social Engineering Attackers often use a deception technique called social engineering to gain access to resources in an IT infrastructure. In nearly all cases, social engineering involves tricking authorized users into carrying out actions for unauthorized users. The success of social engineering attacks depends on the basic tendency of people to want to be helpful. Phreaking Phone phreaking, or simply phreaking, is a slang term that describes the activity of a subculture of people who study, experiment with, or explore telephone systems, telephone company equipment, and systems connected to public telephone networks. Phreaking is the art of exploiting bugs and glitches that exist in the telephone system. Phishing Phishing is a type of fraud in which an attacker attempts to trick the victim into providing private information such as credit card numbers, passwords, dates of birth, bank account numbers, automated teller machine (ATM) PINs, and Social Security numbers. Pharming Pharming is another type of attack that seeks to obtain personal or private financial information through domain spoofing. A pharming attack doesn\u2019t use messages to trick victims into visiting spoofed websites that appear legitimate, however. Instead, pharming \u201cpoisons\u201d a domain name on the domain name server (DNS), a process known as DNS poisoning. The result is that when a user enters the poisoned server\u2019s web address into his or her address bar, that user navigates to the attacker\u2019s site. The user\u2019s browser still shows the correct website, which makes pharming difficult to detect\u2014and therefore more serious. Where phishing attempts to scam people one at a time with an email or instant message, pharming enables scammers to target large groups of people at one time through domain spoofing.","title":"Threat, Attacks & Defences"},{"location":"security/threats_attacks_defences/#part-iii-threats-attacks-defense","text":"","title":"Part III: Threats, Attacks &amp; Defense"},{"location":"security/threats_attacks_defences/#dns-protection","text":"","title":"DNS Protection"},{"location":"security/threats_attacks_defences/#cache-poisoning-attack","text":"Since DNS responses are cached, a quick response can be provided for repeated translations. DNS negative queries are also cached, e.g., misspelt words, and all cached data periodically times out. Cache poisoning is an issue in what is known as pharming. This term is used to describe a hacker\u2019s attack in which a website\u2019s traffic is redirected to a bogus website by forging the DNS mapping. In this case, an attacker attempts to insert a fake address record for an Internet domain into the DNS. If the server accepts the fake record, the cache is poisoned and subsequent requests for the address of the domain are answered with the address of a server controlled by the attacker. As long as the fake entry is cached by the server, browsers or e-mail servers will automatically go to the address provided by the compromised DNS server. the typical time to live (TTL) for cached entries is a couple of hours, thereby permitting ample time for numerous users to be affected by the attack.","title":"Cache Poisoning Attack"},{"location":"security/threats_attacks_defences/#dnssec-security-extension","text":"The long-term solution to these DNS problems is authentication. If a resolver cannot distinguish between valid and invalid data in a response, then add source authentication to verify that the data received in response is equal to the data entered by the zone administrator DNS Security Extensions (DNSSEC) protects against data spoofing and corruption and provides mechanisms to authenticate servers and requests, as well as mechanisms to establish authenticity and integrity. When authenticating DNS responses, each DNS zone signs its data using a private key. It is recommended that this signing be done offline and in advance. The query for a particular record returns the requested resource record set (RRset) and signature (RRSIG) of the requested resource record set. The resolver then authenticates the response using a public key, which is pre-configured or learned via a sequence of key records in the DNS hierarchy. The goals of DNSSEC are to provide authentication and integrity for DNS responses without confidentiality or DDoS protection.","title":"DNSSEC (Security Extension)"},{"location":"security/threats_attacks_defences/#bgp","text":"BGP stands for border gateway protocol. It is a routing protocol that exchanges routing information among multiple Autonomous Systems (AS) An Autonomous System is a collection of routers or networks with the same network policy usually under single administrative control. BGP tells routers which hop to use in order to reach the destination network. BGP is used for both communicating information among routers in an AS (interior) and between multiple ASes (exterior).","title":"BGP"},{"location":"security/threats_attacks_defences/#how-bgp-works","text":"BGP is responsible for finding a path to a destination router & the path it chooses should be the shortest and most reliable one. This decision is done through a protocol known as Link state. With the link-state protocol, each router broadcasts to all other routers in the network the state of its links and IP subnets. Each router then receives information from the other routers and constructs a complete topology view of the entire network. The next-hop routing table is based on this topology view. The link-state protocol uses a famous algorithm in the field of computer science, Dijkstra\u2019s shortest path algorithm: We start from our router considering the path cost to all our direct neighbours. The shortest path is then taken We then re-look at all our neighbours that we can reach and update our link state table with the cost information. We then continue taking the shortest path until every router has been visited.","title":"How BGP Works"},{"location":"security/threats_attacks_defences/#bgp-vulnerabilities","text":"By corrupting the BGP routing table we are able to influence the direction traffic flows on the internet! This action is known as BGP hijacking. Injecting bogus route advertising information into the BGP-distributed routing database by malicious sources, accidentally or routers can disrupt Internet backbone operations. Blackholing traffic: Blackhole route is a network route, i.e., routing table entry, that goes nowhere and packets matching the route prefix are dropped or ignored. Blackhole routes can only be detected by monitoring the lost traffic. Blackhole routes are the best defence against many common viral attacks where the traffic is dropped from infected machines to/from command & control hosts. Infamous BGP Injection attack on Youtube Ex: In 2008, Pakistan decided to block YouTube by creating a BGP route that led into a black hole. Instead, this routing information got transmitted to a hong kong ISP and from there accidentally got propagated to the rest of the world meaning millions were routed through to this black hole and therefore unable to access YouTube. Potentially, the greatest risk to BGP occurs in a denial of service attack in which a router is flooded with more packets than it can handle. Network overload and router resource exhaustion happen when the network begins carrying an excessive number of BGP messages, overloading the router control processors, memory, routing table and reducing the bandwidth available for data traffic. Refer: https://medium.com/bugbountywriteup/bgp-the-weak-link-in-the-internet-what-is-bgp-and-how-do-hackers-exploit-it-d899a68ba5bb Router flapping is another type of attack. Route flapping refers to repetitive changes to the BGP routing table, often several times a minute. Withdrawing and re-advertising at a high-rate can cause a serious problem for routers since they propagate the announcements of routes. If these route flaps happen fast enough, e.g., 30 to 50 times per second, the router becomes overloaded, which eventually prevents convergence on valid routes. The potential impact for Internet users is a slowdown in message delivery, and in some cases, packets may not be delivered at all. BGP Security Border Gateway Protocol Security recommends the use of BGP peer authentication since it is one of the strongest mechanisms for preventing malicious activity. The authentication mechanisms are Internet Protocol Security (IPsec) or BGP MD5. Another method, known as prefix limits, can be used to avoid filling router tables. In this approach, routers should be configured to disable or terminate a BGP peering session, and issue warning messages to administrators when a neighbour sends in excess of a preset number of prefixes. IETF is currently working on improving this space","title":"BGP Vulnerabilities"},{"location":"security/threats_attacks_defences/#web-based-attacks","text":"","title":"Web-Based Attacks"},{"location":"security/threats_attacks_defences/#http-response-splitting-attacks","text":"HTTP response splitting attack may happen where the server script embeds user data in HTTP response headers without appropriate sanitation. This typically happens when the script embeds user data in the redirection URL of a redirection response (HTTP status code 3xx), or when the script embeds user data in a cookie value or name when the response sets a cookie. HTTP response splitting attacks can be used to perform web cache poisoning and cross-site scripting attacks. HTTP response splitting is the attacker\u2019s ability to send a single HTTP request that forces the webserver to form an output stream, which is then interpreted by the target as two HTTP responses instead of one response.","title":"HTTP Response Splitting Attacks"},{"location":"security/threats_attacks_defences/#cross-site-request-forgery-csrf-or-xsrf","text":"A Cross-Site Request Forgery attack tricks the victim\u2019s browser into issuing a command to a vulnerable web application. Vulnerability is caused by browsers automatically including user authentication data, session ID, IP address, Windows domain credentials, etc. with each request. Attackers typically use CSRF to initiate transactions such as transfer funds, login/logout user, close account, access sensitive data, and change account details. The vulnerability is caused by web browsers that automatically include credentials with each request, even for requests caused by a form, script, or image on another site. CSRF can also be dynamically constructed as part of a payload for a cross-site scripting attack All sites relying on automatic credentials are vulnerable. Popular browsers cannot prevent cross-site request forgery. Logging out of high-value sites as soon as possible can mitigate CSRF risk. It is recommended that a high-value website must require a client to manually provide authentication data in the same HTTP request used to perform any operation with security implications. Limiting the lifetime of session cookies can also reduce the chance of being used by other malicious sites. OWASP recommends website developers include a required security token in HTTP requests associated with sensitive business functions in order to mitigate CSRF attacks","title":"Cross-Site Request Forgery (CSRF or XSRF)"},{"location":"security/threats_attacks_defences/#cross-site-scripting-xss-attacks","text":"Cross-Site Scripting occurs when dynamically generated web pages display user input, such as login information, that is not properly validated, allowing an attacker to embed malicious scripts into the generated page and then execute the script on the machine of any user that views the site. If successful, Cross-Site Scripting vulnerabilities can be exploited to manipulate or steal cookies, create requests that can be mistaken for those of a valid user, compromise confidential information, or execute malicious code on end-user systems. Cross-Site Scripting (XSS or CSS) attacks involve the execution of malicious scripts on the victim\u2019s browser. The victim is simply a user\u2019s host and not the server. XSS results from a failure to validate user input by a web-based application.","title":"Cross-Site Scripting (XSS) Attacks"},{"location":"security/threats_attacks_defences/#document-object-model-dom-xss-attacks","text":"The Document Object Model (DOM) based XSS does not require the webserver to receive the XSS payload for a successful attack. The attacker abuses the runtime by embedding their data on the client-side. An attacker can force the client (browser) to render the page with parts of the DOM controlled by the attacker. When the page is rendered and the data is processed by the page, typically by a client-side HTML-embedded script such as JavaScript, the page\u2019s code may insecurely embed the data in the page itself, thus delivering the cross-site scripting payload. There are several DOM objects which can serve as an attack vehicle for delivering malicious script to victims browser.","title":"Document Object Model (DOM) XSS Attacks"},{"location":"security/threats_attacks_defences/#clickjacking","text":"The technique works by hiding malicious link/scripts under the cover of the content of a legitimate site. Buttons on a website actually contain invisible links, placed there by the attacker. So, an individual who clicks on an object they can visually see is actually being duped into visiting a malicious page or executing a malicious script. When mouseover is used together with clickjacking, the outcome is devastating. Facebook users have been hit by a clickjacking attack, which tricks people into \u201cliking\u201d a particular Facebook page, thus enabling the attack to spread since Memorial Day 2010. There is not yet effective defence against clickjacking, and disabling JavaScript is the only viable method","title":"Clickjacking"},{"location":"security/threats_attacks_defences/#database-attacks-defenses","text":"","title":"DataBase Attacks &amp; Defenses"},{"location":"security/threats_attacks_defences/#sql-injection-attacks","text":"It exploits improper input validation in database queries. A successful exploit will allow attackers to access, modify, or delete information in the database. It permits attackers to steal sensitive information stored within the backend databases of affected websites, which may include such things as user credentials, email addresses, personal information, and credit card numbers SELECT USERNAME,PASSWORD from USERS where USERNAME='<username>' AND PASSWORD='<password>'; Here the username & password is the input provided by the user. Suppose an attacker gives the input as \" OR '1'='1'\" in both fields. Therefore the SQL query will look like: SELECT USERNAME,PASSWORD from USERS where USERNAME='' OR '1'='1' AND PASSOWRD='' OR '1'='1'; This query results in a true statement & the user gets logged in. This example depicts the bost basic type of SQL injection","title":"SQL injection Attacks"},{"location":"security/threats_attacks_defences/#sql-injection-attack-defenses","text":"SQL injection can be protected by filtering the query to eliminate malicious syntax, which involves the employment of some tools in order to (a) scan the source code. In addition, the input fields should be restricted to the absolute minimum, typically anywhere from 7-12 characters, and validate any data, e.g., if a user inputs an age make sure the input is an integer with a maximum of 3 digits.","title":"SQL Injection Attack Defenses"},{"location":"security/threats_attacks_defences/#vpn","text":"A virtual private network (VPN) is a service that offers a secure, reliable connection over a shared public infrastructure such as the Internet. Cisco defines a VPN as an encrypted connection between private networks over a public network. To date, there are three types of VPNs: Remote access Site-to-site Firewall-based","title":"VPN"},{"location":"security/threats_attacks_defences/#security-breach","text":"In spite of the most aggressive steps to protect computers from attacks, attackers sometimes get through. Any event that results in a violation of any of the confidentiality, integrity, or availability (CIA) security tenets is a security breach.","title":"Security Breach"},{"location":"security/threats_attacks_defences/#denial-of-service-attacks","text":"Denial of service (DoS) attacks result in downtime or inability of a user to access a system. DoS attacks impact the availability of tenet of information systems security. A DoS attack is a coordinated attempt to deny service by occupying a computer to perform large amounts of unnecessary tasks. This excessive activity makes the system unavailable to perform legitimate operations Two common types of DoS attacks are as follows: Logic attacks\u2014Logic attacks use software flaws to crash or seriously hinder the performance of remote servers. You can prevent many of these attacks by installing the latest patches to keep your software up to date. Flooding attacks\u2014Flooding attacks overwhelm the victim computer\u2019s CPU, memory, or network resources by sending large numbers of useless requests to the machine. Most DoS attacks target weaknesses in the overall system architecture rather than a software bug or security flaw One popular technique for launching a packet flood is a SYN flood. One of the best defences against DoS attacks is to use intrusion prevention system (IPS) software or devices to detect and stop the attack.","title":"Denial of Service Attacks"},{"location":"security/threats_attacks_defences/#distributed-denial-of-service-attacks","text":"DDoS attacks differ from regular DoS attacks in their scope. In a DDoS attack, attackers hijack hundreds or even thousands of Internet computers, planting automated attack agents on those systems. The attacker then instructs the agents to bombard the target site with forged messages. This overloads the site and blocks legitimate traffic. The key here is strength in numbers. The attacker does more damage by distributing the attack across multiple computers.","title":"Distributed Denial of Service Attacks"},{"location":"security/threats_attacks_defences/#wiretapping","text":"Although the term wiretapping is generally associated with voice telephone communications, attackers can also use wiretapping to intercept data communications. Attackers can tap telephone lines and data communication lines. Wiretapping can be active, where the attacker makes modifications to the line. It can also be passive, where an unauthorized user simply listens to the transmission without changing the contents. Passive intrusion can include the copying of data for a subsequent active attack. Two methods of active wiretapping are as follows: Between-the-lines wiretapping\u2014This type of wiretapping does not alter the messages sent by the legitimate user but inserts additional messages into the communication line when the legitimate user pauses. Piggyback-entry wiretapping\u2014This type of wiretapping intercepts and modifies the original message by breaking the communications line and routing the message to another computer that acts as a host.","title":"Wiretapping"},{"location":"security/threats_attacks_defences/#backdoors","text":"Software developers sometimes include hidden access methods, called backdoors, in their programs. Backdoors give developers or support personnel easy access to a system without having to struggle with security controls. The problem is that backdoors don\u2019t always stay hidden. When an attacker discovers a backdoor, he or she can use it to bypass existing security controls such as passwords, encryption, and so on. Where legitimate users log on through front doors using a user ID and password, attackers use backdoors to bypass these normal access controls.","title":"Backdoors"},{"location":"security/threats_attacks_defences/#malicious-attacks","text":"","title":"Malicious Attacks"},{"location":"security/threats_attacks_defences/#birthday-attack","text":"Once an attacker compromises a hashed password file, a birthday attack is performed. A birthday attack is a type of cryptographic attack that is used to make a brute-force attack of one-way hashes easier. It is a mathematical exploit that is based on the birthday problem in probability theory. Further Reading: https://www.sciencedirect.com/topics/computer-science/birthday-attack https://www.internetsecurity.tips/birthday-attack/","title":"Birthday Attack"},{"location":"security/threats_attacks_defences/#brute-force-password-attacks","text":"In a brute-force password attack, the attacker tries different passwords on a system until one of them is successful. Usually, the attacker employs a software program to try all possible combinations of a likely password, user ID, or security code until it locates a match. This occurs rapidly and in sequence. This type of attack is called a brute-force password attack because the attacker simply hammers away at the code. There is no skill or stealth involved\u2014just brute force that eventually breaks the code. Further Reading: https://owasp.org/www-community/attacks/Brute_force_attack https://owasp.org/www-community/controls/Blocking_Brute_Force_Attacks","title":"Brute-Force Password Attacks"},{"location":"security/threats_attacks_defences/#dictionary-password-attacks","text":"A dictionary password attack is a simple attack that relies on users making poor password choices. In a dictionary password attack, a simple password-cracker program takes all the words from a dictionary file and attempts to log on by entering each dictionary entry as a password. Further Reading: https://capec.mitre.org/data/definitions/16.html","title":"Dictionary Password Attacks"},{"location":"security/threats_attacks_defences/#replay-attacks","text":"Replay attacks involve capturing data packets from a network and retransmitting them to produce an unauthorized effect. The receipt of duplicate, authenticated IP packets may disrupt service or have some other undesired consequence. Systems can be broken through replay attacks when attackers reuse old messages or parts of old messages to deceive system users. This helps intruders to gain information that allows unauthorized access into a system. Further reading: https://study.com/academy/lesson/replay-attack-definition-examples-prevention.html","title":"Replay Attacks"},{"location":"security/threats_attacks_defences/#man-in-the-middle-attacks","text":"A man-in-the-middle attack takes advantage of the multihop process used by many types of networks. In this type of attack, an attacker intercepts messages between two parties before transferring them on to their intended destination. Web spoofing is a type of man-in-the-middle attack in which the user believes a secure session exists with a particular web server. In reality, the secure connection exists only with the attacker, not the webserver. The attacker then establishes a secure connection with the webserver, acting as an invisible go-between. The attacker passes traffic between the user and the webserver. In this way, the attacker can trick the user into supplying passwords, credit card information, and other private data. Further Reading: https://owasp.org/www-community/attacks/Man-in-the-middle_attack","title":"Man-in-the-Middle Attacks"},{"location":"security/threats_attacks_defences/#masquerading","text":"In a masquerade attack, one user or computer pretends to be another user or computer. Masquerade attacks usually include one of the other forms of active attacks, such as IP address spoofing or replaying. Attackers can capture authentication sequences and then replay them later to log on again to an application or operating system. For example, an attacker might monitor usernames and passwords sent to a weak web application. The attacker could then use the intercepted credentials to log on to the web application and impersonate the user. Further Reading: https://dl.acm.org/doi/book/10.5555/2521792 https://ieeexplore.ieee.org/document/1653228","title":"Masquerading"},{"location":"security/threats_attacks_defences/#eavesdropping","text":"Eavesdropping, or sniffing, occurs when a host sets its network interface on promiscuous mode and copies packets that pass by for later analysis. Promiscuous mode enables a network device to intercept and read each network packet(of course given some conditions) given sec, even if the packet\u2019s address doesn\u2019t match the network device. It is possible to attach hardware and software to monitor and analyze all packets on that segment of the transmission media without alerting any other users. Candidates for eavesdropping include satellite, wireless, mobile, and other transmission methods.","title":"Eavesdropping"},{"location":"security/threats_attacks_defences/#social-engineering","text":"Attackers often use a deception technique called social engineering to gain access to resources in an IT infrastructure. In nearly all cases, social engineering involves tricking authorized users into carrying out actions for unauthorized users. The success of social engineering attacks depends on the basic tendency of people to want to be helpful.","title":"Social Engineering"},{"location":"security/threats_attacks_defences/#phreaking","text":"Phone phreaking, or simply phreaking, is a slang term that describes the activity of a subculture of people who study, experiment with, or explore telephone systems, telephone company equipment, and systems connected to public telephone networks. Phreaking is the art of exploiting bugs and glitches that exist in the telephone system.","title":"Phreaking"},{"location":"security/threats_attacks_defences/#phishing","text":"Phishing is a type of fraud in which an attacker attempts to trick the victim into providing private information such as credit card numbers, passwords, dates of birth, bank account numbers, automated teller machine (ATM) PINs, and Social Security numbers.","title":"Phishing"},{"location":"security/threats_attacks_defences/#pharming","text":"Pharming is another type of attack that seeks to obtain personal or private financial information through domain spoofing. A pharming attack doesn\u2019t use messages to trick victims into visiting spoofed websites that appear legitimate, however. Instead, pharming \u201cpoisons\u201d a domain name on the domain name server (DNS), a process known as DNS poisoning. The result is that when a user enters the poisoned server\u2019s web address into his or her address bar, that user navigates to the attacker\u2019s site. The user\u2019s browser still shows the correct website, which makes pharming difficult to detect\u2014and therefore more serious. Where phishing attempts to scam people one at a time with an email or instant message, pharming enables scammers to target large groups of people at one time through domain spoofing.","title":"Pharming"},{"location":"security/writing_secure_code/","text":"PART IV: Writing Secure Code & More The first and most important step in reducing security and reliability issues is to educate developers. However, even the best-trained engineers make mistakes, security experts can write insecure code and SREs can miss reliability issues. It\u2019s difficult to keep the many considerations and tradeoffs involved in building secure and reliable systems in mind simultaneously, especially if you\u2019re also responsible for producing software. Use frameworks to enforce security and reliability while writing code A better approach is to handle security and reliability in common frameworks, languages, and libraries. Ideally, libraries only expose an interface that makes writing code with common classes of security vulnerabilities impossible. Multiple applications can use each library or framework. When domain experts fix an issue, they remove it from all the applications the framework supports, allowing this engineering approach to scale better. Common Security Vulnerabilities In large codebases, a handful of classes account for the majority of security vulnerabilities, despite ongoing efforts to educate developers and introduce code review. OWASP and SANS publish lists of common vulnerability classes Write Simple Code Try to keep your code clean and simple. Avoid Multi-Level Nesting Multilevel nesting is a common anti-pattern that can lead to simple mistakes. If the error is in the most common code path, it will likely be captured by the unit tests. However, unit tests don\u2019t always check error handling paths in multilevel nested code. The error might result in decreased reliability (for example, if the service crashes when it mishandles an error) or a security vulnerability (like a mishandled authorization check error). Eliminate YAGNI Smells Sometimes developers overengineer solutions by adding functionality that may be useful in the future, \u201cjust in case.\u201d This goes against the YAGNI (You Aren\u2019t Gonna Need It) principle, which recommends implementing only the code that you need. YAGNI code adds unnecessary complexity because it needs to be documented, tested, and maintained. To summarize, avoiding YAGNI code leads to improved reliability, and simpler code leads to fewer security bugs, fewer opportunities to make mistakes, and less developer time spent maintaining unused code. Repay Technical Debt It is a common practice for developers to mark places that require further attention with TODO or FIXME annotations. In the short term, this habit can accelerate the delivery velocity for the most critical functionality, and allow a team to meet early deadlines\u2014but it also incurs technical debt. Still, it\u2019s not necessarily a bad practice, as long as you have a clear process (and allocate time) for repaying such debt. Refactoring Refactoring is the most effective way to keep a codebase clean and simple. Even a healthy codebase occasionally needs to be Regardless of the reasons behind refactoring, you should always follow one golden rule: never mix refactoring and functional changes in a single commit to the code repository. Refactoring changes are typically significant and can be difficult to understand. If a commit also includes functional changes, there\u2019s a higher risk that an author or reviewer might overlook bugs. Unit Testing Unit testing can increase system security and reliability by pinpointing a wide range of bugs in individual software components before a release. This technique involves breaking software components into smaller, self-contained \u201cunits\u201d that have no external dependencies, and then testing each unit. Fuzz Testing Fuzz testing is a technique that complements the previously mentioned testing techniques. Fuzzing involves using a fuzzing engine to generate a large number of candidate inputs that are then passed through a fuzz driver to the fuzz target. The fuzzer then analyzes how the system handles the input. Complex inputs handled by all kinds of software are popular targets for fuzzing - for example, file parsers, compression algorithms, network protocol implementation and audio codec. Integration Testing Integration testing moves beyond individual units and abstractions, replacing fake or stubbed-out implementations of abstractions like databases or network services with real implementations. As a result, integration tests exercise more complete code paths. Because you must initialize and configure these other dependencies, integration testing may be slower and flakier than unit testing\u2014to execute the test, this approach incorporates real-world variables like network latency as services communicate end-to-end. As you move from testing individual low-level units of code to testing how they interact when composed together, the net result is a higher degree of confidence that the system is behaving as expected. Last But not the least Code Reviews Rely on Automation Don\u2019t check in Secrets Verifiable Builds","title":"Writing Secure code"},{"location":"security/writing_secure_code/#part-iv-writing-secure-code-more","text":"The first and most important step in reducing security and reliability issues is to educate developers. However, even the best-trained engineers make mistakes, security experts can write insecure code and SREs can miss reliability issues. It\u2019s difficult to keep the many considerations and tradeoffs involved in building secure and reliable systems in mind simultaneously, especially if you\u2019re also responsible for producing software.","title":"PART IV: Writing Secure Code &amp; More"},{"location":"security/writing_secure_code/#use-frameworks-to-enforce-security-and-reliability-while-writing-code","text":"A better approach is to handle security and reliability in common frameworks, languages, and libraries. Ideally, libraries only expose an interface that makes writing code with common classes of security vulnerabilities impossible. Multiple applications can use each library or framework. When domain experts fix an issue, they remove it from all the applications the framework supports, allowing this engineering approach to scale better.","title":"Use frameworks to enforce security and reliability while writing code"},{"location":"security/writing_secure_code/#common-security-vulnerabilities","text":"In large codebases, a handful of classes account for the majority of security vulnerabilities, despite ongoing efforts to educate developers and introduce code review. OWASP and SANS publish lists of common vulnerability classes","title":"Common Security Vulnerabilities"},{"location":"security/writing_secure_code/#write-simple-code","text":"Try to keep your code clean and simple.","title":"Write Simple Code"},{"location":"security/writing_secure_code/#avoid-multi-level-nesting","text":"Multilevel nesting is a common anti-pattern that can lead to simple mistakes. If the error is in the most common code path, it will likely be captured by the unit tests. However, unit tests don\u2019t always check error handling paths in multilevel nested code. The error might result in decreased reliability (for example, if the service crashes when it mishandles an error) or a security vulnerability (like a mishandled authorization check error).","title":"Avoid Multi-Level Nesting"},{"location":"security/writing_secure_code/#eliminate-yagni-smells","text":"Sometimes developers overengineer solutions by adding functionality that may be useful in the future, \u201cjust in case.\u201d This goes against the YAGNI (You Aren\u2019t Gonna Need It) principle, which recommends implementing only the code that you need. YAGNI code adds unnecessary complexity because it needs to be documented, tested, and maintained. To summarize, avoiding YAGNI code leads to improved reliability, and simpler code leads to fewer security bugs, fewer opportunities to make mistakes, and less developer time spent maintaining unused code.","title":"Eliminate YAGNI Smells"},{"location":"security/writing_secure_code/#repay-technical-debt","text":"It is a common practice for developers to mark places that require further attention with TODO or FIXME annotations. In the short term, this habit can accelerate the delivery velocity for the most critical functionality, and allow a team to meet early deadlines\u2014but it also incurs technical debt. Still, it\u2019s not necessarily a bad practice, as long as you have a clear process (and allocate time) for repaying such debt.","title":"Repay Technical Debt"},{"location":"security/writing_secure_code/#refactoring","text":"Refactoring is the most effective way to keep a codebase clean and simple. Even a healthy codebase occasionally needs to be Regardless of the reasons behind refactoring, you should always follow one golden rule: never mix refactoring and functional changes in a single commit to the code repository. Refactoring changes are typically significant and can be difficult to understand. If a commit also includes functional changes, there\u2019s a higher risk that an author or reviewer might overlook bugs.","title":"Refactoring"},{"location":"security/writing_secure_code/#unit-testing","text":"Unit testing can increase system security and reliability by pinpointing a wide range of bugs in individual software components before a release. This technique involves breaking software components into smaller, self-contained \u201cunits\u201d that have no external dependencies, and then testing each unit.","title":"Unit Testing"},{"location":"security/writing_secure_code/#fuzz-testing","text":"Fuzz testing is a technique that complements the previously mentioned testing techniques. Fuzzing involves using a fuzzing engine to generate a large number of candidate inputs that are then passed through a fuzz driver to the fuzz target. The fuzzer then analyzes how the system handles the input. Complex inputs handled by all kinds of software are popular targets for fuzzing - for example, file parsers, compression algorithms, network protocol implementation and audio codec.","title":"Fuzz Testing"},{"location":"security/writing_secure_code/#integration-testing","text":"Integration testing moves beyond individual units and abstractions, replacing fake or stubbed-out implementations of abstractions like databases or network services with real implementations. As a result, integration tests exercise more complete code paths. Because you must initialize and configure these other dependencies, integration testing may be slower and flakier than unit testing\u2014to execute the test, this approach incorporates real-world variables like network latency as services communicate end-to-end. As you move from testing individual low-level units of code to testing how they interact when composed together, the net result is a higher degree of confidence that the system is behaving as expected.","title":"Integration Testing"},{"location":"security/writing_secure_code/#last-but-not-the-least","text":"Code Reviews Rely on Automation Don\u2019t check in Secrets Verifiable Builds","title":"Last But not the least"},{"location":"systems_design/availability/","text":"HA - Availability - Common \u201cNines\u201d Availability is generally expressed as \u201cNines\u201d, common \u2018Nines\u2019 are listed below. Availability % Downtime per year Downtime per month Downtime per week Downtime per day 99%(Two Nines) 3.65 days 7.31 hours 1.68 hours 14.40 minutes 99.5%(Two and a half Nines) 1.83 days 3.65 hours 50.40 minutes 7.20 minutes 99.9%(Three Nines) 8.77 hours 43.83 minutes 10.08 minutes 1.44 minutes 99.95%(Three and a half Nines) 4.38 hours 21.92 minutes 5.04 minutes 43.20 seconds 99.99%(Four Nines) 52.60 minutes 4.38 minutes 1.01 minutes 8.64 seconds 99.995%(Four and a half Nines) 26.30 minutes 2.19 minutes 30.24 seconds 4.32 seconds 99.999%(Five Nines) 5.26 minutes 26.30 seconds 6.05 seconds 864.0 ms Refer https://en.wikipedia.org/wiki/High_availability#Percentage_calculation HA - Availability Serial Components A System with components is operating in the series If the failure of a part leads to the combination becoming inoperable. For example, if LB in our architecture fails, all access to app tiers will fail. LB and app tiers are connected serially. The combined availability of the system is the product of individual components availability A = Ax x Ay x \u2026.. Refer http://www.eventhelix.com/RealtimeMantra/FaultHandling/system_reliability_availability.htm HA - Availability Parallel Components A System with components is operating in parallel If the failure of a part leads to the other part taking over the operations of the failed part. If we have more than one LB and if the rest of the LBs can take over the traffic during one LB failure then LBs are operating in parallel The combined availability of the system is A = 1 - ( (1-Ax) x (1-Ax) x \u2026.. ) Refer http://www.eventhelix.com/RealtimeMantra/FaultHandling/system_reliability_availability.htm HA - Core Principles Elimination of single points of failure (SPOF) This means adding redundancy to the system so that the failure of a component does not mean failure of the entire system. Reliable crossover In redundant systems, the crossover point itself tends to become a single point of failure. Reliable systems must provide for reliable crossover. Detection of failures as they occur If the two principles above are observed, then a user may never see a failure Refer https://en.wikipedia.org/wiki/High_availability#Principles HA - SPOF WHAT: Never implement and always eliminate single points of failure. WHEN TO USE: During architecture reviews and new designs. HOW TO USE: Identify single instances on architectural diagrams. Strive for active/active configurations. At the very least we should have a standby to take control when active instances fail. WHY: Maximize availability through multiple instances. KEY TAKEAWAYS: Strive for active/active rather than active/passive solutions. Use load balancers to balance traffic across instances of a service. Use control services with active/passive instances for patterns that require singletons. HA - Reliable Crossover WHAT: Ensure when system components failover they do so reliably. WHEN TO USE: During architecture reviews, failure modeling, and designs. HOW TO USE: Identify how available a system is during the crossover and ensure it is within acceptable limits. WHY: Maximize availability and ensure data handling semantics are preserved. KEY TAKEAWAYS: Strive for active/active rather than active/passive solutions, they have a lesser risk of cross over being unreliable. Use LB and the right load balancing methods to ensure reliable failover. Model and build your data systems to ensure data is correctly handled when crossover happens. Generally, DB systems follow active/passive semantics for writes. Masters accept writes and when the master goes down, the follower is promoted to master(active from being passive) to accept writes. We have to be careful here that the cutover never introduces more than one master. This problem is called a split brain. Applications in SRE role SRE works on deciding an acceptable SLA and make sure the system is available to achieve the SLA SRE is involved in architecture design right from building the data center to make sure the site is not affected by a network switch, hardware, power, or software failures SRE also run mock drills of failures to see how the system behaves in uncharted territory and comes up with a plan to improve availability if there are misses. https://engineering.linkedin.com/blog/2017/11/resilience-engineering-at-linkedin-with-project-waterbear Post our understanding about HA, our architecture diagram looks something like this below","title":"Availability"},{"location":"systems_design/availability/#ha-availability-common-nines","text":"Availability is generally expressed as \u201cNines\u201d, common \u2018Nines\u2019 are listed below. Availability % Downtime per year Downtime per month Downtime per week Downtime per day 99%(Two Nines) 3.65 days 7.31 hours 1.68 hours 14.40 minutes 99.5%(Two and a half Nines) 1.83 days 3.65 hours 50.40 minutes 7.20 minutes 99.9%(Three Nines) 8.77 hours 43.83 minutes 10.08 minutes 1.44 minutes 99.95%(Three and a half Nines) 4.38 hours 21.92 minutes 5.04 minutes 43.20 seconds 99.99%(Four Nines) 52.60 minutes 4.38 minutes 1.01 minutes 8.64 seconds 99.995%(Four and a half Nines) 26.30 minutes 2.19 minutes 30.24 seconds 4.32 seconds 99.999%(Five Nines) 5.26 minutes 26.30 seconds 6.05 seconds 864.0 ms","title":"HA - Availability - Common \u201cNines\u201d"},{"location":"systems_design/availability/#refer","text":"https://en.wikipedia.org/wiki/High_availability#Percentage_calculation","title":"Refer"},{"location":"systems_design/availability/#ha-availability-serial-components","text":"A System with components is operating in the series If the failure of a part leads to the combination becoming inoperable. For example, if LB in our architecture fails, all access to app tiers will fail. LB and app tiers are connected serially. The combined availability of the system is the product of individual components availability A = Ax x Ay x \u2026..","title":"HA - Availability Serial Components"},{"location":"systems_design/availability/#refer_1","text":"http://www.eventhelix.com/RealtimeMantra/FaultHandling/system_reliability_availability.htm","title":"Refer"},{"location":"systems_design/availability/#ha-availability-parallel-components","text":"A System with components is operating in parallel If the failure of a part leads to the other part taking over the operations of the failed part. If we have more than one LB and if the rest of the LBs can take over the traffic during one LB failure then LBs are operating in parallel The combined availability of the system is A = 1 - ( (1-Ax) x (1-Ax) x \u2026.. )","title":"HA - Availability Parallel Components"},{"location":"systems_design/availability/#refer_2","text":"http://www.eventhelix.com/RealtimeMantra/FaultHandling/system_reliability_availability.htm","title":"Refer"},{"location":"systems_design/availability/#ha-core-principles","text":"Elimination of single points of failure (SPOF) This means adding redundancy to the system so that the failure of a component does not mean failure of the entire system. Reliable crossover In redundant systems, the crossover point itself tends to become a single point of failure. Reliable systems must provide for reliable crossover. Detection of failures as they occur If the two principles above are observed, then a user may never see a failure","title":"HA - Core Principles"},{"location":"systems_design/availability/#refer_3","text":"https://en.wikipedia.org/wiki/High_availability#Principles","title":"Refer"},{"location":"systems_design/availability/#ha-spof","text":"WHAT: Never implement and always eliminate single points of failure. WHEN TO USE: During architecture reviews and new designs. HOW TO USE: Identify single instances on architectural diagrams. Strive for active/active configurations. At the very least we should have a standby to take control when active instances fail. WHY: Maximize availability through multiple instances. KEY TAKEAWAYS: Strive for active/active rather than active/passive solutions. Use load balancers to balance traffic across instances of a service. Use control services with active/passive instances for patterns that require singletons.","title":"HA - SPOF"},{"location":"systems_design/availability/#ha-reliable-crossover","text":"WHAT: Ensure when system components failover they do so reliably. WHEN TO USE: During architecture reviews, failure modeling, and designs. HOW TO USE: Identify how available a system is during the crossover and ensure it is within acceptable limits. WHY: Maximize availability and ensure data handling semantics are preserved. KEY TAKEAWAYS: Strive for active/active rather than active/passive solutions, they have a lesser risk of cross over being unreliable. Use LB and the right load balancing methods to ensure reliable failover. Model and build your data systems to ensure data is correctly handled when crossover happens. Generally, DB systems follow active/passive semantics for writes. Masters accept writes and when the master goes down, the follower is promoted to master(active from being passive) to accept writes. We have to be careful here that the cutover never introduces more than one master. This problem is called a split brain.","title":"HA - Reliable Crossover"},{"location":"systems_design/availability/#applications-in-sre-role","text":"SRE works on deciding an acceptable SLA and make sure the system is available to achieve the SLA SRE is involved in architecture design right from building the data center to make sure the site is not affected by a network switch, hardware, power, or software failures SRE also run mock drills of failures to see how the system behaves in uncharted territory and comes up with a plan to improve availability if there are misses. https://engineering.linkedin.com/blog/2017/11/resilience-engineering-at-linkedin-with-project-waterbear Post our understanding about HA, our architecture diagram looks something like this below","title":"Applications in SRE role"},{"location":"systems_design/conclusion/","text":"Conclusion Armed with these principles, we hope the course will give a fresh perspective to design software systems. It might be over-engineering to get all this on day zero. But some are really important from day 0 like eliminating single points of failure, making scalable services by just increasing replicas. As a bottleneck is reached, we can split code by services, shard data to scale. As the organization matures, bringing in chaos engineering to measure how systems react to failure will help in designing robust software systems.","title":"Conclusion"},{"location":"systems_design/conclusion/#conclusion","text":"Armed with these principles, we hope the course will give a fresh perspective to design software systems. It might be over-engineering to get all this on day zero. But some are really important from day 0 like eliminating single points of failure, making scalable services by just increasing replicas. As a bottleneck is reached, we can split code by services, shard data to scale. As the organization matures, bringing in chaos engineering to measure how systems react to failure will help in designing robust software systems.","title":"Conclusion"},{"location":"systems_design/fault-tolerance/","text":"Fault Tolerance Failures are not avoidable in any system and will happen all the time, hence we need to build systems that can tolerate failures or recover from them. In systems, failure is the norm rather than the exception. \"Anything that can go wrong will go wrong\u201d -- Murphy\u2019s Law \u201cComplex systems contain changing mixtures of failures latent within them\u201d -- How Complex Systems Fail. Fault Tolerance - Failure Metrics Common failure metrics that get measured and tracked for any system. Mean time to repair (MTTR): The average time to repair and restore a failed system. Mean time between failures (MTBF): The average operational time between one device failure or system breakdown and the next. Mean time to failure (MTTF): The average time a device or system is expected to function before it fails. Mean time to detect (MTTD): The average time between the onset of a problem and when the organization detects it. Mean time to investigate (MTTI): The average time between the detection of an incident and when the organization begins to investigate its cause and solution. Mean time to restore service (MTRS): The average elapsed time from the detection of an incident until the affected system or component is again available to users. Mean time between system incidents (MTBSI): The average elapsed time between the detection of two consecutive incidents. MTBSI can be calculated by adding MTBF and MTRS (MTBSI = MTBF + MTRS). Failure rate: Another reliability metric, which measures the frequency with which a component or system fails. It is expressed as a number of failures over a unit of time. Refer https://www.splunk.com/en_us/data-insider/what-is-mean-time-to-repair.html Fault Tolerance - Fault Isolation Terms Systems should have a short circuit. Say in our content sharing system, if \u201cNotifications\u201d is not working, the site should gracefully handle that failure by removing the functionality instead of taking the whole site down. Swimlane is one of the commonly used fault isolation methodologies. Swimlane adds a barrier to the service from other services so that failure on either of them won\u2019t affect the other. Say we roll out a new feature \u2018Advertisement\u2019 in our content sharing app. We can have two architectures If Ads are generated on the fly synchronously during each Newsfeed request, the faults in the Ads feature get propagated to the Newsfeed feature. Instead if we swimlane the \u201cGeneration of Ads\u201d service and use a shared storage to populate Newsfeed App, Ads failures won\u2019t cascade to Newsfeed, and worst case if Ads don\u2019t meet SLA , we can have Newsfeed without Ads. Let's take another example, we have come up with a new model for our Content sharing App. Here we roll out an enterprise content sharing App where enterprises pay for the service and the content should never be shared outside the enterprise. Swimlane Principles Principle 1: Nothing is shared (also known as \u201cshare as little as possible\u201d). The less that is shared within a swim lane, the more fault isolative the swim lane becomes. (as shown in Enterprise use-case) Principle 2: Nothing crosses a swim lane boundary. Synchronous (defined by expecting a request\u2014not the transfer protocol) communication never crosses a swim lane boundary; if it does, the boundary is drawn incorrectly. (as shown in Ads feature) Swimlane Approaches Approach 1: Swim lane the money-maker. Never allow your cash register to be compromised by other systems. (Tier 1 vs Tier 2 in enterprise use case) Approach 2: Swim lane the biggest sources of incidents. Identify the recurring causes of pain and isolate them. (if Ads feature is in code yellow, swim laning it is the best option) Approach 3: Swim lane natural barriers. Customer boundaries make good swim lanes. (Public vs Enterprise customers) Refer https://learning.oreilly.com/library/view/the-art-of/9780134031408/ch21.html#ch21 Applications in SRE role Work with the DC tech or cloud team to distribute infrastructure such that its immune to switch or power failures by creating fault zones within a Data Center https://docs.microsoft.com/en-us/azure/virtual-machines/manage-availability#use-availability-zones-to-protect-from-datacenter-level-failures Work with the partners and design interaction between services such that one service breakdown is not amplified in a cascading fashion to all upstreams","title":"Fault Tolerance"},{"location":"systems_design/fault-tolerance/#fault-tolerance","text":"Failures are not avoidable in any system and will happen all the time, hence we need to build systems that can tolerate failures or recover from them. In systems, failure is the norm rather than the exception. \"Anything that can go wrong will go wrong\u201d -- Murphy\u2019s Law \u201cComplex systems contain changing mixtures of failures latent within them\u201d -- How Complex Systems Fail.","title":"Fault Tolerance"},{"location":"systems_design/fault-tolerance/#fault-tolerance-failure-metrics","text":"Common failure metrics that get measured and tracked for any system. Mean time to repair (MTTR): The average time to repair and restore a failed system. Mean time between failures (MTBF): The average operational time between one device failure or system breakdown and the next. Mean time to failure (MTTF): The average time a device or system is expected to function before it fails. Mean time to detect (MTTD): The average time between the onset of a problem and when the organization detects it. Mean time to investigate (MTTI): The average time between the detection of an incident and when the organization begins to investigate its cause and solution. Mean time to restore service (MTRS): The average elapsed time from the detection of an incident until the affected system or component is again available to users. Mean time between system incidents (MTBSI): The average elapsed time between the detection of two consecutive incidents. MTBSI can be calculated by adding MTBF and MTRS (MTBSI = MTBF + MTRS). Failure rate: Another reliability metric, which measures the frequency with which a component or system fails. It is expressed as a number of failures over a unit of time.","title":"Fault Tolerance - Failure Metrics"},{"location":"systems_design/fault-tolerance/#refer","text":"https://www.splunk.com/en_us/data-insider/what-is-mean-time-to-repair.html","title":"Refer"},{"location":"systems_design/fault-tolerance/#fault-tolerance-fault-isolation-terms","text":"Systems should have a short circuit. Say in our content sharing system, if \u201cNotifications\u201d is not working, the site should gracefully handle that failure by removing the functionality instead of taking the whole site down. Swimlane is one of the commonly used fault isolation methodologies. Swimlane adds a barrier to the service from other services so that failure on either of them won\u2019t affect the other. Say we roll out a new feature \u2018Advertisement\u2019 in our content sharing app. We can have two architectures If Ads are generated on the fly synchronously during each Newsfeed request, the faults in the Ads feature get propagated to the Newsfeed feature. Instead if we swimlane the \u201cGeneration of Ads\u201d service and use a shared storage to populate Newsfeed App, Ads failures won\u2019t cascade to Newsfeed, and worst case if Ads don\u2019t meet SLA , we can have Newsfeed without Ads. Let's take another example, we have come up with a new model for our Content sharing App. Here we roll out an enterprise content sharing App where enterprises pay for the service and the content should never be shared outside the enterprise.","title":"Fault Tolerance - Fault Isolation Terms"},{"location":"systems_design/fault-tolerance/#swimlane-principles","text":"Principle 1: Nothing is shared (also known as \u201cshare as little as possible\u201d). The less that is shared within a swim lane, the more fault isolative the swim lane becomes. (as shown in Enterprise use-case) Principle 2: Nothing crosses a swim lane boundary. Synchronous (defined by expecting a request\u2014not the transfer protocol) communication never crosses a swim lane boundary; if it does, the boundary is drawn incorrectly. (as shown in Ads feature)","title":"Swimlane Principles"},{"location":"systems_design/fault-tolerance/#swimlane-approaches","text":"Approach 1: Swim lane the money-maker. Never allow your cash register to be compromised by other systems. (Tier 1 vs Tier 2 in enterprise use case) Approach 2: Swim lane the biggest sources of incidents. Identify the recurring causes of pain and isolate them. (if Ads feature is in code yellow, swim laning it is the best option) Approach 3: Swim lane natural barriers. Customer boundaries make good swim lanes. (Public vs Enterprise customers)","title":"Swimlane Approaches"},{"location":"systems_design/fault-tolerance/#refer_1","text":"https://learning.oreilly.com/library/view/the-art-of/9780134031408/ch21.html#ch21","title":"Refer"},{"location":"systems_design/fault-tolerance/#applications-in-sre-role","text":"Work with the DC tech or cloud team to distribute infrastructure such that its immune to switch or power failures by creating fault zones within a Data Center https://docs.microsoft.com/en-us/azure/virtual-machines/manage-availability#use-availability-zones-to-protect-from-datacenter-level-failures Work with the partners and design interaction between services such that one service breakdown is not amplified in a cascading fashion to all upstreams","title":"Applications in SRE role"},{"location":"systems_design/intro/","text":"Systems Design Prerequisites Fundamentals of common software system components: Linux Basics Linux Networking Databases RDBMS NoSQL Concepts What to expect from this course Thinking about and designing for scalability, availability, and reliability of large scale software systems. What is not covered under this course Individual software components\u2019 scalability and reliability concerns like e.g. Databases, while the same scalability principles and thinking can be applied, these individual components have their own specific nuances when scaling them and thinking about their reliability. More light will be shed on concepts rather than on setting up and configuring components like Loadbalancers to achieve scalability, availability, and reliability of systems Course Contents Introduction Scalability High Availability Fault Tolerance Introduction So, how do you go about learning to design a system? \u201d Like most great questions, it showed a level of naivety that was breathtaking. The only short answer I could give was, essentially, that you learned how to design a system by designing systems and finding out what works and what doesn\u2019t work.\u201d Jim Waldo, Sun Microsystems, On System Design As software and hardware systems have multiple moving parts, we need to think about how those parts will grow, their failure modes, their inter-dependencies, how it will impact the users and the business. There is no one-shot method or way to learn or do system design, we only learn to design systems by designing and iterating on them. This course will be a starter to make one think about scalability, availability, and fault tolerance during systems design. Backstory Let\u2019s design a simple content sharing application where users can share photos, media in our application which can be liked by their friends. Let\u2019s start with a simple design of the application and evolve it as we learn system design concepts","title":"Introduction"},{"location":"systems_design/intro/#systems-design","text":"","title":"Systems Design"},{"location":"systems_design/intro/#prerequisites","text":"Fundamentals of common software system components: Linux Basics Linux Networking Databases RDBMS NoSQL Concepts","title":"Prerequisites"},{"location":"systems_design/intro/#what-to-expect-from-this-course","text":"Thinking about and designing for scalability, availability, and reliability of large scale software systems.","title":"What to expect from this course"},{"location":"systems_design/intro/#what-is-not-covered-under-this-course","text":"Individual software components\u2019 scalability and reliability concerns like e.g. Databases, while the same scalability principles and thinking can be applied, these individual components have their own specific nuances when scaling them and thinking about their reliability. More light will be shed on concepts rather than on setting up and configuring components like Loadbalancers to achieve scalability, availability, and reliability of systems","title":"What is not covered under this course"},{"location":"systems_design/intro/#course-contents","text":"Introduction Scalability High Availability Fault Tolerance","title":"Course Contents"},{"location":"systems_design/intro/#introduction","text":"So, how do you go about learning to design a system? \u201d Like most great questions, it showed a level of naivety that was breathtaking. The only short answer I could give was, essentially, that you learned how to design a system by designing systems and finding out what works and what doesn\u2019t work.\u201d Jim Waldo, Sun Microsystems, On System Design As software and hardware systems have multiple moving parts, we need to think about how those parts will grow, their failure modes, their inter-dependencies, how it will impact the users and the business. There is no one-shot method or way to learn or do system design, we only learn to design systems by designing and iterating on them. This course will be a starter to make one think about scalability, availability, and fault tolerance during systems design.","title":"Introduction"},{"location":"systems_design/intro/#backstory","text":"Let\u2019s design a simple content sharing application where users can share photos, media in our application which can be liked by their friends. Let\u2019s start with a simple design of the application and evolve it as we learn system design concepts","title":"Backstory"},{"location":"systems_design/scalability/","text":"Scalability What does scalability mean for a system/service? A system is composed of services/components, each service/component scalability needs to be tackled separately, and the scalability of the system as a whole. A service is said to be scalable if, as resources are added to the system, it results in increased performance in a manner proportional to resources added An always-on service is said to be scalable if adding resources to facilitate redundancy does not result in a loss of performance Refer https://www.allthingsdistributed.com/2006/03/a_word_on_scalability.html Scalability - AKF Scale Cube The Scale Cube is a model for segmenting services, defining microservices, and scaling products. It also creates a common language for teams to discuss scale related options in designing solutions. The following section talks about certain scaling patterns based on our inferences from the AKF cube Scalability - Horizontal scaling Horizontal scaling stands for cloning of an application or service such that work can easily be distributed across instances with absolutely no bias. Let's see how our monolithic application improves with this principle Here DB is scaled separately from the application. This is to let you know each component\u2019s scaling capabilities can be different. Usually, web applications can be scaled by adding resources unless there is no state stored inside the application. But DBs can be scaled only for Reads by adding more followers but Writes have to go to only one leader to make sure data is consistent. There are some DBs that support multi-leader writes but we are keeping them out of scope at this point. Apps should be able to differentiate between Reads and Writes to choose appropriate DB servers. Load balancers can split traffic between identical servers transparently. WHAT: Duplication of services or databases to spread transaction load. WHEN TO USE: Databases with a very high read-to-write ratio (5:1 or greater\u2014the higher the better). Because only read replicas of DBs can be scaled, not the Leader. HOW TO USE: Simply clone services and implement a load balancer. For databases, ensure that the accessing code understands the difference between a read and a write. WHY: Allows for the fast scale of transactions at the cost of duplicated data and functionality. KEY TAKEAWAYS: This is fast to implement, is a low cost from a developer effort perspective, and can scale transaction volumes nicely. However, they tend to be high cost from the perspective of the operational cost of data. The cost here means if we have 3 followers and 1 Leader DB, the same database will be stored as 4 copies in the 4 servers. Hence added storage cost Refer https://learning.oreilly.com/library/view/the-art-of/9780134031408/ch23.html Scalability Pattern - Load Balancing Improves the distribution of workloads across multiple computing resources, such as computers, a computer cluster, network links, central processing units, or disk drives. A commonly used technique is load balancing traffic across identical server clusters. A similar philosophy is used to load balance traffic across network links by ECMP , disk drives by RAID ,etc Aims to optimize resource use, maximize throughput, minimize response time, and avoid overload of any single resource. Using multiple components with load balancing instead of a single component may increase reliability and availability through redundancy. In our updated architecture diagram we have 4 servers to handle app traffic instead of a single server The device or system that performs load balancing is called a load balancer, abbreviated as LB. Refer https://en.wikipedia.org/wiki/Load_balancing_(computing) https://blog.envoyproxy.io/introduction-to-modern-network-load-balancing-and-proxying-a57f6ff80236 https://learning.oreilly.com/library/view/load-balancing-in/9781492038009/ https://learning.oreilly.com/library/view/practical-load-balancing/9781430236801/ http://shop.oreilly.com/product/9780596000509.do Scalability Pattern - LB Tasks What does an LB do? Service discovery: What backends are available in the system? In our architecture, 4 servers are available to serve App traffic. LB acts as a single endpoint that clients can use transparently to reach one of the 4 servers. Health checking: What backends are currently healthy and available to accept requests? If one out of the 4 App servers turns bad, LB should automatically short circuit the path so that clients don\u2019t sense any application downtime Load balancing: What algorithm should be used to balance individual requests across the healthy backends? There are many algorithms to distribute traffic across one of the four servers. Based on observations/experience, SRE can pick the algorithm that suits their pattern Scalability Pattern - LB Methods Common Load Balancing Methods Least Connection Method directs traffic to the server with the fewest active connections. Most useful when there are a large number of persistent connections in the traffic unevenly distributed between the servers. Works if clients maintain long-lived connections Least Response Time Method directs traffic to the server with the fewest active connections and the lowest average response time. Here response time is used to provide feedback of the server\u2019s health Round Robin Method rotates servers by directing traffic to the first available server and then moves that server to the bottom of the queue. Most useful when servers are of equal specification and there are not many persistent connections. IP Hash the IP address of the client determines which server receives the request. This can sometimes cause skewness in distribution but is useful if apps store some state locally and need some stickiness More advanced client/server-side example techniques - https://docs.nginx.com/nginx/admin-guide/load-balancer/ - http://cbonte.github.io/haproxy-dconv/2.2/intro.html#3.3.5 - https://twitter.github.io/finagle/guide/Clients.html#load-balancing Scalability Pattern - Caching - Content Delivery Networks (CDN) CDNs are added closer to the client\u2019s location. If the app has static data like images, Javascript, CSS which don\u2019t change very often, they can be cached. Since our example is a content sharing site, static content can be cached in CDNs with a suitable expiry. WHAT: Use CDNs (content delivery networks) to offload traffic from your site. WHEN TO USE: When speed improvements and scale warrant the additional cost. HOW TO USE: Most CDNs leverage DNS to serve content on your site\u2019s behalf. Thus you may need to make minor DNS changes or additions and move content to be served from new subdomains. Eg media-exp1.licdn.com is a domain used by Linkedin to serve static content Here a CNAME points the domain to the DNS of the CDN provider dig media-exp1.licdn.com +short 2-01-2c3e-005c.cdx.cedexis.net. WHY: CDNs help offload traffic spikes and are often economical ways to scale parts of a site\u2019s traffic. They also often substantially improve page download times. KEY TAKEAWAYS: CDNs are a fast and simple way to offset the spikiness of traffic as well as traffic growth in general. Make sure you perform a cost-benefit analysis and monitor the CDN usage. If CDNs have a lot of cache misses, then we don\u2019t gain much from CDN and are still serving requests using our compute resources. Scalability - Microservices This pattern represents the separation of work by service or function within the application. Microservices are meant to address the issues associated with growth and complexity in the code base and data sets. The intent is to create fault isolation as well as to reduce response times. Microservices can scale transactions, data sizes, and codebase sizes. They are most effective in scaling the size and complexity of your codebase. They tend to cost a bit more than horizontal scaling because the engineering team needs to rewrite services or, at the very least, disaggregate them from the original monolithic application. WHAT: Sometimes referred to as scale through services or resources, this rule focuses on scaling by splitting data sets, transactions, and engineering teams along verb (services) or noun (resources) boundaries. WHEN TO USE: Very large data sets where relations between data are not necessary. Large, complex systems where scaling engineering resources requires specialization. HOW TO USE: Split up actions by using verbs, or resources by using nouns, or use a mix. Split both the services and the data along the lines defined by the verb/noun approach. WHY: Allows for efficient scaling of not only transactions but also very large data sets associated with those transactions. It also allows for the efficient scaling of teams. KEY TAKEAWAYS: Microservices allow for efficient scaling of transactions, large data sets, and can help with fault isolation. It helps reduce the communication overhead of teams. The codebase becomes less complex as disjoint features are decoupled and spun as new services thereby letting each service scale independently specific to its requirement. Refer https://learning.oreilly.com/library/view/the-art-of/9780134031408/ch23.html Scalability - Sharding This pattern represents the separation of work based on attributes that are looked up to or determined at the time of the transaction. Most often, these are implemented as splits by requestor, customer, or client. Very often, a lookup service or deterministic algorithm will need to be written for these types of splits. Sharding aids in scaling transaction growth, scaling instruction sets, and decreasing processing time (the last by limiting the data necessary to perform any transaction). This is more effective at scaling growth in customers or clients. It can aid with disaster recovery efforts, and limit the impact of incidents to only a specific segment of customers. Here the auth data is sharded based on user names so that DBs can respond faster as the amount of data DBs have to work on has drastically reduced during queries. There can be other ways to split Here the whole data center is split and replicated and clients are directed to a data center based on their geography. This helps in improving performance as clients are directed to the closest data center and performance increases as we add more data centers. There are some replication and consistency overhead with this approach one needs to be aware of. This also gives fault tolerance by rolling out test features to one site and rollback if there is an impact to that geography WHAT: This is very often a split by some unique aspect of the customer such as customer ID, name, geography, and so on. WHEN TO USE: Very large, similar data sets such as large and rapidly growing customer bases or when the response time for a geographically distributed customer base is important. HOW TO USE: Identify something you know about the customer, such as customer ID, last name, geography, or device, and split or partition both data and services based on that attribute. WHY: Rapid customer growth exceeds other forms of data growth, or you have the need to perform fault isolation between certain customer groups as you scale. KEY TAKEAWAYS: Shards are effective at helping you to scale customer bases but can also be applied to other very large data sets that can\u2019t be pulled apart using the microservices methodology. Refer https://learning.oreilly.com/library/view/the-art-of/9780134031408/ch23.html Applications in SRE role SREs in coordination with the network team work on how to map users' traffic to a particular site. https://engineering.linkedin.com/blog/2017/05/trafficshift--load-testing-at-scale SREs work closely with the Dev team to split monoliths to multiple microservices that are easy to run and manage SREs work on improving Load Balancers' reliability, service discovery, and performance SREs work closely to split Data into shards and manage data integrity and consistency. https://engineering.linkedin.com/espresso/introducing-espresso-linkedins-hot-new-distributed-document-store SREs work to set up, configure, and improve the CDN cache hit rate.","title":"Scalability"},{"location":"systems_design/scalability/#scalability","text":"What does scalability mean for a system/service? A system is composed of services/components, each service/component scalability needs to be tackled separately, and the scalability of the system as a whole. A service is said to be scalable if, as resources are added to the system, it results in increased performance in a manner proportional to resources added An always-on service is said to be scalable if adding resources to facilitate redundancy does not result in a loss of performance","title":"Scalability"},{"location":"systems_design/scalability/#refer","text":"https://www.allthingsdistributed.com/2006/03/a_word_on_scalability.html","title":"Refer"},{"location":"systems_design/scalability/#scalability-akf-scale-cube","text":"The Scale Cube is a model for segmenting services, defining microservices, and scaling products. It also creates a common language for teams to discuss scale related options in designing solutions. The following section talks about certain scaling patterns based on our inferences from the AKF cube","title":"Scalability - AKF Scale Cube"},{"location":"systems_design/scalability/#scalability-horizontal-scaling","text":"Horizontal scaling stands for cloning of an application or service such that work can easily be distributed across instances with absolutely no bias. Let's see how our monolithic application improves with this principle Here DB is scaled separately from the application. This is to let you know each component\u2019s scaling capabilities can be different. Usually, web applications can be scaled by adding resources unless there is no state stored inside the application. But DBs can be scaled only for Reads by adding more followers but Writes have to go to only one leader to make sure data is consistent. There are some DBs that support multi-leader writes but we are keeping them out of scope at this point. Apps should be able to differentiate between Reads and Writes to choose appropriate DB servers. Load balancers can split traffic between identical servers transparently. WHAT: Duplication of services or databases to spread transaction load. WHEN TO USE: Databases with a very high read-to-write ratio (5:1 or greater\u2014the higher the better). Because only read replicas of DBs can be scaled, not the Leader. HOW TO USE: Simply clone services and implement a load balancer. For databases, ensure that the accessing code understands the difference between a read and a write. WHY: Allows for the fast scale of transactions at the cost of duplicated data and functionality. KEY TAKEAWAYS: This is fast to implement, is a low cost from a developer effort perspective, and can scale transaction volumes nicely. However, they tend to be high cost from the perspective of the operational cost of data. The cost here means if we have 3 followers and 1 Leader DB, the same database will be stored as 4 copies in the 4 servers. Hence added storage cost","title":"Scalability - Horizontal scaling"},{"location":"systems_design/scalability/#refer_1","text":"https://learning.oreilly.com/library/view/the-art-of/9780134031408/ch23.html","title":"Refer"},{"location":"systems_design/scalability/#scalability-pattern-load-balancing","text":"Improves the distribution of workloads across multiple computing resources, such as computers, a computer cluster, network links, central processing units, or disk drives. A commonly used technique is load balancing traffic across identical server clusters. A similar philosophy is used to load balance traffic across network links by ECMP , disk drives by RAID ,etc Aims to optimize resource use, maximize throughput, minimize response time, and avoid overload of any single resource. Using multiple components with load balancing instead of a single component may increase reliability and availability through redundancy. In our updated architecture diagram we have 4 servers to handle app traffic instead of a single server The device or system that performs load balancing is called a load balancer, abbreviated as LB.","title":"Scalability Pattern - Load Balancing"},{"location":"systems_design/scalability/#refer_2","text":"https://en.wikipedia.org/wiki/Load_balancing_(computing) https://blog.envoyproxy.io/introduction-to-modern-network-load-balancing-and-proxying-a57f6ff80236 https://learning.oreilly.com/library/view/load-balancing-in/9781492038009/ https://learning.oreilly.com/library/view/practical-load-balancing/9781430236801/ http://shop.oreilly.com/product/9780596000509.do","title":"Refer"},{"location":"systems_design/scalability/#scalability-pattern-lb-tasks","text":"What does an LB do?","title":"Scalability Pattern - LB Tasks"},{"location":"systems_design/scalability/#service-discovery","text":"What backends are available in the system? In our architecture, 4 servers are available to serve App traffic. LB acts as a single endpoint that clients can use transparently to reach one of the 4 servers.","title":"Service discovery:"},{"location":"systems_design/scalability/#health-checking","text":"What backends are currently healthy and available to accept requests? If one out of the 4 App servers turns bad, LB should automatically short circuit the path so that clients don\u2019t sense any application downtime","title":"Health checking:"},{"location":"systems_design/scalability/#load-balancing","text":"What algorithm should be used to balance individual requests across the healthy backends? There are many algorithms to distribute traffic across one of the four servers. Based on observations/experience, SRE can pick the algorithm that suits their pattern","title":"Load balancing:"},{"location":"systems_design/scalability/#scalability-pattern-lb-methods","text":"Common Load Balancing Methods","title":"Scalability Pattern - LB Methods"},{"location":"systems_design/scalability/#least-connection-method","text":"directs traffic to the server with the fewest active connections. Most useful when there are a large number of persistent connections in the traffic unevenly distributed between the servers. Works if clients maintain long-lived connections","title":"Least Connection Method"},{"location":"systems_design/scalability/#least-response-time-method","text":"directs traffic to the server with the fewest active connections and the lowest average response time. Here response time is used to provide feedback of the server\u2019s health","title":"Least Response Time Method"},{"location":"systems_design/scalability/#round-robin-method","text":"rotates servers by directing traffic to the first available server and then moves that server to the bottom of the queue. Most useful when servers are of equal specification and there are not many persistent connections.","title":"Round Robin Method"},{"location":"systems_design/scalability/#ip-hash","text":"the IP address of the client determines which server receives the request. This can sometimes cause skewness in distribution but is useful if apps store some state locally and need some stickiness More advanced client/server-side example techniques - https://docs.nginx.com/nginx/admin-guide/load-balancer/ - http://cbonte.github.io/haproxy-dconv/2.2/intro.html#3.3.5 - https://twitter.github.io/finagle/guide/Clients.html#load-balancing","title":"IP Hash"},{"location":"systems_design/scalability/#scalability-pattern-caching-content-delivery-networks-cdn","text":"CDNs are added closer to the client\u2019s location. If the app has static data like images, Javascript, CSS which don\u2019t change very often, they can be cached. Since our example is a content sharing site, static content can be cached in CDNs with a suitable expiry. WHAT: Use CDNs (content delivery networks) to offload traffic from your site. WHEN TO USE: When speed improvements and scale warrant the additional cost. HOW TO USE: Most CDNs leverage DNS to serve content on your site\u2019s behalf. Thus you may need to make minor DNS changes or additions and move content to be served from new subdomains. Eg media-exp1.licdn.com is a domain used by Linkedin to serve static content Here a CNAME points the domain to the DNS of the CDN provider dig media-exp1.licdn.com +short 2-01-2c3e-005c.cdx.cedexis.net. WHY: CDNs help offload traffic spikes and are often economical ways to scale parts of a site\u2019s traffic. They also often substantially improve page download times. KEY TAKEAWAYS: CDNs are a fast and simple way to offset the spikiness of traffic as well as traffic growth in general. Make sure you perform a cost-benefit analysis and monitor the CDN usage. If CDNs have a lot of cache misses, then we don\u2019t gain much from CDN and are still serving requests using our compute resources.","title":"Scalability Pattern - Caching - Content Delivery Networks (CDN)"},{"location":"systems_design/scalability/#scalability-microservices","text":"This pattern represents the separation of work by service or function within the application. Microservices are meant to address the issues associated with growth and complexity in the code base and data sets. The intent is to create fault isolation as well as to reduce response times. Microservices can scale transactions, data sizes, and codebase sizes. They are most effective in scaling the size and complexity of your codebase. They tend to cost a bit more than horizontal scaling because the engineering team needs to rewrite services or, at the very least, disaggregate them from the original monolithic application. WHAT: Sometimes referred to as scale through services or resources, this rule focuses on scaling by splitting data sets, transactions, and engineering teams along verb (services) or noun (resources) boundaries. WHEN TO USE: Very large data sets where relations between data are not necessary. Large, complex systems where scaling engineering resources requires specialization. HOW TO USE: Split up actions by using verbs, or resources by using nouns, or use a mix. Split both the services and the data along the lines defined by the verb/noun approach. WHY: Allows for efficient scaling of not only transactions but also very large data sets associated with those transactions. It also allows for the efficient scaling of teams. KEY TAKEAWAYS: Microservices allow for efficient scaling of transactions, large data sets, and can help with fault isolation. It helps reduce the communication overhead of teams. The codebase becomes less complex as disjoint features are decoupled and spun as new services thereby letting each service scale independently specific to its requirement.","title":"Scalability - Microservices"},{"location":"systems_design/scalability/#refer_3","text":"https://learning.oreilly.com/library/view/the-art-of/9780134031408/ch23.html","title":"Refer"},{"location":"systems_design/scalability/#scalability-sharding","text":"This pattern represents the separation of work based on attributes that are looked up to or determined at the time of the transaction. Most often, these are implemented as splits by requestor, customer, or client. Very often, a lookup service or deterministic algorithm will need to be written for these types of splits. Sharding aids in scaling transaction growth, scaling instruction sets, and decreasing processing time (the last by limiting the data necessary to perform any transaction). This is more effective at scaling growth in customers or clients. It can aid with disaster recovery efforts, and limit the impact of incidents to only a specific segment of customers. Here the auth data is sharded based on user names so that DBs can respond faster as the amount of data DBs have to work on has drastically reduced during queries. There can be other ways to split Here the whole data center is split and replicated and clients are directed to a data center based on their geography. This helps in improving performance as clients are directed to the closest data center and performance increases as we add more data centers. There are some replication and consistency overhead with this approach one needs to be aware of. This also gives fault tolerance by rolling out test features to one site and rollback if there is an impact to that geography WHAT: This is very often a split by some unique aspect of the customer such as customer ID, name, geography, and so on. WHEN TO USE: Very large, similar data sets such as large and rapidly growing customer bases or when the response time for a geographically distributed customer base is important. HOW TO USE: Identify something you know about the customer, such as customer ID, last name, geography, or device, and split or partition both data and services based on that attribute. WHY: Rapid customer growth exceeds other forms of data growth, or you have the need to perform fault isolation between certain customer groups as you scale. KEY TAKEAWAYS: Shards are effective at helping you to scale customer bases but can also be applied to other very large data sets that can\u2019t be pulled apart using the microservices methodology.","title":"Scalability - Sharding"},{"location":"systems_design/scalability/#refer_4","text":"https://learning.oreilly.com/library/view/the-art-of/9780134031408/ch23.html","title":"Refer"},{"location":"systems_design/scalability/#applications-in-sre-role","text":"SREs in coordination with the network team work on how to map users' traffic to a particular site. https://engineering.linkedin.com/blog/2017/05/trafficshift--load-testing-at-scale SREs work closely with the Dev team to split monoliths to multiple microservices that are easy to run and manage SREs work on improving Load Balancers' reliability, service discovery, and performance SREs work closely to split Data into shards and manage data integrity and consistency. https://engineering.linkedin.com/espresso/introducing-espresso-linkedins-hot-new-distributed-document-store SREs work to set up, configure, and improve the CDN cache hit rate.","title":"Applications in SRE role"}]}
\ No newline at end of file
diff --git a/security/network_security/index.html b/security/network_security/index.html
index cc73467..d67fccd 100644
--- a/security/network_security/index.html
+++ b/security/network_security/index.html
@@ -1523,7 +1523,7 @@ Correspondence between layers of the TCP/IP architecture and the OSI model. Also
 <h3 id="pgp-smime-email-security">PGP &amp; S/MIME : Email Security</h3>
 <ul>
 <li>There are several security protocols at the application layer. The most used of these protocols are email security protocols namely PGP and S/MIME.</li>
-<li>SMTP (“Simple Mail Transfer Protocol”) is used for sending and delivering from a client to a server via port 25: it’s the outgoing server. On the contrary, POP (“Post Office Protocol”) allows the user to pick up the message and download it into his inbox: it’s the incoming server. The latest version of the Post Office Protocol is named POP3, and it’s been used since 1996; it uses port 110</li>
+<li>SMTP (“Simple Mail Transfer Protocol”) is used for sending and delivering from a client to a server via port 25: it’s the outgoing server. On the contrary, POP (“Post Office Protocol”) allows the users to pick up the message and download it into their inbox: it’s the incoming server. The latest version of the Post Office Protocol is named POP3, and it’s been used since 1996; it uses port 110</li>
 </ul>
 <p>PGP</p>
 <ul>
@@ -1540,9 +1540,9 @@ Correspondence between layers of the TCP/IP architecture and the OSI model. Also
 </ul>
 <p>S/MIME</p>
 <ul>
-<li>SMTP can only handle 7-bit ASCII text (You can use UTF-8 extensions to alleviate these limitations, ) messages. While POP can handle other content types besides 7-bit ASCII, POP may, under a common default setting, download all the messages stored in the mail server to the user's local computer. After that, if POP removes these messages from the mail server. This makes it difficult for the user to read his messages from multiple computers.</li>
+<li>SMTP can only handle 7-bit ASCII text (You can use UTF-8 extensions to alleviate these limitations, ) messages. While POP can handle other content types besides 7-bit ASCII, POP may, under a common default setting, download all the messages stored in the mail server to the user's local computer. After that, if POP removes these messages from the mail server. This makes it difficult for the users to read their messages from multiple computers.</li>
 <li>The Multipurpose Internet Mail Extension protocol (MIME) was designed to support sending and receiving email messages in various formats, including nontext files generated by word processors, graphics files, sound files, and video clips. Moreover, MIME allows a single message to include mixed types of data in any combination of these formats.</li>
-<li>The Internet Mail Access Protocol (IMAP), operated on TCP port 143(only for non-encrypted), stores (Configurable on both server &amp; client just like PoP) incoming email messages in the mail server until the user deletes them deliberately. This allows the user to access his mailbox from multiple machines and download messages to a local machine without deleting it from the mailbox in the mail server.</li>
+<li>The Internet Mail Access Protocol (IMAP), operated on TCP port 143(only for non-encrypted), stores (Configurable on both server &amp; client just like PoP) incoming email messages in the mail server until the user deletes them deliberately. This allows the users to access their mailbox from multiple machines and download messages to a local machine without deleting it from the mailbox in the mail server.</li>
 </ul>
 <p>SSL/TLS</p>
 <ul>
diff --git a/security/threats_attacks_defences/index.html b/security/threats_attacks_defences/index.html
index 01b565c..c0fe4bf 100644
--- a/security/threats_attacks_defences/index.html
+++ b/security/threats_attacks_defences/index.html
@@ -1604,12 +1604,12 @@ the typical time to live (TTL) for cached entries is a couple of hours, thereby
 <li>Injecting bogus route advertising information into the BGP-distributed routing database by malicious sources, accidentally or routers can disrupt Internet backbone operations. </li>
 <li>Blackholing traffic:</li>
 <li>Blackhole route is a network route, i.e., routing table entry, that goes nowhere and packets matching the route prefix are dropped or ignored. Blackhole routes can only be detected by monitoring the lost traffic.</li>
-<li>Blackhole routes are the best defence against many common viral attacks where the traffic is dropped from infected machines to/from command &amp; control masters.</li>
+<li>Blackhole routes are the best defence against many common viral attacks where the traffic is dropped from infected machines to/from command &amp; control hosts.</li>
 <li>
 <p>Infamous BGP Injection attack on Youtube</p>
 </li>
 <li>
-<p>EX: In 2008, Pakistan decided to block YouTube by creating a BGP route that led into a black hole. Instead, this routing information got transmitted to a hong kong ISP and from there accidentally got propagated to the rest of the world meaning millions were routed through to this black hole and therefore unable to access YouTube.</p>
+<p>Ex: In 2008, Pakistan decided to block YouTube by creating a BGP route that led into a black hole. Instead, this routing information got transmitted to a hong kong ISP and from there accidentally got propagated to the rest of the world meaning millions were routed through to this black hole and therefore unable to access YouTube.</p>
 </li>
 <li>Potentially, the greatest risk to BGP occurs in a denial of service attack in which a router is flooded with more packets than it can handle. Network overload and router resource exhaustion happen when the network begins carrying an excessive number of BGP messages, overloading the router control processors, memory, routing table and reducing the bandwidth available for data traffic.</li>
 <li>Refer: <a href="https://medium.com/bugbountywriteup/bgp-the-weak-link-in-the-internet-what-is-bgp-and-how-do-hackers-exploit-it-d899a68ba5bb">https://medium.com/bugbountywriteup/bgp-the-weak-link-in-the-internet-what-is-bgp-and-how-do-hackers-exploit-it-d899a68ba5bb</a></li>
diff --git a/sitemap.xml b/sitemap.xml
index 4144af6..6e5347d 100644
--- a/sitemap.xml
+++ b/sitemap.xml
@@ -1,187 +1,187 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9"><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>None</loc>
-     <lastmod>2020-11-30</lastmod>
+     <lastmod>2020-12-03</lastmod>
      <changefreq>daily</changefreq>
     </url>
 </urlset>
\ No newline at end of file
diff --git a/sitemap.xml.gz b/sitemap.xml.gz
index 194dc4009c0219c6625b6c522498e224a0665aa5..4a4f1727cdd779038f44872e95d3e0cdfac85150 100644
GIT binary patch
literal 217
zcmb2|=HQsua3Y@Re{p6>YHnhIUPW#W!`ritd`$)dtQTyTXY6VhyR$+w_4%c#at#ix
zY8RA(UGwz?d~BM3-re%|v%0_N`hCg%#*@D4J<n9KG+y^<YpL(K_0xm*Ja6s0lKkcb
zi`jJ9r+au4Ew~JQgPqJ~?32;>n5?`a>p6d?u85Ik!QMBoI&|Gj_gzYV-y?MTwe&QR
zs`%GFX-0mVBi=pxI4yVTD&5%Ryu~|T@7i)Vx^sTYTaAqd8xjsSv2u&)L?AK#t`=P@
QK68P+kw52;tHKNn05xV~a{vGU

literal 217
zcmV;~04Dz*iwFp_vcz8k|8r?{Wo=<_E_iKh0PW2|4uUWc1<*aGAl*X?Zq$^rbLmPC
zKuQG?Xt7g8Z!Zu`JcIe&wEgoZPnNHtkDta<=WM~URIu1s?dr}p1-o8O$)1%ek`LdL
z3GrOERIoOL@yPi!O(}K34An@f^9?86&L84i$VGZ!YS~p$yd2p(t<KIG$(PqRtSAhw
zR=LPUl4Z$G%;PQFD!Q#~V{YEuRb6%cTk@Y|?MS{buwcQ01q&7|Sg>Hhf&~i}ELgB$
T{i_wN7nz_w(~<R1)e`^!&*Erq

diff --git a/systems_design/images/availability.jpg b/systems_design/images/availability.jpg
index f1272283b8eeb69606393e72993c130c417319ba..7921e59e0ba9c0ac506a6f3a3cdd24a2db4488bb 100644
GIT binary patch
literal 123625
zcmeFZWk6M3^f!3uE~OihP(VTuX#^=L5v1YL-7RrJkWgAu1rd<0OLvJ#Nng68Brhpl
zb1usBpLgb+`8*%yd;|8`d+n9K6^FOaRpbb8sc``SAW)Eh`T_tjTL1u^9vc(<jm51i
zYyb!V6rMiO@S5D5A&RFRF<v>lv$fP-(xo`M9T9ZYXxAN8Ibr9q^Wg2GnMgl}Pvgpx
zQiD(5kG?I}vx(5}$x9~$uYULA5+qx|-op4PDNS3&sUG^@t-Oqs{YVvg7anlQ#Pm95
zM2Zp*T}oDy1_uw%7=L{B%uUZ=2(hj=@^a?o%)!c;&<g!`H_w+d>&1ExkH(G++d%66
z|L6Z}9FUJmPfy>3!{HP;IhHEDKkbO)M-`phpYaL{YtmCuZPU=w{@htZy&-#*hsu{k
zzY>z2o!wrxEW<1O2$~)d5%p45_Q$?&_suFm*lc&9J?RIB)yG>j^i3S^=f}p6hw63|
zxm@1Rr9HY?7C;y_wOSIX3e~j}cMDFQIZWuJ9iHrRk7^wY<`XvjHH=i~>t_H(UHxI`
zB56SHR)e9P@Qxbq!}|NTI?BC!pYHDzXlfJT->m$CW>Pyl8qy_C+tK~9Kr9q8a?m0x
zt0eAxvjAXn)gNBh*WoSyu<$&Ql<oV4qSm8$tRIOa0Vp?X+~U*$R_V|Ec8`^Ib;t{o
zSpc+~KdrK&@}TnE{1ot%31I%8KgyH-zx^@(F{TmT5j{nHR2s?AmIRZyh$8Uc4FQ=H
zRG2OOt0%M~`-#uHuF|S6*ik5N&H?(ur2&uS?3H}xrs>X(l3ABGz<*a}L}btgbgdD{
zeTK>$Go{V-T9e?k{P$)ZXFf`@{>nyW+J%0FRFg{6=l|22!GX9fdk^O*w3H=gJU&z}
zQ<ZLyb1ZC5l-pC(($zLHM)lZI=?XFbNO~}wxZIQEZ)aj+5~W9l)QLRwn<K2G>rs;N
zn;bsRa%d{|;^x?^H6*+&7)xQ`dL(RURPo;>B*Q0hTAD-~A%!1i<-N!xbqw{>KRj|S
z{2ulnKY=uGNusi2lv*c0i-o5l<iasN%GSn4ms8KsO-Im9v_FSb@*_S0fq71LcGF`q
zG1qt8@)cU|I5gi44wmlK`Y13!a{tmLnO{L2&~;F}0LOV;zoBTdpU(092b%<4-j1!E
zZ=UI~J5>04DPP(Pz?vzDJFvj1NuQTbSaV*H?C<OHk(y|*64mVpt<Yba_e<AW<k~~H
z!kL{#ZP~_Zu^{eD<5p3s_XED_HF)i2?c#pS{vHy#{m$%o`EVIm=v$O3&EIWqm5czJ
zO>1(d$3@3hO8zz8y>E_oHqO~$chWQf1&ZoHh|AMbS{>1P1V^k8t16_Jl8$@F`meT0
zE(DVVbdA0Ev)nqe@mEb*7G*%?%X=gs;QCloePgSkNw`cqiYIC+iQ_*TcuOG*{5}+Z
z*Q8(XK>@1JmYg#O4J)%VEr(Xop+K3Jnc4TH+gR7+1w3U&s&4@MTy!?2&ZaJC4i(Jd
z43v7Z{}eOe&z<W9kLRM<Ps@zjId4>QC>)3Y^=QFYB7^wGZV0ejuv-Aez9VMbn`Hxx
z$|&RC8avu;CC+Nc-OnRxT!vlIjewYdGm_vNJ+z7m0X9F%84_cuHZpC>f?DkBk@$bx
z{5`1SYKET-MY*OsNsOzvgpoAzHZr*Tn3dAL^xeL^9eW~$adWWI-G@M2YE0R~AtE6u
zr6^M5Exl%<>jcV<$3IlBZ!zy(t=LOEyRpBgPlix=gg*An-dhW$<sFSYXa#TLB=HUk
zux=B%d{3e|IUdoA`tPPQq`|;u_Xp{P{I#5^`}<X*%vBN)63hP2_VwpGBV*tFd?3VH
z{h~96&ab%8Zcnuz51F6xHMzBY|Nfn}y3G4vz2}%8O@8qrSDiV0xh@v!=98*$<5a%t
z3Zn5)o!8ihE)*5&NwEC*k<=Y)vK$+`+tk|Hil1f&Sl2SRo1}8r8k%t|Z7glv*m?lr
zh9>Yxyz=eN{eUtL7X#Cd->cd(n8v<!C|~EHX51$qwz2s5w4yj?JvS31WyyOGod|au
zjZ#i&4og}&a&Ab|xoNK~`Mx<4Sb)!WT|rbBx9WEE%gzepo&}q?lg>rDjXzGNE;3EY
zgt?KMe#L|cs&11NWLumBK7D?aG`NeJ+5Y!!V#OKk783!)e0CPn^zzLu_C4>o>bH||
z(6yD|nY;0Ku+d5mZOe^PaEvNB-fh7B!pU7cFs=UMnQz{|Xj3}025h=MoC`Ow{I%J)
z(GFU#-`1RZ?BmboJ>k7=B{sk#&EK~P8P|@Ob&x(|(9b;I8}hbWto^>a`f%}4638=A
z(7>;s@3J{)JhcxLM4QPZ$lmsKmF{NEek;MFOH?wzV4OJ0teMfW@bt?Q&Obh<;K;ZQ
z6=-bU$-3c$LOd$W{bBjY#S7}5<0VYztD%I+Jw_DD0MfbWCh^9HhLGH31C~d0$5v*e
ziTWb7eP<LL$+{GOPj)8B0ybwqAe3`zGx*7=0>L=*3;I3Rq}lx7BMv0<ot#|9JKq<7
zV-GPNx)IVm;AbSvVW~Yq1!LB7WZYETxBl4}<K<r)i#%ff&%UouS%|*2$04u(u}4Nw
zhmrOOuKmv*Z$$uwuWCUXG#T4{xPS}^oYOujpsn3<`d?p6>9MpV3imlmBlhU%YhWpU
zwS)mGXxQ#WnADAHKxYPqlk`043Zjl(%GcV5M+S{S(uteT)C9w6l{vS0UEG{Wx0u1-
zT|e@)sIb#JavpS|2O&GsQMckU+mY0XA7!%7n1V*1Rd7UdV*_^yQO4Wdn?`BHS#(*N
zySU{dL8eKHZpo!Kb#$t=sWnF5m?ER|5Pg8ohOfY<tpN_9)R#G9SfHu5T(EycNgmdH
z@34ej>QMYp;fCg?@~!}Dv$g-`PrW<%F8n$<qwYAoz*&&%@~G=_$4a-NJ{R!bP2%0D
zShn7V(tlhh8KMj@Xk3<e|Ef8@lv}1!NJQ=g0)!HQmG1sNvh?_*8eQP-8uV*wzSHmL
z2jU|t*P-;{<lSSRL%XTv(2^$Bt*NuX8t>n0RncHbO&))M45>-GSv0JytiNj#Mhdhb
zKXR!4a>^hn8&JYjLlo|h+!sPMnmx=^BWy{L;s&|%wvl0CTiIbM-HT&mRP`;W#4ca8
zUzwRTI667;w6XmQItH<cfRYL`8C)2GP_iUT2R7ALx-(b0xd~PV!U23qlWjRos<g?c
z$QUeATf9rpFRU5+gfh+H@A+=}x}Y;WEx0{QUq|)oG{FJO2rB*W^sc?-wTn{R50C70
z^tseTiorPlcrH}7<9-DC-=I|^|6Eu-MYw$Qr`@f6%R`~W!8NW@eKe$h&s9+vSK#xC
zV;&F|!&rFlD8UFltM)(RSeacxleJAx5(C0}R;VTM-I;;#k&4hyiSK$ti*pk{^v=Eg
z=}e~e*dJ$6ii)mx7YFN_&d1SC`8_Dw`*~5Urc?ns%d;13Qfar;FzxxA@ai8R?MU*L
zn=o)T{qx8~u=oGXgIsUtL{B$Cw@_V<L>m#@2CS^3KbV1f=#<)SZ;nb>zoV~;2-m{L
zwj5NVCNo%-)3$R*9%b|SYWSUg(lFx+tO^=Q)NQ$$<oAM;S!eS}=LSX~%BbEcIQba=
zm#cYFavq_D5D76vWt;8HX&xS(p)&}F>dvrC=A!#F!_TW9c-49L#I}rL#clX@#q=~0
z)k3Iz{Wj{^zE=}n%AYF-sNXroZqb0Y!IDe{=m#7CUh*u!Zsw<*dvp8`KJnUg@43MQ
ztebG~F@w2Ydb9*`h2yABUtF-!`OXwz?fFfiswEe^_F2U7Y%p;Q%T;e>V_Q+~`^*_s
zo1m%i)@wlN0BfcDqwBIICg|QCynO+TcHMgwr-53-@Yh4#MY4$>1YX@-=em{N%F=S0
z`e-}_oM*ENyVal49DV$FsFJ&WDOJ-^x%eS=8Q>TY5`q>D72|P5UMnIi!2rr@$Z^dR
zc{JfN5i1Z<_AM=)-ZNnPwYPw4FQ+*T?$>$Hx<_d1URy-OipED3FI2QI09$0S-ysVE
zlvvtedi@CuG@xgZk_B#{N(`o(nP=-ldpLJ$ihi?vF&?X8X^lzm>Z-Py7VD@Ay{Z&=
z{lg^x7k;0&4#q_Hq}oo6_$c?w`m|6{VKtRV0Y;Dn+#~^CQRpT}*wD(pq8qKB8u?c*
zhk1yAn1l6Es?WJiXovfTFG+xVgV>iDz$D_@^CB<ANU+)&RdW{;`AXW{D%Temy_ImF
za1numz$7+BH|p(4SlOa;(I`s^@tmJsyzz{@Pvtzmvj_p@?|kiNjq43ZPwoI4UOtlb
zDBmejl3inuXlu8=&XhiMe3`R;lZk{8370WHAV5j36i@ckeOmIr(6b3!ByB*V79pAK
z1e95=8`-@HjoJ)TR0J%P-{v}$r~V2DIN^r@9%x~_|2x-wEuxHY@D-%Q!j1kB^goVS
zF1$+(yw&wOU=Vo;B>!Y!*IeO5fVA~#m9G&tPP(5fbzJ-9>!nsv|Ld08AJKS(Og2DR
z_LOqTs!XMb=tiUiw4e~=Knat#UXxkMk7=akDD;9ZkL;09e&Ownpc`@V%l%(YR|YeZ
zj7go9f|oAw6AcKt8>^@b0}pq_Yx&*3>B<?T9(^06IC$jRm=cjrQ;rgJnnja;7Oelp
zqJRhK%pwcZs65qWCd>E1^bQ7_M4KdF{4sPZplcA4ntV9W+c{iv6OY_*K$2GkflnVl
zlJ_K1Adw%^6B+;2FQFM4&@Z~s>4*w9vLxCD80>fAjoiZ#QNVQ6!t}agy3Qm6-ki0y
zvOPH4F~GX)2_=UfwfeiRyl(S%)6(hOD+whO^*G7M33<@$dX;mvqo~K7)fB+(W+pei
zv;>Eo;WUGIQB$Nvm@Z(ZVn0hB6I4WbfLsa`-k?mi!+GZwU&X-%q{e3ot68kUwXb~6
zcQXx7XQ_F)f5|kc{I_|^y~oz(ASkqDWBcEFRip@Gh*vHX8<wQQ5BsZ88LM5|1qoB$
zw-O&<H25#!gL-KX1|#O6qTh6J8|%VIQo39&sxnQ^dL-UH1r94a{E1gr!FVzm$$k!X
z>aX(OmEqX2(cGFo^x3~$U6(k0*+;v1jtSYLzq@_!w(TOA1o;dKrU|ECpuR~VckZ26
ze~ks<)7Gmws#(;CfI$Dq#I8WEv(e|v<Xcxc{w`W4&fLZ^y5i@NXv|uW#%--U?g3J|
z30@fV;!lj;%F?>PZ2~$Y5TKfMRrAuB5TlHP4v_t_$?c8fbm$bQ4Q}J#xUPPuL0wmx
zy?)vrXGP(jO(qikoX7v>p}H$txm9<dP9aO)!2+mnKiQkB`?a>tC5NiVpj5oiBK=_I
z;yET{?sN+$dkF){F8D^{VwdVMLEvU)<`RD(oWe;)&I3P%0prm@dtTm$w!^-*gaS=l
zk(N5L038|Vz9FV=DsGDzmg&G8j19<~2@6a|G#@!Pw<a}q+B>lt>oh|z*cy~yX-kwn
zjzUT1`~(p-pd-un*#h-k&yeA#eJb~f4E{+l{^-|huJBt4;=j{lkFPqt^8$2GR1?lZ
zLbcFm(4b~*{Zb1zx58YG#YIKIr^dYr%~LL4Cr>CXfJdOWMO1I&v`E>4PFwhH*iJYx
zzVPty!<^}FC1B9!uW)rHXo36uoO6ISAr4y2j97yn&Ul!0vgG_4nJEB~9rAe{{KOe2
zct{iSl#p%$M}U`?mkk#s`K80;$&2BG)^kiF<HCIzq<xb;34y#Z8kk{TO1kHE6t>(>
zHtF$T3tYN%YV<0!vThm-iYOoOyHiF_-a~#k)m#2Ge93MMI!qZc(r0>pBnob3Y#MM>
z9$T^aU{zX25dhCM6;v`*7&|ue`5pA2zW+i))P09XWnLzTrQN&eMrEDcW}Pc*hW@?G
z-28<^tU<ioNMCv#>?*$D24zs=W)(GsaSE5+zW)wIyZoT_BZg6`Ht5$uC_VKJzZtuA
zfRHMN1yqGGtT^?9^(xnmVpEgh+Kv(rFa7F1WCjjCU!IH`KZi@DSBy}^%F202$p`_i
zx(q+LfDO>!AU(tk{4J8jMbAut>{<V%q=yZ5bD$vqdLhYFmEb38e>n-pUmUVfKnYP8
zKdi=e?<$uG*!c5rkD;#XJ>*>g3$hd49JL?UvE&+<=?|>&<W8kOpIi^u{=zJhzCa4X
z=G^gSzwLvmV{{`rM^MbDqbkRhX8m&c!NmB+iqe2Z5s^h2`QQd}cjP4k@*RSo%-|vg
z`W+KVMm4}m7z{*sFykXaAeM9DI$Upzu=POn$Zh-LA9$uc!3nxt+A2FPF%50+E${e#
zQGefLxICv|8BVhuwxZJXYW|8s+@;}^_GCIYSjxJ9+ax$@^9{1>fL97e5^Q<m`6MJg
z|G@_Sc>(;>sf7M;vNP4Unw>ED5IMtd=`d*|Z%d^?-Xfz=@HlA2=!~66exyp?fCQ&`
z7W{6%{V(JDLmLFC!p+Ca{q1Xl(eD@<q0i%0IZHV9R?1d8pDRS=ughNBOX6y$3OiDX
zh^NpdBOe8mKuH3b?5=Y(Btx(azkN{^-)UU8ViiDt|GIy?Ni|Hbn(}k^$DlNl4nv>9
z;)n7obnHRd7U=_ybFhs@IK@3Ag|!$)M17*1*Fi{7MdDtuUcDZ&S|f8$@kcniQ3Z`X
z-a}AlrIW8SIOIvxhB+wlwt6~dxeqH4eEm;i8mFtzTy_t+XKP?$wHAp}O)H$^+z)CU
zJlkt5<cJPr-VMa2K6gM#)&mi~N<<{L`=)j#aloKMMe*%<3MR^LQa3z-?NVc2oCr4S
zjX4jiP?{w~_FuLIBT_HdK1H21`K|_ZPQ&yl$6hMxUF*(xCa62QI4vNex@A$R9TE~!
zcFzV>9o>Oz)iZX&YnhfMBT^Alx!J#KQ2_t_@|>S-oYzHBcd!bLP$i`PbxexNfXhOq
za?~00s6kAV60Uj8ZxWE-u(h=h>V|DdFGFlrsVm!ocMs`<eAi`<$uzJ%dVWK$B)qVg
zKpr}nw|Bq15k?Fr^xK#9uv{O(cN3Op+-~EYYv)z;wMAKs@=@8szAjb8Xjc7r{+Tn|
zJ`T`t^q7^TNW+!~<JE1u88|#3sjmwxE4<N;xZE2Cb?11Xcc);6cr!}Qzu?s82bW$1
z?e<;JV}X^0k+YtEVI3)%7+Po>BL{I^Q9MaB15NQpMQrOpw4nt1A#HuN@G~2`IW}rk
z#uHbaCG6Z`M|%6!<9p4%apS(L??U`8`?QXPf}b>9yM?!4eh|oI*l;{#ks7C%#KrdA
z#`e#cHg7P99z*2Ru$y%WTDK;5>sO#FHA~;N>E9S7r=*<PO3Wu!em2WNgMIR7BJBb;
z_i6q@9mYdloS;I<&UG`LhI%axL+<LCiT(8nv4vPm2}6RQ&DR4d7-#J)TgEXt&)Mw{
zWEMbuadP2;b#)!6AF6-=H|K$y$_riGrfz2DMZch+pbw-~AV#KtdhgtZ1--uLPXPg>
zg$Z3zaALO0s6gkq60A5G_)M$;N{JiQbYxSIONG0ruoAJ$AW1p@f8IK&f*NxIjj4ch
zdQv@=b*Hm{1;RAYlvGTTWqFARX6&TLHV}7{G;`P?#jFiMx`JD8qc-DXGFwMW(&*o-
zYj;U1Md`0==#(u@)qi`Cn%@(Yx!8uYrGFQ|lP7KCmS7r}5Z|MT8h&s)FzZu8bWJd%
zU`&Z0o$r4W=<mkY{Ua*0@;0UrhSZ_US(}dY5n;KmCf%{>h<kAr-DQu>tJQ%}8dSy{
z$<?6~pYu0QCa-yAG8h{<K!A@Q?@+hKN}?G%wZiFH0s1N@lI5KqMeM^!#FfwRoGNzf
z5VF#n$E~8=OIsDH1J++hG5Kb2TMF;w(8s^l%t3`Y`W?MF-pl0HM5}?VKmA*!po2S5
zE(s97=n0gA7Fh#d@!rhpd1WN<<UT;gxsx|+)N~WrGc7HWOg{m;%kz_ql;tR-Xb2aG
zp#pfVnAHtE!`m!xjI@z3VJXZ+sH_Hz^FOSYHjj^o2xjnG3imwqqQZK)KNAW7G~>JP
zk2md(-Tz@vLYzDJ>l%!IE~nCL*zofc6^o}XOog(Hbk`NJ6TRHbnBCCO&}w<mU^I>m
zrAg(}gCH=MW>%R`Qpf)N=zxidQkP{cBSH$WNC5Q_?&inSjG|3>6Hq0SFvy_p_lfJi
zUhw4V@(GGQm?UUj(11w6o@O%Bq<@m|Z=wRBhv(KbzGZDDQty>T=94(p`}J8K`CkdE
zwsVwB#ho1rU!Ox#3H;P$u$#Z#F-6$&O&<)%*A0<6_RgIG_17^Z`iyW7Z1U>UTY)U(
zAj1sCQ7A2Ikf~Tm#>`HS<8Jr1N27|LJT_)?24#SN9z&rHF#6WL=`V8mq8LcnY(kA)
zNfy{%+VsZg?Nhl&QgT3I4S3zm?BRJWZItA>JR+RdUvlwiJUIug)2J|&A`r`5_j3%0
zL07dXnY&EPS$x2Pu1G6fMpF0s_3Jw*+8M~?AyZ^tixNe<K%L=MU~9o+bR*4^^(_XC
zF)Y0omuk|$=-Pi|w0*;EHlfF^Bn@n@MUo)}k|DsuGeBW+%+gcqH$d-RB_{7zKUlQG
z0m6~gYl^@|5|6DPkB~ryU;cM?I_AFs1fBEe4hPEXm~CRtEhJ6&s620ehtN2565``)
z2onb+{O(KrG#}wvC?@Y-KiIp&u?lP+hL*p+#$|8y0P@g(g+CNrk@IKrj7uEoic)?!
ztzgLjKb?}2va`$R{^pJ%PHV`ru4&3iR0UR^y<i<36oV>&z}^SKjtn}RH{p!2Oqc}9
z!cM$L8_1Fc-m6p&2&w8C)Z+7fKTP+TBUmNk)CK3;lDFvzQq8oYBo}9Jvc%-g>q&xl
zIC6o_&#4T=L3&UYI1oXMPkz&L3;U`P48g&BBN}X^kk8GeT}Tq}WFtys>lmIPBVC``
zlaaGsv$%2RL3`r^>3YZJi^I8P12(|*RswQQ&O#*fzDVDMt=QqN9gf$ppAQprT7&!w
z=R)PNnsM#lG0EwxyqhSp-LT*PY7D2vErS$_0m2P2q)u*vT7YFqPkvqZqRB}k9V?pQ
zDmJJO&xrrqxB<h3)ytf=k~f%A#Z20_HWabR7150b?f{vf_XsmQ9&rFh^RDS|0pn;l
z*a|fPt4Q+0jqEpN*9UbV;~o>c;J3cl1?^^>2?!!bp+r2HoQh-*fgmuAQd3T2i18CO
zQDJW@<KF0SC8nn{jW%EB0jUlkdx+jtFloO>p3L#@WO>(ml98Q)RG^UNS|Rz6#U0z@
zN}B`fz(UQQRj=27n^{(F56_=HVT2P0vNR%P_5{ELnKBtvQAMLh2u7!tIw2$zzPhWc
zqZxiH`4>!)wfq1hcTi^(7&RyYv(k~TN&=Wg7<lA=I-j$1Eq8O2oV(Auqr!4SAw`%*
z5TE0jSR4>m4_PC7$aNSHFyxx7l`X%~wvW7|=GarX#<QQ;-$2UFcMVkE(pX-N4WOpS
zb}*A*8-TC90Qu4h7J+|Ni^-eSlZ5URBmj1Uqerq2KuD#?R!csPtTy=^S2|q8Q_?`5
z1&ny_y!@}#eeZgA8I5n;1?L^x(<Hi#e_Ao--acb=1B0C+sPK0p0sMfuLq=zWEbX@v
zAJ2=|<L4I}qF6?IwQbS8LPsLsSz-xVKspqnF!h?D-mCf_5??3N*2443z--eq*g*JY
z5|&&?s2s8@t%gJpU*-kRPmhimZe6)=!fIX}YFAD-7u<Oy=2NFzn0C>&6uuBg<XeKs
zBW~tDiETkmceKA!cV27BPHg+Mc`o+td{X^R^PgIqHON^8ySRJ4?oxA6TF*-7$|=D=
zX59J942}9hn`0KVJo7UND(@ZlxniQX9nl2g<&J5j(8fzm8By=Aj1K;fX}n_&T4qzU
zYbryD@nawH@I0?u%l`CKTgD-+{MyAD{1!NWZ#?=<E-D<v?`!qL=Ixj23yxai+#t{&
z4TRN(vwhEzT@eY9c6c3w|606y^S-l=vAZJE^L{SXuqKwd+gWWTC&ksik-kOKA!!1w
zL(f5x$^WBLseVx9*nRU)@j80}Pg{w-oWt!WAN;B$;DFtNQ4@6y2*A5BF)?wCF^%?D
z`nOj&kph#Xc!kq!X2pWW$(A!GI{AF|vYlpf<+Jx<>Uw9X2bh>KXI&m|>FoA5ozAs4
zQ&W>_O&=uKtTKnEZ1vwqsEo162@1VhM8pvsK--pSCS3HOQZRma5;3O>7!Qu^iEe?w
znFgvej2|K}Gk*m6K=MSyD}&vE!(0llrBKcCjZs)W=->5|QN|+$XUBVVkYOO;!R{?+
zS016cmHA0KxBmmev=lO$v<ocW3Pf3UDuwBpI1>^hGO@?1vsT>>?22J`mG;`u=vq79
zWd36Ii+SVD2E1_g2+^c(C+70$@!_N?0rS_7%4E5Ct?%`b3<E<psN-RN^(0S^$uxl~
zFmwCfRo?H7TLC@)Ewb=IYmWE~>Q;5S4LRTQ=l4@yK5*$lNk~HaOtnY;m%a}{{IE4$
zOV!7R)Izt{W7b5=9}N@1WC%v>RxwF+2kjQs7oABRhRqlL8_FjST>Ln~X?v@F|FYCA
zuEvjn1J50%w&h`8$3Q;u{pFL%i~~9u6xp`+t0_8QkuC;N2Kf;~ZkTO#Q!ZCELY!5W
zsPT@<<sZ7S%GN-7oNP=ZB=2BoJbl+Q03Z=N97nxD?##^%5yv)~-E4`~Vz`@r)#6k(
zly?=Ee@;<Em8bH^69hl-ojRSaYK-_@CIzcNO6t}>3Z@*;sgM*1Df_U?c_6$_*rL*t
zUS7`0K}gdkoQ|a?eE(D|=JE*9nIxl7GEruP{lyKpe%OK`m2JzP9S&@EnJW5*LR`r=
ziNx^V%XkdEA;WGw=)1Rj<|(?m_ITF)VoPHriMVj%-;omz=wP4&%Ut$Ck*B(UzV|4%
zaqEaz@7C6VX!zAsv~Uz=T>8tu$5|K|eUbkQ6L99)&fhQhZ_j97$U14OGm;-&Sk7%g
z4O|Q?QJE?iW$DZH_X|h7dn6T7Z^6#@lox{VnucS&zgK`RbVeFT6#rfOUP5bOs5GU3
zu7qmnaM_#7Z!hsx@t*;Du=|b2e2&Wp#BD%@f+2>1+&WFLlaml|0!M{O`}xLeAq*tr
z-+@Zo!~+uBhX|UpMAkgM+&&M1XacMv>`SO?_o?0>gghMG<D>Q1f@yhKgW}uREDJWC
z<u!ROY?yQvOYFOg(&r4~eeJB|f$ylkPmiK){cZjx-Z#p3i>9hlM5UohLDX%vEf%lk
zjy9;VTZ{mn>Q(Ivjc%B;cxUOmiLAx$vDtkSr9RVAkA@TCs#Gzp``zx(zlzBl0;8a>
zlFo~>Oe1puhg9e#9u=k@4s3LmfHN|!0_SD2fos{)zJKJI{vh>v#-oiu&<qO`^FAGR
z%QM%NzFwyv$m=jZ^*_!kN;2GyM9TrQRx`OEd^w9WgeRgirnLji{58Xcy9?6W7A^bV
z+J|1fK#n1m0GlAz7pBJ6N#*Q0JgObl!}QT?L@=ezfSF3(s9s_&hEZ(cc4d9fkLe;e
zYBzEeZLfFTC+_#nGxwQGv0EP8hgTWoA=u=6VhRB}r_qMOk)4e~1RlLHhLKDBhrT7(
z5^ws81OHxn2XH=x&wG^&(X_PfXN+Zp2r=3hbVn$nh1G&`Nx{$lM%WxrY^Pl;@Z$p(
zc$t70Un{Gtin$#{f|f!sU74_vbXgjCzat%D*x&5Z?6rAv<-$a~dpn?Udz7u799swF
z7n+ajq@$VO{!oET=}K^OUR2<V4f+v))8(MiV~j`3Ne+ZA9k>o=ohJ9Qst+I9E~#a;
zb;tnO{?RclNSNj75kdyVAPZ0ybA8$7;qP^bXvr3@NHVpYwHZ%4Hz>J{qOHd?E-m|N
z>q~2r*{^3&P4DO9Qnq&V@41=4lN5<r$7p)yycQ!HUC^nw3Bfx6=wCbs)wQZ`LDx`u
zeB@n@2-P`fXY>$DG3HaTSDFUf3Sfu4GuAL#^lZ0|@w+4N$g=e^s_1N)6ni4Pu$oh|
z(L7dNSl2!2ph~t@D1jZzD7Ij`a>@s-hIGm8or^)*`_>8z2ke$_!<;p|3Hx()OR>HV
z&*_>G=tdtVOOFwqJ=C*fW9y~%bBaKs{d{tR!&JVjYWNDrTf`I2$;kAg?JKF|`J_J=
zS{C_C+9EQ7y$csu_g^dfS#e+0tSpCIbmf(d_&_<@#fw}hnZ~(36{z=AT@;i#?<!)m
zR_CwQFGh)oS6U4YIDnO;H4uB&g(*6h^bBlGfq>KV)fiGKC8bsT#%+#AIDz2=AJ5C%
zW5nP+Jx&Htb~(o6xQU0zBo3lL!2SAEGooJ%{>-v!^Gjl?sd*;!qYx^OCA!i4?yX|%
zq?JEZk;CkXHvR6nnl6<q+Wkp%4Tq8wTmX%xVN#`iwTVdLGlaKmfoGqGSfb6r5M8r%
zL5YCa*DX;Cn=40&?6P_LuiCQ%stS3Z;|zNbi&n;?o4?SS8s?RM7&v6yL;PsSo4bmH
zwUzK-h#jOiK7CTaG~OaRXY7_enuu>(Y#pcf@(&UaFASDC$0oY0q<UToZ3`nsY^4uf
zxm4{C0?sP04j;cJJ`jU6HMDK$imIejpd<@|7qBJ|IAC9yn@zW!6mLH4uW|TvA?ru{
z71MZ+m!rZNw*`IxgD-YXRq0jO*DpQaeqTgr(@}nLO8;m*s4@_7g>bJbnMn{_Z!2$N
z-B#}NP-0mYo!YRY^PligqUsg8Pr19Luc`!itYk7A7u1A6B%u4L&$Gofdb-k@Zch<!
zCiZ@oauE3Aq8B>2q)Fy?Q{3#K5ECFB12zR6Clwi=`XyKsGq~!-bu@*%D3=0$M*y6n
zpg)hw=ZidzRb%P3E!ydX(k(@VKZ(!puc7>zJ0ES$AEHtR6wVEVLZ~vu?{<$Dx4j#r
zw90#;(VEMkVBs!HBtn}>4L6TG?Xx`))jdPFK9)EnvFn{>9!~F*nKE6Me|+GzS9SP<
zKSI0sWqdNQxrJaj_oi**UIT+Uw)whr<);6#o!R<^2)a+FlP(9`c2x!-e|U2Ne=)aT
zrQncZ^Ztk*x)gkjJOEJ@ihA9<cLYsB{m;&Xn{NLP{yxv8N$Hfr^z9ltj|s!{!x{my
z3^AaGs*iaPZp5_+v-kOuH7c?Q6FYclNvAq7FFKCKb3nTqxc8ZSmia)xE|sV)mk1Bx
zPAt0^AE#hPbZ5?Cy4<y|?{NrZ2y8HiJ~~K$$x7HvohN*T+e)8r%b|<Y2o3{<{Ef8F
zM^uhSiU7O5z>9@js7&iqk1;ZMQpPr|Sb*E4V}ZYP(nM@0CC}im*WLUbG82>*O&GH=
zxw7|YXXH8AY=G<#vAQu`V^swq!pc81k@E?{7#YP64*T^7oe1+EhCtDig-48<2ff*<
z9soUpwGYliyqw>69wJ5swmtD%5)oHl!#;Mc7`hWQUs?>i+6P0*BIvzYTn?Z{j(t<4
zVW0XMOQ;s-sER@jr*lkiNCqq2n|tYKcU;jxb#}*XfnH>S{c$?m-4Qzi9;(Me%I?Vr
zJGBA{E2mVwUqS@dCk-9kclN1V3aZ!kd~*h!%%vp~zB<e_2hMZj4`Uczgq(G%RT7F-
zxl$huX6NCxnCTc?N-&e5BhChOI(9a$UL6Nlfnk|m1j?E?Pl2K>%%u(cA_vyQ?r9mm
zS}xh=AiXxU@AkOgJ^QDmL2XUVmaOpXe28&pAzKGv&0~haD@)-0uhOdshI5G^O3Noj
zU?-cMKL>b5*PiJ3q5-Za20hzPMTI?!Ly$%M;3@21@%j3>Ixuz?_*sza+4%`g@oFND
z@A&=lmc8pom0-#&;>`}nrbWttWi;$&Goh1VPZKI=mK*NVrrhg!tpGP<TXNx6K;z19
zHtaXKC5k|m?f7!$mLNVeAT8*H(}JJLTcIY+d)CP_Jm5KfiUTc#WxuFTgkMaIl?*96
zkE=9}ELKa*f%6o?V$VK3KYUe~{rkLv4+AWlJe_X52!b4yVQP~~!;o<H4N}LJ#6c2L
ziCR*i5>_nu4{K+UOaa2)_H0jIt$}5g?dFR-`QRt$Mr!yi^gTZ3<2@>l6AF+=*e%3d
zP&u&w5ulS=z4tJ+R1893=`C<J6q(UIM&CbGm2OBenw#^^*;ykFo+BjwQr0yBipEnN
zqwEKr^_a1wn?#eKn*uGpS|Rl;!PUGbW%zEmZ|HeyH1t;qSR+=$Z6z1mbzxU$=;j0G
zERI7UF1X)&Lz3o*8bXZ0ka$fd?`|k$(%Tx22J^4osb6>>77TV-)b!EpY&lY2s2EeC
zP}a5fQyZ~N^&?Qi4_w{hrp;}(a5ba4H4=AY<sTlLRLd));&`%tj9;6w=S&-wGfN+8
z5v1&OHz}K+tslY#es0d|mAKIJiO(|o_?V8o8rQTu5PQBM2axmbXG5<9K|FLGV)Uum
zKh?@zLi5%6xKo>lXTy0M=qcmP_Xmdw&f+?pz=CMe-fFDWDp-d@quG%1=7#h96nB|k
z^1jZK8D+gG#N6FA&|p{Fr4qM4&}2|R!4ZJMrmbNHZx)eGGh#-O0i2crg7s4!nXGXU
zqoO=)uJsE4y-J&0J-&50#=O=zYVt1s0%iudZOgqvH91u>{(db6j`65_nR(S?z)$EV
znK=!axkR1&kNZE`1%}|(YWw1I%)^KK;>xK#Ri;0^9_J{Kg%h4!hwgDEZLpd9UW{Q-
zCCDlg70+c|TIf_!@FE=_rc3a(kk6Ti!TZ>~$D*SW)$by|u!7=0Y3!$`UkrnKLcV=G
zEFS`jA~xT#J-J?>?PUZy>>F9m9W*kkidFIL^;I4YC#pveRD^OvtP&$E(li6IqfA`z
zY~jD;2$sDG{G2Qqn6gHvRDs0Ok+I1p;b5KFL*E%ILY=w5dHX*}-k?(R8l)EO|K=B9
zLDBwx?KpX)VT`CeI#H>!BQOL*^NGqAP<34Pa<=(5S2_!_Kvz(LqAfB%RzyU#TpJ`y
z?JvQ2Jt_c5vgAlLEYM)7$Z!E?qaLU{>r-}r#tsdOjeen0J@~-Ypwg7h_I+^;r?v@N
z#ho@a_1cv0<gp>~C&H6fo&7S8z&r~u9RNq=pi6GS#vm;5U|(hiY&|9R1+xyR@BTfc
zWvkj@`e3jpl#m$gthMJfjfs!;C*T3G6a^sL!PfLHObYe|l_y8d$ffQZqZCgq!3;d~
zN#vysc|au%bfzpzm^yxg;9BeTmjuDNL1th>*RRB{u!Rf{C?&2ZJOMXgM1!4q_{pdE
zoqhF?K+YV3?fCDWJ1h`pNWuQ89+@);cn8pUzLoqjaJ=5iEh3E=IeSycalmqp8u0k7
zd8jWXlXeW)5$`$lA95y5pluZZ;dTFfl5epCJjr}_YqsSZcMcG-!;vud$+v&0E{xUD
zU~}1)r6&)$BeAuiG&tLj3X2*`+Q9=BSgV*{1QNCe5`ym8`Ikhv1u}0fy-FxIS=cF9
zU^r^v{B19xOV9v%>Fm>Fy&aY=*!|8OMT!6tC<e5V%(lJ9JM`7^Nve2s`{eF#W)J#{
z6p2ia*>_d%wVpY?6Zc_FVggSM=-j^*crmdv`Wy`=Qsv88hBAKea2tn<_@l5>t=AZV
zULN;61#tICVU8IdA3B~eKr?yRv@WI<BIok%+m|l;DjKC%I4#)CQnj;%3+9dRcYEh5
zSZaI6Zmm<W4pX8t(U0_LX=5oqKCvsc+!$$MaXrM~sgj&tIIYFH7Zm9jMoDCva*u#B
zE$N_i45>6d53*~1ehs_$`1DDz(GyIgqs{XG%IQ50imiIQ>ccSRl0;Oz=B28oM{U^6
zU<r1Iqhdpuz+igGu0Q&ld|`yMGpSy6f9Bfmi6)?#-zdw)*U7;#^^^6y+|q>#87smf
zEttj`<__YIqvvXw2f(o#zws^70I_OOrk^EZFS$;#`VH9q6q`KfS0+w;CMP?#eGi&_
z=&6?7@4}}Y30}<o*x~3;zy?am&HyFcJLq_PK>fwMU0dT()r)Lu&dP_>N==#$(heMj
zJ3Y8a)-=u*?kHZ4*`GEVxA_39IcWTm`zQ$vV&V`}>RD8n9ikSBmK71bZ{<C0(bUCj
ziNBq>=N)k<T~;`#OT4_&$TuZw3DOM^6Bx<{UUbbwhpR^RQ9wSP%PXRc=le0-60|?=
zNkn7R@ur|74px>RPI&0(v$cBfYKLI3`LNwa65cJ&T?-98{uL<F4&gl6NJM3#LhZ_<
zzZymxJN<mfLw0bnM<`qkFwWj02~YqN!K1CyAjuqYHx531VXutUlOwc~X;`)hJi!C)
z(YKQ9u}_>B%gw?%izd&1SCA*+OK&oLm~w-TE{<;8uUh1_@2}n-vp$tP@H(aY9Oo%S
zUtYysP;7{lNrNC>3%ridw$FLiqquO;44SR<bF|NS;!wQn;^2|>C&cy$OnRoslxynq
zCtk3=0Y2Y9BoQmokv;O<ed=xoj$~-O73}lX=bSjOTu6+3<veqGrRQtBOi}Q9EDP<^
zB=v{8azZCKucyDIYX&hDod52%Ef~homBEzp7dU0e&zv-CVaqv-lfjfMQrS)ZczO$p
zB6;gBD-Z|vf&xFE!gO}?)mycQgLis{4=gZ9G;`BwMofbr@$rLs!82LY<b|pq$zr}7
zwuYJX;eO3BizYQD!7pVPI@FyWf6hS6{k^0Q6^cb8McqLk{PfS%`q}~I=G48K6wk^i
zmgw!5qq#&~@T2^MMdWl&fYt8pKmm^J`h%{jv8-;e*^R&bSZ(a}{*NiP_W8JSlg08Y
z#;qy8TGN#-WP85|tVe>KeWmk-B#Dx#5Lza(cK41KFCpK!f!;0;DG%X~DevSJH2_xk
zhv;XMZQF-r<SbkO^ZA}{qt25zWPz)FpU4b52cOgdKXKjfSNiK2hv7@Xzue87@Nci`
zFWgHOrtY$DmQnsx5_R|@T8_Y{jBrJ|DZ69k)gN#FK|0s$!_$-({a{*gUkK4NX))1u
zsT_*v^wXKwNb9j|Uu%5fKfAp%`#a*)D8dI>*9$lX4dhd~QFG1RfS9M4f{E4syRrhm
ztg{}PTTPi~_?o;j;E6x`JsgV{{6Zahi`mDK+L9G_9{_Q6B!OI$r-pM!=Xb$s5u~YD
zkRxoB_d(Qv+6P&`nhaajqF-h;T}`L_5;Pvx<#@`I&N)D#RZVo+ka93P{x;Kl2R)GP
z6@ryDnvp@5Lp5!&5OKRQF9W=vy89d}E_UXj!gY;W>!xH$J`T-bHvy!U@!lj(EBH}^
zd^V%3blxz~O`?MEDC~UR`9k<ycS+ViE2HTR1ZV)q5ksG18ogkX<`FuWFVcIUU=PS1
zFQ0j<2VvWOO`^`$X3jn}m{cG98p&1PAbSMWVNxhn5CMHm0>MQ^_@O<)S*~<BXzspE
z!n(z|q(0cJ{XWrc&S!L4zrW+Q{hT~}M~HwuXmRr)n*N;j@UI!%RRA;K`V|DuUG`UV
zzfS9-XoT|fX8Op4BEKvbd8)|V2NY%eaGHT*X@H#QEkO&|jWU98U8r)+Y{Y?q6I$uk
znD^vqT2Yb4SZ23yMGlp;gn4=~!D#T^?B6GK&)Zdj-{i##7-=1g%c9<X2IT@ROF|lB
zlP^BVUXTWA#$@C5O#iX2GUb*H-+r0hwXYm>olZ#(9TT+9y6)e89n8}FYG2oR=jpCg
zN2LB#e(H1i;xv{VvWj>})4dlc+6x<s#~9xuPYL!TI>!DS`$8YqMGezuUO4tMYriFI
z`3jSUX=aNnJp(y8vUiY;NizCTMRUg_a?}|w<0A(Bx-E9gM=YcDvtJbkRPVb6Z4ZeH
z#yT!X1g2bMFNB@I0!wey4F5k?#f}kgdN$Q@??_tBkJ9g+>LuW%3c4s4fc3+6a5iSQ
zfjp5GgQe~6$cBWEO8n=OYOq9jOAk~(MinLLD+1S(UJrwvyCQ1tblzp^Mg7JMRGH4}
z>@$ZWQNz$F@uhuhy$q&Zlw?v(?9p|2r~=qmY@V!}-F)(9#IV}~j{DSw5RvDnSETgX
z%I5PN*i`Ey4YLSe8Qj=tKsPd6|586jF1Fdc<npsk_6#NY)OV(_zW*<xiqYtm`Ul8~
zQJE%$T=ed#3-Ud4Kkdz=c&ESpEJSAXs(JTN0bz@*fi9#=Gmw8GG9al1IAf7fbKxlz
zZ)W}1`&6&8+b;<|FZq{Ojgjhq=H~BDN-ejMGkkL5e<ExUT6F5wS~K3ddhlr<TMHa2
zy%#}TIFd)SNRLz#zs8B6u#}-}O&gX>Yt<3PZX3N&fipF^umkHuM;pUo2jG!i4VF}0
z%Y%I87I=TP^{Sj~!O=8*bVmVR&V5-P6zz5=!l!2he@Dj@ev<}vrI|Zma}$?!FU&M9
z3^E7Tk-RYMB6-e-?Y%S+trf&r@RS!&)Btripr$mCW#V4G$EbN^I9(RT@=EsnG?Rt9
z_o2vUrWHKYbp4MC)zqUxLZO4?5P^=MEqP^t6@x0U^5KDT3KE-177O~+7Zjgm+0wW_
zi6{Fw(d--Za#GtThWsfox&lL_NPkKzonbBmiS2py=d{iOB{>gXnQ`6#sVxDgb<;PE
zuULA;1Z?4|{;Mm~tLy4c$D&JiX<Yw6%bhhTnBvOznmprIa-o;MzPI{TcE-p@B@1il
z+yjfvdAerD%wr9cM?(SxOwaXEVdF?37e+Jebj4aX$!o1PhErZHJO+<yiRckuG7X;G
zC?pg$u*}HnU*>hw%tz%>2r;^PypQ6%@$m@4E}cc>;kMpZ1GXq2uMHgQ7&Cqi{a6oV
zSD;hVdqj<v(9m`{GkF2tfO<5+uAkdFN{#?>>PH)$v~Pu&%Uj*DUSF)c7ld%<npkIM
z(8?h^bWzS#CnlVl%}G(a!bsE)-%haRS1~ViNcwBYdwERbK6t8bEW|?z7}4h+O?Pe|
z0h}J!Y9*igt_vP-p)Sz1(rGIJ;jmdrIi-~_e(TVfq*)#89XMoo()-!dUj6E7Ke$I&
z_`sMJDUFsAgW+@o&iaa+L&+Z9j=@W+>S)xm?K!yUZvi0g)b30@I_H<u%)yE1XU0iM
zpP7_r?YUQ|q4^zF`bR_FX{TcJCGLjztH$)UV^3KUOhAGw>3ni6BXQZT6N4B+KJ>HH
zk}YOpq*s=7;oq2cU3W{Mdr#H|!7}Mu<P~yHp~ghfuE#E&<aVc<grdSk=r4*SQM14S
zEiq)n^bO=~okyF|=(9(6+!1fbchO(w=znrw|1MP8=NF<#2nGa6;jS-1l3_@cppcGf
zbi&%c?xo(`>KIARW1BVSMA*_zAN>}r%su&BuhC2d9Ye3T?bxmoJD9i6itsughiwZ;
zE%SH3f#}zRn*l&eI57zEVaX#%y{NZPr(Lfp!pTs{%bE(M0PB)W0A5TQ@n+RfNfjM?
z7h}Q8RKiy5<~x3fzh9(jF$IH@n!NcSAdf-k`%@;Y=|1N6!wUZgoW#^)y&^2JaGo~V
z+@|E-y=btm9tv<88G?CDwzwVJd6^RJ&)ZPve;cVvVS^uMnY=(cJcYs*1%h-=jKzgI
zxx*ET_%!o`m37&8osxS~hv}c_W5LUz8!<WIwFV}i?rhOzV|OEnEODA^JdmYiAb<@e
z6iHJqk|zFaH3=6*Ok=*E_h~4`PF}PXrXXr%GNGg&sB;g5HZybW=EP5tbxd$WXWZ)z
zf4wy^LP?$`pVwM1F+gqz{L%?v0*6z+BcsJ#Fonv()Y05w8T(VF`kFn5D}Fwn+NcXw
zP<>cqt*_6fL?<+A3NK+`wVA4}1_ug|9E=r1$1_=P!#e!^bYLlr?^}rm<R9~s0;E9Z
zV<U}HKAb+2_m7K@Lw2xVGFKBJ0(|iUSs(`QK{{u7{~;EA07fG@<-FEr@jt5c048la
zR3@D<aLN-P_5>$ZVLS6z2-7D@ew2UygeHQW?Ay?+v&rj;Yk<r8A?Z6A#;+kyz$r5D
zlT_>$;is6=PtcW&a~lj<&z~Jt;$2@>cT|?0^h8pg0u!7C1OjTn4==tjO2NkF^3mx7
z=w4NVjnymLG5)@ixN*xANLwj5RonIGL}#dWL`ci0Fe#exnqwK{(&_S8QVz!8bS)kb
z#*7Lhv=u~;8z#d<3^HSUEAfKV`*mOSymxf{WD%E^wLG2go@lF)Xul$4<wDS#5o*E~
zt!x++?3$(Fqte{tlbGix8zR<FGBJ4=QoDpa;mZedsq{`vDRA8M`uboE-C#fk`w>{q
z@B$87W@+cO8cJrKA?EnLIOB<b9E|jRW(s7B5ZQD-wyU7$tK*G44d~6w1;M+^tKy5(
zpA+KTd(AR!uiijP4^zY+2!ThqwGRwD_pq^94@VApTUb28ezuWSW0FNlN5>Hz5phI7
zNN92F7X00kowQ4`Q<V~&CPxJp-T;M)$hpK>V@&!0uIWkXW3p}Au~SdSurpqDXw!b>
z{`0-#^Uvgm#?%x+_lC1_aVy6(Y_^-vX-38GJoi&pdsTeuJyU6CpVPSv;=h36m{y9`
zmuKdGzxXE2G+m_V?p)P2H!}mj{N}tX4sroQs_4yMsXoANsmo0O&GkigorTtO!q4ot
zpzT+am6r(ex=s@DY-e#sYjcV0{xO}ihmlUBMC#SsNA5+wgM+v&@5K8);rE>Dvo(qz
zF>M$}{w@nm6Z_E~Ym71FoHr$CE3x4@?$Itkc8V-DguQDIr+`qGe6fCJ=XG2RR)<U%
z6*s<dS9X$k_)bbK@RGjMV1%puV@Uu|*rN-A*svnT25_ii`qC+JhhuiExL6yq5XTgf
zQe0x<(_prmvx8>>mW~_Z1v)fJ?M=s>7}OGY{|p~5^B<H-(fPn$YV^sq${D~{K7>@~
zVI!VZ)%67AP0S@grK?iP{8A047R3ms#xCr}tsKRW^7|s@Omk7W+oh@{GHY4w$HLc9
z;o*{My5pW65k+xa5!@-w{zqc&F^vr)zx%JfzTm$sT*q#?^Cf|pGprJ<jBhiazq_jZ
zRDGdGUVccs!Alj;*=%iwof)E@-S()LRl?PTIx-y&Ls*W=XBjSA))}$qh<+{|ku%s<
zBB**M>xZqW5hX1aLLa>{T1cliTg9~@>LbK}G1U}m(3dp_6i)1yS9wf$`{RB*O-#7j
z7C2Wv0{>MBfbM8x^V=x}6*iGN7OspXe&51EOJ>1Kv*d#nJ#++j<8|;)kah~iOW_L1
zRo9+k8*<E-s02aa5IT^UqBh5i<M?y(m7;XLnR~v)r*lqubR&|%XV{0wrSpkxC34ZE
z*v$*df*2Xk2qZSQKaq8l(pFhNI{9#$<L>>5&yLg-a!>P~D7HHp`rC|qM1U=a!$HGr
zXWsE1>!=Rg&)&YD^@c~utA+1$;|{`OZI>rYE%?u3I*LLPvL^ez`H%2t{scR?mtt9n
zJy@xgJGscx_aQ9LM9Smg|HJ>GV6wf1Yv6K0*q<JgCMh5CWV_C|z=zVUH;R58j}chc
zP}=F+7F<~53|s5aow0;hB|Iy7V-)Urq?yC_=OH59mtbDYWD+mOw%<OoFs03Q(mDv<
zQlz?HBfQXaYA}qu5Mtl|GDo69HsV0Q+VnK?hnk{H+gWaj#Y%cApj4DZ#+o<Gd^mnM
zuX*ZwX=q%c*p<t0FR9#KEA^De79Q&4u+0rpPt4gNP}G+|_VCj^LURRYsp)1nbLm$`
zc2p?Z)vqY2SjIZuw+?`1Dr+HP-O6q0g=_-<dk^Tw;l6h@lCQmB0Etl%Z{(i{07L|p
z(LkJir31gD$Ql2gsv`LH{BV3;)T#}+FNkMWZb4b{8+Tj~T~!%c)~dL&J1EH$OSL+^
zi(;~i{Gp>4L*lwWaYG9S%@5y?!4>FY$)D=cE+uK7@}J$if3Q`Vs%MZq_6*Q`ei&OV
z=8$$e;LUKFa8zLObrJ6#c$L*hIe=1#C^-9(yim@m&8rBIW6(=6xfc}@J*ZLlb=!Tp
zP$GLJUFlnV+%Y04U+j8Ngz)!H?~GM-Z5CK%L0`A~YuM9X2&+Dt)<|41`TU|O1%C24
zJ;_Wz{;8mt<k6X(zk9_P7?))Vra&X|^_llTbV*95dZ=oBtbAfPm1Rg|AK-u<>##0m
zOZr~85;ABdF5G<&;HdI)P*$#=asXI2bokDT6j;sqS4!q~Brr1E@y(Z~lS82E(za(h
zy+X*a_6_-|OrkdE1Y@3Awjm=y7=<nFy#s3AguXlVhHbTRu$)8i3zdi7v{gkuja#)J
zCihQ8w^UPEdwMSVCZWY$`-rI?c6TRX|8=n6yE==OGxo~52X5-<9@!s(NHG_MdK9Wr
zs&wRS<Z2ulBgWQ64^HXpnSk(I53s<CJFoRs04yF^6LLJOXH%RFQvodKdSF9M>w!!h
zq~)>?YRMEez$&mn%c<{dXo&qv{sd|3dag*$90z9|k1~Y^0nKGjJaQ8899aQYtk?>c
zn!!QZF{3!VFDqs6SosvH*Ae^t^PKHe;;@DcRhF~@qLAOfuta<g?q)Qh*ky&UuyjR1
z`&pt;h=Qu^gyy*JK(er-tos$m{VNY$>ARLbMS55e6<1D`)Hs!uY$LDjfS;6+smbd?
zJvF`_Z+?qyIX||{ZtGVH6|Q)A=QY6jtq%MiA1Y&54k$IMF6mE7OW4QIly|xM(9&0j
z@(Y1K8XH=RG~TD~m6NYc)l)C`mp~Nd)%FwGLM3+c%?hF&^5tKabhujFpX#zY%(+iF
zU#y4&-Y^CE)ncMoDp7D94H8;NiY_InFcsX+GlF9=u2&D8*+=KOp=gihrs0CW^3+{#
zdRr9o+$QV=?4ki8<gj5$rOcLiFx^n(u<mSOcTn~j;`Ufm+7()Os&nS98`r)eI6Xo*
zoq-rvtg0io?=Xd+b!?pS_*L~knf3S_Y9KD6d7=1VTcNzqQh=DWo3~=$2N#5N?#$?*
zb_QEqXNdmKkcQ^)PCP+as<30;%cWcFOMm)>JGI|e8jMZzNX}|kTboI@lBxT)TU`^Z
zD<xL^#aHHQgK&w(y~|uk@jd<t#|dMaQNI_S691!}xT$!-86?+N{xi{rS$SI?F<lla
zQ%88uKrZFr;TblU`}Y{XQlAa&O?9UHj`yYZih}Firym+Kd-<uGaf&}<`E=Aw-pj*t
zE%Y<v@37g%|7mrY2@cuqtC!M6Q^OCY)-yNI`3?GlR3-*I0}kO;>T2s>KbOBpln<;p
zi8p$P`ygTt0|8D<VWec+Wy`@j8#mm@P;gJM^Dz6%w1i7lRh1b(L$4lxO3tSG|H0N<
z2SgQh?V|%CA|ayEsbGP0#{dd~5>nC)(j_1<3_}<oEz&he*U&ISgVH(V5JM;pL#OmT
z;QRi*?|1LzFBs;Wv-e&*)_T^no`XF!#h$U63xtQe)NCG$qOunc{p%teq6H3>gjeI9
ztsVYNPh(!UxEKtjB#3o5G<ocZ`?^2Ap`oRtHM;|(z@(RFX#mFuYOp5eBR5%l@%ir>
zppha$EOjqf>uTQ^$PS<ZbEUj-*OE`>0*G{rm{RLP3$qEMV)59zKTMKiqtDgE?~pL{
z$&}k<e!xrONfsCH4mhVjw=J<KPO4!vY%c<sIdo9JMYooOq_Q+-Q_NcV5bh7y`B>t%
zUt0d%`+%2>5CGOCh4#Y?$-k@otJh+@rPss6779li#^vi*kr_TmKMTP~mB;!BFlu~x
z#*x6J@Vuz-+))jgA~gjo2f{u59?9O~yF>jduv|xdvQc(9I}L@)nCHCpDX4ZalDY+`
zKE4@qdI6Bx?)d#o+Io>@edSu;HgvQLue#3Rm{Grz7@ma)G=EyNhF<02IL-~E>+cv{
zG6<JpG_<r0=Gt<l<6U&$_%I|05Pzo56H`#8f#%!-q8{v(yP8ZgsokR8!Vq7#O<Ft}
zgD+R6djps*w^GeQzt*BMDSLpX<;KADJF+vc$d}FFd+MK<Q51^6r#sPMZIJ`E;**7f
zO?r`ejKwvUmaWzdQ-!Mo$-8BNUUA?$lr9$by)gucm-=a)iJFQg_YB-x{*R<fTJ>+4
zH0!`if9SUI8=OjB#EMuv02A59&%PX3&_T2(H>?z5wcFlrWL9{5CW**0-ldxY3)l$+
z$gC3i!5?k<r`{S*Z#U<LdNT(w8ey%5J>Ce>$K;UU0eR220K@Q)_OqkvX)jVI;|e0Z
zh=Jo*Pq=%yMhc?%C`2FA{`0-x0!0L(^?!gmVj`*e-C9vjAmyz@Kuz4rN(z*G_%CnY
z@mqP317x(R#?`Xl1ZL@vDltBd^?2HgDOcCcs5-W9*E!f?stV(B6%)>S)V{H#f0i)e
zjBVzb>Ja=hR}PdVsC*;^B3ZMLt2CUn%S#~s$9dNul&6Mhb&Ph7-t_~#?ljf9tN7w8
z6*o{f#<Ji>EXzG=-PnDOSP4>4Hp1FRYqV9-C~1a<%>2cKZP{k)zKSYmET??54-r8F
zSep*<wre_}sV>$Tpdq}VkR<}DAnXjTl6BuN8TL}UFz1oIA%{4KKAhqty#7HS9E^33
z#71ICW~=IA(_;9|yjS=fbQ`>n+W*O7{QUVm`^z#L?Xp2_?YuZ?jr(W`uZLa0G5*$*
z9*|NQ=CI%G1(vz|Ko|jWO#L%WYs(CNbd9#UEjSNSBnCF^JMhZ6{aUzQtNdG=<U*Q;
zPNq285$8VMEG_u8OJsOd5tL9kk~NyfWq~~@*g%agfS(G8S~*JL$bR#`0a2M>qYs1Y
zGxI4lG#3Yk?wl$k7Vf(Kr#}T#fJDcC#c#e0A)icl<&W6)MNrW*a`WgRnu}nFncXM3
zI3`?11IU|L98@l6*;&GoGmaD^?so8{oij6e#Js8IQ$%9s(si)zukohb$&I+RPK}u@
zFCy>x_c%2L%#$Z}vZE#Ky9h$d>kFP`i8c9B^vDt6f@GAXL$-}b#Fz&2P#B2g>C*j-
zy3K>z-F6@?cTr;?|NgLvGbyZYNzFJZ?7aFDVkrvr-&Uu9*1CsIS`$~oK5OGe17)^}
zHh0?<LWyuJqGAdGV3&#^fY(SZFSX7^J1VJ_D|t{IST;;8P4eqj(=ezlF}(zF>YLhr
zMk{yrgvV5%XvKnDkys8UJ>&!pgLyr7OKenFuYTAJ0dsNV=@hTixJvf9{&bgks6RE;
zr`)ME`Vo!(R2lZdL7cJ~LRM0y#{5Rh9&7F1_dyC*Ia1jeh8Droc`>>5EwYf%l$^HN
z<#U|agyOl9<Rke|=j=P5{xf+i@A`2jO*0gHvuVyC={xgaS8o>(6y%KM<gP)`3&EE(
zCLY=(?L<7i<<Ikl(eL#RomTTh4n)_{Sn5kc)`wVRSAb99Gds5LXGae+oTKBsNNuI9
zuA9~jXc&#=<v+phoG|TS!*kw>$0FKY&9D3VObke7@EQy|$b&bSuy*W~haz)-l0{SG
z-Jq>Pl7NcC>vKx~NTb(n`&Su^YM>Hg-b>q=xX}^?dwIzy9s4_<!%FEB1{7hEHuk9m
zifAor5QDZ}6Fz+Irjx`eAvL$FlktMd14+`p;og`0u{JlX3E+0m2K~3cbbc_HmsMRh
zZSs}KQ0`cXg)>{Y)%v{H;qL-20{Y(V*VjQTF?FG1A^7+_Ebyu;A`F{$0p1vFD5C9s
zVd4KrdJLo<1PH+x{6km1#sX>YBfa1Ti7Ky@D&Li^fU<XWS0rViVh7Z+a0ROPS>I#@
zxk4FV8edklTtb#(32jHWpREqvzw3v$-SVH_|EI)f0w`vCe}#5QS6s3NfX%l8c;fH>
z-0DB7dDeIFXukE?q1r{HGz)Z3P;pC#7zNB9QQh8y`No-owQlPjy`ew6b~A6<69?AB
z3q-Ztq%4y*{k>s*3*O7{nW1@aU8(MgKGQafi|ppPH%lT*+u%#8Y)#-lQH~$VfC@}a
zk>RevQ}$w%!jZv>tEbP)UGF1)=-2PXU@e40x7UXE!ps}ffs!3PMV0lc4<|x`?Kbrd
z+M<iz>(13PADfZKu;fNW^AU$=vXo5u3^2nX$|<{D&W9YuYB+4pcw;4_;cbkDxTN8f
ztAPUW@UNKy*RO>BiqF=Tu7sAll+nNt{N%OsHCakL?J2f*pohHS1<BIk>6{$)=5~yP
z_s*NA#2*TT;(Cb#y1F)Po4XFY?3d)oJP}I;{_)3<ZVt3&YLv#gG4&k_dvxVyZTgx%
zS&NroyIv`{eZuH<o`<i4{`G|_FEG3@-9h{ec{YBn;o|@eQZssY{+=Hh{c(vJS!+O8
z+Yf~OaG;5<h3}iC$lI6Y90O7Rzv^pn@lU~t-;2-Eu=X|In0oC_Vx*W{15i)p)4SG_
za@M_lls`p+K<TZv&Gkwr!^TiY@sy9E3vddHsas8_b=+$8PF_dPbS-p_7#}dduP+RT
zG<e_HfYL45p+>7{K9BkOR(?$M>9xv#2lbJI*z34*6^`zW6<x<I)f^1^7`&8`8hn<)
zVAuJ_0}X5wJr-oJrksu1`MJ}Tk44`Xk2MbURaawqSFaVNH;Xa|(dEd$MOj@WwGvml
zBpzxCn-v?28UuX;@|dEasEj(HdQZKoNY-DDQ*MB2osqcUq{4VsdB@(C*A#P_^TwX@
zY6U0Fw7AP<PEERES&l>G=7U#X6?42$*Lb8h72j?q8A&QSX5CXgyV<07H?BnND~{93
zlX-t=X#V(Z^N-NQ!;R$bgS9^cC5wkPQ%|_3kX{0f(21FDd+Ek<9EP?WMP?fhFv;X=
z%w33^lmcOI8N!Q=%fWW~HIW|UG{~PoTVI6$!Z9vyN9#{i04IQmS5zHns<K!<LTU~1
zz2L0WkausUM?k<=DG51fHH^+l4cR{0-qGD3`eQ{05J1ykj&@pAY92JPe9fCDYSQyH
z{_Zj(5E_#9_UD1PY_Xb@px#qIb0F-pN?ME)+c#|dBe9=~-E7KUbUxXfqK$(Um@3JY
zGY%b`R06+C4Hfcd8#y%xpb}V;-$gfG|1k7w0!xz9ly4?-!=y${clC+blxQb5{5co}
zyH)&@Ug^`N>g*E*J<ub0S4Kd>(mLk9I(lY9Y73a>{Z=@?E|Jsi&CL1IU4?UArk1zz
z*=VUT<z~oF=VC@k_J9v4*5=O`9?O%OAFZ|*%|xVEy*Qn|dsZhjw|jH|^(X*{N>)mY
zkwbHTs`wq&x^vfAak~swp<DP}a4J*^S&5ID2zg4KyTw*UfXOQLPo=<_v?R)*xy>n9
z;!HxJ-H){`=)3aoyMM)@nB0rmL@=q{f)h#3Y-K%-(5doEqdjM%Q@H#`SHK#wiudqK
zIIM036=bJ67W80uLdVX%UnYa0$n~9OZR5L#>#*kr;N1_{_JvAPC41^Q#kduqDxB=@
z-Mg-nU8^Gn+;c+=?0_Fte~o=}>xO4JU~;70=DR2K=h?=cbo(=UnmLNRjAAlgVaHDC
zdhKzpBJL=ux)9~_s!=txenfV2n!Ul=ayJlo4&-f;<I&Cj5;!g1Hg_Wg*oXN0yg9eF
z5oMdn19i<9uLc`|O%wDOJjvltay;^Qk)bcr+bFepTc>?;=$#a;@`*M3zG}{tIxYjs
zyoT+;goBsfGbOrt9}G{d)(uQ?-)P|l4NYmU9a5bvA%8%6OVU!Qlsq<L4*Pvr|AKm~
zUC4Xv!fTh`Prf<fvy0HQU&=RjZ5Te@AM?3U(&s<qHsf@Xk~6>Kv+RTF2hUW%<bsjA
zsd<d9ty_}ym2q|>K1>RU4pw0swucjff}06qUis*Q+EV>auhV+*f^qcwsF}u-q&4i`
zws@@@=~*JKtD7j-C&M{~cc?$2VaJ8}30>iJ6ASXqptIzA5^#CIIxKWGw0@nx+a1KC
zFH-A0$WzyzY@QP5)Z683KdL>cpce1kC=Hw4pA+c&UYVjSPLH{Nu_p#8vnvb7+TFm$
zyVZqJU!$U{6ZjPNrPV~1m1L(Qp!#(o);cr6RNzIJ<5vp&79CEm7cXAXu@*#r{_=%~
z+H^B$RX)zgNn3j)&-M7j;mQVj39=fQ?YlI*KD=Hxv#Ztm#SRGRm?S>vK!d{$Hl>EA
zYdyFF&US(*o1#4_4q*O?7L#Q!3y~IxRUN`qnr0<HD%A>XiYOuHjgw>B^*FiSn9#gz
zPG8X$HDeBLQ!g-*kG<b3<g*9f-XHNwtt7;Lf|b<UZx%Ud0Y&2kcF=+>*_I*AbN&GP
z<}wun;j>1|g#n9qw}NhQy@Sh#^Nl_-9~Q~jC<_hdQfr;=;@G=hr}*ldd9I@O3Ismd
zv|R^drb3v7>I>sNbFPr8mAs2C=W*2;wKaD?amdq6vwt?IAALiIa|`94NXel`VKX8-
z9T+7fq`FZa_|A~5uq+&LOjNm&R_SOB-H8eoY#l3q^BQ5d?tO@`vMa7MlMU<Fvwk-+
z^Gb8+bd>MJv01GsQ~Dx${c(XxMWLJHR8*>^f9ZX6GFa=J^9F2_*u1@pSJemaS+8e6
zDZUOSHaP9@tB|4qU~G^Mht@+sMlpBd?flR0dk5^SkV=!jzklnHm{x44ce48JGmIV^
zW#1Kq`pC~hUT+W>^_Mp=IX*@8KQyi|yb+M}p%?5@n`D|f@c6(&qMOK+eh2$&te@g&
zcjUFQv$QZ`Cf;1);RL&VXeH_$-viVND@;Y|Ly!uW6Qw>)u6SEr>BK%&6yZUU`7^%8
zB>pmkIR&BwDGj5ii?lLT92bQQ=IXH^E!2(^=~9qjgF8M%m`UJ3_q#5n0zI=LvTBlm
zNCG_qv*=;!_&*Gr8cJlu3ZnL+^*g?;r{6Eyyyy9*2+3A2Am7E!9tOsJg+C@Qs;KF5
zm@J02T^}C}#JFw;xxvu;jPi7hDygx|_@9x#%E4U9jDpv2IbQQs;H`N><TYrr@xzzL
z`h0oxqwO>f9DM=Az7-1-cla#p$L_3WQC3O1^}KY~HA8U<Goi@PGiL2+s<0~e*VflD
zD6$x1P!zgDlWNo*XHI$E@l0*4=yKFSn(rv_#|k1+bvYte&V-HX?&il9a}?K1Kpo?$
zer^$P#7N-BcbAyc8+pSix#qfbjv8-=PYLA|o*E}&7`PEO^NOzEU&|V?phdnrRiPe5
zp9U6OX$O+iW<Mi$_h6LVD5-qtvFZ>ne82FVduStHH{*B50CPLMPH4DD_{)0MxNE3P
z#_MXchQYXBhEx2K<5s-xnmVMUSyAs!7kB$^-ZZ)2d?vygQ7BFS`t4~ug+<vL{CNAN
zBJzOw_IoZ#Q!TEr?(NC%p%Rq)pb*jKjt%`Fmk`PZ<g6{KZHt*b#0gg&%c@e;c(mH>
z8L%%a+3sKYd}{mjosXA4PTUnySw>KjZ5|pbiYg3-dHg6tjp9TxcC7Ny<-98Lg10{y
z$?#!63Qm~@ra~KV&^A_i-__hxCKE7+;Y|A@!3C=5b<RQa(Mfe06zWCs)59Cj)JxW%
zpoI5z3Vjq+F2~o;M(e&`;RrG?=T;7&Zqh3Lr-f{@P^p11&iD^yBb?;MtqSWuS&{Of
zr~v*r5U}tHy?SO6{VPuL;}5@k4+s+ad41+>*{?)&=b}jQ5VS`I-uTarokfHZ<bo>3
zaj+M3O6~qWgIee1nslP=Vm2)TuQmbDn>!OVCLzZ+L-P=qvz{AB<J=kZ=KHoj1)jY?
z``=Y8-zbm4Pfyeve4X#ku-M0e5}QSZW#C4`GqWGTH%(Ye14>Z+A84};=Yl&ugsq^l
z`%$@5<x6D*Jle*nO`BZLKbYxoPG<uBc(k6%9>O`RLytodl!Thn%G;d4bu}b{nTs9w
zX;0Rw8YlykBlIHAnx}n6QQ(q#H)K7dRr8R$3~XQ?J$*}H@vQsc8-w0qH)N#8^#If2
z0_`{Q7xWm~zGde0+;()XKfk>}GeY?)->WJZ%jtJE8-zwo34MC(<m=#d)^2>TcEMaA
z>%&!V|BcgUoyg?I_J^ktz?`*HOhUx11SC$^<TH6X$C>HCse6$wsntX7G)XUv+iH<_
z3<5xy4o^s&9MuUtQ7=rMph==*y;tcyEds}$O8tD9!|m<`PrHsa{mz8H_i*91yd!md
zAPxGvoQXsbV-(d>zkU9;QA?JHgV+#vn*1#-%@C6mf)Yzvx*|x)N<xH2%ta5pZrAix
zbiVTOM~b@!zqWW-XLQ#^KM4KkhO*mDndki3Ne|Jb&y0k0b*W74+C$kdsx?1}w#Qp&
zRBQ?j??KAc@7Z`w<V_}O!xeG##qFZUF3ZmZhkV*8AicI6*$nQfbh&?bOKqd<0^x43
zboc8|v38Ij*{!_03}z^FWop{Go8@d_uWrQUL<EhPjN^}Sg!{TEqp^DRK=Jk1_TKNb
zX6M<sabo9-^UqpF#1I0WQSGVM^Jf`;{sn24<V9$xXAST7aqilKaT8ta)4~^^0xKFx
zHdr^&n0mJ`;k6za{a&xH$D|nL7_=YlYT&gPSX&@RA$*5qt@3MGLV1nZ_0?|!W7^b3
zb;ar++`G*2oAbPwzl}YvO_<jpyS!6;9mQT^4$evr^^*xqm9!LTA*UGaTtJFta~Dcf
zgQv7BdITP*RlAxy#Ythv6sU`15)X3^UxMq{{dmK|COT@mXrKix9AOthI+g(iF-y;6
z3=20tW$Fdlj4F7#TiE-Gs-BaN?#ySzmai2|*4(`u2$pd6n<k@hk?JTeQy~Vi<MTam
zVDbBa!~1@mpLFngk|9xmB+>hnPrvyYNMrQtx;_brw9;AMt)#<y*12tvXgfh<y&7Ds
zVaoXJBSvSPE&&IZyzd)AOY-8Zq<9vkRK|;6JBeXu8>}VmEroYuS^O%mK`Oow8S5-+
zbtE-hPrnC&EfHnG8`Kx6zNREEe23r&F`%@AXJBDN{gl{0c#n$F<=4&Z=~aj;II6Sh
zDH-%pFF~JLhf*stV&_tR5L<O#kwV@^0o|ZZsp8x{<@sgb|9}R6>{k#)Q)XHVRhAhU
zciZjB@>w_9PxBCBU1RTn2Gtm=ow2staX;mJc#XPk_7dblID#EXqTwuDh^HSrE7^J)
zKi*wls(Ie@fMZj{r~;GI7|kblVJq4$s-^%qFDw#&tcky9N%R^*!Ke_&=4Wy9iFzF$
z;ezvzzCd<w!gvl9^GXqN9#N^l2?eP#FzW3jCVh(G(qMXWFxolap?s;-CZmYu3wE=@
zk&Xf6?Ix4Rj&s{O5$yH0JC}CxTgS&E#Uo88qJ{NhJ`c{N#SCq!YY!2cn45fuD~0)~
zJ?gHKc)L;Dm_?Dl#1jx&SSBEA@Un#~&Y9~o0+nXLV#|&~rKFsTsJi>H&#p!t%-Da*
zyXWn&*7$|Aj57vpmnB)<?lIl16B<<6>9&r)fPAV5B7syK)tPtQX=<Z|*b~6DjlX>9
z%GPUm+$46>r0f=eb8Yvy%EfQ!I~Wv^ukB@-*4#f1y;n``Oc=i=W9h(KR^)U8!+D>)
zBp|2A{=TT))Ev7CdRJ-w$mAeUn6*7o(a1QWBO<h5aapl+`hdu!<khOJJISs<|36}n
z^e0dNh*0grGxM0u>mLx4ZBs4I7t+<_2B<K$L74)n&X7r=XKgyq>W6y%U>Fw;`@bzj
z21a*#3z5*kY_%i_+3hox5phuMvxt}(87|H32lu5%+URZi6%eIOLOO~+Q5lwDEnLl|
zXclqxaye_P^^D7&S}iv=V6Nuzrn_%g0t)E){Qlr=?$*yVcuK)fzaz?{z0B-w_1u{0
z6z{4qlugIguiI%7l%xrwC(`b(zE9>wJ%)QR>YSxL-iY}a${D_22obdGHm~IjL+n&x
z?g!;KB^((OTYxE?gwv-IcaH-wHSLZOL0#N_f(WZY)UjfFIh^MRH7Z#6_1tO63gM2X
zj6xSgnXk!#KE3>&yHe;lK7Ca?#X^8jgHIznpyv3qn?{lF?k837R#~FuXLvhEU8CG;
z^%bi!qGYIy^z|SMW`{;5@zyo$m@|wiLq+k3EHur_F4yK~ztCQ7hZvgZNAPf=JJ*Q=
zu-EKZCVv|ZL-1zY9T0}WhM9y3{kI2bmSA$YZ1XjS+|y|u3t|%(hsvOxRpu-KVAgO0
zIiKo>DaGMQ6zBrnD~<5T^@k{IK9Py;Panr3h;!y7v(<-@wFEaq`4bmNcxS)n5jvCZ
zU37QPf*_jCa$ZMjY)+ZZ8Wl8R>3|l(iVGHaOGY3A%<K7+E0z+iV9{Ph5i1vbMgFV~
zyLhStyOb17mx}=e(z<!se*~pvZ7BqW99&PQ<yo#G<qOJh`!nH2>Dv~<`?u0sti*Ep
z{3+SeL<g42LEp=-Lx{UxCM*)`5w7#f-Zod)yretV-dem!7=mn1z|1?ba%_YLQ}1=(
zYw9_0mLmezdfpNZUe9m=<k5W<I$A4vWfGoG$>{F$SElxrF&1UEc=k*^q6tC4cg5(g
zFE+~-YRx}MbTT#^iQQ9L6~&>n)WL;j^aGmy|HKYJNhJ6>?w&_^CqqLK5-~nUxETfR
zzssz^#8+<n=H@6>R5$}N*`DX68%34)-V!qLChMiw3?Tt6UnLMgC50@0N6p;Hb=>vK
zJsEku<2enH4XfE`R==M@G%}dNGa7QyY74e$W02~@+fA|b)S&*EtHCnSe-3gD6i$(>
zo!h3I9sZ=U;Td?}?<XPs<wavwm2Qw|kSedY6|+NEomyoT$nX3T#sz_}#Q0+$`r(F$
z65AsJ<P(ZY(2&c^O#4c8QM=rG35*lDi24TW6Oii2HYJ`t#2K$?^;qA7Z?P~$xB-S-
zL=LDAE$Lhl2N6<4Cbdi6hOn8tHfj~9_yanbO9G`IXrd{%wOBbR6)@~_tq|_f-(r_F
zUNcj~-(l6-k0~5`#6A3$kH6qeUEM_}z=67{N7Pss%h={}9GMgABMHm`prr^J0v^Bh
z_1Yj8r<8iY6EtE8gXi=VFhG?I$y_iHEgI$3Cqi$^qpt4KWLeUSAAc|=b}}qH`0_`6
zXRO=*>o#q!9X^{nfD82OTbrswEGRoq#fLxb@%eOG0?=qs6Q(Q-@D`lBP1-f=2CR$A
zERxBAoeKC52O%D*$;q*!GECo|cUBp?<22{|j>P2nI5zl@N8!<-5WcVQi-_?Z?hihN
z6hTS}QLl3$tLeN?HCXwIIn{1J60||CrmL0=v{qo%KmgD$8CkiiCoiG0j{;?X$%XVC
zu?HXUi60^ZZ#MzYGtqbsx;EC(ko4pb36<OWj<2KA>)5-rqcr%UyPsmo^G+bgCf{d*
zOu#8<2`=V+jSfexd@bjF8p1Ixp?{O>1<0<z8$TXLS~4+zSnA?bJoba+^7xd_8mGcj
za+24<h#J2X-Txg$WTGmx->LXiKWRQkFi-fH2-I|H9|BrT^pJ5aJ=JgChU))$UHYuY
z^+!WD&MBKQNyG~?(e+hKPJ;H$IoEYA{kPwZ6tg2pB}Q?L^xHN+%Fx9M!)qA7GUdz%
zso4^Sk!@pY=fhpah7Dta#}5dAI>0eWv!%3$gDb)NyRU|?UPvPCcG)PXFQ+-S`Syv_
z5n%af<(_Wt&tzm@14}s94Fd_?nnqVi%=7_AtqzwIvcEZK_lqVbscW6{TDMIGBCLDU
zsi9{7rgmaOBBd3be^pJ?%!zB!(hEDQmGQTSr^>N1!EOhWgA~pSx^Yw#O?NmdhAXV8
zv5SWI@sKx$xQPk2urwFwm8u5l?X^@IxBVcE70Ba_oq%iYP6pllO-61*OCCrzgGYLv
zLrm88{zN1o@{(B=V14@ki4)V&I@97TDtpavwA<U-_TC=p$Pa(o##4BKHQW^%*W4zA
zw)yq0*XrWOD-x_eL1}CD?uI79>i{d^#Lk62oN`u-m~vVrCCP(!zod07Z7<(x%A__9
z+qjz4c7ZCPUBsgd;F?(c_?y%zkPm<KAK0cTlQ@QOk>Jxv-v>O3q_IcMPVE{Pi{a;r
z4#obkr0XShyGoI}{`p-xg%Q+Z_+zuj`mrEP_jufDRHKLNa^AvClh;3_$Yq(<3z^q>
z`UXaqD4GbvO$IR+>x;=!H{c(7svY+312YDs!@NUm+#b%TLeAJA0Cws1A~Gqi-%r~!
zO!X8v%ffAXIEHxc!&IWVylqU^KSoH-P6cm|2usDg-)_PL1x!q-v!VCH@K+FtUO&qo
zJ<QVQR<$bKx0Jd|z%%v;*|{aIT5z|ih8PcF>l`D<jcGBslO#3AJIK{f)orB6c72Yd
zw|D<LTvH3K4ZcNHSnIF~45LoFMsZQaLV{Vt?WBONNJlNhF?`KCk!T5QGS@6=iB_Nc
z%=Y~AV8~8SdC{yA__7zdVxxv0r=EzvZtHICgP#I#Z4z<d9{8PYF#5($@3-c7d_4D!
z+uG}*XMVEo%>(O;qpDsL_)w$w_c%ieCU7<fZHPa23DSS?z>kx(+P8t!OEE+5ch<nI
zsU}6oba&J%h1QEh)==fb(72fZ)(f!8bW%9Aez{w4F=CFvZ7u`XG53B4+N)vZAb-3V
zGOX9)%An#S1NvkUMRYBiHy<T2no!(s-Z%2?ms|G``3piGS0~nQ5$VR>qq3>%1Urx0
zIZuvt=JclM?qY5As=m3YCJj3%!Oh@7<7IZ%St*Y<IV0uttHag>ak?Wdu)<`UinrB-
zXUcb*R&6KdT4=r)VoSzdOP#=5C0#<{9<GRoa`4K}_S|4fr*A6Y?S$&;h4?6$U!Mz@
z6L72Pjid<Prf{f4rwTuhBPlC}wZXY0%d&pQmfe1DhAp4Xud=YlF}U<Yf<8-r(?tE|
z*Y+j6SgUh`&!9(h>n~fzJ3C}t@1Q&MK3#69pto_jqS}otXMH9k@rMXR1}M9kj9jvM
zj&iZ)U=qv3?k%aaoLp?oEcwmIb2N36$oLV9pC&xkLUu)m+Z!o8qFs*v#<-Wsd((@y
z@(b;*Q`~c8VK!QEs~!++v$J1-WoC!Lm2nS|R<ys{Y$v{A`*ekM-6W{CL!*7|a{Y6S
zwW|#dNf|Ao7G40u{oo7j=orgMI-?h!d33ilb}!QbeY31M$@!;+-$B?7-GGYHVE%^D
z=$Wm}ogdp-OEtpI!;J-fV({ZI$fF?k^ATThRh0vI626q|rK1Yh?187%Fm2AF2Lg;}
z(|5g$_wk;UPGs<gUo>Jik<Q-VN@JIyi>(bKga)p^O}@t}W#IA-(*&Km_(oe9rd^{S
z9*iG%36^!uXqd`Cznj<3(cMUb3(BH{%lSK(MB3vk99=bNo!Q_*bR2&BtV;!B0&m~d
z@Vc4iXmpFpTa-S*LljI}6@FP9h?n?4i4DHoE}ClIpZ*Pc{9<-AM%xg~ia->AEPrLC
zLL|;&=p}^@k4*G<hJGb*Fmbw^P0OF#EBt){(x*RWno~8Tky4rxik^8jwO7Y*>sf|c
z^ETi5aiXtv)|}T-p}zB|M8LyQryaeO=NRYtpF#oxm(x1?6#s2|r2GQU#0UerU^DL|
zTvO_rX2Ui$3yHorW4?_{;=RbED3&mP<kmY9o8H$m@Ao-JMTXT)n>SyrdnF>HvHHz{
zFd+rLn_NGY51<J}oIeCv2cyl?(btr`oGb9%l9v*OC2XvMz62#w{;@9}G5YQ0s-my#
z%kW##Jl7q}PMB{nxBlp+$<C*cfDtP*f)drn-5Bnt&YTphGY4a89`oG|@&{ksWvk8M
zg)2jD?IJwLMb8AEA^yHG+(&<N&PXwgQ$uCP82^R<7&7^}Ixkct5#Df*!!Im)W=@T`
zrn2MTkpEGzLi}R(UD!4=iUtX(w}P8Omr|U<X%@d;IqfEH45BXc$r<v+;){2(xabWw
z?rC8RLHy5C$uZl>Ba~vyN+j>}p6sUVRxZhqi+|xJD5-o-_oj@L!Ek}feyz%jDI<o_
z7ro2JNd^vU>Mq_xsNZT<)~>4))=X|6@7R98s39yFS}Nk)68Qw>?|s{Iz)8Gol0<?!
zfe@eO8Hvr`!W$DMPABN1kwEX+m+b?^4$V#-A{+dtm`9M60{c%!kNYn|se>nNd#pYe
z<r)68`Bo0Ui{50FXRHl9fuz2EvW}>>{QatVpJ8FlVulqf%kLuT8n(TQbkZ!X3hq%!
zBUdwURZCx_Zd%k;{5+A1=GnB}wP7JI@`=x##g8wL3hV>B#^lhxk}AcBAMAdc)kY5x
zdi!GMt8JLPnP1IQHW}EVWP80H3Ns$Igq!b6Gov~DUJqc-mzBJXTECiDkeF~5Oq(I=
z+-{nfs~8I2V=}qiI!YW3ytiA?QeJyCs1?_rA81Iq8jqX&KV8!nap@h97kUmF`h(;?
zUFdTwIxz-LXsf;(L%(zYH<HN2PC4BYU7u@JS8^~?l*=lE-hM$p5i#>vp_(+NC~n3v
zoO(I@>rl)ga)-qJQJ91=iap|IcXI2H+K}7~Tk~Ja{J?MbpVNs@G@0mTiiYXCOEFqi
zK*k%CncZ)i3|dq2ZJ}9RP<(@1`^ItpMTI-G*5$G{MyrzC&dqxGZ)T;$jD}m;SIkAZ
zEgV0XIhZK4n9nQf;x};&2F1P`el5=_2jYNo-Uss=Y*%lPRmzWItb^FO{Jyk(N!0li
z@8)m!W;54pwrWxg88^_Lbz?c()0;EBu@lLX`q~IjDI97pxW4}oH5F}D`a1Fv^4Y<-
zXUf-__c2+P3(gYNj)<L`DtzaN{_SDNlNRFYBFT{t(M~+=iC4bA3Ai7BJe$a5$GgPW
zWA0j?=k$kTd#}~;#>T;2kI}24i@^Q%WDOW$kjqB!^mqovR!Q&}=#$rk-hd!KuFQKv
ziY)3fYgZq2>+p5G;tzVJ9qC2$lz>Nvi#NcSmGJOOq|Lnb%zg3#)rp;Fx$ZxlCajhg
zR<Q2OQA^~4d~IonQvsJ~!R^y&(s@&!c3`m9A1vaIzWp59|MQdOef@So={0<v1Mdem
zd96USxtrEK#*nx)h`-%R<ZE%$q)4Ew4}UKP$W^R6%hnb{Fdnd&dPZDLpYrY?rTIJ5
z?}^^M(uPFI$CzQrRAfM6kJUAbvRvI!)PvOrZ)3w<QpJ;U3Zw7)g%!HEx%5pnRQF3n
zMOJQX<{n9YygIIOxssmvb?*N3SveN*XaCSgjXx%*O3gi@OGvZ(fQFctdq9E4&+7p*
zS4K{^=eKs2cTQ7xh}~4C#t75ni<RiZ<Bnw4;er(aqC?K3BXs|holGljBk4=j_0aW#
z8skuj!xo?3Y1N@6i*d7R@U5e+?+dN>^wE$oU>OE=C8&rx9+5`hf6lSFubXD5e!^8=
zjQEIHn%#M&G<=F5Kly@7fEvZRR4u><yg&-ZrnUe??F*8{TxyQwCH`GYQ)VRBd95IV
zk8pWuE+My*1cdQg8t6xIuPi_2DWnT*Ni*2(7JApqezmEUhw_tkgZO(Wv|~kvREMy3
zl`&Z9<Xjh|w9=AyLSdebj5B8R#}0{8?X65_-XH|OHuy7A8o>crTe37@#^*=ly_F@t
z^<f1LJLs=~#IrJ(s);v`aYO{;+-E28=h_!<7IT;C+Rp0GvU$KhvFUYUUm;6L-K5u5
zPYJ)d|9!$E0cJt@4jc#9Tci34Io7r|iq>a|<(1=<0Y%M5ZzfBQ0w04-p;3S3MK_B>
zpmMgZ(*J}zKqcdZ0BT8Y=@dc(z3h!%2CjEufrac*TeAY)3p=JyK@K{h<JtY0LvL#X
z5V5SO$UhH07=>>a(dAC@3%$U89AVhMts$(NuHMoAIIQpWyOiqH`yZavNT5M@q_HnM
zw(LIN8m-nZT0hWZhhm#*Sl5w)j$xX0@^J#E)Rc;Jwg+n|mU4BRF)F#-ilFWjrLsYy
zh028l@wLXs?5Utww`uHy36GK4E=A?mlt^tP;C(;wn68uspti(-3_}1IR>b#>f|=eH
zz4Zv=)gFUfV>T=xV}oz!rgdS3Dr{Y^P+Jg)2Kf@ium7M+WQn2yaH&7a1yESppDEK>
z9>@NaHR2|-;l+>NJKlj&q==AG3r1$AFps)F-yyNCtvjHe=c||dF<llq*Y-`QY-dVs
zi0MJ8KDc`IIo(KY`i7qEgl8Ctu=_z<6_)svbN>`ha4a(wg_M|)BbI2J<G^|ULagsh
z*p7Dp%C_6TP}QB^pA*H2MmRTi@JHITz)#G4RsTT4!<uw*_}V&4ccAzQ&caViVFkgh
znxE6GGnCb|!RT_8%ZY2RU4I92CrA)I@&F^cOJvfSe5L{EiqEwfa9*pnx?MW$oHgaX
zhjllZ8c}!Fe_S*-d8O(Ly#1GehoFQ^o=&!B+-PUZ3hUY_Sy3-sEk~@@Wg34oh}$g&
zW~4I9Yfv$=7HhRrM`FWfn?JtW`%YIrHZmu}5=|93+HQ|x>lRWUGBO4Wa(>%?u-c<d
z?t(>@c4VCT0u!0)e)FdE-U#qco6lJ$94C&(%Bg>HY@QrqtcofOr*(Ev$dN-CIn$&D
z8Yv5Smh=p9be2%H3h}K{*vR9*^MV`HkVg<ysa>A#K=U~bOGJB^UGmx!REfHFD{`yX
zb|&A<ner!`I?#54^*sf?jy2~W{TuHJA0A^E#(KYUJ26K>Xq3+zdD}(C$}yZSeQyww
z10VM8L+i~CRg5QK?Z+L{_?6~`IFV~t^0Xk6sOKOV5Eg&U)hUx@j&ExW{<2MVap&V#
zil%utNprRIUsy&3)_%|L)Y=kc9Gp*;1YI!7YZz-zj_}A_@)M;}gxKzgOs^W(+zQnR
zDX8ngaGV2c(HhFFfbsBUBO`PpMDVohgFd`&4EDs5qdrlPDV*T~+0LS0g53S#63V$V
z{YLf-a2hyOd|sg0o_^bGm`mvPvXu=#YH%)Fd}W^bYl*XWs6n%JmR+HH;8t&P)f2pD
z6|u`y28tDo3p8FEPapV=J4hy&GYA;Do6Dypl>xrFqv*s3l~$;~f~k-7!ovey`(OW;
z`8iqDwwLDP%UScy81f3dvHB0$jau>->ZaowkH5oB!?H;^-u?K+bY~*tCynpEo5O%`
z59agn=7Fx@V1W#Mh<=yDlfx{Bjm?mgM6J4v&c-Cs6L)=O=)1i_m!~Sap>ZS9l;XAd
z++CBwxt{>AaOw{HwS4ACSWoe5U$((j5xBWbOCdhGj51PgS@)jl5CPA4I6cQJ)LNzN
z2<8#5tNQ>S*Q)ODh~>xspn)b=@HXJT@R({`=K&paUHUShCZzu*>V5e!9v-P*!@nZU
z657uMCA)7X7s#LyFoMfO0PqDN5`zD^%<}e~rWb#9IErKe!(Sq6y+FReuc6lQT}tm|
zIR=2{DH!3cjg`)=WW|vU$^>%1{J+0gWU&PM_r+{cuf4I082M8%&*iOfmU4T%H8PZx
z!E3y=xFY$hdxu>$t@eLiGG6Q9q)ei(J3A^UUz~F19gvJ%*_zO2R&YA`WvulAbW$I2
zs+%_rxLiO>RPg}tYPlAt=RO^G*)otxEUrkrft$_8&}~1G_PHe`e*CQzQKZZ>8Bpz3
zk(7!r>~GVHuK$79{2KHv_C$?StYq}p;YXBrn&_hJ#H0Gv%dNgVj8b)-bUN2MY;ic(
zN;+)}s+D}Lm@}RUxk5=0-<+WSj3<@m?QbTnLUgqaATb)>bYno4AE&)kN%Xq!G@UQ2
zFe@9wc0Y;ZPo{T$zOuw6ss}vs<z8*Sbo3Abr(;-*K7h#-38%3Z(FawrxjDmTA|JaN
z+kJNz>oo6<oF1c)y6V@nq^qD-KElXjtp*p)%=|x|>4)X56YZyd30s?v-YoThem<sV
z_gg>eZ(iX}Ht^O3c5vd|msXmoAxB-6Mv(&fMgW&@%ORiLPt%#{^>C4Vr;r-8onOCG
zKw{!SgY#7L@ejST!eEC!s^Sm&eE89dAlz4+ycsEN$c!>n;6(zbOXWy~-$HlP_PIi#
z05*!}PUBUYtV!(sd`F~fJ`2#004#H#1oN|E5b~=laD)g2_$QuuRVaiG&!S&+xK6(q
z!I7Axv_D{^qeNS2ulrCMyV0c^p(68%O*E6`L;Ydc358itWY7}CE>fEKR(4Th*JjwY
zf=wsQ=Do_u#IvpZC7mdYEMRp21Kb~}U>SMq=%3F$;b7Za+172hynGENFZGJ?-%F~c
zHS-cdmVGyBf15}2aQboXBm=QfSla5xK50!wQ1dlXll`-Ay!_#^4u=?60aeqT1uD0=
zfq>Azv>d|^{MKi8LHx6ysaR{$9RqE(-!B&(9se+l6e{VQ!?5&^CWcq@bjC9;P<?SL
zIL~Yn(yE;{KcET%+bMmwscHLG`eN-Wqpri8|HRKCg*^75ALrcF^Pv>QH6Ub%3~ID>
z>sCo8LQ%?IX-CKSlbFL3f)Y()6GoLJqqaJ1S3(<-*aQMERH+(cLl-}P*%qSAgbMIK
zQ1|HhqW(MIB6N3=X>NU_tY{@jAk!*t+~Mcf{nv7dYXMi2rsU0AUC?d{In|w}Shp*e
zMK!gq<xy9oauDvJklMC!7|t_^y^buHmu3_pU~d~<Rc2JCe5_1q^{q&`3-g{v?|aA2
zBQ3p#9YLFqpaB+HZluxElbu;Ut7RG)4{V|^q3y)A<{nt7LnCiO`>KCMn7ll<Iho1(
zn<kb%g)fVQ_5AtR*!4x;Fu3MD(<u17owkuHelm`cHJaD6wI0d4sSetWQCn<`HHSqK
zz@4>VRhUQ0=!wiCOK{lt4l8t(Cc=KbqgvH5fkxaH`BFdTLdXuvII1H7JuxU@o1<m9
zWI_Xw{axJUtgH1n9q&6bi3@EIVfEuYxg2K&4eg;Nq7IqjTK~AQ@I>%l%^a`a-pHOV
z&Ehe9?%3aRo5?d&`M`AA9CsYv94~MXUHXTYrh4$bgYey7G0ZDj7`Nfq9$)0x{B#Vc
z(@p+drWsz#K7T7WlbuM}-0No9^L0g-jKZUPh}rv0b&&&u>mnj>KUb0{+OtRy>*CID
z|N5JZLIs@BmlTE5!<<37?Bbr&{gsjHLGWQ6ejOTk@7tVfp}I0Iuv#HAZ`?KUb!Ov}
z=IidG4%~WaIaOff49>R-AyaYgu~u>Sn)Je}%a&{+7%OpLGh^;0GgoEqek;QzVmI)@
z%0jZXAuc`A1^W6C#)(mdX`{olFAaLbzfxU(-D_*iflCGUuChGdyU4b;p%ZWmPNd^*
z=!j=X8XOLfR9IV1d|YV;4~*)CHzYg(&H~`auh%q%fX7ubewuDzn!Qv3A`8+NJ%HRp
z@@B1g232m-vR|BEFm`v0bXNJW%*GP(Wo45e3dyCx-BP+`l<6))x82uxCq56-6zmX`
zlxhaDQcB9;{ZL@jg1XW6!Q|AZ4q(RRs2HrZ6Uj(}&zQEUGq&yVxuT3mFC8<Xzl)%2
zDBgk26I?$PIb9d$Y~W{KW==tl7h`BOU5gF*=<4jr^v`9pj^eX%R{inrL%R~Gk$RzN
zFkl3yRyi!;N_>k`YCjsF;SgBnWPsBV%723LrOYetsM7eE6D?71bGeyP%(7^kf9d11
zqQrd{T9MgJ-MLrOrM>fZzjdxv6$xLskF0d_!Ci$}FIdrId>;@o!Nc-O;&#D&T~%fT
zr!ULMto-)*CTwT__6pt*0{b!t9rZan?J$(U%~KNpXAGwZO5BKuOgOTbJk=ZvbUz(P
zAEAqv^T%EBGvnVG&vf$q%8U}hg~x4`?(Z0q&nwfpc?YaDWK1G?v2R$j9RfmUio{k5
zwzM}vn)lU)0(6JkC&Ej!3f$|f1G=2XVhKlnW?pp8yi4`imwEcO{j0HhG_SdW_7T~X
z`-R}NF!Gf~1j97|rVNp58#)Nh$d=3+Rql{sDd=e{w>3~t2<+l?>BOC2W&pay?+LYX
z=9}?W{0A*+gawk<dW2CO$A>o&lEp<W{3?eJ7V~d2;vg6X^w7p!bLbLx>!Meifq2<O
z!ZX)bo*@Y+sF{Q!!c#81?h)--_TBAdod2n?Y)xTDrMea@lo3Mnr12H_?NPl?Z092q
zAc&-XU)#0WyKoYpKev)<I1syLHFX>2k!dMK+G$I2b-057<^+(N9SgW`9Bpo-bfe3+
zzY+~)QQL4Ro+oi-<s+L(+eysMct%Dk<lPBfrMSePnM_IpZu;flKPfJ#Ke%?*L1PRv
z{`MH|!$#(JP^n&JD;xWq__v^)0YhF%j(j_BYz@+(`_9kxvV&;jXjHobmcM{sJ^?7z
zjLI}B>0w-;5)IAiSN%d(%y&yWvG96$q$YKfoWH2~e1eCAH(V14EMA)!-oL=8o^$dT
z5<=sutWcdbBLUt<MgS)-Ip8=-@%<|x9MQo{&S?B0|Go<MUd)S#caL3~%&{oz#E&<~
zp;N<DzO<UP=FYwtW;pzSzf#r0e-zom)Bo6f^w;G&1gUD?ZUPR`+b1tYKYTr7F_G=^
z!h18kAu7%oasMetSicqz7caM3d0++hXJ0eVRysTvSa3%EVg$LwL4uC+KS$bOOljFp
zkF`>x&QyaRgfScu(bgDRt$yG;&Y5)QvLt;^n`p><XP)vrBzF9v?YkIV;s}LxpARf#
z3xiN;_`?hYFKXr0P$lJjdLMm$4G7cgc`md#S&5AIfU>9R%&{t#+yrL?On|%lroUIs
zEt9aSNC6zad!rIF8qQWpopr*DzIFuwwxV9*vM{4L!)uo%u^;K-pq{ngm0g@<pudo~
zWOZ)28EoPdmf)71tnQ;?34LR~WKjFyzxz9p36Tl?tEpX=DQ)Ma@pttg;h2*(x|z6w
zG=VbYaamYxO6Uhe$X5ODz))@Wc17Pvp!0OEWsUm@g;>4FWxwfP(C#>1JVhO{ySN)+
zsO%i%jidE5@;abhw}0*uU-0fPvX^%^SL*-hSv<lN+D+IVKcf}D=%Pc(KMef|$*lp!
zTJ>4W_tci!R4wP0{FvVb(Ob^vnTIiRq2=RltUPgnqwh485onE8#pNDdFL@qbsnEku
zFV`lRoROkwQ(s1g%MMRGr%C5uVKuC*4J!g)xVI#WC!YF>e+vjI*i2yVVVHium-PIH
z@6pbsiUYtGWn%-B=UZ+JUAgMTQs>)yf}@j>=NQ49n-2_Jto=Y*WOPw+Z?W$O6Pu;Y
zobm?W)*7=2Yx>~XXYSlIaS(*Qs^uOo6fuzdnD_#8tpsa3wR`w1qe38-OjGh&9Y=%K
z&(p_|3nUPOzsF9r=F-#7#i4wUuXou?5PM;Ed1ftT)`^WCHN@^fuPst&cbRAq@Q7}P
z6+%Xr22j>`h-}L*Tv0gzJHC@<6Y8US8h?@R8RUBQb#Xrc=Ou&Th#Xx0VE?~l1&}G;
zvwKCNUJhPc{ienJGSZ*|nu%8{6F8}2e_2OYYx*24dn1Ud_IidBNefNr{f4ASIVEp^
z%aHf3awKwxgg-l?)v<Bm7uDd7qkp``vO7fPOP^r*=2KTvA_sqMjct6L*wG|h#%Cjc
zJ`}>rrY}6w!Q8%;TS`P4)D4$6n^0U1tp*U^GKYP9*nkJuKu4D^I_knS2wg<^<S-p6
z-Q$WhM1Zv9yo>m>Z0dj2{0m-wJPRf=kuMSrj@RT_!=j4c6zD%$d=@Sj@H4}xU;2(%
ztsMOEH(5H<7lhU}U)R6xd<kt9To4wj8C(W-e?J70{lsu)V99{VWJ<b`|LiSX*DQ6&
zT(&ZDC)L#Y?#{v5(+h}>Bx_~&SHo<OP)Ah*zg0p=GT!1bR9PY<AcL{PwMotv6LK5x
z8I<W}WnBNbH!DDmQ#we|`$6^vDe0(lvAGJ(%effUtP_#ca<;nmh}PVc2~WxA_VCvp
z-{k~1;^7-tj0Rvfc_+=at4L6A_!vS)Mu>D@Hv7wf^{~Gpmumlps(%tCWh*K-sQB|z
zN*^NmTAYvUsms1BTwlw3$H?5Cv0$7V*e#Ab1ZtuLdUT2T!r0P%0F+weW~Jtl@Chs7
z%1yqlJ@FYGwswkIW`*JrpLeu!UEKFb8G-HC6DuDVXbVg)?IU!{YQ8tVPHxYq?_JMu
z#W<QdeauV%g=++{#7UV>C6MDV-OL_47<840l2s0=aX;JF{5vTqxWw-gcC!dl8CUvd
zdqK@h_@EHU{-xYqc6>fDjdf>Ye>m0YSr4n<$nf6y*Mk{@GofKF;Fz9ve>9}CKmG<F
zi(mb8%}<!OAGCZmjx!RHZuxa$$M`K^`e(~ue&9SRFC%3$7d+elprTBVyg^|zcEm{1
z-2bW?P4PXz+11ea)Y2(QtGtN0U}c@9ofwalrJyj;XOQwtl`hs0{+3mcLrb`If3Rbf
zE;X}?%6xf4&)gVxClKbY+Z@%7%nf-S&da|^(_hk7jA1LjRv;-Z+HFrd=YGD<*TLuU
zpbIfvaU<9;(2Zlp5M7Ub<X4F}7~>o>O4Nczx>_nKrwWg_Rh0U>kYw&kW<-u0%-2oa
zaWFHfj0+fvouGw$U!ch^sapJ1Y58sTlI(DDlyurHDHIwi^_KaQH0+*k(jH<7$$mf7
z?H{%$op6=kAiw!9zi#YB`v7AwZG7WKMMah=>5xpfPC6NQ{SGM`r=WuXU9hL!uP6M$
z0;|J_zoDi%6ji8f%lbaKs2MuA03odn8--g4h%iY(OF!mC_t@$M(qEVOwRyoz=Q;Z}
zZKOqwu0DK(VGh2R?GjU*W_jHOV(jtUTpAsPhIgT0hTyWE*WrAJd|iJg_*^o}TFV{o
zHbo0=k}g_vI|!aQD{4%dFHSY&gjp2+43@}fNem1FY2RI;A7H;(5!c_YrYwKLq_m^o
zz0CmNqUK2riPOIXJ3R>@*Lm*7rCg+Gs_@Re(t^#0p|#~sKBa~0k^P^kAeVaGeQ(*V
z-F_Q4feX*NLCz@G#LngY-zpQQFfHUA+kEeg^t7TK+8<`Gh!-;&ehYwv7+DDeNf+c!
zh1%wjG}kIjk^D#X7Oi#!N89rkN#Rw>6I_u6#qRaG=52MzsvK~T#vwFSZNyu^gtV=>
z^Q_3*eFS0k8HbAZatQiR`=DOJC@;IGEL^!-W?zr`sE@t;EYx6HHYL<0pzhlXv=0*y
zNEbHO>9>hxG-UGTht>&cy;TYOo@yxL!1W*J2o&-H`pM8^Y8!?QnA5vG1Xt`Pjx*S4
z&!J|F)r>u46d9gr^!0raf)DZ|{&D^ODAHV0#*x1p`E$242-p~4)c@87CJGEaAf4F?
z5Y7xC7W1*C1>m52tS;4kcmnV@Q^fQ9Y8$To0y_*Z<H`RABm%wt0$jBRu(MM<rXhy^
zE?NO+UC-=eqbYrTfnvwDce;Al*m{sW-vwU#ASw(rdheh57$}z*da!20sSbjk;fy1m
z16tNXv|zN&Hb>>h^FjryMe9<>-yJzrD`FCD>HzruWAh4d0ZD6$056LB{*u^)8`7z0
zI}8Z2+T#Tgg%K~6n=ZsaY9y|ppnsiGrKIBYQ)>qPD0v7(iTxf|fg<P!`@fJe8vlO{
zK>jZ{7)tnWP+dQP2&HGPf_9J}dx;eqe(<1`n-Q*@@mv{z!kVc3{@4FCcWXxLiyDA0
zZQmg%`J-sG^PNtxLG42-*(WO*#Z#g9&vHS|i&^(~N;xYYEvyed!vksc0r9*=&z~g8
zVy8Je3;mOSP#p;I9T?7v3Z6>qZN;x9Fc^kLu#uPak=)1d=J(&CX{?OyRKf^D`!efj
zhD}n&+Zt+n&HL+iU&f4U;UPjry@%Qf+p5=B{wc$ON}g35#!#j1xd);Hrupg`@L$AB
zIw5wCM;jaR!2O<Lb|KyUBMG0=(UpSLQVFcaZjliX>)ckF9V$G08hiX8J*PQy2lW7l
z<k8zrlNJSf1|e;NfunCB%t-rR45*E{$?WFxf8&`;>;%K<`yMzrVLbw+>ei!xKbbRe
zcYaxnd$j9M@5K7HXcXTIIUcNKuegU#)5OP%uU?jYq$1?4^bAT0FadlFa1-2jzJLgE
zqyI6H3DfjZ-+AkeTTBY5hjnM`P8Uz%$6fsaE67Blw>1PM@9r2Z)eE-F+*J`<OssiK
z-pR(iE-l8z>IK``42aQ=LnT%>3O_YQI~V^yRDE?oluP^eQi6)4w19w!(jiKNN~nN{
zNXHT)NJ>iX0wN(LA}xz_H!RJfl(cj#A>GYVOMC;KbKc*_-|X|u%rkSxbzk>2K~-!U
zNmaj1&F5V%VPvEpH81G=sr<Fj^F0=?Lr#Iki^WShI`5esySJ#wJybv54pMS*)WHQ&
zdGD)#V^3X&n;}z}qNlAT#j-ahOdlrX|A2Kx-ynY0B|WJ$9)bCofZT1%S<rG2W*wDf
zD|~J#C$UoH1hsDX2YrQf;DJiH_h{ogL27w#N8{lDNxWQ^{IbVG&$<`X2OVdB_#&OG
zr}+(^%viOP56R4mZly+;4hz5C?a%+wogakYSg+e=n5+t25l55~hAuq#c5I#L9HLky
zr4Z`U5^;p1MUb?nNV!!W+GcwYg)X5_d2ic`qNg)4bhjUuN!53lb-#0DgvisgjF1{h
z2qusVKC0Ws+&GMMwaL<-DdFm#-#@)|(8k_!Q=3VRCSQ!?vY~Rg4c`k6!O7d8!#hpJ
zaJliTQIFpqV817AO>`vkZ0VYlWQ$Kn?T<LPbm-9wwXoAUxIpKy0S%fQk6Uis8N$D&
zF#5Q=CRSun>anVsK=(bawf+d_1~n=7@c~MVnMrer>UZT|*ipo;e5e_lH1%SZMc~xG
z#!MXm!PH8ff=JrO>4(<2)A;-*zI568A1qbI_-em<7?}3P^s1F4>!BTLt*z*k*ZYzz
z=?sEZyJ-CsG%8DcSz`U#H~U`pUCKm8!iH4O@N&lVbEGUaM)6i)(Ff|9ee#cIREKD~
zsciYR2=ePJ_djssjQQWAt`7cH97g--XZ0#Na3PLXrSQ#nE4iAiQG^6qeo;2H$7#0m
zb~An=dF?#y*(GnR4nl%saA$9PgJLm_#dEPWLs5h_r^#(uT@I2X+Ki17-oKZ-Vij(A
z-NjE|K)P~%^S7Rb^a{){R1w$VK<iNMTW(n=P+AsDoT;z4r_sk;6)d@5n(GeG#pdi7
z$n6~~xDwltDxi(@mi4Y_&xG;VkJt@c8=IH;hhlDshhmJ!du;tVxxeP&{sn2kE#kl;
zU6qHC^M-ICdpK`-3FBV6ZW0hB&lL@M17py#TlCoN&)vGM3d8B3HM2mhSkk#(CV%!A
z?14BQ#}Vjn^j1j!s&goEYm(iowJO~8E!Uamcx~$jW1Ms@L~}CI?{$f?_T$pSqE9<f
zU*uo2!EUwjHKUm!yZyV)HpQfLq}fSM)*5vd#(IlE?ynJFepQv!O1edCKiPWsCvzqI
zz!sW1RMhqs8OU(A{9stM#0U6ncOHJ|og7%FM!B;n1!&_IsJqYD-74WgH)QT@UCD{7
z)h<MOr;O`<?A8Re@T><L8rfLKanJw#e9X)jT!)IVd~=~X*Q&Wd_-l-1?2sQD!keu?
zj)1=!F&opj-*FNsJmHvEwS75}XQi?{*JW1HK6h2LSws`vs>7E@@&7N}6_xvdbX}in
zml@5by!4T5d-utWx3@XDy+#&nTJPz2*SrRcHD6BsL^@CjidbUlyWibLTdy~v$3ry%
zS{KwSj%=j)VYH;5Z?W1W60u=*x<8>g3I`PFg*xtA@jmw8YpJ-~_dF6_E%0_W%4uy>
zO#RBUwutg@j*#cy>qf(OK3ZDYmwgP~woROOpU24PN6HQ07shPW&16nSx!AC+#17rS
z0Gej|`Dxp+oDj`hcip?K;@Mp>tK%P>Yu_)lE%u@bztE<+sv$opALR4;*KRlsQ683~
zeGje8PtY7P$bnS_sU%pn#Rbh5c*N|VhYN|5zmtC>eWOvwbCXSKP)^>I!uEhKWdzB`
z6i|l9NB*7YOGURDp0Hkfr`#fW>8+I=ow*<9g!#f_Sm*j<CNjQmA^XUlxyUb(dos%I
zvIoJ{y+I99T!e<|uQB7U_`0H(4v)Hrd(H^yJTo7(#E|!8m|QEmy_Pg%dyVS!#ZAZg
zaLcjCOB;S{sHZpKC-ojZZFd~FeoHlrt~3T0tPzyWaVFs0ZowKD)~MWY&{B~w+c^XE
zLSmsKuL9_7?97*7H(KgN_rOuAQKfentn5dEKE0JF)c(mN=2N0MT;<3CbyEBGY|mlc
zbIAV;{fhA9jAr8Kr}V`8cGBbJiHO##H|)yTu(E?LZ*8ID&cUW^JsDP0B{}H?_eTiD
zLw~DHS!d+{qSN14qCUzHK43-3<@MGic7>SPA*S}$>nGa+p%pD<a)x*GCv90kAwGfQ
z`ly&-YdA7^vTQDr!s(uUD)WjmULld5=g`Eb7YtRMmCs#?=)(1l`$SUCs)^_12nvy-
zl5D?xlQ?e!u3bCd$|w^@vG1LsgRktv7)H!okcriRT;_8zZ~J($CHc@p)0gZx+^Xw4
zJx8Hi6Q$THEyCbDXQTNwo7tMBBc6>L(br=dJP!tM)$QyT53;DPMBP(P-0#vo+bW>@
z!NpZ`GRQ2pZ+n)2@_a5Y*;-1^shjJ73G$1hPFdDSEdJPS^nJtZquZ?8+sJ=Vbr4-$
z)`q@nxng+9`rvo7CVKPw=p$~`5i@sR;%YzjtA=~t+w)fOe)hKBTAEG3TuU%ziOhU?
zj>>rxlH&B&dI+QT`*Q`HQm1QwK03Ku8lokn0PhxmbMLEe3~lyXZ!y2zQWL4`h3)sd
zR1-nl4RU)Rn$drSu7$o=Ty*7iJbt0Xj3>0zU6)AUY+c*ZSKhnw9+)V=xA-eB39uR(
zN20iKtjxyke}tUPVke!j(x>lo4@`eDPaOXwJUxYD5<vH}a?|CY{IYSa#-8HAS1%88
zvo@Xm5`ux%{QGqwku0;SpEChvK-SGE_{Q5fk&<9hZC!Ud4IZzu$TN>`=~ryMhr7b}
zo^-+pnBw8CDq-`aT=fI**X&Y6-zN5QalgTK)c^#7FsA(l;(bS9xqqaix&TgYwCbs|
ztiGA6S7l=mH)$cF4RBUp`|31SFtB-9H&6#~nyfn}91c+JXrPyAnyZJ|zfh0h7A2Ti
z#b`nzn7<J-nzU#|a(S_1ZLmp+U0fa`Qy=+GZJ?56k<c1jv(k*v6!`t7;laYuXDYdx
zM+k{Vo3!BnCdJi4`%n+MtBCjZ38c?20%>pC6p=Z?_gh~+_cP0=6Lm=N&~r<GmGixb
z?)^RP*bnFXJZW&#dNNj`b=I~_hEDz-Tni_^ZY3pYJFo`uJyy8cCZl{zzv0~1fIar;
z;UO!Lco7j$^}OH1%uATHnR`g+ZO*Yl=FSzvR-aLO(8m<B1zR=edMwQ4`^z<JEjICy
z!`q>f=789lPaRX*CQ3s5=^$&D<S0H_wPZLmGT3VOh3~;n6Y#<v_U^nWsM}VYa>#x2
zQJKvn4)d&C%~rYlz$8)J|9|sSpcgGmdd477iu0I(H+5g`2_&MK4h=CQzN^i2eO}C=
zzA7*yZA|xs9W+E8B6sc6&}xT`-#<T87))!0>v!554q(2faI8nznObw)Bb&?DMpY7H
zwb2H++!WQ|!bi{Kg0V}-bytF3aq{0c#f-l=i#E7rtpHz<j~ZIQQ7dWwNPEe9Mc+i8
zqM|PS=Y*&})x@PdIy&g$YC}}U4gD25R<Dmsgv%`tCP<qA1+xRWNRz*CJx;O3`xGI3
zZp!VLwnk1f({B$_&eR{VbcQ=a-K`_pVX>R26KVLqhw$2oh;y(gkEJrpkkVrn$!B3w
zLouV}2={R{!aZcEaQGX(;>mpae|#Cli|3~lm#iCiMX(t!Tgkl+5{@$_Q$5Q>D#2Il
zLiru2Ihy4_PMdlQ?WMM2Gdhc6Vlfjg-nR#quDwfyZHy*LU;GxlXCCZeWsYw*33{1M
zFK6_YJl%7Mrg<4qgB!DY)|_bxhZr)1rzJ@T{)*lu&dbqP^{@(Y6<GLo4fl{|dZ4$g
zIqqndDfW4bs{fv(vgKH|nM6b#8%YUfPUJH$ZcIGuOs&TrlB~B7;lPvJwI-2DFkdk&
zT0^JGp>L@yh#aIa$zg6vKhcXlTbqDyekyL_ql6uBobGTiT7GvkT$|Ss5*8YCM{bTI
zmz6|En}+E>__d+NZ~bedA+K<)3x8kYe0#I^Y_ORmI;q|CcfXzEK<U)07876Qz-~kB
zcs;%l5w^KK;-|0d0Bahyk*WW|C`wZy>LG_}pBc^4N@{o(U+<Si$269#0_PC4z}xoX
z_+9#l8sfa8)$ArZU!3B17`5oFF=`!SBD!CmCmB>v+*cR5c#BwMg~-b3c8q7fm@Eua
znz6OSXq7ZuiSJ69{C?316ESM0sb2ToY2t6$k%zRWPsJ$6M^q`XE)cg?$Rw0E9c#P}
z<r4G9j-FFQ9%E$BKD&1EctzUHYtF_RzLA_q^Y-U!R>H348R;=oHCl;U4hFGVjxCF9
z2mE&$7!-eTv2M_b@k@__8`0^%vzmNpm&r$G+?Qn_*JE%hvn!8fvtj#LU6ZBL#%KSa
zvG(>s*Q=Ki5>B^SnjLcToj*F892Drng8~&p69Oa6qH#twhwiUEt&O*IN4P~hnM-sZ
zd5dYXcFD_DrR%vO^cQ2_<Gqc37>Uo{jAbt(-fG8BpcXbb{D)xz_$G3TV*o~Y*U*AD
zkem(Dpa9cP&;UcrzJGH(oS1^9!=E&Rm)BHpcF%o3!G$z_fN1cL)guF38w(WIk6RPG
zh>+p`Koo{NpV9bD--KVPojQ<29ZpBR$|TX%NEp_oAF!9eb7hJcqtBLC)3=<}7V^x-
zgM9x@`w5`q;9<V5O$8aK!-MBC_~>8%@?WTLSsX$3xVyhbIh_>SC1mxy2$Ec34GP_6
zHn;VW>PurhB-VRqn=q78na|VN>R|H%v<!Wmhv644dqI!{Us+&uWIyf~|AR^75(LIk
z>r~MVk@i~<@YBe9J=6Gh`tA!MWvNzXt!Hy`of}>E%_1M_PWkB#<v4EOQ|Urlzx~=P
z8i3$fHQZG@euR%6{@=(VXp+JY3c{+Ktm(<$e-V-{!`-J<<<*vfDOEnE1+*si*DA{H
z9{~0J=Bvb%fD1hj>T9^emr97Xu991^{evdd>wM1CH)2<OBKSz<!6t6nMkH?Rbx(T4
z!BGV2S`#Lvb#etkQ!aa0PV!av*2q@df#+cl=J)k|Q|rp>Y+i3ui3aT@KHOss5m2TE
zK2n1SRN#uAoWEe^UuMzy3$~iSZOn;Vwh`%G>%RI*O*u#jPngH=?Uwu%9r=E`tZ{2x
z|3OK~?jYS{=kC)ltnqjKx#K&+YCoDx{|Za+2O0<3{*POPh-yER2qDg|GpiSrfuLog
zSYRwZ*0277V6?7MlyOZgS|2vIt(m@V%v1eC@a&U#;6W|>>1~2<p>fn1sUm~w>pXP&
zKO<Kjq&YX`hsQ~YbE#JQ^wvi(JE(NHvbo|H)}^ddsCeFvkoe_Je@`2{N{a=QlbQva
z_+$%1{sm1eA10?aF_b7n+pD^cC$?&2faj3CE6l@N3A5B0QsgV~n`z={Jy4#Qw4cqG
z3xLjNB&3jl`rle`)eeE~&2#pk76Eu{BWGhlv25XkiB0`8A(hYn^goiZs`gEX9KMI@
zsZsJNIdxzCdi|?~x1)!T+9Es8-OYF|Nhpj$0k$2W4BBGx$eS%R@D<IA!7~dVfzqF^
z`X}fPD38@1qLd~bQ=Uz_r0hI?@cl3G2D17&Q+un~O4D5Sd(;el;)9`I5zqAx2{Ilw
zE9$)bQ|{cTh*<L+RBbXK2E%QR;O(X})Txg^-yAeY4ooZT!&V8TPeZHEI>YogGd8ds
zwkT}f*%V{SEB`at<Tx{|2Q5{!A!jSSQ_Or4qKi;b#>u6@?yco8i#x9lg)&QTH3m{{
zs9bJp__NK`i$_Qj`mbEi&am4D2=elbE<s~KGV8Fo)NWYsgYknJMjT@D;Qy^l$#jS)
zyxj`VysOuOz~K9!HpEi<P&*ZHc9;P4@ld16Bogi}ua!#00^(T{TX6>jdCjA#Cb-K!
zr4CWbAY>4a$Ad+$lR1=89AV%#a#Ql%=5Gh1Gw%;GCs<M^bJG>^le?h%A^q93COP?P
zXTyfab8zZX{#iWVC;hoDCXJjtgE4EQEp&V@cC5TBh;TY05q#2tk%@Ak(?hQq$-&2R
z#A#sufuOJIPsjdQqqsbCAUW#w!IpH5`xzJ1b?E)e50HVm=^#GXsoQ1cmfn5%CS&Av
z6bX}<1UsztyX305wdG~pVR|*WEv_)4J?sO|?%;!uMDp+p3OHmFbXjB?OGH*pqx|Bo
zB$`Bu^x6d~23@aD9iDZgi}KNzOyMmCj7vvYFyYV><sjcc5KRuIjpRqo>q?*Y*8GfK
zyOv(AoO&B4yS2&{u79=_op!E*vec@3W@5VS2y}jGe-1fJ)h99KS@S%E=&EIN!$2DZ
z+yxC^qe7AW_@^%z!VBn6wy83&-BsBUG<O`Fhkx7ElJ}<;<$ySQH9$9OJdeTOVo=;_
z@d^5?<+l=&$8*0If}G@-=3-5>F>in4>O((Djv7Ag-~y)@=T+i4IS#0w47Z}8@rWvH
zVg|=^1MR?LJ;2Sg+Onh&A+<Um%;Uj_$88ip_9hMz!R`+*+<gExKKOf@JT@J&yG`%5
zUIhIfXQ6X%B}+f4l}ORPIt7@IyMs#=RiPensB5{CUjpn+d&uV;(pcIji6!u26&U41
zMUL)`45&tdRlfAXdT_fYZ=X3&Rw}<@JKKEAazUc-1WTziHtG#QzR8U^n4|phNSB$_
zr{`~*GsFX+9FH*ltFG$Xh<-`{rG8<J^BhzF4VChr<OJ*d?5{pWM(b!)K63o3yZI$K
zhI-Bd82amOSGo%#Um`Ewsb6EJBgw!kZHM=Rl9%qr(@BSePqCXEgn%uH<_4@h;OY1n
zLp_hEmaZjwD!&R~zb}>GygKOr-~7EylbiBoE4%S@353I$k-9#5+|R(y#ml@cg`*TC
zA$@j=B@%5oj82sO`@nN=SHlujv(;?l8SvlMf_UBF*17l@(|Hx03?Ikpnile)46tN3
z{?E&R(4wLCGz}}QOqmQ|bAGr<WJqO3H9f?NUzq%V7Y1^(9>iv{{9eEt0v6>%vU<*r
z?8X8)BEuc4|NB-5VGae@SCDJ~DdW=OKZNAm$+?aK5*HKOKism;Uv%>K4oisPN-G=e
zr14|Q?gGg~^l4XX$&&l?us*eYsY*%&P+(p<34^ay!lCc_*u;kxEy=+%yTz^;(s=BK
z@9wgxq=5$2dnX?wK)Lt@7|gHirUF5NLeFy8<fBF~&ZCQVDd1fODY#%KZB&Vhe9}9z
zI`}-HZ;QC)i67(RX<Y*%8?~VMJ;N;Vs2Qkyoq4WXlY;K_<nubUIvEN`H%z!<Nz>hJ
zk3&CRG1TS$Z<j!j;j~*hn0)tMapu#uV3vh~vw7X62&ns=lWEQMr+}<^pK5nQtl~Fo
z+#V}<RVFncs?{F%pNKO-S#~F(t}}S&?a*MUlR2j~wQ+}&ky5h%nI?!8yTJ5N_i?M4
zb4_{bVj4mIhxfJjMt|F5B&8D(C)@rR!7^?+vOKw_fre*)oH9_+90Y|ovbnvM)~@Zt
zw~O=;8AnIzHbDUpq#fvR^yLhMni3fXO&pQ^XMQ1t>Wwz;ncdrNHtt1yaFOx%D_5^D
z=uUXH1ohgUVl)$jR1(RlpJBi4bf<Q^cQTq_vPp$qj3Gf8*|;%M3oGr=GmWG*O^oLe
z44?lF4u0X47s6YX1~^vQy396}|L#Grwg?FZv2H)k+ROnC*X2zY>g{8TZoj?Rx@6oZ
zmiF*3TWAeXn?C8UK6Pw+Clm%Uc+CFkyu+5{p(b=E{Uq7*eMZ^PczE{EDn8hG>@T7q
zgQ8m_yHqXGqVGlan^iL2CwOvu9xY`okccrcLg@}aUBl*!gfoeGWC`gxkC>iK{|aYY
z@clVa>uy=v_6(eP<Lo=IPA)GVhm{5%>VK`@3s<oSn&^igx4&*aDl1&bXlg3ToJ{Wa
z<gY|UY@r9qxL`}0sN<fjU9L%5X|swRUAity^Byz@J=4kdUE9$~&-DcP^OL4U0rFtb
z$eS?3tXv@BEQo263%IIj;Djl!Z6dj`JjJ6yM^>-#M7^m11SjfNo)u~Tod!-)++k-)
z)Wqx&s4524#Z=eSA~hiGY_K&KFMUT(x9y2_2S0{d&nX_#n##|1a_(W{`v<LeAOB8B
zJTo<`f^WQ+dJ_afZHS^F6VB>DOLwX!Gm7b4>TTqYeG4*>(BH*3?*@J$m8$7hP9_A|
zmPcCt;@=%7GxrdJ&R;N-&7Q#BE{??20%<vsp)J#3Z`ijr6}oq&WP42oV-XXsd&!Ii
zg<vx}Hh)fr4?T4EkUT8&e-kW|!dJsmJEg{lc)Ei+9Iy5`Kj!s5Kmn(E_u!i4EkQ;_
zm5I~Qgfor17xibpS}QV<2diYdyam)?NH3huhqUL;e7xQk0M)(u?=kzn-AHt&^;SRI
zOfFST-R<6Xw<L=IkGUVFe+q&s=1;Cjs2+9?WG_6awu!9Fgbd!@I-Co1Pr1ViqXUq)
z9B*ApY$!_b*}|Nn%4F<><A%yc02B#v?m9H<UHEum$_QS*g7huu=SBDrwDzHjgiiH<
z|5Sf=PFgS2JU-fU4j@!0?Tz$-AYTJd#mVYbyB4*P_wAr;>VMxYOhqOuOaI~HOSMjj
z4T5~E6|MGA*lkpGBO_1YZvSfRtIqnX>gaHenV#1fM%$Awt98#>MRY@t<0NLuaU3Nc
zD@ZQgi;(erkh|L{nP2K8;mH+}|B0qv4B^J0)or`z3IiQqHfwZ-a!q`?5TPj_U3zge
ztJG$i5pT~*zCSdQMEXQplEVW?PX+CbCkz_Uu%CNi?to<6Vdfhs&srp%gsZ9B@;V$*
zch(%l6`p7rYQR8Umo8g~$D^~{CIiuBUAYO<cRW()Wst(gEn+^`A<w295c(>T1;ro%
z`1G$=&XnNAk-Pfz<=17E{0QTa6Wk$3J-()|NFa>$hJc&$Y<TC<02PXq<7{0Q_4Ly8
ze*dQuqwyitKHT3gn%rN9<hi^?TtXZ%1!CPan6L=<)F=0m%bbc3#ay%D_~Yt17bd)x
zofWrbXD)(5;2;wrZ~V(W3K0eeNv}EdT=&n49P)?q_D|XqHoa9&4ub#8QPv~i6A9p7
zfn^|g@e1O;zZE~UnVV-}1$P-3P?&Bi06hI`=2={LI95-uQ=v+4IxWQ}YFBJx*88N9
zC6c>+lO7V~9LJh<0?%z>-^)v2I;Ed69L&~h9u>a-S+M09ppfu~71~>R^R;YdIHsCh
z!zw9tt-`=WmX)XY*7W-Xgd!v-=WUVFmjL(Iur$K>uIPJ<?;|I7I*Fv$0*+Q(+c<V~
z_xsoCkK(VBryaa$8>AT;x?$I3xO}S!#_YO`OmqHtUsFPt!>f}E)^x>C@Eg2uvh8|}
z9`5k|o|J~{xm~#v3*79Hfsc62Mz&?&{*5~0+kcs0%0Q!~USfJ^ghOS+MVsg4aTUh<
zL569P<TA}&FUHD@61EDK|4!3U1wKDpg(Kt8P-FXZwd1He`=T1Xec4kkM)rY9o-J1+
zcfZ*i`QBNQWG5)BS~x0dgTIMx{EBumh$4>^3$?GPS=4ii516D-pf6%FbWXU1u<vKx
zzBMz#iIYpbWeJ=ZY0VtvPQbYlVlO7b;dW&H!3bN4>mxE80I|mp5E{l>U!o}+pE6?>
z50C1U3?u1%Kx%oFvOaidBr53tZZoA%YJqGOzKoCc*KEqc7V=SH&A%Kd#t6npp6iE@
zsFbJ*zS*}wt7hY!*)A5AG#TJ!t-8*QlS}Oqes8~2(14dP`vwm8{Gn-}J_CSM*kL@1
z5ci4Wi!kTuO;7-SNQPfX@Y3%*8e07#4j1%1UUE;t&qE!I3N2-zb_Wu^pGo^|Y07^j
z$fo^2S<65Rb$x1!hQ{Yd3d!l+L=GQi^;UK|dhapvz4~zDuy|wX^;dnrp4ol3*C$IW
zN21HE>>^bLx5NiADZdt?KdM0bx;<l3Zs@XmMczFhk{Zy)0ITKT^G`%YEeo1o0GlU4
zeleGi$9{bCPsEb@I#UM9sr^IOyD5D*f~j&tacKsQQQEXBESCI{3PH~O&lIUVfvjY`
zRk<mCE7bkv)&s^=!iY*KRU@2^In3+ENL6{n_7%ahr*6mq;ZM2JcaJdY$P7JI5Z+hT
zWq^L`WsQ+)4N;^HgiH5WM-5Dx*pTF$e|i(Z0JwM5j&*z?^XR=z5a~##F(3Vey2<fT
zo;GxnKF4e@FuB<;7)&|`fW!r<^*^uDI*Kdchm50Exy6f<oAk-nTck}D$?Bs7NMVb`
z;d8$y)a(@>yE+d_;0_BSWxl@M&0V1^Yr-97Z7dL`t_MNnm48>}S-RC$junnl%iPY9
z8@i?L^IhPQgN7!h`&znd*H{W3#8Bq}PKtHbe+Rd1hT?T|8{9cco}oT%*u*z1X=W5*
zAEXatTtijrUOWx&oD<e~f6PSjn!XKAq5*9Rd?u)}=W3v=LWe$Ys?03Zipd6)&d(LY
z>bjg>JkO4G9L^WzI|O~pOMkORp_dPSqPw)DfOrOlErTd100$>mmYM|?dDm;n0p&5R
z8N8X+P%yDsX$aj9G&D^hoTscuzQDietO6u^FuwX(r2Ae_%r3QHvWjk}O`m3bqmYIT
zPE&vqTe#l}6J6r<`Q^b$J@mCBd^$Q!^wtAP%|XS?F|k6Uf$%XvAGS^g0$S+@*4*n)
zWk)5|Lm~5S>19vHf0^}kW}-vL>#6U;tU<6&bm?=1HQ9x*OrJXltb+wy&N!GA;Zp!a
z1@SpoVDfY{bs7`=XyTqMIK>KGdkJW!W;fVU(e0c9OBMbh=YR*&zjZ4hNK@9oQb|B+
zgDD!4-V~PPlGVfdr28n(RG+WAYdJ@MDm5dWKzK&|wq$DX{;<|DYUN|L^>|-NZ?WX>
zM?Ol%Y2#&WwABOCzq3=qE1*%T3u!iK3~u2{H@crRN9s5Uhk=VwAF7dPXYi~X4h&qn
zY8XU~x)0jX@bP~A0Oaw}_7xyKbt&Y>DBG%XMmMXMcbgXW6;FPd@kZ+`f!qb?=MpDJ
z2c($<9qe{b`Q+T;C+H^+PwF$69MUoKM%Gif!!@kKt{FAeudM9<1)GTKgtAKSu$H4D
zrh``68`I;c-;_f7Deaa}A$ifMQE_|xUncbHXtLAe_VT~H9YK@5xh&|6Nc%;JogR77
zhtQgbu@OH}<yHm7usIj%nO57tI4DHOsfV;b>pDGUSrXXZjRn^z&UZBHh%68wa?*F4
z?*VdHkGY%OfqPn!fpB@hpMZ6(1yP)59p}lR(AMc;-z2y7%46|wp34kEOZsl<wbya1
zc*$4sEOx)t3T+6-Py7R`YWQvGeX2#))gQ1w^)7v6*J<*rfQtLE0lmY#(7d))+V>*v
zEz1Uce&8vI?khw3CiHk4?72rxtf&?~uz0D17)*5JqCyHNPo2Oz7qR(tQtF|(>lW7S
z-s&=sPVH|T|5S3DDF}AP&vpF?EO+usUMA6AGebI(iLa(cy;@xS7S+Z-EF?%FQ54vD
z-!FFFLn{2j=){9pN1tXAzj1wYpULP$OFej=2s>J;Y)FJJwJ%jmA06&Sa!853uQP5y
zu$8CzlR%eA{7Fz}e`9xbO??cm&dwtlNc;zfu#?Swkk#tkGPU(I_vd`^3Lov@nH1KW
zy2$=M><Q<;3j+CW6~zOy&O9FinPDVu3^nZ07TNUAvLQxAQYNun$tHR1KC{Kfcy+ma
zJMT3xe-~`0^g+Rp`teavfn>?&JW^Aa;{t@XF8ON616f<Hb;{a*tLPA9q<R39f!hm&
zSuR?U5a-3=yNx*%KhK*MM+EHv{$#@A+f${8gJVU)TeJ2NUKlzZJ>LgCT7HC-`a0EN
zqN15zQz=(Sy87+MihgspRnOInR!o3<7&2%_g5VODmX+4)gE~+@l7hX-lTF{BblG~I
zsZ*C<vuv?ZX{3YSK$&};tbYDaLV2PCR_qfrj)BR;-bj}@?%ix1pL%vjrEDQ-W_YcK
z`k^e}f0ZI@lgQ~IYNB(8L!AR)2n%$Bntvig_4BdKiMCnGcZXC4TPv0C{>TJTOFakz
zAi7}9(lYbr6~k!6VQi_zjoLHChg&PrD&x}82Wbu7Dv}zN_GhgMx~eOv=;L1Jax+}-
zLUI<P3w1L{p{xd2|G@M0zo~_U>;-X1l{lk`5j7`eOBiPONXZ#Im*TK;xA-AIB-p$d
zZ}j|JxP)VM88mHbhMaCZyZrFI=hoYT1I&i>!C@sJ;z=F<QnS1ZWAP#<!UwD|uvid?
zYo-qviL_@6NAFPLF&0D;d+=0>^VO^O1+4D^k<(UTNn1<I^iYvWOCL~TY6*nC;c7g=
z3aob!qBE&DMjQ^9VR~1gVtOtsqOrOx8c*@D;PcN=)r+wQK*c0ZHM?`uz$;Mjf+|f<
zw2Ku|C&BD$V`5yR+)Xl~cF^5(F^=|B&gtmOXIS^iDt?^Rj|-@B&Wlf&9R+b-3yct7
zqIlDgl(L}$fS@bjz60Rj9)i7m)z*EAx$zs0h8+3oxl`q_T6s+ANWXFirrZTt@sC1s
zCek*G5I}Nb&~)w>@1a%(UkL8moza^p?gBj$=jdMd-T%gvk+JS+&k-{T+gbdubdDO#
zPh8o05PJIhEl2^z_rTSilMdO1TI$jpUH1-aRZ<fg_BVXjg-O#ts7Mr1?w-X@VuX)$
zfNc=T2A<7v8re(Sj=o+><Oe~%W23wNXYIk+A5<5Ym-<tDci?&p!QpTc0qSvsn#XSU
zYql;81nMtmTL}c)U4du_lnd>hk2RO9mbQ;CDj#o^Ap+&3Rhsvp2soJ%-ioF0-P0CS
z6uQvvFqWeiS~=~oq@t&#MC9Juq|lov`3|8;eD$)S&hAl@A~d}2`+Ieko}8`bu(UNr
zsR)t{to^$Eiu-P@7>O)D1jqpbSj+U*2i$M&tNy5r07#T3e)UvI!PB60lb^tinN6Sk
zra84|(PdtK*YH@SD>Y;1-IV{A%AcL2yVSg}rNRX__1ELGlnt~Q5JM^laT8K7^7<=F
zO4O!!EkP+BMyuR6*9LEmzu3I&Fy1<;JmGY@jBxzYDqLGH3_y(0y>y8`v|EZn8anmc
zTeCw<ahE5LR|>=mJg0NIS6xCo-KApoh_M+o2&J>BjZ^p%yxi9IX!`we3uCw<VQp>F
z<sBQ9%-Tv14@`Vm_gCGs`Nu5)v-|@(g@H(G@aq?!J<E^l3wU+#xj+x|Y*(VA%?I<E
z`nIv77w+&%q;x;7hU&vMU$%WmFd3j`l7KlKQ#2~$@)LNDQ_nf?+{^@~<3*KBW5P>X
z*z>yR{>z{p5FoDB9$8Q2B^~R=2XnxqiDgBbIl1SBWhKg#T`B~oqbHVM1Zh;u$JnOr
zOTq+ePbVgo_Q#KWlx7-#R2#&dLjZI}Pi$jF0GRz3p5a;7<E`~fTH8t^;MJ$rPtUbS
zVMA%s$|W}EcUPmOC1%K}i-cKOX{{Ll{a&Ij3u_Bwbx+81iE)(tOH>euKrCO~o>CV0
zP@4x(Nuh`?JScq^&v`lo@(J4`FZ$Zowo5Bp^tJd94gT^H`Ey=y=B6=E^Nu3l;xa)m
z|MV+cpi|hN7d=>1ks)=M$G0s`F~soDlE3mfRQeSRFXB+wfs)B^73qJZ#MeNBvhNNp
zRO{DDB4FY9PB$;gyn1-pHPptq>uPXmt<xFcY|x4^9sUU1@1YDT{9bP_;$Vw$0*Au=
z*V{g>zFFMlx!gD%(V-Lh@4|JNyLg_>0eh^xP@_g0jALj5)?NsVP|MvSLQYw?vgzi|
zzU(1Nf>__=bg)fJf_-oj<EedV57f;a^i8&HOSE<(pBf`oR~Pig=y155-J7CDsVY~+
zdXpo`Tj&QdJPHO3-h#Q3Mbnxq`uj?*uqGD|(~mtV(Vc4qd!DvO2akY(Y*z8ysr2Y#
zgFPkh_&yW5Yw#HVLmmzew|EVJ9WTOE)G@|34WOsw_=RitzWn&MTD|5Eb5mv20^oM{
zRV7<ZEkC04nRnKnT2cF&QIPw<`ZhBp=zhn8<gSc$(O(8L8jK6Iw{6L&4GcDaMTx>1
zERI?@V<k@}y*W;u4ZYL)gmr02Sa)pmchYDmvf@}J*<OIVRPM9g&eICZfyo;vdCb>%
z<(vE%v6Jwx8vUL}Y61psaD*V`eg(lEj40X%K^MNk-%L$MlRyufU5s#tA0S*=Po~Q2
z`0n!s7#33fU-42Q`PmW`Pd3j1<wOMtnwO34Ykjh8A%KA2C!QAVzU{6|uG%;|+Vmdt
zd^MS};gmEaX?tks37qRR4Wz!~-w9E>`bAQ!l>QMch6(w6BDeKml7EA(otT}pua;(8
zHs5+<crveJcnxUo3APym?I>ZMWz4H%Izt{VxJg;HdQy;T7eP{1*qhhdZh&y|6vyuS
zaq_fIxWaMoR0eOARP92~kDo}H8)KLP`$R0J=G?73X$a{mk=n^MuPpPrT`qIObL!gC
z)o!>g;`pY|kLC}Mc@kSOPv@2yuEs3F#IY?BAi{A4%&w93e0KbdyplUY6R-lw3KEay
zqQ%p!0w-5bIskTQ$AMx-JsApIo9Q5KdFy=tDK1;+1bjg}KAP(c5N_7Zx|?4>FfACw
zcK6W;-v?_Iy<U@?tm&FqtDel@rnvjF`?<%&{kiYhS5y!)!r#WA?Xeuy+}6TeF;2N6
zql1!|r=v5iWtKDKQJTksxWfeH_j*Bwtagc*$9Mb!8BG72^vFH<?bKpji^}@96!yc8
z6!>QY`=i9UHkDbVcbYFq_tmBo<%6_FKkziODM3>TPO>qWy%eZaB<zoxG(r;u`X53F
zajeA5yYoS+Vi8BU#-3i=1S+AUPcE^)L=tHrfvDfy`?H*mx-(!YA`q^tOS`{3q0iuF
zU3{qv6MMfy|6ryR5Tl2>PY!y`i?Wrr+S$EWU^oz$1?RyhU{MOA90h}^<bQ|%{6gO3
z;WPLIwD~NUnM_-VQ)@Ng&fQUi2=#MpDXJjr*h2cN<ZaT1e}!it)lY$@*pF+CLOCkE
zj4G$lD?xbS1#LkT(nk#C5@#1RNjZFeYscTlzgyj_AI=0)yCIH8AB#V9bM3S$+QDG^
zbT_ckpy1<X$BVOixG-LMZ%dKT<Xz>ilDL))&uXkanl-UgpA==0F(w9LyO$W<_rd*&
zHdz8SKW_v4(Y<SEU|%wvTFyP_ZGiyLF%bUpu=VR*pGY3BwQ3C3d5~2{;)||O^v6&K
z10zm($m3&N2vOHsF1TC@V#p)F^jxZ_mHl(9`>HirXVgc=7UL{&ZT=A!M-@c$FS#p*
zesRAFl+5@qBg><AzcbALQUgNHfhMX8kGY<^uQYhaQIG4P*)_f}qu<ZF7;GtCF}%H4
z!cuxOmGo)1so~+#$<hLoyUNj2_euN${&$eg@7FHPC{m$7Ef-(Ly5{iL2+U@tw*g9@
z`W|)~{l2E|^$2kC;;h3<QVm>ItY}`ZScke|q<HWgsO#{YcmN@uG}=}}oUiOYAe*k;
z*<)7PpEzLb&XX%ufK6aDi5R0p9muCaWBmDc7yR$b(rz`rZ`SBD>M+k7$-6qY=kL^F
ze3xr?UeAzc6tBaIgVz0aY|>n2P7RQgY^`m+s%&F9?5t;bR*ewq=1Mw5s?-z*9L!PF
zTd6MoBxM&jlQ(DcCn=ZOM2j!zE`66{UR!eNtCf~yKL#>$U7}|ly<I1u<<j~0+~AL|
zx`ef9DR--R%eU-zKK{fV4kdEdE%8n7i7DMlN`d2XCs<S0m$nR^3oi5Gt|=pPcYaXc
z@jCfcGNs(@hjO_uQ8Onms6}Q9B<ijh9;L7ijVcz1&Tn1n+g}!O)B|~8FvRbG0752Q
z&hhHJO(mC29<t+VSt`*S93HpVYkyh5z9@BO1OJg_7r`JX-lc;JsXgWb+nsnvwdQE*
ziG|C!QbDuapnsenKtWu~zv^+itu!Q014}=Dg=YNp{fA@~AnqcEU4M?6DQl-efl909
zFSYeb0)9`XVLsS*gYQoloyVwVl;{^JA&RC91cjOt2lb&DgULMxrtKokxvxQS(m+$1
zq0S~mlhn2{oS6C-NVVlM;Hmw2q>mp4Deh^fvFw%wjjsRRPr44QuuT6L;+$jyDGYT~
z*SaA9XVyhAgf|nJz0sAzvi}Z{94Fu_1nF>aM&!L3fT>dn&!Q1_@~>80*6CyiwI|6{
zrYp;P0q{Kmn>StI_BzR%JpJ_yU`OZYXPLCjewQkG5hM$d#_{<4JhGh*U7D(;(Ib`R
zlCMm0Iyl_UJ3)9tT;&Rj%cVN56mcsaaI)Qm;nYWUu3c6??{issBHo~7)JTio<d%#N
z{*}^{AGZKYJm`H<^0PM^pMPoX&2*bv(SU(5o63lAzR;jjLf8#cm0Y)LX)8IJ)l41+
zMv+r;w%EoxC#w3>pa&j~rqe?@M20BLl!3fBvYh4`0Z@e!MYDp!9Z|d3Le8BGCXeE0
zxWnC23^p)um)5KcW;2SR)$nreOMGlCDeQedrX?LfhEPc1M+f&u>R^cVV#dfGq2@Wi
zgIc!JdAC-EPgoD!_OtGZT1cxp)1^A;TM1Uh%AA!W%Z-)$RlOs^6ZT)i%YR+9WlO%b
zs<GZU;m%c5^4xum^>Xv`_2H?co7Y0)1&}xb!)>(qp~2yAZj~_!(JOa<C%pHB=(EdZ
zZ61EDVi}^V*Pev(hY1>r?~fhEou(F`4!f2ds=Ak?!p;hox#DAC34M96lLc(38?k`v
z7-!#xJ!9REE396vYgFhdGi3A_DVxU5wl9I{8HOuEb7m^H*fvOGCs&AXKlbjINQQ;z
z^0di!46Jh~VrG{+p*XAKLu)H<k3RuFuPZFUaS&(#u#9IqxG^y&10klQ<GF6za|VR`
zsGcBjU-U|qfox&C^U0@;edecE3>*0%cRj7UOSpg}wO&?9egF4?Wkoa3=2wXgOY)_C
zfoJ)gXXDKE47oRPV~EsZ@9!mwBp#W<1~w;0sIfL0*fX0Fl#(KI++I_z{isIth+0Bp
zfdN6`PX45AV&BXGRRlYksSI<`Xpn(Tw=%K(kiS|med34>U&6?Oh=$4}WxI)&=X{;n
ziXw$`1d*-rC7tqU8NI_0@m1)_0Q4lI5_{-1V6fYZM|<{$R-a)3dVJNa*`KfbW7Y0d
z+5WePQHcC8?&nA6S^Q@rRs;1i(mvtnU#zdWZH1zIVV0*wo^4UC8ZY_6a0Yqp4)H=(
zG|l=e^=*GxoIZjNS|C0yI7+*UA~X#ud5$`&e+BA7boo8%ySUdqk3XqEu$4jFxU_6j
zIJpDE5~6hNklR50SH-vPRx*(_YsJS}9(;bkNFQ2i4M=tV(Z=W%g{MRp>nR5T?3F;u
zJ%;!j)iIvQpU@Nm(r^r0cmPyD8&@@KhTA(pYloqZGxDvwRi}=-u>)`k>if)PsJ+I^
zSV}YrL$urtX-Ce@P4=Io#R_5KyiG2LT??zMiZ^ldCaP)R*kt%wn#$J+Qz#5w%~rB&
z^b(hL>#EEr@_Ml2y`FPdECo(g;1@zq$4tTlp<6_T?(%x;ZYTj@A`$U%afm&76jDij
zwWmlJQ%DgFaUP$bS@q<rHDI1Ti~reYx_{&H>Ve_32$a=+X^16X)3-nu<@EEk`A76B
zisao>S!Nuixd(od-6-naM_MiTmhYDuZsGG!(|CPlyU-;_(0aFXO4`EWb<!M-2zYhA
zFWoa2w~TJSdHBgx7L)c89MP{?Sy@4~JgyaKcXJyByaJ16D*G_nM(KS9wODg>3!#H}
z*HA`|!s;B>AlIKyl$ER=T#v{w<1nKf1VEE3Y(8bxyGCPpVA_xiltD%T1_ZDZ7%-5%
z`1U%}M9QKAsxT9;HH(E0U(|@%yjUpGGt8b>HWh@#H!pmQthmH4Iw<AYdm7I;xpr`1
z$Ql#)?oHJV^2)k{&8x~&T*+XH*BcNE&?|0te-RC~_WIkAoPXNPe`dH`y%gA<OkaOG
zmqa=o+td>T4JS2RZ)bL6H`Y2E%hUnquMzyYMntGlseRSaG_WP+vLiLL519Et#TYs;
z=j_2x{!8|bgIL$lAG~gc22Enzm}iZJmJ7|O^WVylk>~cMk<QT916%eEB)s6e68*&b
z@2e;Xc;&hL@p;l*5I|U{ZP}Ag9A<HA<P#NFSHib%RZnlwC<WWQo*XO>q?q=_3`@95
zT*grf9-qWMJaJ6lfrEp#z{srRE5O%s_zZNAvS#!V4K9Jn5uZ=a9Oxl{7x~<bdL(hi
zMfhBf$7{SQ9x@N#8(NoQ>Z#Xe{mjnpmDNIs?Uz&tj&@i>nC$IUPD1B5-TUn7hzw;!
zMneoAtRAPy`1B5%U6LT=x6=V`OcwNppO3$dk7vZ8$7c!;zfgp*kc)}_PdM>CMPrCs
z80lW1^#pDt`r;uj$MS^*QkyG`e4Ym%Et+8m!vSkUU2N><Pa^#Lq%V_1@{phxkm~6q
ziZDaNx?6<&qK&RWB+)B#B2aw(n|d(TVVZ2|KD!qbEIIn)q34r(C;NAD^Bg|p^{f<N
zVZBoB;q$u!iE(Y&f|f%dsWG)f@xw>!s4(JyUHJw#1q$+g|L@+St&!)))xtkNWbY!Q
zAh)AsU-6YhY=UF%vp{|RlXr)BuHtu~RSy)8alIz~s&g1^QT&kNFXrlpI5$Ybua7{S
z2Riutsp~ljsfVR&U1+wh5<zf4V}fj;8va$|rG^h2ZQca@cG_U9i+3;R+hn)-$X9!n
z;q*EXcg?qIuknU$Nl8Ca*Gtvyy_}{YBf|xyw*Y!cAA+LYDaJ7B)$f6Hrsuz=`}=F8
z2KnlH)RFH=lI;YUIfPP?`AF<il+mozSxmy&G$jTI2_JMULJxOi6V0NfdV8E|uvG=_
zh|BX%^FztH{xyvStYJ#^3>R-<r8}SIi{QL&Vtl50A1UhdgXh5lj=R@zt7Sv`5_UoU
z$K38n^M?KCA*`tZ^IHFTgsq+}s@?SUjePN(1l|nm_vxJ{99=_070RNd8Qu4vPYxNw
zP0P>;b`=TRj!n&`^AZ#Od3z?auCbT*u<gvqGh@t4>;}i#_dLMUnZ&MHt{(~6;`}n&
z9e1qfwTAydcw(%(q3ity9t}*x$9j?hWey1odKj-0#ELEQ%yCX(^ok*?TVNW~Sqr14
zi|*d$HsQfG(WW=>fq2OlBeiEO%wXk=ez!9}BV}d)Igrf8IfgA`6`=J}ZKD2{fMqSE
zyi!J@lSu99e8%vBzV_jnF}M0Dd~nJ+<Q_~q`Ivjde*B1VsK$PrV6N2O`C0y!IGX>M
zd-67KhDAkioV|W_aKjQ|=}Fo~Lvpdo?t?fy611w*FiO-PJ9dAyMQfAdN58gFkcLvf
znO`eQ)H6N7otC{eN#;UnRGv9h6!U&>(&pf`q)UQ$MQuu~ma#^3;^G{2!{{|5`{U__
z`$N$RUmyDxNkdO2mrF)v|4_Cwd}8s5-e6}6gnHTH^W)NznX(cSkjMPw$LfTD;JEgp
zxK?!2IGFeuYt=70efGI)Az~4k-4>x-P0g92H8`A{8IeP5CXo^<sD`!P4@whLRRb}p
zUFmIHLmANWv~MZ~Q6d{&_M@;c><jsObTwB-Pk)JhGmz}g-JX1oqa>YJ1MSCJq}m<f
zSjP{H7;EQ<-iX^X;f^lcq5Po}0<GTL3Jq(B)UFv~a{VLQ7cFdC<Jl|aXrEKN7TY~q
zzNY`@z_eqrE@(|(q0W%meU1goake*;-cBa;llA?Wz%<Qo>T(Fu@lE0kZMK9G1Q=s|
za#?)$wY-sfyy5T-%|IyRxA=K1Kz7ys%~vAMqc3iP$;5Z0BfQhI6AX^wqT;RBZD+en
zM(5hw?W^=l+Pd3FhIqbyUHiPP;lTg0KsQ9@=%u&dcF4gnJpDKOev4NFhQu6eD}&Zd
z_Y^S}ZQ=GD)EN|1X#P@ci?QaT-!sX@C;!n^4Fk<%5Y;EXoJ(toHL9dKYaXIP9%t37
zqk&G!EV-Ly9Dz_7+zJBz@*-G+{P}@ejC;-&qm|EZE*|z3nD~DOy&Rmc!Hl~T<#4YT
z&S&zXXKvd;W5wl_V9k$ZA-(rq@6i3|lx}nTs|qkv#y$TrXW?lK*HFA&rSfwe?u99_
zS9pHy4%H~3r!H*hr}&f$ltSe`F(+xf?swieIvr`YvHCn6cw9h+^1|O_s6UTB)~bpn
zk#Bg;&5)xy2f5X>p};1@xg~`F7~5Tvb7R}+S5=A#csPxhv{a$$nj?BA*6;N8lN0Uc
zcd_;(l1_eK=#7*FEbC{Saux)v!>Sy=>zxXq=cTTfm#9=rE^k$FTf;>NxXRhdluL>)
z<<6&F58|=;z;vp#uvLx!`c@gk57_Cl0`BF<sQdQ@cG*K>ng-rNDBEv8vpre7zIFA9
zS8HpV!f|84d8l%;Zw=zy`Jr1u(96@90jy!VGu!Ys;kGwnp=q`Kx#43xH+%ut$Zh*)
zq_f)BvP$wk`Spo})J#d-wwM1}MVws4o$__xZam$@FZOlbyi6(+R7p?1xuLEvn%9y3
zNQzrr4}li^lD_lRbCm{#Eu!5gL{1XzwI{lB7mDl#C8DjEB~+z$*h563G&#tXZty8_
zr`#E+dw=bGq)ACh!9==w(?j#EJjxH#(ZKKKtV>&LoKBFklGmTd72aK^z%@*iQU0iV
z(b*q1LUnzMDF_@($%}Zgi0x5K0FxVWgspl1j6RhvaUVs%?d9NGu1s`J{d7-Ub1)t3
zqT7Bu6|ML46~mqyNZriY${DSAE+9yPp5XL~<bmTTT`Gz5$EJ>-&{`U>4ObVSY0Pg@
z;3yrN7Q6j^Z%174n4^4jhVZOyrwG-U%SYb*s-V_&I3I>ZQJ}nhW8&hNoP(h8%^dRt
zu^@pE_{7NVPYbl|>Ne!CeFJPsR$$FH^Am_}PtXuNtSLY0tp&VT$S(E8Hi-)`vcD_g
z8l3CFU~B)nCadb3y!?$y{G_)dk1(`Q1L>OV@*ytr{8>R?VbYA~jD)gz=ENK;Q9}Oe
zruZiXAi)0e$!4f0F^bS3hv=UO?%gdg_S2>kF-j$;BY%Z%Vml8$@|IaRYHRQ5j4MLQ
zF2!?S4Q00BvJCiipUE~laC1D0U&e~2w&Y%8ctH0-sQ@?ThVjxv^3p1*dYhBM%h>IN
z?g2bKEi?!Pj^A?l5ZG}SmSM5yM#KHD(U|W16mTbf?(~RfVMZY~s)aH-iH~vEqB+7e
zAwgS1J-^S<P4ZVPFGr4byqZ;;a6Z>Up~|kw=Q6jxp^a^EbYWil%$Kb2Zc7MPX+_@l
z@ayywk!d^W+dgXel+x|oBvRK~K??Dy)^o3mEiIkS2yxbX*x7*Dbea@`>ybk3!O5JB
zjf<;tvA53_6c(1$=Ph7{*1DBi(VLi9t}mNHB4*U~Zxp?kcrVruxqnc<v)6+3LxC)$
z9_7qB+|VLF8Va4R1?L9BdLc1o{IIKzV(V#`q5Y)@`ftw$N9YvXR$uZdZd23?4vySm
zGkX;)m6=_VuxqYaJQl`~zM{#iIJu5PTCP2*V4=i$4<=>V8Ky=zXEu%8ySt#O0^KVj
zwQSqiA;CJ;&%kcHfJJ{Ia$fIMcoZn-2I-52P{46`{0>+ZI>_8DoIiL@N3LO5jH5-G
zhw2ujh4|bs++O4;uP3oFF(Q0dfOx(olSkd$){o;$h5VsA=fTv_b9_oT?d(FBPvhGr
zS6~;(=>C3}<u7o-<i#!dYb@GpyCoVsFX3(?ceN&rUp}o44sNi{Lsr;0QNNn7huXYr
zw2*>nYNPM-+0ORUX$h|#i_Yx@qVF4ugjox>NUM2RQq>=oVsp~hIQkBiuszpTDHK8s
zQ7_%NOATkK>y>7Xu&_Y^M~uYzP=5vLKq6WQb@zt1Lh-a>{sxKW96o`7fX<9tb_F_p
zZ@Ls1o&X@>abbAGWnENL0s`)^`#%thZC)A}R<k}<BIR&xM+;;heQoC~6Ul?==8%*N
z+g1|t7csK(E|Dwy3KTHM%oT@OEOKg_nK{qpm8jaupeM*ztUM^n*(?*Td8gCq&Qb3t
z)kp|?i1OIp<r{KL+-E<*;bXlx;uiOw0Z$0S3BTS18C*Uv%)`}saIu^}`<~;gnYB!A
znI}n!!&ZdwFe3&aM71n;2c$p<5$HAn=3OInZJmxT^~jahPstb9&#kKgS$7EeGiE+i
z5)|4nE^wuSs-b*()6&=}KVd-ab5^YvAArfy2X|tDR5M)9!cGS3I{54dg>N{8F@BKe
z#Ym|A!8Uhthh{P}TbZt<x#HxaTMn=Ad$o@2EO%Hs-FNMIS3bw%0BLvLYESt#;IaAw
zTsIJW9;GkRU&OA#{WA%HeBF(NnB?sea%WYVkJo<~GlH01X13|BSL@7&z%+798byjD
zgC{Ul?TXi+_H^c3NBMlD34LAB4?I+FMXQp;9~l7o=NA}OA94`N=UjyH{1i}-z%Z&Q
zblO9uE*lZC_%z)=|I%6kx{#oTP4fEw&tHYdB$w@!YmZffg5Mg^7j<<#XDB2xT=cP#
z2RSap@nYQ|`Hj$zL42*BLVhr`7+ewY0o|eCF~c{#F!#J#4Tb;M(*zD-ik;(fx8wL0
zh3e-vb~80z@TznOu9SC7bt+d1%-RRx^E=8tU_Fnd-Tn$zH$L+s=XS;kJ|JiW*Dz(^
zDDgVni4xfrvJ|%!X2$Dyd%vP4-)croDI*qh_)%@*oj4fQCw{hzC;U}zZhS67&aH9r
z1d{V7aDyK%v~yuRd}1z76nJ{y@(Z@GxVd6`oDX6?<B|JJQrqBmsNcdyvgdQ#y?&8j
z1*Ab(wX81o0(&{cd7-0ruQ%2+)TDKHW-l^+e^k?IqTxkzTT$^41mN7|jqo7TD_FgC
zWX-^h`fsrGv$0(X9yYC_5Pubr3MCQx{Qa_`f3p%@M)^XmbF_d=*9ND<+6pmd92S~q
zM=VL)jic02L(#IItvx??S<#QrcROkyay#tW{JjRH)4GI!$Z{~<@S7J4_Se2a8g&TC
zxwkK-t0RtMWxR7sAg5D6LShx!|NS6AEBRfc8wV^)KuHohvCUL3pIai3XGN>-zvIeM
z5CO0d+Oaot`L*cmqfqF3-Lf?FVKNnj_2N^!RPadRty7{4XkBA8A2WCa`Bp~vgY{wu
zvMQ-`f7_=2e~i6%Jk|04IC_ktl2t^qqhTwuC8Q#fbr9#+$%-QDa8enW4UVlS5<2$g
z*fNi@cbx2%b&TUU_jRbx=lA{o9`|wY`#;Wmyk5_}Ul?iUvlpz3<P9UEeaED{rZhjk
zt;de~*&45-piemr6G|e%2X^=9vu3^e`sp3uKf2;@I0}e&B)K@_e#W~gPj3~!GX2F`
z_ZboJh~*`LRip7qv6d%Ji7=vrE0gSYDi5ubTJHCw09H|KrkA5t#8w@a$|aeEDhFZO
zN3(Z8tghd=ZOSgj-Qy^fZ6y;-DWYS_+jbT*Ww3Z=%5NEnk{j0C)7sN+XS33wxc>XV
zxk+vLo;q&`c{kCTr4)3{R+kRG%cyzIMqUQ9^w@8E>Pmq60U@gy=UFzEIZtHWk1Oua
zHq&UBe~9mYIQS>|M*I9DsbMojk|>*>ZP}g{LdPcPPgjd62wJdRse<r;0vZT}C(kWr
zC-j~35pfKRmL=yQjd=8SjTq*^yJn`iqG{~Wwu(g>S9W6S4vpvcqYWC=p%2JnBjkL<
z5ouXjgCDs5n9SFTa>aqjUcc?HIVMtl%2%&`@@E=HSMK90Mx<<}q(+vCOo?&cX0KRb
z!YpUeD@*NR<TU`pzkN&6%L60;ZZWS;-#q&H5e_rO!KH`{iPL!1gf*?Y#GJ9@kl1Ix
zgGrPko!~8L>$vJC#&CLkeA`8q{|*D(YihTEYfDvkusRG&9Ju^DWGTtr(`s&NPrzXx
z<ud!enU*z^9CBpVX+H`=X<W%1-F(3zahjuNg^c{HbOzE)huvo8^WGR_85VhCB`u}6
zaamoS<2>UT@86Fz6nZXoLOc9(Q>#<%@ef_c$>k6E@QPtq*rycr#^g9wzYbxIZRsHp
z&%+3!-#aTgNX6Nj*D+qQ%H0Y48B|rFIEzg$nWT4>^>d*^QzxNz{Bd#(XQ19at#XNm
z&ME!0F(s89)_VNVmYE$wG%=XRD;Q4lYw5d31)Zv)1Tnf>Z0F8pn?LE0@_?#7@N1Bk
z?e=tXDx%KYSE`#UGWEy4HyWeTHxnISpu<;AIki~Zz66ne%=pQvL6C{yx!sV!v4iT+
zzEWeI%LJouVTZ4UrZO$9?E=&O<ytr?I>QJP)?(bD$uK42a;0XYt=|rr3DcizW0+sP
zPOQuNGGgwYP_?Xq)|8EajzzMkI#*QY2tQ{#%D}X!W8`<f5Q1MVLKVM;6#!*0DlQ`f
zJ$?l#Vpe|jE8428$-&W>L%nT}M#6YuvE4OEE=wV+DtYVL*opTXqy-z>s_xD5ljfkZ
z0BJ-fg(#?Y^X`38fH5imvP)c~D=+`u+wurQSw!E2n;gO_{irx%Fy-xpN12H1dFQk+
zID*UhUCPo$lVu7m5~aiSG7*EUO}B`LMxnGGodyh^5pX}s*kBk4-JpE-cH60hZH{~p
zI!Z%x!s2MIfM(1_9tr@8@1XXIxlI$&jq$}6t{!c98nsi&;tRPVl5^fJKC>D7_DbH(
zbKf$0S8}9F_+18$ZrW+9HmFY;4JfozpK7K$#k=@54(2S6bQ;<6Bg9wiw<|q+?6VLD
z1Mn~_d^-2jH<rTjN2)qI9!z<={^@|HEsKuBrBYm?ep8HsECKTkH`aIM`uE0;D<R`z
z3?<EU1|KOk#VNJMY*{_r9;A1l2F{ybx07xpyJVfJv^5uBthZzC)&u_n#E;jSO9#;e
z9Byhn2ZZk)piQ5_9@_@TnTI-at}#~ulgwLi5z@p3WLWSyvOvF;4F;_(;!eKx-V+w1
z@xq$c(ujBG$!PUknbvZujbT0LpzHOisP(K2i=8jIJHc??lYj`54@RkcI`A;h8{VVP
zQtU)s`l%*@Y%w<A4<DC5DaKTX^@z2N@lwR3*s%Y|98(8U5Sh$=?ws%`5Tk+IKZLW;
z7f8D3QijHtN|q|fv`4!*rqVg6Jo30xBF4H*Of%$zyE0k%Z?ymV1^16#)eI|J_$3SY
ziw9(x$YRQR_N(09hy&yui1L(0@K8Zj2xa4t^s)4?2?a#>!gue|yXM8J;jmumP8VZ4
z6zbeBi(&QAP_m_>Sm3!jx%lhXFUK>KQ1=6j$N-F3A7Uia;%2yFlJN73DCN_bcWwBN
zv!Y^lvNR$WB%k)4^IMie+Poju@BW4vpW&#f^ze44yDB<vh*uqJ-dPWK`YJo3GaLAa
ztk<t&>FDWM)nbp!`(0vkR6FMorU;6#7>^y$_d}bkoo%y#afqOP&U6<)2?H$`%P<St
z%g1~oR`zm;5}{T$P8^j-#Xo)+?Tq&rG*5eAE}znU(RA8#YIAQAzq$T+>CGRqKE2)_
zJZQwH6f#9Wb2F2pp!&g$SeY@XYs*^!gyqq*TL5C$bq>`>$Te9T8`@V*q-Q41I?0B_
zNu_R?6j}>D;ppt?;Pd<by7Dl?3TH9i4_^|^$Eu$<`6r|rXb(#hp9y5`#KI@@cYPNz
ziNz;vmhhV;p8SLJd+I4AG#1B{$Y^@H7|7wg9h%^Lc5Fex*?SHARfv-uDY5ZfK~-;j
zhRvAMfH3mm!5l~yYigh~Xd9GC>)&7ZrdfHIG<94X_vPIJhq+z{g>QgJAZO(w$*6ix
zj#ENDP?3QKfgESb{Wf5_$%*+kaK%z&DB6OClJ+n{&3QQBN4#|MBL%jg`kU{U6waeO
z4-X!DdN>!S=6UQ%!O57|QTN8Np}|3OpR7I>hUj?=VSCir<1|v73?xVwXze6_DH1x#
zc>Ro-KXFr*>D5n3(X!ufQ*i(GaQ(iuXyu=}$+}l3+Rm6gebX^J7CSssRHn<kMZus-
zejHr7AV$yVbK;C>dkC#+*!)gx)vtgPo{Hq$E4aFzfTg*jm?mCrpH8AJhSyTkA0Y?u
z!Sx{nK)~{@aFxc>*CT8bZ^*?-<bR{c{|^7mkmjW&&J{=7S~GGH8-C-Zv))J7groPL
zj#iD>9^8loRw1O}Z0)6ZtL1Mke`eJfTf?tiZloPex5P<D>-}Fh=3R=%1)LE5<$mNj
z4^pa4daQ8jeqqPKs~}4Ntie(xv;}h$FYpD*p6{6I7zr_uKxZCg-v79T92jevX02%u
z{&EBN%yPqcr9H}xzq5N>rb@;ot4Quj>)h0fA(5jtXG>Ja(*01^jJ>9wx!D?JStXTq
zK-w<%3vFr0JG}8I?@+Ioo-r9&uB`WKeTaESQcl||8NnLwmmMzX2nF5sY^EAo_$}!S
zh@t*i!)*QOH*TUC+!BdO-K7!6ONG5<67V>ysM3h|Hh1fDV=p&_NSIzaA-!N`l&RaG
z5}L#|JUFdXKiBK@W_SesAf_APDCha1x@zqyf}Y_0(jUlXaD4zyI8PrfoLc;R!X+e2
z_Vh1aE=PpnlUtW$9%z@X%DZ|?o!zw0F!DE&P8>V^(V8~i>4C=BBYJn6plcRuzCiul
zk4%T8FGu>>_=jCYrL5+mdx`oUgVWjginkMfQ5i;5);EV;ira|y42#<ev3G`w<3$e%
z;M1x9?oki&?u!4N!0xtNQ>TMBY}S6a3%XB7o%Pt@i7siExD|Mb$#%nLzi0d1mC9pR
zMnx~AgTq6y$ol<@KAveA&QCDSPBDaX+fpJT@LHTyeL|<wl-u3m4=dM75QZLu<dRSz
zNf8Hh1tROJ`E$VOh_iZYvt5Py@~KGzjp9|+9(*jHG^yDe&)qX*T#P+kV;vmtK5)S>
zfl#{<nCCda@R@by(xVc+Q5vdN4qZfu+D?H<=<r9FVYt8a!TW1K+$^}PkS4c216F`q
z*^VOatZog_z~t^gR3~RCw33YVpR#GYIJ<?9w;AhN>gViCWIQZu=5d!*C!XvLu6KId
ze+4e1Q`@{Reni|I-{**v-Y^}ri_S#J4>w6~mB?U`9^;uPT?2f90^(-HU4h8{!Fj(!
zP|ks@7^8zd0~|K)6{7e!!+@Jqx~x1<LGJ>xin<$+^qUces!Fu#_t;k-duvuie64qq
zRKJKW$sCzT5bt(B0TABa9r>njdFsw*X=hTfM{-y(`pVGCl+$eYGC}G8{t`VL%xmx$
z^vkru;b4MDUWpBeVb@q?=}Fml53kGW80?gFxq!e~#^62g0p0O?(IzA54}x6kOkRC;
zv`T0NWdh=8l&OQOa%^!~*QCNcbEJVy!ig9!uQrOMwW?}Yr=r87&aan~S=_{gDi*rj
zbsF=Vv5oKb6cb3z%9mIny%13?vwSzAs)awuUD3MFZ`$<OE8Pm&vhe4L0$Q9hb}E<i
zNF-{Z(DzsNg!dHos7YeR!&0uY)1Rw}lJ}=M@fQvp$wNaH0FMsN=Qt`(qyP?Mpv*}M
zI@b&u@l8)7_4>Jj@RY18Iksln${^HaCOc(^7@F&~+3V@zvx?|;6p|3if=kg9@lZmW
z<T&1q;9;4KQ`6DI@77B@(&HY-O!(c$C5)6zR!W|acSa``^{?Q<h5ml}3z;NE!YLe|
zVxvWHC<Q?vUC7^6X<}kZP#bttP~Jdljf1Ak7&s-~q~>I@d1UwmqGx4vw~T&s+iHHU
zcj5aZWfTcw{oyT&WrI1G-6o+IVPV|CE4DC^Zx=m0h#v9CaO&hJmhF~7kN8UkEl6}+
z)LSvl7`}UuX@o$`K|a30WQcO$Tm7&?qnN~H8fQQ<cr6NHE8rH~31rQ{`A!vffBmSj
z_wCc3wrH7AS7%yszx}ixrhZeVL-53-V-1NOW(G?bO)jyDBqy%NGLZ@?_QO5I9Bk`C
z_p+X{%Y$R^0|vPc90maA<M7E+7)TSLwgn<6Sf`zMksnRf;7ls@PwBGun^qo$OIRi)
zm3?ZH64g{=X9`vm*0qaZ;lLP0+V%FAwhuN<q0TC|Nqu`(GvR&5a9!&v;`YtV5jI(F
zLfWs#qh(E--^DN5HM5+<2feFqviUNcXym8#>oJ%6?fQHvf9d!+Ij!MjUBCX7Cn+os
zocRwHc8i;m4GGoMgRHxah?Q-8l+gxgIQRu}-Q)m1CgAwPX3V13Ts@*Wg^q|nP@&{I
z)Y!=~>@zQNNwNF_b2ITUtqOh!28V5fcX~s7c6)APn~BVt=RFoY4vHWC`<#Fxaz}O<
z6>M{;^}!EhHB<&t#d(Pz`#&=@N`{P9I{oKIU62%Hbf`KGw=C|hMMVU9><}W9=Vbky
zeD~VSBFT#O@cMfnEu7D{1?LuGY@!0&pXf&K$StE}6#wlE(n*$AMb0$hQhqIY3xA5Q
zqpfx#7`&90jbaPB09_tllb6TY*gcLQW#(-mR~p4+8{WPe1-EoffTIBa-qI44!a?lY
zqlG>Ut6Upb7ut?<+i99&Wv=vpSBdx|nC-9ZK6)JPyejl%5IVVMj_aRI7V=@m{O1$;
zWo5e3VQ)7(QT3L=Z13*=QMxFzNLBLY#9VP0)DDHzM?KGeq+D{gq~3W%L*=rxXh~uh
zLB4Ys<+A5<PIo^EAGGbMm7lv$>~R-DddUi+WbRfp<Ctd%d)q#Wjbg6l=I6G+tn<Uw
z)|_{d3SueYt$w=FduEBs(6csm){6V3mv4Te+YX;+NGWffmCBA+S)N!A;y$gtKVwa*
zs)DqwqJro#i!lK{q*qd$d;JE@&}%)isGV7u?REX{PP9OVuIEQku+V(=r$>>_8GCEW
zbjI}_TO|WxaZxKLHrH%&Gu`cBr)pBw!(mbji}{GPal6|)#B6oy^~+2Y?F);-5-~t?
zpxee)H@vYZ5$)lH?E^QPy!a2TrX6kbvU7UcGsWjp!)~jH#>H-Wa=fT?MibOgt~*|1
zZVYyA>HXRGb!Qrm?#&j&f*r{QG1e^0ow503XV>OgzVZ|?)&VCmq8)o5XVfyanwI=+
zXwo&NU{C!4W;ii#DDtr}YB<qhz1nR^TMyE9baR9y+6r0Z6DFz*NVuROmGQru)%R-i
znaz~azV?Br(7hdJe_OhH@py?1^`?xjN9lv;*qqN|4A&e=lT=pDcn$v+PK=+}n4H;N
zt+;u%WUx@Dl74gdF2VD9nWE%t&y%$Ch<jb48v7%sS&j!1K*mTRqr0DOD?xAelH3SZ
z`-*3Nc-v3zQ%BnTAqxfVnvC)ISKgS@g#=7r=}J{o#@i_b9@Z%*FW<hl?NZn`P^?{I
zZ0_GXQQbr8$Rbtew<-xapsuBk2Abd`pU{)c9Ri0x?vKp*U49hVm|qOLW4OScyXMhH
za(X6&+zB_ZbOa0~5=jt<(b{k`PC5ts&uB&-EibTyZd~~O=aO>k)Jw5D$KX^$Q>dJ2
zv6f!3&8+b8%nY$trLZ2crMs@*zAT>dTKr}lv?L}(FiQ5zm-vl!7{Vt|LT^?m8Z5aH
z6dfzPD|*}FdY5UU{q`gkYvv*;h^4mbS+X9p8QiO0%4f27e&{CgPF+CGH3thh3`;vm
z(eQTTZZOCaxzMKOIvLGgSBM<<OFni@NYBtkM#kqa?P9_!i(RxLg*IJbKedgX>}-8a
z*1>cb*Aw-7lPh|bqL{LK>7biio5Y_T5WyxO^?lXFUA;5f0Cp?QJF9UzHwD275r@nI
z`Lbqcr^)m6qe{|T8n#*&i@Sg<8@=gnucnCHC@D?m!H06mtPMH6gMC_X{rLNFLQ>4M
zkjZqMIWW)oRSYT=)!T-dV|MM^TBocF30Lh(MRuK@ne^%2q)~i2CA>9w!+EQq+)Qc;
z|NH$g+Qn3eeacVRfl&Bi@7wHJ>G!kCKIs0@7OQ~`m%<Nbel3qlg#{h+QycaKpFTGR
z_?kytOlFU&X`e;P7nD(Vv0l|lBK=l3(k3F7DzN#zeUruQGR#6bXU!g0fo52h#@5r*
zKY?}&)!+M%kiIts5chtQxB6C}-T0Tpx*%(l;}TyWhJ_<2fp;Z2JrjO;CJ(AFU2efK
z#M$nCQQ_;h9PUl=IR@7z7<SSL8Shg<$8d<t+(NSToAHyH9aGgmTwqyKGhc^nrc6in
z<EIpFY?>}lbe)bG;W~q$-$GPGs)!|8ruq4^(nacY=f_b6Iwcn+;_eMTQl!$l5UJNU
zvpVh$QbZoT8wv)+?XHHzYxf*huOJB6kui|&#DGBd+AGVQ29Jmf#lFo!d}j{X@!@db
zNsj&Qo}P_A?d@jLX++&jtzj#NzM(9m$QUEEx!JEbAlm3H?Bb=o{Qgq14CfiGw=l^p
zm>UgCO^;a7dLXFh3?BxYbu`Ut!(J@O9DkIo9_^C1G><hU+oJmEFPhcz8jDMghq{@b
z7_!MMfrSfC=KYv)OXzKmn)BoOfj6yg^t(v#eDLMU8?D`wgga&?I;f&b?EK}zQtpxc
zrTElYV6A68nz45$B@_?ZUsBI#Yb%k7yc2Gr-d6e2W(>F9>KHmBSmIC8-bxCKziW|g
z1d`L}mC6PqYM??}c6TPdN5l?%)**15{CkjsOcpeESCZCo&eLe_8_3dV?u_V7D*`di
z&DC4LDpq`3GR@6#i+;0IMSI1_1QFu&`ko3+u3_5HgrBQr{PWMSn>me6Z6yO9n=?6-
zvE6Pj{K`6>x|Zt{a4kos1`%8u{y?+5DpT5qmP$+=Q&14;pOc02xbs;~Mp^7eJFNXV
zM>`&bE_e*}v$y&D5-lIWI1eYf<lRl5(lbrcfPMS9wBIL&J*_x;!{$db#(&52BKyAL
zRWofds@PyXbE_D($wEKdh`1Q-^JK@LCnh~TT{Obr;ZXUH<iXXB@1x&BI^K0mXokWS
zeu7{@<ZqEJXxF2%QgFiHBb=`@|12@p+&@dK%Z6^Qq_dOq1V6H+?IbuBQgJL}ULwu9
z;j)RH9b1{mU6jKjhoW2bIj$GZTdpb<#437tBP+>vjq4l60O`CL+y0Qy)3(2Us>aQ5
zA=YLWk+nYC_KlT;z~d5U_orxg>rwpOer?D?_kMV0Br$z3uZj*X8G!KHtE!GTHf=)|
zlyAa8IUA4{+tP}P#CwU8{dlS~gYwC8%J;#{!F1P|?OwJl!<@-*5P6zCvdY!4AnA~f
zGd@y9oth$6LKL<+v*D+U9^W`pUf%wZizX=|4^&s^xjZR;;j~pjohnyv*I=VueEiL%
zw2{cnhu@oi&hCjhxv1;HCbdU$zha%9$%{VtF+*IjOBlV8G`E^uG7@QICsd+>VX(`=
zqpoLr?QJdKS1{>&6{0dD${uK{*l{awucS+?Q-_)rDV8AZ<ZV<L!=61b%td;P2qtmA
z8ZP`+S#7iTsGU-1J(x^PQ6(lp$rKBVs2|=?dzMop5w|}D@ot8?h*3CxXmrAwEODP`
zYx8p@P?`mXGNIOwaMnl~E*MKqD&*Ln%B-y`+!)KYQL@$V$i*Z@P{cebT@0I8(-7X`
zNgK!Ruo5i#*0`d3;#AYWKqW_{%Q`-@k_5>Z!mjyc3vap_UEOQ9_jy9$SYT>>MRDwj
zD5-i)G!l~-G!yI>)LiYC>_G+9-6>I=d_1lO>a%HC)%Na3vH)Wd5DuUI<!GIz6{u<S
ztp@ZRn<4W8kE9ZS5`{_dBg5~UzK<H=%)6-BdDN8plES0Cdzf3-I5jj9%}<(W!<@5F
z?~3A4Z0#~5)74S<P!v1d28Bo+FV?1t^{z6=lFj|nOyj_Eq<2^*b@2%i4|LG;Fps2y
zA%wMYN89(g=lofT7hFokUJtojb1vI$uEy&*W8|)2+a!O_;~uK{>}3ucZ9G=K1A^Ax
z$_ZRE^Ed;uoB87t;}2^mT$Qp$v3@09YJ(X^mR2Pfayzt1)splj*U(F$@%0#^ZY%%3
zT-eY_xbf0>u0;Dy0Z^X{tXPl(e;-LWu$iu#j!+K7#O2_3<2dQ+p+<wY<JBH%2txeH
z^(JsQA_!56cxAcIGWEn=+@(9=J}9^PxiFY6{SPn81MQWork}qinuni#bTz?g?^%l+
z2h~^J<ufH>UA;tuzT&)3iAE=ns!-=vN|8Jt%oA}o><aG36gIbYrP|J26qzcNs^2$?
zyesI3DvGybX|)Q>oaq+xZ+NU63GMjURCsdU@19E<s=2bqr9)ZCxWmmnU2GN-lNVnf
zxx4b=QAeai`mZb!hsYzsrvaeZPnPJAuI13&FCpIh$#uoXiO@rkLYrZL8#IJ1;35%=
zcej)$*Y*s@i!UA#m+(-is$SZbDxYbEHXI5}U)K}xlJ>=7()>47x)fD4P;>_zl&H!n
z#iL(fH?m;o7p^$;SeQfzcW;;NzAC3v(O%_2n>m~Bm|=R)IrQZI%o1RHMNuzJ&n60U
zc3`B?`p%9IqSH0U2bI4}Q3`FdKh_A2N0-|m!mf-w;~&EIu1`I1Msb<kp&z#K)}r6`
zZO<A8mY_nnmGCSiU8ysRp48bYN~m2L|FRpqXq_;H`}S3F`n4!w*h%?!_Vo8p*v0!L
z>X?Yc30H$F3h7`{KO%-8`SHyOxMgruZ>KAUKE?0A{XqT(z2szD#kcj^%|6^*QpAzo
zh-~b_atu#No)MvbLHhf`hL1eKH&JZnNyVDeNV?%LDze7v^7u6FPV%)=lhO;C7T#uV
zKcC8)J3EZUb7$B2Dn-5Nb`7*YO%=;Vw(!w7zYwe7Mu9_{=+_By85-F*5()k;U~3c3
z=63;AA^ggd=+#EbuJ*`mP7;zyy7(1jiKm$h$}6eG^BgS`C(j%>UEna?L!YNBp#1y?
zTC<&|dnk$aAn>fv9z?KM*Q~E+b2~uyBoMG6gJ#aFn(e1UO%IKgnlt3MBl)`ukLBn;
zDBw+E*9^BoEn|A@LVlPoJpjz-lSzC7GtJ{1S-8WscE!jX&5d+Yw2tJKvssbd|BBdL
zPCN7wXCo>%J6H1>E}E{W<vE`tiT0OPy9M`4bPb5+g^NTAv2Fs>5SW5zsh}ef|Cni#
zwZ?hSzs_%}gM0WgQ=RCbU+f_$W?##I0tXMyF;>EVJ`KhcNpvp^WVsAF8!GO&Aw2#r
zpD~^M3oyg7n$c78N~iz2H%KvE2DqgyDt2NjI+n9|@dxg3q1PWyo~~&a*xp82`TW!V
z%)JmnTelE)vn4st`ICezTZ)>8u?%WaXA0p<;0z!DCTsv5oa8WVPxv`^0nF?3nytWx
zj{7(I5jXqgxlB`(oJknd6uRFYUYtVx&Y-0$TPh+XBxK#>Bv&+0#ukfB-$Ap<`6Gwe
zMh2hYLn3^^+nVNRoHE)hJh>hEqn8Y_H0+FW&I-{pFxYv$1P3)y1MmG7$T%HfimBfo
zVyc8tp16!8TVrWf4$~rWo-?zvkjVQ$^pL&v5LI$@DEQtaAaToSqwE{qec|{%0_l=l
ziNpGDR;#_YFXG^kpK1y-A^qudb8&im&(-YGD*awmd2c>+>iwFx4+{F|B1JbCK@?*0
zFL?!*f|;G}-9A>E>c9S~;_+&Snaww4cTXi;;H>YD%k$1|;Ago$1bfG}Z_5%Y;NIKM
zTvjO>DY-%Wzu&XHQ4B@!UaadcZdO*<A_=`IRphu9UJ?Oor=*Hv7BbA1xn}+`({kK>
z#mK7QlPLPatOSUAH2h^tM%N_jT+e+Q->Z}T<!j#9)vSFKA<J-8kn8#*SY)b91Gj##
zaigw@iIH$-TehVdDDC(^wgJl7ZJe`H25ZH`+@qcFnD@;~!~Kr2*OuAL0LG&x`_tl7
zUBO64?#i##h2LbVtxr2+(^rpS{q<{CYr4ppl>Y*_4g^CsN|PcjxcbrKcfivod5H$T
z{nqE5n*+lWVhzH`O%u1?zdCV-b%d{-hBPU*#Na>a!p2LN=Q4_~Ds}M$2!?!!AlGFh
zFTxF7eXMM}0*o7j!8t)lHRIC97K0*n;@;O95cT}00sXm?E1Mx|6zEHp={!FG+cT>Q
z=V?5Ajfb<VfuDPrYPR#4A*smz)8=|n<m^pI?V_0Nb22dq(!za>k3n>69FC(e-MUJC
zKOBFipawj~$Pc1t+{51Axs;!_vI1^Q-5)34`{OzUCv_wQtSyQb<Y|7;x?YmDdZ{4{
zRDA1aaBQ{DMk%p1LAlsq5`!Ln5+)`@!9z(4|GP3vm)d|M#;Nx!152@<zrij)L4Q&W
z*e(0?DdFc$ixU)^VL2%g;F%B4CfRBlxQ&AQ8EsjpM96`$F_0P3RQo)@c>++>8L;@q
zw`XgBWGLPL{E6GrOU+fOI-44~910q8iLS4<SF)aQ3m_?M!G80a{_QvLEy$+8euZKh
zTu@NfJR|=WEGioEQ<$Ejy$yV99Oi*#qGam=a+jxXQjV~ov;SLXk-_iJi|2H%#()gL
zCbQK9kY;j3>t<YA1;e12ABlyq*$-Rs^qpzI41FdfA0sn*J%{aLo|Hql)o8i9|5XVI
z*W_U~F0N^@VNhW9o+@@bE!aS(dU1i_a>JZYnJ^!yQvsFejNn*D(ej7V&J#0f+{7=6
zTVBdtyrNeEnH&vAf)v64zV3fPQDn=ka}w6(i1?v7&InZFA8F}uoyzsb>G>aPUk$Q$
zJ*}yN6TTc3cTE(NkS`rIZk*hs76-XHo@#P-&2l6a%e_CrJ+#n|W>7$ew4FwAmJoTt
zNi8h^<(GQ0fVfi#*Ky%DKOzq5c~VG6X6Ankfs@<fa7^?(q5&YD8YvVI8||~HI9|NP
z=_4BjKH%0c)o5?H+SSGAe<_@Yj4A_RJAV=5{PTad1%gT)4@r&H8x)-;`iUF9v0osP
ztg()xY-Phm9%h59VtYntE~}g;kUXY_>`Clh<wq{rj#H8R0lW3D%lesYLwR|~NIcy<
z2%ChOS%ARcq^E-T!CODw6QhjXek<v`>d>q=Gd#@j;Of?R^sSNfJ2vI}Mtc#fSrRg$
zY{=5t^T?2?r*Q`7+M%HJ$WxI$N0Oh8lN^-%EYrEqj3dKj(WWitm1KiWvun!L!zJJK
zW~$kD^@deeGmez!abcFr?bOdZV-JgQ(rxxES=o>>bLWwb3(&VLJ_|35)TbFP_b6vS
zPB5r^)XU~C6|PNADRctDJt1*YkuHdLS&wUw4CtSs5W$!)ug77H8o1Ebj(4V&uh0d}
zzyY{O!$`AKogR!cYkXw5nv6kXFOT83!I9V)lYNWE`5$K^?~^mHJRYo~51{;K1w@gn
zen1ED+)ZVzX|gNs$6{lZm(Qi-yTA%+Wq>G{{5IPEzLZl>@=?KS1QEQUcdz&A5IHz5
z)V>ea4;I7B^N7N6uDv=&(@bKT0f>N7hb^h8;<=>u%g#?6&!)f)CCWi{0goa1lY*=Q
z(tkfGLQdpCf&+l?DF`yNWpNp@Ow_G(%Wii#UPn&T3LS_g@P6c>Afx3+uI~Qwe~{<J
zfWAaaMUG|v)greb2YM`(e4}bAnSk!vPSm{;2+*CJG`c-fqEJbu{eZ*Q@Bl09K#JuR
zKAxx>IdbMflwE^=FyXBRm~wx;m9eHW9B_V7WYumA;!h6;9tf8hpr$GK|2+q`4CykX
z7T<Dh!Pn!Hap<A)C2Z0+QUtiG_CIg`ch~y%K%Xl9>jhZxXyw{;<dP{q<x2|rg-N&d
zAg1`))m?|+ZK}|VL<x{Z<^3D&K`!$lW&I`QqM>J3hZLIu9=e``-m1Kp-=KGlF6{r}
zJMOQg0#OYHKaj5v6}0diOzg&;Jpq4o1Va-LNt2>2z^+?k)|@GhHyBw^P6tB>)d0B3
z7kTk6Fs)q)zghi$(%TduE*s34sbW1v7&WJMdG{I9jQ-c_f1axu+Ohm8<mH=7O`VI0
z<&d9gN_c|1vEK-x)%*$CVmkz4zB{3|>%+{?af7DFsJ}Uf>(4$*A>DTyKc(Pan1MdT
z5z5#wbCPWmvF;8XAe1gOUZj~MXbza$c*hx@wX#!OMW`siFQ74FtDdU_^gxN?ZZ=}D
z{T=7HDB9|=WeMo5$ngrxDRZ#2oKz^uv+quSw)!v-oac71uct;sl(A65JLj^ph8x_?
zJ+N=S9L-Hh;PAJLO9NKzb)yYQWXK<!hb*0oRhxbz7pEz|xzD34!|+XplP7IFt<w%_
zyuqu=h3*32?amk3L~=#mfxP>%fSfv434mRmZbadjouA~%QZt}XW;5o{^|d#xfbZq%
zY#?9>q)dx+GTN&X@YD6m&zF!P?9fptzH6xz4!Up|s0Pr`{lDwrLz*d7DI30-`{rZV
zqtWBs-*gujfmY=UkT^w0F8@FNB<&#^;tBtmym_4CTTp)mxvi$6KWw6(TmmSWagE02
z=J)!!6FKsB%Q-ZcGMM_UkfZq|HN~6m?@Bu(otE|`Y662?#uT1$!{o2+OW8y^KqR_D
z!5A(Zh7vR=cX#(gv@dSkT00wg5s%I&*U79mvt^x7sPlrk0Pgu@I#_QP`=*TPRb2NH
zb*>gpR;kSl%+UU|@<K9A1Js!6U+&I33CwslDL_H96ApwY8B3bQ-1G<^GE4I;gE*#=
z()!cI81|9fUk3R9nq$BcHEl*ev*qvie7Rl?idiXcU1P7Y<siW#zD^W`ZF`B?>6DzR
zIUe49rYsBWbPsXwX0YG|A#VFE8E)5OaG1~JO9Z*OHg)2e<?TA4?N2KBaw=>F;@pD#
ztBARZk5>vn@muFQ1(xHwmb?6cqScBl=_PCn?9<vlbqp`r7C_y2P;?oambkSEKz-f2
z1!60Avmn@vk0<;h7R48~`N+P(gK_|Q;FdpJcp-V?d_>#Cj3)Xn?v!11`)f_e@Yc_T
zO>%!N9`qPXB~JqmrIb~Qg_`Js!iDUDpCc>Pu75u7&Z<E4h>26mfdHg01@BNewzc=|
zZc0u^=Cyz`0Q()qBjk_49};)laUgRCrXCpF_Ub%c(3of&5Hh0&GOAZkt=^_CG_2K1
z)}VLg>VEqQME<-L3dSAxT<#7k?Z}&bTV20zb=u7Q%<)#I_cKc_i8_uhDZRtSZh(ZJ
z1IT>`VY;9yFbI(2niL|Ar3BQF4`t{K`4`|Sny&Y@tkwc=Cx2B2W;s1LC7&XHsv2~0
z>PrSLC328#!J0R&zo#4!xl&P)f6nD+U@*XJp(kS66~dDPDxg%t;ky#GYPny_eQlo{
z*Kuy<5wg#Cb^?B6$yYsVGk=3mKfE;Y+oKK!*ZKX+rHPTWfGI3VD(t)opjiQ(g!65X
zLV^yxn^#3bFGdVb&1}OhkEw(7Eu!4Jp?cHw!gM1#_=xx@3_8t5P9%aVb_%*oPZ*XA
zE0D*K&D!yVe~n+0XNp!s&iDH%eMr)1${1{#Yh1j<6y4L+mytLI#$v9v<#%>o)^kBC
zQE5fGNG5h%R?d=LL>n*V(`4^7YXWmDc$3EFX>CtWPh)gzJFjx{POuN;l-1Uj9~`#+
zYrSc`NDd%Y^2d@4tc^?FnGPmF3%|@>KUN5Y!3{Ow5%IFDEO?!R+!9iz(2APSIH{Tr
z5wOWFP|-A#ldzJ-3KqOy*N;w#ql9)&mG{ngA&#1WdK3@iCFv}cEcgIytvD0SZM?K)
z%w-Oga3}ZsAL<;^jxzq5Hq!}udfnZi-8uTlkGzw7sj)Yi0s4J&bw-~wtZu{S^MfZz
zV!&1gFazh#HZJWTXHN2@llkw{BtkKg3SvKX4H<nh#pyTpEB%Zve{`6caU03;5~$p5
zOLB5$2hD{iAC$4qh{!wo*FH|JoT^^r2Xf0%=^}sX+tW3_p~gNf`whkQ5zRE~K8a$K
z(Ebz#&oRh-JUHYXY}*ixQ=o@@iXMkZTW&k@^Y`4s?etvzZQpb8lc>AQ<U|=11iPjr
zM<dFnPN%hUDWw^RY(Z?xtJn{co6Kt}>`c)OhfNLQT-@y|<W6NXf2ChuRJR5l?!;4q
za=A~?_<korNnqRhbIy>-4)nEvyj*eQM^U{mH-+7U*=*y@J|E5f+C1|(gUw(wcQk!q
zMj$bBm@FcP8CrwCfZR0DSfFWa-m}b{+`_T2dmtHF&GmjV*8CQ>R&Gu`kK|4LyO$J5
zdZ+Vc_GC?m@HSTt(E29~?Xb8_&(z$5d&na4MBl;gD72&Ag8{m9BsYFa>@sja)Ye`|
z@?D+-y*EWVDUK$ry6tr9-v0wyZ$Uu|chFC3AR`wF>cKR`+69>d>|6i^OgqhM_fs_G
zlUC338K(4}i|c`>AI){c6{hppc_%+Jq0F1M7}r0kTp&XF0pu@_A@_SGU3=hu`_3ox
z-@Ss71JUf<uH?UXdD{bwZx6CGTndU6u$9vm0HE_e1YPCP+(dVevKy<IM|+u<l^Jf_
ztkCi@Q?H-7ylF=i#jbmY-H%l6yKJ3Fu>H{Jpg~TzLy#|h@7+`*mvu4u{zD8|*S7$v
z|9(_d!c?pMETDvc&_h84llgnC+~=BS?pxjOe7vuPTO;HY<lPqak@@vFiP&n>YQq>x
zpOW=ewBIHEwjdg|{|)<?Xxw%#|8<PduXzVoay41r&WEsIK45C`ZTr@&AC1cIfBy+I
zl_#PN+c>?8X124;l$C%e;4)7+;5zp>Or@k+CDV^Dwo=?KZ5y)M;p%+vL&VRk8g)uy
zr$G{$_fnQwGM)4M&p<%&iinO!$v;4{s-REUY4}cfTZ?q@uzhiY-?{wzRvcFh*B5io
zGKc{3*#hKq5y%|j04$Ay3*?f|-P<=Hr>+!70IQJms6;}xX)_H!vbKKV3K^H5xw>1O
zf*E^O++>f`&)F4``t0oHBr?AyX(SOpr<iASR^E?PkCAc=eShsiO7+PjLBkI~s5N;m
ztw!|(1kykRH1rx6r=h?8QRn2j8qowFC#EY!b%M6h?znBh)}DWbZ$tLy{5Hl~jfTYR
zpf={`nhh7+Z4HWCIc0;^gTENAc_s(ARcO5?H<c;(V-uuCrcH2mvOx<`S0*F_heiE5
ze+B_cVj@!#u&<%i|G1jD86tQ?|3dT5BUG%7$3gUMW6eFWnF2yB)ZOIuoB5?~b;l#f
z!c!l>UVKErzf&8H6Wi^0@9%DBVL6L}0B3dH2Xr#va0k!{G(!9f&bNqc92|qs_8w3@
z@{BgwR^xFce_k7Qt~{I^<;Pg?gV+^o-@)$d%=O4V_9EI@*k{(Z_np|Ony##VS1wSg
zDn>SUd8EkC`r*i3q4?Q>vlW$oRR7~?la9;giU=LyND6!$Avs6v_P|}f$`JO4U`7a6
zb;LTz?0AA+E9AwUC7Z~7=kdEb5AgdF#O@jYshZ63oktz4s(V`mmm!S)Uh>kBp?yG(
z@rM&W1f_M7cbKz>DIA-hWbmIk=zyez%8&_UqpL%n)V)HtvKx*u+yCWLyths@le9ae
zx>D50<~57ZgZcbHXvQdSSBLt~<d5&L<4<c1#To2%avNziNg`WZ+xAa=6brd{BZ1c0
z!Uc?HJ*00)B?!`8KfTvCz9MI&#?6i#Y4T@R`g6}>aG#X4bi~&m@Tb#I;ap^uuWXrX
zw`VsBJ_=H1WqFHvxHre(FBlYHFiK$dwUQyL_}G0)nG_IgF6mizlBvmgbVuI5#{9*%
zBms92Qp_PeS3mdvXK2bi`VDBaT0Ni)z$i5S3Tru}ubqBta(*j9V0g{)`mC&@*smQx
z)7hYR^f&&<RQcMj7c2l+V=bVP<pE)%CHY9Mn9|-2Vx<LWfeo7pH!t&=@!xymUX1FO
zSo=j--u~XD;TNMw+k(xW6w!;`eOo^1B?`uvl~;)+dfjCrjh{{i?2&T}H0Ob#D(T9_
zjQv7&sMru;^Mn9jGroU(35aE$b!4L<cbxGPHo~Ovp;6${5d~lvz085;O^#${&RMLY
zws&FEXyb~`Z2>5`y_L^)$BZ@a9i-TIJQNS+rQ8@5q-4W#ROR|^`8aQIRBsHzRZZ7d
zEOl;x_TKV=h1K)DGi5SI#U&aRqGDNW<(7IYB8w5e;w3oWkbb_^_)pb0nQFSG4ha}?
z{k{9y7n7{7eil~+|E95NsOjpuXY1>`{&`YtyOE8PbC_o`)INJWcQwx(%v1U1^~cKx
zm?DfOkW>C<+#756sl}78rKWaot5d&d+1O~mq^vpLBn!Z5D@f{ySn==$Lr~h)WUiP+
zc#bj`MBPOj095V#LzRI_<A+kUkA+TRd;}HtV|tnTO6;$|?2Q2CX6s{e$X6iZLzZ}#
z175?_#AgKs1v?WG6Tf<z-M<D#p3twF=s%S)L=CUjs_~rq*ghu%o80`qwD}qmD2h4Y
zDhMR?;w;<g&5Q4gm()KgU*xw)1!e@JKLV^v98DqIj`Jn!5?#ipdwc=4YQkuFSy}gY
zi3SfqPwumL1BE=VHBVsTuvr@B%OuV1rIf7<dNtFWvS@E3+Xlg12Lc43^ikbw72WU~
z_QU3C`!6J!1z%HW5d(fa_00u+6CC7@Ql=Vjk!%1W)eCAons><4P|~ZHzu<tCzPR)R
zgK3}GN+&Oc@#BAx@{;pK>LF4ZX>87GfdJdC`e$!n@eD{`$Kk50PJ4h=e>A&I2cKW9
zRm$ry{op3w37pD91q&3HntF-lJ^j>sL&ayvI_xC~=XOUj*dB+EDuMgLAbmokWVjac
z1HYW!)jUJF@Q)iA;Cvf$ojCA32!uE{e=ye|<HvFn;O7)js6pEcgwzQ;-STiU=Iegm
z-uvoHxKD^tT;UJk)widGuWiG3^MlPJfo-Gu(!3eyL~vF0WwG^S9pGURm~$2&88RtO
z3s-P?`SIQM=AS$!QyC9$1}3_XcQhgIH2J=w25)bJzCw)yGYB}F=4+>39EZt2^!Hek
zB|I^W99-B+$uCiUQm*t;BiVnc-9L0Zw42znq@yl+{Iin}QyW9;Eik8@LbzduD)|~E
zv)bO<U^wk5u<1Z()nD51Zq%gPB~BH2|6;1m;0)5)?=troU-j0ScRzh+7|&PC{r-(O
zSsw+H#VIw<cQXD4$kuGb{9pR*I$>_vMLMTwo#KttSg-E!0td(qWcYjbDB)XGJ(e2E
zui&~`ayC;Ay4g`GmNEM1Lu>#M{*oNyzd^QQ(o`)P#Q50i4s7>BBNpt~d7b%1gYd=Z
zV1<eZ-`Z-Y6-vU8Pj-ye_WrZM;p81hMaImA`vK;uQ7rI-<>JZ9b*5OHj-y#%YPWx2
z=G9(pxy}_RO@=ZxZ##MQ(EqvmyXGhgeMPrLRvo7A_F>$6S?O(rUz|D><|Oocu7VsP
zyy1&rGEtwO1Vr5=f-DOMgO!q08D2n|)^BQ*GhqNo$%^j3AT0+VWyY<EU=w$KPJiyF
z_c;9m)Ev{?$>JhL;M`N55&eeC-B#q&>JKQvl1vFh$KX?&9Kpt9NZ%@FC%-e^6!IiN
zS3%z^mK;3Wg8ikT(O*(WLsm;TTpZ-~qoHHyZk|tE7Z$2j1#p|9Y)bGHeye*yx)+^>
zL)Cyht<%!dN}Q4MHMrc3A9A<3VF+}jJFg8HmD@dsG+S{hNi7$>yubPG#c=kyEgldF
z8ipP!{=nsb0;F#G0{AGHt^>zbdw3XMcYPp~mkq0EqnK}Q+-*ue5#FC*oZa|AI*rU_
zA%qWM)L->&>AgZ=AYl~@UBd2v{rrdQ2XV`Vz!DyD7rp3mrY79jv|DsoDYgxPgBcya
zxedc|j5UD=^O5k6+{JgoRU~OehNBB2eKA8DpTlE&pU(a^^clXAk`t6Xj2C_QTG?{?
z{dU=Ql}wV{i94PP8X1d0)dUoIvP|r=q#02}!?_o}H_4pKyaPD*s*=*qj5F+>bMnZI
z8cV#9JQ)z4r(bRNI#X9z%!nl+NGjBtRfm%}#CC#MfYR<)*!De7HE^LAXp7!|f(bel
z0#?={W+F(>O0|<eQz16)JWlLcAy=&Un=|efIdDIVRN*=V2N8hd?Af!eT6gc7ImRC=
zw)YM2?45AMFtcLz6uAFXPN=+}M1kQOy)=G^WnznL$Cb_yc&5K1lSP)n-cM3)>i^q-
zjauA+l?y~K-BJ?|(8_t1E-6*(w_5y`a*TCgi@}3BSbvP8^4cOS<(P`w7nRw{g)OWy
zy&=aTfdDI|F2pLpDYM;I4-{%|k*;A*J+9+^_U-Iwq1)6o{7bp&)s9E~#dc4h!aY4@
z64uC4#3a~qZ|zj=JQ#!*V<s5zd1z#zIoEVgl4zk0BKB;J^f9V*d`OY;tyJRN{F{5l
zAjQsr#sZfVaPtRu<`;<pQA!POpSN*;?{6L*-?2tyVh9XGW5k!$=Bw6>CSWGrerA?$
z15eNab4)5<r1}W0^mN6?JABJi<x<B#H6k0vkC~>nrvw6|L=d;AUrZ($!=rWLL7;k|
zw1v$Yq$7SaYBIe3(3=DCSSZmRK&|+G<N8%M1Plg+N+q(P2}XbQ*wd|@ec9vM_JU;E
zMr(cihB6_Nfe@);LY5<Iv^qfH@LYZI;za>ydi<=3T2t3~cJN`wpzSHv+AvLS=2|#U
zOh1@K_7!9wr`C2|GmH!VKZaKvdJ5p{)B?e5JvlrZq5TR&esqt*{I?<*l>PUO=s(%|
z0Nn3<pnGZi`0?ZO?Vtg1`M@<k>iQa{&D8EXr^?4RbUtQ0{01125l@ri0>*k_D1^hv
z+OTWlpDLzRX+%3ye;nqn{IJf}!-f&x4j#3q4(-M>*WO=MVW$m;riy28OM#|STZU&u
zGH2celWwWMaE_P#?Dhn6$TD)>*Ea1GVADfH?(FdhvGJ`F)nh2e+F$BDl(7m*1NqGn
z&(77<DUdZS=b`Zqfyl8~@6F$2EO&o~RJn+xWi43}2oM0K00<I6C&|w6y{F8Wy$FLy
z(whtjJ_%*#Yqo6UK}y-jonfNmQj<V}m<}`x(ii?eHuK?>N;4XI^dmh#^jrywHfENg
z_4>m)I=CiEloNiq`tU&KCbT%!K$oKOs2_wspjI7N3f-%<Bb3k*a&$p8=$}aOc*TUV
z<aj9;40jzh=Yv`vkXPYDT{5&|*x?~$KdFA+Z|}GevZ!c-7c8rh7kB|6vN;c?V;K9`
zn?n}xWV2`X&p+)KkvnOW{o-B%lW^y-CbcH89(hg!y5YBIMBjvD<)JF}eWP}PDcu0N
zNuU~Jy7{G&NCsjo^sFxIvc#Q|H~(c32&OI!md9`dw8NLWh%pHRf9!b;NVt6xYu|2^
z3|90}y0y7}6Fq6fMv;yC%n$;9$P3C9=s~%{KPH1H*G0fWXm2R-Lz#;KxV`{z!OymF
z;e$X=g2m}GV&;i9E6=8Oc#44W90mi$j5RSz=L2fVRSJR0m4B^*%K4jnceEJSm}=kV
zSE=PT_})7@Bv_|sRcs`&D8Qg790Fxtb(;J6*^6ni^w|wBrCU>ARXC$43gJKGRXx5=
z7UUQHLLDMj&VpfPd8u$S_q-F>6!3AM3tk(&TG{V3;)%<*x;FASjWg607q0xUNO1&L
zoy>55tCH!}Hj6dngbkVC>Bt&;<M%&^-?@e}nhb~vqKzp86xIkRtgB(Jt>_c|vMUTr
zlj%Jcd}r_YWh7#5%<<VIAgvf5NX3(BbDz0(rRF^AT~|VDhtHCb^oqqrt0`z4B+&4$
ze1cpX1)!t5A;Je`29(CS06=#NI2k}ms0sNUVX6sSAr&n*iSa?_K~%UT&&w?o^zJul
z4?E~)0Bc~O^dK?~8QJ9X6Og6_M{j&`2D=3o)N?^#B{KZnuVgCP26c&q85&ZW;!~{7
zCh*N`?`I`Jr1QMq#`aEwOmgSi7o7XZVYbP(>NPBc{sujha0{TU&?y?5566I4_Ts9t
zi<*R=``McEYBGtQ?C!pjQQ1VE_jt^BDWca(fXk^e;$TJqq$V4+DzvKdow4?9HNfKl
z;@;7C#u`thTMO$q^>IcQD6;Ly6e(_}`B`#Sz%R$lNYGM(aH6&{VusuW4?(8(uL`lK
z+zN%;4*-72R=P-a*SUIU`b78D(q@Dr_j$Y*f9q=2D5P(ljQ7kE%f{DFM(d0|OF9AH
zEh4!0$0GWNWaL#a2LrqfUVX7aOoBBhmR5=u;k)#?is8l`YRxtvl`Pj)*dg~hYf`x|
zpcwBBbT^7N#(NS9Cr_1B^mB^)IshyQTIf;`dg!Zx6;V}HwX#2OcQ?__2)q_z_;eC=
z4&}VteJ|i1==}!=Ev&r0$#|a+Y63WbHI$(h5;X*24cc}ePTm?G_jc{kgUIjfUcsji
zX`~%+d7peiEjcDX(^N=nX*qqrq^UJ}eBcy*wy$`k%-hkr_p5;ym+oT_=*a^?7RYuu
zjJpzNPjHd;?cX2iv)at_BVF<#T*+7<34wMt(uES`UR`Pe#&GPB*x)WV<%t`Xg8COE
zE^h5KFIFee4>W=ns<cAlk&3;B%-tyE1=vm@c}}5|dTya3pqMr8_Y^$Q6xpNO0+ijY
z8v7rF3aT5zzIn7)8x~xkXI&E0zw)s;yBHlr8wgI7{qKweB_DPsFV2Gjw~(ku=9B#^
zV(8u%eM>&JOL{JQ-}}#q0`orCubL$5{UwJMUjakZRc|k3Ek%CYkte*KTlYP}D?ykG
z^x6Nu&;9IyMGBb3mqUA=va4o#W^pLgWqUv0{`d1!9up2aLvf8`{D;t;BSW_w(sz50
zSuOFnknd>z3<96m?X$>JiSNs<vUGucp;-JCl8^XJFyLe3b9nqX_p~j<wEXED<o{f*
ziTNZdwo!mDre#>!t6qs%pSIqlv%l2b)UCX>=K#J*BOlLlFf385(k1~hw#h<J>>qa|
z;r~Qc{prhEC`eM<_QGzCXGcDZmUb`Hhk4BLZ^mhBYYmIwgI3YsV2BE?n97@n0L~`^
z*nlFtdz-};1P|NH{Ry8quS#eNwL=6MYZ(oI_<jY{$y))<-GR2??+c#EW&rI-{WWHc
zlKjp{<u3#IyiP9VZ6gs(C0jMg3}0-g<iIUgR&*&igx%Uw+V}#~A~3avXI^?HUe5cJ
z5-jt!lxQj6fDc}JRJ4>v5H04G^#~;f;$KBWZ{#M?#{33yOdUk5A)f@1N0=~mVD7iO
zjMqXl$riJ{JB+VJnU|y>rtT6pOZ*q-eEIZW<(*HZgR6<F_5S><xehE8^-$K;F;?CG
zU|-H0rKlhBr+4`bFJEf#ht!+79=LumkQA?D#$ry#tZKHu0vr?a9KtSq@rvBqt8~ch
zl&A3{YR!7UjeJ{VZe*$f0S60kZZ<)A_AFX$_ACM4=3$SOAiOrivNz|9%UP_*czZ9q
z?~tBUCI&@@zXUT};lZi7RBS$M!2AA7hnE3jl?a+@Z+NO1ncAjrFLhE9cCxsS0WSug
z*7<TxlIm+O<7!ub_C<k!&o;pNd9(Y04idruS7}0jpc-)U8Cxk`{203=P>0gnczZAv
zj9h`bxjHw`L;$6MvNyp3392W_&;b3Gm;UqNv*tJyo9Z(cIw>S#>AA%?II&213;IRk
zRv2kttWEXgjmUFmb34V>tjdXB$>5&`;6E>iJi>_ypoceWuSl3TmtaVN3t?ii`xY}#
z>?ToihRU1yI7jjfzK=)6`Pfpe0WoVqRPUHKuP+`4a^X`z%C<lg2{9AC9&_FCT14=A
zNU+B=8s-1Awc2fd#kUdt3|1nx!FIk0j5i%DK=<A-Wq!QzhLj;R%rs11!^8{8pK0RP
zUQ6t{eHvgJj1pDOT8tFN(zMXQEgH}~R09z!59}-VXsWkf#7t;LM7qd3(!t%NV=o1S
zY*AX!kk<qUYf^3p%NTM0169}mx3u%g<KTZm)m|?UVCW&CsKhqGmX_0J>ZAAXhb*@n
zRvPCT=6ZSfCi_*#iJCBqL-KtpK^uYzFf1_*{HPHzY8km)QEIa|jBmGFXjbq6Uj9|H
zrtS;Qg)XBAmEV-m-$2;*0i8)}Zp<OD;MhJ_;(f-nHJniS9VNR-s5QL#X6D83Be}p_
zilSKjy?|}6So9}OL@G3kxzDL)@Y)8%f!g^q-oSqQh++k13g@|ViAy&iS)wL|!CU#a
z=6wVKh<W5#M=DA6OXnOksl``qUIg<`h919WX|F0flIUqu@t-+)Sa8nd9}4+`(h8MZ
zjwRccH_x$+b#S<(C=`r7`rTcHpSB?EtNI&`FJC;Gd&_x+#pmXB|8N0Vyvum`Nv5=N
zVj~D^W)C*m^iMa@!q^1FkSED8<deV-V5!mS7qE30-5A&cy{;Lb8Sd6U)e>j=R?bu-
z7X~j<S7o)Js6P3>hgn2YSKEQS6eM+`WZ$p9>>#SG4dR->5gIm4VSi{MiVa=C><60>
z#-#8F?4GM)@b?KRWKzY(n`CNUSvAOMnjjYzin~m+z}YlUSxR?)rcVVuU$XUj6tO3?
z+(KjXvc!eJ0aN?V8^d!>*AF(ow#0|*z&Iv9+f(FjnDnxG=&)~Q0ho$%;F)>yF{e3I
zv?i|~u#t=?p+H`(%V$&Uht!3~A_OMiL6;vpzb}_qXcKrDf(vIs2^;^sVEe&!g@<A#
z4(tK>(3A9Mf6ikP1yZ?h)Tkx$)FvBhEfIU9#VW+2P`}r>*H7(=6J6>h6(8R0<qf~P
z+GIH_P7&r&GJE<}K?0?j=yBnn9zP`A`|U@i?d`8>C#tRW6(-90RcJdkxpvEiY-+dt
zjDETjZPStp6KHeEGtkpc`u=9=qHaTj$I|y!Y3)&AqxDmfehdsLPp0W)&)a>+(#Vu<
zY0zT{ZSCtxGl@ETO|x3Fmv8U}oaVaTP5NVG*bw!Va^Q(ZicBfbc~y(kms`yonSQqt
zYc>4$2HpG@*OfgDonea(?;w4-Yn>e@#`S_eeh`0nrmik5sOA%m%>ahU^5VA;FKKJ3
ztqCXU+)ha`14W5)K}4HI#d8U}cM3Lq%g#6A<T-kJ^EzpAVy}(u)vR+3eBL&==c#*U
z=9$weU*JqD-(kh<|ER(w3;UJ*nP^VYuc{e|$Jl>a%kN3&1B1~W70<BZlwf1r?Pbaj
zmC%SK2T~u$*y9QQi9dnZN_-L8v{0a-&254o?YEgl63(HQuiT;r2!TAjmf(zt{eP(X
z?m(*d|NoOcqwHjd5GT9LLW*oz*<?FTlFdOS*<^1bdyiut$KES($U2$F-h2Mu>fZbN
zeEV1D{d&H}b3LAm)z@Y=TXj60pga(CxKVQXY95D$w_(vwS~G77a=R%}eFmSC{-$5*
zLt9=qg2MfDk~2{mT?%TGatq^B5AWLTyKB#fAIMcD)HEI=z-^y!O2cTyDcAw+*uk12
zp|Kezz}P8&1b-)QlW-KMN0nC?Hx~IdCr@E-DUsIurJ^3^$0p&{uW-g-0j4#tp=0;?
z(5<VmEp*j!6%XtzPg?0V(rCAFP=^{Bv|T|a`QytwhkG9o82hkXMXSfqu$Y~`i>Iyb
zdr6&8#O5hIb<XXX;||eFt=9}LZd-r4dJH+hcP_<%#z`3Ct1TMz2WB~UL$_vpjfThP
zqP4P^2Rr1tmw)#3$j^fMq<DGEUsrJdw1y*Iq0HWPpgpTrk1AgXXtW8l)kfsKX^66j
zkQrrG+sxC!d(2^R&QM}6aA}jyX!UJVzV|e8CC1&D6nn7;A@*)3G+M&e;*fN`Q;bQd
z(F^MFTYSqt^H^)U8|}`m06IH!l`fA2Y1@Asrxdx>Tnuv^t__@CoDve=aiRt8@j6?t
zYR2=L`9YOQ%7cHlFij(c=rZ~YY$0j@%jw%#O<S(NU%|vjf%Q&;ABLB_xV-%oy%!=!
zr;Tezm$jywdwFrG`)2RHMSy+V+e#!NXrwolxT>${x!!jVrnn}6M;0x$-oIO1O(-2&
zTxDqw9>F_Bo_jF^BLOVnegb6r5}3Q8pu?rJw4+6lAY)w7^8oa8H!48jyjk=rw~BR~
zXH!#Bb$aSITx#j^_X{A)Z~SzI;+o>$kB*72*0BeF$)Ag5few=kq^^mUys_S@L3ux9
zO6wVz#9)*$+SJvVo+x9_YAQi<LOZ~FXOi;cbCwB8v!Sj}xDUBfPg3JHC)CqJRMJ;@
z+<(a3r$Os_ErpCupgtu2jt&+Zl9<&P#H#SS+*)O;9Gy_gi+YxB80IWxz2C4y5qH%o
zJ*vG^V6y+)T>RIm+UL&HbNS33gJ(FN?TEnvs$Kv1$4B^`gjlpq@@tQr=&z~1%Y;5S
z4Zms^Au>T9_87~Pe`{Eq4cMw3l`ww=o^1T0rs_LQ#}Xt}2w_;3iycoeQX%1yVZjTH
z7O9XwY9nI7eMp0r*w*Jd)MdAx<f?11UVQffC07eeH%Lo5rv9>LAvR4q(FvR}$FL3B
z&VrUfAx$!I`+Vz6Q~kzzW_Tz)C(w|8O_mO}A$^%6A9J#Xjt3iE%&43k2E_HxK^sTB
zhCU7Mn1@OU010^_uRD4FOc?<^e+~>&!624ca9DbP?*EP(l%eGQrCJ116S2OylA4=8
zeiOL+`^SG-TZDU;2}JuVnAPG_m2BZPj;&h3Ly%FrWFkXXvih2*7V+E`w08lb=x!7S
z0xb@S+aT3a?`ONAUKQ$dV{6hw%HmhVfEIS^w=??5E0>{32=@39d}-&9X7c<f_4))s
z8`%(jW@-$~oA?9yA}Q4GKIyK#A3>+>r?-r{8suM%RQ+iMbzzqMtFgXe%D4}WaVjDO
zlwxfHWKwlE^ReQEcQzPg_hf<yEJ?A(;okLu?=J(SuQ;z-c%Wy8&u+m^i??1(5S1yg
zj$a@TJjEwZhx~zu$ytZX3eE#Pnf{lE#S`hh6>#-4Q12gRVVixvNyhMwNzjAM_vvH^
zxyJgtZ=vgxmyc)@fotJv38!ev?p-tVa9TVX$d$;?o8rGwXsjV^F<%4Chdi@ZzR+i0
z;zU)`_a<%m%*1I9-mps~I6Nu2@Z<I+wY`mm9cFO8=7FUUnjGPF>OmhLT3t^hsQD{n
zA4xT0T4Z%5n0+r+;(YEt{j%H9`f^kC@z2gcQ~zc=2lA$LZ+QaD4H1g8b~(;k_T0Pp
zWtCGW=8`+r``SHywasq%=h|meKZ<l6ltE65qj1x^+&dP%S5}e7nj{?}Z#QbP`UJmw
zt3Zlv8q_b9$-FQrTDYazUrbalW<|%^N|+ijPF3zc(`W4^aP4!kNxYqD1*=QvxV@*p
zM0#S&@Iag{|Hw(B#<Nhei;ZmJKabxbn)VY2)wMeydKYVRW2^Ql=%Xb)3(-zCbbsS8
z8N?<TF_mDN0o(XgnRisXm!6p9)NK7Ni)(P=4mWbFA*qh_YP#*69oG1Z1^%O96x{kf
z9z>ZLAU&W|UX-tQ5dYhZKndwOA${^4XtdA#8FKzi^j1@TkjdEP?h&7ea;HC7@}R(O
z=kh!UGZ<uib&fay2FrZ{Um&mCc@e>6WYo|)v;!66MbCT8+!znKVz>MWcgmtyfqR&K
z#~n~|7lQNpIW{?#hSH1|<Ce~DTvhU8fcc-owGB+0V-G18v|mWzw6Fl2Vlv-QDg^!X
zE!?G{k!Nt`PJ))BEh`Lzlld+DWtsK*clLHZWe`t<KEYudMj-V>fNZxfMICoOn8Vi@
zaT*`56)q&*81}-mu5YlZFclIjuvA1yA9vw2>}BeGyJjX;7wsSfh5dFXTYrsH01RS0
z8iNU~;)>*|pAR=6iJscB@%IpuN%Q|IIzD(`vzl7e8Nc<|fzA%}_S2f+pw#sy-Zq^3
z`yBdV>^-Qjx8n15FPNV5dMkwuVDGnm_dl}<%6yVxN&GZW&Lzj-9@gKN>}jc&Nz6aY
z_A&_Cn0^<S6zzKHZX%mW?AjXCK?Ce&naka^C7s%MurTOVdBexH!^i_#TkN7~vjdSw
zWsTF;#kG^LHIbHAK?K?XphGC*Iiv8V>g9lDm4o*&1=H!=9P<3fRgQ<x1~6Ps``n`)
zvFg>Tiw$~Fj}Ii_fk2NKMW%@y$FRnUp)#P%26la>#^2a<Y_z}ih_K~z=AdHqmwf)4
zH|Jw_tf<y<s{<sQSHcE|?_{3)lX;y<Pkg^#mHH(nNBU4-eEPKX_vqHfy215I+;Azc
zW?>HV!W*D_{dBSU*NgdPV(QV`dBg-J1SY)PTT=}SFp@qHs6R(b{zTM!S=_jq=T;$L
zmqVD&jHv;xh(pc!?9!vBUgMl)tYiiopM_s3^j}RQ#R{LD2N9YGe=*)GKzo;C0p%|s
zdjTum{69Ka<wO4U^lGeezn<%!<U@?Ft)kH}1ln;R?N9nvKBD(4y^nV|MgK|zYM<?X
zX^r^@I0bcWB@w{jEoTpNQqUd#|33Da`|rnY{QVf;Yny1aKY=#TZfgmm-A-S)ed@97
znik}saGY-g2ZpKdtljH;?O1H#Nd3(s(O&YS#j+YzQL-TI$Lj-l`#LKK*gG)Bh7SyM
zseN*0U8JKp&8j<%HJ-$D9M+y`oFG5Qz#~z|=($U8Wn}6fpu^%qbu|Nsgj9&LE`bF<
zk?E@P(d6rPurV<CE#JFPIhN(S3f|nQ*WgLYgFSI;T}kac>59VYKpH&OeU;oTz0WKg
zKn5s~drqVwS9)~;k*?Ofv5qV4s>}vxqA-W4Jm&q0v&OhxR$y}8UE-pd*dmo%g+PQA
zxX9$9`u1N2_37ke@Y~t9frxNPN{BGcXF_B`@Y)ft9M#FsPt}fQGp>f=B0Hyk8b`4E
ztF=B@-h%=pHlo){`l8f0K3uf>T;#Q@&Rn23<UpPnPGnBxTpTglXWAH@z`S3Ssn2zN
z5=~`8r%r*Zx0_cfoA|u8C$&*C#^-J@4vx`hk(jz_$$i}G)kB53>e{*xYe~NYV-lRe
zaM`g;<%StTlb?&wH}^j^Bz&oGTKJ#kwbg;;2cf6SbM4iap|5dE<B)4tx)PXGPxx*7
zb>!)Y-ZEnLXK-_9ny1Ku^jU%xveyXievaNXKLTG4C;3!rKg}H{+7>t7dl?N3IRX8S
zw?=@p)dK!JC3|nTes3Rp$OW%N%goiXwOvVxjM8Mx_M(hB(-&iLdOMYK?#oaJQdDFG
zOILjiCBdeqm7%{QipnB1Nm;DY!u?(-BRSFb2%p`3K&ej0Xv`k`)w$2|gM19UTpvXz
zWH*pLeSL_(D;0j-+$m{XoDN2M&Xa+SJQm&Q2~Eae`zOJ(?N@f@TR8(-OyU%t9Y@mY
z-9v)j3wFVmlTx0CXUfAD6w;TCf~L#<QOKG|=2vcYR3D5-HyBm38i4kfpbZSrCg1}A
zN>)o8OOMtanBJ#M)u&-%e6VDk#*Sv9Z284Ea0)ci+Oe}TFCt*uDUt6?Cbr0^s3GES
zqv<xAJgME9-dZw(6}lqQ9IVftB&3=CPJDV#8tAyeV`mHO%>zgwd!yH>$UxRm_ipBm
z7F=ol!J6Arm1d+-$s41?N!z>k>wDMw>O}+zxFBhQ)_)%j<t-%-e{VDr;jkm>vr=U>
z3pI2dO^6$}%khEmU;e&=AOCnM-EbT!?qj{<gFc^Y2ZjMD2TNa;li9B)ymAvJg<i?<
zPF^TU9V~|WvtZb@lH(2xX^P!NDE09#x7%rw-NmV}(8N%W9liTF>B<dLD!G4-qqF%3
zfeG$pkcl(Yo0ix=Jw~RCVYcy8NfGv(PLHk=9)#1@+DKBRl1nZs0wf~5W~R6v!f))A
z#D$D>-}#vm@8sAXs1-$YLWjExOmt6s9WGKfqbbp3pl^*y>E0zlyvtr{4!5GrbJgpx
zG1GVM%YVT!X&ZGeQ?W!c0pyqh#U$x~45v=5@ZX-3IigC_?Sq{i>4ZEozECwb=u53}
zcbshX0oy*|YP=dZhw7aVj4>IVT%31HOH9g_24cce)ZBs2lg$3j0`GH!<egq&={9G`
zl@6f-IDuSI*!M7Dt05QG7sUo^ZNV+#FDROla|Mkr(Sa=OUOfI^l@xq7zyG?0R)A*d
z)-}f88|2yBV{1=UNtX&jzvn?^7L`(;xDUi42cJF0SQ@?}`o1`q%$^0s-l4R4?3mBA
z!jl32nns2VNlMZ(?Gqr;e{416aJ?r`n3x<OW~9`E)mYopWeDmnqtMlnPZ!Z%3-x24
zG9UxJ6IzcV{|KMYN%QtOnRDc<y1!5X&v^lwwdm{|jMfvK$QS~J3+942<Q~tyG5D%&
z40O8>eQBQM70c?YtTffDI7#GaI{YjPf{OJcgre^w7QMiQ#Xs6Pp0D;YZ1$B%e67|?
z4=ICxMfWSa6?C(#@gJ%Gq3wCQ2<!Ns(ViNwjKXZy!g1@>?pYPB4v~5{f6b0l=xwCR
zA4c(=U2>aTSsu?J(6(4>&Agtxnja?o7%Zj==E{B)&Q<N7!6DZ^fcm;)i~RA4mh<b2
z8wEii5y4Y<Fw9_{$RgJc5;^mZ;+EH~!rUVVX0#S!MCK8HAK!cu&XS38Q%Kd*_0!~o
z__O=hMEPc#Q`}mw2YY$!@CpaAOMC5PTak+Ti)u39#dbCx&RWf%kJF%0_iwD@{831>
z4q^2vVPCz!m}pf?NpJ)D$1bXj1JmB9N9DKR{z`>1>He6tKDDAyc;R?*VIa2_PHB9N
z_QU-6G_kSRa>1q`v1luZLZRNY%n+eXqAqo2N!vVrg{i&;`<On;d^7XUL4|$IXVp!a
zT=yQNH?BH96<xw$4VXiJ^)&7JJvXj0BdNPIzp~22DP;o#vi!-}a^fB@T%$~wUQei1
zdB<k}$Br7fPb$EwI?G$}srvC6?Qu=#Pk_#6uGvu(M#<GGN?*7sBo?6LO+B~|f8ES*
zBaSTGHrjhuXym`Ym;kBOlf-wRzft&L3&osO>HUvr1jzu}bg*{SyefzT?L3><-X4I@
zgO_Y(*Ca!$C`n)Nh`50K!-BRiF7mQo8hKnxcCjc=X!6{^s15Av@<a4AY0*EDSF;!#
z!hNZ&=I`flm%rwHf88y$VB<RkoihjKBx0en%ebW<3<FJ|$4yS6)Df?*pCv>P<@FJs
z^s#=)fV?|qYi$BcJ;}40stNuJ>xYAGcpmcQttO2g=COWvvt-<#FH$=#J#Q!(p~1Ca
zlW7Ph`Dy)ihzZno9~hpp5rb@?c-lqh3W(eyI;YECCht9^WiFXAi{I;kNrUinp#L2D
z%xhlS$9<=4@ap&6jIlcmP~2<}t`E9C0)JXH&L<o(c+cNNc&|7PnmHIPM3h-5cwP%h
zUz$5DHmiw5_pZ^%(=3`GlRp8vtC~RD-ut-ctZ{MwTAxEY6QM&cM#c`XWKX9|fWg!)
z3bWWG+fEfvwNLutSmWbuxGc)0cKP`6luQtll-0ns`oNRXw!GTB=b)sdQf4us{}tT=
zGJp9Af`Qq5P`hO$+)s@>-tpS`(b*BKeB7hSr0=yWYE&M78GwApfhVj7690D1`jx~s
z4fO74s?QWwccUhSAG0Mw?MWdeqrwI9N+<N3SvJtDL4;fR6WH&E$sxcdatPonsDL7B
zfDu<|?Si|KbNgo#$zy^~gpW`k98DZbWI=2Aa|76GvX<J_p!Iu8oZlHWeRMc{_0&<d
z$5VvQH5WyT87&D{#LM0-SN-f-qe$VMu%%oks~xL;&{`Vfg!k8EiueHj;C<w;3cef<
z-!LNonn4~ga~e7G%f;{6eYtNfrF&g*4*C*1Rh|Pa>(xduYND;2qw^kP4{e;U8Qoap
zx2}zbbnizWb-QRWA?CyS%q}YNf_RFu_KXUd<mI2`ed>LZX{GOej=J4MM09ICrrP^V
z=Ci0bkb63LT3Q8+uhua%R~EE>$)80Z5BA<lP0%|SKfsN7%Ir<AC)<PbkPD@ZSj$m_
zWgQC?Mx;f1yk80UU<|K4LLg&Gv{89FseXEr#1B-vplE$E3-LwEQ3`Q%X;Gn0SRf5p
zMzJ3AkKSRX;`(sW&2+UqgPWn|){E^UPX&|7;KkA<?gi}UA(bimtDoO9+Q>GQT{cLM
z?cJ44v*;hRzN(d?e%|*sla2tNYW~BiE;&k;<->;ETB|k@Ft*e=Tyo9ZO8FS~V+1HR
z;b4zS7|bl~o%Dz^VEAA#F&a>k9lA&}*lK+1dAWa!m%H+Fg#tU&VE6kCA*H^Og1Fiv
z&oTL7Pls|-{aQCKb*OEN(ezO2<Bu+XoR(Yw_x;yL2j0(JvP8e)zWcO-+NT|l5<1fH
zS^-F6_R02y258b{O%}s)xvZ0|fHgjb<d@##cz!OHSXNEEF7W=22FjszS5qfpm$$bv
zT+GpVkS?iH@L$V6of~|yO#q+(*DH{!By-PjGezSBOi||@`wS-2s|%AojFVs0-y$&S
zZxd}vo1*^mHQ(yPXxYIm0KXXaA*Bku<gFbW@6U~?hf0EcmAC%N()4JCYZsu1`;Vw}
zOf{%zTU(5MAy{#lT{9_f^DRr=nOLs>?MINyBl0E*jc27|aH$6pNReB}o2(yLU>hFm
zH$e6tOxJ^fK_G?o7dWyYJLPN5ABOGT5eP?Ube>HGtzA4$x7+6>pRNTvv0ob0GTtam
zVD{z8`eIU&co~R*c+yVZEZb(5Jr@fq!v{tD=Q^3tyD)!X@vZuHZ4q_K&NeSLz&k9p
z*0~##5=Qsxv+#BKih1ErqxIPaZVwO5fd!|SeHm`zl!EwgtygVbLE+Rfd{Pp+BTr|a
z0-hA5IT?uAVxaWT6k|{meB=S}ZQ;g0-+pdP`!Yz)UQd@mOQkZ=V=NqDm-0o+04-Qx
zWHNBfD%rnebl#5C`!<VrWBo0&@3SGfQXlWDv}s_Hu@17jA~z}p;{WBiYViM%pMKMp
zvYEW;j^VY0pZ`u?Y-y=Qz;nrm!*`WjvbnogTjOFsP%U?tcDjP+2qtLUVa`Jfz&bba
zv2+O=3E&&3fM;%3nVEp6V8$cYR)Pu#?k)OptHyPv1kkNPJ&FKz=jrlyGAU=X>*4ZE
zD{8b#VpPRNiujpIJWoL{n*vRo?E&n=Y_g@!{pSTWkT~)82!0y@<tBiIr)^8#{F;?O
zk_|8Awfhaw?`Ysh3(i|t@U$71wN};!+eBWMr;tfzRv3dVaL-wN|2WQ|+$7#-8Po(a
z1!hBeF*G2M3KdQ%QNx^(;Dojbw?vgoGvE}<o!cIb1D<_?;Df(tV<|D5-2V<A!OFis
zx`k63WY6<qLlIPeybZdhZZOemKz2Q8f5X-ruXl*+WPLm^=CLtsER$H~C5Ggs)-~0j
z^&rw`868A2;EOIH?tdsBc><dB1$+m?ZB+O^IdVe$@N{mAl>{F0GuF$6+nJ{~S(3rh
zNODY>|1$?+b555&OJ8W}&7X_HtuK-+dZh$Ztj7if8u?{6@1F_(S!84Y@0%JMZiWnr
zM>D=a4{%<bBv|90?b$v^p0{PW0NoSxNp=dV%%P3vJ}g6RpTY%%26Hrp673F{pLLY|
zGI$eW+MnM<P4snc#_LY4$Wiei;!@*WoZplT*}a=6CA(?8^mji`)@l}G^)IKsztrKI
zavrOv{?y;P*sDV=I_36ru5PV3&A@fq`LU#3z$;4sJDdbsR3BA}8UWXwo7orAoXx81
zXrz+@aJTIBX**qQZ9HV~oI8-zMYRg;oGN$t3u9WMLvgyTPm)f`FM`jU(QIm$maN4w
z$gxy!LkWt{lj{GVA-<@${la5!;`j_}Ke$zS*Ia~&(~P0t&I2?+ACZk2O4lDw*!@C#
z>%0Okk(~hY@5xgFC;wGhu5`>N-Sc=4NsdeuI-I&P-%xiu*4+zvQm!BdpW8C<K&>yG
zKcw>+MMK^hui=y`_<QiQm2-o&4!N_{qg&mbP6i7Noi^!2c6Zt5t9u7O`_*8UDhGVT
z{r`FILwEQL>-N2iZYOSDe7BNm-F4nM6xa3#tKwwlY(&VZ=kk9Tg8%cd!WeK$?~Kdg
z@W>U2x$X04ww1VqOY+uioCJB+nAJDd9$kzq>mQFg;_3bXTPmh58QnFfILhq_X$&<k
zj_wQ;yOdm$8|loI(OYmvWkH@T3m)_s5hz*6XlO<9((KsnH*D4W0leN}S--cCUhDMv
zJ2&uT(uECb-z~O6ZX=U-5CF_94n^=jfbq6gjT!YS&+#dc`#0_hL;t}yTz&o}l@6yg
z@tV}O0?4%`8w^O3kH@2%Wun`c#yCgobB#PW5i%fdIa)52Ur&<Z3l-$3!e9;aEkR7)
z2t}GriyB|!V8d?L-auBVuy6tExZHy5Qbv+)wM#;^A5B~VCi;}t-6ovPSx*bZQ{On>
z-(Bo2uLum)Nt4us)IYZ#OZJ0Y>#&LDqUxE`qKyg5?cKR)<aza=%+3|Z!pc&&xMF+B
zcN*HW)UCwZ>dX4D^~?6~=>znp68S0WN732e=g1tYh282Rqt)G?uYRPv67Sraf2bGr
z1XK_SSn4cBR6szI8+I|*>C{$o_zmK>Jjj`dujNN!A@BDH(rv|({6grUxO!=dO_7M#
zi9*W9c70LZ;RxgDsprJEzNiRG-X1B^tw!l1MGwBb+pF0(NaEc~<g%eWi8Wh%f1;;T
zn==Flhs3ng^wmXrYz7It!5cmUY1xB+#g(u2+mqczpQ*+QIG?D@d7alu&s;~6g9-&Q
z){n6oUr{bY`r>M;@i=4h%An}Okht`TWH9EcFX`q#VsXB8sS8pVMrVg2{WW2wy#6x-
znZc^{tW-z2qWv2Dy9WbA0?uH`yq>DeJfDlaHsf)>2v$7h)M?Mr@O<w98)sW6!fx>}
zV8Fc4SO7`VUpF?~mgVUkGujILw+C?)Q45D(48ftg%Q^=17v)O*`8fug?L5^|>+xE*
z_)v{alGm=-6GR(MsrXi%=T2DtCj0%_rQR*0^K<1bgY)yy>O%i&HeZI+Pa8L`&eBe+
zfyn-536!0{@azW$Y~=Pcn8xSag6UBq?R(orT#!VQ$owmbrb0c@?avZTMA&aAB!JdF
zE=?ShER8EL{W^BDSzec)vfcydVmAS^PT_}(B!66p(gjvLZ!J923oX1hdAIH{`iR<T
zE@F>wuk{I6)c%XfEQg}6Fhj7}e$0E0Z&Q*b4#NCUiW~O#hH2f<XZlQaF0?_1iK1^d
z{QCb9<WG3M5Sl=1*JOi{N5#(xr~rEnP{+PF>RtW-5NO~v=5I&sGY|2>DBa_hnHAO|
zknyknIq1C%PV=AZD*$++Ax-gFx_9u?9BrUxnn0cQy9RDnpv~u@ParrO5E#v()h00X
zw;Bh$Fe@LLR5SYafaB3u8aSmgLlKjkHcx{A)nJKb6BFvw|MA6S-H<yAY0P6V`!O=X
zUbniu&zaEV+2fq-iG(+}2^v1Kn%=~6aRCXr^mhA2WQOM{c*T;XC&{LH*LgVBxYro!
zb7fq0Yfe-2AI?rUeDCkrMVDdUWTHhI2#j`_wLsJ;E!0J$tvJrJ5r%haHHO!MYU%@>
zhk3Z{o(Gm3uh()k@Wx%~uPv5DMU<46_tgFB$VDsU3QD8(6cBn94o&?Hb<6S2s=?7B
zGgJg7;&1406~_7=kG=u!sJ4IBpb-BVZTu2}2_M*;A7j%JLD8O!(RlDEk=56K0JNr)
zT;FMANUGSwiP$V}y0bXcCZxQ6Cuvn*@fz{@qgkKuJORmq#651Z6EP@~h*j-kRpQsS
z4-FL}Z5-l0vtMoON18Dc(J=+BS<Y;6S{mMqwEEVy_PvZ}KeplUa}BA%7KziuL8550
z0at-gpMvZ<^5G&BQO}#0tw{f=IL3X2Ypi{hqhyFlOfivf+B9p+8X1WxtvTft$A0i$
zzAu9Wm>na&WWowK8b7%xnmQsMJ6Ingam_@x5#Zqkc{Kbj^U_5A+R@wAx+=v}proy!
z?_$2`PE5-PPdHpFD=SXdO1mwJYsJQ{*n$A=GLXJ;EtY}VBP_ltIA_%UH+laU3lq(9
zv=PbbDt9U^TVA{};0X<z$C>{)^{prHzGi0dV~x8}EA$n0-jQcs%ie%G5)@s7j`W_p
zQeh_)V7p#SwT1d?Zr!Op(CE7VShPT1Um4Wfw<@B+2Huk0dac*Vx3zneC*Pl^gDf5}
zI7hrdCxG`JlkMNq>&zG|9J{*dT?|xLGLF|1d_Eq<>%l2?f0LS$c#8WF5-c@e<eU-5
zlx;S^gg>{Oblgjku<PDKr&m@timDu`S$N6q0NIKjLAMpAT`ewiFAlP9L<QE}jmZ)x
zZkt6VD&=WfZ~dPK$=TW{my!MDnm>G(*xIutOhSN3KpRDNSFddv?zqWwxT_(qJmYBG
z5nkd(OM-x@E6czherfQ#0b5>C^4RF*aF>YsYE#V9Nm~U^JHt!9z2Vr;on>9&A^ILk
z2hnwe?)f$czu6?I&fQKG8M+z;g$nd_!eT_qvJF7Q-Y(W3UoS&*0}+9M{{_iV0y)`r
zjVHCrM^@R<-{>>0eg_>$Ox$+yuGRCYZA}Yb3??zJ;O6M2VXfpnzscfTdyp3t;AmX<
zoM8)Qep^?xvqx;+Gp18wzzp-{0O85R8LLbOD@y&xwk%2y#TqA@y6BpNKW}Vs+uq@%
zk>1Gwv-&<2tEcu)<oI*(iOOBe_d*F9pMvj2A9vu}wS4ds7kra`4x{eI)U<8$s}1uB
z4mm55a0>7#_pLmi+e3dD3xOxza$@YRFA$9zO9-Ur6U_@S^>3`WA6US&LY9}tK!j5&
zS?+WTFa?#P2~Bn_u+UDmTSbtMO?NDmgfrbc3q5L7`tqxPNsxzo(cOcGEn0dPn5_7%
zA=4dS+_3-YC?rxB;BGCsk?6by^$}kpM=k3!_0%jTii##dxCr|b|Jxq~Yh0hv!)&KY
z`glo3gTNGAhjAh>iRdT>t~luL6$=E?MkbruMp#>KOGi!OX!9G9u%Z1!oXV=_r!oG`
zuacMw<6L>$+7K%Dq=(}<L(?a;KNQ>Zs}|}a4zS(R65qEj-7gz>)0o44GAyT{xl<wQ
z2ZCF<Z~$&zRj9y?z6Tfyt}jZ6la7A%D55oOx{N()PWHWn@htZTdKG-TeX&jzNEAt*
z=^$wGlYIjETjP0=r>vc_PTroLOsy3mga?7giMO*r3joaI*CxkPeVo#kpKE2D$g(ev
z8&<HRK5<|Kkz$@crET3GO=ZndCfdb$%UmXig@4iOChq`jp*~_(Z8E#GD**c9{Ym7>
zK#ZMCb5M=B*_X-JHu+hCV4IJr3N)|9sCK1Zgh2DpT?$9M6LeCI`HBWKq{S%-Oz_iP
zt}iR}6`h@-Q@j&aeaCvGv7S@S9@)_|RD{^<$*kLd($KmNbf~)Nx!>2y6VoETe!%2&
z_XbH%-b+f`;J@TCo{=|k2-AWAHdeS-#M(Hg>}X8lwDO|aM(ws4Mo%HDTBoxh+*E<S
ztEP8JIAI|7-j-H~%(R7+H~#~jU549D*+95oBunI)qN0Z=kV(|P#x7AJw=Y$yf&cTd
zY>D$lv~k0NciMB%$48SvG7ySC4nV(I98fu@VWa(V$IM~QNXY_Y@_50WbwIG+!Q@dS
zl5iHMq=jCINNf75$nvW`RVuO)<u19D{%EfXT-NnZMb7}VO#}$M`YQjo-CWJ<)FN+}
zojIPgUt;Hd0X{%ljq%CETwYG<gxJ)@uTGk)^UcALuO%bf@T8gAn%Rz|k+(Z@?U)!`
zkHu8?l>m>W=h6Zte0bh&Puy>$W7ShO6%u+1*r3}(X!yy%Tzs_~6vUaX4)4kG8})>X
z6`O6yzW~|sdYTUD&iafhh^w5+=BZEBAK#m$?R6w3*5nwj9-6c}OJ+h>*n1~;c8f;+
z3V#}9{d<#3#xv%p{t;Dv$HK5?VS7828Lb_twEI61=uBV&Zdj`b9y4?|xfK);!RS!u
zUS4xpw}u%r@@)ML^ipH+SWb1D^%Prr&Xj!5^C@ECl5Y{$H)vf0#Pimy|CLv2V9oQu
z4q|tev8Lo;b?r7`nzT;1@yGxNec+>aTOLO#`>=A3{wLxzi)4haU(=Jw!4{yWih8on
z^FBIo7}+x;?^%=dksQjV4%W-!F^)2^pHfkCda&O+ejpUc=#cRz-Lw@)o{@1$jd+a~
zcO^cMe(+z|_;oV?cP15kk<aFT2F%x(_5;zW8o0&WWC;@X0zA#;@A_(XWk2N6y@ssR
z%d_uHjH%wL?l(*XU4T(<dsWnyT0%R|5(MV`&mk;@#~4k8j9l`!mU9y_>2&VMNE_F_
zTHVFA;<DqyW1XN)R2H4}b0fxzHj#)E*ON#eGR0NPb;C67d&&s-?phzWjSAa__=CI(
zHA%&%@62v;0#&raUu4FC;JxKrj?aW8rE^<3(oBtWQc?2<&O-n9Ap>=cM1v*Tgvzc+
zC&wfFD~tJE=Q9S^d?4uR_JJWnQ+z9E4*_!NF2;RWajqY9&;Ow&0oycb2#st7_xkaS
z#aGtLNLK_!fY4KReWNX6)66Fc8YGn(pu0NuAAxLzg6>B$`r<daqlM)<3xkbR##f*3
zrtm<fRC57pEsezQ+SUV7h6ByW?7|=zA`BXT^AG-0`2onPOsm_Cq$V_pqdD?AE#cj~
zh{1qo4lc)pIE-naNVfZ4lJv#(rgEydAm5;oDrXyQ{$iD9nJ+rCQj)5`VjcJB&ngmE
zAM@l@L|`WP5zIhU)KJL(0zj{uMX<&pIy2MUWTmdtM<~Hth2*V?5oxY79{RP%{xm?-
zyrw*gJw^#?AS)}8{}AX+_a8TozXEyg#0*yMHxyZZF&0&wiF^Q~nw_vKS;PbK<bDfX
zx32KM2J-#|gocP*fF^1%v4;6#PeR3-lihlnD~ETJa~NoY1@HOXf#{!EZN5NXKG3?|
z|A0BZ+NH!d3dudp^f_<uZzsA={hg5_RqGC9;4OLH0Gd8phWwv($eRFifqyrF)@@G&
zI~ajxdH*rpwIO`{H+(>{rPKW{;8ux+0~B@xfAYotdr&$t#qJ&C4slniwT;yzDNVu*
z?2U6*gH$#NU(pjyu6!G6MuO}cVPAC;2H=A>?OS^<ysgJvU#|9gqjpvw1_RMPbinE(
zRePsL1CO!KuG3O0f%d8YXNfq)9eaUWNLSOt_sjUjX*^>zX(y~bCMVNx=;G=Rxp%H2
zbcLvq&hO(+hKJ#bQqx<Wtb-pHkDk?KJ~3z|Iv67yK?|w*$Sb%uHn^lmyEE@f3e{Qv
z&>04r&B^GxCP){pKbBotSRz@!PF)<jsRATt`qeY(O&xZ{(cnVemjf%1x0*n<Y{pV=
z^tWa`O@`6dq;$G?5<tSsUE!SjzBX%?nz`l|OGddV=3pvLl72ZKy5Qrw8ALLr+th&u
z`Q8@Obk%O6!Ff@jT!L#++Mz)fFK$`t*RfjH&|oNckEB6|@a>aTb`-iT*lPJZCL9r|
zM>DzfEmZ~xl`NZOQnq(k8s1Mz(7IK~HcULqcC?yPWn`XqeF-jaxv|FAq%V)>?0}RL
z|E%M)7&0kf)Nvk399gVD2oJ5;yTv2yTOPb6Oh?SpxhFRiJPW8mzt!Hi-%S-0Rq1n?
zl&d|!#D@k?5}9aCe$QL8R6H@D4f6aVL$bV{E?ILmWtb%5y#9Si5F_(ti)-OiVul7-
zbL&*eOH_OFVhUO}<Fza`wpn%Ir5v(p6C2pjQ&V^yBcxrXHT)fAqslXq#_?V`M(W;A
zhQM+QORe9DIIC~%QPt0*cTSu_DXQLmHxv#>WaNS$!E~8`4W%32tp^=`J@SU_j7On$
z+pcZE!D3m^N4ZS-2TH7D*dITk>x-1a+LtrwVAHYSyw3)}Q?b5{dL>9ZW_sT?Qysw#
zYz0+0XjiCMKk><vz-oDOWSnuzM>{jr?0{pQLv+PRdiv|-z4mmaTB`xJofGfrz^82A
zy%1j;oMXzCpf<D=VfpDPf=lQlMgF{!k;vGb2#_VVO&{CEc=%xZcgdXh@q#Ku6L$b=
zC)&%1Os-8hs}^mlpp9F>Xcph6ff=@Mw8;>gNzRTB!X<`O5NQ31y3p>HN~hk8SF%Qf
zuLKu>LcJ$ZKpq?|nbP=B&4%_n0+XcbUjD))*vaXPq@08H;3C~0q8X)=!su%criVVc
z3X~f841YkQv)rPd4ab@(Ww)6lJoln2A>9`>Q$cSV9=O6yr>*AnWG3Z@jg4hKj7|Y5
zwEaAGwC)^bMi*z!lVs<Xmg9IkBTFPGp!p8S8o!gnmkQ%Sh4F+amhsMI4B!KpKO%#B
zk3{V<DZ@fWCFjFVz8##VTR;=?lJ6)Y6{0JBDSIS>r5g~y2YLk9xOns3H%Vo#X@5B?
zT-;MPp67-@x<I*o{ZHcslLv3_LMSF%V;A!BXOXrkS`10kq?3)syIOexDzcqM+>#aC
zAG*(s3#K~1;}o3Bx4O%9Z{Rt7znUbn!2~)fbk?Jf+Dl()tg;`_nc25sjo&NJesFtF
z?K@+*d&-CXgX?f-`eUJIAfCBNk@NikM!oYxokqCZYF-ZfCi1Y&#~@_psGw?rN7$fd
zvACU7bSCR_614He6KvFQ+@M?Yb`}diW-FFbHU|8`nMb0bN2o)wVdCTN$ScpE0y-g7
zP8A-hzFtEqyuH7rmj@}?G=I^VWCUOY2Kn@$uP-@Sx8A)>jrd_pnQQKwt+Bt@lB<0X
z!X&y`{%K1FZ)Z~g;)*g&aICe{MiYep*eUMkMg^v&&Ahw0e1B{yvUYf}mO`PEdvCsl
zC%_XMxfRn1Hoia5Na%Sxx=7kZuMrkZsu6Iz$-{CKTVG%Q{8Hc$Hjh%L@1AVamvz!a
zf;h&S!USgIXYPoJnr3?2uT=)V0}H6FzKk6-Mq2e=CgOIa7<XpA@U&*_)2*GERwaqE
zQAG&2^yRyTuM_9B$XknB#|<>~LPyVPyh9NA;}$8W8^2G}ry8MZx5bR~+vV;{r<7?N
zy_+I=ISi-5d>s%_xng|$T{6J(BAMUr{Z>J=)tA6uN}we6%0Oez%r=it^FX`PKODh=
zTiR@hgda!pknuXyy@NjFlX+cp01qB?3pRAUSO8St#*YeDnf#1=^Zg3!9!8^zuGYO*
z61ib9_?yxA5vf*vbRKxwj!h;HDXvaGSCotXvbe14wOe9s4Ahf0ZpI<eb{aGh5?y0`
zZK)kPbjPWcns?}C;SbXKiWgU?kY>#aK7(#S^#$Fpd%DY{j{T+fY-4s-xgkIfRE_lW
z$EF6onfwLv9ct6<OD+W?p;vm#yfFHQl-+38P`<{6KzEXZNRa`@0P?1D_)nZ~5xIi;
zM$(6;af9Q9#45y4!-AI}`UK|^T4^RevP;@NtPN9a_qS`+g(XAdi5})oj3=Se933;>
zvZ8N|=Qp{$GRiV5t9{5!5og$A@Li)`Bqr}&$?{n1R6P?>imG#NSv9F)MI(ibBAPU`
z-$usp2;sS`!Yqwo7+_Br^XZB3X4#kd#rjaEec~Yi{7!1{ABGI0DuOaD|MM_zvinjY
zksCerw@PdYwi*uL2M~&qdf4G%H4^cXtR#jTYCCwFNiK!+$)+U9OW9ZJCM!Vx-$n#R
z^SMOjQFMUMQFh&f01kl|LX)JC%&Q^kTaFf~H%gLBK<ipwzwsa4)2vuE{2^M<u@p9p
z#C!`svkF}38IS%9&!g3Ms^GiRucVus=<eQ+*x@1#HwTAb=Twvh(LSVU_Tg{xX_b8C
zdM%EVa;7GCQko?0`+x@_JGg=6?mxpj5#G|m8<fq5fT;_UIy{wQTn=X;D+pUQE-!gG
ze>PO;VbD`n8wy&IpnV?cLUy6;QFMg8VH)GeI5Fo=T>~9n)vf1@ga{CY{IoHd>2459
zNZby7vAdqBR4cuWL6s>S-3=!+fk}7ut)7%C(|P92^NIo)ap>R*{oygeOwT*92+GJL
zEpXk?K}H<^8@=+j+BWxRuGr}BMA&7gL+~dd?yfG%&Nm97`_tSD$xA*`U^;x%x<jv;
z^^ynVAH)z~QX|(zKkYyzSD$TTzRkL`l+fNWWl_}+n9qi;)1+)3Zbh$dIhc9wbhfCu
zyR9eI@C!P>taNNr%W5}$$v99|q<zTZ`wNFnM%3&ct!UE_5GLpwr@AAX;oe4<i0P?H
zoYilnOMSj;5p&X#rhmFLHQyFLTHOUPDNefAXD6VHW`o>LKw9<~)D?lWEy;sM$NCCA
z$NK;To!|1+m;^z7!`&Z3*AR|ohHBPOcnJSv2TLQSD!(dS3I#JGdW&yQ3cWHO5*J3L
zyl9m5Zr`fj^-qbv(MV4loYH0RmAx{<up<Z3jS8&Xk{Dvls8yy{O;8YBj|<hJNPs2@
z9Og$0!Vxp~AExd$=_YX>+@@$+@DK=`;v{3Un^4QU(v^-jg91f0A$c0lQH7owuF>Tx
z?KS(=)XG#%S>qD?Yc0oppK#wCwLGIf4&yxuXZmCJS<?Xg7gR(x$pM=_;~6xb+FL;$
z?xW-ABXfG=N|IAZsVM=>->KR5d(d0KAc-$^MNkfTw1EAaxycNYKFfdxz)GvNn!`tS
zGCBx-?3coM7-en!W9EE7=^UctoBe}uU#s5)!Zx2}J|Nj80JR@rHRpcgwl8V^X2L?B
z?SzpriS_3??kXn-W7uuXy&@x7XG9=KL@9aCY|jonv;+}U+t3H`P%!qO7&$-J3hq`q
z3UbrEOd>MTbR^4wxF^Q-@t~4D`Bb<Mtwh5N?|M_f)SvB51Wj9IePO(59C9S<&@$Q8
zk9{O9xZ^!4NMmj;{JwFG<HCi>9E|%ot`{Pl!?Di3;z=EjcvPo&7JJ}dUL;{?bWx;y
zQTDTFh~r(~qb<V|J)^QKmHs+R@xH@dZoA2rwURPSm>R=j-zjxlqE1a=XPzE<*x53%
zEQWL4=Ra>rmcT?BwitCCAlh_I4K&`W+bRm}8cd1f0~aG_J2ZBP!KD*<tW(xdmu!hI
zD%fNxsKPXgdH8w0Svnp4MPJIei$a-bfhK9CORGopfd~&jOo_6!Md`#|QRg%DEL{I9
zexDuQT4UbQ&iqo8=|cU}Zi8HR-#T}2c%SkmJlk8-Fgn)hRZR6ZK1aW&)=SPqy*_42
ziY6gho79KMQ_MO^v@a+Y&Ip`cnE=$G2pX!mNwxY2yU<*lbU|CM8pG}mUK@O8*Q_>#
zIx{tM&v&!QaU0d48uw6SsO5d7xm9I`HJ<(%Rv%ubW8pnK&`(cqNZ_cib0!miI2R{u
zlj<m00b7bE%#z$6zPVUcsBG{!yJuWgl8Hy(Xe}+AvzpcQL-dvwxBp^>bwK_gLow+^
z+>SxRuh;{EPGG7gpy4Wmfit{X>N(SQLum_2ARUnN146TF=MPE=5e*{w1fq$ea;qP$
z`(EZ*p~xaiPC;`aZ+?FH!T09aDT~%RG*1UaOsJCx;y^1MlG;5sq<j6u@_n<|n^MMv
z_k)4uj=G1`XKD&OZ)nGG4%L25>6vrshw5oIJ{!HaQ!h(o0>9U<!W@puqQAoDUD<<>
zH@!hRW2O&c$HD+fWpBAk(PU<$SoR_nVb!0HuUv?B={t?>_jcOE)p15t_gtvN?3Lmf
zF@^i9_@9;9>xoX>9sTvzK~nohAF{g81MHD&$X$Nt=Rn^f>l23h+e%7_G%k8l<v|u!
z&;5Vm{8jMJe&Uo)Zq{Mek3Jo2A5QY|!Y(`XM|?qW8V&!Xq2}Q{{j;n)Z9wWD(ns@S
zyKZ-h@Wu?*4?t#_0->|JL!^)=cfL=%Gog}^-W%b88F|JaV!C0o7Qab{A3m893#3D$
zYu{j6{LDgDcRvEH4l^4#7H%xb=##vHjAQXv8Yb~$u(t0x7RK|QHWbxZswf{XCOVq=
zY$lcF0GVa+X-AZ*8|8viO6|2Q>?uD!JFRgMn3Q^U$ou4FnUBxW-~2Zb=k-%y9|fDI
zZ}zKkB$<6T{3&PUJ>)}0A2z%oD^0ax=GtrH_FN`S;k<XW&%}+F0Q=1%(f-At8kD^#
z4Ny_gTbs)X$MJ_VlWts&$932Tz<F1)_kN9JK_*2M<DE2~c|0cbAHeX>B-ez3L{tii
z0Wo3&W%WIv__@D#pER{|ZnO@1LkU%ZLMIbQYR-kzrOR6RbnNQqfJC%T-3pQY6lZ(m
zpQ@=D5<PHAC5AtvlA(lS{5wvd>Ez+OhoWyHJ&Od&D(xMffj)}SdYb=A94%6IU;60%
zU$oR01o(m7pGatb4Fj1kB1=@H-~j>wt&j(NGd6AaHC;AUId@CHL1^xi3TSSL*48uv
z6;H1dEud`yJ<B8>43S#`j!Gy_GTR~Q1-A{Zd96t-^&kv`g##f(IGgT`CPMp^^>XO3
z(Xe0}BrY1i!%Vw5*R0<KYy3%qIcMbKH#%73_Z^MKChQ#MWZtabg>%r4$oM4jo_-?S
zudXeJAFm~AV`@bYJ7!Kx78O$S%=`1>-WXc>b_=U7Ia;Cy=T_a0crT}J?ShhcE*>m2
z*9LA=*hZD<(HvTut)F^(XBkMppk14A8=lL5SMmjf=R8e+JTv-^*wp2bFK`ADI)H!h
zMEp7u_VEqJ9E+1#3x2a|r~^SPlw4JA=;rsh77dONiOte&KfP&@2kqET8aJf$I{5cV
zUL-!1Z`2dxH;n{qfhvroKC_=Nx}Chm%TM@$u8CVnbp)mJ9vdYTOP}qja6Wu~&~}~y
zp-8liU<ec{JWkmkz7teCDB2W?sPyD$@HarV=*GB{^wZ^G#rH)e6?pNpJOdHCXLjH`
zbY;}!*v)CrtQun`58%h(ol!#Tvgv>`(pjO1dO^$WO#51Y$<M=itVg)a3MdI#3$>`d
z>~*#Qg0b8^nbX02tZP@}JkR-d`KgX5V95T4<A84snkCXVc?JYIhB%zQD~t7vA8c`D
z`?+(7h`w*wCFwtPDNeqDr`(h{3UTm!MR?cxU$yWD(|N(MkNQs8ZWf?Q#)^!SSL$yX
zCe4x-T*UhNW|{7*L7n;Fi+iL3hKr(t6%Gw5R81jz-ujJ&;dLH7AtskeOHp6(eQZkC
ze)?xT+ehq(2o~T?CkWubN9;th#`=?NHClaPiUZfF_SZQ|y{Tm6a>9(fnjBUgP|tYG
zrUer0Ip=8q@ajfi+C09W`w;hm*wJtbd!>%$dq;K`6)k!a+YDsEexUC5nLo0)3x3ot
zixFN7uP|7_{`f?^yU0DjQt-wD$_|coL%Lqq;*oGT45OIlbP%0zut6zG1>1e{%fs(1
zQ!hQGo@xoNBE-0UEK$2A0H{~>HOK!e)^LH+9@@&V&EXdn{U~jR$&R6q!Ilw@Rt`Wu
zA3oP-L%pz@hWM}L_~pNs{c`uIgKd#iH9ilf=*3uSF~7W3=zVHA{Z^WPc4O?b<@C$<
zZ}uT~@q4Pwqa5C#mhN|QV8!<$_dl&9Y289R*s#~b8{=b9y>sHpsRS5m=@An~vLz{&
zejZRUz*e4|Lp@4*Bvq8RWQc(|S*w?aIXBejynD|x;-sB%p|Qp#np0K;40`$>jQIwZ
z?(5?~GH=H}n92V}8q7Nx1E03hg?0*YH5sjJF27zHn_nCPetZq-dH?_GFLiVKA(^Hx
zaeN#_oaWiMJzB9v-t_xL8L!9}%8vIdwZm{o6Ug`EfD*tftvmiV9jpj+Ly1iK?GanB
zo%CLPFs<>~M=0OS?hu957|^&i(p2A`d}na$_bdr0-Z%+BE&oLtn+2(_l_@q(>B07C
zxHOEz;k$-?=y4A|6Tq?NEh%gx9haJJK2(^6eUemT(2zu7^Y21npaTHS>Tqt_cQvp(
z|3G=7>$>_+e|-aG{O1pmHx0--!gU-w#<D5(*%?>8{y>So+C%(<U-q%{&2aw!p$IWY
zqZ91aZ<L(W*+Hti7Q(zCO3r>}r4OVB!y^P#{${!XTU$?XY77!Ytp15d9zkvaFd%?B
zv;%E?h0NC>AB5|kdNE<?T749f_Y+`xH{<9moTrPiFohRpjywwX=%b^Kc=%7^=j&!J
zViW%tTFJ9j#8W5#z^mW?{m|as@)-;ehVr1#;ur1&T)OwMX|)e;qvst->f`?n9{zrX
zTRPWQJhxtKsF}3`RN=AyF-V@!{@oJyn<YB78VcxXFEXVw66{MghT)iQ?c(#94E5Uj
z#8|y(yne33d0PRy(QxTyLGWg|(sWzH(zl!W<wc<E*;UI_S}RVCfCN3NaWRsVsI>o9
z9l<G`3n`u}EcVvSIspP{z@RMP5KI{USyeX^T93g2bNPn$oua%Ftu$CFm0})YdLLCb
z^pblX(&50&5yy4C`{!<+ipkR!dX;Vk_UttPRt?Q3G?}0?`2{3U{;1Yj7x<*&^6!KE
zpb6wImz2ov0WSj>!{TgCdUgQqF`;t{2C&Q0N(InQ)b#l4^+ukM9|^}2G|28{Eb$yR
zly|OGVXc_6V@Rye<l>Rah~r%M`x69ZjhDKD2XC#TAfbV=*H&AOLd!*|@R~k$&smdy
zR}RmhS{A=f4|02VEe>3T1X_ngExtg25BDO1-+wlnNery}@H6?p!-xiAo!E9vlZ+h$
zxI7X=K=H069u-r(AO539l6Ae0&14uJ>WFwr-MpCIcNVRrK4au`K+xe!1x%ZgruuW4
zmkgZcMZ9J2Z0btNk#!`EOAE)gA+cS?AFjxwI97?34RW4t8c$<ix{j@Tu!t6XGh99Y
z)^A>%@_DA}mq2LV56O97%ynU_uO&G}(+q6Pa}bA%*TCr{vq%zqotI3~kwbnXinX7q
zCP}c##0rl=qRGt{`+gFq%JlY2hD!5m!tM#NmBFcL@XS_DG-xA;GwXzQ#lz!8JXuv=
zzawk88zFMI+K~3{+rR^XFt3vQ2XBp0#0$<eSmSCZ4*6a*ldBI4+|mHIoSNuokW;Wo
zwE|d5Ld)+DQPxcSHy%)LHtcEG;g+&envFohz1%S^W0J<lt8>qeyc{r#fc*G<<0kV5
z;T(%&-Vj(6_Gt6Ci3!^B4`CXTB|tU6<LsT~9sz50Bf7MmG9AoCG=-`>6)?kY;F$%D
zyrmCTyo>QN@vC=dt&wp$G|8Y;R&pqtuX6P7VZKWS2mb2r_fxfyDN#YI?eptk!p3Zv
zINw!D{@mDx>(rlM=W90Ki}jpT-Sd&>FeiSsMjrS*F92n>qiJNk+}*;j7C&$Hl&Yp}
zJlZ2L*$~{O1j_49^P%rWXPH+vKU-{|q8;E*C$mPJvfBo+?<No5b>aSOe1y8lz$r~=
zZfYb{rf#a6xl<hoV02ur*#lnTN4FEcfD0a_nju$`fJp-n)H({Y&w?QsU;ALV_5AoG
z$IUAkH;0P<L@Qe46>*-;s}20Jx@}zUq=-RojPJ%ANom6z!oi+rtX7AEv(PbYbESAp
zLi&$+Q?rz4SI#{*R#Xk-fND?N^Yz|!O%)?Pg3T5LGoAgW8MQMy`E6d6Or~vLq}xWd
zD@HGQF%6bD7q_}`qj2ZV(s{#;4L{X-*zFoAFn>@jM9YDHXXDj*z^}eGQpeh_aWLi?
z)883}Ja&<o$afokSxAf3IXWJ)(Tt7gH?^IC$nI$TqrAX0!5gIokJ}TS%pG>1sw+Of
zcAbv!+=F(;2)jfc-ZcAM9`7hhbFvJzUM{yh2tA&`8_T(~UcWTOEKRjIyqeC|V?{Ah
zT&OH2FCF#WcE<3IdwQd|k$yMYnJ4>)U_ZZ+h&rgEr%p=9#tJCRs&h0bmQ9*@`M$sQ
zSZrs)>&}-!ytyPinCLDnGbVGr(dl>5F9%30)>C5zPq-42qE>Wwi~W>p>FLIU9EWsX
z%cUB4io;hB>gd#3wa@iz3QN89yP)<Qp}Q}sQeEc=AI?L%t@|tk0*=V)5UZt7{71ZQ
zFrfa|_t0@=IEI*OZj2WI+4M}mhhoJOi+Ufv4EAx`Dk;Dk6~TNoJWD`p4W4jI48j&J
zjNP=4Wk7bM<~yKGM*Hu&Y@|F1R&I3Qk~CZrev}|}H##&F)>WNW;@I7qPg$95srB$q
zl2+z=TfIx}0?&5`8T^#E(K11MQiKNy!xO1J7$>P_g4J<S(gCj-wbA4@2>+}p2zDR+
zmI<c=lCUFwNPjgI9+B}t5c7E{k5*a|8uE(&ZEsB{hyC_Z`<)X3U(2^Dx3FZteKf{*
zXAU(oyRe1a-hEw4cpwxs5(WK#bbWU`oL$%Mjp&_-PLLo$Mi-q3iRck6+UT7ih%V7Z
ziRe9|cZ29HdMDb58a<587~Q!g&wIZ2`Ofe7%O5j)c3pd|YhUYH9c~*0N}$TIE>ncN
z%vx(ME>xy0QqJ5(0mh5QiQ1f{ZoAH`A*ve|4MmZ;FEs_ws)IOqvpck@dY*2nETtKy
zyEZszW7akz)gh^M<__l=YgO>Q9jZQ0*(2EZVoh4<f|r>H<rFp0Kg-{4<4bAckn-3T
zstkIOUD35cxzu3PFi@1~?m_N)-;Yo!x!Y<h>8owzio{vfmpO2!fAQ99e7EmzwseE6
zX$Hgz;zJ+Z)@8AtVZLMGsv*o+JoSX<?GT(;iBbPzw#C<2=>nX3F_?eR>ZELvu~#oS
zgV?G}5ucQNdnN1I$?2vngXX!M(1>enunR2@XK&-%xW^au8!1OM(suXKty&XdIOCQ4
zG;3&C@yJm*z~7tYypezCICeL9Z8pW`4wY7OEB|W)2w_zdnat0r-@!8t7ZHP}v?tzK
zEda@rA(=}vI`DDBtDk>0@hy_~V6%82rI5pi{1AvSpc|brrLn545Zp-A*u_k6)k%N$
zBHb(c$&gy}h@k$JT(cB+ST@fcJ0`@%NIF!BtW`wL*Qf(U03w+%N6Hy<&Z;iLI0?#z
zggtm`DdocRjl;=+z*n@tIW#(h--mwu#zgvsG7<abj$2UlG1aZje99y@x!h#cA8)}7
zXpi^DiWIHptc~Zb{BL}{*g^Uhhrj`zGolnUT|Z|r2HfWZCoil5YZu@BI=zw3neGK8
zY@2rvRvQ@hF$+NGjq?U05-?h&x>e5X^}EK$VgCTzN9I!h=P9%^J{0EMY;Yagt+5DR
z?i453x(TG7P@ypC{^WAEIIk~5aoARdiem&;%g=pQj$gAvZ;dhZJbN*>qB{vA6cZy1
zx8IAJ`1$nIo`EN9Z|&h0t?*7>w1k*Ezu=MLl&H0No2~%0!`69_p?itL$u`$vLdC=e
zKkrpn|GWD6+1!Y3<z8)~K}Hx~>xJ-BkF>YdmgFVr>TsGC+n2w_1MX}KP1BI-4uelw
zp2gl&V3f5R<0F68K-Rhz{Y}>sEqBX+xmvSdVnJgG@oWjfVPZ;-R?L{lR`Np@qeP5_
z97RBTYp3bLJ&%$~VP+mt^<JcFntvp(2oK6+G>O{Te$XO67Y1=<)YSlD&^KFk`Bw4Y
zJh(}~*WQ`Xt!X<+Wk)zLB+1l9NpM-Zfir6<R5R<;f4JM|1&8R@zg_L4chjr)x&+A~
zFGJXUY8QiO7hDKHwO7WijCqvho)>o=m+}5J-1lNX+Zin7`#R#f%WI2{#%cieVvq3q
z99er`Pe%;{T|CvOIqRH)42|TsMjHo_{(9=<BQ9bS;{Ai-OvhiD66XA4n@pPB8pK%G
z+yY03N;L`~gE<qIwm-GCn7Vq^;hP;;&J<7;49>Ns&@^u?Hl|Vp)%Wiop5)pYD+!oX
zteF+XnUS6h2o+jm_44vO^BCd({^ib@X9mHG&8MO^MMP-DTL#8!$U5ze<6XY0lQjcF
z*!@d2asZ@{7|%!B6UD5vTRl0cdU7`Td*;j9{q3zK$w|*Zk*?%o-EGdsS7?gIGj%%1
zv%V%5GxoDE-z(iXPp_nwLUir5RmbK=d;3CM72c}~Zk%y<&hUqk!}8EHr`43i%^BwQ
z{XyzKmtw0U`HUd!#yUHsTn;TUHl90wKm1;pei#T$T7y>%hQ$_jay<ou6m}>vv3{r2
zIIfuDIdPFrCw7dE@jM%@3t!<0H@|B5osS`;ESitDOD3j}@z{^2_$Fg%eLfDSQHhaC
z^Id52i1k<HB&haqvqkvt=(QF;siE`VA;=kVRZYgu6Ku8!J$#V_#LFIVPkmJ?E-+VQ
zh}CldrJ>R@V~rC(y9lYa_0U~4a+xIG2X&duOqSB!LG(CfR-t2(r@_pN)iK<b#V>Fz
zBD7%L;Gtmp%Bex-X>HzYR&Cvu_Rw{qb1`A(#bd?ajG0&QDHGf7tKM$U<g>o)4i1}{
z&LiEQ=y&w-au+>G6#WQ3%IX9If~Y<L?$w#S+~SN<CG+{F@2zw`=X#H4Q@<bHFdpcH
zx*z)0?Wr@KDj~hf3)j7v{OB>~R%NOoCo4-vdU#U)&&w$o7|absyt8P<5oE2b_uYqu
z@>6(aLcO2~4*9_Z6*$ll^WsoiIKPQa*kX+#&-RGmOENdPPZ^ACU$be(ohq$w$3n=S
zV>l&|HVu4yAV`@#*%BXIXlFcV4nFLT5-~~Je6~!aNqNhZjf?edWZ^tp5f~FAL)>nC
zxqIIjkvPZOJkIkn4~Tzo7(l@!NPH}qh`r7_=$}KGNF3F<w-B&Tyq#%M7;62->#y6F
z_Z@~0-SH~F@q+yKb5p_Pca0_XJ}5D|mWHY_l~x1?zt=&Aypdb+`6Xh9-w}K9O5FMG
zQz2C$rfjuY-<Wz^{HL@95Ig**N_T%B0@$8i$yLsQ{G>XxV;Ws`ik|kG3#AagC6VRb
z0b3tdWq7KmDp#!g*Dboj3a*X5wGXjpaDr2fnQYDoRRas$ZF7Y_%49Y(n(BLWqxnB`
zxkv;Svv;^iiiRG*wz&_J*YZU$%XOfo^1^v#k?!S`p_R50#U>x8SZ^vArVRXNXFKEl
z<8*L<7hk$j!Ocp2iysIeHi8dn{}{s9_l?o;dbd|2MqoFWLp|EX+L)HeXG+|$U^YYQ
zLWbx{KH?)b4r;#1vK^~t=X+7-?&t3fWie6m5egf?^zU%o>9V>*m2xoq*(%We$EA6-
ztoZYNVN@SkU;os&CstyRL(f9CQs3xauacLp+~A>|I(Xg(a%9HtfyT0cZzJbb4In7A
zUm|ts8Cr3r$vQs8)g5wSo2Xp_yW$A!<{V`$IQ()rO(WMQgfol(R#E%*PRcS_1V}>y
zDU<$xLWsxqAp3@+O|ohC2gPuiT_@yLc^AuqDiO6&HrkY=qBy=6yx?T-F5x&6hDy>8
zC3~&hP`A-fqDKepP4%gn9_$CPvYRCYTDj2)>Au|V)@fGAyTl4^Pjo><kzpB)==eQd
z0xNf!<-+PbRm7mI&q9XW=nmG>HrMrJm+Wx1-Sw(iGuHiO-$Yd(lOaRi=liudY0+j%
z0?SvdcFbeXNmJ_YAC9P6ErUu`idmFBG7EH9idn3<(B_^A(rr<m2J+TyAokgrUi?&E
zaP$d3tYDKW+F7ZPodMA@eX%t3D~2IIE8sj$vCbDa&f)90?3P{|>^lYlpiG&5L+AO$
z|A)GdmK|*aW)$uo5I!WT%gGSEr|%Q*um_IXfN9yRCvk<bi|hKhjNW4-yzw9k-Eo*4
zky~s_4iUH7dN{ht2I`L}#?@&NJ6Aq@cmTSIZOK)Y4rgDlUy#BnU9#W1v91NDkJiXo
zq2f++Afr|9-C+ZJDWN=K{6=MQ%3nC^*!w$Pi8^;<b-5N_nf=7lt&;EI<1{NtN^!>U
z=`L<2_{27F3i~Fj&_2;S`|9x5&u`LPN2um~cxS=Ebv<Ue?MKhhVpF<$n848z!j4By
zFC)PubE}yTveCk~du6;chu^b1>%}d2cBiahn`u2m9;!^kg(%(h8przgM!4apDf<l+
zXLv4$bGNr5o4*fGtDn(Ih?%CVJ!3H^KprlK8>acGSu?N~IcOs|2^9-mOqh`Zhdz*q
zljdkxA)q;;aUguWd1Jn@Cp!ounn|^e;gRs*2IJXB=tiFttHp?mX?yy|1H}2%`x;c2
zsO}F)^B!@GBd5+w1X8F`LRK;FKf4mxMINjdjSEZitDIR4#2xT=f>+)-iKUID<OmkX
zPBlZ3onoQLb`0b`mT5Ug;-#ThQKzx)Om9`j)Vt=M&jvqN8_;ZA2#r(m5h7VOFCI|H
zthVF;`E?-4^*;vqhHu9fB#Qr4eg7<Xq~w#^_12g13UghsLbN(9I-L`ph(q_t6i0aB
z&@U0eBHh9}L5trHoa^+{1lB)P@!df^%ueI-mE<X!SE<wS#)Z~jH1}z`gKv-_FI2+B
zxYyEx<7Tg18oy6%ha4!!@5fKH9PadRRLPfC$>(OL@$M2edEin1JY03lOdx!+VQvok
zEX7>MO5~tuLKN}hwmPbQ!tRGiV$xvs>Q?fc?fTE$`We^1<ikHed#j`W&0_<&gH_4F
z_!m&N`fp}p7DyuegBg8c1y}fA1j$x4a`IOD21Gg^6UXh+1}DZF6c%j84=e}#Z{8uD
zzzw$W$gsJh_T4%CfB1<+e?chquYEcZK)J|2SX*RrO*67&xZt7BoKJV!M}$Ky=|4S?
z`tS!qbPF@9d5Zyb-3X+#(%j@qetzgf@il?m3?w7Wod=c)Dg&NlY`(OAy8Vm#Z?~0U
zTk-ZlYwZp5NPBrw*WuC-%t-`Upfh3Yl@4gOdvD)evN1S>1Fp!+7RPwDzZ^!s|M$zP
zbzY~X&y1JggE4N!p}gmJTJ=t_cdurba)*63py*RAXTKfNSB)smz#`z_T-^Cfv~(-J
zz3xSrPUP+Ev!*rhX+hsWR6A(4ID^7Gfl1wGw;6G3$#nq~hHI!5?XL>s_k62jx%UsD
z^D%B%Wh<C?>9lyT%E9qOa~~BUG*=wP3$hpV*gJ{~XPE6-{3vGVn@_}Bn#XwmP)wyh
z{>6Gl1-HhGnEN)KFxd}A*!M6#gg0=Lzz3h|eU7a4DPHNld}Ns0q`k(YHJZY)kHK&B
z4~Ca|8?NW9<a(2_r<aPa82}amUW|X@^`otGX7}C2C-5SJ`2G^Q!+2J*Fp~rvJ6~Ug
zc1AT`<9j~9N7pWT<M7#)Cb1^6$54IL(#abQkP_c|0nBvQSK|(~x2J21>N@Wzk)ID-
z50w=$ps+=0J-Y*Lf4%cHLm2G^c`GPfl|)tKykCbXQf5DtEd^Ce%AdG9%^TuF2CsMr
zIxGOClz$LCk}o7Z$#?zg4!`>xtE-GZ0`Znq$SrOLnq$8?f2M3}8ZlF}aTTLRj>%vn
z`~wl4phrj#G8>cMyR2n4DaSSoDJ!?%EVX5?@Cl{!57RD)2A}(TbkFk~*F2Fr2po+b
z4aSr1!_~hMGw>1;Ec)<j_&555_R&UQjZdAAxW*d0;qw?{orF?6vHly4v8n*@DtUC#
z?&&M;A)#FeRQKOF`|m8LFedp`fMr4lzcXCw)FeKYJcE?!q0AO_gs+pIOG#^JMuD95
zt?~)MQL)x+)JHJR{Ls3BvqOyc-DIj9=BB8~?ChkXV`$r(%p&_UQp>l3acHm(mDnP?
z)I)pDt2Bu3<nz@T^Nr!n0Uj|(W(S=?kb!9+&RDDn&bhE5SOtlH3)DPh18IwwRr2|;
z{!eOUY%sx~D`lg?3v)x8q1vVCNFaWm?Lf+NIvx(DV4N-`?)K(JJ5H*deZE~=C6HHi
zVZMb_cN=`3%_QECT0Wz3_O?q8?eDnh&_JW1cTx~_vDSAAWkR#f_~Y52b39?&&&+%`
zwViZS)3trTB&yI8%wO>qgZR3xr$~uAp!TRlp6|KC=OE4a;%u)vBTp*7S0vW?@LX5~
zFbQ%?LUe_y1iB3qjB6izycZbG*$$t+>_DpVSvS0W`CG2<(*uNQoQ;Ta$%3ms5}{1X
z@~EklJ;hc?E6;bnIK9La!zIlf_0VOOBW@yCGXv%`Nnw`6S_PK?*LR5HvcuD<&g`rF
zMTAXvG^&QYBdm7qtIEmxhqyUPP-IfQJMK?9F@Rnr4IB<*gOANisb!3{4b<+kfav1`
zDZA^t2!mglnQRQ!tF996t*X3gOBq<D2{W((jIP}1AH;J+;sM05NBWISS-+n5It<(T
zVkLU1yMj*imyO3+g|~wRObYnE62+VFcUn5g{+8`Jy!RPmGul*I+>^maBI;jm&h6TE
zEp<!xW&9_cN6QaAg}-oYR%m^eqyAaZ_^7lv+d#c<HgsI4J0N1EdA|t}*R8oF84RUG
z<E)aX6N$F@+M*eS;WEv)KF@NM3|CMT4dS;Z#z4SWx57K?!5VKK-m>#HmS7faW(zsH
zv!zXSg|Ku(x4bZhEm=?d*X+_&Y9$}4r)PRvM<08GkVYKyDFJ;`0pM=zs3sm4YdyP<
z%)HE9j>rksnIm(&cb0U>O^bP^{8JBYBpW&XR~rFsn%S>THFZNkRl?>a18FN!m@7l4
z6qV9iI;jFp@vK8ox^xlwyAv0=(o7wJB^PvJ*3nkpmkd>N>*Uc|+e~^i>s|c^5sei+
zyvKsiv-)J>`Pu87A{%S@>RI_y-@|>sH8b!w4=HNn{2*vGaZn5hNd9EWz>L457B)AX
zq*y6cmm7Vmn1WGnu1}y%b*V_Nl%GiJtx#0KOC0+)&$zVswK?0nRn{$U?#O}DE6}N-
zC3j2~d<L3Q9S4HmN*24eWFD>QcdR~qA$kr?%>uku>n~4jzKX8DIF2#+LOd)hQsM1v
zwnK$En&ED8|FBO;b&2s+>WrS=LAq>;;l(LC@%TndNLA(jroH9RZ~*=w{?%pTY+<Rj
zclJ?bppZG6!3;4C?{Q?PyeXYFxg>_7Cut_-i4W_J_@%I3I))(czMZ&<nH1okTLS;9
zl!!ATh*nI9hPL&khs)Nht53#ei*Uc-0LsZ&E&3jT{T`d#LaIMjOsOf@4MF{$j=u8I
zSK$@ivATou9okA6t5@DVpMwNW-OUAkb?KoC&rPb&-I%)+4ZU`%ffy_&U$GYsm=@*8
zh+=xkcBqg~uJKkb&b^nhNgf-6Ab+|^xDyqWrjdw|{azfk6z#0CqrV`uZmglP=w&(?
zD6uf(GREu1e0V9w+fsKFJWnS^X|-k`kpfOA7<v$1ba^1@$g~^Y!;&zkD-uRjOnQzP
zZ%sSj*8X@|?d<Jdd~{m(*;Q-9qGDi9>f*4YVld)S<NA9ZGP0F#B81<Z845Cdpn9ha
z`Z`~TJ2qMHk19u+<RO`}!3>_=9gm%&B>0USN=N8~al!*L6a6n?GZf24xy1sLcm1Rr
zz;|NMGO~j{3EEcA?`PrnV8KC-E7IOu)XKJZcSdwDKZdB?KW0TecgG<X-vaAWk>8K-
z$qom7!>o`@=u>z=5Fh(Se`ZNa@efQ|$_$8@Le}L-gDZ0>=%JWJpJoq?hzlW}1aN9W
z9ElPixTkR(4p03~SGkIRHxpY|X_k}*)9@tyYNOfYae2jixTzGzF&E&Hi@ODuBoxEQ
z>vMy-xRK?zC}Ebn_j(5!-r@4umQDKfn;E`s)#kOF04W<GdTn4~E`+ZAb6Qe;Eie%G
zBTHo%(nw*=d60z|%@%dk=vpne@O1`jCos4lwsLJwBL9q*&6%ewH`F;{p@y{eixuMA
zKj!Qv4VRvJT2NSUF;kj6xNj&5wstW<?Q4^fXe8G~>S_67NP;REDKl-hhgngv-GP-W
zfyP;;9SkTLmj{wcr#v&3<8@<wCB&_~qI;k*bQxwxkrOH%^Lf93da)?%mkIfuRrSDY
zrGBxwF9TPaZ<Dd54F}x$Dt+u@GJH3Xl*#MsgtWxqOKFwk9h;0u?ez;6A=%>4=z0O&
z{NlPEbxZsSSSWt3J5>3{<XM3{Ut2=jVZnqUJ($OT`t3r6*;%2*G*YR6*nKxEtwFF@
zbw?(u$%LgUZm;7vgzm(mWl(AQPQ^j8GE{%`EJXl>H6DTP8~E4vCop^BRO!?FQ8X({
zcQKQxitA@<EF*fx=OC}1$?%$KnRjvRzb_y2V@M}Ca;`EJS<|EQM}NZ3%jW)Cw|&OS
zZ23WX;Dm;jjfMO;_eE${Sf;^HwjNkTJzV~&^s9z}{-@_kwnV@0523*jGBa6$YiHU?
z-2$;cA6^=B9ta&AY##7yF43_L9V$V=Cui#n{Ind(>9q=5{jeO-eAW2oAH$9K?iEJ^
z^;17JCV$%py7+v03>hF_ORsQg2m|7iujQYl*u7?id1gFZl{lIbokVIzBEMIp%}y6K
zaj${0HACIxSs!zVDB+LGU2BmIMMpLA*^B`PIB$Oc^SBP6f!sRUU5{Uix9|fqYA-@N
z6&!p&{lWx8^j||C_B+ct_cNvWf_nJyK&8CQpL#&$`-^TdT&(-wRb=>BQH0>*{|iGU
z9#@-r?CK}e&6W#ucdy6rRyoKwj9Y%bC1OuO*#_2gkaHm(9?t5DnkJ9Z4kS8DD~blg
z!fKr?iMad-V~6z`dR%JkiOa_Y4~AigP_fnMqf5Sieqx#H;^8Tg3=z3P+Y~*JLiM26
zH+{rBW%Ah;CJX3?KfX!Lx>-h0s{pn)r0al>FMjJ*`5F`9OS2jG&TuAW#j)@)Gu^w>
zJu(Ud&R_eep%P|6Cz+rN%#J8(#{NKeJ}vypY$m0v%Y&!;mH0IWzu|LZUD9KrlfhhP
zsl1i5*;kaUPs|vStY;uWePVYGs|1QZ$imNOaOvpH>_7#LM}B6k+u?QI_)w>mcCk^2
z-4~U}M$a&VyVo=Jm8^!@z09knx<E?O=DKh0EC-==7%>=oM1pJuu-AUPH@<sj;fa8I
zH&=)b4pb?p_LP{~Ic<t>rcH`WbhmKxP6#G!yOv*C$-~ylLBLJ%T}t;jf1!jalizn9
z5=7Bu&(tnv*Ayr3j>!DG=yb)O2cAMg*)*SW-egnPTd;aDXtEOyhUj<Gk&w>^QG^Rm
zc8KelSolR?I4Z~SHq_IH9jwfYN${;3Pw{gPGy7>!wie6J&^RohYb*Xry0_xKb}4Dr
zc;?>su-ZSO${Ez1o$6@fYv@aiSaps$yP?^r1AimH@Q;)b35dqYAN7vh6gC_kT6`!R
zW_YplBRt{CZRVYy)xK_}kDwMC4<SnMospDF7u3Bp+ySR|V3T%t@_dLobVY~HBw8;0
zliWlw=PmBXSjOHO>HQRELm9eq(I;Mu@(Q|muOHY1-^TEAAlq;eP(OIgMZJ5Oybjo<
zAFNN^Hc>7f7<IO+FiR3$5+XN?Wc+wwxhf(H7MuOuVzxT5X<gb8<LTXr3VS4q7_|K<
zCzHcyg(wtswOFbFF?7!oi#|7Jbsyz)MF-ZdSl@-0HGp~3g&X=p&JfE3q}uAd0*6W5
zAvQ|*7yt?-Qf^{Jzv0z>H}TKRKKj1x5h2<sp1y;>tvoZi>xJ93_IKY=uS^Ecq@uAB
za;aBZ`yrAv+9&Ta5nACmVLeQ^c5Eg2oPv~DVKZpHCw`yMoeMlfjb*QMGIT3FSTi8u
z=kpK1ngLnVIx<!Y@5NTdxP`0Jez-$5habgQy&X9F`NBT3fY-v_IsR)=O1h3@8Bb>-
zAI0h0pnWmez*q+_twZS%{IK~XEq+)1cI(9zV!E!l@wI+LV|DDd>ENaUQyqMFZGJuX
zNj*$()8o=;DMI`~aukLM^V;Axs;<rr67w+JW@E7NY&H-uZ}g;cQ(@^JR|)Y=Ih$IU
zH(mQ?MShc4IAOtebNKe^wyQ;(B|%a*7?tB_zw`YTIzP(IiweKbLM~y!G9k4@FvT~V
zKSpjPDs7#50v#o!a;*qq>bQ>JTO*2S=6boaDttd;{O_vwofS&@%w7kZ>-V@~*)7mM
z4N`kDomAk;pbhU&krcADI%=}Hbmv?6PWS1-VFG9zG$W_ITG&HvW_W2KhAcVrGU?B|
zQcD3a32`!c@D@mhz2<Yc+zdN@i`co#ZQd{TUC=6Pwz$QMS-eg^-TXyUfPwapuBd8P
z)WhmP2;OjGoed>=qS{V^UgKrQ`N#3I9*!=`hgp&t{6--5@yc89#$^C9Y)b1`8{Te=
zqO8)PHS?~d`_}!=ptus~$+BwdkJCF;8>J3a-V=x*nnQ;YS`0AAt$l8@)TJuM$0&y6
zQ!Wq=)a89_$35V4wtu^$`Mkkqh;XAom#N+>Jif&-9m@26cvUSuNdRwvf;=aD+QQ7t
z8A2XDSSKykDf7JD!)0qam$pEQmfczCWm#!z)AJ@vD?*lSwq-jq&^Kv#J(lt=BYOLB
zgwif?RU<<oksSsiD-@(8wX*&rh6Ip37`oMPc%a_`4k3<1<@);A;#TThaE+noWr>65
z3`DGUY!APMe@@rEw8iJ$VjE@v7(-g3^AIPnE;d%?^8b{!Dg?0JSpRnhsZ_iB&whhR
z_tSpE<|#)i)iF>7E4yc#?7oxD(-}XnKEBFq%4drcivjgagYK$-(Ubp4sRgS1iprWj
znibHt3X4jYx=27VSPJ)Q4Oo-m{%Cj4c`<Ge->0>HFQS3E=R!iZ6CRfTpB5Sw(86i3
z06&&zc=Eirm$W9oc->jI1T*XJWauRC|N6_!`XiP$D|&N^tKJ)bY|{@l)H3u&2Hbp+
z{0m8aF^<x4?&s63(YFz3{~NKA!vE_xKEA2sF-YYJ01y5%t*=`jVU`z_)>}U(yxAtP
ze^IIblFa+E*!T+*(o@=ewkga21wR5{gZWkeM#QAr>&`Zdx*Nz^;?bwVU*81p?EmkF
z{7-u`E_&x5bwaA8#a`E|1o!fGNEC&gd%Jyn9Mu2#fZRGtos$n}<ry_cD~=Snn1a`O
z>D<}*m?8-pu>a&S1N@&>tAj7~?Y;8@zV{m(R}g*ky{+A;3bo;87~j9k0}^K+XC6Q9
z<Za*Q(LOe*9u&V4&W}VcX<JnS)f^_jcuE`xoVTgLDG1g+ycrFY9B<KTV_N`xTMNe3
zWsbz#-v(E+B9P=6qKd4D3J=fG8CuP!TDRc961&#_xZ0bFy6Sf(h$BY6uci$W?LS?*
z4Hvjoer8z-<d!VfEq2D6B(MJqbp)nJ9p1GEMs>6y3{Yp?2ItdouGgdnsQLvCFfnbO
zeG8WguM2Dtn(-K|U}p4!SY?Xj1E9&+?TV#Mzl@GXK=j{<+`v`{qO`@x@x}W)lI(#-
z^$tUXW12j-P5Xysh|x3y?0W@t?h<#p1@5y)Wsm9mz(c(>I~H`iVlYROxccEjRtEI?
zyY(P(KZ*Srg^aJz=cq)-a$3uT0UPpaHq5EWP-&2-Jd>^ug2{*8LKQ@BSrFBb*Zl&s
zIl{=vQDs6KJzK)ECvHh)2KUk<KRYyB==aqpL6+U%nxw54XD+MC`%c48B@U(Lx_0Vp
zpJe=IKXo}p$ZmGC&O_*LlpX)C;@=c0$cD!bqdkkR{SImKvbuOKj#13rIMDc5Pt1ME
zzeDQu(wMr;A$E)ac2F5jHr!K8n|Gml{DviBfiKH}RG2W<=ynL7x{vy}E+linTt~=R
zO^$M1%F94A12|80!0K!KwHEyzhsXb0REu~KpGQ=}b=T5Hn7aw*=;Q&{ddx%JI@g3%
zS}vKminut3{1vUqJW!4mq5P}9m$y{4ZiQ~eAo0!WkAM#&9*b-FUP<#$k8n$rSK>X>
zR$WXgACdHk^wLTYfn0`{>*uf<<>%&09vPV^(K>_a*4H9aP7z}}@<9~c1Kg@?CT4_h
zO*}1!YMeRGm444#n1XD>gK4ohj5#@T#IeI=x^7CP0}nnv&q(xW>3_;Ny4meOn_xfO
zZ!z}Ynecw};0v5+uEk`8CX3Nid9YMhI%#$b0XeBk-iq`SnufKtSt^c0)@9JG9R0N3
zJw~}Y)seWp^tr3C;KXMuC(RRnMy&F((FsdJhqC=Mugy{dn0&}@F+v+spEQbGl(Gz3
zEd7Cbl(-LnHl*Z!x76sK<ZJeW#5lbKV-jlF(cf&7x-U-U-k)0knkb_{N<@r%GK4_x
zah}-alu(*&m*5^%lvcg<d@qtDFa_1f1MVd6=FNL$(CV*jKAn7RG8stnGfL$BxABK|
zT<}_V(+CBf_M-5FXkp3>856T#bEw+JNb;_Pewzgj8x1tuog9JvF3mfZ&Tg0N+(HrP
zr^8Jb3cNXzij6*N_;F)Wmx|2rKeyYzx06X%8#_~k0ezO|W1ZDXpN?`K!F9Rf5&x&%
ze1)b49*-DVI?KP}LX#85xj%Im5(~iiZSOT_{vcGn_Vq+zaOr4For2V@#@^e__lAmY
zSwzJ6s~E&P;vFiEoA#~B1iNz-Ee+@nCnja{t|fI)W$Z4I8~JsqR$WV3-d3<pdp3Th
zuwQ0%<~sIv<~~3FTa3{v{SfA<3#-mYnH1=QI3a6|^9j@5Zrcqg;qz1x4HxAJROO_>
zT+QbAX=Tw+UEcBTPLoFa*HieINBgUvjss4o=_XC3Ek_U}LfyWmubYt^ir<<%eM%kD
znOQO2*7D<(<n=3m`x3*W!%3I)f>jKY(_GiI(V9h3+rrc27uU1u>z2cn^8?H3zU<Ir
zsRG?nEswntRKSEG{LV-5MGxjPV&WrsB61?~)H~Bb3;7E7tow)ac&N{SIPCGP?lS@`
z>`n1vQ6GmD`FJ$#ab$Cr{%(Kdq0}|K{qgOJrmkbpA!Gw&aQCt9$i&Fxay#-$i_Qfa
z^sf4BLwM6{2v#PK!Trtar<#huGOE_@w1SEt{m3N|{v&t4d8T>>mf9~c?3uy;ef8du
zIOvg?-@1`eZ4DvuGg1^nRtxK|1sDR8&reoc^{OAu`nubf8iwMxDhhNvTVZe?mcima
zo9J6rmjzuu)QQw#eAzeIIvMs;1^Ut!EwRW*gRpLOOjNx^@Ec31sK;IrO|&l0x~+SN
zO%PtJ?fD8#GUv{TNSAvFvC^cY9yx-vn^JpIU*9k}5{b!xG&}cJBi~8)zW*$(*5iAk
z%UAUlt$N|>ImDT8Xzt!F*H2g~HrF<fmcx?rfbg#~z3fwZi=trbFcCbumTTMf0G|w_
zNu$mKJr;A{Q7ou*hv#Iq*N$C30`<x|T~PNoocyCWe85@RJ9jNSL%(~hLQesCo+Fmw
z34B`d<N&Xv3fJEI35_oCc)RaP?Kcr^5MYd!Yoc6Q?QkY>#<qk1^Hf__J}@wuNFQR0
zQJ!yrS(q0hk)Wo2GMsm(#!jc@Y(z6Baalur?_?=RtQ-^SA!9Xtx^XnzSW+YXjB{I>
z`kR;RJ)7SuESt#`E?yBK9^drYWcpp0cj}8!L_BZ{{J5jDVmZC#rO2O?pBO|8)X99r
zo%)5vh${$MkLI5@B_b|UwWn<g@|yC*moM#JZ^BWH&(B34_3rMmZxX-U?Al#UUrnT8
z7U6c8tI<yI-QK<G(|0IsVZIolyq+-0m~k0h9A3C;38<*D_npffUO29=gfwlt<Xz35
z`|c)iuG>FYO10G830?BJ#_mFvS?et%cU{Mo?t3(8>9oI`CWRyGQg5c~xPcd(F27X#
zfOAOt;CdEAjA>SwopM5M$o0oJm5$vOl3D2GLF=&W)0gDm2${aFlRF_(5v;S-5@I^9
z+Ux9^=_pj=Pftvq*rI7ey_6^PKCH&VD=WI|Xy2t?SHHQhB=cOJ6Km0~<X#fn^94iQ
zD4wQZ#op!V>Byh1uf9wk7nj{Nrq|DU^lAgojrhAqhoFBzMzDN8FQDMmq=o$YL5c6e
zlG<hR+bqio7SzhO`~E3CgG=*U6CX+;<5C5+3_hEv{K_@obBcud<7tG(FA5D)?&H7|
z-(4<diEu#_SE+$Q8~xOvRR-nd>#x`uX8l(k6FDW_y0e!r4gTxQ0IFir14>PHJ(*HZ
zg&2C)kqj>+WI_sBo}+ME^$v~d7(UMIa$;~db?cS2DC?M-#FkL%>Sv!L-gzrCX4DC+
zoKNu^jIAz5;W`TN!#UxE-u8v};Cva*LVJ&|MT}2?;)n5A<eRnNUVguRs1|YN*u-ax
zB!_?5R`1SyKL2Sx^s#*gz!_CR)cRR(cVfNtUOX1l*|1qR!W*N!s%1Hdu=Pckh5R5~
zi|5!S5wPv`?!Pb8vZn9h09kN4E+ltr-dcqyko(oeLv)X|Fw-8M@cS!YTDY`~R;BvW
z8||XyQZ685|2^QX6c61fbX{UUsS_cF-)OI2VK~j|(a5g@DX)NB>{sUg-m@ejtG8z2
z2{rDMid%&C(;2RC8#xjV9_ZzN?8N%Xj}|?Av&xb>M*u=r&qDM;R2j{oS8rBn@CMrC
z0l2W{^wLiYv<=9g+VVX=aqj`OG2z2H={9Q?WjPZ`)B(T6+iayniiVbhq!bTC?WX|6
zYyTMY4v!$*R;-~Y1qbi#ycjG)kJIsZctH2{S^u&}S+zLg+h%Pwvg(X4xPIJ!ICqsV
z>o_y!*Woh&3!2=_aoBXjbYy3r(W83N?=;33^1TZ~pgTw+x=9)H(Od|Gth9?J$4ciJ
z0|vK7LNx=$nc;E*XBiJ|71DjensjEz(nWpLfCIk1Nu6sjwgN6^h>c}67s5HRe#jAC
zSA-&iU7|_darWCla1RSLCCH5e18zj+`SlFuMBKV8?|PR}va=#fr47|08AyP0$HO6|
zrXtrnQct|2e%j*8rrLTb%4llA(Q1A;f7n&Vl-!RV|EK2ckz^Sa>&2){dCY?2g{YX1
z1p*#dxc*H_GLJTXIDo;+l?(OInb~6=R=5h*!NTAs#A&@bvmeGhSqn&tY{eMhUpDYw
zt<=}Im0<_IR=z5tdE00Frp;r<kcF7mPc~3fP;I7s5SJ|Ed%BUif1F3eY*f9bL-ntb
z>g@_w0<L}&^LC#=h*KhWWv1}&4D3?p5v0zscz4!NhJD9r8TR37EFn|1d)@7(gcsm|
zCovTC`9w%vwx^p*q-R|99iBCI9S0Lsqq0dW=Y(NzuY}OKg~Xrp%5Y!0Nkhf#hbF8<
zwdx~L4>sN2jqQ8#Z12|c?^<*o=y0NHepX%#g^Oz0b~looG#~C>$tKF4<n#sV8Xg`l
z`1DI&OICT?<DN6(Z0xEj&9Ggj7mzv*&6F0LdCtSU;*Ss-(D53s-}i2&<YfLPKj3!i
zyp;J6*XkI?Ky_p_RqBG=ZraKjv(ZqD$q=TgV3#R{-$cZAhrsxWeHNIJDpCB&%U-#t
zp)~8t`-!B6+nN_t!^CjfxO~5U@EIeyu^>MJPAq=%M&NTp?a+SyVK+f0I_!uT7{IzL
zrJ`$t*joyTn`()h4}x{>w~Rg^P6jUR@Xu5I93#%ojwcwU#={YxxI#t^)$jOcYKpFj
zKcH@*J(6t9w?UZWJoS|hLwG-{_5UO{U}NWEKz=MdTX904uy(mcb52IHUgG1RM%s(P
zz5ia}%8adlPhl7LSn^6GXO{}~bj>B-xXz8wSFr5C+N`Bnx4@`Hy1Is&J}F~1nI9TE
zFZvD62*v9Oy4|!WL+EYVut6Nqw14+^ORh<=g)%4o<Oovs$s;z}yn(x%*3BhG7~DS=
za;>?;5oToYFY4qUzZ;cZ`!+pGnU0)a&Nij1DZIA+V25ZY*9iCCc)eLU(9J+@Y-2eI
zs+knH7Yl9DMTz((gT;$Oey1x-L^L=@x(IbbsczRix;$AELkX3tE!aMdDsuC_dNhNW
z?n2HZ(_g9E3zgGhpiLR4vDVEaGBTZ>&P|YyyN?~Z=|MVoYqNJPWI2ydMiF04f5JP^
zrpldtI^*!|-wjG4*KZ;4+;*ovuj;+(Z$NkPo-&1h6Sg+!km4k4(~TU)MWgbwlKR75
zf#M?J7hcglQ57M(M(E-G1VRH?PV$1aeR8iRzRc`g>+S26;T`A`PC2*HJM{;>Ym#n!
zFzfs<^vXHHXTL5IbNWo9-B*65dbl2)XX=ga*kl3C7lm{eJA*RXX;{%J2dN8HNT;8)
zo#gYA^u!rE*~SHH(dzZ-$n_-&;+S|BpbP1vC`a#8a8ReuMsLt8@c2Cq<7pi>AOR<6
zuDM|d?2+N14AU@xrLr{kW;HA*RkUNEVF1)b90jzlCzGmDfS*~;TAQ&{rC_Hzg<o1f
zPbHc_1Lo1C+qe0d0FFeXwz5-)7D%Hl3W4+ez<meJZ&-lk3n+Xo^`pS(!}uo!M|7i%
zbtv73R3G;ga(@~24H+6t+yx8`n%4yfJZZ@gl4j>K05Et-%0H{Tyek7A?uiE56eX&D
zvhgdX0r!8kxj`=JCLZq)`dxmZyH}u0R$tMz6yN)$t(N29qERz;=_rK{+Wmuq$?JpG
zkzn8x9bwJbxxvBw+N(Q@2~TjkTy9Gll~JQ<fcQ(;5P{)C(*F34QB^i#5%Q}idFbWl
z*H~(CLDddwO}^uvBRmF>k6Zea2+0L<#T_CbQGC;lxdr266i^IQ5VYWYck=w#X!m3T
zIR`_`5XLZ}mwJHaoehu1SoOxPb$tDT7Rk5(#G}v?EFlU%0p`g}Y$L*M&ymP{a^!1|
z_h^9MS7xBUPAveO_&TxwnfNciU!Cx>-SOv6h=dh$l^5Wjllbsz^Z932yQ<$uWfgHj
zYRrz~@xmbvrI{GWl&WNH0@TrH*i?qxHC02pkhddRB8h@bdBv)D2;S`mW{EGLdFtUq
zFQ=n5JCVhSZ*V3Cyh{I>4CO$`fuTT))<i{WazHcqqwIX;N#qJLtm0mqRQ)yIx+m%f
z;lIzxs0`<=jk#aFJoMKHHyM+8EN&We4beI7P95Xe$sJ|`#t<W0y>VaxhPWusn_CdQ
zJeB6z&94>x>(_`|3ypbdc?CL+cgw(2V|(-|_rV>{$8l!}&CK}uA_d~)wGLyd98~<M
zrx<2D#NquizP|j7xdP|5V@`UJ=y4v`#X9XiVe1iXZ~UsbCG9!m5keu*RbQeM%<X8!
zX?3zpU8H2vw*N2pid{q;h<U|riY2+}`17MYq4QLAaW}HF(9S)=qnHwAc;@_mkGS>d
z5*DakSfkrrA-Vb3`#x^#G>^;rL+3U~IEbtDaDc<1X1z$hK0a?VA|U_ZeLT6~Vf-^9
zbp3dB7Q@dJ9`1KjKv32K3u;Xz)0C&FL=Yrf&7i<VDjvR&`UYFMn!)1z9)1HlDZQVI
zNu+4imI|8@y*Y&+vSW!ma*aFuK)A_*{^snE_^tMEFTw@pB=IXh3En!_UQcK{Y+>~X
zfEEn@Png9n!Uw1yzS>~=gjciKWn<e^w?;QpfbaIp6h9K3M-R9|Q7S(Xa%sg{+<p&D
zd$_`OmJX@`dwkC{CCZkk$>&r^`Q4ZW>N-zI?`W{>sw`p4_ZLcHhS2PEj^f-w@^r~l
zGu5lN*{$WuUo<K&7XZ}50Zz695}zEx?~fW!;cbU*AqjX)+SC8NwnGH1_b94+=H>3g
z-m-tUB5tL@MU0?a&cv()`aMY~>^HjQA?3{8&N%JM^KbT>onL|e^888CWw05ETnQSG
zi-do@3#8PF1sclBln?KmmF!*6cXMGu1E5y_8o4f@31?7mXB6Zr>$S$|P`d?fCwTw3
z5U^FATBkb1Z9PgE!D5^-&eyNnHEceuoD=nGgETd6@SSTlU0-_ohSJ;u6sgh6ar;e9
z;_ltjr8-k32G8_px+n0<c@QTb)bCb(TMZ~8&pt0k<5d^N!>86@PTsJJL2rRRKylYm
zv!d9LKEdHGW#_t!fSqr0B&xLrn@T7XQ?+StM;-JU%^kRfZJ7mdfkft8Q1aOIy?(Y^
zv{YxGNNlJ6&R3N<=s~qrVnSakG;C~$7-V4!p6&Tm<i+5nt+aTYWD#E`$O4*<v#Gt?
zg{Rf8jo(bQCYKL)#<>8wk@{u*>Dn|s_meP+`=1G32N8mO2iGSIuzeCn;v*Xfoy;W0
z{T?Lz-_}GAEs^2%ps;}nmf#tQFYj-wu+A^NTXy%K3Zf-8r`um&3z$eEmw)HZX0Wdv
zi*~spw>6mO{SB^>g-4u-{KM$Mn&LLd6K<gOHZzdo#~f%_N-`jP#Pq+{pTbZ6q2B{h
zgRw~M44oqbqZgWJ+CQh_o12qOd|%_D*j~)Q2*qy~c{XCJAuMsuRU><%i`)OS8_NXH
zRvNWIs6jH*&a=iodTd>T?~~-uc2EZEXWqMdQ&B2&M|jtJA4vvKvl!r8h@6xLc-*Em
z&V&@)PnUFdc8P`FP=%`9++cv;gC~HXTzi0_e1BoX!VZO>H)@|Nbn-k&_gdrNrit}G
zO<--`WWTl+)4G6G3JXXiy9G7j9on;rMVmUHho~_6k$%7(5&&cj_|X59?MyUU#``<h
zet<1O7rjr!LqI_QoQ1^QKlkci3jmmp*Zvuk)OS+9h^c#RW#Ik<-Js_<YtH|3X#jrI
z`~_fF2mn>+Ehr24zs+s5sSz1QvJahU|FaJPXxBa5mU%BLp^IS~1{}$HB=jU_uIbIp
zrOKn&_Tei|uf5O=hV#>}DGa*Wa*q^lhVc??kGFS^0|9VW-t2^1>ok5$|J;1Q0Lj80
zqO9!9;N5C-yAcg9U5rtZ3Y8rAJ$4fGa?-@NCvj##{OL$=05sJG2>J)p0k~Pb+RCQa
zcL{gBj*{*ZN=ROJeq4-^^uBlTgAWxnC!<Ah`?Qu*koRd!Q_r8>=m&6`xZ|{dc!L}-
zI73umAFBQ_k$}0M$_a7^;%kwKif8cX^|KkAS8t*<Ep0*#xBIKiNsMUU3w{y%{k0y>
zaf-#x72*5?Kq`{d&x{?isHKTE#nxiLpmHLR@~2V$|1_GLx?3LX^avswq|IS3%;b_a
zK#5AFYu-Dwh$>MTBE9o%JLb_8B?Bs2T-<TG6mORbxSNO5%KJHQkK-d?+sRc%<8UJ2
z`L8yYHAP?32se=8o}Is1-lpz7&)cl=sfq=WydRL&#BS&wVaxp4sRI%J9s#*efz$FO
zqeyi#+x59h+KhyI=T-UJwRBZ4(@c^NXuv@jz=`3G-vUO`5^gg#ZL6XNf=Pg_>l1Ep
zgIWD^6L*!&wUAn^SZ2^%dRreJn_gW_d`lTNns=Ka<P`eG<JAt)xvGKK;%B%wyA{8G
zMr8Kb)<2w1LQVK+TyVYGcePkl<IhIEx#*czc`j%K0owDC;7aNbj-_Z+)tBIAhjQYy
znj<a|$b?-6E@zopziAIoM|D~z`IB!W7+V#z?IoyTdYfO-?UXxWd$3m#+!bKG9u-@9
zOYZu^%$5p!R2<`F5Va5K-yzxJxD&R3@iMF6(c)I%&4wA(<FmX0z)YS2g1Wm4><(ge
z1uoBNd<uXqleCxby1!3K$wU#f`5X;2Ev8{ZbbnJ+o9`AV(CDo!SM)F#s$3mK-;a=;
zV@##BZ`qAds6O3{+I6`((^AqU+OV%;l9JaoDMAjyjb{CXO!vL54Ba(qJ&?&eg&H=9
z{sahQf1?i*y*&1S4!oyYStX7ZZU1!ZPoDxwD8Iy>3q7bf5j=kN@=@8zEvR+I=OH1D
z(5b6(A(I@Y<6gI!_l^Ye=;alz%Q~Stk9yC$mFxoe7ZdPWUoH3ciBFWH6ou#}qoQW1
z=igq7-f4sI0iqipycZpRfG!7>DmU*5b1hBtz_0@m-0%mHR+)}xaq;V>+#2hNX{?Nj
zP!>ReX?Ia;8sMaqVH{G%>8iu>s|H<hRh&{lc0Tc_<Cm9O#oGXJv1lXt{sWr2t9p}}
z_toASYXPEw`V0<N&K<`Xjh)?^=AoCMF#Of=+01jYs~+zi8ibk*K|J$jgS~CbjPGpq
zb}}r&;F@OvDBjMmksCONI~J!1w~A#GwhRD@aUWeZ?*z$;?JX;R9kJQX$_q?$xSlcj
zo<QxF)@bajEi%S&!F&q?&v>;juA7p>GMU)n<jleuRMyvNu)ljT`f<ysJCBQ!(7H6k
zi2cb4vUAP>r{%O=zyKwzLRTl*n0sz<N^|x`@IPC-3XCKCV3nBc8az~e{GAF$k$BHm
zTFm`b_>50SDlSr~2%M9<&g{^%LA2V2a2Y1tt)w|~((($<V1tC`?6#*`TuyXA-%OJD
zOKZ%jEzmDdWf_dY8W}Uyv<Rav#|`t=_VB_{S$R#qb0M@E=;c(P-7f_OI1eCckU0v@
z*do+*cc6Qdz5A~y%0Bpx=h)}gehNQ&-=Q@5n=9=L5H@*^=xSJKdZRz>(Z8^6o>4mU
zu8HqNL{qcO?!c;F);}3xVL2LP$P1=I4Aq3^z!SE9#070VXjz=^YTNsfMO69H!J__u
z4;T9I<kR<$^R)82@;O2$w@8KftuH;k+=CZ<plzy&+l(^{(s-#<>*-klKMKE`@Z{C#
zgyO&{j(_Dd&t|3-+=ekwl)KO)GdG_uEW~TFRo72=2FG<m9Uf;GC8BpHOuTqHC&;y1
zgTRVUnQk^}hb#b!5X#x3e%Sj2F5o<3O=$Ecq>vgK9CmR3@*Hhya%KppX4_Y{)(kOG
zHw97&=13TQkobr1SHDURBKgk1lF9d|l_MUW)PvDno4?8qQRUviVN+mc)-!6qInVs2
z5nA6anSWWUK@dyk?l@j8Ha~648YVX%ZGUi|<Ofp>7f^|5B|?!u!G+k+j@SA=!R=e8
zPquUVLl2pc4ZR;#uYrVrvo$R1HbO7YN0phoU+W2#&yI)Lwv{<zLfL!{(m_Aq3HRM@
zJmG~&LRx1Sqn5sRgxkqCZpNuX4gNJnBDBO{qxLc|WUa9H8BLjvQ_1RS6~PO{n2X(7
z*2DO;mi%2D%tfRU<pYXngxJh~WYl;&#`KSOERlFBEfTr3C3;)y+9$5jollS|_<zYi
z{eDzlFmdgk*z!x0>7@)ub&A*wY{SK3QephyjE9KaZ{y)5>hb2K^IYrDg_51-BD@y8
zd^zaGXY@;T8nSY!(yKEQ?Noc@0G@=Zox=O8{Wg>2eya`O%pMN(GhfhX0Ot1XtEZH{
zq*r@A_>1$5^tg;3n|0v-5RWEhER8HGGBr#nAH$8Ie(pT@D;>lU!_%n!HohzA{ctca
z9WF8$IB1)a>xQX3d<(;bI_4z(VlA=*t8^5{f4N$zZ@}H`6<o<~exwDgZJth2{JaJI
zc564I$ll^CSFnH226X>=9sw-3Fr2z5{CYpF4?Dc``&_Q~W>pit+)F6G&L`bUC(tkp
zr*(4I)57%KegD#L3qE4DI}%js&4)%dr)@&SfisNmycegCtKPbFFhZB3@f&<|W5DhX
z3ix}n0syzG8k#msZvG-ZV%o+u<R$n-Qn~i@08kvXGsACv&2#=r;oXh#@&z#`{)Djo
z<RI5s0iJZAm@SC7)tVISYz+fiA}eCA=nEPZ6V)e{TcBUWH~D4l%-!6K+Q*FE&)X42
zo7&FMH*dgu;uL65crh1=(LFRw{FW#HJHuz5`a{Wr7NZp)nDx&kPOy^%dUsPv?-lQU
z4SpQ{I(R#Xb&w?FVYm|^7%Zd|f2Ja6>*MJcVm=04rQ+?W1<oKTTdOFoi1oEwXxiCe
zOpZy^db7lL0Tv(yh9v+W=6is+@vF8#bfRSD<TxrLVrxIA@7nXQee&=v(mP7j(_g=;
zl6Mra#rn@#ndJk6d>9`Fb(5C*T!oiBCt=suCyD8+_@5=Bw1t<}^6h@AXqCajv_*oo
z#+5YhZlM{<&#c#5%>8UD$n9YT)R}Z4=BGyJ+%ApPZ(uAqt*Kz`OA4_+i|Gf11GZf>
z<9d?AsbF_?u%I(7=cI@;x65CQCjJnOdFN&SA!m(atja)WlSMrXajQA!Ef(OvPKfT^
ztYD=z!Z16ZN8cJHY@s>?K~f%3yyB+THc?s~PzPRbT92s0AS!|ebR*(%Jt3Wkeu&T<
zrbHWkK^GW*>O&-|jBRW2)hM9oTU<b2BNkM8)8$=tj<rjC<4xCGd+TS^K1$L6=wK>R
zp;4htg$vy5wg*{wH?Cp&W2fuSF4rr0l7~bsN14R>vd6b7b?Wj&4glMrC)^;82)agp
zC$JKe_aOHv@f%YT)^-w#+Qjc_gW8(JFc6SXRc|Uh%0xa{7N}+-38dPJ7)R{JT-D2c
zNGTRJnK}5zwN2%{25{IQejghyj2V=n=B;JNYYcX)Au(%?ZdKQAoqK5769)!}CSYco
zN052b)g0_Ky^oUopI)nyVw8W}@!*`joElp+J0}YCg~b5`p?@YloI+IPA_a^&bTFaS
zcD?hjDSel*4Hgq@e#_{>260*aiyT4MKL|Rf9uJ|O_=>a60G#OY)mng8zR5bCX`eB-
z-l#uarL->6W7P9r?_JqJHVT~cH}9R}k^RW=Ku=5QO1HRaO_ok2O?84Gg@-Fi<oiu6
zv4v_X`Y@{WxU*qo6(qz8z5MfP)9>S&x!dj7(65H;`p?p)=Ub8pTf0bol+^wV;(0WB
z`Ix<jrM$_vi_>CVMkc`D0le1Mlghnp-n6l|mldOz?@BbAnaVJp5e1&~mL+tP`4N(T
zNUIV5k=pJ4H<bKiRC{v5Naouer`DDZ+?9kEZThI^#X#uhAu%lS;8PijB0GN}dsj9z
zs&THit?U8*&H2G)e*zrO+YvuHItgRW@NMb-WC5P+kHA*`@SN+YT^2!0HfT`ptnJd|
zCZ_xDQ_e5K7i_N$mJW|y`;oFiTC_WM1R5(|#?7Na&~;ndGtbDzj06_Pst!w<G~8Ao
zyUzU0@D2LD^5b!P*#m-`pXBLx23UiI^pGXp<O0q8t8BuY%xK#7gI-`&iNP{=cs_W0
zoGwOFHnu^2D)0}wpPzaMJ2|EnJSi{Z3Lp3sdto9bTqvVJ5J@KuVBLkZl-1p=8E{}e
zy9kfH!6RC!Rt12VLoadU?8gF{=vBlD0=M-`(kZYtI%DAJP1+8z+Kq~QhY7vD4{8$y
zOAmbHXPT;@ZIb(?nwcP6EDFNJVpq*;H+CNAiIER5RHp-@O*E6w8o=b#!Q7sAN{hf-
zVVmxn_9kpb;wU;{-nY?+Xhgqpi&uYGQFVX~DAN<qQChpSO)F^o_(373VRPzY;4_mo
zjPl`ak&QPu9oVj6Wb7RY_Hf_nG`uZ%OVpvejU-6$K;p#^Irw5rtM!2te1ZKB-~rra
zW2Nv>a=+Ow;or;A5(%0m>Q77eHcv}3ZS-%qI3We#&EvYZ$Z6K5PF|rgv?-m#mdmiO
zL544#QQxBpyz>+MRU|WtOq9vMUE|HPBI2t1@N=-iEhunse4c!M7aZtaVpeLOL8(7K
zF~yBG6)d!iUpD8(vZ#Tz8g?8PZ}flKd-H#&-amf$SdyI<`@Tn*u_p#4WDCibW$Y3n
zvhS4{DNB~I6q4*a8T(#IL&!21k*rxF%h=6*M!i4Z`~DB^AHL@&kB2kY_PVau@_apC
z*SUawv~&)|W(LUn%*PhA@=F6vv$mK0NyZ8hD#IB6@XaABt}U7V-A;qBmQ`O*1x&UJ
zb(D0i(2r5#w`S8SwUKa{^Tc%&kktdwVOx08D7~#2(DgCjQ!qG`Q*BeU3fEAwpQ@~-
zQ^`x`1-5A0H(4KRfaYLz09mYjeDu75x=nJz;!kVc1=(cdOBYWw8GywX^*tfXdN@97
zW3`N6??^IMtmJ*}w4X$Ia2HrJ6(L7Pzw=nt=YJ2_ZSr9vy2@YK!dhfGe`ZK#f79#T
zgu2g%A1k#T9c)#=q>|^2Ep2AyF4|{Zue4U(>wZZWTBu`0jP5WRKaX<PYnCOht};e@
zGC|~&!9jcxq=EeaQR@ip9$hd!6~6Z+N`R)_Cb+|F^Y3I6<blKO1ze0=?~l=vE|0@$
z=BY{tCrSKbV=PwdES!vQY?(cKIH&JO`35m_Z#Ny-zRCO;wms}K3Y5My+S>tlKQ%{~
zL@x<iy}tb1W|pWcE3;PvxTIjfs3}C(cJe*-Hw|Gc<7{XA16aLb>-#2_2Tg>YsJGmQ
z1D}vx{$cw{>I_kP9kHH0;=o~NSvVtio4e(5WpT*YOuLO|!JVHP&$4`(^kqP<1=B+=
z?uYNxTb+UxdYTi!>ho8gl0U30_gPOiGTapQkZ{NjsoRz|*F^7G+tajq5`}FbRYzR&
z#?M3$yFkOzEY>U5;*~ANHgr)=3e?$$Z#M_Q>qf6W28fr*0dHQ0n~Zyf@ZIT`JAjKz
zeFWoXHfQTcLk=@f3<R?ckH3T>yV_cpgJ)hr^jV%}R(q@OiIns|MA#XDyS`<r<|K56
zs?Y6qlugQ3>$y<~;nrB-kD?FV5^w?dW$ZQZc=TT)h3?;tX$jfMSm}b4HQm>42=RCY
zxW9K+0h;C(u+5kC0hBDcrSC4T>pjkB{+Ylo#9}=azZ(|?C-h@$I1UU^A}5FaD0k1U
zme`GN)*XiP?eR(i3~gTt88>D0imAKq{+o-lO%ow%;B|DXA_DTF>;#`1BSBfXvukjY
z;!@X^74*UH{;|`%6iRv5HJ?;9dqWptD&6iKxLFV{E($q1vRJ7`W*?7V@2|33JevgT
z3L|_gn`t}Q3#TFU#mvues2=Xp@TH1-2dJAMxUvlK3*LeFC=nEAT}ZD+IfzZM#)Ht6
zg}h$Bj^c6ScXHcYxh;~k?FQVfMvq}Wb7qn;{Cb#RHH*1Gmrwubp)SSkqRvaXlfi|s
ziH((eiY~Z;X;q!$brK0si4p}P(=$p|S}K?S{^L?mL>^m78(Wq8kh$sanhX{-x@X@m
zK=j{u3@t&1GV&Negh&W^H903`a|_<gs<QE6bmP;Z>c#T<`KMzPFXVy^=+>13#uIIC
z(x+e1qx9R1Ikx-NJJ^R2LPBJNLwX`~xt}ZN*Uz5(%u4FYJgdUY9kPrUf^{k*GzH1Y
z5H|o#Kpu3Z;_iZJF}pO|FCyd^e&F!uZv}H~%dVD|G}plfXeAYc+VBRWQ}9{Jb`WI!
zife_onT_gLNfPG*M2@E2##^cMvFOys28DB>-&WK)H*2bhkdcNqhaY3Aso%4IdN@uh
z8Th&-EIl34-3ofHiY>`JFrW47l}YGp>J-<d)r=A8Jga+-TW&&<-YO6cymJ$NO4T5A
zQW`o$rq=Kv=rKvI#=o&1n64`S@zi8{>~t<d!(-9d|HSs4I*(5FQBdF<n4z3W<viF(
zo_|UNMS%nsX=SPpx+Jkjb#nnK8|KKeDoYj9H5M~olj`PH@t<U+It1VQiu;5{*40QS
zCE-l>=EM#oW5E?sl%QkM@P?2N%E1iQ6@;4iy+3vXCsk<cA-sox*Y-~<4Qycwy3MS9
zaW~p8+1OTGCH#JgfLCv4h0TnG(O(Gr#g_(_ij4=yGSc3BM)XcK86#XJTXt%*xlJfh
zCV=05rYBXrIYKw=V4np^-=Q*~$QZUOf)Bh~H>H}Yy~o59;lvoWgZh4{ew|2^j^Iq_
z(6<~z&JL-ww=5=JUNy3dol+8Ie6GItD^CQ4aE&zQtgbAUz(p%k_|QYAb0~f394u-X
zjC80t+;zAQ-)5P?Gn!C4C9@-BEsf}DnGS`c#Q9-JsK+~!vF~Rg2ApA;k2+dkBH`7a
zHD7}<SU+LaYY)c~HsTKl{fLW{U_!~6oFvWe4xhOxNt!tJ5uumu{r8ixp`x#~{p(5>
zRd#<uN>`F2O-yG}F9QNcL^mPg7av)2*60#%7fNwf3f6l&9?Q8x9lJ;-#Tp=YpaE~=
zmM)rC`XpVOHVY+#?pLVvqb44V=c=&VLo1UAX6j5CkDt=Xt6=<JIQ*jW2N8cQo`Xtd
z8lFkPnN)Glmeo&@nsKE_HTU&n)eHTHzLTt-5Q{lwwxB(cMP=RKNolnqq}uAqkI9W%
zmJp$y6A*u->bnj24O+)X8Nhb!>kq36x^|tf#50nZ^D#zPyx=DX2~W>gJW%fx(pGnB
z*Z&B-R6ie9YRv8mXzrbU#eGO)Cn&Mw8Mk!G2iy2dOvQzUJ@SM*`r=%z2501?Zxpkx
zn6-S|*34C-r7&oP^Y#I~R%YySRqtJ_hQ>rfIiv-L7XRFTo(IE*;Cqx&=t_pjdnJpF
z==JYmMfy0Tyz5>bDRlhJU~s<DzyRNqN+kvx^gxMd@ilckYf{G`2tZn=Y3c4}s%O(f
zrjL=&@ZCOR?Rqip;?f)ej?qHFmHXS2Ntn-0*>VWQtJ}lq4Y%DEQE>2-6oRreBx9}$
zu!~c{d*gX@JJUhRN6*VZ_wzB(%eTTP4#sjmbuGd~Fl?^bp;`;uQIHK^ViFDx=&95_
zX*zx>!h*P(e9ht_o1S&!<<GK5(qvGO%?CbdDq>e$yJa;Cp~3^)GQl^BHVVcG4dQQ+
zheKEsw6dweLryRr)6t;C3lHr|FzO<GWs%nIZoVc=y6T<v4z8@e=JHcAK1=F5Dvx3b
z22t2>uf;!}N4+OquHaf+;p^g6^uKYDZCiPNNQ*gU3gf2j(Cfp1s8inPp1~hZrCkD)
zPF^c@Gl%uOWp^H3FVW(zqs0$De8rdT3SxQ^oOR-&q?LxRTMI7V8t?hA5rK52Z+C=L
zcrd841-86|b$*==O#s{vKxOh-njCW#IGn>`Xm;5i?wYywczG1sei8WJZhqkI)mP<&
zxSPn%ZMbgn4r#rNf%8%z6=}sk(th6VPNbbz0MlYGyGLZu#=ksqt7}g9H^%*WU>>ev
zV0%V%r1Ax<taTWgTy{d($?`LnlKshHx{7-(d-M(DK{-0a(mwrpVn5Ct6uSNg5>*$z
zuF6Fdkw|{3T&fW8ARwQ#9Wrh5oU{D%{2)(VmlDrGNt6xzpsIkno%wp@cL~W3wPsh^
zcE^fx44zBp5nUqegQI~IX=PEHNR+xMpE-(TEXLAC&MTX5U23~Q3n{d#xMIi92fWyz
zAxbj8ttw|Zz-A}p8;9S*hi`U_CJ@1v0waC#HM)7RYXrG#UnmkltjPq-Y2KK&JJV;!
z9g6Sq6+iGwG;ug~W`G^n#-{DoLyK9aw@yH;SOSny=Tj{G3c|%v`_+yO^X=i*Y12B)
zYzLpSY!to|;v#>DxB`CP&K!P{Uk7!D%yZ=j7Q+uQ{K!Xlx+UW+cf5U4hDpY*Q~J3v
zXJcZ_IUgr$-qXu;rD=EclvKQU_ilCfnBc-$0e}Ms6Xkb2_t*)9baEI{*Fk$2OtY`0
zslaoO{`-n9!Znw=_0G$kYyXb$^w<yTNA6pXOirh0AQd`xy=L*Yz+3WTEIB_9iFr}D
zxV6-k<{Yc=#H>4V4m{vdHBAlr{%Qv|$Ss4^9j+U{w0YKqJ~U1KD2ArpeZCqO29w^_
zW<N!Z_o`(+@q~Q@!{EfZdL(`OT!`)Z{@skJXDKJX8md~k2%j_5ml;ULg6k$(T0OVw
z5MnNCdwu~cyFoKA1+);7sz-l}XIR#QE`<<Ko^&nnR;O`<WmoOWC=N5>tKbgWw|9l!
z;J4^sw-=1BWL=a(fLUnVaibnm<;4M+z&=uL;i$yO(Mvw2q4h2P<v+QmD!$9smXqvf
zi!Vvgq)<NCKnAJ%@%{`>ODB~Y2lRf28`FNBA31jdYt<{Rvof;`A8x+aIUA_Wb6`mL
z39BU;>q%V=_J2uM2|uau*AqMvQv;Y|7}hsoZB{ufB&_)pf@Dy(qZ?(&pJwILvOMJ$
zO}FqDSIY0!qFY1uy%*FTO%vL?D*4Pu)p<Vc$nUZ*Y#Ro<cVGvi{*I5jW3&r1%4&z#
zysgfSenD8#;SY<eQWMAX8><?K0d6rJh)4TAlPs1EEm`wpOqLO2=XDoNhOjIOT4}BH
zH8v%vT{kg=nldq0e^CxN9PwGtFyAwY23EImug-afnuyco<x+#={Q8cxvUUqcSs{H1
z>(Lz6lklv>wBlC}?+b&vovaI4!c31F5Gt?J|2q%VU7Y!bQAUyGv=%}3(07U3S$aX9
zP-A0DEs39sIUfGENz$y4w57|aS>K}QkBI$7BUPUX{0^i?F88<C@%&EUrws0Oi|)<W
z)Lc7iw_4)o`NIvv{Xd@Ip0h@@9Lxrbu!k`T0Jx#5kWWcZ!2mJseiCK7N^>AQ=XySe
zU#ZolKwL#hMZ>6~XButC5|uodN{rHeYWq-~=a%n(1}Q4{ETp=lL4blI**ZLDQrgBv
zK%FJDzWM>d7q;emkos9oPZH2QbV551r&@%gp_o+<XZnVv`;3=ecYaMw$Dy<0SUDe8
zRf4d$FjEB41=y&kLc-6mks6&@l6Wb(ElpOLkf?p_mL5NFdAJgZ8|7-^_831&nOrqH
z{8I9I23u7f<Qr?SCsppofSpa-MESS=%vZ=dh%roI2>&zEz<S`dO#07MToT7MUj;of
zelX3iY6L^+*t>ehJs?Q=97m?Da@x9%9Cqj8bFqX5PUA%`-OOZr8;4g(efX(IhfZSb
z*cj%2c^RM08MB9^mEm}K5KjXrN*<oIT_4}f?4*+cKZzyN$*~@`J4onXv=1MJ55_UH
zF_TuxS*y%+Ge$UVH?2cniOktAbrn&!Q??P6o~_vDjXdd}JE=v^%YsF3=_2<oyL?Z7
zzEQ%f&YMBk4$>(s$ZZv6egmr@6k#&3j~3<$19J)V*i!37maw86Mzb>Ny<{z$;CkVY
zN#U!*d((sp__TOe1sLEy6eJnzRwAeuZxn8ju+Fd$`vX|>k|3=v8b+j*W?|bL4ODG0
z=OWe~Xf*F=cR@)jX9mY!%LG!lmrqyw+BGHTIjw!-=mbNnFLzsY0Qufpq}y%M+>8sW
zKQr52UR4u&^xr-JG}q>I@hwf1BxBFAn?=lK%s{=5<H+J68wZ>?%2NPwOIi6vy)4p7
z40@7XDV){G^(7xGiTN@pwRcae={x2Ikc;bA9^n6z6#%8LApH0`yTu)G{8eL`HXdWK
zXYxX^-H$?4<$O65^k@UX25C>BOgK3CyaXpol;2X<^|Q8Mu><k3eSK;Pnkj4v(`(_Z
zsIR^7y_7>hJZMiHUL9E+_WluwE;HYA|H?)RPMoa`@1?IJ`kc`{Er)@IBjQ{b(d`9e
z{eZ5R&{tcm5oMD*XB%kSytzT5kf@SwNU;y{)52>$A|(BXI0-(Gi$tfiZO8YYV*)@$
zy)S)G2y-UPG@r4B*Mn;ixL#pd67tsP+5h*KAe9Hf1;(QBzB)6JJpRq3l`dK9QI~h`
zP@QfOpndhAw#L70ZI0=Xsy&7?A~WoeGkb3GZIz-6W&2M|a2<^Gci8H$4e(+~T1evx
zxbnXm!P$IK`^G5#Jcj`?VL=t#|ETL-YlvCwUzG>+mcJt|e;f!$dU|ex><ac*J_w-K
z`ow;PjEJsExT>k{ZEwwhF53-2o(s!euFdv`uA>^H=-`iZE`;d|lK=Iw0U$65{2Rc4
zDD9pJ`Ke6OT3)vu{<t1raS6vA=AGjYc9c^Avr3Yl1L<0&Te=P$c<B8rH^!g*GyGtZ
zaGDXMHJt@FshQCLxC6;;pJ?D$8+SKqp0N)(L8QhlUjU^Er=xgIead@6(5J{x;wWo)
zgA@J}Rr<n($H#VVi#N$CY5bdEbtGeKmNtsjfO{CBX9m+hsl6v>eJbwCkAbb_p+CHq
zKRp_^)Wfq20GB7ho&Ak+?D{F&DF>-?1bSh1C{6i`{Qr*4CF*R()llrw;Ahgx3mMos
z5b9C5i~<RE!TkrjAim23E}-)$8C0&{Y|;za>Zgj|9$O?j2g?&(a;`UeLB>%IgHyx4
zn#>TOM;~?buQLER+koVX!|WE3BL;W_l=!dEw0rd8x<#*dW1)K=U^IDEzdIcA!uI{+
zU^Xg?UvtoZmg5Nu>shv~u(n(Ko!;3SB^@F)Uf{gaEkMUIz6?bFc;X(f>dTk!cW8o&
z{`Wma!oB^T!Of*)qLPSBpgxr%v!c7*sN{Dh#=rZ#IXMoccKIP3z#Pvz3i#C$YV`Bk
ztj5Q_mMEhgT1O|%8rJT9xcVi|BlX36BB#Gq=I}w@Tvf=&Y69AU{>8Crx05Bj77mH*
zRw+Cv>>i%Iv+;`xzo5HLNpRdzoH?t|Dg?%yJ5vfz7pFG5!$=Zx??9$_<m*CJS7FDG
z{mBe>k^KlCEUcL^I&Xa8q01^YJh($>hR6D(pokR87Sxl&O_)tJ*yX@)bT!?#@}?o4
zp!AQx>ah~N`1UZn+<1vQ=hhP^&WN6Ym5JPW#kG)>`9aYZ@D#9D8B8A)8-PbMN1SIR
zS<^eqS)TTvRQ2T8z+}Iz!!vPfJBGUp;+QYr&grVB`Vks534yh%`xEl+Iuq5t4sdH+
zxp|zfM^l+ZNnFvybZdj81&cQO(n{RH3Z=i{NR4~V{o&NNs3P`?p_Ssb!c^zZ(BCnl
z^qnEsp)F=(qL&rKw`q+v=u-mlDF3Ia>nB|s%^VyvTJp!!Gt*W(bu^LKKNvLK$OT>e
zvd;M+jVL?UCs32Hom{L0ZG2%2?Wd{QgK5b2{UnlX&M8A?wg4gSpD#B`KA%dRy4{gc
zu2&iE+GFGF^8Mgu78%rRNdrLWy{@yCMbf1?8k8B01ra#^Ze-ruCT?m89VqwLsF`T$
zJC0yV?ykPaJ}N-8aFDDjtE#z`8^#)xiLY7Hb<q#DDXW+n^E1Gqr+joIDv;`8KSViJ
zig$G}Rg$UI=+Ij3(Cprb3PFk|1!&W7SXtIGiXsbbgw(+XFmOyfEW}djwiNEjez2vS
zxbW20X5M6R8n&%$l_#_Nw9Fbw!Tu;KbmrMcqzD?JFh$7OcpiMqPky3wJotY7R(m&?
z{Qk~;a>Vk)=f`JmyM|Z(FE&b+PG?NjKIiq+qHil@6phU8H3sk^T9`g94CJZOHb0>5
z4Em&+Oc5USb^ko>=y#+NmIgVu+U^{xuH?LIXb!n`Mk+|4j(g&>mnK7Z<HW2m(~tKD
zsw*8v!|0tXV>*ZM9S>|&)7iT<gaCnS$K#_8_$wFerN&lVcZ%b3)&gRuqD>UgIcKAs
z>lyF$r%3GF!;cLGC(0G<t7mIa5+jPvS!v2BN5i~kkoLqvS|%HNg~)|k1;H9#%979%
z%ct<q=VSX6WiFGXtscw8*)imn9*oW=fn`4k&=LDQT*)_fsdUm<=oH2PZrmn`GpOKU
zy3~M>xC2Yy=GF=-bifySM;U^yw3uM=N7+ZiwX@J&>?lTD?21k?|7y#};e>d7-O%>}
zaUHbnjVK2h>>_n(uPu~OH+ZyR*{K-JDfM7`vMepOPre~x$*@KQ*B32>t<GX(0cBf4
zUP5BUPwL$A@6{5@E*KjZi<UqwzC}Q3Eg#8@5abkLYwqE`H_J`>XES`yd+$}-{;Tlt
z?a(R6w<sHDK)!F0^pj&6<LZ?9T5rFBV%<N_gEs~w6;p^yf1u{X6i4Xp#7RF_33>CD
zG{dwPy#vXSo1w3<!acaletp>OYTT?8l0MnaQq&1XaeO?wt6etDOgTYX5>vUmeV@kP
zKrxg99VA7hK5vzE7o~vY+?1N%y@ISkBb)kUbc)q1STJ+KDQ^^b;)0}VOAxwV@R;28
z;e2B(2Mt?9k@tA3x&Y64BMJ{`FOHom#)xwfO!^aydS9_Ac~dghe{qEf7Pgp2v7gA<
zRC=H{*2jl$4YKCg%(CAygjJkX5xY4=mhBwlvEl=M<`Fe(YG?Gr!k;NVXs~Yjc~Shp
zX2>0`gHdf<;f3t;y`4x^S4#Ys_%MMQuO&0ppzrPQ8<>V>1Xageh@Cg9M&98QAF8$p
zQIzanM)ovkxpke&q?a{l#AO}?3LYK7kezMKf3B@mMq^dHu5A6#rEp{UzLVy2=@Y~B
zk=K|l<&EBYFsG%VbU7)T@cgfNcg|QP$y;c<9V>jW@zmqocN$&Df}2%j{PJ2}kn685
zo@Kb9iPzB9nBRDSzS2VdJQ!}<dx~NcV&#LZi++eNsbZ_#+c=DP4yr`xi0tdzGRuN`
zhVjPz3gp2%-Mh~0j6Hy!JSA)^WZnEp-0Q9t;t|G99WGA!g!kCMrIm+ZTa!=h7I6gB
z22Gm%D|wHpRgN(0Hdhs^8o%$?D{m(QtFytaJim_zUq<m0JZZ9~+Gf?9x1RI_wmN=x
zdZ7Nmi~<hdTgce}UoqM<W21kT#tRGy(RFdpyI&jq_S9DT{g+PARr>2g1L}jwFEU+8
zHjj5cfHj&+#>~28Qg-e*IscScPavP>gY6q84W7=b3lFWp)U>4(4o}y9_1sEL(KAPq
z>E39Xj<ChIo``NI&hx}+efg{?Zsp@Z#CzhH6x&j1yNCPxTQ{EW$W1G5|2l=VCc~yV
zh$2I~4&@skBb1xNc+Exa0bvXtnQgVi<ZOutQEP3Os`;=ooM(xX67v19E9!@C3MaX3
zBbG}7%PrAQMGAdkk-?~kFzZSPm)!<4z5krOD#x1w!J#8u{jcm|xnss#Z<rpe)Rg6(
ztKzvI(A8+pc``6rP>f!?{{g+@B`yZg9Q5NlWkXx5E*+?(@MjIxO~;Ih)cB(exF!~?
zWp;Dzhm+Xcm%rH8Hw;ksF+J|-)^Ty>xmX0!&r*VmXZp@&kij~eIi6+(d-3fx{yOm&
zCx;h<KEaU3)`A2wx04tE`e|3*9tMA~Gabl(w6ZqM5flbxOY8a3i{@tY4*eOo&Oi=V
zq-%dv4qY|+dhvzMH{z_kPs-oVU{lwN|9NN4pA)*|L`*D#B?nMu>U*^xe{dQdG;TLE
zg^)s-n187=PLQ(JdhC1ljrny~uN4B~#UiHN4%s7qebA!e@Ju&WZ5h_fyKos13XYNx
zvPv~ty!mA%v`K9#q?j956LcGN-Ddk6d<5-YvPGo(IDO7}?D#S#ZI#atzFxdBV2opq
zp>3Muga`A$JhYeOs)#W*YZD!Z{Ok7*XY&IsFZpU5>bO<j-UjrT6jjZ;q|D5Qk8GuR
zldh$^WmPyeao1A7&rr5MlBQJxy{TusKv%R7U58`;F38gqqHdcDWrY3p)wR#qO9{Rt
zF|`z@5JdC76JvfN$@F%qBZckKKDlkDd4b!NHl1GdJRvkVBISi|(d=(m-<ctrVkh^u
zg5x%O<$_KUpK__4jQq;ouQ4TE`BklGR@xuS+&g1&h2817NZYo-qfehniABq%lJ&n*
zGp}Jk5Caa|x2EM*fk&TWUrD029`}5E01sSS9&wvMSI;!Y#_Owtd$SD8a7N9$SEzzo
z9M#Jp{6q@mujcatWS_+PyrNToQ`;kNB)5D7AxxRY(@>FDj_rOAqXvV%BPD;Z(D=f$
zM7Xfih6BY-G~by}GAQgrk*2uWt;)4}#dfjdwdKe=b>WkdF5f|RTs)*^irrqyN+$SO
zQM*2OJay4<7&+BSr5J^}xKB&|Z9*U}_?AOtfas|@iIbJh$RG;j(nYoeeO(~Gp8@Z$
zL~oAuIr;r$2A$jAHvOmBBMU+b<!zAVOXEiLywSzeCbdk@_g5E~7w`PrVVuJWAvO7e
zt9H}%D>hL^PAV~qyid4@@uck+J%`g)Qxy)*+%eh;ITu0l3k=tsZvWFCX{;m0y7&R<
zw%3@cy9=-F(%zp#*hVpcA$r91j0JE@>`x#ZT2%i2P#>i3{I$!rZygO}<W}F%cFa{G
zq%RIFo-Z-hSCo0nSUNxqw++o}7$b`IJ9_QTg)Z*%17rvpJmbHRC&G&I!;eYJp!D1z
z@B8F@=3wnzC*;k5vk+jc&cD3EDZB^1pU7rO`49M4`%SL(oc6pU1UkO*Jg{w3a+a|)
z;k1(gB0sCW{)O^?qXItPMDUr<oK9SfXxm6;Wvl<|7vObZi?WR(q7M;8r|`uK%LTsw
zuz~hyN5;oY!bHG19|WvOSfNzuQUAr$fPlOsrD-%#P-$0BJAFsX_4wc7121|Q`OJTx
zZbdPTGax@?d_^3yxK5;Oks<KAxEt0K7NVUMqoNoMV%Z1y=ygsGep9&{^X=Z$Z<dpo
zi(T4mkLRzR_HB9xU^XdlUcL`T=1|@XE@Aq~uas`!>af^AOO2Gfr?)WaCDJB!=H?kC
z9Mc^NrP*4i=Ly(QpLg0bj0*_u`V&+ew=j5Jz2izASR-~C%^ORAl(c`$1FNP7FyizQ
zMA_UkK`)uP6Iy1LcC^1V>$AAVC>I3YO$<JtL>cjK+&D?hML)`C9AncqStHW(eu1rT
z?Qp4-J0wHNF-}DML$4*4W04>WQn#Jg8l%*lCrQQ{>R=fdU=`vC7Nu%NRi47zP*<^#
z^cw*4yD?3zIR(ItBOU{q%7}Z<Iv7jl0vIMxz8F5PR~J-T$5VL8G1kPEd!No@Qd1o(
znOMTC>;4=>65CD_cbVM08L+}|BE<r7@PF@x<+rq*Rsw@V-c(0GLA=m2<2ZZ7Fw_|^
z{Y7Y#e2d&N#*7|duum&bc3gOwpK#T#74A2Ev6q4xUo(7DW*Kg!Vmg9`*pHT=OfVvu
zTD?pWzwS?{_{A==b62d#EZI1+GW9cxn-TXL)L7nQqM2XpsBvL}PM0)Yo7}cq7Qsp{
z^&F(!w5Zam4k$ts9YCQIR}lD&R2xH%8%L&cNBD|kdTjKa8HJw|WO*@67o4?2JG~|4
z#X=(^t6JNu88#Oioif2fDgE=Zpr(A=#&G{w4pXJk(hBB>g}VjF4;NiLxj+%N5gb7W
z%@pJ&ydvQC_azw8>_$z@;0|<-Ab?oJkK|5{90h5ikdQ6Iy_r`$Hk3a!ef2>0%jvWK
zCJ5wm#vF~WlH`-}vjvPCV2ZkX4YhZcmbX*s_)&EpO66zMxOvZXPLY*jA;k)*Dyn8Z
z=Goj|L0WLddqKM-(4Sa$(G3=t1WN8zlxz-WGR8Bm#!C{0UY@aCw;;6EZ<J{5ov|It
z*DrW5S??M)l;8IXw|2S0x+O>-XF6JL?cW8W)g~tox+A>~yA0xF0Za7C;06R8cVhlO
zDSnj0rgC$h`Q+nc?;36V%-rUTnRUNM6ZwR^o{^7x5pav)Y{ofE$qaSy^#J{;OhKSV
z0ynT+V3#Z#$*CzMOs@3%h4mDlc_N^PfJ0P$TpsQDf~6Loi~#(UrNlszCbl?*zqfj1
zt4&sE)VrnemlpsSay}$6$8NHRs$AxYM2CEIz^SZA6?HH2$5lC5OpQ1QYsZ&>m?Bt3
zXKSQ^fD5UVEB+X~p!fBx@RLdzbhEVY|B3Nuz<~DS?h*eHX@cPtDO65%Ok+C0eF<<+
zKGmY9(zvK)1vszxUZnJAG&%PimO63#wx5qVz#S)azo~r6<+?bReI*!M<{|PPU0AhD
z1WJVxcYvhG^yQ9GT|+Zgp?F5UY>w4h7OV5E9`lEt{$(e-H1n{vX*gy3T(b?leup8B
zX?$oU86v(*)dH$|TA_Fn^T{LIha_WH7KjS@bQG83>VaP7dUAVLMj`b)#dFh1q8pQl
zjmh#vL4ZaXFLN=Ms{Kx-JWEwL|4-Hsq|=8&A<7QTJ79b7P>VpXoT~X9K)yV%^*`yw
z2$TSNJj{c%uEqRt5_1d7)~WE=lH?1+c3?%SG<s!173=2VlWvzN%tF+jtUBjNp(ZM=
zi-$B@Ppqeo2NMDJ$^Z8nfu&ozV~hJB{BIYzDF1ZPFGUcn6$=sQy6PS*DWa?BOmM%m
zUM0+f<75jbnhV=|8r1Ee^WuH)hEL%K<uw5k;^q5bL1Qae_O8*##;kBQ&GSvJCzg`}
z>I#f94dx_;=*!u0X`V3$N!i~)f2@UtYesA81%zl(5}v(1W2<rLe+TI8<Mi@B0pEbq
z@-nTR2gT1mzR{+ecHuba_qVwm%BtqmmPlcHkPs`e<|~wYD+I4QVxmP$pKZQU(Ny43
z;$Yzds%DdniK~qvjz0IdiH0Yl_tZw64pC1jR7D&nsKXwSzA~tu4HnY|4*Mk1K5qQ9
z@>BN3{K$zAUHd!d4=NbKA%f1s0apHPLs{6&RVj`kP^yt=;?(kqM1j+`0O!cnl#$=5
z4JQsh$JuVE`O6cVjot)b>EY#V0?&4KlAW2lWyS50(GmRQGz#53p}JEeAy~-PE&O7w
z?%)u&0>Lsq@p<$yT_)}tBo<`+jG8?U3{{7&+C6mSAqws@C((rb?F$f0vOZmV!MCK9
z6%Y1<0=}YJzIx*qn!4hx>O_=5*3QK;t5&rBzk>$YexW;Ugf*S$>RN%y-K%fH_v;(v
z_5Zyw(F3e(!!ke2V1G4P{!Gpk5@T#Hd`HzTZ&mjadfCaM%3dSg04!7`J`umX57vC9
zT3S`SgEOhgp!CGr9Ad~7+E+_%;fh(V)mQQO`zny1v`Q!3B{ALvw*LL&luhu}pJ1Mf
zroUy;ZJQB*%47TcAzM^!VDduv!`t1zNdo`~u#Hv+E}*^Vzs%-7uGru2n`zuJW3;Cm
zIds#1Wx)QgZJ?dCr=eZ`!KADw0*>{}U;xt;S`jHKd&~c2<4(p-Z7cD8+w+c|mHMyb
zE3Vv?$EfMyt=P>PjyA)`V9V0w4*Sc?wPhwHre{Ll{?|6(JXY<5xw@DY{NPG4Kh{9v
z@A)OR<c^ZC9OZNZ{JttK_8MXS{^H|p#k&*7i6TD7p~ZazXpz8P@Mefnu!;M*wC!J2
z4p+r$PkCy9p?JsOdAx4c`@_TGv>XqE%`_6=QmM~ZMG;o8$uFV>$%Rg*O-9&LfgF^g
zZxyMVv|Qlzmr-)d0P(&-;&UlWjWOaOv5Wuh3cbi^Fax{g`{(whp(O&R9Iatd+l$ta
z*WTe44VgNGszT^ZN%#=jXvoF|$FlSKsBXE+zzEj9?cjC=efg7DuP+AuBzjjQ`bvJa
zsezD(g$dH6EQ<vAoaux?)q;%M)8`G%Q?RJILrXXK76e2w!`S2IgFCsFWhF3}ZYw*(
zmNpffAA6jG8^<9tw(AReEe2n|wimKUQS|PLvsud*=>iGt!{*j^64P;4rW*eQ777PI
zNPx6xu!|9pGT!6;h=b|=U-7;%2f63%+m%{7bBVBsJ9~}@6{od^d~^t|Dny%>!lLhF
z(|U%!b~`l1E`GT$Z`}=~*&E<Yn+T1U(7eTY9(DO#+0>bLxqYqA>vomYJCr}mn@QSd
zuMJTjQ<s$a?7e3Ev2ZpE-Ph<>3cJMtsBymzTu7e>2eR{tF~awj;(YRXIr`H%8*)aP
zv%gr1Pw$%Q`NU&sATUx=<TkE}t(Jt1QN5VAZmGQk1xreTtwtnp*!bL}H@A9$(u-9U
z^Cz1U=cZ}&)^ceRdfNoEeK>21m2d}^pQOy5!sc$T>*Ks>O&qv_GHXA68@RpBMFF&b
z5Vu5^3O^|_Lc;G-jwbrVI=w$UNa%XF^5{4cQ=bwwJuv!L4h<l5o%8JeJz^1YC;K!a
z4doQb^kwX^DD3kes+@P#^MS`>%T&uBK<eG)$r;OUJ7|X~Bx1hmey`iGR7utYCWq-@
zd#Tm?=2IBO{;Mn0ZFYj7s9&sx3U!GnPR<N|<J79Ci00M%sxW%xaJ8nS`t03K^&;v+
z!_UjD7?6m<6k&4Xpy6gH7=A&#j^iC!na`gNZ0;^Eio!O?vmB9ExagriV{(Z3JW%o-
zA|^Y?@!$^Y9Q#$M7;T2ns@WX?CHTG?#82XDAGFaIi(+x_mCa%loh`{;No*Uh>wh=T
z&+||Z=ehI5bj0UXdEgfSxH;EJ135~14za1~ww62@jbaJADz5WP1;rG63$`;{7n8@A
z*y!>N86_VaT9RePglYL!7##IWUDE%9E#oNDFTy3t(=po4kygn9LyN;Pmk)v(r7#nu
zP_qPk`WjZjv4WrvRr_9RxYzTnPES&3Geg)Teg+w&lbC;ZAoO7i-;_HYSt%@=M0X76
z2aK|T`k41Z_Mw&A{IZ-|mxbuaeUoGQxD~tgA)gk0O`eEf>Iy627mdIDc3s#LJXIeN
z&D3B~-%51HzNov#Ac23(owkbZm}P`RCwghhur@7JOpEhXe0_q*5>IYeZy)Wb8@G?i
zhh1A4<jp%dsO8Lppr=J`>}IiUk?0fC-bKD1DFFE4Gzun(43r05xb;V#v^pO>cyKTN
zSIeKBse`M5s)p-?DbHO(*)vBNI_O;67RNt|DKKZnJLwa#PoZ^S7=muQ5w}d@Y&j)=
zHtodRBido>rQqD);-5>w<qCbAw%2;ywiivHA}ggL6v*P?MG|8>bJ(>^FxCU4rMgJW
zW$aAS!KSvqtSh2^1x!{f>2z{ujMVe|-Kv2s(Rp+t2O(yW^B`&LWzMs*0uv$o<DiXP
zb|0&)=ybaT#^<q$<%%G4@?;{e56QM!7}&QQw{}3`a{zaHwJg<b6(6WSe!EWW$9)UD
z8Mj0C=0yEfqR;PW56--<?Rbsn!tbd~qh3IK;J4`Z)WPy@h(S|#F+RJ*HQrw);PC1s
z!|6~WnnCTgVd$guIoxUB?a6_e{JTPm<P4|4kv9VBDf#BBk&X}4*X2f;o~yGg!-{(m
zOf4>Vjm0SxHsPUTpXwc+J0O&eTKd^L+oXyT2c=$BxL!riQup^#t!g~}KLaud`FWuL
zyf0^yP<FCDtaHO8og{5V>iAEVQ|1BB8o7G2??I^MGXvrcXkf@vqBcgxAQzG~bu$+!
z>%1hrXl{y-IB@(G#Opwzdf?_BZXu2xl18nu<0Jw(EjcYe8!Mo3@?m%`lvJOTKmXKO
ztfA(CcS`i`{jXbFj3x>IAn4a|hUJcA!(3wBSDnE1;OWEu5BBR4IL4^&C+kjIyFs99
zEAcisjqWhmstr=KDf-u<1PXV(L|69f3UMe7&;1f}f2rEUt~@s@_9l_A4C^NSbKBv0
zh!w;0Wz<gUAtocK{c`PzPjyZq=x4qDG4{4s5pBJqiv3f{kcya3(>;e9S<&7pbfY<}
zj9!qRh}+eMu?Uvd6o!Jac+c;S?O;-~^;OWZROz+D-EQoJ@f7u+6bHW%_WZYJz?J#A
z)WwYzk3S^0&2a(gMh%GezvCpX8h;VDX%M7R7S>+PSzIs7jI<N}i;)oj*-onHUZqI;
zK6Z+x)Lj|nNMGrvd04g}nKEM*Rd<f~#_1E2Az;F6mLRxDW&*3fJ24B^v2~kk8ROz&
zUt@;kJ&W}<#*mJu(81~J%$*X7r8&#`LQe|s6aJ_*U(_j@va};8eq@d~V-I~z{eG>G
zu?z>V2r2zG?VLDe<ul>;B>MKxwNoM`v4u2!FjOwE(opgII?bdonKM3H!d{cv?i1c5
zb(rxe^t6-H_ijtSNmOS-$Npq@hB88;Y!|lXPiBk9vW!<yxTKbjki|b@Y%6hMPE)u4
o_nZIw$Nyb{|6i=Y=P?3<+2i6;@-DA&;()X@Zrv!qZu|KE0bW#(yZ`_I

literal 48556
zcmeFZ1yo#LmoIn=cY+k|kU(&E0)*hf-GjTk1q&p&1&6}jf_rdxcL;8Q;4V}D?|t3<
zb<cFaes4|p%$hZ~)}bzS4wtj<*>}rt|4zLuy!--Q$w){`03a9u06|~C%Q7GaAR!<i
zBETadA|fIqBcY(-qNAarq7h=_VB(Szk&}@Uk&sZ(Fw;^{F;bI|(DA%wWM$*z<Rqu%
z6XInTWai*x|LY<kWMpJCR5Su~bOLrt5=!>}<>RFTz(RtVfbD<<Q2{VmAXqHWOAkN}
zohLl#ZwK)A0|WyL2akY=gp7g;9Z>fQfC0h6!ob18!^6QrNBcti0XQspY)Up!1RNzp
zL@GyI_JG)IB<lB7onYn3QyLB<r$A&BJbVH|qStR|>E6<Fa&hzU^6`s(5SNgYl9o|X
zRa4i{)Y3LKF*P%{u(Wb^admU|@bn7$5*+gNTWDBZ{P%>!q~w&;oZP(pg2JNWlIoh;
zy84F3rsl5hp5DIxfx)4v>6zKN`Gv)$jm@p?o!!0tgTu4)i_5F)o7=nlzvKb|u>V6W
z=+FNl*uRkr3n~{392_hh;$L!sVBDb%77GrZk_`b{R0+}05r>LB015YfY<5*AGBt<t
zDcHzq5(STjbK~{dU!wg@vj3c5f&W{Q{j*^IBG(dt1`C2N9xN6h4BXt)<@lrg|LuS8
z9xzaA&0!=D6cd;kW+wjvX_22MOTPeuSueoP=-X-OwooToH`f^r>K6d{OXkH8=EMFA
z5cyAo9>;Gdhnc&sV^99|kZGMhcKW@+FHgvYgUp@Blq<jK%6t*EpXa0APa>^xjA4j^
ztCTgB#BqWD4>!=DNBfhF!PUq-ISD4S%rDT9-q-LKV6OKC&>eM(akQqa7{Yc8YH%Lw
zea}$}W-9B!vyV+w6qqYng5F~jwpb^#7XXq>`Z=Xc?ZV*XL^x8&C?lC=gkvRLeL7<8
zLTcwrad~mQP+2nDQb(ncN8STT=9>02Kc}C`8W-Kj3$U_Bo?%L`r%t`QH8B+_$x{23
zUMb|%Ty*0}hLq5p2W5nuU{TL4twiTACgsy=FfU~YQY8!9N3T+%!$(?o_y``DT~R_t
zw&o`KX~o5rONXlradTqL-$g}PO(DB%H0%u7`>MP7W%4mOVRXQM+%RQ;V%K7AEmob-
zK%9wBnLBDPzy`&%@ZPrHI@2?F)T2D?5JPmEqQXLfZNF#kvWP$IAib_iDgQNIw9E_e
zCFtV|kQw^|_%z%qK{XK}<pmI?e!jCmt>l$#itVb{?9b}89L_yt(?)(ASh!*<4eUz)
zF~+1X^=*r<PRZQzU;RzqJIbk!@uja%=j$8#_Pb;JiI2sEJB}eMl2gSS+8WKTjW<`D
zv<~MQ9M;~y4iwq<4udpBBaM=1n*>U#y)&2Ktw@nFj2);@Y1RIJv(;fpnX$Vn%>=(o
zDp=Fe?gf8$N1N&}VbognYh}BkSNP#k^BmOd_l!FJ0^o~~g27`?LA{xmq|-0JslMNB
z^SjQ?@q3Je7vPpf_)!mVQPmK*#>DfRa94N%Iz3;2&HV?&aN&J{!WZCI>kDw^0#bo$
z_L0#GP+`_2<+n8@bHF9XqV0<A?F>HX0|mm8O<oR;8p>L~&SR&EZ8bTEjlj{vE%@%~
zwMvq3FgTo+pMr*_JiFkEkn^DWvpruL|Iu?$&AL8=cSzaRRdA@z97$As`F+=l{BJP(
zh!?=eRrn^hwBLf6h%qW3aSirB{Zj7U=B=Bpy2mylWA2{9Sw-ZdXhC^V+88<n26TaQ
z5Y|;z&LBZ6j?^S^_2$I$p!quqPS9mR?Ky9!9fOKa@;YBL-XP2#;D_UDP2gIQJRKB#
zCoip5On6?*(R`{Tym%4lfqiy|a&UvT*}AmU-!s32KICDq*6<^3WP23h@oeGxG1BQX
z&S_;&8p}6?Bh7Y3G>lSD2G29+D41<5eX(}|Hr{pr_CAl!=AD_PF+<vy@i4Dj>gr#B
zXe#a<&AmStHx`6TO1jrU-X+|X#g<DMJ^1K0)Ng5&2+j$e2L>xb{(XawDMKej2ODx`
z|L7<D<O~ib_H=9MfZJ{G(Rl&Lq3f;N`^j%OX-m%~;b3{>;;2Q<)(z*l@@Y07zZ%Cs
zCy^_Xsk<3rlwY7R+u<x*ofHXNqv&4C>|Cfsv!gu!I#pnwLMy+{G_siutaBXwG+R1a
zq066Oxl8Xs(E$E9jHrTXU{}W$S^FL3d)<vyY~6HYzv!{v-j_W0$qq9bh8T_o4fH+e
zRK{5*RL>4?@Xqesst2+6cvZs2>fT&M*w}xqBskz(+bf#XdPmxtdLt!mZadysY`hLG
z*Zu18|CGy6K@BEJS5EApNk_T(gY6OJtNrJJSkghvM3#;hkyOH$LB?fO(zGf;dnmPK
z<xr<rn|<{udA)bnob)WSQf6KQ4TMM$v8@4h0fu5X@}>5>UN$zLJt~q!&PbNfC#JYU
zfp5k`$@TAprZZ)x<AOgtSH3fA;49uN^j25@cxh$Kt0>J2TU>CLJB-<A+vmL0h>3L@
z<!f|Y>r2_GlF6<6>lOdSf!0*Pp%6De{ahrMd(*66ms-wK>F@O=th<zcAM>NBdT<c4
z=m6K|`hub{`O*(hNE$IYgrV^CCe&<_St7cuQI!B|L|$ZEL?PdDP$I`qBa=fXedbI>
z;byX02s_M**D*$vEGI*E?;lqIG$#H6ye7JM?qv1bUo6e7aALWmo6o#P4tfD3M)gPm
zTqW_pwKwoi@0cS~cX+#!&mgn&(=?$p1g>a8NCj!~`^wU#9K&EY?E!Yosp5I9%_21x
z?hgT?5e~WFp=$PYtWhss?a+elabjZeLV`|<*oFOS>Vue)AB?$h=K0DkkqA|9Q4j|(
zW%jaDtv%sl1*kE8%@(@~gyvgHfrf%<FlBs-rE70!A<BXBEbrF}4w>BIc(8fP^e=bK
zowPz}ZaDo(=7y9aY@Lzc=M`i!2xP*&00Zx~o||6)QN4Ev&bs}9?OR=c|6Sapf08M%
zX&vm>-~aUm_{~869PrvjZS1!6`JJFJbb&QrfJ<aLf>e#isMJ3XF@F2t$$7qfzk!2_
z7oZ98IpCje%6GFOtJFMx+Zt(VnEsPWCo5XsE@ovf5ZCHcU7THGiZNn=_msAkdc%-h
z>(K3?z_VIsaN8M1K15zYf8ebhQ>BkkQ7HrYwXTbyzT|a+?1MO_b5myRku9b;Ze2>=
z;pw5<ayNX8@AhRm<*3)?p+uf)&LyYzArr2WI!GK>5hQvbjtlDXDA%e(09-}G_7-Ip
zW4w0T_;<VJ{vdd$4eZM~tWnj4&7DY<Zz1`k(UtFyu1b#V^eF3A_}Z9c-ky<bm#Pm?
z4ZsM@%3tj(F5W{V7(6OzTt1UeUEXaYT#aYU8an#>^)(NV3MfFvhaq%xTqI;^pA(`<
z^LW%>g{tt12Cev_o65XN^<*k+O4Q8eRWqJHI?{~~FJ@Rbu20{RA!%)BN+{ORSzf7L
z8ZrAS>`nT_u~r;aS6Wh}<1s4&>n^G#R_^9E+~7Q3SIVL?Dfs#Ypx}A|d`sPawEoL^
ztMdU&7+uzXdrKa##g+oRrV_j2q+p<qvgapF<1Dj|<mA}Kcp7~=45GfT(9vI}!^Bv-
zx{$cKJwj05jNNj{C$oh_njY$#e_U4x$fruN#A&9NR!A9YM1L(1L>+#=ck45L6rl!7
zl89dp?!t}5AXKnADg9j-RIGr`Y^inJHjbB9(p=&Sj;fLW>A5BmN9^X>M?9$e0?==@
zTDmeePhu?I;m);1H5D##=2-g|MzP8{H@B`YH}5~7*;B^AiT5*F@7)@sh82c8SK{Tw
zudI`5bL8aWyE`2xMbyzuwpY`n-ysH2K6LuEWXdGTL8MreHFZn<r3}?1gDT%Y-l$vB
z-k>!JXZ1=Ft?V~!&MQU~5~`1hB4#5tR_6D~MEY=Pdq||0UFxK>UQc}2(^(`P%ka8L
zvZQQaZtV7y&D_y7h^R10(sgyCMag?O(^2O?$*|rHt$=~>c5;m##%1{F_eLmCOMi)U
z9Dc>HduxmymLK-lRFhO1$hC2DauMB~t4_(I<%*+aW?zrc9EX?*J1;zFlv95tgu_|}
zU!0!0?h{zI(D<DYDv(F9=|z8O)p5<%D+sQ9EOFfaI2r@m=UDNcZwm`XnR4!y=9#5B
z^$7buRj8-s;+K7>s-kog5%J1%pim>-YvZqn3EB|(@E^Zhk3Yb5z5uyq6;VwC?c2Hf
zehY6fpNP3!T>hT#5JD3l35zV0q*UATGlWf{9tR{|F3D#sU)pEi@uzERv#L5h1R>=O
zQ|lD!r51-aI@px6go2dZgA!Ym{Apg0yB+VJ&I<eo`Mrl>Xiyw>xqB*?>om_!UWB`T
zD_YjRxA6k}i4}R}p(8WRC5K12hswAoaC+N$kFpF6rVXTonEv`NTs~l{Os7M&dw{`S
zW;#i>fwioXf+@WY(5$Tv9HIob8oqJ^8%0ctz&rnhDq?gr<_oZ(F8l-|vtOEVrt#?G
z;rHBC^#bf;E5cYBoby|^pNPHySsIeMy9qA<bwSJXHu*g~RA^=8S#$-JuX6S5GNSey
z`r9+|R#?07)gUf8c~b7hyqG}0VDET+Z$CfoY$vmn8c6s8O5&k+o4!^>I(8AeFRqsw
z%AL(;Zr2^tJU<TPp*@|Aa(PTXMx*)#sn_ZC(p<u!by8Hu=0Xk0gzk2$5$f(=8BOaO
z<=#70i3Wn4Bc^UE#&oV9Ow(v4sWz^;r7HG^U;V&PpP$aUYg;DiA^JY2QR-;Z>jptI
z5;~f4(X&I>p5cF0UAZp*Yd*oH^t#+TKbZ?DK-IY0?OoP<Lekcu;r5?0uUKTx$7mfy
z&box0BSow0&WYey$+0iz=vJ_)_xG;U%JfR^9}nd3!^Lsc{r~cS;DjOz^_%m%va#q0
z?80)ZNf9#Ja_!e&rgU;S=wpXn%dGxf*<;H3xlH#`p?Ak@Rx1Ra431}FZd+G`yjF=!
z6?~M(P%9kCh<Fm#Ph4Phj%H`;^A3}Cr4t|RDNe-bD0-wPb(ir)AjofYb&ai$49YGO
zK9;pVY2Q)13UhD!cAuf6lRVkj9Jlk+`8>*BmAc%8`!jA+Yi-zuS){r+G(4e##`0g7
z|2%v5-VqgsheyUy@%hYrPmdf&g8D*qzjdqC5`GB?=c*7>gB?YjLUHMAhgav{75{JE
z<iF$mZyu}v_61OebW2CkAsf`PsXH!UtVeo|#k(@)|4GB@wx!rMdF2(P-&?*vVXf`F
zG}`ZCIIB?Z3EoY67g}7`wzNg=+QNDTo>tafK&d@=bTdx~`?96aMYbM0si^?>kY`Q&
z>Ci*K<FQ%e^=9dup7usc4a3$Q%JPpHo8zq5g2oSUXYslrC3{-)JKR#|DFjF}7&@@z
zQ>{_p+;35Dl*{pQ?MhZZUZ7ODs2ZJ|m|{!QoXc5Q#1Gn+Ez9A6V~HuEvr98izga=0
z(7^ZuO+{MHN0ma}a*k@LpKyn6*=J}v@m5y%&IQ|WNlhf|m{)DTPd^xAPpvP^S=1AE
z=O8RAU-Tb)za{)tW=GJKL$*{z2S5S<G=SZsT#rNThcqeVkc-$mwQGKtXtxH}%c=JG
z2L%d$dVH^sFuHQDB<ZL&lQ^w+DcKl*nfcdhciZ%{awY^%rn*wg9HVM#Y|LL)>yK1K
zKi97mPoDQ6Y3+=&#4hn4XVvVsEK<2CXTMU1Jw)hPXmqPZBI~Pr+gELMWyrWvzb$2e
zgqu2pS1L@a8yEpT)QD$NhWN9dQRXTfZr(2d&;d)EZ+(zj9w-=bqg2#!Xw9HlAK&|#
zDr{XAL6<_^$4~<zeO(!{QDkJf<$3fbC%(n1zbYc#N^vK=#pd9VbW64r6HSjeocLJs
zcLW%|+TJ$LMew?;9DhsixnYafC4a&+a3O?+3{~ENA8>&8au0qKu-|B7vZWGO{b^|;
zq*d~8z|G=Gx}_~*XFN7ok3O6!roTqzn4u+uD&a+7A%mMscw!Qb=Ln4;(5+tp(EJM!
zo)3K}8lJO==AU7q&j-HVs{?T(JLmS(#1~)&R{I6$aQQ14{x^fbxS%0R9*#pYj@B9Z
z3{Pu28_EE=A$Z0vY2-fS-(Ahke~&~O{}9VM#T^{jyV!Q8h_N+#Xb4EK507u?MT)u7
zu<A$)^{vytX6}jj1&XtP9iu$6D>Nrdf=w~AXQmWRBWG!h(Gl|H+gi);++;EysBQ}G
z9m)AP2*<{LM^QXr_u0m^U;EH+gLz_GW05^cjTaM#Zo}P}#<62m#z!Id1I-1k8k@iF
zw*`M`SVCC1?SQCS(1`SAxoL%6Zk=ZGhbSdIR!#T;2mW7~U6DHabGE-)>JlwBdz4ul
zvB;C}3=<FpcA|ImgdblMQLy9i8ZgOkPO=`%n3GCK;@$~L=jQa8Cc(%D<k<1`DUhI@
z#fuO$<JEb;t4QRLCq(;Dq&7$Z`^P-S^9G?tMPs)1uChTl5n<Oodh~tY`)V*&Wg+m{
zb$0nSQ#^fSVukYjd!p?Z6WE}jD9^31sO4UwkI(uCxodaSR*A5cG+R+$%K^o&YP0d(
z+9A1|vad&+cthZ#2^1YTj*c{W^x0?2YiAw6+l;>>Vz;GmVQa6)X&evqdJ9?#*2M)n
zSs9R4-|R31MC`%2^m~;&(@s){@K`!THfEjc&;ZC3#sx@xSr~S<-pVt!`R6CpA!1Zt
z>an=56puofAYX`%I8ld7OQjPp5H#(`m^R!_fKx{;+btpXx4NyGN_3$z=ukM08`MF{
zQ1l*U8_hfwaCQF7j8kIC^J+=KiKz}Q^@Bgm^83aCxTtLnX>q{wIc?Jx!Zc_4+&jDM
z)qReH@3i6lINJt=vFx8jxGEnJ6`q;np}<(|wB8Hgg!u&1%n$5ghWj1DmiztUhoUjA
zLqZSMOEGbN+>3<Q!O5Sp?llTENH>Mx8`_S43<x%3?&;f^%RA?#tNp(EAb&lvB1bgq
zl50*rOkByxpXoJffV5BwyEowAW#X*qU>)}Yn93Oou)#Y-u6V0UrObq2bVPa0XXp@z
zSg}Amvze8CTi=H5%sp)mV)ek}T$gBrN2;t&OX5C6)+JSe^O3911gHp!P<M36*hw%h
zYeY>q+*xQsyr-HX-F~sO`EqiQu*~xP$&cpO^onZW_j2bnJ=M=-9DDW&Z``w>hN+{P
zD5swCt64~)+)F&tH)NWb8k*vaY>HCgs)XJYv>*G93pzE3d>7<`TN4^Xll>d2c~2Sb
zDibPE&9CfjarA^uGDnbZhi=G1GPVrDr#%cmD&E@NOZMZeFb~xHmT<lcn>p<dfgFne
zY=x63bfP@$pP6^%D&u*TTo6k0o>gt0s^vUPjS^X2X7G1dK}HmQ*E`|HIYB;4Ki8Z?
zY&rHsV{0U~XSjN6?`Q1wdw*+#Ta3&{J)1?%<%3g3ydV8&3^&SLONbll)(f0`#jPeW
z?=NJtj~Ga-w33%A0FwBd($7-|EVfil;qP>dNS){5Ow{E3p2bHMp4*@)%mlh45ld8r
zK32eU?{h3_uT8A|!;lE^#eoP}thjSwACZmJ$gqP-Mg&eMtApFc7`m8ngzc2aEK{NF
z_)e{<h>O4v={<rhjGP~?#2Jn(q>SaU8?Yg~F96Y(+j%)X|8DnY2_@`1V|Ew^l#6NV
zHj7A+NKdF)V*!=7KJ{GQRfPdtu92AfbK4Rvkpl|NC8{8;%+tU_@{2#TPnUHQ3%9=q
ziv{uVN+@BJwb_@G%x6CBEzFDAZ=%X(P+oCL!yzGWS14>d-cKNq`kx5}m*|vHeTXo0
zKOO*2AB?-cj^o;dOMlt{hmuFR6z5z}MeTmHTf-8wS#od^?f27;TkbivB5K8}j};K3
z@LOm9#Xb4R37S;W4ZEFNTQ&E6zb1vntPRJfFVeB%v{qPWalk)0Q-@qWt1%qOg8&42
z_5ya3|K-I7=cR^kc|Y1bs3Va+nx;eY%>3>8#l)em<TP2~uZqfF#S*Blet7|)WfZ7A
zh}58I!TMWmq(b-^2l)lqODBio+C;(|teMZAqIa2Rxp8_yOWjQiO1dTx_6*5aT?$pg
zTYAj#MShkGlFl`THi1q1qIuIgk<zke`Z-~5aS`)Pj+(*sO(upZB924St8&&#^6ZZ8
zABN~<M(&1tyi8Bxi`&YVz{@uTF0NO&>*y<kmgU`?9xK_6)D(dXE02;Jr3zS<yK63>
zezqb0>`L4;na0!gZ}4sRzhMOoZZ+Mg+O!+{bzqg*Zht?UkI!|<1e<c5uAd0#&{j3O
zyZ=x;3hIfB9_H%zm{U*dK^p;{mi!Uz7;>g6nN&v28oy!iF*9I14;f(J<_=5)$q7K?
zLy16~FT+lw-fR@p5VXMgGf{wTR6Z=i)i(VngF!csveuE(C>c9A0M6u<BvqT*XX1mP
zZnKUe9@@PJ`FFO^GQzRG;hQAKjqz8+wxT|*uyrp$@K+;-Bgf={`7X6cmawta#l0ux
z0y2m6dVz50G?|Y-WzQpq5|bxdhn?k>^L)#51AM|e?lt7{*OqdIMjc;~IO(dxAAeb+
zJyU9!Mof#zYCkQ4jg#|9LT#Stl~Gess&Cdj>914%YnI9P@1oty50TBy3C)cMf9KB3
zx87QJb3;g`dtMb;>ZH7;PUM6Tp7s`g<vfF<Co=0yROT~&1~)V8S2gzQ>sC#@xh28Q
zYRW(REQ0XXBBv4a16@uS@Q;nY?J28$`oxwntn7@_^s6EP){|v(L|k{Ft}G14P;3nq
zi#i1f=#Rdqd9g>LTAV<9v6ywMaBA$XB8m&)(S><Kp%rk*B1mfMiP|@hO=pB5LYl+o
z<wY_r88m5Zf%oiaGsXB*9-p|o6erz0uD#qu5JDkxA?;e^iRnlcQx$ob<&zA!&{p26
z%6f0wzY|ZjuA)i28xrqfs&(66*~>=o=P^6|;<O@5yG(;sGf35=BvabHCK&bkYgj=$
zX4&jU%u0=*C%K^1aD&@%wp3RHWah_;H4hn<5&DdKriH48ut#As$S^kDc3gYB(GN!}
zUEJA|pRt12DbS}b!7&0uT5eq%nD;|k^i+31-d3{ZkPYrwD_dOhtw!8YTDpC=w8p27
z{@&1@J(eH6F^1%(pVZq+L)eKc?O1iK*1f8$W<w^BcnJF^0-_E0kv<`R@0)owWTb8n
z5-Slx&S--&VOrCVNTZ18n(LvzE>#Z^@C-u!PUrU)H@FXx!ufW$YPsVN=~H9FPnU?$
z);U$BTK<v^4FbZ>@ivXq?Vl8S@^h$#5CUqwpIYC(vmF!cW$`^)F17WwBe%xkwb`?u
z<$jUijRbfF(SD@@6ZSA#v}4S>a%H3n<Zsc4r<a-+o_`IFw|R~<@So%suAl}KG5)cG
zb3pQs{Hc_&_SMbz;7tEE47ch+ZZEyE-UAC`$_YWO`4dLZ=UUKyUG%1qyf3Z1PPm1#
zB}6q8YoTN(ie1k7jSSkn@D|G*g0|oMrSLr%_;gTno9<DgwP;w7QZLp@9MW;;(YdU%
zZgJ-R1Y2AAh~oGB=KmB>e4gC=bB}0gaEto_Jjzj~_2zv#Xx4a!YkvW7^hj|*dqh!R
zE09x9bQtJ14v*kQdc6Hb$^=5$&N2Jif|DF50!AIyXio<t+K%IV+DszcZon6d6?(a)
z;$FFLyGs~6nENcbSn2{EiaM1QoUHsvG)I_oTVdI3m!y7M86X~U*Uy!kJ5u#@hQGA~
z6}Re@FG&|Z#UZO}IB_(@z?%{%J&*0|&if^oHDTa2x1-&fRxH}H;J=De!aVbSqB|WA
z(f(b2ykzvs>6>5p`hng(RZg%XKnmn1?D));Ygtah^BSll1>n;A0|bCdQO?g424Z+z
zrH^RGP{+IaPmb4liS|ovF{d2AF{)>#sZz$?PlD&1X3ST6&sc3Lh={+T(a-*yMmhR!
z139v#Ed|*x5xv-wa5Z}&BBb}}#znZGIlr#A1u3mvuWd|n2nk9|wvP$7Qe{VBWiC=Z
zS99E*-~3^%q&Rugl;Wa*U4A@;T3SzFND|J1)(BuUAy(S=)%%F%uB{w!yQxF0OZtYH
zO}2L=*roSUfhN<93<ehs#oBmV%51amKNOKEScKRu=VL70wFkZ*ni22kvQ>*a)*g>}
z5*DoQH^eV2ikb}DGO`6+N3#V<_Gdk;hxR((EaBDLv3#n(STtXm8e}LK^dNVKrI*G9
zm0IUo7_`KZitZ?%P%gX2kX$VX%~gnPtnyu^mGfy!Q$pTPH6+X0-CqkaWEfx==n>je
z*Lx%DZE5}*ipfI5dzbl@t1?&9sy>nDItiUZ1SxpNzbAdW80z7GI_nK|=21I1Bjf8}
zD!KFc^mItOOk#gGH<9nXUWXZ4Kp?e@471lSmkR02c3f#|T)%_&xNan}4|7`~)NZ`*
zzMhtTl{!OjD@#%wb!6JoWe0mUva!NCkRtGLf@-{fjlOx-h*L|(Uu`id<FTX2oI#nG
z=9HCVet*4j1748j<0Bk(thRu>)=8^<P+RsXtCEWQ#r_N6-xE@hnV-HqmKp9T(l}Pu
zvY|}13{~5Ta2|h`dzOXK_g{@4L*e0GgLB-b`^x7)h6#r8M`)RxQZ};$s$*2OxsM-=
zzdhr&q46F=#L;6w#W~doY8Sd+PE<{%O=z?vgQBd!(&?t|So&W%cidf~Uw5Sw>6Y)O
z)VSN`4ce62)JW1tw|cH#m9<w1-vl$_)yUDk-(>ZwfxuhnTe67(-oBz{4)09)$P>&8
zHcl>58|lN-7HiFYBVT}4hQcYXBVSrMSx=?KAe@97uAw`Xd!9Y%?GdS=)YKn)8cyOH
zhY!MTtX`0EOLy>bwF2@G??CZU+Uaw?xn*uQ?nRj$@_?}Re(c-_j0i%h0qX1uoEg%;
z@FGop>eJc6Z?zZp{2+>5K1o%s7G3`{+uw@$v%TpCrm3EvB4eLF4Ym^^RxNm`M5JrS
zt)z5u=vFUWKoQ?fkoR`*x8BUF<=g)0a<Ax+RyOO6VGtY&k=d@6)Xw;=`n$BPNqXJ3
z-zeC0*)f6?5qDoA467yr;-^zro6ktgAxZW{GSzn~)j9t76fp|4yrlfQ%?w6|>d}n#
zd_}*Cm3$^w7W)axgt2eUrhDAb;STZCcHfHZVBV@RWD;wOkuF3Lj>N!ZXCRDo3|+jB
z!*ngQfH3mc=U<c8)E`%jQdNN6>Q`IS<Ns(%$YZ9ms1!Iv%rho_P0I`+qj+$S!6Ro7
zK596NF4VpfM)xqA?oM?G1f##*m6qCxG+Ve`d#f5g?3wNNPHHyLCj!rag<@|uNmzR(
zv!_1s-uyZ!^dp&j9Fo%DYQ(u?L{#3~Rh1fjg_e!;Wam`QU2aqDTkDjhzI#=CRJceA
zH$?^1^SBm&!M(x)ajM(7KG`>oSSu24r4n%x>>B~}9kA0tX2(3+jLW44=TEk3O`6mX
z>D}0-dsv%7D?Ux*`jQ4?DVUL$i)#cEAN4gX&VuixC|p;AX2>{1peq^XlyyHf@sBVd
zf_`1O_Ws=Ds8cojAZ;QyXddod8gRKPseh)aX>5~K3v>Lb@Yd9n7%h2hWv_zcPVHDj
zrheAeCp;uUMexoEcbuTJ*ZklfAu7Jp(?Tnb<0tDIV*(r76$Hn0_be11G8R^=X&usc
z#<-aD0(5Zoz3Kydg|y}G9{TF>Y}t`a<30owh{J#OEp3cyA|czXBksPpHc)U;dK_%9
zf7<9D$(Bd71IiX3ak5g#HpSE5t~UB+cSR1@HI6%q;4}M(!zYy2RxgiDDPSdw69o=s
z!Sq~2aj0eX@f+E@Y4yBq;Q$jOE5(7v^YvOL%2>+FH)2NXaoKY7%F1i~k!VO_MDqO5
z4zP8I-5N&3Q|kZl4ia#J;4{NGA6DtFpDAgRERbU*kPjfNQi9&IW@q{d)^5d|nD&hO
zG-eJ>ymB3{Fq~_>)br~jjp4uCdw7!ZNsd*^X#Mawlou)Cd51n(@kjemHM!|i5Ap)@
z`{RRjmrZ{Lg)OA=KQ^0jQx?kGydM%o+zlJ-R!B&8Yh8t3X&-#VvnVjb3e}a!`mOAM
zyf>Hg4tvT3b&v6a9U8iFaJ+Gxi0@-%QxlZSd3_cr=8|}}VHlf{#@rGB8wldN8rKF~
zezI1xnQ<n7m$3$E{1}rzl{X*?_42b2Sf0}x5ob)nv%M8famPkj^IH`1ecRp5PpwBl
z(lS)Kixe?>4zoB^;Q?1^FT>KxVlfw+pM1U-3^sIgyAz?grnnK@YXfX7iN5pK1+I!z
z6lqqFd<w+C1SkDN5MwaGIsQA6jF^36kzMPnle~g<_CNFjZ~n39;5zoNDiR{_;MCLt
zF4SR9K(#(nx4nq^O-*!!4c_Xm#R)D@R&rRPC-2ZrOYrL|3nMCZu<@0Ibz*$qTs5lw
zkGy!~yinQicdEh^IFQDot4aceyrVaxpQ1jfhe`<qkv?5Spm|TgY5xgY(~9g%FF|#h
z#0kh$QnG+xWZ1#ohZTwQVFjgUdbN9R$y%5~mf)G3ap=0Y&`{xNKJB&ps6<C`PI7dI
zMwA=|fYrkBXwW|02hD@`1S>HPA7p)+u?8xg3nF2dX93UzimP+1M^~Rw4)2L3{3?T|
zkJ$Vl=YILclC#?zS%}nDupLdDGz?WvDNbyRhY-VrOmBuBIM{eo)>o$Q<Z#tQtwEip
zIjZ9tQK*?j)yqBXnB~N{9+ms%HC%`w<tKJY-J1eLF>%;@Tu=rSRT*e1-h1}_8~Wg+
z?H+MlX7l^^+Ddc3O_o$-dUY1B;3wCsiWdF7?&i!VFIi~ehp1<&l__`CLfyIUyMaaG
zD#36qHbEBQu0O*I&}G$iaJ(*SYSF-%`4f)*%bJ3`$FUOhbDt2fVg8C|9M*OPF*bTj
zO-9qfZ);=8)BLF9C_Ow+-Sid;60C?%juEQRL^|A}-JI1okcF}Sw{iACe<5_Dr5<r7
z%W~C?b#<N1kqe>nXx<t^Y@;fE#C7FiX{9WeS>Jl$GJV+X2D;*Jjn67l_avdIlu-j@
zm5AW;X6D8g`A`kbw2y$VI}Ofq$GJ$6v|$H9$KF9Npiz6qc{9hKv911%sxCs1@3R3z
z3xu}>@0p{?Uz$7D48DCZB=X|N_tgmF)B{_W46;F*s5K;GX_aA9m2QClv+9D29{%uy
zp!z9$AhEfA5bR|Z+LLfkWr?N6ytMi27E!XxH4GB)05!#DE(4vpI$}Km*|<@yf@VTP
z64Ajsjt(04@*_Qb`Re+_wY5d;x1aB$9*s(Qf?eE$4Xs6tC04Sker=H`A}D*rxt{i=
z6^#?{;Ecr#lJJtV(O`}FGH8g*C20j}uzF&D=+x%6sotA;#ipJnKAk$mz+s8MxcTXT
zj8|D;`Zs4O6RQ*xg=T9PYV6EbKA`&_Gx`2!Ouzqmf2Hu5!ecP==TfN3gk8c;HI8Fh
zx^o<|55%<e-BM(Yi@@vg(T#GOYcs2^D2+lDi%jXsa+F%qnouREmubZoy)kk!_WQ3=
zSKL9rtuf)Q7HZ4ayW{*m6HX^N-=1e#ZlIy$`mwvyw=5NENQastyGX_G$0mLnBfjJB
zU4A>Q*5i*z>a)g3Ow?}9iWxF-H+fTR_Ace>eUyw<C-3>*j;)uQ`IZ>``JAx6<`FVP
zAQJJEzv5Gr{`@(i=P)4EPbepf`i(+jP=MCN&E<DFN4e?SH;YR7o=7Xs`tciG@<CS8
z&*Vq?X6;^W9Nm8B02GjbLTMbDMw_{>jVnQX@)_HsP~u>d{01^?aT&oQZGK+M!Z=mw
zzya|{FIJ|&H{D<4$<MC%5lmOar3@Cex7u=3nVh)^^xWxWxq@5e&J&hov`Gp$(yx28
z{o}acMiWr4ZOa^|pUgQy6U(>e($cSkneB*NLX8I-jV246fJ;R3NNrnUxoG)@$uCnM
z{P7|`<Z*!JAzQoT$z{Tr2dQ5$OQnVCM#x-S9sBfc$22L?ME6J_4D6(^+KtrXQ9C~0
znAHi1lu2r6bT|S<?h=|E`y54x>wh9mXG4xnEQyvh5O}{tzyzT5jtizE?5$NUSrEy`
zdV_lyCuL3!n_@PGAA5}3S7|RQ-XAHPnKUF}{1}6nD1XqR{S_Ewj0R~!EMUtlmoDDt
zKWL9+oZ5(RN04GB^U1TkHWxvntxR4#So7zx7bG=FY{)c?jg!tz06`>NzDX^o7mXuQ
z3oFuJYMVjsnIIV?CqHbIP$enh{YjnIn&>X=U%f8;qkgTrvi$4fI&MuL78a6Lv%Xe-
zsI3mg(vjA}t&LtsZK5j2fAMX!EkP6x$U<N6A<kV+IR7w^4Z~hG`W56BxpL8qo@1fm
z9#imZdg=Y#P$}h|1_4F1A~94mZ%Q03ms+*CYpjXo+6qPsOz*;Ml|}4wX&oxu*1PWy
z*YpQTc<Sq?IipHy5PWt?n+ErS9WO@#*U}AJ!ic$^5v3UWFCRO-4XYsSbbCwRZw+K2
z;Cjy!6HQ$Xgp4S8F|_A|!KLM+_(M5xk2?!4GG->6$}0tI7n-XbWWr}PL4NX38e$gH
z^v%_3<K)OGPqqMPp*|!FQ~Z7MLIlPd5@J4oQzr7kO+EG@lTQ>4#F5Tv5e+5!5Zz_w
zAGz0{&`lld;WSw#t2n9H6+{T#y0KK6<|p!Em0JzcLJxa`sIj#rwG5Ix3lfDM)aZ1q
zmCTE&Huf;!!v41b?npIqswp-#-y+Yd>zyiQ$;DOqKyA4UI=OmX_~>vW_j2A~A3m>8
z)2M5$A|mz1s<3L!tljfeJh2<0M(W3mML{$&$tJ?GZ$3g5oz@ol6((dK&CbyF*ngM}
z1!cZ(Pw-;G1@(Kl%gp?Cm9}G{bl%m0mtePB4B=JwiVx%~667$g)V9J`wt6M#Ad5*o
zvI6Iy9=jeJ1r7Z2Ojqb&hih$Vb!J?i*bT4q0u^3Y$jUpv;n`^mK?zHJ0lHIvpAz__
z<bh_!)1t3>q>va6&gb*#;Wj+Tz8?bTcY=JIVlEf`B*j>fD(0z#k5x30HMGT`#7gLs
zrsny{I>nxV;ln%2JLK9wh$LPpmqc{1EZuWAZq2V-dGaInkp!X?^!ZBOvA+N@riD*_
zV$foVhPdvZi1uwl%NM|40-D;X0{;<D%xL{!$z$f-ywJ*zLDq$V*Ywq(g{Vh$!_)PU
zlQ)|1)3y8EpYUm_ZO4cBexX5xj)*lUxt25ZwWz|}O;a_Z>;<-wB!{xh1L<3C6*R)E
z)53Yz1ior?-=(KF(vt01z!n8{5^>eMH{wC5VsA7M`XTc)CE?kt`}1@yvuIUXa9sEg
z_uaR+1dZis3XQj9Un}ccgUwnb@s794;<l{u1s(iarowG8b-90&>GZ<9)#kKxth-&F
zfa<tiWxyphUy9FGh%jA7eUvCQ;T7(Y0h~pB1KT(`M4uhyB;^|cO+dso&75ykbcyIj
zx%O<LX=`JXCDxq0Obu-3IEh(}UF|q_e;Ln0cE%^5hkTp{yxh5cH43=&cYD$6BXtkN
z4WJ6jvcZVP--LLQ%+&wHn`V5hAx!?3E@-$z^9F%c2;S-3VrhQa#?CgYF^o<%bSrhs
zd4OX8QJAIN+CrTuU8CV_CBJ_W!m-nOZrXtD@oS6VkG}=1Ouxj`M&dnhfu~8MT#eoL
zDilfZ>xQqj!}y`OXa#&|p-tm!)ZqSwTW`%;F+nBh)A?Ds=%Ufa+|6@a#pW{lRoicS
zPg}=rrXCgWMNJ?oLZ7^M)FtS^xDZ#FWfiv;lv(LF&;kWR=JVR`K?S#eK~6l+ZMo1|
zkGOz7w6N!{@&Z&!`(47yokGF4@MilbZ^^$LCNKr{&oFh5n9jz6NWDZ-i((i(5oV2=
zKBPruYtGAB$BIF}H^vs-Dp1+_^{@6_6cIBT0$p8^ch+bJvMQtrjJuzS<%Ln^Cj}Ya
zBoyhaz+|?>DIdotssnUS4CVig8)={%<t)s1XSist4E~=L4IF6PdQHaItO;%^RpO9#
zb|!TW8OE*_#;=3Bs7_xCV$8M?MW?cP>u&c<$z#W9*BWECVz#+Y43eBOP%{*hN^*4^
zQ(TtfH6-ELH{(;!xN)s&Bw9;&dVKb>*KFZ1!c~LpSp|e9qp6{5%|f`)kO{}@L~f?r
zQ=*ebjQYv0R0HMZcpD4ddU;3t6F%UVdzpv40NWtz=Ywan)=AM(FN3cjBJ>KsmM80Y
ze46btFJ7d^Y0F&oFuDq{)_+3lC3p!dByRet`qn%%6$GeLEoKNmTjDXEe1ge@!ilau
zCPvj2t$YRg@Hk826dLZtNiDvA#@hfxD}DA9mxt0)Yxeqy1cO?9xIL#6Vm3&G)o5iz
zqIuP5I1PS))*DaWyEMRomG~zzspF_6CYmL^6Js_a6r)=(CLj2$y0J0J_%ZG&PH5nv
z50P-pIl7V)R1O7LVAWvaL<of}XOu*s=;nW}Isg1m+bd^-_NE_E15150o_6Z&U$z`5
zAZ^WRLJZH6a_&z9!j~wkkR^s7!UR}?OfT~qujg9OkZ`nN<Z=9On$`uh9C@WE2Y%y*
zq8xkjjvQgC-W^K-1(v)$B4I;8RQu0{9+~u)abr-dW61KplQ4ZO)TVM`f~ujI2wI-)
zGxf{_JTyMUCU9Bi%c+SO_lOuI&S>GTkauE;OM_BQwZvcNA)VmX=BH?6WJRDC&b4?S
zbI7)YF)$Qmn?xsX8S#?MqFCHhi3}xP9|i?Qd~zY5P()zV7qmFuQJ*$T$%5CK{Xy6X
zL>zYz3O`w;JbLa7vvVh~or`$}6U3C^^Ny_;uL}no)K9w*H%erays~K`_jzn-f^LIQ
zJ>S3QSgAc11tor<45i*BI1(X@^{C(7)2)JTu&7Do{vQ9vbZqhmFLkt-%9=-~js0Fj
zYHxy(uy0=9&K4sAtH^k{#S36=>1QdMNlz|>ME@%y5FhrkC{uc}!j8;6Y)ujxx=INI
z9Ep%T%}4kAV9;3@ph0s&jWFKr^VoOWElldYnL1FB!%GF{eBl_}4FnG$f~2;+=Wb6=
z64}Mmh1rxp>$gZC?pv{K_|mZ2SBb~8@VjNfPt<*#rB384AK~b%<y~zgsSq7wFe=s2
zTwao<?k38Wj@-s*Bp}b%f+jQG{{WNobiV-S%m?jP$K=m}Z<lVM7VDp~LVGAfdRuSW
z?`TQ*2~H6q;XkW{|F?}(#s&tn;B(SijXARd+37&m?~cT)T4M$|DXI=dsk!{9zC%+p
zv5ip@SAWdX)Qv}zYcJc?R(@kT+q@yf5yZl)ilIN<tZS>o4)e~%F@Mn!N;2UV*>*RT
zeLJ!+*`BAHpU+=_b*eV~X|YM#y08zbG3-H&!rJA~5R)nC@h1M9d_$Qf@OZ+|ZqJ~A
z4(9yUTxKJ<QTUWvdr~5%rz$5{oB(hGlV&v5)`qRH84?A<U2zHhGix4KNlG3bU;>Zc
zM)$hiV<UB3ROrMK2q6}i*%EIOG`DJU5h#P51E_HPeJ^w*F_jhfWW|t;Ec<*S58Z23
zl!CHM`4F=U)!%IVJM26dvV;z+`-C3%3p0(ra{xU;BTFO2I`iy-=gGxtE<&{+p0#I8
zF>i;o&(C`N=}!1hvvA#>a6j$Sm7=GjM3~8#RIzQvr@HU51bW>CJ7dE92iy7fZcOR)
zuG2CqQgL!JCsc3{Cv0|hse%{a?^meuEaSTLW+o(Yy920dUVuqobh<9Qnjn%wHDR}$
zDu%;`j}n7<x_))~;d!z&_j<L}+<O+Cv@`S2h%F~tdpf+Qp?*>ly)|e!0stvZRh25}
z^f6HvVrt0BOV><Vlw7N%rSTR}!_RQj_kMB>{!5kq7i`-9C0F0^9p&j-Rk4S^-m<LS
z56br`0y_R;umR(`Gw8pD2hdw%P(9%+(l*>EO$^iH@525#(DeciJpAa#1pynQoE=H*
zI%9C9V<U#mnevuZw{I?OLZm5OKcy9{xJ!Vg=yNA_TOQRv7ng_@i0(=`^`8_STG1-A
zhJS~A!(e%SWvef>jp;{J8#c0S@_a$TvQcY%R(enV#m=VA+WIJy1q=C|+|G}F0&0JH
zO+l00U&z0du!L048A=-<49SU_$?U8HR8`sG`3Ap?logDu=yIAR{-UIsAFZD=ANpM#
zusr)){v`h^?2v<o9Z<t_i6uYZzO6R{HDyx<Pr$SfbXNn_N!kmb59KiIQ~7fi{hKQF
zKl#A_s`s}Q?6rqcp4bFrS{PWkH6-Q%B4mc9-W7F;NuSPFlfn)en%>y#N<qY7*!|Wl
zc`rq^>mk&0CngO6C`p-v><uv@^=6Dj!aks9A#3+%><pa23$)vA_Js3grv%V9YEmdZ
z!-<JySzfBMpo7I2KctkR>YqpXxv`VCe@}#D=6<e`g~<fIyR<~MUJ&^kJ_T$)P))ll
zRI-!UR<6Icq$AGjv6G6!)ENXIM5%jpT*2d-KUHc^+k-79R;;jAB_?`JdA|%P#`I7)
zd5{1E&KkB{7R;{3hG-TJ6%R9K=LuvPpS^&+M==NLxvTf{Nil<@Uzp5dIGo?IUn+I-
zp{CD?*X>paD#ytQW{2byGt!?(i(v=CJgsI&IUnog=~GTtRDiKJv?V@$lfi1C2?&&=
zrii$IvdryiCSSr5AF_A$@5JC3Amsg1yXjAN=#^NTx*lsupWl#y#>-~6F&ob9`-AO%
zj`a*uk+kIFlnwgw)&Y%%S(j&omBZidhTuR?X}*m3<5%U-?qxZu5<X=f^K4kcceA94
zP1erYOI9^Hf=aq{6mZN+3KZ#R*Oyrsnzxy{Y~t)K!;A>;&-w`#Ign)OVFNl1qxvci
znort%8Kw8Ss!}vtAxcKL6h?&s>(Pa6mYKMkepXLW@bwmM$bv5bFIph-odn;(k(%%Z
zXG4hKaG@aMBvX%-rq3j++v;zJuhF`S@K92X)qHbC?dIK$98O81T331zt!2l+-Za<L
z+`EKQtwVf#EbU|{Pwv5kn(5H-0K#Ad-8z>?g90GKmOH<Dd-hSAsVR(#?5uyNef5UZ
zqp+9FqJEd|n|D7sl=kkvG9RzIGV1PdF}AbqoM^1K@R7RcZl`L`m@O=`34Qd58Oc@Z
zgvBmwWvw<{k}*w`;OLJ=Unu+tJ8?KcIao0vj*oBLj@?;zC$xw5NRRVF2B-6QqF;i~
zoB&Uc@(3v}_jkSW3Dvh<E|oN58^WaJkyDoZU-CLLszwx6-hEwali|UpFr^5Z2)pwP
zUHe?O{}c9XON-M>y_nf{a2a>>k*t5|XFI<Cjc>VdD&G&y2ie7$&tEGiKSuV15lT^9
zQf2D%9skV&{>`D{gnd1BTkKz=8h8P06yau6g{`4m4l}>C|EZE(I&R<FWO?}g?|wYH
ztG)O5dGrO)BWfdA(*Z$u6Jq(T8?|ofP*%Q%&XKYcTu*-cZMXLYKoFO$Y$Bfuu;LD!
z`jpE2yzQcQ8GWGV;ItEAbnKlDrpB-wlew-kni9}7#bgil-_QR+KbOswun*4^he+NN
z`NV+H%tYHYy;cGx5vWSWAgajc^I&?Zyh%_KcETNrt}cAM!bLSfe6pyBRyp-lW7ll@
z<yUG9-GCX_cRDaRfYO})%3BHUu=H)PG(EQ5G=GadIGmTV;T*OE$P3v6FLYBR;>LQh
z!fC`*YX3QD)yTFWQe`PVOoVdWFy?$36hucI)eC>`3`NUgYR!ISn^e*yBRva=-Soz5
zo37x1X^M79){Wg4VlY2;TfaENf4XL%&Pr`sC-fU&pMGx7h9+{Q&i~w%aTYn-Vp;F6
zfF*4E<#g*|2E_cYsuiOa=QI$Gc`Z^cH_@T=7XaR+_HXcvvXa()K`BO>-IP>E)kE=0
zYFGj_Qj_#PsO0d+LH({YF{9*A#$d&3?3*6`P$TKR_(gG*pFh(Sn=A`#;wRi-!o8Q%
z>=Ox7K!V4-l_@>Ob5tb}KQTu-hg0rIO>cs;tl?$t6J1Df9u2g+r>;UT1rkHH9Kv~B
zgu71|^5!dE2Z>4>#m0TC9KjS~7-zBDX-RUa(2ZiZx<L8SH4{-(Dtk(@&M<K`Y@J+@
zt!3!2-%Syg+S=XyOqnE|HXM^!?|i{><J;>cS2v=eSXRaBVi+UtbxY#Hrr5k*!Wq#N
z%Z00?w?laU?}m#ib${;gU4`#2lU@K3&UH*^RiXtNMa<Xw-6Lh8)BksGzb-CbEXXa;
zU8s#FfN)1Nldx|aQ?HfJzuhdZ<7Hu7SHNe?b-T^cr{UA}S^Y+M$m*GeVEK$v{{ynA
z<jGm!@DN1rk17!x$12=HG&84<9Wo4Ml0}`^Gb0nJ`3Enz<u3H|j>~_p`x4ZPGwKqj
ztJ^h7r(8_f^|nzFrQY$m(p_{NVr9L4D?NSeHaF^^JXl}WAI~pMl^*3u7w~mUgh;zG
z(AL$`j!brN(vBu}TdfbtV~U-R>>I0BL~2W(hZht5u^oI*jTE)X>kh)z2HNNw#68_h
zERQf*%RKMpUbWgcR8$lv>^}x|w__Urq&v@5wyi;7dL+Z|I;*}lql+=}PY^Sn`z?Fk
zqc9+&72nEMALPl4il1O30cs%bj%;-jqrbX@E>IU{A=9>VFLf3&5j$8Ny~?e4kdQQ*
zEMb&Xrw2<%oOFAhbtNQ>R|Bvg9aLvT9(-E-=qsm_;G>v0=h4`#LKnMujnBY*3YLQN
z$(H=gKY^%4`?Y*sylUEK9&0f<jI~dGETynNdohw~UdA)eA}dk@MlQdD;I3*${Y~Kg
zC4?&T;k~pv<!(syumD^8jS0!t$%C&o%Y(3H;Fcm}O?HD3TBft(TU&G6h7}UkU%LcN
z>UqeFd2S+8i<=X^XTs7jQ`~lri1Nj>3R&+`pSzy!7y3PoAIy{+C(;zgMQcIgdKWEZ
zo!XMtqv4*UG>DN+nwv=T#wqyCd+zibx&COotGZ1chNBGSiDlv+ktEjNcT__s;v_3p
zGQ0e_UH)KdAEc(Oc8tKj=?#aqLZgFHaes>2?Q!k#nD?T(Fy$uh*iK1m7Mu^)WO5#_
z2C{Q+RknGNh<qVD62Yu6?|nxX{-NP~t9!Na4*vm4Ih51q+p_ll)++085vcx=({`bP
zp%hVu%Sv1F4R>v^N~@&iLP4?Zn_SmjecjeCoL0B=LJH2esuvco<je(grgS*4@zu=-
zj08SiXwESX1N1#4*IZM&Qu6WC0yy8Kw;wbDLdU9bFA!yz@-oWvqr6m$#}c;ds(QK3
zs=q-nyf9UyX~XU13S&te`_GS8__)HI1r**2ck!cqO?@zr|8=N(Jxh@ujdP@CeA2t`
z0wI_vceOY%Z)BnT=Kq5lo&|DOes$^^d18#mv3S<g_c7oKvD_I#LL<fo7u3=))e=rf
zTDG+^^10xrFwZy}CkL|fmsBNh7a<!mvhVwauZzVx$@pyf9di$zPJ-M93hX!ja+{VU
zyaN<L2L^0I5jRmKs2qF%M&53lfad9XwEd&7C0^tv(lOyD#na^LD&FVY-Je0^5^PFE
z4N33Mmo73km|_n$5<)=%)D`GVo;=-tXdcVb)Al(tuH-fH^YAtF$gQ0L18-XFe~;rp
zE&XTmM>y?^Xx07w3g-uo9%%SX4o!MNc+vmR4eUoDRnT^QCYp4`#1wONFIXNGjM~|D
z9Ta9O=brXa2!fL8Zv9TNti`&QbS#z_@mP4$C->Nmi9`7gM8Hs<EBfi)6X;m@Pnht(
zoUY{fv;GHN<3T=rP{ZkM@UU63ax3%3h$;V7@8jDBO5b3Y8M5!79qm9*JL)mFIF64k
z2jo-DOk&*{)w+C9T(Q!x<$r4kdF9I#AM#c#;mGv~Me~5A`#3TsjRZKgSSTe3m49LB
zeX({gF#Vmkj<nrL`7F^m@cNvYI*D+hW3z==PJQW~x~l#spTv>QCe>=DSTxdRWqAtx
zT%Bie5td)B*u<}$NaxfDYj6iDB!%XtoWMK^Rng=VA6Js61GD*BE`a8&CPPvwo((>9
zmN@r{VbR{dvJd`=cP12}vbvCbqRp0)ZB(A_dQ;)*HD7uFg&!~)px-@Ve5XOia{ILq
z>M-E8TA5DU-=ChO&ME8UpI)Gr#b>R6j(hF>x`;Q%?_rnx*1=8UP8ogVkCZ=2px~-d
z;nSJa8tUmXhKn^6s0YfIpx;|^;rCTh+;WSYNJk`)*QibH11YZUKEo8lSgUZhRpx2T
zZIaS-op}9&eAdR61?+jNE7zo-nMdYx5EQrlMKysaDej!P2%&{u{!#cAsrDcH5Fn)`
z;srW{G!#`E8ckfiz2LoXSJ=PhSI$?zdn;RC^Y^xmI3402xnk+Q)qMZy89Z@o_B<ua
zRsVl*_m)w0ty{L}0umrN1lQmM2@>2TcyM=j3-0a&*Wm6J+}+(JxVyWq+`0FWI;U<`
zy?X7QTd%eEYYNP^7L7T^H%1@5_wS49p4=e#zRl%F@NKwCRcfuumho*u@_;r!-8p%n
zoggD*t-}~6l=Z^GsPbEOB?8q2A=}DBlnF9B!G2+V>_^>eMaPyOl{X=0ma~tHO$d$s
zd~mAV9mup&X){-hrDwuJ=99~nD5^SNXe-Kh#H2yGt2~HyOZ7jNtS0%Ld$%2Ij;Q%k
z)EFRWr9l|Wh$=GEv{rO===2QX_-_!yZfaUvkg3h(Jt~{V0?Vlv6b@&1YPHCYre#pb
z4HZ{{>&?%i%CuaZ9?Pv0TGKY8e}j-4D_X?oYsUngCE16WDpcd)`|R33&03y+N~Cc>
zBr`#z0xNAu1ai}1sK>wVK0FdcQd1vh_}bVLjDDoG#=$p4l|R>7c1CzIZe20W_|$r_
zD21mk#gj^ov4LO<zL!(weRB~Nb<=@zB!84run@}v{|!jED*IUz5>K4(9Y2cL6jwW|
z@aX(kz<Yo56t|442}^DJ2mg^2)`%+8rY>w|byF{j>e`?sdK7`(USBNM?`aTWizX_<
z_By{ZfaW3FZyk7#=7Btb;XT=9^Bd%2!A}4{Ilx;`3J!wzet}ZwtKnAq4HA0W0fs0C
zIn=7Kye4l|K4H@VbO%IJ@aUz=D*`59!UA0jF+HWZaAy+Mai9yl=$$ON&!78rZWsU`
zjSbvM7|H*Mk1RX2ZI#P8WLmGUvtjC0VSJ58?EFdKjSD($o{|y>KtK8?;`+Y=3fR3R
zLS0uk$88K+dPi5=xSc3FD%4z^$j-wKby-sH#gwwI6ErA*<EK$<b%o(i(J7`su*=cU
zz_C|P@4;BOzBXacmYy1sVMm)s=IaJc0Gq>yuqf*GDL6$eZH3lYP|lEJ<n7_g<QujO
znueM=+|FOCBOl@gahcyr{uuSO&ph-0gQH?mkosNK@2l4ww#%TbTfZU5$3DHpT{-R`
zF;?p}Kl-uVrEy$l9o7H_{79y3^73JcFC&inYbB0|RQ1m;#YN-=8zKo%F6DRT(x8Tx
z*lv+fgG7bTfujN#s+SoZ4A{4&cf6mgX6cD*{owtXD-I*F0+-NZ#n}7t6&AWuWYJ*6
z$*$qC=!wbwspOH1I*AfAeqP)rX42aAl9`dN*QJl3wpe@Lpz@<va4T5p6-nA~+qJm%
zlP_jLT#@R=@=uI20<Kf}moTAm5<#lle&W`cP`r@4a`rwN8Ob*{rC4iNKWA|j*izn%
zYx7s5;BSiZ`Gsl8^eA)Ilxl`TlU|Jv&@|a0A#sL>Prm(fnV7jJ62vh_7CnHUFET*f
zYZ&PUttZ#Doz8o(T;7T$-?|SQmbSm&@4C&ap;YWanm<aZ5-~hn(c+v&afJi)nhvoL
zTlw_>WyQ?NS})iz!!*h78#b}PgKp-y5B=f7l)0N@+YNDmLO+>o&l||kW9mh;Wm`XM
z!lofYa%4l^jf090KxGlmLiO`y;qSv4cFCX;SSp3thx%6EQx(&E?xjEdREt+w+Z5$v
zSN<!ws00g4=UnHm`au@%<dd|!O0`RH&)w2p+TDytnds1mqk>i}jVXF&I^ok#lYSg3
z1o&=Yr`@^?>?v#Wc|5;CqnC_f^#tn3tHznZtsF?DdMr0r67p=ncKIRfY|~z8<XZ8}
z91#kZPZO_5FrmM};Ufk6s<q=KidnAopA?SrAaTK+^z}|3{)!c`?6;3Q)&8WHxn;VC
z6i=SxR3G%ik`8A|T2h11#Gt4>LrV}^-W9rm<kF*imG1NuBL1R~V~BTd)Y6P%(WmCK
zE{I9IQu~6^r#~aK_{bFZ;2Pf~hNxq{{X0?8?wO8SIs6!yk`Q@$TzfpV8mklh2GiY9
zOHN3uVKfG{*A-lMpsVl0@X=zdSYC;IjP!tNDuU{&7YNeP+5ad~g(er$%sGuF(l)c=
zqX+O*I4Z^R*pHQP*jsWa-?Cqg7z}&Y*zoNy**tH|GLdSC*9+=<i)<{o(|>nZOpY(>
zi{A#6PR9!w53#PdZE6*{0ixKlCGYm3=IfsNr1$s~a~Ho+?@&cEazmulyrw$;2Jy~#
zuS5SlDYvGx(QTx{7A0xYyzQ!#{oapjpK~5*2uP3l=A+6K&*+P%PHd+Rohvq#=QT5x
zNZL5ZKVzgZHmoUvW<!K>8V^K-IjiGW(tova+WOTBhEWyM0&Yk-KI~&$^378=j;8sO
zx8l7G)n8*Z`oqieE{F8g`7RQMeuD(pfXR&)DWK*(&dKrNSbvb%0W!Fa=5J63>K_JI
z-rXvcukddBuMbgxEVv>p476)~d+7=##1>T7uYBvr2maJVN<NqWX!vuM4ntaAGNc=f
z|6aRN>FkuGwZWx8cCfp#%7uL)Vm?-b$p|k)i@BV8g64IPgSlS4_wIcRCN9NhOf!qx
z!cB2)veQQGCodInf=<tq-BC&j|2{0Q@jYa_l1M8fHN3dyeob3shq8thr8sV2T^@<k
zvY$$Ug>O?+;?-th`UsaJMVo@c3`xff?o>58a{LqObZd_3=x1(|k}8b#49;=6J+Jd4
z#jV^by1JeD?^J=q$yjEj6*L8a22yII{PZXWdlv=JIydD3HxNhYcDJ^Ohl#=T_F6|-
z{D6xjW1qH4l7zTYdBYb);yJ$${GbgazjR@Yn^4t7;9b)Fo8ixYbi^2UIR}3^K7W7#
z2hikJ*bjJLQR;Yi^4$>g6QI3L-Q?%#H1o#)1^)P-vU>VaCWHE5J=4qSuCYRe#1YBQ
zA*2x>V4P;S^_aLb4rgl{bA3CC<%QmsB-7>-(_+_n&@-zv@gS+VR9;t?+dA3;En|PG
z-BID<)YFUEE_@>J(=L+T=m~dl5=>;KPO#C;KQr3ln9s3%Q<8xPp>Ex#>i!$#Z<2hg
z`GtH)>bWB(VZ#QZBBSakB^J7cI}eCz0BCP}C-N4gtDl&zUS0ah?DJ%<2y^ZTN=_Kf
zXW9RPq6gVjRYw+QLn!l15_f{xaea>UdPO~k4x#b43##Y0l`qc#Lgx`y155xkEm9oQ
zmwt`0i#Os4#)aPuK|x&>6VF-h(^icK##<XvzCl({<?IhFS~*5^G{Bc@u_Q8mkHP-N
zkn_g+p^WH3pw4A7!Bky@YMLSL?Oo!do5PNmBE-73xpE?=m9rz$0AzR)4|T6R?NnKa
zT^SQ{QH9lw<X|iMlA@d_-N+XO%h-#&-=JDi^VJ!7mzx99#t4H1SsLp44F(=l$hm(v
z1H`Db%x-URG2tKVX>;9OO;``CQ*8Xc_nnW%iF9(IK*?f+%0}1JB%G6B2X~`iH^Fg?
zfUMqdn2o)q5}&(1pSb=b4T3dY^ha*C&B9h&Pq&Vi@f{K1wboz-Bg||xy(hQ=*`Y>3
zHZ$}4y#0f3yPNA*uAGxWx3)~8sNoz<0{Fgyps>-8s49(UaQ|D=bo&f0V5-9T3<j{$
zY`BBtw9ECE(1rC2<X2c(m@gd;o*&Jy&Z6?^{$bkp7q6`UD0Ke+aPMCg{>su#TT(PV
z(Rt13lL2Di{Bh_Wl<Qo6gZk0cJcKt7(yT?0unD*A0OaU52wtH(^ZMmC=>7y4Uj5s}
z42&=LXMit<_TBq=FA0nyg8;PhB<tYEl3io3DI`EgTD&Rq2=;!y0|sJ$KR4^R@N+Q%
z`vOJz{g~_=H_Ij>$%>SHzJT91bb5*crvTTy6aOVrQ7~p<Am9EYV8rt)p9uYhN{q<b
z7J%HxRO&Bm0zaKjyEwEsMf5A4mJt!S$Oz4Nkh?mX6bd06Hdqwx*nP}*bYNkgkgsWN
zn583au1hfTQ(B2^gDpOec`*77B6|k>FdYGy;j@+_N%#L%RT4E`i?4+l?T(55J~{*o
z#z4dOLgfzwD0dt{)CP2Wp9ww9*^N{o<zb$j*bCcsTqJ#!SqZ+)a%tClK>^p=N&ajr
z<4RA!=m*MZ9kzSoS93{vEJ>ahS?-Tji=TFn#rw)9=foNe$D6~b@>Ks7`Cf%%yW{bF
zWyc256G}y7qfN+C@5N#Dp>nfFgZvmwh7(b9Ne{OpGsH4!HV7IAs=(|QVcni`VsrUu
z^iip)o_HnhSD!WWaF4A0h`eW|V<}1PFjH-%mRQixUF_6VnKUfav=7&7&#XL_5{@y{
zk;Q1lKq%>FO(>UgwnPnT>E4yjXc(b;i@e6_#@SYk`lru4`|)C266vdvJhuD<Vvc$V
zx}sHiW(G2?M;!`b8wFAdl71)ZqIUIDJ=RryC}0X0cel$vgCT?RV<Mx*7OW8_)b|k4
zaF4lZ?&To2>gJ!rKS^hCp^C|%VF+9gHKjvYOByajU95ApWBOwd!<#G<d0Lb{8qd?#
zy-J-Lw8lA(u*JULVLTyXplmmVnquNHUE#49-JEOvVx`)#G@F+lj~!_!-^S)nBqv{Y
zAGYM)4{7>KZZLRw91F^fpeAh+CKpCz92?)UD}V5|f>Z`Ptp%l#vZ$H7wo!{nt@q2R
z@`IP7s-{bja_UgxiH1llH_}iLK<(TI=&@PI{Ipqy(Nw@EMqVP=4Y?OeIa`s<YYSNm
z%PSePcj<Brs1H5Mgv_e;SiMR7cJc__uRGR}eID)xeCm$dRLrrqD{FowzgnJq4B^(N
z<Y)-2a|Twom$X^sl*A66gw>72Gu50(87dMV&GQdLow6`_)`Ydbb3sbJPq^2xbrUG!
z?6poU;?p11$*-ECgQNoX>)(~y);Hz<YU@l?!YfSJj`qj}v~>47Ud#{&s}_S^pMVj=
z#OA~U7C4};agD2OI+m<)+PWfRlXntFpqu7>or}UG#N)!dZ5=eWkQbqxmPIL3J$=Rx
ze5`72hR70_TPC&0&AbVT;15+%D!3Nnp)$%R$ob}f+#7zV>?t@!$~JCnlvWeHgm|^!
z);yXi9Fx*se!}0E;l5nvzn17S5Qvp>J%17nX8{UP4Y7&WtBx)6vZwj{vZduiRq}f)
zGDq*P3!XV<sHRVD-B~!uOl-xKJW|_xxda~?u04I)0BbY;=-zAtfk4P6?@*#E(sl1n
z?;Bz*BRg+2z8%qa0E7TW_=0VzWMx4O%<VYdLwqxQtKP2&3tE~{J@k*1PbSZR{3AQ%
zxRf;OKk5wrRrjbPs{o&!)XaPHTe*3@9SnQ$DabXwJE>`jGexJW<35n1WBbvZV+3ar
z(ktOmP~J@B(-I+_SQm%1#M9#B%;|}~)qU7i#&98IPFrm~pnAnp<m-Md$xL9&^>WNE
zJp4J4*wTtpc`r&)Ak}wmpMZf=AuJW&-oL(v!ILJkbcXZ8548t{r?|mM=1q(KkFV*;
zQYu#kH#XyGmGZ210?@_MN2yH*m|m2%t*shHBFfefJfAfZ_Hfx*pYmI)Uy90OWz27A
zJe7x!bg1zHTp900)i=^y4X2J~lDHMi^-s}}gfYnfZSwk`aPNd{?J>$k)P7JS6%>@&
zy!Rd?1E47?NSOz*+VjUF@AH&@JG(BXNE+2GbDMUJdurI#vVa8!smMflwK)?aKr;R=
z4cJ8&f**6iXmng)x6J3g#uhs2t1D9C#z^u3ycNSant<l|`2L+8XN72UOv1C3!NTzB
zy>CuD@PB!t;q_WU?U+?%20JVMvu}EyO0sKQ%v=Zc!bOj(+pHDwQi}{-A9XxF#+eqr
zeCa0*)f;tcs=_dZkR9a#t@4z_pPYXGxD++DWIj?Q65SyKP^=Kfv<jO&;1Y_~1MULI
zQV04zoD%=V^p2#lA?ye<$WSGsxfH=)^3PYgJ1i!vyCfV!UXC9X&n058k*eKP%lC4S
z!1hVb)(T_Pm?N5#u%w41KgS2R1XVE7uQh6G|0Ns@AiKWa2a?*&(h!tcm8oFThk)Y@
zn)u#FznObE6!*x&Yp^23x&I$km`B@dc@f}Cdpq&^!t8Bfu5<kgd}(h)9mb>@-l&Gj
zlX6E6o2~G7nhqz(b~F<0Zo%T0+!uMp_N)tdK_;YOrA0kkh}0~xM`z!{zrl^lurSE_
z)hhY_$`oCoyd(vGaX)`R2D+Z^j=EbSpfUj3&5oetPr2^g#vB!UF~~|LWVnUIB_>lk
z2pv0_hnZ&`;2?{NN~#BrEn=R4C9<*SLF8m4_u?ZyzJ2XVS<`=gJ*e7F-QGM?3!hrb
zfkCN&o6EF=I9{3t<i<K-d$R(UglM7%v1mgRF!yx&Ytoj^6ZQ-MZ%+GgQq!b^M=t4K
z5dcoRkD2J5PN?^Rfy@h(1n8jT&nPd=ya&c_^t~N7jD=u`d{N$*EiB)8Ek_DLj;NEO
zmbRKDANFm4PH+r%mjirf>byLukKS<~((ORFRUJ?VzqBt{aTL>Wl8zNibsf(O8D$73
z#Iu2BcxUMEi)#Sb-@9CE>QsAcHy!e`a1h)!acRCFTuPiMLWxp>3I=79fz0$RkFaEa
zivp4B!<a%#<Xyi4K{pe_Ek5oU9n11JZa@f5Tf)h<$|t1eR$rD9%hFa0cX`7!$d_O*
zC^bF~H=rdZtk9g=H1t}a@S>EzIZvrsPj;mWm}w3>E}papW4Mcm=gnqIx(0k^BqpP2
zF&ofSZu|i}BI1G@m!Kh@kugncE{Os<5<ird$A;v@y@<klK;Dvi9Y{$zoVD^d8IEWz
zL%w&zy?Lgi>>V<I%tRqU#q}!~Lt;PFHakg|!WaiUm|T*;LCgU5%Ut0$p>+9S%HdVr
zQ~e{FMSSQc<}f=QVBdA%@K>+h|LEPoh}g1ud;>h+XF1On+OhNgHwX$HqO%jC+08<$
zQ6GeUz_)#Pn0Qe6`3$Gejqr3iwmsx>CX+gxpkmRpT1G(mbaVDo4&cv88^$C}-H{2)
ze)XgjFi#O7m={YO>4Pi(-D1^OE<LkDv1~y;7sCh?nH6T%8hwYsrRAAb8-d3`pn-w4
zL=2=UM{&y5cYDCgg8u6wpz^gUVgMnSbiU<MTZI4+N-S@_B_a@Z(0)H#aYny}Q(z+4
z;$x78yIm|T=WITBV>%zOK<#W|1Q;ud{GHUOxjOL@FNypNGXgAKVTUxSKybx|>iq`k
zK6>9U@)MB%yH@gl@80BDo$wt2-QO%-UQ1O5Y(67*Ogs`_K+Jq=XgjRdXEetjp**9;
z_4}8~l>{;M@4fS1%LWaXr&l<L#%v$LYP~*;E)*=m5=XZdMW;o>euf=)Jq3!V&%Z%%
zyvJaFfG3kH`a<<w`Gg=0piB{tSiF3(b6eti-`xh4HwCy6pP2yLkQx{89u^#(UfihE
zRDef3uU$Wso9D?S3^y;r5x=g*2J*eei&^D`I#?ihK`A(wm~Xz}yw#w1NFS0+IW~&6
zipgUlnf0ah3CXLjrd($NvzQ4{<3t>>FfD5v;nx|mI%tz`Q*_mPQlI|$=8vX^2xuY%
z0PfFJMb5+kZp7>m(Ve*;sSX3z3Gt}j_0VBlWP;L*z58ovVFikf8fgk+48Bc#m;C`7
zE-1Kr9qz1^t8&>~XK8qg#F>N`FF4=L^Bd~Jj9k#KC5JkvkkRvN6g6deUqx?se6Uh}
zwoAdb(rn_IShk`!pLIWZ(r`QgkUmYqX#6M4)PEF{|8M7N>X{+Tt7L&KO|bjXxp9w5
z^zU6V2;i2@QSPOAzuerj?AIJtuW_y&B^~28!0$oSRxP=C(wKIq8JyCLBvO)Feu>-3
ztC&!pxz&)8N9G)NjN#fYdYapuZgm^gc5#T1@8314M?&L=Ao9gHbo<m~QU2@Qso|SQ
zg3rU5LSGICl9m)araVQ3P$$mD)J2Nf%i3gmIjv&_S6ANJPr*>syvS_1)Jodp{{8D*
zAIh&ZuO2xc<JT0$y_Li#j2A)QCNcv&fGFyT3x}k%GAi{-)Xl$zT2ZR0EZ1of&<t9F
z7d8vD<cD{y>6}lZK_Z?Zl@e2qEn4Qin(D*YH;xn3o`@f3qUdW29&?_O1UvXzc*xAB
z#E{G^Nb~+yrO{+uHoSy2@ZC-$zv3rMF7RyIJYraTALkK0aZo{d(cenmpdVT493>rm
z{JSI!BC}jXN4ya>uYRiYX(7E<*xH})wMx5ypT~k!Cy0DH-zY-Jb`bxzBz(n2pHljB
z-4mfb-_!lmd_yorBu%kUqx>*v!fmuMBA~4Io0O0rN2QzuTH)}o%|^ut6>`Ety^4}_
zZZrs9{cFV$TC+rAMYw+OWRrzXO^eM}zt6M!*(t6j9Co&cOF7gZ)oR3>8XPg1<Z)F<
zqovFq?7>2b9p^;5YO1^m<(r+}^`|ai(wAa=6D;YWC@5+3azLD+3~?$s?K>TIEn`YE
zz5yfx?>xW<$NPz4Ax9;>3+SJJgTw%y>jBU~>t!K-`5T;8AWkBZpYB(5Bt=$TCN_S8
zp%N?g?P;%xBA@M7x&6*QzN5Y7k1|bDk#nz*WO35Ms9s!$nn#*%Y$l+LpgIhH1pgRq
zZ`;k(M&{clqR)|9FtWf1Ft}CFVA;fJ#X*#BaDg1b0~ol%Ei6j7{Yp<j59<mN7|gF!
z{rR_V@RtJc@<qSiEcQzru{b(YM%E-uk}w{5&-+MoE}Pp4t*DSPIyx)VO<&Xz-DsMq
z26+k(KbjH@j`)giih0>oRQE>8&jZIQ4kN0RX)Mc}8vcG8wwc}%dFvjp7Wo&`rAyLf
z5O14_@||ZrYR_C1v&WPNRE$jYFn&n7Y%?<KMA~acg;+8#=247YvU-`$MDukQbOe@V
zFxRDs<tB$1DhzBYEs=%2gNz)YY^souwM}9ff4W8A9vZ2dP?6kNe}pG`+OtThNb2gi
z!sNRho!jPpW0d$Cg!)8qiY}*Zd;0gpYwyf=B}dD5LPQS^qRFeU-UmyN2fzC70w7Eu
z$RYl}SjYZc+Z+J`a)qUpjD}0I!C7ST#PwdT7NxW(QoSrRV#~L16OM6j&L&}yLY%}5
zK&DaSAM<09C9IQ}=~2d9aK=I;N|}Mo6ZeCRi-p;a8m<S-n1dyMk}z0qknlBKAtxP5
zr^?hc#TaHReIyWp;`H}b27Y6#P>p-deyMxf051$-D<wtCkD{+8;1g_r*W@i&$vO;F
z<S>Hoe<x=5PS*(uxm>v5;4a0`NH<gn%juKos57I%#B9ps|67Sw)=d`Zf+qcvK6G>P
zw7wYGVS7hL#$IyE=Dkq%GKN;=U#_+7ZS&W3zFODe4dx`uwV<&96Vg*H^lWLGC6y#v
zkEb-3lq>CBa_2`JENA<5EuOxfq?mDWmNtW;6<S$AHEmvyitINUif8eRe)1pH;_w7H
zV&fv7RKfBM4Oih~KOt$7LW-4oHxFA$_OwOQ1LN}9P6?75wpyA*d_TOQ4$`C!hudP7
z@_H6%dzMQ3L8do*qj#?1MRNHz;VjL{>O0qGNY!wNu(9fkw$;@#XL%{aTBh*q_^X};
z!i44Mfuly4+jXb&;zTC-(h&KqbEC-=EkP-1mF7gjD~=H~i@d5?Ye)fjrXlQ3hy`|x
zk(C3sC8ee|agvNxF{CM0+l*ukw;9!1r66%4(>KPA53vbfrEu-LJ{e{TUc@;R%xU4Y
zY%Mp5_;sR`w(3%KR<QM~5w~94<uoXdO2mbdQU+s`Z}Fk1tpf##Q9bR6Dq62Dg0g2+
z;MrL@X;Y%9RZhGSLiq@?EKLn*@SNRURr~3>ysdr0SHT2C%VxseY>WAnyR-(USg6d_
z;F3%s^{l;Cdg&;Y3x^(sx<s1qvR%fg^#U-nPEQM!2b`w`ZH48lrQw7)$V$9HIc?Yj
z>v@k^PZ@y!!I687a!k1}g_%X#$)7t~?YCM1y!-NrR|kL|BuehUGU2ie7S_moI)nj7
zN`ThCzskS9<xItT%721${40hm9&^kO|1}Xk8BQ!a{z9PePaK6GhsniT;(5ZlL*Bft
zKQ2q7ds^aWNzoAbu{?Orrkrp!Ez2w4ZT`Ir=TtxLp7PT*KcN9{HbaKMd#`ib<%Cm>
zc4T+=SEa4lWLC>ZDBCzK=NDpDqU$-ppGblmLm%nOI3EN*E_{}0xzEpj@f-6xi(FMT
z@jU^^(x*8*A|xR_r=)kbH0TFqF6E=X{P4m!gtf8|+RiX9aj&G{j$A+i64Zv)dWH<3
z52CN$qJViiBFOE}noX3f6zy}%Te%^ML~&)ZPrYxU$Wk_M+sw7(y{ng?uWG`PDga4d
zSOo0q`PBQ5s@5HqEH6Q@?^GdnqP9wKwX-qP8I#L<tG(Y*<|{V(o))?oVmq>v6#Sgo
zpC$hV+lgO8=+~|_Un$?gw#3+Cz3=K=jOU51{is)+bqXwfM-5e)npi=o@2pj!`Yjq-
zS?|^P?f}!R$1XrqCsxVRT9+}to82f_jXd8{lcY{fEh*_mT1<1|=!JdBA(hA$H6XSF
z<bCThY(xBo$R)Kgm+_yU_Jvn{7ck~sOnS#~H1Oun1DsAz%&$iK@`~q|bMYys()<2g
z8K4u}L;e`2{Yk1QcQ-=3f&S=AS~Ot3>sXG7$cmmwX*c@K8TaIvPi3Z~)+&+VSxs6X
zi*O)`ZH-U8&ZtO6|1q>(VNOO!3-5t-bD7U99Qoe7Zatu&t~POFMWmaBmY={D@Q>B_
zu55bcU9*=zny1_{PuzlerdUdf)^kyU#Tg!Fq_8V9JI{AlMzmtSdIA37A%H&tA2LsZ
zenw!fOaY&5*QJ<v^%+=MY+eGRUhP@<UWgTd4tm!6eyH3Exo1G4(JU`sY)2Qw@K)GE
zu%s-e0t@zFsD2!P3Mv#D|Mu7YyK-HN{2vzwDyY1_t&jgVk44ry48O*x!{Y@z-8K|w
z!`VK<v_ZNP!g#v!-0mc?A*qY%i?d9rn<Ibj!RVEfhDOKIO!G9K2<Il7M{9cxOKdPm
z5_o}mp+Orzdz(UG0td0rQ<@o)pnhY<&1pq<;_~2dFc(`iM*n{0&9t0To-J+iQZ7`!
z>s;?CcYc&~cXJf_F{X2(nUxj&kFI+(PGzOSAQrqv%x^J$@56H?o}H29v<HwIf;vCy
zx2<YF;s1D^uQYdi!k$|<eG2!Nto2jfPGONn7i(JLDUF|H#(QNYPjTrAjC>QaoWz?@
zSYYl{Y=vMah8hjB*Ibb;(P#LXh_$9Nzw{mAxujf1sPK|D+k?d!UoKCq%MQhWkD-#O
zV!Ic2H{j`O{p2WF>{p0}h7a?Im4UZ3MQENeJ$T{83EgLeSxOhP`9WO`VfT*HPZ&Q6
z)l2Tw4=4M_oS#JUKg`g5NMtXFP!bHq;u5X1Q;+ob&hM{Y5ka8+Mkcb-bTejtn37&1
z04e@K<SQhiNgs6qCHy-*&s|TeqMyi%v*vE54jELbHbK@ok?dRHr{r?BnLkwMH`3LQ
zzg}Ye^l1_OY#B@Z!v7njK6{B&XXKbaWM)I3N*e$|F==yH16?py{VF-4`JQG>HF1Hg
zaIUr!smOFlD>(PZxS`6i%GM#{dvV~lPB>@3KUuW;gZ>d3`}@`6<=d?mEuy~r1~-=U
z(PrpEve@p5F?=C2GDrNIiju8q_{LFZlmS|klI9?ya$c%f*jTDbk`Dkf1)`QQ>;!<g
zjD2w6m=5?A`4WKQ+%uoBSiGNa`1+fvsi4yT>BnUqDCS8^{n2*}58eu*iDHq5q!9dQ
zG-$3j&@JXv5HThrvLdjMnSXJvg^*GH#OywU>Cpw1u)M$}&8TfvaFmjmj4?WVHCXxP
z1MFO~f!(71a<HajrBa#X#CtPktT6)`wlrAzQXEn;L*!z>l3ev6Nu?uDcqCPxlqRYs
z*4Sz^&;1+3i+O%Sh=-6(&a%i9Gn#+h_X4L6nx$x>TpiL0i^!OVnuA6N!DjqnY9Z8k
z>`%D%E)AlDy4N`MTq2z!GBo!cpKc(=d0V!`Hr)Mj#fHJEfqI)Ab~+r#_d$HPIV@x9
zYwpjD6-!^}2~|4<Y*rx!{TS2skF_da$T<bfd>S<c*|-dRXF9g1F)qErE{oCj$#$LW
zTHN9e!zZC_LUv~Znyq$I#UupCf=H6zwrh*sy}3M<J5;ZzaW5CLG+8%ftC6|$Y&V7Y
z#?wURh0(+oTDw?5CXy@`71T+#Kj}7&jB!Zlff8Cp*0_`}M#=*LcoW#)w-e82E!YsF
z2G;v~E#4WW3+^y%XPBo~hB<zZmRCbSEemFYUU$YrFX|*1(tA)bvfo1FoW49Q@Q}i_
zv2EZ|d2{^$mreh@_DWX6XCtoV+j6ZgitT|tKRP#;V+lnu?$?vM1vacNLE(Nas#Y8~
z94t%9PH`nYr5d#t{YNDynG6FTHs&Kh#2YG!S~@yr8JIt3Dww7Cx!H;&1MoEV0dJ@_
zxBP$BEXqOvN++I)SNN2U*C(QF(HF9NzMD_xz#Q_xJHkOx76ziy#qa2Pq>j_^G~N=P
zF&#4KZezY7u=ZIFW~t#F1&{Y)xs`!LltSIraxi|b8}3$i$~FJ2*oSbUWOs&2WVF|y
zkIF@rM1$k%5+{ITELWlCsyK5^f-?u{w-WXIGIi;w-Cs=~Nng&>7C4I5JWIf4Q$J|x
z`Nt#;O1scy3_Ng7clN&>1<xm9G4_a}rTS?bD-khk$|aNK4JD8nWLNYPP%LOppMIjx
z`$%1|`m0M%alI!Ivwqz=<#cHlv<N>`hNz>=Hj~qdpnQo~Rm9U~F*{y^&um6jH|7;g
zff;_ty64QP5?sc-oXgVMw`|RzN(gkfk?AHD)S7~u6wxnJk>J~yT=UZc&DPVV@$Qnm
z`@*HAwTCDL+EHm~tqEa_>zUr^N&)$NnKc{X#Zx;eHIgHj`R6Yehsh2ar&76G0zQTi
z=c<G#4=v>`-}~%;$z%;ji=yhif&J>UUp!7TU%Sdn$2vu~Nkm29DO1kF{491BF|8q3
z6BETK3r%{gBN`M?JQZ$yHdU=G!uC)9AEJx66`-?e0^}6y*<h9_IgRk4DS&)KxW{N_
zYeiQR5X-RuxDsHLYr7(cbX2#Kn9s}ib{PFAZT+<iD-E;lubyHOF>N74zM2-Y`Qv9)
zbWBjE0pM2F9=5xC8CaUl*uxa*#6>^+po>IRcbVTBO&g~!LnK5DMZzEsMY-m~%Hq@^
z>B#9;D%q00mM~_HnL$2lm9nNuX4UhibFiGlLxTL`H|VasttNmeKq+1~rp4MkD)dFc
zKHL1G%^OsSf|XGrXtI~Z&H<U?EF^m{3eEZBmiKwd%rrBB^A{6V15@wTG6CpjEw0|g
z`}_Ve{TL%91o3`OlPI}!r3w$T!lgA$4YAmykoQ*`XI-G}>nwOT$zw#W2w_wMsNE&T
zG0O!?=WPqehIGBUw3S}$R?CiWkkB#>EWFuUADLf8rZF2<p_Xf}hBAJfP(kJAG%;TW
zu+<3M2|r)Ku4>v9Iw7;n|G5LtpFq+7IU4w%Ol$rt6cHn{^aw_}_F74ZQ8x=0u;Z_Q
z=u#~%YN%q0H)!GFqzMO-f4lctkLU~e%#*NGw^r!g&$Gz!ux-9g`poB_lO8(kILjD(
zCcuuVX7{2d!uIM|Av?2`DNCkvcKPv@bq;lJ3q66lDa(M6B?d=L=p*)r$hw_&o{RV;
zbC$ETz;f)pF9Zev=}x6$*6vGn{}4%#GWLgXe~r!K;ef{+`>k)6l}O4SZDBW3e6ng~
zCtJ<+kyceDG=#8(30RS>2ulj>xrM|QtQ;-_s(^E*Q?jR}K?AhWTS32f{WO_j)Y9#k
zX%~lep57Z7B1maJZ;jp^SU!|b^C3zipwh}EV}uZlx%Pk7nh0aTQ@g3LKo}t#KMs_(
z$hzS3!Gw*Io6A9@K^TBXLUGG<JKTKv@^cY}`dFidc&mt8nq>B_YG;*Zs>~6ivA#C)
zXo;gfC(EF#Pw8^PcU?T@7Lf;Dt!gCe7!^QM3k!5KFd7K${8|LwY-5b{VVLM3ODkf`
z-Tnso(Gsu)mr_j#Y4nYUZr1x@CsMV}>BHEMxlSrO!)3)vg9re#O_5v++k)?^6l%uK
z*ou42GLSB?>a=bJ#n=}9qqb~c?s;$LqE!;{=-V7itq04LU_yJB@Kj|W9uU+^%u`aJ
zzPW}`5ZSLhFXR>Vfpq0(mCLE8_hXJHv*8$bL*#@pVt)R68iVqeb|OD5smkz(J?2AJ
zE+g5jS48`i*ZmNZO9osIHjyP(fvc-<xM*<#c6~nTFznl3W7U23#o2gEHtarZf!IW6
zXIY3A-fuOQtlTYzwvzdkVr-*X14*wS3*x#Nm<`Eirv?oZM*WM?JU2CWVqHQs#H*#m
zs80;`kdyOztmPuV-&-h%XR7fML+)s$I!Dn~<I|czMG1|YLiVn`tx8L9%|{7otrOme
z{4sPMj#Nk95lCw(;99VTAoD&ELI~y<j1j|A86wqpGvw;Uv>=5BjVChyIteuiu9JUx
z2)bHPYh|-}K7^0um2cNa2R$Q9LZ5h{{fwl_(kT8q<+t@UV)?uE>f_8zx6?#P{`Q(U
zUH8dno32kP*>@FE-t{+kwV`XTq@SuJdXgv|0s{HIDkVnsUiR(z+7(E(TYk^{4B>LP
zKJUZnY2O2-kSH1R?f64P0y>CEBAUr<J0sx@FT8J-a${4%9u;~+795BupLdH+TZ4{R
zs;@Ifz#@)lSTk^g=xfT}=_ik`V13O95iVmxW7EeN5m?>4=Pe(ua!Q$~ui|uDKL*<k
zc#)MT)07ij7r*O#mu>Y}Bd?u``Z(!zJ-WzY3nsYM5)C46OZrM=trn2I2=#GDF9Q)|
zO_;FPd{$g(o?<?RfC+C!SoE`C&vU1A<NZ<_O`Yrd%P_D+6WF}snnLBQZzDf$1MTj*
zyj({=(e(h(>9*(nK_%UHe&_+a9IW5ZCZv`edQr`8E|cMMHa=J2ehoXNDk_#{A=xH(
zz--!SP`>B%KC76e?X+*m=ABcXUeY+O^&?Kk-%u$yPNC&&D^`Xu(rE-IbgSZU^HmZz
zherhX57@}*P=4=p$30Hnu(8jOtywUrpRFA-x%gEb?oX0MBu_J{h0A8B7o^}vGi!25
zn2eDfubFEbom*T1HzAX$J!i=HY1Wx`)QzhATHWDT8ZNH2{t+ohsubmr^XpUjWEgP(
z%)Zw!%}nhoD<adJZXiEY@tG8^aWZtO`A<O~h}nC}*||;a3Z0|@M7%b`F=8ayJ^&3&
z))Ph#&Ij2lFA)TlZh51!tO!peqd5-X*{ff>=zL8o;Y3L9(t+r=_djByN%H)3Eqm!z
zT|YeavoUJ43C-Z$Ze|j}xUINz_CxI1+D9YjHMK;sn63{H0eS$Jobwkm0kcL<tDz_g
znf**!=B{GaB(vIT>_>v$FE%m^8`q7{gtIBu5$-kx=3s-td;4?L&+XEzn_g)%%ye*j
z6XG3Vrle+PWGg~VJsw$h-khMeA~iEvGx$O+shwrUM_vzBfeDynMdO)TvoltilJV;@
zavjHs(W#7YYjc_2n-S79suB}Cvj^k)sKe+2F+R|uG_rl05hCuHHQLKr3S62zTMR?P
zQAq@DQTZSTCtQ*ElyEGk>BMLekA!QcY+FD6B8@ILzGd~}k+{)M6FnF3cHRj_X3fx*
zg-5J$dF2gUn%3BgE7FW-JRcp?DK#?Hnv<kW<d}`VM844D1Hcg+XtCv@BH5KTmOVjT
znL;quYCZNH%rZ&Y5hr3$F}7qL8SG1TP(O^$p=N$k5Q{i2S+nc(2Qsd&KbD@q6-IfP
z)1<@nHZTe?U)A3kqxIoMB|*XV@TG$s=C$8XTT-ke*tEEK>F}}IXO1^hUmw13mB6#c
ze4So>&HwS9@~x8(6CZEFs#+-KJbBWqE<aw{b)+ez+ux@CduQG|IjY`^ygIK4D&qgV
zV1o|-1`PZwkKKUpq(2aQ6}gYN*O#b?#!#~hSuTZOfhj;yEcX)et$zJ@w<3)@O)-VN
z>YGA5$sOJuD;Qwjq^WDl{%i^pH`ELF_u)+lgKCLxqR8ACJ6KP57!og)FhL-HvmC({
zH)fn+fsOy@+2B|N?q6S5pRSv>%2=%H&q9;uRl@hZE&Ek&6sat`+<7qU!opazmbNP$
zD{+>(FgiVDqV?%TbLg5%9+vQS@sRVjy_BX8x4Ic&;~rz5_sd%Fb@>GRXd>?S5xZrS
zUKPp(lBQ!|`@yD4`xaz%`Fl;vm;-br4JpC-2ew~(D$BD-bLLIse@qo1IY`9iV!t4i
zF(_Uky6S{_VQbcHYnrwoNZaW-_0ODm(zMMv(uojgul2};t)_?(8h=LPJ(Tl}x-U(R
z+d>>ld5@SUf~5*iW4*#wg*dnY5qVpOd!2I*1^3{htek?gaUN_Sk)~trOWsIyw2fcl
z{+x2d&<I)O(19XUyr#L_A4}{TmcETc9CG-egnn6GT4Gt>Xp(6A#uRIhR)|p48fA8_
zl(Tv-l{x}jE{Ya)S_)DIPm}~&1e;p)jY`5p)TZZ*c3po&RknQ`JS!ZLjrm&Az^1yH
zUcd-kk!c*Z@gqhE?~hgWr-sl}@zz>#y1dwrR{4!dx<e5P#^QGnB}EJAST65@3Zc4o
z${!d71^bI9+te|{u0%EZC&+l)Yy0FvVMOR{aaoBR(rq9ak_ZYAIqN}XR=AYdY)fKK
zD;vgR#0!>)()MOBE}z9ID3_ItqzKF90*k#LryEUDaDQSF+84C7?GZg3GdMkiPko9+
zz4|Hbj6veCK{y5UQPk`+d$xX($d<^n%EpCC!gkXxYh9nngGbVS_@8x~?8(J80+kEg
z(zK)4t%ZOsT7tY-7ik?x=O3Z20*Pmo25y8)nSw@TdA#f_ByD<}r4><}uz9CMQR*07
zYjzxtn_@>k)YnYOy4Ko;&vetDKT_g-3v7A;=qv&D!q1XDP2kzZB<JMoqFoo>bYWAO
z9J2*X%sVT>McpkHk$z~{fgLH3ArW@h+wW4g7SzMO;zB-RG%chTrL2VHepl<Vtqj#_
zOCO>o)6TV0hX$te+b-H;ikO%$(G)-^iyMfIFO7v}OP}HlY-}wo19}gLV_EeDAZ(*X
z!azA|48De{UVV1fL<!%a$gEb7cctrqw#~Ju#{^ESUl7ZQU74l@=AyJ7j6Z!^pq7AB
zpt-p^#NN+%Gk`wm!INipAL@$sNc)4x8%~<x-Tf&)#<_=-#hV4&w!El2ab=zX5Ed!7
z7lyhFP8V+~&wQp0?Fd0fisABA_QxiH7aIBdo@TAPbKcKQd+%e*{X4KHc9pg+f+F6K
zz-~DN8~0#GZw4`ZKKAVcaZdEkH*mrqEo&}k5it;XT(G}LQ)geMXD6x#mJg&NZBtwA
zV(<^WT1ZI2^)Zi>;u)%LXFj+U*~s$dvP2kcwo%jZs?l33t9)ilrDg=}1X6o8!+|`!
znCt1Nu8d*~^ws8El&;|*y>X{zxFxNM%~6+y5lYBJVmYuqDzY{*$J5&JrwzpCh(TW&
zww>i#ysueQL@$;OmuA*oiwu_Jv1d`M#D}twGXJrvu$baf0dS>JfU{>i4*=-}KEO`R
zG+b)4I#P9Eiu}8KVuO@b>{*DoG{~}-__&^j4Y3@mpC*`ubrN|7;4}M+D<f#v%s!~*
zoB31cP`zmvha!r}LP`stm#)k1DP2y`#gw}znyx15Q=!>3y%m6ar|nH+;U9<>G6a<|
zhfx_BZD!%@X;am@5E0-NX4?Xj;Yq_8pDq81N#!eUQ!<gCBSq6M;s}F@Pe?8m+fp+h
zW~?w_Wf2^$cb*pbh$6D1oR^|~?~+2*xTvg3#EKXC6M>bB)|yxExiaZhZ?ysHvci%T
zGLoR-Z84)?<bX6)g|-duFO8M_*2xvokNr0vM_mt794o`=&W!6KtoC(kBc_rx4GjUW
zk$eIcjEQxZST6WSD|HU?XkBWN*4Nekddsuiwwka#+LIU|gxjol2LQr;{hWzX;ah1@
zVW5VyC$gjg15YSTJqqT8EhSSH-ZVB+*aL|xA-KGl_eCZd6+gu3JR4O@?M@Jmt=15+
z*m@8ZMo3wQ>-J`y`rAN}5|~0UyKGL|<2SpP^k<FA)zl`eKI)erf~itvryb#oPDZ6{
zkW&e_d;D4gt?EMy>INHGZIcC0S0fh(t_sx;Sutft5ZkIn@jC!|0Y83z<@a+^=h!E7
z)}4Mf8eL-3doRUTzJ9wSw}`ef*2{?L)9A!)Gp)|B`Id%BS~MC_KM;A0lEIO^AH={6
z^RpFY&(G>18^j{haUq&3I51BU6ybfZTN>_4;*`MqKK!y4d%sSKv$hf`zJ80MBU|+z
zBg(`b(sr+7)Xd@forWo|MQcOMbyHoY-5@biqT#&nUuH;}B#X+n)#CNETspJh=!&H~
zmUWo+=IpWXU#GnZEogdh&x+mcZJ~3-`<f?ET>>mSZ#SIA9287BHSZ&w>2jD)7$)Kd
z`#Es>ct?b1YB##4=SWr<Y~x}MC(J?n4mucZw|(WU_0O2LSHmZ~_HmsrrB(ejoCNTa
z4H+C;H4$V{XQ-J;7v;Er*PH%-FhGEU@8i2diUK!B?N|iX175ClZZIKq6s=Y7;LeP`
zE#7W54ly5|q_zI!)@yv*k}{t*EyY{NV{R9pOFo%zai3Qd(VP2FBB|3xuFPZ6o~Bqx
zQ!$XBY!^s%)xMLnWz7C2)*V6v#Z<knuQ*-B#!-2rjw0~QRCZes`!03gS8FcYnYHGk
zR$)UullUKoGHrNB-pK01t!1aMxt2_OnsXH6(8kRT(F0V5wzH^msi9(B<_9dP^K-ez
z8jfMiZ~cEhj?<)6gvo{Ho{K6Z)`@p3ho_1vZNz%l0$TM7o%xoq%~pUQMvMah3Q4yW
zd#%MUU+;@sy56EI=r|`X1A&fnTTDAP>)_5Ky~VMcXc)_EdM`||Qrz_cELf!ZVE?7z
zU0Vh=fr0;!8bc(+qhjQ%Me+<YGD_X-M^AY2nj!SK5~+T{L4073H*#-k4{gHvmt%}3
z-vY)l>uv=;)Ev*v$bIff7%j}0g2N;>+{8U31Fm1|#3)9QJf%$A-MF5k^9xSb!(}yP
zW5jWL)TrG)?gpb2#V*0Zb2coJNi`8`A5Yg<*D27AS)pvQhw!~vBxNt|n(&b=3{Wkc
zjkrgK8xq39Gtce$35YL(f_D?HVDVVLy+TiR48nPif6uq5pPxx4OHjrPB_Qj6SjGcf
zDNM)gWe?P6gzj2eTn*DJ49q@YVXxwLVu5acgVe^9W?JdDsJw>oM#y+I#fqjHNk~xq
zkc(Dd4xmb=YnQe7)Mn2Rs#25vKIb6c+WH6rdn8M6)8uL<rG*mgE{za-Co{&fJ~{HG
z8y%?g=2||b4w+8kl;sApNw(Jd@JhSeb;n6g)@f*@!Y7Z^mfAmW8Iieai(?NwZ{UI!
zo2Hp1B`IsuP9ygi->vN1zkM6T)Bo<}qw&RE)J{LYi(tSPmz82!=t-CjTg~y7%~#`d
zxfDrvXOnA6mox4Y5H6;oY}-#MCM`bIs#g6q{Q>UFKqsrQ#=$};0uhK~fa4kUAj%x_
ziO}d8Wh`N-!nQF|W+Af9UFv7m)W#LvGNC~t`7-T^D@#AHeRi3Kfl5e7_fT?!YwVk7
zEW%{kIxB7tccdCU_Ruw06LCC;ytGFnRj^AI(pH%8b50`Q$MsiUgr!gX2ggD=enJc6
zAeL<By|!FEQsLBB($uui?<XvGh`RH<kseZ*p<(*xuD69)od)sXf@dwcpBHlF`0+)O
zHpfKz@7A2m2og^)jpH*{U0q0t&h>L<9eB*8lr?^!uHeN^`BM)4JU!xaU|9nmiEPO+
z$6E5&6li&8gZ&*1<&EFhxTt#zTpNUA`F^NQwdm5XUmu@^-a$d~utT>IhJm&`<nk?&
zn$ydgEro_dW&JzeFnGi~+KN}InzMmP;jQokzN>~c#+in;c8d>qu~)36phMHG`Eb8H
zn5aaKqma5<<FdXD-*L4|9Q5{L9H<jQ4!q4v<o~evb(*_6*^UBQ*l4>R#Fy?S3~aEa
z?1eR-oNl8o@^(_}%MW1lHt~)9d@C1=FRjy+82QSudP~2e8;B!0pHa26&_Pa>fY>Zq
z2fSSl%+ICVD9x`s9ut0p&N$bfm?vR!ln9iEm%xL4PNOl!$W0n%@*LylxAtCiKU>>_
zR@A!}U|V{+t1X9U0y*xOA>Jfr5Tpt7j9m}sA*YB-lfz#lt~DOZ)L$6;L5|t%g%?pB
ze|&?mV{pxvZl?@>H<w?Fx~35XtZ+D9=kEp%%pWes8}3reh8UCw1tTHj$@JXzeGoy8
z>laaGBl#35L0<xiM&+wLx@yw)iZxxh1e@XFLJ1a|XpJ88CNwi{eQh_}OwF;h6>DhS
zRr!ZLV9PV0@9foD-r$W$xy^46o79Kz7|Tn<`n;cb=AV4~iyJws>FstL&qVS<`U;qZ
z8%!{zTcg8_9{J`2hX=-+eU95PJ@X~ZDymis)6pnfhtoLv)hMD*(4OWEcbILq2DHw~
zXZJQBr5_Vlg~JeU-LC<U>BG%*^8Cmh9C#n5HDiwn!L{0v2zcR$vS}4V6bw`m!;Q2Z
zLr;tJD8U8&pdpFY1{7Yh=%Fj|L9VLhu;~Q{_y|$$FbAI>;kKoX9tH^Fe^ga|QY76P
zGfv0JQ3@@~M8jpjgl*oI*=nHZ3j}tJx!$e?ZV6|gH$*XZK1KwroUX?r$=q91UW~;z
zdqpSC2<?i6|H5l9q2$OyECJ$$V+;l?q60vp3oacue`pIQy?2Z*iC&$*1D-Dxk$=V%
zdz(pjQgdW6Z51~>dNo;)$i$By@(g_3b1D~FFQwpSSR^zO5*P#@z0iA-mLn=)d)>|j
zDl)VEFmZLZ2vz^9@R!W!inS%yuz9M*-5AKYBmQF3EXaSP`TueLe?s;Dd*uHu1N?W7
zotIy&@4i(R6YHcoZ8aRiA~5ii0&!MN75;VO{;ou{+*z9@RGv#eq%`)|2ZQNG=ZNT+
z?v{%=1*@S9X;yy;#)6h~%Aoxab#C&`I9D$5Q(t)t>H_fKhT-|du4Z+j2tuA8C#v$!
zthLeA*KnMi@oBefbrwP|!%_VsJ39&5+2$CuC8<$pMc+pi9(l1ViRJWA-kVX}`S$_J
zdn_O4QXkZ2T`0kV00Ve|{#a}58~7c}v!ECIRn^mit@c+ih5OB1Rx|(@|6L=3oig6K
zq;y-}=&NNEW|n97{KbrLCG*9tiq6C3K5w~8zub8bRARUk=wvf4(||F*qN<_A?wT#C
z8-Y#x`Kq1`IU6XHcs%HG$*gb}zhG2lv~IKSUou1Znr%z^Qxt>hK98B6^g#>^Yf?cy
zFYcsys~<U7i91@ca@E1Hp}{Joq1ejR`xdkdsef_18_<0J61=N?a<cKWUc=p`*S11T
zjvw=5nQsVXgM=gcKkgpzZ|5Sm;*D-$AoY(-JOITf#|Ja)Ym}UbXc1t)8@`|aZx8)H
zWGWS?LYKWQ0w#)%K*ZiEn}`NozHt@o)9IF@k+_~_#VRrzqjz7lN*E_ixB+c~FLG3F
z;xDpi95gYQMBnzicZiQxEbbzgdUJZs$z>T-Ip4>X$DQf9JzdJFY7v<*BXVj2aY_1M
zb(%FQ_a!mY3(XitFZ<A8Uk1fH0d&h2D}!Y=Nly3Y0B$Sw<p<rB1p8~E2iRgdZoQIU
zXIN9Bj-T<rR3Uaa3g~+^RU|M+ApxS8hFWBL(!Jg0oBfqZy~#>?4Vf#wSS20yz|--y
z+(Ukx8W+Iine?koiVihx2QB~5L_S#tOS7qw!wej?PgBez!l0_{VV{+_S<Z?Er&#?M
ziq+UP0u&$@mU;dZKhj{-grE{0DFzrXgJhd8(Vv{Y8@ZBK56<`)Qm<13HWbv~A8ygS
zDNm9uQ4>5OenE(Cr_J})r||UEIz`egQ6<?8beu&^<V#^j<x7R;*7;TsZ^oODi$J`*
z1=%a}(zn}rPm#vtQN?`pEVO--K9Gg4w2X|l##*G`SSR-;2_Ej}H>WDi?a17<`qZ8$
zgO3Vkgs>nV#?C|efxKT|(8*iPQT;1mM4&*EZ#M^Xd^`Vpx#>TR{QqfaFtybh=>5a^
z?U<-&vC2V0_GXAnmdQ|+*=2{!1msBCtI+O=eHQ*137Ms4G3KH8c7q2fv2c^n$RTvh
z8i<5@il}+Z$Vqk8&Q4pcGtYv@3pbStHZZDHj|K6s{CR|MGZQbhaaZUN{u_CKGlVsC
zmRuq7RVlunt(Li|`j=pM8=NOr^XLnuu(Z%TB7PcC$tk^Qqgb)sn0p_jBT$1`;j*e9
zUAAi1apbMJkKJE)j{h?UQzzyYYaAxpX|4=nVBOxKlPy=jH>0UO#n`iZ5o><dHmH-S
z**}ZBM%C(%C|5sbHDhV9e-U#lzG12R$|GTZCBl5ke8eT35-&?tCe{7#)B0bpk!<?d
z(0ZdwxTrWNVQ?yhp5<-Mhkk=RQ;uG=rjc`1@N94yjBTT73IcSuR;K#G(uJw|Q|o}=
zs51t?WZwTOR=&H;WuhLHb<~xn{t0ZsHeGA5kRL`wP6o+sU@8zcEgSXApD}#@u7o7%
zu55ih4*bj<Q6eqS8w&+~END%fX0&UKTU2mXe^R1S0E>v$0_6=K>Z}XrnQK0P%Bsy$
z>0<9gx4>P)YkfWJOPLC*K_H~5xM(l6FB)KP)a`@qs^I9Bb1Nl`;H*lib~X_bMpwiQ
z1SYvK|5zX`<ot6|`YZj=@PD;;ok2}?>pFl4B2|nO5fD&OK%@i^gdivckRrV!1cU?-
z=|PZC1OyC`s&o+PO$fb8@1UVaLFr9Oq(i{FJ?A_3`@S>h+#lbaJNMohe`IFw?7e69
zto^Kaz3W-;^DGorvv#Pg5jS3kJhsA}k`|44Q@)tS039UJp(&#?`+6Bf3lL|+lX46O
zd_y?&gM+5>`>q|Ug<>i`I?f8m&@ae@ejYy<wG6w#PtosId<rRQXspTesg=ls#Z^hg
z1j9EEHxG0Rzp5+Ke6(nNkz)#?KWFZTeNboMB_2v6R!x&;9c`Mt9zOAihR~V?fqK=B
zLVWbDo&I87eW^NS5>(CHOW9rasIcV4GcX^VwS$*fG~GPxQ1GBaD^1DY*F1?PJ!9qN
za^zQ1G<^;_(>`n@*>DIee&NGlRoVT!b~gZ?k>Z~+hw48k7K<R@o`3uMbK$mIY#&hO
z&~@kC570ZG#sgr_@u+`;D)PVjf7QSlGbFobD11mr8(|qX2$!!W%#8&>wVI&h_P7F*
zFN{kS#^FYvRrR$_@fCAi^|2kbyX+@5A*?-GmPlPNm!gbH(G;w+AuRQM&g)5e&#f(+
zNGLmhf7Hm4v~cFs7zefU+-j8`mqjdYPrr-!@THYt@kN)%CHuC{-Rmb9?ztw|lK8@p
z;?vEJ;;}ogm853xWQkqmJ0z3mI8H6Lk2EpL(7?lZD#;}R<14LIRleyi9PjTIp05pG
zBAtS}=Jd}`BZS^2wP(`g!!m=Zq$nVlGiESygl4rw2N-d^SA(YHBE`&i?vdf0O3SPs
z4oMBYanF}57g?k}PX>yUH7|>r-pZ-KbsfbBSG4X5PN9b+)|C4yJw(<`Dp;h;d};A_
zTw%iOc3-0q%+3Oh2!|((q5}Gw%m~I74vfT|z-#22yA^QG>duamTtH05gs92He==6Z
z!>pJYS%S1xHy2$BpfsSlS>nk?8@u3TrO3=XN7M3DaX$F$n=_R12fF%`S4JO2^}@at
ziz`WBF7A)Wo1Wv|nR?<@^h%vbj(k!!BBEH$6Vm4;FQan38w4zIs*4`B0hK;3u;=Q%
z8etnS3F$Ql>xFWVt2Fw#j{+zDi|?Evd>*#{YS-lTk)rdS_egRuuJCRyLd*QKSC8vi
zN1nH=7hj9q+*y>`%2%JB+vGiEGvAueR26sg?DJ<4_nlV;FDJui)C96B8CaseOP!Em
zh@?45t4X4!eX;<|T?tpoPFTBT0+}liF>^jGRbXA6x$ju?9?~ErzC9zTeuD_9ez{lX
zoft~agKbT{ZEoZZ1es=)Vg+HdHzgB(ep{T|nyqpdt45tpms}-Jo#;qOS(wBLp=YK9
zKE_f7w`kz@q8vFPJ{ILU>0H4J<~2yMvmxrGs6z=7al4>UQ5&G)p(aLU3*DkuQI*zQ
z_kpA^-&pftTrQv*%a*#A1S|xbhHOGM>!7do+NLM26_yRw_c<q(Egr%I#0X^!j7BR5
zE~bR8xW&aM>06K@X@h?DlZ{?et9P##T0}%CJ(1cfMt!(-8&SN}<8IGAKuo^{MEQ02
zW9^pil_`lPINZ#Lq||oSZ$7R{W8*(Nbb7)XVa#8)^*-~UchJDXeKZoNf!{m=C|L9>
zk{$U3Sm#hj6Yz&#aXKV5&M5C>r2?^c<jd|py4_FcqaL&zK+yg%z<xFM9E<<?VSpc-
z;68x3ocjS<wjtT)5@m<$J3~5Cu6hLbchF(GtL@R-KrsQA|3OAL6Up#El;3ib?9w|*
zRiWw5-gwTKm*|eVSpC{FNweQp;r-Fs8cdHQt3MPTMG>ARe!BtQo)}m#(sVjyrGJmU
z<z^f79{v$T#iPY9V_ig6AeWQA{E%}%q;7qG2{1n^xPsL9{B1D=f|}6LSLWTZYg{Nq
zE*V$uT<eCPzD#n5q~<P3vYVzqY|_~^<SbVxi{(NV&AIYh)xSv4!pRCNj6lo3dWw8=
zlj6MzE;iK!ieQCA+t=(@avY~=<q#bFOPcTYQm3Bkw4TlwTRtt`X7nQP`FpNa_RW-q
zvgG0Z{;(W~I+Tm}k9IvC8vFrTIQVo7NL}~vY)*fo^Q)z^Qn7o#wJBs_$;<Id$O(iq
zGt9kNA>>5le992nlG|_U81Pwq0Y4yA(zTAhQ~I}~pOU4TojSs^U{)0qXJ9ih15PnE
z+FRFm7eiyBE)=e~EV~{heDaJ=qIGvQu2Bx2iujm7RP5nyht>#SB9ud0GQgG}!d7ox
zafS3{HYMo0aDhs8idiW1rCun;+Ia5qO3B&g2Ieg7N`sesm@mY4OC2lKU{0Hd=swTC
zVG=YIJ^I;zDSw$o=+=j_{%%v!+pT$=P|?G(WZR(bnxp^$>W8Q4%<}9fzNw}P48q6n
z3R&8*lZ?w)Jx)E&nAfy$Hu0NpcoS=<7m##eP*P)g5!flOoUPvu`dxGndt3|H7Nr>|
zo6ZLU+?numfSIhbIG}WM`+WlP_gdLMo&S^Yyhinp>7^Ex%3l#5{uj@HG^9tb<e{z)
z=nQ8M@zqorMBTnT%uD0bC^$1#gxcmCIWEG<MS4_xTM-Ej5T$+Rz`-bMACP!_Ce$+M
zzA(>oudq`7OW|`8BCMTU-o^DGH=RAzNu!Zznb7ojUfA#`$F+3D{lEjg;ElO_yAgKV
zME<aDhD)pxtXTez(NU_+f~y52WhaM0McJXj2{TiZQVy%LUepotGL%5f!Rp;~tkWGd
zZ@*M)K;KP+ePx?cOOpiWx#7AkPKG`P_oqxg@U9I$b9rQG^kFYhrXoek_tf1uswlj^
z|1eIL=yj&RmK?U3#MQB%(1*7g`bv~-6-}%zsHhmf)Oi}?NB{cKGhmMy@Z6VBt07^&
z8xx9l?RPy^%1%X7s<6%ri)Fj;Q)IkqN^mRmXnQ;1EPbzTR!KJs#Q6+&21<Z<D}NAj
z3(tMT<6#>`J>}phrR17KKig@K!O8J7svRZ@gjc}u3*TxxTW&-n13UPxJFjcR-_mk~
zf1j;mEJ>uY++=D{k7w;-+hh<Y8(pfol!Ae@_K1-QTC&!{K{Az_FOOrEd}QG}o+chB
zTMvCn(3;Eb0lpnT+`xiJ2%3$XR50yiZ%3JQA2wKu#PU6*@P#DjW0^ml4!37rzf7}v
z-pe&Q`MDMcz0&m2QxW;|U0-`x%_Sn1-R1SN&03hjuG~UDK;&04)t#rFif#_rJSY@=
zTdM?mPtYo^JaK%vG_FVcRdd2OZ{fQ`xE?-aYcRp&@oB&)c!sl1Pxu`wxF3%YpK{|%
zF{$`IdkhvOf94%og#}z+1mV=6#jC?XQ+f?%qMDWBt?{qhFQ2$!q2aZXFd@rNo|2x^
zltqvoZdt{gRQGc4FYwVTdh4nE+M(TpTWYmq+P-iv&{4Mi8HQT01ja5eD>72oK5#5Y
zg|C@GN~yknPErx;Y1eyIj*+aKcNfS|=$oTs+gVr-ttPEd7?fkxhHZk`BzYbLcw5_o
zYv0y7#ypamsdw=etm4&+0&kghY!qJ!!Lg5hzLPWTsV>_~d>15r%~{`*jVtWBkTv?U
zI5#m`7mt9fKALcPNPX#X(EBNUoQz(w<gvmHbiIZ42CD<z)zOxwtAH+(w_7hy56SGQ
z3^=4wm%p&>#=@f97cXsA%aQaQhe}Z_7L}>$kzs1AUJpD5e039s@yQJzTAbS_<BPo8
zzYu?boPdF}vCt>wZlXauTo!|n$b8DSVwKyR%!N=l$`~)BdopS<sQrC>@0Msv-cvdx
z8(g2JKRq$+O0@ayuXJ2SwRi~2y9UQws=CS|SQMYF6xH(0ymM#<Ic^iw_ZF?XQT5>(
z8D<yyDNbGgLmW2qNmauAOuc5|JDyWW)yzv*A9-WI{b)EU{5Tj0zd!fBZM%PjnHD}^
z>o^7p{{VpvFZ|6Dcx;jfP^u@Pzmfyqg1Wyy0N|lbi}I;{^T2)L+%w5I;sEQr*nrMz
zw#mAYY!Xim!x6b4U@G+?FTvOU>B*X!<l_P-YuG*hMq4JoQ&hK@m(0K*Yjm?f+D|j9
zf#V|@=oI(^dXdQ%P@M<af0SqA+6Y^OZc*caF<Sw<ch`;U;Dpi7qGaPOt&?Yu!Gj)F
z{R9F1H7j|s?IKqLd}C?<7fIjkD_J7u{)SI>q9xwI?L4B=fSOQ5_QQJ_ZXcTfK`rO^
zVI3368V3Th%r!69rjy3iaAIYsrB9_Bwn2=UfUq`n=wyyl0sDorv9s;(k2a1J_7x+w
z(CKB)@x)Zg3R!2P1UVcn<E640y9-?9YEK0n^Fk>C8Z=Eu9wjfV^BNATCOo#0*&AP-
zP4HqjLf3U<<4f!{4vzRR=`U<$jd2252}tQAcXrngz?7Xrm3T7Q-7#<ct~;Zp-%R#}
zJUYp*UxMAROhx&Kvx(%TiHOIGu3u7OabL09EEekwb7nTE0oTQujSLQy!R-!Gz~5Rp
z6Uf;NZUZCE-PEH4aPeK97wA7Um#J{;h4boz5H6Z}OpL@D;Z3ke8XI_7uXS%%#nD!K
zW3|*Y(bfcaO_foCrbzjupA1qU>9`%(D1vqd@XTQO0Se1FJl|@uC59z|ERL`FNlQnl
zoa4LROCF&D@&6NGbhp)6TGg|=p;J7YN}}*X_M)k!<Y8uya62|N;}M(TN0fzWP6ARO
zcUL`kA-1g*6PJC2b=LzKZ|y~v4~X3_OCs3Bxk+?z&4i`_t^}51y?IWvM!wI7bak*z
zC)OB0`dvgV-Yf|coGP?UXeQJ0ddQnrxVN1s1m-*qQ_F#hMekxPDo4J#Q+eB?dR?R$
z-{xG%53MuetwO!k&eWiWe6t>-mDW(%6pIGy>slqz(P^}gYU84{2V1Cg4i~XfyWk+&
z>zh0=4(C8bGtJ=7h@DD<UG8un5E&P0Bmjj|Mu6|)tdkgC8pOxXjTuh6C14{9&n@3p
zH5Q}L#ut&Gt`{b7k}+QT7wRz{oLr+B!(W@4`vVs&mahpjAxGj8oFnv%IQ917$K~yN
zzAg9b>s~JHD)j{<_06qQ$i71&fB>$$SeyH(_I$C2zH*LuNxSG;o~+??YSL)n-m9sB
zR<%Oy)2XYQIiCu;Kj~FCkcG%RVc%xmvN%IMgl@i<5s_*Me4+-wp=gDf)&`*877@{l
z;E$tRPE%$sBWugcP-fqqxj>kD)C~6n_<TNkY!V1%>B;B~GW1>^Xvwa~9{AR&TVln3
z4*|+MlA+K=TZ`Ymys<z6fQ&0gv@1Zs_}Tw|1`N#uw$a~!l13jFHs4rMrve!1NCS4y
z|A-jT$HDG^n+GLe6qWO{B)<5Y(;4)K{>D8}BT0|zf8!mBkiV(8XMd`=|NIJOGA+9s
z_FZ{M_Uih`i#OhcJF|k4qMO9Y@c&#d{og&;e^`ljhTD^s8xo9)c%OO2zyJJ%XzZ?|
zHJCP(#yC)mtcp}kVr)t81G&8Ny*}hPXD?<?MVOACep$4j-)hgzO_rkQzo(yM&JW$d
zE=dQDmqjmAGFb-sx0J^5UU^4AHt(5eMDX1)Vu~baidf6UzkU$qy#XRonuIIif=BQK
zsem@SrYVcHm(&BxK;39-NXNNBW3Oqvo?xU3d#A$snR66N-IDtd+6Kwe+VWlrC($0;
zogjL7dKw%&rO_?W7>80*Nno|Iqh@^GYGW8sE9nRXS^vs~d*MxlI|Af<!gKP}5j?Yb
zvrL1FtpEic%N60a!sv*JZnb(5&x>WnkcuUpxW4T!MH_oITs)LZ&YtXYx+c_9xmK~}
zazYz+QWmDUq{+#I_eW32af+SCEYQ<9bZyI^3Qs3r9$91Mi50DweZ2v@rYeeF6jYv(
zXWKx%A*j<hYPC1>N6-YYMz@1HhV*sKAtIlVr=4xCAKFGHh_`F=<0Y&#eJv`DCqh~(
z7{^S<pZ6%bv}JvEF?@N_b>%%Nub6bPMycy;+r>?`1SL_9hOZRl-T`3LP8!Wjhs4RR
z@)uwAa=(D@)qN2Z9!l|zb-hCrlpYETbrh6Y#m|fG?MIf1?FVYgvEVVI1mE5UC&Iaf
zo6r@|d+0*FQOU=Gt)0-qH)B>o4>X?eEKqEx(f#C@+4xj=V%=%qJ_wK=jYs7-mm*vx
z(zCNxtbE<LfMy*j*2+>j(;dW0{_~FEc6|+D-CeU@`}-KZqJ?Jw3jiayloniDI|^Mg
z(r+TEO!H?{#afD0oc7S70;GpEshp_G>T(E(tgO*0pupgGJ+NoM_SQL1aU0rQPb1~P
z$v~$A4#K>RzD3htT&|n9>iSNOdGI5txa3O-hf`<QZkubuPK=LCf#Cg~c~CyjIgS@Q
za@&L@Nu4-%v71^{=P@q6;tPf^QZ!?r@x?3``&MS0HG&Z4qMEMxY$2I6w>E%G3o)JR
zXjomL&j&AjWG4+?$84XiZ@_j9PS4C8LoJUXicKlBsjZS~vhVG-wxDA0b%5jeVrxqm
zn`iRr&0E-wyo}5z?vKZA(J5~m63h-6PAL_lvW*VwgG$Q+y2pi9KkxzfP^p&4v%aa?
z9Zu<15#R<m1lE7iQ^|T!Z@RtX;iwr~vs#UhNd}h*cjr;%iJU9u*+x%NDxEUBBYPv-
z+Lb;gRO!aZowLz?am@#|nOksOC__}8HZpCkg*@LY^an_mYQc;l46>QOl+}$N_j5Td
zbHJcFjV>)}tbs~50!Glb+p4mdMZrhc;hWsSD$G)!Gk7wOy8wT?RHMfAgyD^bh8m@q
zI0K1+7%RnW?%7ex%;k5>k##Tg{X(c7w{aQfewNEs-oIB&J@(n?(>>c4Sv%(y-HW2a
z1entWe!5gNS2r?e5|He&bLBCk_Ksp@p)980Hn$ipDqxxYl+Zfh1)X~I9omlFQ*lBs
znhXJ1S>#V;mpsQhiLbJ8OK2Ir+xY{;t~jlRht8V*<N8N=PUpg>S<8yfR3Y2ciTMG6
zRFgR>?&5L8rmHgW!}J;~a$CE)$e`7ni@w;?E>()n?ZR;^P!M!-FjsB<#R7fK^yE~U
zjony*-z*cM7D}(iS&QI%_2JI<)+W!@S>j~XmCx2PRW~~z%hD%bolDH(N$-JC$UI4y
z>M}Dhs;a$Ioeb&Smb&1ioAQ0Cuzx7v@<sS<e<QoL3#RTm2@}MJ@tmo-!Ouz2<a=8X
zWf=a-aM3g80A8-Ahh*j+JjsaZB+k-mA(^p+_V&$IX@9}iVq)hL{$d!g6Sep!n_$Xj
z|E@L7LUxbjlZg)R<kR>$Qf3c^2?t5^l$N97<<S#~?Giw*tUuHIR|(+%!RM&o`r9Z(
zPzca6dYv$c+-qqnwKGU19GIG{l3j*%kbs<d#o*nLjslLCH^;^@fWg^VC%4OOTT`hv
zBb7-3l3`mjw&4v0cOXs6aU#4NOvVJ3kToBtJdDDc*vV8*mI>mRfvs?hERD%}*}luQ
z=;$+*J!UqAZ}mO8oKDzt*xksh2faz=I0xRGx`>dgucuc<8RI>Q)?OMLE7~ICb{0!o
z1Ce<V0ofGfKds!w@G3$9Kyv^xir=+we>}e5bwc~4HHI}JC>W{APtH*C3DD+KH?I3D
zkF5d>)H93S_qmH{)N&obtmzhz*ECS7aEP>0W58r9Wmc*G#)&w{RqZawx#7yjKw`~K
zmoxX=2Q*7n!78*}Y}`29>+2>BUD^T_u~>l@67+ORUGCs(e|Kj`+?aF1cM(?hlEi#q
z`P%j7-AUq2O0_TNkm;S{>>HZa;6?UF0Ai5bLGt$jwa7>^JlkYxWcoa+xp)~lR=9x@
zhI{o*I(bO76SjZChy4E{e8~SYG&}2wl$n@4+{=5Lj`Yp^Jq{<nGDpNL`rOV|apn_p
z3*|!^#YWty=7qjaqcgr1b5K~I&*fkscE`E0%WST}PiO0J(OrPACeSnPDE_f>$yqYw
zUw)N8t}p)IKc<J9Z5&PJdd)X~P*U(Kec24#aBaHa8(f;TAv9R_%&gsWF5)(u99(Lk
zvTp!i+s#jrfK_ZL-Dp7^_`GX!>oshYQPMEEuwnr#kL$S?JZTeZc9J?=25pYq{=Hn`
rUkr19q8NW&|J7E%Fz^clzcBC%1HUlv3j@C}@CyU~4=_OXWBfk=KnwYn

diff --git a/systems_design/images/cdn.jpg b/systems_design/images/cdn.jpg
index ece4402d521224cbc57cb9fd1c678d7a07192cf6..1be88eb95e700b4488d4570683dd0e2b8fccddaa 100644
GIT binary patch
literal 76662
zcmeEuXIPV2*KPzUQUZ<*fq;w!rDg;vp$a251T1s}B1-QaLRBCZii$L;5do1dy_cw{
zw9rdv5rIGmAP_?5?8Gwjz2`mu&vl&>e;M-Zz4lu7>T5rbbhIvVvhlJ(AP~;Wm;Sy1
zfv~|K5XN;@X7CN`9>4n#ND$=m-{)_656zAEKRsdPFTA#L+bo1SR96w`+kq<DA2%?y
zdNO}-@x#cKitpr*jz&S4$sEk?(RKD>bBhPqHUblq=97%0HDw*|Dh`MjQW(5X2=T78
zTc23zO6zQ~eyYlw-DqifS4il1&n5F<F?<c#@wQ6dl~W4BIU?ZS*_@^2M{6H6_3urh
zyr!eq$<vSi1f>1{&;P9)2zpU*yZAs^d!FaD=b_}G;d~0&$gy6g`1aL=eqoQz-(<(D
zxwwn;^ku8DN`w$B?do=FOPJrd%q>$^Nmu0ynxEl>e*g5`{)^S>j)OywJy{5c?P_*v
zdrrDn^rcWWP}^2R1;U%YdE34{0g_t&oWCE5d6Yi7r+S^30lCvfBD~HEl>O|P7v+*1
zeJ}r>sdkygXPbS$eya-maJ>j;>RTl@y$xS+Wo^mRkPMw|+MQ-^mC`)Y<kfP$XmsoF
zjpbB3Nv|FZHiLMJ8=gCH2c`55UymEzDP7&QQm|jJv`rw8%pyFw@@j^5e1%HQ6qxo;
z4|SjHZbfA5`Lz{KjGTzT(A6f_L5K-!?L9P7ON2v6F*+gO)VTtChYML~E~}xIR^yLq
z(i=GB=)10N$qUJ7D^qd!NGG(QfGVea6}CE7)6M&9y`bw4)9+wvD|_7CvirN0I2}u-
zkBGqjXl34bUTDH9(0(z?ci-?sEw0%Mo%4lbmZ%-}&Y8v!=T{COhV7lYecj(?VF!CW
zCCaI7CMdq=9c`JJ5mNZ0St1DmMcWjUxQXJ!WT;I0g=+POEm{u0HidjSe6dy?g?xD;
zsXW0)a$o->#X24;l8N5tTxL688!AD1o}!-xzq3*65&|uEEpsWVg(lvfs=c*HsUhSn
zM`{lv>ocR8V{h{PS~2L|ht7F|UvUiin)6@F>v_-uVFc&r;mf9r`Mvj!&Wvs|cWM)z
zOFMiDJmaZ_80-h)Eu55H=5~T%mdvj;Aorf6k6@a#4l%g<oG)9!eeuD3IPs$5Me%S(
z(oAt<b;4<t@VHA{wTce|)X>YY(Nr6!7TXts17Zs9@gYb1lj?pi6n>MR46V+v`)gL9
zA~E7I(_wY-Eamc~<$ynoTA3HVzCjV;+dIcL_Q9saRp#RITFdM&q;tYNHxz%aFn5WI
z@6C%FSI+3_eYn1W8#Qtlxg;CC9I!MPdcXhN%w(ufd&X#DgcjH6WNoZWdkS<pw*HxK
zU^cc+6wuP@)pqXnjhoxcM}I8GJQZ97*2;Lx1`A6=c14?+eiB#Oa@{{;3N5Y`miT);
zIPqKQ2Z7}$EEVm%r`+SAe@~GU^Q@&Y*l$D5#n|sxB1r}E%`tx<_R`l&OL)%Gf)P$O
zIFs?>#@p9d7;I~O+2&+gUAsu8S&(7d&E?CIk8-j}FW+Em-YE&6!XBJv;seO~$Y^54
zc>s|_S{n5$K@o{H_n^E8&3YL;p~|IrJ7w7<`?Cl}{Rhcco+&DtmWx7yo&&`qJc>>;
z@r<8zUzFH8a`;9;L8fWy=LF?_aEZUO?uUM^x6AH$jq*2j>Nvig@Kz1osA20L{dCOM
z()b;r0jZ9j@j0=a;II(=+Uo;TmW<|!-+KtTvqHkJ@E>A_Wn%BQBv8Ase_Gk)Y!8;S
zLAxdH_6ZwiaVrlKml8zO(NAD~cImaFgU;r@3D^+m^sAeDur>D>qc0P==>!MeV1+S2
z($C`S`V2(iWIx-XgjSRrxxXKO$amBDp_br|?EX<>JMHR&Wauf0soZW&%bk|a?9r{~
zHdZVHJE5yqM|@45cqHzcp!}bcQ=&YnbMb!4?P5|Ag-MRh!h^zg+5TszUxYn61!$&y
zRL_J!flbIv{bl1axM|{v2gs!V9r8krMw&Um7z6za9X8szgJy*P{{sI{^57%}d$jro
z6oQa6utFldu$;161*tnLZFs0Z35PK@db?A)^I5wzzhdca-ywaI%7F0(-K(3_g(Gi%
zs6G!P4Mb^0YC7c12Q2y_Yp1fH0yUK$6yZKIHvY`nhC}*}Fga)QQNtf@6mCR=qpHO|
zel64S#V<L^0Y>A_`fECiKeWdDH4Vf;8dW<RB(u@*!qLXQJZi1m^w{OmNIu7!Y`X#Y
z$OIwuh^ZWjgN2S_9!@#|&m0lnM2l;z`~g!>>W8YfJ9ej&1BK6ddv9~f9%kd;smQOe
z?L7*mKLY2a({LQ7=uLc$LvE8^+7*x_ohxqYJIY~yxK#~xnyy&Cw&ciD9K?zS-r0_3
z+zT~(yS+*6kZbwzn=f?5k-p)khK|-};Tj#T+BiUBWPz%K^B(hzWu))*LYuzO2}0cl
zGqj*)c0!#A8cNes@X@&V<8OQFH+nf`N2T2dbZB3Ik9o-tHi+<sC``vjztuSTQ%7~g
zf1Ebt_aa2PzT+;bp?~T5%Fit^>a^d|J{vzMeU8KYvJKk@Xtsg(GV#}rK|6G_5Yh7j
zN7$SXd`szJ9~;Z|8d-k*>k;++^ha!l)X`3x!}`Wlm2EXq(VA6bFJ+0J)HSI7Ap2z>
zj=<-H%Jmre>{RM2zc^`SJUuG%%ghA+{Lx1o0UfE-z0pn$=n)aoL^VFpX8&cH;%U3$
zE_EM7`1LDkm!<d;HuKJhc7ze)e=(1E;fI85SYbPT$x-F=fg7QEhD|k1i><#H;r=IW
zOX;o?XlO?*<u0izddxQBOR%I$buq^;*1Y>kOwYfF;Vmr;XBY4@`YDW{+dqF(f+OIS
zsl9zSCH?BpIU*B~gTHp#`vXwdt`HX^%9Z-6c4v+l>9Ui!`{+ah38W4FSmP~<xHxRA
zT?X}AAJiKO@n9qUGT%7OA8Yi=yL$spl-DiS3YN}_<Qf}X{7Gxj)DH<{=VP$=6z{ro
zXPT<melkq@$q$BkaKh>qcCt>La_8yO{YihC;m^I77r!{wkc*6{-aLKcx#@(MA259R
z1BR~=XlS%Ae!6aGqpN(UOa_U~GF{tgN9a~+)1Ie&-qK+R7#afYR+k8zMyb3Nv*(HR
z2lV#eF{7Ih@T*%_e@F%q3LW#IM&~UrY#P~Rw@6Qq`o8lRZ|R6sa^{IW8av{!Jy!MI
zo7CpDmGKi}s*FF((5);Sq1VhOpMsM$vmaTeEX;>+RbSiuh!?OM*<E2j&czpYFXWzw
zah$9}ePH8}6i5GWSI6wP(H*-n|G82#4tb+o<+~qA+)H_sB1K28cJ1PJ7d8x;f*hS*
zA$qt>juwzZIHP|>GuF&MbZnL%p(#?c6V~Cr;IMd~CDqX%9GDkj&olKMW6|M$TaRaF
z-D|=36@_pyW$=*P!Jom9HT1{hr-a<&dlq2ZImr!X<tZ#&K;prS=>FubzIMf`ya{7j
z0jJw5I9V-rzW)?r^g#rNM@N4>-gkOL+cUX?u1dSzk_VxDVK#v|&G2?i)(7s>a|dO9
z?|Jy=p5kE7h$#PRO02;7#&ZApoID`JfaXG^_rh(e;-K5<$rx09pOpRSpUQ|6`-xmz
zB0RfAw!X5P9a+9^x;WmQx8S#MQ3dR{8%P|GQbOO@8L3XO_FsEu#m4f>`0#v8*+yHn
zD|_ETE?^GWp`7F^1KP!fWf8-|qpS<)nWhzj+p0kLPYV?-fY6+!M(*@#6@(;D!5G3=
z>bC4@N;z~ipc3y}vmRM*Pvgi2+b@p5AL^Tx%A-~>1!86DVT@z4&{VGFeaprANX4Hj
z8H+={!KZrHQQE6h`MuXM&F{H+`A_^ho~nx4LP&vvyPwZN>Qk&AC4e=ZW(mX9D+;6V
zz2rXw^OdfZ*Q>p})|L}TSuJhv;wkr#C=Iw^ck6JOUGZ&Ff?Y!%d1xSia@8)+^MjWD
z%R4XC(3eBkYbM*9*(GIHo_ddtXhRSE5<}WUZsuVWajk3ASj#?QN!c|%&>(VAC_EB?
z5)PH>%+|rH#m&gzyK_AfEGw1T^nxcn*<c?#uM!%r8)!S&b@GM|LR$<!)x?^xu)(_I
zx_JP@zM@kHXKD-aXX8{hd;8FWKAA5Xewp!+BoA^?<#jaYauXU^xvETeHau|=Z%}E@
z5{N^7coBGNFGEW!N#4cseZNWz*(b|Rs`NHV{@fQ*O`f$ESM=r6uE&R9@bL6erRz<%
z5~ct<QFS{b!$NWDJl|iT>#iI9@<~CCbU6<PW8D|wVq@2XTxkwtqHdme@U%&|C$-_o
zwC2r{=J$?Y+42KpZA)53!ji&_UasPhXNO%q4Tbm(JjZ`Jn;=D+Oe!B2BFmb5<#=@j
z0C>$!x|EJid03=`5c*!VV=7i~4MIV3_!Nl*nRdTg+)iLp)#~Ng;=vsRpQ+|lWnYRX
zU?5xxa=3EpN*^k-w(be}%RIJFB8TiFu2GG0(JTn8x`<t*;PJbTnSCc~w?8jgDezZ+
z=#j3%Sc$O0e(D??QBb}9%@)RhR)GpQ7DS~pOwyv}k7xGPOfs=`2fsfd7FYVxM>5ir
z>NoJk1b-Jrv75ZLfjHf2k%M(dCOlx~dSc>MdV}<`+!161q6)W%?^QXbl6$asvnC}F
z$qDYi{c`xnL3G_agRBPR4P-4pj3<SL3auPizS5LbfpBBJ{U^zN;+cGmmsuT)Z)4C+
zuc>wRM0lhp%Mon<<pTfW&iNoDfAXx0v)w1VOc2x?ldm{6YudtM@gzn3PT<mpiS5ve
zXMS1z&NMkt_Qoc>cH0Mo?d>7u$ZulJ9{klwiy5lpop!_VkF~fg=-~<OgJG(&vRN~Y
zrfvR{JanXLU9N!hoi>T|MDL3(G~T#h-@Vv6Q)sFu<32#%5Qb^AhQX}T=hfBYT-thP
z3!UzRR7JMhe!>=gPr@T!dA@L~qCrN|!%#n-hj#WeQsmT9yUrP<(T{b;bT9JQhoYNU
z42(sQ?lcZ*P+yo5d6+{B_za$`1mdlS$6=>6ec_r-4xe>Cw`AKqM+SgITd%$35jgWm
zSb)URPGP^vXU|+txdo8ZbAg1B<?rQ43;uolX9*!tK0)w*&T39|!A(cH(>iUrATHcb
z;+IoAq^NjClu4Z~U-5ljCxjYbU#xYvmhf?qnsyr$*scmy1G!NqTF<m2JI`7XgVh?T
zL_4?ML2dTm#K-2-lT-KPPdx_^_IHVe*0`T&PSZv?Aq2G5#uu9#v1E!zk2zf66eDCJ
zcEzCL**XG`HR~!i?<)1l(lH&xU`<P98f2&k5Uu#g%ATD|wo-_5-<D3Rp-JlYlA3!l
z*pDGlmVLZG(YZ2{WUS?=d4mYgEl6j60Nj6?t&6k)MD?2KNz0oBp}PfTyY=z%va$FA
z$-C{*x$i()dg!*B2R_nW=M=ts!dChvj^Nrz`g;s(d*>?A*;gGcxLM4Yr(g5+P(3fF
zfb^{^*E&jtX;QIpUTr+Ue&Dd&aCYHnqyR0340`+F8Oy6{ev64K?d4B5c1<i_t`l!*
zqpn_`Hl==HgE?xXlLnmza7bU`^c$>i91LL+UZqkJg{LgHI~>{vRE!NKl0i4r&uhOn
zDOkqkuYWD5*?EbU+$yz;8rcdX2`a6B<dZQTWLpUJ9mx`?8{b`9d$4P@mQ>3E4>&N;
zf*FM(S%HVTB@WP-+_R!*RCT2G?wj%4gjJMr=T&62RxNkzA%qF}okXJ%YF+Ah)zoYW
zOzQeHCS&?lJ6AuN6PAg3-O8+X<VN$9a5COj%}#@eTl~T#>RHKrfF7Kk8ld^G*nI!B
z^4NTzZ-1LM6k3a$QbMcEd<LIom{qKe%A*dME2`8BOM?snxedEOi~^dg`{Xzmb7H{o
zau|n}{oTx#P4?aZbu@eDJh$0WrTZtxVx`;G=B*d186QnRVa%6xEYoXK20gy8pM>%u
z!e5Q3%NCTyCC?|je$H+^0RW{*ggZQi+?lIpI`z1W2?Ehf`@m?nmViqqz|UiKrcIVF
zk>Zq>*84;y6@1@H)CO+1UWM9?F^1z_L-Xt(-s4I7O_Hss#~i2}<hb)1$vxiSf@PX@
zq@dUnC|C5o{c-h=VKVM=W60zt<%G}n9ln;d(uLKl?gyze=9%>ycV6|Lara)Ik`-2V
zukhWy8O@CdKdUnFcrUlbm^l1;i8#ni?uVpgd|~Aa+lXQ0nuqdP&bGG9n@O#lZLpqG
za=+v7Tpj%%JhH|3i~sSqJ0fMUM|$~oz7?YFxS>XpkG}+^G6ULTVrO<duWVXM;hRt0
zK@X_D1{3we9oyulo%qj#+UyDUKEhT%+c!>jl$e=0NTTF<75(;=-T>iYm*?%RMX3XP
z2*rhYVXrb|lNx$3)#EbcFFxfc|MG^vJIg?6W8e2ok|1J&Q&w>!@2sz^U+?6_YG$Zc
z@5zg?$FbH7FKnMPqA$xo#t8xk^!D&Y0S*S8U=X!NZ&2{N?|Lw?7hwpFWdybF`{>%y
z>qNNd-fHy$U(r7hA(zt~_COkX6c%chEjv_pw=!a4V%o@o#?gA4?Sa}Pubq{bdPi&d
zQYfD-K48PDeU%ieguGdGB5C1_0w)Gr2#Y**5QHMCy<a~)I1drgp@pdnHJhLN$l8i#
zcpTvZmw!5CN@3^SbAPE!oDjT{#`}2N%~i5-%KJ1V!g*~<RN2^uZgZ|iIc_(7pz`)I
znO~xtB6T9%9-Y4L18~qfrE*K=+(B$T^6v2*m0PHbyKiZcrEwxicR(mXsrFL3J`(}X
zpT^?A4vI&5)oAP^PX0PO%68tEiOP*D<BO#vF0Mmz!-te>zKt?j9cdU3fnpMXR=+Xg
z_kpvjGR@M$I?hy|Tn_*oQ7%~i@MdZ9vAeySAcZEL$1^~JvJZvbO6h4Jd_nE_ldh%u
z79LjOpJL(Ss*Zxd(`wO?lGiQ}oly$>*G>a3K({&%Ah*nKfKaOz1X{+j%B$oeG!(ny
zR7EZtnq&D*Y~PnJUo5-Pw*t03qRLD?);pKf(P2i+JRo_Lj{c<(d)_p>1|p?}(uW0H
zed2LQo-6Bld{O<5o1xHP0XkoeqInU1q|_0;E93B<`VAsu1`9NhU$JJ6s8O=J7%s(`
zrlN+XCuqPBDe~-1V*n3u914@K8)w&!5_4apvGED!1z2#8HE?q9QawGr!>7cZ*8&5_
zk7qDJcPYJG5n|436ICk#9c_Cy-21YkI<)_boHSiQ94_lORg`RwGz8vzGu1X3WmoI8
z1rj5rA4{*!4N4Wid-v|#nP6-TwXUF~0m-Ace&ixdPSaPBE+alw7dj3uXru9Xg0-5<
z4+}~syqg<Hi<S#jZ9kf3fx=8dz->fh?4tp_-;6aPlAUja8Sb=2jT#vd7kl;nkYd5u
zRd`Ecm?87&`CPlGwrl@&@q=LTt<Ac=s%g@gI6q=*@pwl`EQnhl4Qc#ZoR=`N5J24m
zq8swe>o1DkU3-qb#{^Z65Owx`8!0B=0(qPmhQp+@ZvSw1-x`lW4#j^2foTT0YK>rp
z2!mp|zX&;3xGwa2W+s=AK_$Z%2ekd=pB%fqDa+S<@mATli=i{_K3GarikPVL+RLaw
zmpKepN>ZsRqg*}cYkTG7w~rxcs4V{l;;x!0z?=y1bTrHvsRPUrq@u{TRw-^y{@JHI
zszZK&B<T7+Li#${DALq7zpU!^6TEIO+>b;irCeT!5U&jA4om!Vcj^FFO--vQ)C@q8
z%@@&w7gAMeS6+$va2W~<qj(*}02I+&*$+VoAd>n(%1NhP19{FPxikCY2y;R#j^JB8
zm1IdNo7RTz_H>;y+ltAs6WqzusrMuoC8{T*$VL7N1rGJ)-s9{l2QoPe;tt6vPQSb;
z!p1M)knA(qdF`S=T0Gs-e5NL2Hx&MdecMB;3Ym-80F>Ul3Tjo7XiPa4H)>#AUp^S%
zB+BdL><B7!JqE12DPSWrf51b5GsV+QRa|*V`T8c_Xl^#u^C+(5fu#4Sc4RF~iC%xA
zd&50%f@lRMcnr{~ptC0%>p+Uy^D*A0UN94H9XMiB<-L~_3x&0p<vbi*-FR{6&1~6R
zrNm~&!vJL!{jW0T`e=?=Z6Q>biL;whpuC})0c0kjbf@B4(EU{bM4fa320O9ykdgV=
zKZf&|JIG`;PXgPOCgw6bbO+N=f<Y(Y4%|WTAK6Kr=lp9QJpY0uB|hFNQz<pC$EwM#
z#{Q`Uh*Vm|ENWX2l9p4+xi?j~@NqX<Oh1XCq!5SlHJzIEP-d;36#-Yv36|+wLV2>T
zt9VUXXRhSv43q0IR6*ckpbwTaDj)|MjMb?(K#mtGy<Z9|W=M<YHX1{<Jj#2-#_w3*
zWZ-m>i&lF3W##`(>}RPGWElSHeYeXv=W|1_$QI_sCdP$`o=rQ@v`Xv_u0G*j0s1#e
zQoHu5PVz&rapMj#r_v7p;uJ$q#QTbuLxD5YJ_VEd47_t<c1M0`zd~)Y8*KHvFKVQ(
zdXBLQHt=%AF+N{kj~~II+mz2aMtbthR4$lVZgc!m=;f+0{=WX}4+y-pqSLLDKM+Za
z)*Ehh0ag0)uCFfNKwxp%<%QrI_Qs|f%(Dk4?8{TuHLLpTUkj(W7fRr<cizp<a1-o%
z<V`B#eVy_f%ET{JKX@i3-*Tx;(#J{2itkmDzw{9g=)F^$$m6Aw(N8D+&<;b7!}x|O
z|1u41!yf4qclPcRj_Uo>-FxaJnx(QC-mlChi`Wu_#2e8O7LJV3wnrGj<^FNc|Ay~n
zhM)(~PCf=V%<bp>C@oXT#~|<<H;dQzjxFa;X8W3fIx2Q{_jMdrOZ~&CWzjA?65%e_
zjjVU@tkg^F@DaDcivOLAI+OHSOcLg5LUiUhJw9v~Ma~g1@NPdBRdTpsOO2!tRUFvJ
zi1G{2ubo{=k3Nh@vI{K8K=V6YP(!O?lPEJ2%hApS^0`^*Ob>t|0^vE`UY+Jeh~1DK
z_P$AgC-G|UgQ;2270ygwECyb1B8aDax;)lx<PWNkcy!3#e%H~KM19{4xvb}=d!Hyu
zX{Jazx*HbMEPmB!S0>BUxU${~OZi$wsf(Xya+UvMb{0=J3N9?1W`QH=3g@v^A#5l#
zbb&0hVp)&|G!S<Q#RW5a>m`Y9jsr>E65=edGigRYNdtDat+apNI*1M^7>7NYAyogV
z@ZG5<tmJ0Illh(XsN50i(!>$LbwOiH(=OJIPz#SxVv3oS-s=j=De}hGsoXbS89yx;
zqdak&s^3q6{!QUSn9RG?E{(RZTTGJ6L195V>d_*_vb{toTuyeM@DMQe!*%|fUqxoc
zH&qrpcF7)5iYo05NLD^AHJq~->~l)T_FhilJwN)6v<d5zc;q-plf;I_e?=KzSo!k<
zmu@nEBv7>$I6}&fP_OOwdlpdatWOBxK<UQI_<c-ya6|mi8}7TLtm%5iCm<F#iFYE3
zi<juerq6;Di>a*slk%LfLA<|{(Da6Q0q2oS<0o2N$EG+F6~~k<2W^gQ$jwi@H5<$C
zuiqv+?T!I2E<+3N^mHkB!JVFgrZ6l2B?HnCVF~+z{Hu{63xnq$gaLvq$b*62Q?y*I
zN6fuqe_u;yuq&?~O|{M}F!Mmdhv7)<0~RO8+uM&k2z9)1QvAGE@eFVB*yp!GcXz&S
z?#w)U6^s?^U$ttoBA-9K?TgWepN8=!iNnWEw8}<rAlA41EQflNNU`hIg@l+VVbJKA
z7VlGX_S$Hd_U{i-Vs1j`912DsHPt*{Bv=YI``ed#EsQqjaPWos_RnrMAC~hYZ(yU3
z$_(cR`h1@@+NG%MR7&=d`ET634cE0jtawl^<PUnZXrRs(Br@!`+;)+fli$>*x0z{k
z)<oYVJA%C}!(mTPS15IBSdt2pX}uMXR@#?gDjAZp+oy1g*eRy?RLfV|I7%yY-|}nq
z5VwTMZ%oTFZu!PjuiE$2B=l6BT%g0mB~Kb}!Pi}-WF~gpoyW@{?n9Ep!}Kj3YtO*^
z{tVOAcX8WVy}+tE)vja~fsV`acS$Y#akx~C>ro|`$VvB0$3xT1dez0zlkEIzm2`mQ
z3Nfi30_`8?jIjm+=%bv#$?nHsMGq$ta0Ww%Rmm^*%N<k<d1fN{o+<MhHUEg(W48n<
zR<R3N=WcxBXuI5q=$O6bhMr~0%qVMjfp7;PJ5!t&krd&{BGk<_g58Zy*)z>P7k3@7
z-KNh~xjxBo-gS21uKM1~9nXxfe}_*R<bsbrOm5g~2eslna533s=Gli<B)@bJ&*uK{
zRk3THv=XM?emRboQYyxe9tHG0Wk_QKjkHvG??v2aAbyfl#r1e6hS?6#scIYKjK~E1
zzLF5E-lz@$AtWKUeWOG{`k<OUsWbbjX_f$Ickl<C)@5oK&*;^rD}0^Vg?Ew?rfuCt
zYT`N1t<sas;O4y5{+!Nv0odlCa5^h2lksUH*~8?qCzpQm&X$JlQ15DqUAB){FL`e+
z2n2TLxm4tq8VIBUl)DH68q;3$&AB}F$TrCSRPJ}CWX!CNx+{*NT0T=;LO8LmO-pkg
z^yb^!!*-YU=){l;>USn($NY%KwG8Nf6I8P5*xx-dd_tPDtzjD7We{77gY?5te1+yG
zq=at0fYxS+?u}UTHRf`N=Kg!=i)LcTco*jVid&T&LJ7xn-(yg~mw6vdqjO&9ard70
zrEiq6qFzH|eDcf55liZ6msyKE9o~b)E8?v>x_+CW9iiyHc2#hFt0x2+Ncf7H-dHp2
z6#prKns0Ltgb#x#qDcOEAz{@IyG6doL+hpeAU?ycpmx>Dv2K0pcrpVz)nNBE+^miC
zvv=A1y!a>xFlX<)pwmzG6#|~InA{O2!fX8mpUQVvzWDeMS9(gIVH2YLh)GA~YKfc2
zXd0j_ltx(q#Xn4UKAl;yhoHzIG!}7*$W1mRS_}Ib+~`0fm7Bug$^Z~Ogv@7Q2O%-+
zwF0Bw6OG06b|$S6D~mQV+x_ODZ{jlPn>@P|<!3+fmCL_ES9kk!s_9Z`)!Y+qX+`I8
z)m$(2V;6u?8J1%}-$(0wp{UvG>x3$yR$Bo!?RAeLdRmZz9y8nb6fbgN20y&n5i%>W
z!c>h#ZE|&#pj1row7BJt5cYsEa$~V_(Fe8vBk1FRY>f8?L}wUSaFY*8e-f{Azmala
zPrEU}!OtepgzIN7x_w@Em5e{)RKC!k`Ioz#LoI)b&rD|?x8iViOQcxs(mT|YnF|5d
z^uW5KiHBaVu9byFb!@DBU#F#h<So9s(SVWB;MrgH2eNVV9ucm{<FYr17r;hDN^^X1
ziKTtuOrtsviE_V;Glrgam*WRpL`6kO6K}n?Mw!qWM-f|-QA%)K3^o$^9+V`Wth^0f
z6@zes{+ep<9nLclVh1>c2KYOi<Hd1EPkb4Z&LbovT5@N+GWie1kRnsb_nu7GR-BZ-
zH?&*?t9@YJ3-zMh_a0PQZWk%B+GG9aFSw`%s&(wu4TX~Z)22$qgNj6tJI8bXUZKQl
zmymFs3EELP_3YzbXt&45jEjep4XryEaMHgtKWOLHA;hrhd}b|IPf{5ZT<;z;l!*&D
zN9X6w2oZN$&QkOYgT+k{L?vo0`Vweoxd!@~KhL7Aixou|rvH3gCY_Zg4ugUtcdGAa
zZczB@SIE~xpl1Fbj_@8u3};_m@aou0HiYnkiq|iR`b;Ow8u#M903I4gLUi1Q4mTKt
zpLIU%&1z9?`jE`_a+cDsv}C1*PJe@%O1@1a|KM-(ztZyC956gIRBY7|o=)c`+;!py
z75Q{35Y!=ydJ%WI$B1{|=G0J!gEB$kHO;mNfc)SAhCr}wqHY+pJg$EH6674Pb>Tg7
zi~zXsB~s`>ep(Ur$j-M#5IOPQIZ8Hs>9ByAxH|EsSlPcuueKqKa<sp!e&cPMp%rhp
z=C32+j1`<KuHPGnAH5^b@qO+g<Q(u=;hKknvG4Aq7izbK13&K%>82BR3Pn$A6x=Jk
z?-i?qSvX(!78-}6zXBg#_VGHsHXXNk+aRh?*#f_s7+F1f_w8?dR^iK?%uLV?ND=P}
zP}S*q0R;GmE;AI(DX^pBwOyV^9XVP$in4m$Y&+mz%Z)!IJ(!puNDK$n*@D}F6$GrP
zpu+{Ab#m1_OVsEa7TGRL3qz&X(N6CQ1tx|aG3uGgzl#^+(&QA*BRK+El^55XJ*ubp
z#nUtZ<hpu=oaL++7k8_vf!4JP?WqHx+$zvyL&r~Y=`Q52lIs48y7fMj({<M^iHo_~
z0tXNwgg})u=OQpzJs!u3FHVJpTSZRAIH8;W6kViESm#60`=(O^ce+;VTRdia3yDu#
z2*?WtyI%F1Bg^+6s)mByZ}gsVmb<jLxXriQ8$}bE^AO$IbffmNPi!#0UtZlkpEEZK
z4J`VM!CqaUw!-3hCZOZGN1NDN9J*GUDnK#gXJP70QB~DO{lZxNuK6>g+x})bM@u(M
zI{m+LFkDG<*z+PYG8h|hA04<@nW`*K!)7&IepT|c!dvq;I;6hXQ#TufHQO0rY~zHP
zy51c$<j{P4Ma{cBX<$fd3Q5E+HMxdDfBIZno@0K+Z}EX$pzDVi{n8%u$)6j&Y7fT#
z*@)exrUVZEMcWAE!1_Gr(;n~V7~QZck2#E>MNko(uoR!qwE^V}2htyNk6y)!r5f-}
zdxlNwmgT9THRXTjDe#lDW=rrF5cR7khBP1x#tAzLyDcdg;LS}WSz$L+CV2Jajp@b0
zHhsT7?v^k;X5QCtkD0zH=JLPi!jI>Py-8~ho+bZ|fg4_MBS61bB+FqB$Gzta=;ZsL
z9in?!G2}K~>La)I%W1N3wak8BG&9@QnNUL)R4hgsTEXF$MK~u$T<?%*Wt#}s&8Dp!
zUOhwN(;xasPYQ0T(dIzj&@53Q5_o>-&WA+f@>K7O7?HQct)_QRpgCf6mh=M?Y8%rC
zl3w6%WByR2nOt0a1L0_#fT8;;Lv-dBxM{VFMvXt8u2VWrsQVviY3`#H9@1QanNbbn
z<X<(uKv5Wbg%x2J`09I}_|$iZrc)k7c#qHKZW@K8KPG#NxCkuJkZ<o~H%vxxxhvhc
zpk^+`$4UbJ$d(&nUptTcK6%~VINk|XrcHcm^G}|g8A2;V=*R;<<un21j}&nqSSb8*
zA6;R}jd+~`ELYzww;~56QpL!wcJgfpC%+=Ce3B{a>^<1YsV>48oeRa(T;IFgw3X?B
zPjmcl0$9m-+&}<bn+G(;T*A`rZk3UtVL}d8r{ywvlbVxPZnl_}H?~F0^QQ*UD^PFm
zhZWR(`?Mr!;<u1gd@$a<bl(&Zi(SVKR_dPp&3Ns2&?gT^|5p9@KLXd#fpXMfF28YI
z+d^07JtsjF!j>cAEcX~kfYVslHBL8{^R$xSfiRPNyJX5mL6mNS2gs)<s$xw!gKcic
znU7v=#71Y_jcxL?Exr9eU<!du(w59V>ulgjT%@Wf7~78PEIwtvO>>11+$|5b=}^Qb
zPX91^FlBMQ$^jHr|0Pn0syr|TDQ}_tu}2X#i}Qif&l@n~LY$Q}_W?=Eo;{3X_vkBa
zX6CI^_REjNA9w#$@=uNo(SZU1<skM#Ti9R$i*>0E<oe}$9vdPc;7t9mC3w2<`4LLM
zSgsVqKwJVej7R0Smi-_f@%HL?VJ?pFhNcX!&(oA)4@6q`nmRhKABLzK?(htmAytWk
zgDd>Uldiyy8E6old+5A;O5-IcBfiZ)Uz?1KRq^+$`y>-GGg|}uFOO>7EN>uyp<x$J
z8UPq+R*3;({niLgag;Bj%;v~gRp$kIt7rmL_Wo1Hq@US54ngx3ut+z9dyVRuTfRbN
zV5&9qt((C@#yH_~zI^6l0J$9K#F>8}4N2n%iWAj)&RI^ASojzj!^D;F^%uSK!L`Y_
zQQ#nbNCKv*4=G0wcfZh`6|M9Sft*H{F%_l*`*vO(txLn}rx)~42go;?dx$QfsV)+%
zF6D&>cyj2UC%YU<bc&TsNp~?y4#T)@*~Fn8!>j|+&q3g{*+59cV0RY>19cK<GQa6c
z^K%f@o7Xg*7jTc-Xc7zYfbNDB0NX3@TZ2?x*vYFczMH!j0y<7~OKLZ)PAYB9P6rS8
zqJ}b<Q}~v%{d;@-A=bvK6W7$nouA?ef`U8fQg#sBoMoa3w((%RO*uLaPu;6mZs$@x
zh0s)qtI~d#Qfc)^K+2JI#yU#RyT`*=L(h1~tksSCD2%Ds^5^6+dBWIbBd7o2Sc&zV
z2W*QQR_wB8gfS!0)J4(Cgwz1@r-~;&DUUn25}l<yOmi;?98<e#W32iBP_w8`-7W4T
z3y)rxbLYvtt+2Gzw>iJ{XebN>ZVBTgCI{wIgPOAfs#!yzyDs=qNjbVCM<3rpTvh6M
zT(x`t%`^^jPUbS9_Jp^b4M_~Bf?E-bYHydUJS5GU?^JfBM0fk$%;X*%GUdZ*6_bH)
zIOMy9!~Th?>0p0#PF^_<p@y8OTFY-ptV->!S&8y)j}hsEpkn`Q|CnE3jz|AQPTtt=
z+}tPZ13`ahj7K9uzES-pT`Zb!oa-%)dq|*D_D<uc-Pa8H86JEVoC+OBR#BVex&tEd
z=Tg^Aa%#f|CC1c0Z&~>cW54tBriGmnZ;*X-@;@lG%-MD-$M`)rAJqu<?6BYT>atHI
zN#UEV9*d<Du?4+vyot`9LFCyL1(apb_JJs*`~~VrTC>l`asf>a2X^Z;;9s<r0(Z5X
z?x%C`k8ZDR8sDp=tSwzqNB0NX*a&|+?R`m|?&SBqfbxe0jhn=+F6hnHebRi}HbO!j
z)AE-oD1YxB^>Adq?ZtQgs#KY+;UMZk=1Oe{{CfyPC=_Wxk5c`k86l6$kg@4EW$P6#
zI|fL4+EB$b*46h-avp!NcjN1-@7>*vKuj~j%1+*DsD^KMrvEE++2~8|#Eo`D7<Gze
zU~G`^Qf8>YYe?lPdAn-R0@aN_%SWEi!1QCIYbHI1gt7e7y~Lgeht1Cdz+yT0<TS(J
z0=+t4gj1AyMDTGbhEBDC7M6E0*w<bc8r6B7X)2<bwyxYxSog#uM#7@l0|F#^1x!gx
zN<9vyBlFGfo1;lil2Z8eJEIG63B(>jOG~@ItcJeTCM4an*LXIDRCQxzVuLjm(iLjs
z<6g)?2W&`SbRyR0d{rf}hjXGrz1m8C$lp!A)k$;+mVeb)yG^)~ki6aMhwgAU((p|7
z4TVk*r4C+kFkAB#Dz1r8?koDVK%}hhTw&RFM8Te<VTn>;;+kl!(<&3*UY~>O_{2(W
z`W!FT4pVB+ziIw%EhUus%yDPAw>ZKiS5l|%{D+B9wUEGVs*3&ghw@#|tft*30~?8L
z!Ro=FLV6!9{f%bc;>S1t<YNp_o}WM+8%aqaJGa%w+IDyu>D6PfD@qY_f?!C)=I(-!
zdo|bodzs=@96{M94uZn|z1#6%5<(}2-oxC%!wF;G3O4&)Gq3J^@vj6&l^Ghr-*#R0
zJ2f;Sh1@{eAVSK(gv`lfN+q4P=rNa(*k^U$byiAikT0t9EH-K<?{6ZU67Rpxy5A<z
zVyd0DU_Vtmn6zDdD0x(hpqENYEKdc;%z4K03~o~*o+k8#jX&~Fcb?eqU%669yk~1b
z$ILiRv8s2&3!VBY?}@;M25BRD%u$Kzm8||y=%9gT6nX|n^MDnm&UqatX5CfN-c&>_
z1cwSx&pcnH=%GCxr#GshKP%n;mZH&RVIgB*i9>D-T6-;^i<x4JxIN|v_nV9C`$xp|
z2J5av{5K6xS9Ljsza7Dl58AWiM%0)JNj~*5)p@|Cw(ERN@0(3-+~qft{!-PsIAo{C
z+}+ID8s}~$e78B`lWbh^T+PHYfhOy}rg@JoATJke$Hjny%D4OA_w=NeF-fZ?1Y<$A
zsKA-MCAixi=s2=TS@7iGJw;iqP8p!2&8`Zkj;-5gfp+*&#6iWoU+B@!zLG<eQOY{E
zhMTDkCOr!7JQuQd<o@DYd_p^+Pq*Y$NpC-@Rb?SXU38XTY|evgkNMkwfj3u(s{sNI
z7UpucM|%TlxfD0gcY8>w)=^XPV%9E`|58Hf{rV1HaSQS3?RRSE3;jh8X=QUN`9_q-
z?7=@;SN)!vriMy1R}nWnjkC0x%}YBbIB2KQtbE6az6ZL+H3*91S~GxoM+5SW*=DOn
zmQt=Sm?id{qrmqv{W!|wA4gFRWZ53%rG8g}^MRWmp0<I_o#q(q<bBcznd@je&_k5O
zwAk?lspV%XYI}MAJ`G~!Ffa-Gv#qn?ggqgPj;^oLMt^(`AG;Ihsa=2xJCfcm)RY0v
zAd@~XTfgipASUW=;0~)!c;ZRjh|~8W^<?`ej7-l^5=4>y)p<7!n~%OxabS<X15$Zf
zIJFfl1;T_UA)M;lAIX7(6pU`xI3X>#;T0`~$Xuaol`3E7TA02TdeIVP;+BQFVDd>U
zXAE5NS_rR!++Cvhq1Qb&EjrePsGJS&53n6Xgdl%A_aLB6Gl`_j6_Ue2T3izf-5Db{
zvv9~NtA;8t+bg@Qo>xY_9N+8*xZR^}?m5y$k}_^OcONIjZDZW9!Yl2}b3dq~*1M+n
z8t77YsFcPkymsvrfR3$J7OeVNAM#af<+EMSZ`QvkK!Xh1PskkR>{kc`h*8bj&x*M1
zmbKv4`u77gbeSPo>Ut#xTjP+ryu8Qy4~!}Z^J0Go!oXEWLqo(fO|OROnUXu_k6I3l
zyb7)}6{@)oEl{*4ItvYf-Zu#pROa9vj#$wSFZn)Q&H^!a*67Q4hD_X!@kHuTY3DVd
z#dee%8btU?X8iQW=DOPzaoGMbqq)Z3LxDT?^Y2FM|B_n55egfzF&*DlojG;sVeo;|
z+s$spN}0(v<t}lrZU)95J+dVb|43{5uSuguyZIF>z4S(PbnU#&d)U0xU5Y}DtMAb;
zedf#*oiv;f$Bz;kt+~817It}zU(0urUA8RxnAvdpNVh01_J|%y7FW*e!9|!HsVM*>
zTH>YigM8!`rM~R$w)JndACf4ajmIVhHVeA9mLs?IF8_pynqbYsBsD_B*+7rDIBr(6
zUa}rA@j>u~Os*?^SUyX9Vb<b_#XcDHkYbHRzaUDrmmWXuefdZ$l<Z6KtaxdApkuP+
z!-Pc30P*bYa=UqZ<G`l?JS*(ir&U%>7XGTwNb2va8g}bSf$*OH2lID0eIU%%*t?8K
zyX-OHM5ZC78N!3^!0&=P*QmTt1sL+jRLzFL{W`wE89uJ<FmRuYJ9ea-pw~_^zP=N&
z=}vT(FRsn$oC$s}=hoVVmrXTlcWrb#?xYgqpA@{&T^4l4jX;Ro{&<=Z-T26gi@cW$
zon0f8B<bUxQ-X{srhq}}?UG4{?Y1c`Yv=flE-6wd6`$6KrH-1eZR96<+4o12Q`fE5
zwU7<80NGqE17FMs#t#MBt%eBfuzAkA^(>b7<<W3NRDjO6mkRz-mLSg5YextReJX`g
zB@RpBpY1&OJg6L3G<%TorRqN?r;q9YZ3jo6srNP$8JNF376g?|)K4D?uCkXDd$4z-
z&sXetwbli7^m2la7*|oGkL9b8;D*T_U#HirBYN%cWUK5KT+tNZe_MQ~D1-N>HL}pB
z?g?0>?Uaa{KdvE-tE|slXMtYKo&!hKWdYNrEIgL$!sR4tIVrJo{ur3@$AUhFC({9Y
z`Q>8goRO4~FEw>NlcNn9=#Fotgw4vSlo^+W^nU7;-fX~oTg&7rsno$w!}SK_BF+o3
z1S>`yt6H!c8ZP!b6~YDbos#5^9fqfn(?_D`UErvj2!+2F(}L?Jp)H>hwL8IlpMMu#
zPmc&^J>S04wpke1KeTyr6CzYSH%VMUA8xtbXC+ab`|V?(3Rily68~wE93ur3DQ<pa
z^xB@Y6F%p>)*rZwea4ZKls~;Qk3PVs=(j))%`dHD0xiEY6LeGN>@qc~T6V1#H!-Se
z8oHjhy0&xLwXK$i6HG~T4Cd!S@lpqpM~m;6E}*eujQ@6$*oggH%zNGpnSfAqI7HIo
z1!?4}sX+nWYB_(8<xoKfg1I4x##|Hkj*i{V6U@*D^=qqRk#`Ly-C?NJ4@34&V~tn^
zPtK?WJ!$LH?w5}K$TLR!AEtNjRyf|Mm$llk$2K#~pW&zmafuKuF2U0JsXto1nhyd{
ztnQqU@cXHv@C(Y`V=W7b?;DWLn+H0g><uPg=c|CB5eGLj+8(~+S2+HVK8Sc7PD5tU
zM}Mb{9Tw~Vu*{ImU{JhZ3CM3acxI@D(A#X<{Wg(LaMQEDfsp8kvL~__=x?nTm*VH6
zlq+;jyRW4fdj{z3BBi}?I@xDMR-+Hw`iKi^ubqXQy8j<02+j$HSrFW5I&U!)mF<?m
z3KB^;)$d)`;)wc~Uy;T5qL=b!?+pQSn9oM&BM$ydHS`gO{_>=H5pY~jvzF!qbsRyD
zj{S=PC!8UWZu82KGLzGC+a@Sq^7S-LhJ#nml}J==PUfvk?NkqiKzBD50tfzbuejC4
zm`j)cQMuNmrt4W{B*xD1J@3bC#>{MQWT;Es)9mkg=`ypo^!f1d_{7C~5HJq=FGm0X
z3xOP)c!dhsiFynz;uqP=rLvXKKerbexRNfY%iFXWwL7Ci=XulFQ)ivmZV;XGut>oZ
zLEd_d^-7ONuex<`LV`^G4S&ZV+V!`if)ykyGrTsKyt0#}_Wc=71!2R+r7&G6B_EZN
zG~7V&tfj6dTOFu9$a#zn22}y?GT=P^FE)H*J`I+6`aS=_?zb$KeXvzN#hUH+3Pukk
zgtLKf^c?bA*xvBEcsAD++*R<~DVYrQs34Adzo{a9?|lYlaPs^z7m(uBOx&SRbSe}Q
z6t@3g&f1mnAXxm93*9Kbd4Rqb0+kFL4<8najUI)z@axI1xW>ztxUzCWc^NckHzdU)
z6rI;b@#&L7+D{V5z8#)Quzj%DbN`)YTqDZ@YTZAbLm+lPf`ihtOih(psNdNXj70!q
zY0}CPpZ@OT!~v5N<3;eFa$c)bcm=Y1FSQ5v5^VIlY1eh&2mdW5S=Bw(dVFF%_EG(_
zTPTHG(tY)Pknk3|4?e{)AnFYqR$;emlg_7femx)JF>^r-78zH(P?k)(90m#=kOrN9
zWpR<i5T-Qw=VLxDQT-)CdmuL?YNn?Hd~P*jK~R|NtH7Zy6t`cIWBC)GUS+N+6a^Rv
zh8L+?ffZ-(dtNZ?-UGqGe+Zl_90CRwEBCO0910N4VGY(etBwxz-L1E-U3)O?8n+B?
zygAi+Onk2sycOCJ(lNE3xZqS8uv=VwoD0Ur-&c0~dY?PEP8LqrsusrMw2@JOARIqP
zI3emh7ZwX!!IT<E(lafbf-zZ5qB~oIO<dVcB|f!$r*^&({cM7<S{U_UtWmk>mzV#@
z*~fe@EtKTcfn;J$HmO6JaW)$J5#jh2353IN^E*qa?!z|fr<PO2;kyaSSuBv#O5UJc
z2k#LU+^#no2{}e^3#4NEo@JR0>^odXN)h%F*;1)FJW4t&!=a{H*xG<JCF+b9mVu-Z
z!t?mwCV?*vqM6VA(ioqg*RxRkI-)dQY8%wFR!UkDCLP@kEDf4_TQ^RY4o^~-ecMZt
zhn|9js$8oWmN_;o!IiluDCG;l4UAs;D>+cX9$X9Gav5w=L~}A82JHy`zLy|`gQ))k
z^U`jymn{6<?a<`$g-Bbkn7mx+&bL;EXSzmPLpodkzV_bQDoA>;CW5=G<lReMOO6hQ
zCI+@Wr`nz-8xTsPOB|lJLM{I2;<>}e+7S@XwgcH*A1uPaKYo-kFT9puIEwnn!{2ZL
ze%2-I#5eUSeAexL|IIq%F^|o@yp8SG$E$N3M+y)g^GdqAUQimlkEB6*^m&s=D?2KJ
zdt0MMWpi*yh2jxE;$JGWNQGsS^77QdNn`(wM;BVWHfu7IjmI?Ri~K5zq6c@STL*ZZ
zIUtbfc-=+kSPXV-cSS{0Vts84CE-n7t=4<qT!&9F9EazM<`#!HAZ6T7JIhgN?2o6j
zU-M^BD5<*V&F(p|cBS$IhtOopLkNzOyXubB=81L*lj^&Y$s3jXVH`(3CNy`OBjv&@
zQvo$)&&IMSt!^`A`meSj7RoOwv!mD`;TDG*v4&yLz|8|~ZVcXWWqc@PosEVPM*$~^
zl_VnS91m(#P`mTshDA^|JqM%RE(O}K&Tufu*LF4E;(Jh?o-B1O7wFXeX&LsEs~5TK
zsfK2}@L{nEi2@FTI^DtuvJl=tav)6b^`4;YYrw#5)deEDZDLqrxQVE5pZh)`v4!@A
zH_sf2u~Cm;K%+JO>uw(^Qt~Jp1{iy4WnG(ydxhcRuu-E-cPG~-6N7Q3GGXH>$u%d9
zYp~7!xWwrhI~lgVXo0J_Y<nQx@iN|WB%2s?%ypRFfb-!C<BK{VnSsC$(Tq?0&t$<Y
zh(X6p=yiVtR11|PX;{n#%a8QFc5T;mp}20#{iBUwk<{0v&Zia~v3ibX3YF7XACATk
zhkDr{@qdG+#@NPtu82c8;}RUEfq(&(YKXZA-FW<%6S!ChY*EU)bcV2oVWSe2sxix3
zTEs#r^TAhkv$^VM{PkTNQgldgrs&PVZSLA3V=Lt#o*Yw1!-==70z1>yJB<TEwHLsh
z2!1`<J^cS7i7#6F`KMDv?R+Qoq)mzN+W~srqUGt0-J;qk?Wg&67by&oQ-|)OkBlu^
zTrR6wzS$w^U^MweWoJyxfu`VRX=X_C0xe$6{F$B7Fn-f_d+4-x{(%@Uq$T+MWmWfP
zwbIwW?)Dd*HDA|jRHpF3{>sgIwq8Am*Ge}Zv?mr}9`BK|PCs<v`sx){np^NQ-mFhO
zom<XIGhLMx?QOR55J;>h>-#g4vB%?vClwqI(-a+yfYR8nZIdRc&}1fsko$sEt^rC#
z`1r8DXU>9fE<$;8u(c*LaYi`*ZtU2j$Li=D8lD4^6r3(><F5JNGS>*nJ$T`alDpjJ
zk}psGKpd1yN+b>E(k@a575!`(GM$D{N@6R+O4A>7ix=G6alE)G)QAN)ECvhBWvO1L
z6DucW-8#x$n+<!=txgtF)T%idwbMn>hMv{t>jo5t%-2zS=Jwqb@8||wfPR`>Zm&l>
z1ysrDuWO(+C22d%-@KP~12lnpThHakklb|lBQ&YSd@zm!VfFo+_EyE_gKgG<x3GN=
z@z&JAe)#>bT8&G2dp7sNq5d4>^7r;~2`B4S&eQlcbbH!_3*19G9r_Q80)_tWf72Ks
zgX$ms$kW`*@5UGLSNUJ_%6r1q1R3SbV;iwHnY#IIG?~Ws%lFgbo-5$R6hDm?q``j1
z0+^l)i_SwfF(h8v8OZ<p86a@u4IWjD%>#6|R*p$CfHX3%z%3s@g#I1~+LS%8Kailo
zu4c%_OKI=5-GHTqjuY>_@H1`Cz#R_5VD-$3_DTT|Akp6w0el_6KLlcVRgjU#dU%|$
zFtS{)rIfdnLDpDG5cYiT;=fen5UhTx_W$&dZPGX)gS_iG%WcNWr8Qgl0L_4AcT09t
z0vFNKevB4G`t1SljB1TlW`;kvUtH|Pci=_iN(23-x<#}P$Z3wOeF|$3nlSy}SPFp@
zXGHA@7vmJjbZGt{yEUMhr5iA<<Z@QDe)~}-c*KPMNPI>canP@`FaUeSsS<JT*~{vC
z{^fHks|x(2Sw|ahJcf4b{0EMIu6S}USNeS%K`c`@0NA)zH8k=z1Nv{8qTNdGt*#&D
zd1qo$jOyfmK4-ZqZ|qq^)}fCh^pZ0Vfa@B88$1o~9WH`VvJWL+7Iue?&e|cr{T;0C
zaSjC3knu(FJ4AT6b3C|_;=3uJ_At5iFMD4S!Gu=7&eM`j2Cqp_B3eMAD|QxkJ0cVU
zr+ZYAfM#HZJ$>D#FjzjpL2kLfX{JP^72(d)<e#o(R?}s?P!X0FSX`b;zTfX)8Htr{
zd3v0N9gW%<z-OKqz*-ml{!F73KvHpvkvs*+ZZDK}u{@2fI}EyfzOE#s!R-3j>t}<O
z0qZf!czfzjz0%jZ%;UVPBt8$cBG*;A`=V6S){B1u*3-rBZ}Ki?rNm%1r(wbBG)MQQ
zsRV<SX63mbfE1Z%Yqh}KeGoEe6IEU7Q0^L)w>oGk^G43z>`7U2snl0r^BKBw2hdIo
zi3WJgbX2h1ueh}==x!x|@SCd!u==s6GzM$gqcR>B88Gl!u?$8=vlq9ZJGr`#ndfxK
zbgSNR`xGE^vBFBrO*e5g;Pj3&ZCy}21}aTghX&1|NT3i%k#B~Z-z@M9Xj&ww6KbP|
z7ENe=ym6vUnfmTRi)DZ5jlwqa{wU!{4KCOh-C!;jh@0h$L}2xTT!1{J>=ZKh35>3N
z`q-+D22y?5AVdcQa%d)Ixm$pm*d?dHK=5_)Uw^JFc*I^x;Jf!%F!Ob43cCl0p)vuO
zGafWxTX&g7*Em68;SueSo3}-OlcSC%e0Q9xbQk#s_i!ohAfaO-gz)@#Px30cSCGl*
zuUzyVal$udV7AP;{W;919GXuwVz1&Oz7;K$S%G2CZ=YlT1$t@s3aPu5Z9>#ncC{Yg
z7$3SUtji(fbeBE`-B@{fc|I@EKV>XZgWag9i{7b>9)$p<UrCSJ^P<aB^AAOi;|JQC
zQg_o5w^oH;GN8kMsH}Nx7Y^z5$u)V@HF<yE(Tke|taSAYSg^Cld;cfGHM?Z!pq8%~
zX*56%oIU96HD5;XDh6DXGP8~m{;$i6iytq_WP;l#o4Bgq8XcbzVeQQW=i_O$diHgs
z>$G>9k^B6^2Qy=djAhYg)DzVDnM+{`>X8{UfC<bXoC$iX`OmVp^kt>A=QR1{w&>E;
zyrF*^*xvXI?wYF?nK^bxB3H5Ag!;tJ#xv0qt#;kcX4jR^v`Kid#V&m7JCJ)X<*Iu4
z_Yi7*PC|ca`Zjz*W8NjLgGC?glk0scfl_9<&18)zp?-Wisiz^==V$Z6y<I<jn@|}&
z%;~T?r8Mi74qh)Zci<i5ij%^reFAmUJH53w&zlo&$k%9$Kix-qO9J6=aV#tbE}ne9
zdFl8;nO6_GCD1y^HJH2b@=JS_Q+&>vW(Q)OD2B=@Uw6Dv4c|lj4ZfFQX=ARZpNH!h
zRq|C{zUIa_(D4QXoKN#hahHA5)z7MJw8{@0u~&IaQxfwYWlq)XUx286#*Pl<#Ga*_
z^EWv(^Z!C9a$~pMNct?&Hlu^oWcN7py5owWa=2oJUZHmP@b1(_o7N~l)^9Z3Ie|Lf
zD{^{0vBAda3YhkCJj`#bfZ)k(jXUco)}QWnQLfcAOTp0^?D`7qIz!*Jq-Hxm=G%6v
z@l{8K+DiSVH(|gATb`ZS*bD8|r8zUGA^$ZQW79RVRO{Y;em8}P=TTOZPs<ofY3=T3
z$m28T&h|g`({X&x*9l(Tgf3P2U);TSP}6A_HXKDnL4vMQ1Oh4+6cki?2?zpK%A(Rs
zM4I$o6HrPl6f0E-MT*jUuTfBXlNKNp>AfTYLg2dtx~uy<&(3@^@60>%{<pJ|-(AnS
z&$-Sy*NN8;KHOyvl#MxN@1QCW;m7D4ke@oWy`K=YLf9_v6Y<J;+~oNJy#-zNTMa>f
zux&Qc9T{mLR#%vO4T2YPF)|6I6GHkY&tqUFAVxBzZPVX4u*6X|Ynrw~G)*dy!Ih0z
z9MOH=PMKZVMCoO`4=(Tswt1lc+FIsZxAppli48Z9H7&9b1l{R;=P1aRzO#L|AY!+G
z>>oKQ>{!?{F7d}>oBoMGp$7B)!KM}ag30`$=W)n%MATzrT<hkMuf~4RoY<Q8hHHr0
z4qmaY_>e2}&Dxl*nXBl_dtBR<=pf$W)9nz>hd4Eb1=T@SJtykRIG9Pr>>q%*Fgt%k
zaAK(cu99#kp?FHB{vWe+9m5lbvev>m8zv^wJuSMIb3Bts5ewbU)_NcU(mrc5-gL!%
zLo$3sw_d6oK1^_pZ?-#9CIbZEg-MQ!es8#grvJAAV)5J=u(?<`V`Xds4E@XEk^$Zi
zQSkSJVn-xfi*{8XgINjqwmeHzYzmfRQ}U62Y@T_Me9E2u!psr=3ND!Sgy02Nq=d9%
zPP0?NWiZ@303Al(qvKSOieG=p$ZjGZy**L^xGSfuY7u*wXn$M@$VX~s<I9;lpVMxg
zjc9VcOzNFI-W9U(rom2Vm7(Qc)w(uK{!2ZBo>**CK&Q0TgrMY-(NT3ywA$&exM6C^
z0|c_%m$WN6b(Z(CE3a*Gx*}C2L+(&@&xx=5PDwi1-V=Gzb&fYG*=xd9QbO#RVTG(t
zaYM}uiU7z0>=|D>*rpS_PA6;%N`s!8Y@M=a7wS8j1uw*aW9I_L{x%;5%sN`=Q>u(X
zlBtG*!usu6j>l$E$Gd`1u~n$55;2mds07=eGc1-in#l{9AZj&jqe$oD-_v>mrzReY
z4Q$9yJVZqH{W9Ou*)U^p)-NvZC<jPFGN=huJEEX=<7|9xnO&8G-Pju8@p!xJK+}_1
z&v&?tZ+*)O$7`?fFp9)Ilt+V;Y(19K8NbFcDF}O;CG8{eZK>$bBMKh~1a8BZW+d;T
zht!w!h}eV2#Z&G;0aH1`fMxFs-J4fthZ%2wxlqmP8`$R%89uJK*p}?|B<m<+w0_aV
zI<wL@e`x!He#v0p%+*m}sK%w>v?DX^?ioU4&gL8Q$Z22%J&OYwP>|<WO6VH&aCS39
z-ttu=HPe~Op*f3ci!$k3syiaWs}KeLj1z_9Ai2SPC)><}m*dyc7~PQj3apgKJm6ZO
z8{u6aHuBCfia68j=fE13CIn^ZjV?PhE!9eZvwlXT@!_BeN)oSLR5>gwRCdW5#q90O
z)Z%==_WP^k#YmT{kvzfHg(a4*fd&3Q)GUNberBkO<6zP}EqT`#b>sWYowDP5x@Xe(
z829)u=t-O~;Do&k5|iS3{Jh8fZ4SBp2{g#NdseSGJL5VQc^3r1mfI$0+i#2&;=+-*
z0HVBi&OVq4HhOlzBRj-RApeXQ>&RXJ*zH<Lf#iC4=Ns+O@#0L|7=yLeeCB@cTz$>o
zM*PsJ*o_*iR-U1(1zpV=o$5DE-~Mtn1e0e2(fpzQ^GoggXhA&@*D!&e7x$$Mi-dSX
z8OsuOmFDfrIC_Mh^K?)m18hu5=$8F>ve`-vpz?{I7~~D^`BUh`_d><}0FT@~p|Q)1
z1hJ}h#08ZxHe{w3|7EnV>v78+Ww~Qv5)#M|Z7?m(ntu6sCQG&d+Sy0Lw{*A__xDXw
zTuv246_Q-vc~}*12Aat<6p9#P;w}b#z^HX{6OAPu`qqq;l}<Ep)oNGSE8vc<Y^IJi
zxgCu^@qX7Q&&)d$2W2bhWlQMHBolG@AKru;?`W+b_Izh&m-armzo3~UFnGgE)APWw
z8J6Rqvn<9PtOQ`{|M0prb(kRQcOkvfhF|~R`NyE%pgeKQ0ulFwNvji7gC7!e9|*#o
z^PQbEJ2#l+&lHV&4?CT6Yoy9^ErAJDNiZw*9?W#+L&EQ+J^5SJ+<l%$fW#Qk#`OF6
zZSvO$<M5qf^-SjwdW{!5^LWQ!t^Mw)SxoQRITZ$qR)9r*#fU$&%cC|dByT{XZM?v=
z#d<&N(%0Wy#=j0gbE5gaRFwrsSy$j?VF!l>E8%#b_=C#q5;FyjjRVX51B(YFI>99z
zF)KYA)ov9kOmUJLDkj6QbuX4DB*v*art<i<8JU&O1=*I3%ofaN*MKfx<C4~*_9F%H
z!-Cqb`~fGszw+Z|rSl~WIV8hJu@+r%J!t4i!=<$ay?Dcl*8`}uz^t^5<Y$vby#Y;(
z6A2Y`mMcxSC0(E*al@(x@dXC`eJGamC4XkhP!hwNHsLS(F@b#^I(Jy_A-9oENHUen
z<R2TybD@GgisMc_djE1&UQ~m_(AM(tJWoOE%LV08$zsPupO4%u_;%LS+UN^hNU6K?
zhNE?hphvj~*)r$wEZsgA|5B4v5^Ty17x0a<D(|#x3S78!ifZrC6O*EFXu#gqG&8Sk
zgU=>s59f?-Yg=J(gvr{eX><_EImj#*|BC5FF1s}$*Uq{!lk>}c&SQ&(%_4Fwf{aON
z<6O=D<86ijIAPm}JndN6MwZ<3y)Cm}an7l+!J^B4`Uc6!!PhEpea1%Op%DP<6g#}W
zR|%ztGhK5g^H->62Hv~FdBM_TAb1u|KAc|?;i0nb$IvcliZiX>Ryq&2ovhyvx;lID
z#i%Gf9M?FIJxyEB8hEJ?9)tX{_m5ge7?CduUi)V*e$t{1ITK`i0lS5c8L0C{>P$O8
zHTJ&S5?T#~UC&apJ&-owX01pk|5!ntJA)-vrbK4VaO?)g=!-S}$H>qA>&P7P@RFVu
z?fAhpp)ahY&Tr>54V-U`Tp>$ZPh`SoRZhK&IxWV?mCmH8RE(co!XcZmnGWGxWbF=_
z2GOa-B%CHkwkL|*(}H-%mqI(;JZGx*B=fCg5Ht6Otlx2tUUx`K#_pE6DmgEfkwYQ3
zD^lh}jpuG)2!65#qU=(`hUZ|EOyLJ!I+w-DO&kU9gmS0ZI0aDV3ep^NtFBD*(!=r<
zrJ@@zHr2Wdd48|G5{o@yS0z5BNRH=Qx7-0p4sAzMe-k?;P3KoF2$9^*SxQ-_N4eRj
z%9SkaJ{Yuj%)JU_D*rehP}Q_n$qp#b=h-<fl!RabRymq4o-D)w7V0#Ab$stZBh2}2
z@aN+;_;cS%8nUhF4P#}VFYc>{GQ=?7&gg5B3c<L$w5-%c9VbiH1IxAw1%4dl9ky9^
zG>}C?7nWJk<2?o(XEpgpYK{x!D7B<3L1)Y|G|sqULe_R9cAGi$pZ65e<N9Sufd`W4
zmBG~Q?7Vj6c(LN0xoZF+?y_Q)>U^rm05hR^6WEvCGx82F#4-wuC0$lda<(Rf=p0=_
zy`P>YMUzqv2R^QS{`g(`4)DbJqk`sF^`xW=XYBKvPsur6@U6iCM_X@W!o`qLA9ON|
zF%jsV_CuoNQWF-yn9*ptD!}mx_jDZ%%`rBv%zvhcI?x&CQ}ua9q=pd&bys<o7^tii
zYRUTUb>l?eWX{O0SwhT*%;|-an$jKk=O+mFt1k7A(Xx=eZtUY|Zg_zsW*V4lHa)6%
zWyiVP&ruD;cJlz8BEl%mv)8`RoZ7Anng(YI@D@c@R!VeAr!ARhT-1(bMrv)D%(-@5
zt}X1xZJvz9Zg^zB_E5>LuL(!qD9AZV!0eR_+8Zp@^OY0tY_sJOw}?%x_xug@`ujat
z&k;*~;P*mD^c-|I%k9OIC>=OQM?ISSSkY0?HEi#4XZ%-rH04H$i<Cn4@v4oYCk(^{
zgJXi+_I*!@O7I3W%^AR7G@hlC8I||gDfQ~-s`@yGLrmrw8uSAxLcWDVIotewvQEFN
zr5A^H``HPtn>pJ#TJzeyP@EU$V=jPAqEvEbO&rDIHxqE?0d^?UJcA*mHf&ki`N!l>
z{{EP0F6GOYC>$jylmYbMulN7QOZWf&KMFEgmoC<fgIM&LW=XfD@6)Vl@4I>xBoaBS
zSHB2w$)N6!tS*i$o(k1%Q}uboi98TvZH0Dzerf8tJ3v+cmcW=B^KQ)^sMQc1>mpLe
z2c5$ST%$bPWoL`lBMvve9nmmoXWVr)@93A7TF6wVvsnRee0j3Q-=Ho~b|3#x6fGSM
zQCHc&^esu(g~CX;8%<X)Y!%P7TN*&Z{k{Lq{E}ss6Px}1Royi7M5@cQ66>%S+_RrR
zvm4zU!laA5uQa=N<)SxxKCJhAU9!LwGZ>I+V1sh5d@k>E@1)$82=xcWN(m$L*XLFR
zwmj!6oZvwgG9B#fVxH-`NJ0cV^ri|oO|lLywm&XlJx(7uQ9od1pf!`L8%6Q<^_K!{
z*><DNKa4y<pHUfj^=@@AFP;ucl0$dpcGzmV|I6G%?rV=m1UtI6H=cQIq3mf}S~+Ab
zjv@%_33G--1IVf1zg|sMKVu*+JY1bt7@4Kk$QnRqR8I$Ac*LB?84~d?ze=Eob*54`
zR-G0~Qk0ZJN!_bQd;p-llZ9li&Kos@4nD9yJCHq9Yu`OM7unpl9?zr#qmo4a%SHyU
zKbG9;%&FsKj+HmO`Y#LKt}gOR4Bpj|HrryYrifI_07L!=G64N{=gI^K18JK5U;YFl
z9HfxoNuTtAMHuqrU$)eEAFO<>DdV(?)UwY>!WVTs-U9&Xn!EpH{w(64ND{|=dyYJI
z`MOMj%;w4fh=5h@ZvWqck@+MR%U~@T$+^{rIUT<`U_i05Uz1mvD+9qwP1%1N>%61u
zB2s0Bc7H8%q5(96Sz-@Mz`ra<VgJr@f~5$Q2igdUvCIqLK(7Gs_<vmy!2iA=Tp$zC
zx4GK>HMQTC_@T@Rkl_j^{qG}=1vIeK)#z@vyuKb@E!2qMK<EH6g4_Rc6O)Z57KX{u
z-3)uULe505RSk%MDm8Whx&JR+q6(<CBIh?A+T%qr*FXM|4<iEHHTls0R$uf^;3&t4
zO0PMZ;BOnAX9^%NAnAzxU(}Ug^WW=0OT1l5u7>*|8OR{bs^Q|ljI+!xv5{9&5hAtN
z!1T(Em3VO`1#r(K0qH8v`)_J0EOT}rDcj;E3fk$uW%Yo|pk69^U>V(Z#|j$J)iN|2
zEECnC(5(T^N%?<nV26H+#$H-Tmq)!NRMX^CPWoH%(%}Av8GN#F!h2-T*W9S<x!h7S
z-?@VA>t9^V0HwxOi;Sk22y!K&yY^h7CX2)#Ps|>Ev;U?AV~N^4ed;Dy+rZ<b#Q0n~
z3pKkZc9+>XE#G~%3sN6`g=@@I!L{bZv!#!6;TvXL!gqb?1rtYTqb5g!Pmz$z;YAD_
z{z!WAy>D(n-2P>pPPAtbK#q<LJj9H)sp6a7kb;c+ap^0)sg_^4JakprPYqztAh~Q(
zUd4x#r~}N-Wt^f)W*y+n<-Slp|Fo_dgdhZKq#pqpNcwNOResi3-cR9Cwd0<0$6PE3
zJs>UQ^S?FMJt5^c>I44MOh$_Xu2Ni!T;=WKi?F-)LQX&vk1nC3Z<UiYygVjAGC^bJ
z?7750!Hy-y{4W{EJh+#Z-o?E+A$~VY;HQEJbB2f_a%Evbkac3(7kn)-a$U@89@i+1
zpOw}(;pnX6taY9fd#pIW=xmL5b{|g#IanR9WP;tmW_-xNwOUq(<q4|9Vl65*qQ1}B
zY-lazlebRxux0jHSbGT-4b7;dS;P+D=y9C6^A)RE87JpAstaDt%Cpm|O&nZ6{*f8;
z-(GaIU*=H)(~-pEB?r@Q(pWbh(#JfQySsd)cmruEBGol39bH!2{}j4+S{uN!c;}~9
zniiFI4}wqi&o@pOirJqkNZ+tS<!ZFmN*0X>(8EORYcU4%y_fFvx-q~|L%1!cjJ`#n
zGcr(97Brz=%TWf~8ZiN&{>504y|eOcYYPSN<uhN&Tx&%A{aXT#`&QxmTY%*dmhz8x
z7;*ea;GHl^KoX)_NH>frFJV_<<70B=%A)HRq-BK%&QkI<6KlHC=b>_~d_-CwF{k!r
zRD^_wa$76Yb7B$RE-~0<r3e$mK>YA+yfpE6tDgvvfL!0&frZ7|z2$R2?_7&^9izJ(
zbz^P#I1h{eOE!Uxj;`o!{^N3$-MK(&$MXMS&1kYsPIy|-k|NE+1R2km_&D|q_TQ*N
z8oGQUccV!8K8lEdI7;Qn$#_^$o4>I<dhHNbWSLVcYpHcv^J4P}$8MXtQN>)D-r;JM
z9I1IQozm&5Gjz&DoQj;K8?k3dyM5aCfg~CBTudZp_2JSS8Y6Ya7O0+|dsP3=Jwm)!
zXEVimn8(=Ukz9BrM6VUFFr%mU-bP9(PY5!C@Imi8&z|VvXxBF){3Vnt5#dPf<{6Dk
z!_pfdW-|j94JoSbJmtt%*N<P#`EEsGf)dJpXiH(|?ge5kX24@M#;L-YwB~{u((yyc
z$I4fdu6qL^``p+056p~#hmpzI-Ai=cv%LM-eTk2V3UlA~F6#hSZruDp{$bd=k3|M&
z0leKhzV_`9(e91Ms+v4{x`<?M4rm_3LL|AoB;3G-ffc4NY#{NTCT86WFO$k;9Q6?2
zv9si8Ha04;F;FCCz^rMo`iG5?DY(>rGDFb^Yd86(TA}@t={$`ovxFrfWKyH^#zX90
zKWJB+&rr3a%y7dZh);)I=+Yz7>j0iZ?dqkBk`X?dE;sO`o}}s(hiZQW`&fb3TqKPF
zN20^#TNOC`Pb%*)5ULnp-&`#ChgX4>yRLNcz@zHMWU)Q0rgK*`;x^SOiNP5`uH2HA
z?xUCH+?33zGjO?-(TwI2<!R>&{n+&5@JYKL`zW5<KK#f2Rf__Y$pIrD;%MM(?JF0V
zjqjR|e%W!||JZRiucOtD=8%hAw!sDPL6p$Zg>}HLhm-FO7nB=$KUAXDn+X5{>oL#K
zym)&#bmOk^{8k+s-jwJ1TCB%^9($aM7jkgjz=0g^Vcc>lqaV3B%jD@WlL_J&gXEL4
z;B~lfJ^j01fcAR@E3$1lQZ89E+DX?(SHm+<n{KM#KGWXh+e(wO3#*vRy%Blxf#?km
zk-BSW$s%O$mne*@@Ai@R%;q};XP6EY_;J(PsmY<ui$)fcUW<BeWMvh=6ybe9qd&z0
z9wYDh*AS`-D@yx^iO-@ex?D6cnR83z7+YPPH@VU^fZVM-zo?umgLHTi^|25~_BfNX
z@t%Z@&qesip+N){J(?YV$=Xz(gXm!OB`f%_M1aG%j3u9B_At<09SWeq%Bj@pZ(bV{
zEmr>K;a;P!gH?pyW`oRUn*V8sF`VIer!${(%lYajWsGrKW&ac#DXZt80o*K<Ng@#k
z9m0N0)PRb_Qx=ShRU&DpZ5YLg;BY2AS{kE*iQXj3A%4Jeejf4hdmtR=VMNaQ9%ZoF
zd8_*0Rxb8{`d+=m5^X=PiAg=@k~lD07G;CUNn?;9<c0fFIjh7$>dF5y!x2Y8%1GIo
zm7gsr2FawF{{P)L@!nyiX1M*EkCaDzTo3Q;E1X*v@c8D$q)%k%l5wn0vDp~z>GFL4
z`uk1S3vV<~t5pSC819X}EoS}knOz;tFK^C0EFJzHo)@3gG{ad&u$<n|Y0f8ms`Npd
z(WBK%LrzUxobaEB6^QZ0whSE{qI*U#+n>aRrj7k|HQv4Zt6m09b8jRBPIJN4j|g(+
zrD9wM)dh;C1_D_@vMIAEvmvT%<7(2{Gj#*~dA|c^HV4E?;i+d*o3;F~e*sr_sniAh
z2T@P<UBNn!ZJs2WKhplq>Xfxg<@OqMLtMq0KlYD(=hct>s!}n3`RmQ}Vy_BaH-qWV
z8hr^~OoB>sUpC$*DcgiB!t6COTA6;5DRt7Q(gK13Z1h2)zP|HO4bs>1Kf%wd-u&${
zg?Su5a_M;{f>%Itv&aX5)pc9EOPURHKN_>{yfyKmokPh+y8ZmJ$M?+5OxTb-?+(xJ
zjyq-hK^~2L46ceQ$m;pUi4FtIL5mCm?gXXs)ee3|QO`+_d2Ti_Db@5sm&<?1?Gkew
z*V}5j(SyLoEg-tnbC`0rtGajmLJ8gCmLah#K;tCK{ATJhOjR=oSn4~rDsbrN=tT8z
zop$1@y|7OB9=bJH{D38%Bbubd6v!naB{(%iv8s~y#x6g5ZQ2Qyv<+kA@}Ko!HKc;z
z+mK!iy&U@HA&Ga?;)Z>M-~0)~T`);!%bcJqSj)i$){M=o36HSjkI@<fc;ryY+{JZf
z*{}L;Q!6IS2(0IR@=(8b&rf83Y!iM<jU{^@?1J^g!beiMz*;Q#dhF||qBvgbac_1c
zYub*RU-fu0&{h*yIh0{#5K&t0G=B>at>fKoKUNMsS{Py`u~Fz_PG*#j&Jd;cKrswl
zb92Eiv?hQ!7UZY(x`&a;f(nPg&Cwlu3Bs0CCo+TSyN4}HLi$IIOvCCobxw?&)|7Rd
zlNpqS@v-~9*x|t;y)5><f;t&ugi(SUXh3snCe(#4@#mfwGWh^WyPz;3Xwe4PmfLqj
z)@9cXI&!zam!F?6Q4dd8O0izOztlz=kRi9kehArRGF2L>lF?)|2vo;b=}ke{57DVY
zvH>^Sc2W+lH3BHIFf5Q3y0)#jM5nuDk7?C`OTi&yO9tzW-Dn`oNG?|nIaFa&=4_Ng
z`@X5RLlT#l4o8i(>NGo!i#xIr1!j_57*78>%?9;}1r4BNw9!yJW#RQ#4qPzx)fVOl
zj8?f2Z}^K%R^haiDQ5n#w6ru(O9S1aNDheRR1Q^?6Bz*IEQU{GpzBXCki$x6PMRB(
zbB>Ow`Qb7GT!-x#ln+@jxmwB(D(^<%mWe1WSf1_mgBHxKx!YG+p-Bp=`(v@G2W55f
z=Vw6>9kTLhr6So&?{0=+6{ooU`>edYZ)rCNZKp*AsEN+EQa03$>7eb0m@*1YZ(GrX
zHMB-5*E;RvgtJQZ^&8By-vS=?_L16h@4XvV0E_^tQTPg2AntRZos8FD<W~zDua%Z&
zm9Jn}!Mqyx`HG!2I;B$A7$ew=&`Z=pQOGutS`!PS8Zx%LkFWzm^{{q+np<O31vd?v
zW{{`#e7^pSHq2pT=z)`Xt6l-K>26OF1toqUokaYt{bz81vfS6Uo)>rBCD5~U>)_Wr
zzkyAR>Tipv&0fP~6k6N^40KRF+d_l6e${$N&9-no1l;I+h>9`~!Jo>LdIJyx^5|I0
znGnIa!BW6G2HvsxS@pN$)Vw^+7V05wM>>-mwzakvE!1ny2P3o6GW0y7w8A1+-g~jb
z_Kkcztoq1Lc_krK{Ukv6d8t^kJe&1c>N!U?eTOQm<we>TAfS~QgFHqN*v8;gpL#9F
zHp9I_;yKG#%19c5ZLzJ;T{U*!UzM;6Gjh(o<#{|NDDul?ja8<aKvbB;MQU>;7IbG>
z^RqdXQATMklAr^(qVh2jobooHSlPho)~qK}YS%w*kZ(uvsW?(6pu5#_K33P3B4117
z!Xd3Gt2E6F_5QV{fPHqW7|ln|Ie;l${YaJ^aPw~MaC&I0&X4{6+oC{1!L~<LMCS0i
z2WW-+nPiGY-!4gUmHf7_Z^Qd#{Ly&g)BwI`;%#DqW4T|<5N(&tij4tsgmpe@^o!pz
zJkLJAbTB*kLlT5X%zdgsISQn#Zk0V3+yo_LAnf-nk1z;7@KF`?7vRm<98r4hBE9+@
zr0eOBJf(ZWMg*uWh`ecMX(qk4v9rX2Y@JS*o2!S4Ii$%R+N)MpP6c-^(i)_YqOJL_
z!8&as)e+CW3c4fi0#&&dPV&lc11FeX>Y^72VM}j%gw1tjMM(W3SaSXHXmdAgEjNyV
zRhdKLKrs5)NGW&5@9X?77n2z!j;7QhRImlSvGP2yrmT2T)SQ>c_G1DxqWszidKz@u
z*$~`A+DbzKnO5@)aub4_XqUq^B_CJ;{(1x8uYKq%%q*vXJ#Rqi=-L*knU*2RiiNcA
zz@~lZ@b34Mef@PW6g%NR=~xpu;DyCUH7xU?3vEEQ^#kR``U(G@rB@&^JGNo4!~bBt
z`$;nf{^WSks35BC8iXy`Z`3DA&8)e@*V(zPKjMJ?*x!DlVs=yJD8S?RFrJ?2NmQpD
z5|YgHerr1%z-}O7%eGl^$*{<BArpV6eu!Wvw0WnY5uS0D+Wcgqs#Z+hBo?3F?mc#L
zSIXN4czS?s^zg;zs?@3LMy=<zQqnyZvfUUssZU;`!o&iw1ejGcL%Tp=I&nRHx8^lD
zbmqHXFPg#uU|imMy^&6b>0>xHhQV!o(s-TbQ68;pt0P^p3Z4-NOYYyZ;|%12(m#q@
zAZv%+7w3?*Aaczs(k0!8R>c$G(+{tbA63sRtsT=7aV!kSDJB^j{28gXxYB|%dKU>2
zdPM1iZ1M{Fl&eIB;ZB#EqR1en-kH8hC#PUwBfI}%u=%U?EZBKN*O|wFi2mN)%!Q3<
zF6GV)w_|QSi_NEGDCNzZyaLF13IO}kSKu~LaEv(qE`(u{YK<@)lIW9$&YupzU!h{{
z=YF2GxMSfLYU_f(^~*!g$$696vz;&f=j0~LE=!1dzu~6XoFZ*FJK8?T&1=X`Ybb8t
zvL4s3h|uv8`O-B7GZJCzjvnlLP!Q$M)Lv;oEJERU=?$Ii$E|n@=J{yH#rjR$Z%vk`
zHfJgexlh-lzpx}W7g4o=bN3ajM*qU+vY4S#UwSm4oz>#7rAJdsIUo6f_p83&4dgof
zHQAj$Wn;fw26hwNy9I(>hm3B=RL-1G@{#-~#*@|$I=_8M<B|Dn|H6MGpFE?2+Ee+>
ztn}C&XD^Y<<c=p$|Bs#PmKAEMq9c9w{S$qvV<ux8-wRkt;)%*al$Bb()+$wF^Pw!D
z#orp$27SK!MpSnx$cyNOUsz~I9~C=*z)I|4WD4;RrJt%zrW#y^L;GRX_SC6TV;EE!
z`Y%%zj9j4`KN$8re%MfLJyKV6SyMzd6mz5K(5#B_yS<CrwA0tpSfxVu64wJw!qRQt
zoPGLS?!|{0UO&pz(8DUDNw;V5!!7qK9HhRkw8WdO<YQpw*#QfhVxbxC^*RGf6*fT8
zTqvH1d;f7M(Zy@ErP_a-(klN|<s0Ca<<saZIeME5l#A|R8E_ND=<E5;M`P_=MG>Wu
z+ElH6#A15K1ObjR#4w0z$WUVsDPNms`4x-yBVXm2$%qx|EkvgVt-%@T_t(%)-w4G&
zC1PLnyqat0tvC#gaCdJ(<uNpwt3miApN*IZiM@L(9V%J2EY|qNztL<V+5fVDQZN@X
zwGP<K75T`?Snz(86AY!X{w1RZ<<m{yy;fVjR@Sf|Ii3ywc?$+Bn{+Ha$OD_>0vby3
zS7T<U-%f)X_0^?@yoAe9>c@h4Hi#npr6GFGE!TW0#0=geM_E(7-W(!>c&>F&k%2-p
zGe|w$Vhuc20E^;~wIqt?3weuu%$qRmUR149+4!VVT0B*W;I%1TN|fKvx!Ff2V}Pqf
zSi6sE1vn;y+%*38%jsTb#>W+Z$WhlK)qee{Gk-bn&nF2A;m8=HZpTlcZ_hDk6;@2b
z<xW*x3&QjhA(%tL(m2S}=-N?2w@6K2#!6A%V+l@@c+l)bpP@!;w)sAOZdqM!Th7J-
zi$vHr+hO>4XXm|?smh_O=cxXDXrni*dT#UXnBuOdw=x3ASGsfd;iWxT5!p@K{>9Us
zr)rxU93rShecn%h5U87xM_aT`48;gW+3YLv^VZEFX^L!waGy0j6Vbm?2jbC5!n4=V
zc2{6r&Ouo5Ti8dEJf+;`kW_;wIX!?XJW(yWuvwfbo^w-XYms!5iL-plU*N*kLBThy
z26h@!@1uj*WmoiQ=jgOF$MNp@ddu_CxB-Q*R39q0`d#3iP%Y&EQ1Y3lOOEaQ@<=RU
zgW625BNgaPKX+l7wn5d^p`we1MULOA4;t!xjarUd&?^{}HdmxzuLVvFK6zSI7>fm&
z{|dEj0YsYD*aPdg?Rr}fVqPgoqMfvhZsWl8vqTx)r!@>h{!S|Fa_<V8i-1v?F5$Qe
zL;<va8lw7t42LB=fh%&<skjlb>ni^4U~yx$`{xe=8C_JP8DFw*<flhMm0%NQ5fF(C
z`R>z&y4FH%f=D&U<)ZWt^t94RmQ|=9Kf<agZ)qIz6^;oqDU5QnJS8EPXOBAaDXJkq
zn-T`n2Gpo`&qO{@vbD+^vAQK>DOwjiW9$!g*_-MiNz!GPn^7G1KhhPyn3xh|Ki@8P
z{L@qNJK&*N+(knTTxOGQr${M=FQh3?-vJqKpPV93EdVRu<fm~$?Q;eAX1B!_0ZdE~
zs#N{*%RKpy^S)t<&Wm^OF<r|X(6(N)1dJ;84m2n1Dtp_P-&<4x(ueKj(N!kam;wiK
zp7gNz*~^Y$QS9QJWaTQ9i2)|+WAQi1nvJ69&dh_upO8&FN<l)vt0@LVn}POXibYH1
zS{p$FGvCfUV$m(oGE-8Cn(Vk}%SObN(2Z;}v;9zoiHw}6@A0DhNsV?zGuic?FPR`6
zA9haOOAd2lPt&u+>x>mCpJ_Ap4;2ymEUL53Z3X8j0LI=FVcl)rqiVFT$gf2YE+u+>
zLU77T#)}i-5!pI;_I*wrc$>##COkooioYaB*>d{@vBbbvQ}S?MHkF)gs_F*2DfygD
zLN`|pYT!9a=?6rzd>Z{Fi?34V^pRD@+{;lk={VIv>H|qQ0E-@2n5$a-_4U`W7AJJP
z2XxBm6<0ECqU*nPt%iPp$o5n9W3tAwKu`@w0>5tu`(f*(nGv&wwIb^vJ1%x%@kBXR
zeOJVCca~8km_i!%+}4nljm%v@o@u(Zki)<%F~gx)I#nJu0nF<NMco1f{$;=O;zXKh
zaUMPA+}!-3S@B!I>i^5jDO?-Vu?|0JyE-(T&N>xIZW(%NCCmv))&e?^fj}>IWNS<w
zgG7bLVlmo}fjg{rFr(PxZd$by2eFKb-he(d*iH8?Luy$cHD_?!-U<{QSlzG#T?A3d
zr&>hEM_0dfIo?h?0O`owJ{?-lXMz#xT92^H86K|YyU{&MaeVW78acN8{>bgaHqsuw
zY|`-P>@PmjIngMoBH<g|3*W!$ygJNXdM`Nx3i>S61`0wT9a%p<8<8!CmLXL&3jk)`
z0M}IjOO0{M4i_^@kN11J=YhY^#0;Dd+i60yqtEQWo(dHLgvufHdugFI#cL1j8=o@K
zuY5D~m474;iK(ILxeh*dL7z5|1q!)-^~#;WmeRTSV9$bpmZAC#l;K%<w8v;2S^FVN
zIxcgbdfdy>bwiVk^MBj|{VM<3X7U#$_>us1AibpMy1h_pB!AEPSeY*J_VnuFVUFXn
zA3-xN;W=RH$LjAwkKGlO+SnC~y;Rq~dGTaA?!{uAPLp*raPI$!6S&z^2wgJsH5@jc
zDBjv&?%?sX(h=Ca>m-r*`TE__wwnT!GB<J7hkTGs*`37<wotvJEl}ScV4tBz-ShxZ
zANfrTMD%CH8DRNXl$(p8``^cD=%^ILX|4-Ep6hpwEi5b=OCXR5>O7Tcgg32+q+KYP
zEwN`q?E3xXi^du>K%V$PlkH*}0F3}YI>6MzB1H!=Vf$I~uip`fQydkp^Qi#l@8Wl%
z+R6j?yVRLDP+8N}&!cA<IIAtUS%5$$;2hR_(bCE)4|D;SAn&-_Q$ng<+kjSt)5OBK
z4%3CTl{(Uym$D4$xRx$HWu#l#GZ4%C6~-!LqNxEDW{^zVAG_d9mEsc0*6adIR%?{d
z)wh-gij$kk@n~OYl@rHa3HSENRUkJy=tCk0aQkr%ow3vk`X6`PPzn$$W1XXr+b%kT
z6FYBSb49+61iH1kV&N73x`}k}kji<7iG@0{r_JMOk$?&2GtH?mX{SW>8{M`pWe7^s
zr8heT*1znM+C=8;49zy!liV&VexY=sdJI7#c)5*#x+Ra6A)_&R11$iLvi|tF&>HJX
ztVUmEUlUAK>OKhl2?7FtlC6ImD)^XqPo(S;B!(&*5{z$53-D!X3I<z&+=WOJAk8+?
zg`oHiJhQ<uVAlj=sdr!^5LF0pn9KdGa{i{ph_!{{1$Wa!&`_$c3UYh5zuno{>HIbp
z+drG($_jyOZ>D+78@N}}v+_+~Nl34KPLV-8GgjvtDQ0vSEuH4p7N_nc6`bOdc5*kG
zuK+cfwNbESYGc8lUu^_m)qeX3t3P2|E4l0E^~%vO_LAAdWGXzojTYTxmGA_b)#77S
zp*2nBt-rNtrS0-Tv4%ZNU1dB!uZQ4r`IhrH<fdpD8GCs@*X9g2${A=Hf#M~7{OiGD
z#>$-{vh9at7sW4g$lAQ|=AhtVslM`sY6c1)>gTzJy`<ig<(Bd7W7P+bXA(V(YNeb8
z{?L6i<F@h-)pa6$jCejR0;&Jy=Fdplf4?@8W`mrb$}*}IDF83rGK&a*gtd5pCmV`w
zac<X-ldg1>lkw1B-`E<GnLTMEW;gz+YFjk|4XV+P7fHC3j)U-D{`*zte<rwOun!;j
zC)Fqq%w2ixk><w47Q`lJNkSdF9&Cl|aERNx3v#oMYFCu)j?Te_>W8C0gtXhw08*!d
zQVP?nu8OVvEG5~EA|@0n_OZV}(eOayHc*~-q{|8tLS=T&F;9K{K1*k~Kf72*#NF7V
zAlE&C5;gC6=4<Y>eEo7Xsq|!glvbCs2}ep9X#c@LMKYXwj6?O7((Cb2ysw#s_dzs=
zso2sKvu%(dM|JYni;QRX177Rc(5CFt)n_Hcpa-V#CnpXF6gW7BrHbO$Bg$SFh};p&
zW-T40<v~LQ%2wJQ?Cw#$->qV>$D1rDCRDLSmYk<1nLWLvrRD?iKJ`OmdQazr-OmF^
ze&wK|*!6qP_3PF>J?Eny+z2&5t$m5bDsj1;41cL?vxT(_BSL@~X1-%s?_6L=rBkGv
z%Sy*&AeNW<RyaimNzODQVB~rg#{)rFIbd}R8pe}nuK8P(z0em8&r(a$Y`UE$WdSnH
z(~j;x)Q7I(r*;zD0cw-mA>Pv>%X0wlJB?Ng8gNgP6c{SW<VJWwXS;1AU@7MOm%wSt
zwPdz(&}K?cJL2&h{RXG{P2nWnwO$vSo2U)UhEHrPR-<&x;3S69Ycq2mgG6c??C&ib
zu}NkGJDqsk5#Z!M1qGt6TfjW3T8E&WcTbRJ;?B<GM!WR^&q5+r-rIPt?Bw-QoqW?n
z=R8+ADhgQtkRl{t-14QCUVnvcjbd0syj)s?p=GU<{=-{^^V9PCr&S7=^EvWm;#Kd9
zaa%)x`vyz~s{6KMsP2U%7FzSwodA6%1p95@a%W~z<Yi1^<ypYPT6u}69UXPAQ22V~
z!qcSrJ|<S^J{IUX?s8M7iNHB41J9wW(@lH-z@q#qQG!p{nwlee9}9?s?GyX$I3Q#F
z2)c!j2ZsD+FSIXKBY^p=d7|tkV{L@onuph-nLSBk;LW?4jrynZ-U_3&n~O{YM$XM?
zhI=N(X{yzm=#hQ3m#aGJt@mm5nqZM^0pl)Sq$nHrW^Ua@C*$m2g#$9!a_5ig62dLg
zms2jn&}A_!vDz8Xa}t4i36XtuGSDtjZL_|@?Of4#mceypXMM5d1w5}hKU1W(+d5>J
zffOXbIUd%2LA2v^NZJ~B@BVt^AeovU_YFx)HZFxnVWpZf%j$yePQ0K6{$}RjtCL#b
za;p951kSub^t@g8ql#QzN*0FK_~B?)()|JH0oy(v`f)pjwEN)^2T2HEd~6Gn5Crl(
z0nl&rZU+vqVl|mj=YrKIUMNt%TIv1>JIBkzF|d??k<N`V&_;dtddOMVQ5XNlc7rF#
zvzuA!L3qTWe|)V?Z~z#GAo`>Fp`yT_pdp+F!khJg`@!%EA@Pni)6JHsP2$rVa;Vsi
zYJn{QG(2x9^N*(5eZ7g=CR!1H{PH!yf@)GnN{R7hcOq$Ew*L>s;3?Mcnv>^41%?O~
zB?;oyB0Aw#jM*Vtq7Vlv19wL5O?bKUw_0AuFL6M?G-Ux2?{EKEY0Er8osWU*F&UV4
z-r|!xCeg?~{Oy9cKGJkiTVN9-ca6OM;Tvb%MO3@l+VXv~MGU#87bJx$+ai2g5KDFH
zNjLW=q6tmd#r?4C32>4us;^F3VE=Hylb<W`F_A`-G~r7bs0SB_XW!VO6f+a^vnCp!
zQpckL?%*{K<2!z!yUDXg-jFB2nN6wLA0ls<35qM2a^eBgNmm+aGsq*Ox%|SURlInN
z)%7mCz&jw0g0*AE-)JZb3Z&Yo1v8EX0&&=V<JAKXP3^h4j8gLp)yST+A$TI)mYKC2
zdT1lSP{+!sHS+MUTPT|S2z&70jA)?!J_ctHA~s|{5OCQ_zHdCwZY)nB{*;N*)dO3z
zB<VGN6gnurHPJK3oqSY@BL5<%dv9fRSfnBKFqJM8S)9(P_apcc0D3e8P&rN6>#rRB
z6GoMhlcr-Q`a+}buZ_{6?02RS6aOE}=SXQ?Xfbr|S%5jON>d9Y5AOCfU$9M5!CkV{
zn{IWjkWZS{p0&Cx6L-J0L4K$(KYrLeu8Se$Hpb$JW&B~r=nL$Iu?;r`=X(Z+dcpyx
zxBJ*sp)XX+7FbXWW^Z!)#w#`>9S$!rsPk7WeBK)An^EBf8#0XVCvHir1RA~k$F8*D
zopFcD;h@s}ytPS)713O$ZBXB|G9S3Xi9F)YAOZhc(xXqQGs^&UJ2qs3v2v^h`ym&R
zWcx!@%!AI9q6UJlPrNWLx(M<jHIEsr&5_Xlqnp!A<>I2dDg-|-N!?E4ydfrorKalj
z@n=u;p+WlZwm;ThxnV|tcX8}Y0hUhC62ayB9-=8h63_N`0tCU@(bloX@l%aww|!dk
z((z;ApjHFi_s+OY9?9MO@7)+C{Okt^Oli05`G=gAU8PV;Cau7{<&SacBd=bIU!jUv
zIGO-oT9CP(jy$FeFhQl)^)eJ5k5L%r;pwf#rmeZ6B^`{}Nmef@_w>@yt8Xl$0-#bX
zH#9Ghi!-AgqYxB?B*G&H?r*EFXt#0GYs%!M!Z<v@?MOLqkOz>xrND+IKH>Gg&+=T;
zroG(UQ~Z(%e~K|BUfm6u>e#Up6kqNgISpex7o@lqjX1^51scFo%-<~Ust}9dcht=F
zbmlNu1r;ci$t4cjU}jnd(cH+&OX0OI2CU7wi@vAVh}9knVafmv9I#Yv<b9!V==s;=
za$-O3m3r{T_wK4vCYjZdW?BaMV+(CWyyO`n*RWHTGBZl-*A9?H=Pvp!A8e{kre^UK
zX+3ByVls**3&vUo7kQ>AVoF@U7@3D%;x5$%t-qa*_!vvmL1dBSZC|-k3^RRwD^?Ex
z<Pw&O@qSRBIEW$VZ5D|>PP+;;VGBn)&9M^k4WM8=mDLgLJNiMiRy-(kqm=78{-u^9
z^-@lp(&)#Ol9s(L*}Kl!Y|dr8Qi(1zH2WgR$ae4O1<r!^S3V(*f3n>ek_wpe&rtzW
zJX*Lt#dy^IzNb^%5&<5kJW?lFht>qXhJr4pjPdEK$q<O}^p5(9H&a53mf4H=c5$}l
zKTuN8t+%r1YeA^RWb;D8H_LiWk&?7H?v)6;CPvxWMhjINn}|_hF$dWnKoq&bp%pwi
zJ8Enn%zr5>L+Wk7h``p^hxf>_jq%5>h)<P*33gF({@5F0(YCsi7yU;VYo&w8<!b?v
z3L$=E!LcHy%XJkq!5;OF@$P6ST@+m`)}guoWAJ{6Dt5<06MQCgt>E&|^oZHUJlCs3
zxDdy+1?gKn5mJtt9T_%Pa~NSPF!GI)j{Epu7D1=`-4n^wz;FzO2_$QPPOB2sJ>+GC
zQA2!Zm^?>3z7}q-+iXd#t+%_J5tXvvl%s{V{}IH;X&}~QC%x1`dd*<%kn^R@mb<2u
zgsAqy(S+Pi!u4~t%$u)t7WI3eN=PoP*W4`1#v{tIJ9Xf1u3RZV;mn|`eV>brnyf`P
zyv{h>;s_tj0hKIpW&6e(UMIUJ(mWh0v(k-;r%Gn;VMYM0$oZ)>(GpNf^i2DCQ<Sp@
zkA#cF)b)Y!g$?&RQhA4ex<;J&gk;y1Dim@(S0%bB`k+!g?KFG%JeRYgrA~H6Pta*5
z7z;(dE{-y%m=mQhUc%VUN5fzfjdgF{%hU`lMfr}8Z?bI!H9X#a#LPi{9hW{S;mqsn
z6apS8BTkOOy^?`b=3m#t38mWp2e2qKg{k&Xkm;Y)Z16{wvEYn=Z41umHRAv?@@q7O
zbs+`0E)9YOlc71MJnf>G$`T%x=fN|kkId9R%-uTW+A4C7>^V0K5B`ko%zKHeZG@A%
zgZ#I6UrM7X#IlLnr!)CDWRNJwQax9_JI2Z~I1`h0eEdNKsVL?Ao*zD&VbBBe6jo8P
z@4`fIEztG|p014GS~Hzt-3m`o64tt8L5s6u)bdiR6g+A>C$cT;q{@MT`OG9`*1h%E
zk-Tm%a4kWbUGTb!P~&>VYd62TYz=3;Hb-t{ROGM@luT#cd~H#_kX>}(s6U0C%u2jG
zGoMRMosHD>#2>b1(NdhlhK<7;K#}0Hp<|Rw?q`;_)=(-UPgu&I7)++|aR}A#UCAEG
zx6YOMQ=ce29X`4oTNY>aUL86r<6?)YZF@<FYpr@o6CqEuD{F=a*{4f}TV;&q!wBLs
zlWY1<iC*8Yb-e}A4anfbxw4}o!$Y7}()*%^av~C=(`v7*!T3|Zd)94Y%i_Fr3nQkV
zXAmZz*A{gNdrUWx;%lvRoaxKC*^(NkSY{m7^{$HW7lvq|q+K{8k?R}rmPR_vG$B`D
zavrhoTqyE%CMo;9x{UFZpoSfjMj;mK*ntIF-u05j@ov(J0qXpu)LQKK92MPiQKVgu
z`sF0tJ{$v%5r<Kz6r5iT-CTLs%Gl4JeYFpLu^AcWxQ_FDasDkzt+X=<|C++Ov?egV
z+`cP8n?_$<$ZvW5h1HSUG(!B2Vfau_HtQC6qCw$2h)cGg4U=dsimebk7j4a3GP|)a
zD22A!xGU$ij)wCcKRd5?PfS<gB~3IxtV+S)?AYQNnTYyk&CH82D)_nOh+IqM?)>jt
zhsHpy*a|s%whum9Ve=*Ei)QY|*dE-19whU~!^3@&PKgd6kWVa^gl;i<F~F)lw~Y-7
zNZwnM*<8r+7{Y1=c#3^INZ$~8kYz^WS%?fj;sN%ch-c$$aIw~do*gy6HtCzQ)q9bV
zCoz5>3&EpJ;Eg0QKSzBb!ck}T@hIKx<@ULpz&LYnKt9Lm#GPct{fv0_=u(6uW+Ztl
z_*f4~BK$tazpOcJ*Ste*E#r0;h-%U!aTcZVCW#k}gJ}e}+m~W;<0x9piRL=n)oCfT
zwclnPq=q~&QIAKy1f#?nMIbDH>VZ}arAr|>9$RKo8wJYbS(gVaz!k3C&CVjx5abE^
zDWC>9@Hel$Qi@*R91yDWQ512^`SQw+yGDwHXnUc}{=PowPC>XwYBK&cDy#JJ1Ihl!
zT}LQ4x5U5$F(Z1u+2jsDI69D=r{~gAm}i4M!w&Q$p^n!(cgO(NZE2Y3NpUlb2?72S
z0;-hKo+O~<%{xjPZ;%Or16vsZtLrPPk*BO_3=th?OGEcEP3JfNWlVsy*`B40bT>nr
z6>NqliF}h;$a6THdnWK9XgKH9(0HPdDPA8LCREt@q=_*wp{meTwj#;EOhDM|dv#pb
zC))Zm^7&a82Zgs}JV;z8zv^}GhmXXKoDiwo(*5N0Zhlc|(=Mp6@QH~}AWlB+xD;`%
zusdIXxbcE5PxHK(prOrllc}SiG*QIJCe<kKU_M7C0pfOY7j4@_mDx#Ovroq^Uhbrk
zX76bTh~BqXST6fhxAz0zsIH3W8@HWr-@DrxpK>V&j(K9xaO>{9@+l3i3WH7;R7GK}
zQ5oQ<AZ0}oU+!-E5E0R8xT}IFXyEK+qL^7hd6#qrZ~D`0H#E)Avin@HOLhNUhK0LX
ztFZ85pp%nhugIZi0fj5MTJ$vsmq&WY6|5u%b+%|@Q=Nv6QJ5wCL@(kERsH%Vs89HR
zurrBwNUDJmuAvoZkY$PuH<cuG>(}}|OLO5Sf%Va23(bz-(?IM_Ql`{@4BYm^cdSIn
zNQKE~X8c~+Q-4v&KQ!xZL3pfvYnEDZ-<S1}=eYmN1MM${5?o{wvi9{NI+CcPHY%9<
z7@NPaiB+mN!+0*;rCV9w+q$I%krQn7=9FXM5vTG)6)i@XS6p3hN?V5HLP_qRJ@`62
zBX9z__s3=5<xGrV*6`$jy#0&#HaS)e4aL>#q{BI`9#Fr8CwyW!%*5kwJJhP4RFHT>
znZ}<LAG<w?LZ)`EeK(WtC~v)+Y@Poa6c;L*XHy*gw!w(9cb%o!(&%&@235ol%v?m7
zWua|3b|l9t<11j~E0N*T%g^Z@7v>wNA|3q+4|E@GyceFfDgrrog|}t?3zfv#o4pro
zUBMDVS6>11wFAbZbF~FG*l$@1FnNxT_Cbb3^;d`Pd1sdS$_~|Xp{!GURS~?Pca~kC
zLJQPLf-E@uD0AkEX9_J@+I-M5KJQjMVO-HfugBbv%(&7Bg7W4Z9IZq_T|ffu{Jv&k
zb;g_AeO=_F7{0gGZ=%n3{GrJfFcg$)O9l{LZKN~SZ}WI%x;4K?FwYN?5Bvq9sJh8L
zLMi!E+2=c2PRgTw-V~sg;M6Jjpth%=nAp_BJVWv|1Uwia=Z6-FnYd$*$_r~n#w5UN
z%oW_2n^qwH3GSRdfT$RcccAg<u@Z0+8w)feU)$Z|l<L^sSqJG#b*20J!a}_34%4ql
zUZN7P$N2j~g;}mh2CzTZp@fxA&&zd)Te5OBb6m7ZB=kK@G00_)f-z?Fdxlyi#gCtN
zc1uTcT!yWi&EgDZGF2SH$H&lpwaR0c$grk)%ceEuu29BlVeRImj7Hp6;jF~r{Jair
z)TwjuYDC7eP~G3h1&LYm-AxHPKxK<gJ{~JiT`<k*82q8#MqNjDBnxn0crX6PL=S{P
z0E+d)V}^LsAN=P^{!jdYchAJF7ny3dYvG+s<u`Zj7%!l3vF6&}ck2&{4$VEYRJ7m*
z0i=ehf+9mUj#$|W9xSy5$-`?Csz!%$v7qws+_xQ12V!XXpGyXOId^t~UVz8((0{B2
zR15#P6FLBcEB^l-JZ1%x0yNqB3&2GEFO%?T^GXL7X;OYS<d(+2Oy<T`(K8RJM5g@^
zLA`&O6fb4`+}vUq{3N8(@n3evFx5n~zS=~~ijWo(*R-n|A&-8Z)@JtBuTun@Kkhy=
za^IpS_x<$b$(iOGxa|J*7qd7`bBaeIcAX>5;jJF3ynYD+ar%M8LIg$r7NZv}u{9^m
z&{f?H#&Et_<M?{&d^9tfN98OiZa7P(*+v&l5xsKhR59EX&)E5r-dLs{D~{<jr!j)U
za$UqjTF5QLzidOz314!j4(7GseS>&{rpQ4t{E!1P$u+fW{1W4`AEDW~$AqVsi@hO8
zv+&R;9dphjY{I)y9Qj3$RjP52(FF%oC$34S*wgvsC$XH3xG6B&kFe)|y#Y1%FGxrV
zFWjms@8p$7&$g-U)3_X*b~Q>#w!wdkMLW3Bge!77+w-z1$Fy|*A=4(EB;<`GGkw)E
zi1*naZs2d5qgoMLQ4;NX{HR}MbPD%|^OA?bs>xCc#?5S^Wm^rNBs&2}`oWe_^O?{A
z%A4(-ENpODJpejy7WO81h4!1|C}C{UtdKpEai+!m_y#x2tXh$_ajbj0+Tkt<OFD>Q
z?@mA&0tpEG$*BxlCV>hV(s1x5g3osqsAN%~H#>8Z3~s|6S9-FASlTBAyKZdiHLSEj
zeFoYl-(a0QrF-Fj3@HQRMaA6#4*B8!WC_~c8n|`e=hAR;ia7GijAL`-yI0YnZ{L-h
zIe-6TdyDZdpsQ`$@hu?`qrZ5_lVh`ep*W>08ya2Gf{QJPsZkC6n*+-UXU?>09=L){
z0B-uTmgBt$Rp}h7u4T&!>+`*UJYyi+u1TcbtC@A?FcDl7Y0MG+p00*mqWO8#qHkX&
zKvL++ulIYWFNZAS+l!82^y&hk#~sB!4kD^*?k7=6t&Edkd;8NKz|Zi(*0tlIFp>C8
zP=4XkoUAC(5ScDMnH8vCJ>kC`?!=UH0pk6Unr-@1rTq0_;Nb_kYx)DaGbzvUsNngl
zMs^n@4$JmDS?8wg&&9^Dx5*l?rDY%=l$+#&r>E%M`0zU`5f9JiTot5LsFu=znGc8f
zv<}CRi&k;P^hZ{Rpz$wq46t^8z=5DDZ_EVSt0A*G`=>9|hY~C;^RecB1vM?KPFeCm
z@l6^J2CHDv-t@)G;@jFK>V0f!=}XASyJoB2aU8Jm4w;Y~%Il3j^g!`Cd}`w{_g7um
zZrgnztS1vlCU0a$mvuuaw2)+nUqtLj`<0HCWY7kbG9q)TnbOZ!G@8J@^<d&d2zo!v
zB-9Jv`}(VrsKMbnZ1Wa!slAbMVHgCyX@rm9Q42P&wupf?6vD)<u=_7!5FUUh?9D5d
zWB5NEo$r(%3}FyG*ajKU9xFNS`v->=B~mP@S^fLos}-@>@CKA+uD&RT6%&1a@VUYe
zH|xCF!X?n82Nz~u2FT+Ag|3D%vLue5)+_IFY=J-|uTLCwVh04pzZ*RAg_*c%ueEi$
z*D~VkE1mX~bw7(a4y_4bTO7RKIvCp$8@CTu4Pl3+Z%sPZKW{BMUS<bK=xQaADt<5U
zmbj%HSO|Wi4Ly?|82HYL->GPfZS)`{>`1J92jKQg{Hs?%jDHPGq9KGPSh_&?(tVkB
z{`or-f^T?$Z`>Pva~@T<QU^J3!gr)vsA}>^wS!gj=QLE8XCf2JjrcT!&P~lT%W1~T
z*7t-iP1oU?{W?i^a`G}jM-y9v;`DEw7Hx<2b6C~BE(lC$5E%pZmxw8*&vzH(^nY3M
zb&#(7k_oec<7R<!ZO(VWGmT=gaq%#H&)P2>&nes7Uw|AA2%TCIAep59*;l}uJ;D)G
z87U;`Y+^H{vcQj2%eUe&j(W8~5%f>i+-LiGHeeu^3m8KH71!Dii&LfnG}eES-V5Ie
zX&Fi=*t!kMa(Z72%xF$5(2%6s9bhhSN}CwR^QhfV03-wmO||6EARY#}Mf;O}ABg2C
zM^}@6yucCAd>Q1MR8Z`iol3`VswjWVV%z<MA=3CfFh#&?e*Lh-)u_FI-r5&0_BQH#
z2@w{p)}9Okq2BE0K-ocPhF7NQ#6nvMhTUyq0coLfT82{VHMPE;$+#sC*eW1^nu@w;
zNX)?>KM{Phu&z&4axX#f{!N{M=U77YBP`7s13`Wf@b@qN*d7n!y_;$_BwNN}34!g>
zSRXeYC}4_5Z7IpPmAyj|^4=%c&&voq4pKv65XeK2<O(h#1VRsdU!dOnp!4p-WJwl@
zncDh{(vTUinYHgxE^s*LItikxAX^3Kw<!?FfgAxzY(T_8O0DPGgR^pIyz3BJXS#G{
zE(r_|mhZf?a}ZVUmgBOFcP~1!DIV(sW;8h&&0RQt6xd#%)5IyqClZX{KWIU&Ovj6t
z(B}+@+UN6NCgA`5Tt1-0_GbS>Vx~Dtr2-&$;9vG_A16e17dRu~JNYd`dMch3rV9c#
zA4g7r21myRfq1jly;M(njoBQLVW#JTN_+!hA@Iu%|9{Tjzl&r)*{>1^K#246Iv$tS
zHiJ=Z4$=Y@OTDt~{D2(*+#jpo2TTN+-%zRE%L~*;=(uQ$=(84t#1i6=Tb0uGs>0ZJ
zmfq6yr{ie@A-qvhPp5q&Jr^)UDnd*9TgX_D<)?btm>$M*babK8z-Gn_2;Yf#nE&kd
zeXZ=+IZ5xPh&1Bp{ov7I`g{craIbRkw{1in0Xz-%eLrmTYiklipy28ja&a{X4SgQq
z>^j~qu=9nLpI?|_mpH&9YMo0IrKnFFbl*PXOQ3{;s$#f7BMraAdjn35$b@|`F0nN#
z6D7Fo0z2Ab!m<O@)-x{Os<LX%@5E)Cm{uV<9sj5pM1KR&6M$zJCUF4t^KCyz$LAsw
zT}pUOdVAk}^#7ymz2m8V-#_ppi3klvW|C57*}Hh7p-?27WM%K|sBl_Hc2)>UM)o`h
zr^qJbIF6Y;k9Dl$@Vj5=JwCth?~mW({ntC^^?F_ReP8#rujd7LYY+bh)(M;fh_R$t
z#9WvT`QM41{B<&2G_g&mP1QVZzNyWvcS3g-54w&;pXz~`tPJ32)fK~!u?1a@G$Pi+
zuP{g)13eexGp5q)Qhe7MO&q`}{m<fpK>p-LHK8S+IpOHJ9J8pFBS(QFbvZOH`@OGC
z4qB|>#*ZIzp`dU4>8eS`<s(y_08J-)a7Vl$98N@k;=pfio9g8bOt+5!p}}7$PdWm|
z2?N&s_;8=~J{FiLAcDc1NTyGz961*3daqi8_OXz)Q=JR$VQtf&eXoOo1R#~@R^Ai?
z`KlGzFlbZbntbF-0<J&q2%{~Ka~hk*l%P%}qv`usRGm5-7{j#<iS-J^m0(6cC<zWs
z>brk->Y|H8oF||Cm2qW6vCUvU*0p8A#@XzpDNt+7zK>j9lWmF2fEla?q~VehTX;<S
z$U1yA+;)65E0?xV4Zry-d|zk{{7rv`wq4SiM=^S~AoaXJVGqXe*W_rtZJi=3m>b+R
zg-&^JtUcoz@UzJg=pZ_k5k-|GHXf)m8&Fkre*bPJ&_b;h_D>S;WGK*e@`_7UBDHnq
zzP0!rWm5>2<CFRU^SuH9FMe>46qgg*<fAG`K&aEl`<M*>kHm0^3Zm2Y<}2w+<(C@L
zRq=*hwUgyg!DZYwoV&klD0~d`=XD^IGMGN90ihB^*v*<{pDHEY0u$E##*4BE^rs+P
z7a&-4PwdG#|5nf*q8vKjqt}$p_{f4aftDj3n}$`@bITb<{s;q8ej_2l1Ee)m`u!cC
zMrX@NKv$x@1d*d-?azQ20v7ohV8B3{amwcE4BL_BBS&xrH<!#~8$4TlCPagai|6h~
z&ll$E0bpqds6F6w*sVZ1j*Zr)29*$*1bv_3jxm01#-W{i;Ju%NK=I$8?vOOz$LE5{
z!RtXA+urN>4j<~&IEqf<?ZCb>-f+I$Cuimq?>T?FOEM|KJi5m@%E(?%O(@Azfc9$L
z-=q`3#y{ZLov~nN{=9lhU``y|qvybs?y4S_HS%)$M0W5I(Swf&NMAA0?Qv$e=16w9
z*e5sdM0Gl-`Pb74(G`$sAgf;$HQ6*rjE|DxP%GK4>D&YL!Nv8HRfIecBfL&a%W{a-
zeVRe)s{+)z0rT%WzQ4<Zzb(Bta%KIQ+&u<t5ST#B*xgi_PLs`|ss7`}GR8#rZ)nHD
zXeE2;F}Me$clJvyz>dc4OWM^-tr30!u;2PFZe9~9xLC)=WLD^Rz^&cWKYxCApidMK
zdn|l?=#TUVPC6w0_l_R6b@4y?qTOU%0Z|ZVX4nGsrT?q{=)ap&c_)+6$3^t}_-0RU
z2!O%{f2(u<^RyN4gFvs*{(>9+_i;^N__pNd>xiW|zW^<%fLqkr|D)56vfTsurM;F<
z@W*k^|Gs?$fVaLl3_3O-i6Zkq%VAaXB-WsA?O@@gq3v5>s#Kn=OAOELTQmUKQDlGT
z5A^uWDF+`j3>>*+A+EN$ZLSjxuw^0E^}n)jUL5>vsxm7in}#jK<mtHLr5@ZplB&pt
zNK?ADvNRZ>V(hh_YXnqk0tI-THUT~!b~+h-RW;WK*AU5WuOv_QSF++>kRiQfzZw;&
zJ%ASkLP?(5{nCOir7PpLFD^|GJ@kITetTVTx#?>8PktG^HxHBxT)&&(-u+E98O_FT
ztyn1w4(4(n`*jAXzy2>84CbX}9z+hCP=FHr3b8i)%fU<$|I$ytQrN&z2^IZuCtz1V
zpX$fD!NrjZ=1Buj8^tLH7qj*GOJaj=BrnDJ$G86vGFqyZQrBCfe7~cq0X~92>C%W!
z(d)~5FFvUJ1iLH-PPEf_Xe4$eS0ev{i-d<K5e#?ciobvMivmRNpJE}Hzb#<b^qWkC
z#ckeDfaF7ry|?+Kb1F#nDipK%6F-8%iUAwNC`=kSN(emI$a@QTPpsc}cIlC=Nu$;O
zYpbdmq=lD9!Xj64WQsx8*YhB-AU|BgX)c!MZcKn*_NyMjzHWk#zfAE(ShQCB9^72X
zkt&x82IY&0dtVJb7Qb)jw5)u*=KtSE5`dP>GvM`?XgzVfo=r+sMT9|QKfd%HYA}VI
zLD**?ZDHlq4}?(Dja)Q(oZkWWXoK-##P(N&>~|x{_5v|dXZQHwcJD#Z3HA}#4P;Yo
zJvUz>MptsB@|m8$oHX(*)B)zu0!~d#vD#rhdGt+%y(~LR!}0xq)!rsnK~QzjvrMtV
zCf~g$iVwZQs{b~Z#D6ih9stl){i`=~uaD?bG1$?Zwu_>XgZl^s&?NYRFdm@O;lQ~A
zp++Eojepl#1_<xYS<p$H`nbm^Y5!pq|7$U}2D26k)O!!d)c$ecVUbXi{8_%j90JWf
zianP3J2JEX=8wmEbTM0^8He^S!9k_>!6gu~3T`fvvm&wVzc&3pudV*X{})aXk^bn&
zUJTFbPpkx{4qypjs(reJvM!dd&GsKH{_mp~iqx`g{`{@(|Ht35l{b^oS{X<7sf8N9
z0{0N^perkMSy;ml^id0&_Jx)bd?oPwWdG&Vy{tkGwuewr#b+B;_SxOiz8G!IsAtB>
z%(oGpV_jVDw4$-zK2oaSueBkt&pKY~|7IQknb)Zc$yMq-slqpEZx|)rbM05#5b`zX
zH!bTvgd-S$+yG#*&i@|&7v7L!%I#k#m8tZxd@Qk(Xji}Vrdh_mo)bG&J!?KF%zSCn
zwW{=o?2`;l3W)vVo&L|Bs2eywvmR40k3D|g#>K<8e}ph?88Az(UjpW9u71!hOS&9o
zkusQi#XQhi2si0&l3En(r}$3z%jMG`X7W#E+y3S6KFwIEY)<ZXhs}_K(Zlxd&);im
zu=Ktzbh_5ZM5G>Qxy!NA!HvC^RTmB1QeEZBeHjImHXl3$<4+gLddkJlr(U}6+h?L0
z9A}T*H1gY7DY2DWtxZ-expaH;&PqYjot&zLt+77qT<e7)IO#Ximl!}I^S|=HyGbln
z7E3L-QBjGhXETfrBG;xYwW~LXYPd)0&k8WJkoJM6)gaS~U5f=##}ioY_5b|Jg|Emv
zYs<lXZQEP6k>0^Pv;w>4{`uOx&{M&~-FC7b4mvM$rN)PAaPQUN>7ExIVlESNtL#j7
zcSz1pMPce4|GTjqn4dr5%?ffuaqRTm(pQY-<%id)*;<u;kRz;g8Y+<|#??@)%Hp~$
zI&zQNe1=-gquLUq%@NK8zsB`j$5`E&Z^mmWWdcrnsy3VlO8I7UcDp2>p>0PLYd|N$
zhyPsDkLADRa>B45jpA3f?r{eYwrJZ<$L5z|uZWvR?J7(x75Z?l_@olHl&uFmJ9#p|
zP!!=5)4`jFELkK+=kZa6R>$0|4_z<an2Ovw?~0T9T>=Pn7u|j4NqX>yn-X@&@tzzL
z^xR7X$Ic>x<*5Wr{oDVs+PVA!$<VY;$`UoscsX(TYFFt6XH<UfohJQIg6OrTAbeqD
zyz@28sEnvHk_MAfkjh#o$?e;6ztvGN^WfvNHHsKj#o<L7`W@xvAE+Hh@O@Da0FYP$
zFvXFEIaPj2w3M(bJ^zuQ;2OA@dyQ*St@0~P2AzImSTcI3sa53%D9OzcJbYB#i*Lwp
zj>Xr9@ytNRgnvD)Rx+D%Hk*vc)Tefn%_drL_9;P!Qmq`l2WT??*MGu>djcKYO29|y
zofNsQ;Bt%?VKsKQ%IxYXqFQL!1l)Ln<1sdciE*K=A#T0)Qx2DBSkKwGVUt`cUa*R5
z27=8LV|&1>?d>(*CL%9=eRxq7TVg--R+kQ@`Cs{>sja`rd{&u9RfR%-dU30?+Wm)e
z61co=rc>hA&)y~$w%w7OjSbyOGW3+45wyhO9Tl}K5gOK=r=-3bN_s37k98(l(XmP#
zGXu<s3<tO2e^)`H&xNLvw;C4O#!i6`G)esmqthl<LQ6>q1{FZK4A)i~^<uoWeCJL3
zF(1bC8{Y{6MA_zp57qjP)3O@6lQM#+S)rol({uY(Ou&GHL~{3Om4O#tCS53kB@qD7
z8gfj2O+8`DA?c9QHtVMEuxZ`}!lQQb()=z`zf8mqOP;b#(k=5PVvS9>oPBsZ)-oej
zT3dXqNm%EKumaj-#hIJZZ*@;C@*0(GM(H8wSoS^%b-jaDn14QrBX>@=0hqz8Oze77
zOIt<FQaw&R-{b(>RkT)Ki^GNn7n|xl#f8rOeC}-9Wd7pCosKmP>dxut=)Mq(qWSGH
zUq&%pl+M$toX(qX6cAlu;J_Y=P`P)^Uy3{lS%e?c|M!l8+@Z19h3KGlX7WloeqN1T
z&hk&j4LR<`=xZZP%gT>zIDR-*5grj8%}_%RoqA9aI!NrecfPED*{|_ZQ>}334!YEy
z{lezk2Ss)Vnw$qmkPCTDxnAoOELYOmw)LQZ+>T~uxhz0;-%{s+dQd_C6);mFwOvhM
zUo3laWxvEc;=kN9>_xw!e=YL={ER~trH?@D?R}qsd*(k|S~^HB7p<CR1tMEhQw0rB
z*zd|gT*=?*Ptbec&e6w{CEZEC56}XD^Q7qnk`kW`Jm!E4bsu;jANBvUZ2)$#dh&gy
zCO{Sej+~67!*bxKXb`(j()WP|0$soLCn2$CNyBp1{oA-7WQHW8LuI%1mzQ~Sxs?LV
z1W~&Y;K$Wt|1rD&{1^a4K%s!;xoPe28-bXh=@`gI@IANh#lfbauJZ#b5bY!0$kith
z$xk$E%WGG`aIAl7sbMZ4j^sZpJM7$``NaufPD<aqNO=$WZY}~4j4A@G`7iUd4_Ji<
zd;JA~I`*R5xIv6dH@~x1Okkhfe~eBXup<8a_KXx1(tB^AhWhYUuh+b{7%c3cUp@o>
zcd!RnlF{yin;v_#{;HJ=@P*u}J%clYtZsys1DW;B1N{QE8p6W9wTLQP8o>#aO?QOj
zD?Mec1V_r$2Y1R40=x3^uDkmfORzbRd50aG9aa%QoH|~^?)I+S!Uh2R#f$&654`Qm
z0rv43d!H%UH=tJUyrA);LO%W7YV9`E%+KE}@?Q9_1=KJhs3+`zX+XpS9FgYUahaW7
z<DUc3kUxtOqNX8oY+!{_Mucvl)dk8&!p5?bHnPUHvqBR1wb^YG-G7*@ABDk`A;6Y{
zW9n%i0kO#l%{^qxKYMPh4oZbIz-al+G}5{~Jxeh#_NB_7&X~dcJN~&7k)kde$*FA*
zFM>{6E%3$zw}a_>h27RxoIu%T2cz=U@)1x5(Ie_mnyv5n<Z_?8M;&NJ6O#C6dtx)R
z{XiZk+Uq+y&)$UNZtmY@0i*7qr$uyaVW6V4va%AnX>q?O-vW=nw7Vc^cN2OuMUro+
zN3R3!GorrdFc{=?1cVm>PpSWCGwXla)T*{bJXI0`W&l^+kV^8Dv0Xtto{14NqXR&a
zAaZ>hxl~Jk=aiVw+G>^_QKZ3nuYI|Yehf)9b6WjpqO5n+7bcPBBXmQ)^U;?8OtGwo
z$N0Bkalh3;og!-3NBI7kp#22mvVZZzO51hKGn=jz#JUp7vEr}X=I)#CzK%*Lw<`PK
z30HWPDqMpm6xXK~oBjL@5IUsCmqCPD>|35m@7nl!(v=@&U|V5Nz3gj!PjvBq%;=#)
zM1mGu<8k`%p{ML;Zw)VEKG4&imgqktSNVI;vxo-vQU0IrQ}jh(h5A)Pi><<JTU9nW
z>(V}Z=Q%R9SbBfVz4^-B7$EFzq2;pwvQWMnZ}07MxnM~8tpC@q*8srFZnwqzDkI{<
z{9d!zH+YFyC}#eRk`4{h&lU5##GXXeL0`-%=;nH#T6pvE9=SA+YNmd7^~f@Q_r`Kg
z+knyQ6Lc#t5QqU4V5Gj-yHeG8Nlk(5O=2nYH!92Mn$nVy-JI*58GXf^g^VSUbKmME
z&CDrri?<N<7|nsljSN!TtKz66ACfmbsedJb!zPfvf}hwb&7l^OC{;BIkUoR+vh9e=
zIW3c5uCeCwD|;WoO?o)N7VuDY)lq;%l<|zM5O9dx{DUi~(dyI&z;R+*d(cd<t$i^g
zG&gyT<w`RRLps-DS}L0Wp?A<H)YkQyUY;#W&x!R%+8Rs#nA})_(0U5o;w&4xk(TS5
z%cdYpW8|}yHdbZil|O4OP({of!*=F|$k;ITobB<|2-RSW#*=y;_6qU;dxNsRB%{|!
z;|W|xS%a2Wk}B=To}n=>5ZY{dZ}!qCFqju8jRJaw>BnTg-baTbg1*!h<H4Ig&av~N
zeZ?FlJ>SBxNo#I48JVFt9FoPh&AyPGLsNfPMpU@|+b=iP8r9jQqGDe?+k}G3^-q>o
z@}culDf17Ea+Ok#nm$yB1;{c-LyeXL7gA{r{dP0QK%N&M6fpHHeM2P8mS+o*R`7n~
z(_^EdG9~<b0n<|P5y12!c`H%T(UVzcB(_oV%df%!U=$$(g){}!H$|$%J!OVnx8LWv
z)D3+Br3CUotDgb^v%mcHQmbdfRrQKwZ(;^RT7o9UbVDt0rCA+o#s<QD?8|y*7g>L3
zfQ0klK5A*2rMHArv8};;z2}{*PocRbY;aJTmp;FN!$`~1p01<@AVk|8-|X!vcFKcg
zN_W3aQqr-42!CylRQdcU#F9I!vqQ3%Y@k^00qH{Q6>jq%bPNp#Ki?j9*c^geK6!=~
z%3h9hmvV>+@$mRjwepk&cHRAN`X_=lnZAR<B@<==8<b=8k>Mz(;v_ltb<29Ur?@(h
z4jfU4;8@_j67m|FlVuUgB`xZ@77t?S6Z6g)qpBQ6bBl6ylEkh#2gA;Hmf2dD0d%A6
z(B_Thom{z2S6NU&wKN7Yvw;8*7rVY1Qz!Yhkm*oh0t6-a_f;A_r7ZomQKSh)XpmMu
zBjtlDqJPWn(EGvMb3mjC1{>JddT(c(V?$cSlR5`g(E(PV-~Ut75xlu`F-jwk4VP()
zvt_8`kz(;+eNu>)m=Sd8m8&&PEeZ*Y$MCyI?0`W|(s#>bP9?C}ep~D0)8+@&!g}oR
ztDg3uABRCHT%?TmR(FUAda<8!!83hQv$1L2FUtZ#)`U6i$s#M`ZMlsa`c{5H!Cbp2
z^RrFA;K<*Lp8;suTV4l`VpbhZK&jLLKX*@FOQ@A#8N5U8>zoa510yP?CsMZ^3`#OX
zi2%Mg8I=cjyr*+E<u0qr4=~(S7C^epbt;&n-aoh9NP)ml)d;)2IS>S+b}roBnxWQi
zwhB}VHULq%=G7~-O){mI$2eaZA0jn&Hq>)?<~Zyn0uLzl|9Z#HYjq6JhFZ>~tY?>!
z!8e++C`%uPO#!HIpzn+|lbS?iN(Z;rRS~YBtH4DQeXo-$BiDehH)Ou6*dVl6t-C*S
z&IODg-wjFR%?nlPTU1g+(AeTTyS{h<s^BhjIK9-9Zo2MNObbwQvATh=INfNWm;;ZT
zeKn?r+8IFp=Y*e-wk#HiWf~z)8&O%Ica1**Ag@C(7tjq2)RfSdHZw@?XskQvOQkss
z7B*w&L$A2>+VFQ~Hq$$V{I)D@AMq)a)sI<FiI+?SC54^iV(C@SF%UW|BdDVE+|^Dx
z>p?X6{{1*J>xF+`2X%PG&h}y(-{9h~AphV-ySKuoxVW5;9uMQt#$sZ2y;zc7?{0Nl
zkQsV3m73Mi1<iGenw9-dYsE}&xjQ@T9LQ+_)2Nz9K6;ubh*Q0kVH`31Tb0E{Y(}Qr
zerrR&#?2;oI?_F*g+&D&NT)5FYfmpLpp>pXsNqTt;dV|!5_8cFP4z0;mk^u$pFJTk
zJP(4%u-A9$OjS{qbTYwaJZy~;_u0q^`T&DD03dW=IX%<x6X;wsqv}i}`(D~q&RAZk
z5-yO7zXayqj6SLjM&CfYJBsK}IdC~6`?8g!Pf6LhNR|j^6N0X3uTvXBAhL2>?aq3s
zjBdDzUjUIuZs(^n5Xg{!vv9Xm@VOLiS3P8U)lLP5Q!|@4wZWH>uY%}?T*ku!In^vS
z)G#CRj0lZW16d%=48ph&`$Qx)&HW4<NMAIt)w4@(S{r>n-y7I$oxe*i*($?sw`fKl
zB;0`=9y-TaA;H`NTz*?(VXvFt??e0C?S|=NH~Lv=U&KN2traBw7dBhzoig<4OuoyL
zw%k?DKv=r4{x}Dt!>-JqLkGkMc2W9HE2)AJoDNKlahI4RZ0>%m6sxvsK0+%!FiH;l
zEOM|@Z~^gaxd!ujd*G`!(ew4bg{GY>p0gd;>9`kQWFAX4Jl8ymqfnL=I<3iTx%5qD
zDrWi(m11*~KB1;yQ<+K<cJs35e!gDmRIiz3mr~8pvm1IyMHwRXZ~YJ{GE^R_PT1*u
zoTcf=+@IG*V}@PNe`^=RKdC0+!gRZ)lW}2X90GbG^9Rn<o{A#?y&FF(Lb?esSqXGa
zpPp5e$@M{)ti<5TwU4Id^T*}lyH*=-5L<o{dQ9hM?bjsM{2)lyybd?Hp7KhIBCfqM
zU-gtd`@`@qB6i9~=rXAdL8Gw)uVY0RuJe6)h{^gzA8%WQw>Ilrckf?pM>L(0s2nb!
zk3R3>F?bpwT_x|F-R4M?g~0AULj9${J4>H;KD#sN!5WE&qY%CyT;=Li_R=~Z|MEQt
zY>M0&L1L0f)5)7(?o5GTRnk(*TdBJxdas50eu&FeTHLRxePicwL8o-#*;w@2P*Nq~
z6uc<A5~O_1j<Kz=K%h*pr=V!$z|6h?7SXG;Mj6nXL2=+%oV_pRP}())9DuCznJp7}
zd1mX}=&{yrZkI<7tDXm?QKj-jw>MbYawCL1)Q*C->Ex9;tsSC~=Q?-C@C`+!=@J;I
zcK+Mhft*m`S_X@edZf^R7m=Ron;OkQeXVeSNH1nyUbN-O)_Ln}xVx^v;4|N*AUYO}
zCG2r!S#O0B+cq~zL8aA|Ei5OP>-KSEcKoirSEt_E9QIUbMWy?Y%FZO*dpIn*ZVxEy
z%3)d~j`2mog}XZyyQ3*hsq>vCyr8rK_5gya+4n0zR)Ua>wrOwgQh`-}+V>?13>Jfk
z%|lH=AN%eDW@Ow+WTU-GD-?um){ow4y<bR@*9sgugaZ)Xpwt>C_Q7DylT&J4-p2MX
zQgBRZ40g>2SBw$%{Wj-lQ`oAMs%X%*HpHy46VYQWIcb|-#4%rAXt)@21iH@n?N<B+
z@AU;X@6Gv8xSfp&nnsT3uslH>NLv!g8^UKc)2$%l0qc-G;$u&)&a!V70H2&Y8J&5I
z?F=pR)(tS>7KDvIKS+3ZQT&S5mUREtal9#W{GAs;^A9S;oVH}K*Snq;`fg3w3=7b*
z<(MVf7iXhnKbA1q(l3hQic9V<mgb{0%u5nzujV{y1psR1i1NgFRJMg-MPDC&&au@^
zqQ0dEDOwT#LNnF2>{$~?@N+!cM1KPiTG^ZGqUfN>AUfR8t{?f!g{vQBsh~=ZKb|cB
zcLM45o9*rNhxU9wrG%NnYh~>wee^oai?VN}SMMswU$TEXc8(S&iZcvnBM7qHy2=t`
z&0%tNVBO|r-U(MaMu8`Zar_Q8Z-ALLrrIj@YxGW1T$^MN&m?P$a)M&)wCAIy_$HAj
zl9-Vgv6O`e!rD%s(CY@Cvyb-mYZjYC{}mOlU=JM;|0#Czz88D-DL`vn&uvRf=>o{F
zJ>o7NEk+A!gNs4p+sYtMs1D7oWEkOGSMt}msc89z94U7=_BRjw!)T=jgGEYf4a!9m
znKor}Tu{2vIE;{y%9`WaJLKZ4q%7SWL}wutUqTSTG?m5I|Ly@r-mR$&t%bINEKc$G
zMfO$GkFejR01#$v2YG^y$YWo={8J$*33rd|d#~Av`5Ukq&{hpt^CM>RKCp=b!GB=N
zB?CZ=bul{3v|Ugo@!S>CG)2hncx#pZNx}u%qd5~Y(Iq)^%Z~SMshr?jt}xwV8P|;_
zHPQ&?jK_D{b@C!WmeJpp#rLW-_1Jxpa^puMdo=9gId-ujlypOm!yUQ+qEQn68ohKp
z31<Vl>ZbFT_i_L7eHYq4^MZ?|*Z6bpH7hb$KO@<ZE-UIWzkskUv6ROq({?wIe(Qp*
zI`G^~)6QRNQx2JJq(*On+}$YmLEu?&$)?w$FwRl5Cf~6qx&w2_zJvMzIB_%yx70qO
zC%>d!1SX7tRANX9dtqq)QE)t(ANG_wY>&r5F(K{A>u-H^VK8tSWCY=5qr^Z<Zz{WQ
z-5Ezo5owlAV378#=)i5kHyZGo+O^3E=bU6uQb{3wFZ=c8I5E#0LSm7iw0z@j#~KR8
z?d3p5!<g@mGT+)q?ESW^)3p{-OCyqHsbC2#tNV9LNDKIRm0l$8NP4y$R^MV^<bO>8
zhXceRP<Tx0Vj{gfc|Ob&aShwjz9fBIKCdJuq|7pJI`R!Dvl~}gs`#D9#a1VYX*VR5
zY&Pff%0|)7-bN#4Q@=9&G5x7VP)!0Ad`HQ?FHTA*B9tZPQuRFxr|$=?orAg9wS#&n
z5E!b~y!>Fw!Lh(+HF@$1i&W)YR+|l*;tzn)i-kQVzB~ho&0!>!(8qSn&5TZ4<$;Wc
zEkRTkxExx~no2^vb-hhAvRT!d<3sG^7A<fjOASR+es|Wp5rdr=lF_ATB;OdTBI`Ip
z!NUEEeW^uTqKBuar)&HTv|}LMtXSiSr#3r|ss^3y)E)L?CAZvS0g5h-EJHMQ-rM6*
zSo-}~sEeybQ10rl%qVv-y1mDBiS1IoSBM+XA_CHB4<TIQQo%#VIHk)CV-h`z=QrCY
ze+F&lKiEv~JZqscZe7TqRG2L+&1|x^v?^Xhh&Kbf2+E7jJrU~?Kb1gI(|4w5Z30Eb
zon{Z64N+ai18L3P!r`6bsu{(J*jJ5?dx4iZYyohq`&qR&tK`eK+riJ_OCN|&0nil_
z0J@rbT8LkKdxsUUmMZU_B|;W+8z{f@agvem#m(QHf{|h_8yQBscFPMDi7`LR&VnK?
zShep7<A^h<^PDxuA6qL=h7=CUrI?82F&%Qjb{t1LPg?>|J8a(L{^HiiDI1S(vRxqD
zFZ8;Yl3iSP*YH(w=u~f;B=!}Un+Gc!?5qD_Np$JPVsg!*46OL$*p9-#-HTkp$U6_U
z%|Dr1Y<X~8qF;>qx7K=d*>}K=)gtar`?}xwO9Y6M-z(czsYfP2F^7nYE*ncKiFf?g
zdDYbB;(?@vExdu9KBLUm95k5E9WXHAY<Q~HnNz5wqu7S|c~j8I0u<p#N7=Kw<6reG
z^>)uCqj~z|lpMwUOPM1ryvFZMdh=UUf%>b%AA*isi+&h@Y)!W-4jvt}p{jR>h4co2
zp-B-fQAkM^17-6;a8D?*5g1-g+(sTUW#FEiqGuBrB4%fw8~X&!Qh|6<ot$&*Ov&wz
z>w5iO1Lts7bBm55xBZZ4xz^MDZP=dt0@oaW>C;l%k!rFM04GT3_Xvxek2X4u7RbN!
zR|mI0?F$4QJSZp|+rPZ=#+05dXne?Zax_hn9`a0y=V3zeLzUw!f(w65E!tw_gusik
zoyI%TKLkP?3ZWKbya9)H0}h4!kIORS%R=B=k;}j_=NnjpiVnffRXYqi4u_!_r21bu
zwZ-@CJ-aV~!LwQbKQ_QB1O#)sLIUaFV9TQ)UoitL1egQHRQ1N*XG1)I&OHS<mlf^o
zhmCdj6<;+JC>G+6_8D2qHXiw`fZ$b0x+{PjeUcff1IPkm1Qt{<+eW|p76QfUU_b0{
z^7n&aXfi*Z^eemp_)S*B?ITHkq>6@$1)s{3^;e)Mg5V(-x?(I{CG@S7OR2+v3xck#
zV!1bHf6;#vo&Xk&B^CkPRG&%8Kt%)xe5~xrbd#Fa3=<RvUsr+|d*I8bXYH8*HWmoj
z-38cK_3tf*M$Q(|KxeQYafYd;Nd?g<>h$w*_)e99@Vii;6BX;;VVh;S`5YXB>I+%#
zweL+$O}uewWe>(naw>=wsmIt17qN&yx*I@?Tn1$Uz>9=E$jku&6aD2t(APyA1(D`-
zO#%RX*dyn2!T9+2W=lTO9Y6Raqsff8V|s0-gKkKsB^eD0Lb{D1{yX!B|7O^wzFI?(
zZ=j4m<_J{G<=08n0>EGV!(0xlDS-c8X78nl&}P-S{|4;tKgY74Hv#+ae+^sVj)(Mc
zawT36&kBIJp<S?@TCC(<NYMWOeCjNwuyNk3ZE#3!5X4&VezSRM1_=8o^hc`fCs6=f
zsb37IVl{t(NM&AHG=gu<J^;8>XaxT0=Ne1;Lqc~CF84vQ1{~`3SUwQ9P`&2C)MyXi
z1`Z(m&TrB6yLX2d?`pH_sCz@p==;MY|6WFcg_;bg_vMM6Cx$jaDoqi@N`XEHC36^Q
z8;`-rda+j2OroSHBXq8y>J1n^kY?ShY6E=069+cF``Tf8#m%bS!Vi_}TNRXa?2w}k
z&~gl2ZCWB4A&Oi6P<$FR`CkSj?yN_I;;$t_k!Xl|Ef95Si!%8#UO2b;B64iEY+LaC
z(AF56Z>T>&QufMwcmse{N#w8Ag$_z*MWp}<SGXUE@y`_bQau9lt;d(aKR{Q*KMYr7
zjZuwpD*HPAeAlH#Pgw_4<v8f~Jl0e!q%=7;<V~b&(}&7(78EZ%bRY7|_XOEFj8yZ>
zf-{NqO@ZU+*?3td`9CL;O2sNBPn0Bs{sH29SUY<FS>^l|p)L@CENiDed+|lo;#OW_
zo}9($x_$Q<mi|k~1pR{2{*D|eHr>JK)f;BIy^H6+b}r%pQ^MjrB1Dk(l*pWBtyi!g
zmGr(Z0iLog8E|{jUOnQ9f#1%{Z65EN{Q&afKpw(ieJ|7nIFEtKpQRrIB}u)#uc}9|
zVf1P?0rONGwXJ}aL6p@$(`B~iMH48HwMULWe1^OoK$n}Kjo!N-5ZTM6!*vJ?cPX0~
zM!91+*EN&XKZi1pE3uy#u2H=720UB7dBy}u9f7J`+tMmx*^@S~`5Qc;H1vrv9PYzH
zEHcM%>jKrozo%4x3hC`Q6tLp>FcUK3+RsUP%|2zt^6cJs$XwE4#!TV^E}d-yZn$Jd
zF93X4y5xV|h`Z6%np5?QIXNUdVZhiQUtCkHkG^<9%tp{ezLG^KX0w@5E9}}r1YSRh
zC_c$g(H?uq-(<jJG+5pnXA5R=GDvKzt`yYza0?!kO3X5Lo9_u!SRrMy3{;>MdF?Qr
z5k0#dG(llY{1gFTPJW*{&O)(ni^d)OC`<uMWl)v{b0J?a_IoY1ize-E+m;0WvhiE1
zF2WdM_#TvPox*(eT{Y!UyQsCZEts?MP^VRiig{rOB`;RKr=a!^gpqw~LLv4L2tpIb
z2cGR@EB{dN&03>}C0vH_B!O#zt@2*Kc#2P%;V_Iz7UG>k$|B0lV5oR1=Pf`=4<M}w
z+<?En_f5ur7Y41<>BEyLhqgr7Z|<NRa1011aBN-dpUyyKbf!=}T_Y<%_Get{tf2UD
zI^nTr-3}SFoN*{8AO_kTatta~>p|A54XBqRC$^?cKBcF%{Oaf9jpJ55D~U7N1SRhC
z+?8_2w(ei>>1ejeirZ{1C!4>K{u8PVYhsm<VUdx+uG-yzd)+mue7aB6vaX?_-MuR=
zQvfw^jtVSeN`;C=EOh~uX$O!?=|?}W4-3wA#9kj!4aI*oEa>Dfjyf>~I0n2_FSK5Z
ziWSK&)87v!A2497sYgADl>V&@un5d21w<Uqz<rGj<`w{yF~jLvf9qI$h|qgurg@=|
z*6k4HLoYyJXV}DTwN_%KJg^5f+A~{_dq)>%>9W~+8#8nnf<x+ip_=^0PQL76TDwUv
z_{J*cIR8r553?b87{r1p7e%X_sH6d;BTO13oM5ki9-&jbp4TbT$jMiFB7v4Z9hF-b
zi;piwTaPwduPEPX4tdG6Gbhrr3^0=&HEkLvKNlrAcJ10XkZi~Sd%b}!LGGhrhb(~7
zyl}%YAqXeXM1M0O{gGJFHE3O`MZhrsdNngMGCDe1yb=`0?SD7sjThobK~s>iG1V^N
zl+-Z=e?c(O*=?hBrYI-yGioTQ)3rrua_1rI8n@u_lOfjJjk^Y(oEF%*bK;;8GPJoA
zv3BlQ+VfOa=K14C^3?N|%=QoGB*+99#z1XB1{H2+ec55gtB_86>9SgV1AW3#Q>L&q
zLZ`T6M4Fd&A=@4M5Hvx#T&M@#!Xm${&RyjtZY#Uky>rM!i-~RZ9<iiXAcGoUGA;KO
zxGtb@6&QA1m^?TLER$WA46GhnUS8e;ZOd`Eb<_^oKBK+9X;GlZ3UJIdWn3hNOt5qA
z52-9|TzWHH^hiN;;wkf~!s%RM#R&dMX+91=wbl?n-~a`0eqQ+*0`5PB=Kg#H<Gx)?
z-3Jo+bqi`(W9DfI{kSK?LJ5y0RhQ=2$Y4yDAysppwvJXxTA%eaJzJ}Cl_El;(Dz7%
za%(YgPbT=229%i@Y}OvZ%eNo5ntImMDh<_J($@~VaY%jB9S7V2$De1w$OSGvKlljn
zSY#c~9zw(pk9-&gbpSWZfFhC~Vtf%&#{fm`gFio-68cF4tLrdMMyEX|CNN%U)@{-;
zD#0`>O&(zZmI?J2Cs4sRsKk@wOFbHN@Y-b2{E^yE84ngt$bkyFf<b<me=_vu6ISo+
zSUY(w6g`63hjg$SCnj;l-N57*RF7r!SKXDxnD}N%;_z!9{90+jLDb=LjO@D(W(|<U
zRWWlMFsTPHp|hN&jLO3Oko7T<bjOUjJ8vqYDK72o+U^UE?cw-y=V8}}_BcS~ruY=Y
zJ8&qEFjnOw_l9()mrbarVl4p*i{Uwki_ErDLik<_E>KWRX>ty#2gMwG>_^%ICc)nQ
z`y;{2%e#vM^>B1&F7xto+)hvZ>Vuk+1gMCRF8r7k_<4iRk@GX-A@?^R2K#*U^P@Zg
zJ{0>nC9AZrg_%*oNm_QPW|kjU?NQ<>9rtqM2ZE*}JJ<u{Kzp3a)4#?O%Oyx0+{z7m
z!tWQcKwgiuVx3zdr*VY$>G3_q=W@E%!Kyb0V~ODHz=lzF4(X15cApZmG0kpr8bB80
z&#I}&fs*@}l5L+>w>a6JBt{|C^7xAVvo{83k9_o|ePjY)#V5=2au1=>OQ;|Y`*M9R
z0t%VoZjamw(Z}g*IP@>7idVkZF_&A>XLY4JC8j%T*v40It=hfksd+3wcVLku#s{4%
zFsa#WUZ%0F|Hd#LN~QCJh4%|n--~t*&=)ZyuJ*p!Cd#9r**5COLmez%%R`+z<r^dP
z@R-%SC>_jga~9|9`BqKO{i~}1jq}+zS+4#Jn)!9yKv+te`f-L;z^J9S@m0L26$o)j
zTc_J5ya=E}Cvk3<{wh{;2A~KbKf!W;!Ei6N1c68b*>UwX`<M$>g$f{?Xc*g{r?c~<
zz^9ThNz08x+3;MAuMg6t*wcDYY?f+oTTM@@SY$BS339564~>Z4iayy>a?+K4@bqS@
z?#m<Kc8#-Qlo6vx$?Ch~M=d!>4l%aCc3E|(nG9{~-e;3rvPg~hPuvRlY@)hb@)Pq;
z_2^BC$4}}M(Lwtgv=1E#nJ%Y}`%S*pOZ!q#T@)%J(YfW_G33xWYCktDcHR59(;SlE
zq5md~PCOJ{aZ40+qxJ0*i6QD5+n?n3zAMjex3L^O0ljaF`)|^Z5e%3B2*pR)pIv2;
zJ!5_K*WUSNww5TrZ!T2E>an<bEnJfK<;F_*?#_<KGU9J8cu&w%N9Xx?3=Hi|{k1$}
zEq}AI9By@V7Dr~Cy>6jwyJuw>?w2=#+vA^%q#1o}4<vr<Z7{^ui!rmVMCtwaI5RVb
z<SG^9$|XI{O2tspcI<L6Jke(<clU?-c-AGjr04HV-uL+nMkObElI(bG#BJbzC4XP^
zv+_R#$xjvdc0F8%7#8X?#&5<uy>4@MJ=<1(FCykYy(93J7fIXB{^W{*3$dXHBx5m^
zZz70#zncrIT5cTjX+yfKV;2YMDApIeXAByg1&3lITz8cL&;{}AntS!R#~!;AzzzbY
z$D%9^%zup;_V%v=E%QI`^q7jH(V}AuBCQMDZ?#7VbFr+61}-<rd&!hdz8bnmm$REI
z&0a^t#e&>eU*|R(Kqc^*02tGN(X+-g<B#T#0P6%cQ~-ln=8^%c?PsAEjxZa11vJ#`
zcr#wclqkG!UKI{r4uvl(IN`%lajg3A(MN~e-AM%0oHg^fBYtRu{H1-r6w)Ey_g;le
zYB4$35P!T5Fo`gbN&SR*Ue4ul)$3>IyrDtaMndqr3!pKf>gH41(N&UO=T3;QvHSXx
zk?PJu<l|K0-N(BZ<xa0mECr1U@Km-1jr=cpU0C0#jmM&jh<e5<?}$m<u<Ecw>d&9g
zN@UkSAfPL-dL)ZNc_prECo(f&R8V4hBxslu(%u`16tL^wpw$srFD-k4j3K|rsrR3u
zTS&CT`GHi{p~DvGnufEH>e4$^vzJb$(11FOgAL1%a*(5bB;37c2K?tmfs|^^+8}Md
zhN)1NL{c24qoAjthb-jkbv|H7T7zAszZMATDZ^l^NVTutB|L2<*WWj<-~Lp!omzkC
z%!dkmraQOUAnFQ0lB9kY@W0E|EE`^_pZszh*oM;sDKbNcZsq^t4R&igg_8YN-G8dh
zC@jKr_ltV%=4Im_8D!9X@@WI%^r|C(PtJ9kLk$7r?Bk0YDekYFd}%H;c;$-pCD;4;
zJ$_b(@=jal@eS|a|FqCyUTB++J^rS}EXzLo1X*MwlQvWk+`J^Nc?tGW;ctue;l3FT
z=Ia2UZ=Ru&>tytPvqNfpLfUJjEQO<!883&*M(zE2E*%2Y_=nLXmz!rbGd_}Q<wI#E
z<Iw=cB0)s2N#Ned`kelR#7Zj}?E2}xXV69|@XvwLD$t{(mJ`Y6QhH{ssX}pDX6ZM*
zcTmU9PWOZGIK#3rqITfPRyD!4L_bk1=<et}_zZAQEEvw3_=pzx6etWKuseS-e~539
z5n~yr6wCmlWD+wOvoyZFy9m3EJ@}Yy1fK_w!%a`$v7eoR$~DlbtFQ-EY=-S#-drVj
z%-==sa&GowcCxaU!*a#m%Oi;>pQ;Go-5qqa#d~_+%QHH)PPh<jXW3~f^cLE!c1_v$
z*hnSAH&E&U;wXRxdd~vn0iFVbs01s$Vo**aL!;qW>hM7kF@05FBL)ULZ3n6jfSFWu
z^0{Al;!{Z*qv3b=D>kZAZ)vnudZ;)}vFujjhjEkaTO3C83xU-G962P$z~^4cfC#sg
zfO!PzCiyFq-7VR42lm=co*B?T4RZ288&tR6R79|3%WIeO#T{AcNf}H=E4y5r!b~~C
znSCqMe~P^ZeSj&ylhJiAkrrsVmSYZnzpvV4OqH>$`nm~I!+NbC2hNiIDgAwG$PcQ$
za0p>i(JGhbzN1zD9)g+}ap+U?+q%6R8P2$VY$=TlX+rK{HiUAF5_#Fn8^9DIACE|(
z109I7DWDY<q9_DVbf*KmXmV-VrNU}M2=p@@x8<O{%Fo$_VHW|V7LL~PJ;F^0<58bb
zUpv7&21xo*y3ikNJw?66p>HIKOpX1p$qH<7NKwydLTlUO*~*-CiNU#VA}IwU?Q^Tx
z0*bY7*wOf7D{{GiS&-+z{<xruR5~AkQ*9H%Wy4g=RiS7Wpl-zDF1w`gD-`sJ20oep
zu9QnTQ2Wxyq;Xh-a=sA>59b^4sC7)MX9^K#b(aUlTfS?*$7>-ayS+O%VDR;cwu#^d
zNnJ4Y1LpmLOp9NcAXmc8_1mdeoqztcycXuP>~Q+-vDPIXC*`n_WSLV2ObROwQ*mME
zbv`=KzaxvE#TCDJGmLk`G5I`x`wCZcM3wGdUd4c&sbzWIU7Ib#7qmfLt5P{FIu=P)
zS#I5#p$1y0q{6NR1ET4?ftEF1m$a@cM62U3xLuYIK{>74;OD@97tFGnA2WvW&*jFk
z9>e^Q>hR02HuZ}udT-kp(s8+rBb~cRmt<Ssu^EWUoeU`n&l;7eL5pa&xj6~lEY$$0
zcV#R5H0<eR)(Ht}mA;>M^E8g)%4RFWD=w<|CdsA(6jR{fF3M1yT3rZl%Q5nu!46~w
z&<f(k=Z3V*lb<9b-3K>3@C_W5JuKaALtBDX_^K^Sd<cHKM)SF=Ywl3x9f@2AzY!S~
zLV~s--e9E~YCe}whsESbxRgfCA$~6BPa|+0Vvf~<iB2B8So&ho_b<3k)v=v&q{>d1
z3w_79(|?OjZ9V>>jIyqSJZte+OXl$#uB>9UkHb=&sq;0+-6>fsPIUw5v}_#*-|~i$
zu%i`RJtb38Yy{uI+saAo%&_Yy5Nb)JOnzRqI1->NcZ_&K?1_n4GLo-%JupLXt&Xr_
zgdCJ!SthR%lv{xl<hHuuq5#*#U{-wg<P6&kM=Mu+TPeHD?hHU&Z0GdncmPwq3q1CG
zV_m=3{WhMwm+9E-=*rezsEc2zNbqH8vwp|jKB7jJ5V%!Lvw)a>XNFcl47?}WXgtch
znF_CLzY)%1B}BJeL>*$V>L>CZ&2=ID){^E=tz08)!Cz9z>t$0i053ubQ0+f?qwU4l
zue_o1zotU{N_`2WHn*(6V@dNt1hkupw{}?I8N^n;(?FHly5DwZ(t5}YAqiE<7~(zF
z51$%XZW)qtn#v0y#JL?MP!nhf#|W}tFoPah>tUUOXT$-7FU(JsOo(<9q$6DIw&8*~
zmnbt@_(5xYV9VqAvBj<mte6rPZ#u<#zDa$rfQRq>Wc2)d;+(`fj?X`4Eq8w6om6Dt
z;fgY;dW?;4wYNbL^2Lni8oN#Kh8#Ie^^M;N7_99@A|<C&_q<w>!rH_a?<AdytuEm>
zZ+H;O$Z%mM&*im(FZT0u4(~Z1`(FwU3*AXo?YJrrJ^ZYopOd}U@Qnu?m@2>U59cK#
z94a099ky>BKDKgCh6E-7LS-7;F^7z2mXpyBog_q}0yo8+a14QTP3a2*HyafLlv0<|
zC}#0=kK}VOb~Pj+wtSmMQw{}Va?*{Y;z(9jLhfgV?o7VnXw<}#sI^vQx>h3hugl0b
z&^(m_V)4~0A1814YiXUCX=;QDf(=XUPjb;bJgwlalj%*$KUw?SEX|UnbCioEC~u^Q
zK9NoCZPo#ID9X7oJsCj?&D+Za+jEuNHBdwhJSUn+J;4?#B3k;l^hnkxXY#~8-817l
zJTZI5sKES(weGmi`GnuZV=y6p=*r2^d$AvWq=i=SUHbXlM0fNOd{NgvYQ_*%zSYW`
ziwAwcmQSEyEp(M$rGRGaLOuX1o@E@Tk*>`yGH=)2K9YBQP$WZJ?&*|+tR$1fTUr{n
zg{V2__SHsf^1)fpySaS8YiNG|=a9%AYIUm{>HAGaU0PRW^jWCS#efuj?pAlho9MxQ
zmhQ!JM5`7ZGbljXxJpso1qN3YXlyF<^3#A##<@^OMGknsu6>#sL|5{@hO^S<!uR>V
zSB%pbU@61&Db959_Fl|EE7yqfmZ#5iVsdSEmGHjq3V2~yb>S2Ui!I7bc^)^`3O+T{
zM7g~~VnpGHwVjOCr=;S|NE7olE4gcS9=~gQZ~R$!IhbFS$2M@s?N0Hl7iLSVH6sMR
z3yeE&Gx|X-+*whV7&-}MRxed>3DHqzt_`6I64POH6%<Vsw;Ue{(XkafPgX>-(p^X|
zTj!HQ6-`OZpGZ33fCH&l{e(@lD_Ricjw|tFTaNpF^92xTUsbL(D+FQWx3|L-p>jy*
z4xKVfMtevNx4gGqelS<ZwHD})d*~#jUJ|Yc?*cT+jxi;?-(vt>JC1oyS5{G%-kWqs
z4&gMa+*7PE{1R)e{wuc8`UQ3_0tx-g6EE9NPBQ?kHyG(W4CVoX{P`EzW}2ei2TM6t
zX&$h{H_Nn@sfpcHex1~eiAV=4`!8dB#vU!?78lvC0q=9sl-fU*hlcHl&bzNV`FAa<
zcb2)?GX;gg0QXyTL4&{ZC5QcD=yc9tF3FXErurAh$AFAIvQ|vQq=m5_TNn==Xst37
zd2Hg-qFZKaW>Vk7bU=^4RR_p44STk)oU8uw!R@oXx+mtY(GbmcU_N0HTlJn|H~;?n
zmf1Ma2M?LfZ9|+&LAAntm|A|b>qpf|g}`Ke;xIOolIGy<S_L@heRzAuDQom<x?@ty
zjI650Bm4GZs~c6!r12JRA9^4M36;R0oxH)+(4CQpjaLG5nJs!|Tn3Zn3Z&MDkgg@u
z;mT$!#|ZqUn=QMmgt8-)`|pOWV;hy(IE7qyDPb|wD*y~5k<z5CIbV2P9+!P*L!gVR
zOU3S`?nwp)sV)x~;At4IR}z5thJ9X#eoTO~YevLIoVBoYn_1+hA-rQrDLzaQNGHk;
zQ`rGO=9}<+2$FUm2it(5-?i(ht`T+BrI)6Ywrz#xOo*WPU)e{gso9>&z(Tf7sbP<r
zi8j)n(jKLTj--chQb-BFpoWx^kaSi=>e2d0mXx)Fmz#E$(ZLpgOO^;cC|J6UfaC{a
z(!8PPc32%>n=q>&tG3<CzEk@|zr8yt1uF$MzlR}+NXF!snOWVFt&nY6IaVLe@|crq
zpMbh_XEs>B1sO~RIC(HttjvlCUXCyjtP^i45z>F0Mp0dTN_~_}NGxF%HY^8<2RwnN
zWZXFMA){;;yP#Df-~C}?Gmz9~t!q}sS$Cd?$K~@9j47_w73Ppc0b2y80~0b6{n<UI
zy1DH(7W9bc`EvyXGrj+}X?;rL(>7~&oPXw*4_b8k8DOd+0knk=L@d)6y0Q=J@m}e&
z!Ok?qNS4PV|Dx7kt9&R;F{+y&SAiW;tJeci(@m42pr0u@N>uOE+9mPt3J1rww*y%&
zs5=P0tl57Z2u!j2qMq|^!2qN=W4=oUk^)E#wBO$SYm=+54B&rpHqHF|(5uyp8ZrHF
z^Yf$@6L}{^KE4|_0H`5lb+1bfdES(61Foh<Ign@o<T%f-op0f<>+h;aJQOami)=S3
z-Zc*-i7V@Kz>IaKfhdESr`w&4b5Gh@sMBb@WFrV@{`aZ9;R%>17L2xY5o}WMWFcR0
zhpdE!Xp;fAg;HtmdYiGCGtq7hj=y#!$1wZ=k;Bv`k~Q`7y_WX`cfn{^4qlis#lcrX
zB;&H|;9o>r%L3-X?tAR-{>O>m9Ra`ZBf<i|xaDZmnit+~bybgzI-b}&A1(3e#B&x-
zzLN^)=TEfJ`+I?=H!#eom69y(^n&Rql(-(9Pz>D+iA|U)vO^^<ZEeCvCj1E%+_<^1
zwUSu9D0=Y)WkOr++XS*n06s7W<!b$7Gp%~eCmTmYMU*8&^Za`6*}V+Bw9hL~1q$z0
zadOizHg9ndFR@9@X-Z&xVuQ>Z9DBmiT#tjD{9s+P$Pe}<CE>sG20#L#YHabPzcfXC
z^N@W$UEJcNdCfPL2ERN9X)OKS2@F1hmCGn2__=9GibaSIPeH=5B;;9`@!36m8sP_+
zuPxs9WINf%Wooy;5mM|Qp}KRj?Q8U*&HOmcI44JD0H0$+FM+aa*i=KCyELm$@;QVB
zo_BYed_U1c{t@}%)~02dBT;@%PVC;4L&?}+G@PHKwrzG|VRNZK!Mb`Y;W;>vE=inu
z>M#H}IRcZ|h^GYCz}2-Cr|*gvw$^Ip{0i9g*YW*}D$3ZGZj#W;Y5Xp@wJX770DPYB
zJ;il%Nw53Zs|Egb>7m@!zxquv#Cb0sJ?`~lAd}zh)cX^jo7O#GWgM`OE+cl;z4La;
z7)C|~QkT3Z9XHp1z2KS9U$#Ly4EqX3wSXII{xqQky0P{{<v3Q&-9@iQYIZNvIR7~V
zEvav#m!Dzo7`7cc%_-8pkc(k*nrqqFGN~x)-%=vz;&V}0BY8vnc(>x)Q$jRvM7HXC
zZ?37BHx_QWHnqaJBxPiu2ulsw{Dodz->ul4w9|}knUb=o7xa2(M+l9~?pzK#5>wGG
z;2!>>2I+H)dXK5i@?9}k1}7=Ixq%gL5kJ7|eka68gyfj}czSH+1BXc&4pmZ)B7<c?
zEnTpf*ggxp1$kkI<FSk7{m1W^b*T?TCwZrdA2pE|_ZuZv!FPY)*ZlCs_ILSK#qnE_
zfpm~&dDS($8hEGblp3n5VrOJhl)d^3mF<J>dvknz(Hyrf2e3BQp5}a{&A`xmtC5^)
zQ^@2vV)=J|tSSVZ{MCaL{K+dOCHgJ<cOGd}{;1u?Bl70E{bC63QLlXYawF+jzyt2p
z<x1<Dw-CU(S#CEu^GT3bX_pJF3s2f4B8MKps=q*G2QYJU&Lc!Ag6hayN0YLe#z#^s
z)P!-;Muz+l&1ThXdM@U?i-a91olWX(mB)0;pvpbeqv$#=mWC?<E>cLH>cfG>R$XCq
znA=hK3&fh&5-(%uFF$$q)(%i%BKF**IO&3WrD0)i(au&l71vvU%C*+yme29t@~=tk
zLJ6j22X4`%*HNAvq9ef-=d=u;+Kr{SD!v7`9}nS3GLliUC{FTtlAV3o*YNkbmx#yy
zXesiAJDnd4%fjCR#IXzE35K4R&dO9RYa~6$_q8Q@kimGtP;=-|lw!?Rzu=Ojgof{K
zRGhu9bKCVOVO-_xc7k5wSFNeMrzG>UQq7fXb$V5x_F6o&j!Pthv+zBAH>gYqkGP1I
z{-)?%m@r3)f2`wwzEEp3GlJ!oqviQI-Z))}Gn7nv9dLVk%iZE|Y#^OC#bit%_Zww+
zqXLT_cYQyfjy%7lpRQBF>oo&SjHB5N^tNRb`)jgB{8^>ll5x9h1HknCLELt`CgBnz
zk8r8>y>xjq;n%Grp&`AE0~sGkqYMKTV(AX{<giDdEbagulBpLnJeX<Wo-4ES)6mFq
zLwMU@>Rp;<y}HpwRohBSLY&H!!~Gic>tGd~cF;x=6D5K{j@?1ZUZH6$y0bQPs}aqp
z1iZ}5w-w}TCn!(UdER6JK+Ccd$O`VJdRn$RF8K+w)XVJL5n;hHIt)-9H4`7r>W^nD
z=1vX~Xde%I;6$}>u5YH8IldD#YBR4Pm7VIYie)_}RJZ=CsJ}olb!@|Gq5SkfD9(=(
z9Kr2_BRIMcxSU9Aog>sB<QX#u6%cPfwI(A!E)Zzyvp{ta4Z9(*tgJ-X&A4s?Nm%gi
zp^dkKbT?nGT;iICx}{^qaA{n_u!AX*ZdP$dzE!c0CmCJz9;5i~aVk7Gf29FaH5D@&
zM3>d&sj1WMQ1N>bf*I@e>bkcuws3T|V`%gQ+yda4IL-T(d?dB)wjG{-K6GKp^UOf>
za=qnbvGwGFVns)}9>r`09tO+$!#C7;vl_HgRzW)_*9j?^au(DQNf+Qzf{QAWS!dey
z5xCPr{8mnj94n*mInqA=l(5yV7$e*Rhxusrc+YKfMkzjNKRKaT3ZbU-4jIr`qi0Wi
ziT9-n3t@(K_OqM)D?FJr2!zN6_bs*h6Ptm5WwyS!NPLnyCNclq71yz%kTIq^249(r
z=ql<)U2>&KJR#=u73P0>56!N*IfY{5%r`2wYwvF%wg$JlQL6$w(c;uiS@Ogm{fdb2
z93#Ik<Ea63qlBRn=bZIdO}K#Nt~<L$>rG9BoZmp`jB<Zf+j)RT5yerPs7pU~UjmJh
zm%;P;+T+XNbUK%4m;#Ee+ixPYGSuuYQlhDsR^JDI8suU-GcQj!XFG0)yPbYYN~TdH
zd}IqTTo-~5Na1<?eoiel{vu_@b@oqM%c?>*O~0GI)x8AsH`^!qEd<6YDm<-jM1`mA
z+i|xiDdPq2B@OA>vnQi(VFcH5;*fIR+D(uEwX%B{LapR!cp6AII!*UR!7kxRA*^5d
zKKuFR(68XWq!^o44oc8lsQ|`J6&t^6{Rth+iP!lMK`9ELj+8VazO(@=wK*EHzKqQw
z1jo!+9mLjer}|FDb!GOipc1ufYdk|I@gYc6*9+)>(F~pC@EcrhtiE<DyyN++&1u?_
zAR7)t`jK**zdrE^mFVT$X-qkIUneqxtP$Ws4F$x~&$rfP7~NZ*A4fj}C#vx0L%RXO
z6F5VINvdM3;aOk>&j2(#AcoFDFpy8p6O)lPPimZZx4rlk5n40R>!^Y4u`UIKmWp)c
z#Isl8?5PlP<+EG2!=EPf>Im`6w>SwuMJc=!Iy|k=n;kiapc=LPUEQw?hrXg&ozS0z
zefhF#ipk0@PD(YmvQxffqjGdB`!uUFn6mPo^_Zm{H<7G%;7Q?hjxd%ebQ{*8coh((
z3XM&K2?;}}m|e}4ioQCR<627>2u(zKBTu`hpg+cNXIk+8Y41Cunp)nyV}%14P!Ul;
z^pA>47ipm>96_b3^o|rodJQcE5sXUnh%^xaL6F|N5F`rHK@pG^iu4kCNg%wl6Fdjc
z^}g#}>-})Q+*vG<z4!EIW}f<+{j<ZLl<ZZ@=V?vD-JHa)0WGbv(o2o0kMM*7yX%q#
z5e#tEF~wn?n6one{V(@5u<a>&l5+gS*r^#X7KP6}XPDc|!z4$+Fa;-hKmE~XzIG0S
z>z|r4Vxa%%bq=uJz7y1wN8z0M__LR(O793n(pG9m0xpj@GV{vI0yKnChFIN-l5!`1
z(-l2o0f9}KJeT`yFPtiRv0tyiF5g_XXVdM%-i{9Xj=<HzZ^lSr307qTH8?Qret*1z
zpUsYBcz64V6}o46*Azn!I^Vc>`aP~xgf5HVIUBW3s`jjNtPjDD3*et-UALx-`z!CD
zhcq+b@vD}={ttr*Ljb<ln%d8_udY-YXW5SDWcX;}9){6!$dFoO*~&tpGb6i(%m12O
z{F$KpKx>>q7dy2awvQ>_Dhn{uz7wrL=7cp;>Hc<#I-bx^4A#TI11GhA5HWFa?f}74
za?BIE@eRw+E5j}iWSQHDPAI45TcF4JNjS->36<*AE3Uv(?OXO|aQ2FWMG|#uT}j|Q
z;*x`VZM62K6R`XgAS}UPI+~CIz&H9J9Wx@ya*}1TXT~VabzIOGo5ls#0-os`UyV1)
z3_KSzjlgxQj#ogHoWHBmE}>FDcGW3U9<xqVx#%MP6w<yShbAIDJ7wIpKrY$;CKrgr
zxIG2du+JhLhtF7e=jw{bCa%R=3O1?;WIn)kr!4_J{m-$b<xmA0Cxw%*+{OiECkJUb
zQBaG#ep9x>xPy=)f|p*>XwkQ3kI5q-*nncvZ%~9$DlLQCX&1mAP1Ax+n}<bl0I3j6
zW!jgWb5N{~2V7Yxpfc~xr_3s@1|aBXDS-TOWJb<oy83Ou0D4&<+z&IXT9^Su#b_WZ
zg6%_-DzI!5s{T6x8{;vkhgY-EYwJ(I2DMNb>s%3uCI%*uJZ6H6YhGIFf?izwT>}6S
zY&q7-vUeNzO+~H_$C2O91xi3()eELau6|GiBHKqGeS%uG!Xf?E&#em)KzyojFvDwe
zVRo%{Rs*<sY8;ypWLE>#xc+9alKB%VvEryo2efOpasSrh+q=oY!}MbJ;KMQFZ|*SV
zxZib5{vCm`CEvxaS=fS`045{j^w#TRDvf}{0>@pWw*MwyH1eImUgCZgeS=lvr=k-w
zJtRn*p$9<XaEFfq!u<L>!W=y|Nq?IKyPS?bR)Q_-6adz~STPxy<yO=1oA8HVCpH2-
zL;a>_mM0P_rwCgq{iSH1id*hkVB0c4625x%s7ku54ZRiP`KAbR9{yd<FA0@#n?sS2
zogSq*{#C}`{@Rmr1o6sc(=Sxojoeuqr!YSEFtoC@e6caq%l`dx`i<pvpauezYbpO5
z%2h_Ri&+7kS}=Z%{9u^#jLX`B8rm@)T3NZ1E`9Q2(3(v6-I`<vIzl2#f{!9V0;~qB
z87L)wPpq}-_)s))vEOx7M%rm02fiG0cYH2HIQt%GlG1OQ)Xvv_bY)AjSV}^R^0ngl
zT%lNhcMle<m(ky>7iB{^lxf-!vTtcQ7x&0D6%XzvHpO;I#e)VN{tfX8XRG7GWZg4Y
zb8DMdvr30KJqhpU=eaNkrfy-aC|H&$0tVeZc%V`SMAjJj8zMU<(tb3Vg<R27DWVl^
zUXqiw%mZ`;z5~mQva)WavkA^X{X%R5iX<2;;{v2YtZIa=6}ct+6}~G=?>s%Emx_4)
z?}F_fzdX1@vGmI(Blc(04h0P;_n#f|1=}0T9eR~t>a0I-Q+S6uXvcz-OTHRySGusq
zbs+B21xPajG0Koq>F=GwSMv;zU4d&0MKksH9t1WkNMQvonY7tSo?xZN$F~B0lA^2u
zrBL@Y(0@n)0B|fJb=2SWgXTlc0?J#8zU}8Qfo&D)2~Z$Xlx9DB3HB~XnP)iyWT5-&
z3cv+pC)re`l?~;G66omZIE;XK%n-ld_pg7|MObSz)2{{<5=se;5%znkKJTO>SVkI;
z%x0mh=@o$D66fvKSG>!_d}rU@m9LC^DK&UxaYt`+8Nq)nXy9p!OeL3K$rk|kh~Mp-
zJHDf9@w13cJYS4_htg)v14njr(kb_nyaZe<4?tb1+zT_C9{>O<+hlPWgy>fnY}P1Z
zd*2TU1GiclZEhEL$jF2yb@U~x$yRkqxr4KJdob0JVZhhKDk>d5{cVzf)Cd+Tw(=;C
zjzKRz$u69f85-Q;brH`!2+uCtJbwUQ)%I(%LI4`FX{Fneo|YSb<g(x9r8j1yo%Z4E
z&M8}X$s<!`$1;mg*dDE)9m)GE=%|4|7lM3km?O?7!?05wFS#{I@B%#c)=3w4|Ap7L
zTMATC83YghI!M6wkbl{jcF~sGo`z}onKAom2H{{gQbYNs8Pcht<3`9anj`7JK9Oi!
zlsK&Mokm#=;7W4DN%W;!za#W<$4zW@Wa60->{f^oVU9$$-O4X^lH=qokeDoQvGX(J
zwJ{<SE%fVrN(7B$8R#PR?FAaU#@$bv=*9|w9LFX~KbbR}d3QEzZHdb&wi>ezI2Jsq
zPcMLRiWLk2E}h_UcG+rwl=#lgp}i0Ac$xQf+cfH%p5w1wovHzWO6<<o{?6UX^|)u&
zZPqIGvW0UipE04fhV#+2<*p3N0e>-~Qx<0`CL#mi@~v~<XT4@6^DWHfeN(^eSo@dz
zI9xqPHVSGjj=gf%_!vwE#sDvAK5<J#wFIzQfNQ3Xo6R1!99ZKDhRAT4N5;#uJS3qq
zT}`@&R8daOUG0hUx_<@$IJKZjV3-WC3k#$lIJ#et%y;Er_;Cw%OM0S5oT7|Mb@MiJ
z@+5vl;mi|o&Cl@nQ;Xw>lQc|sC3X*;1D01`@rHv;K%i_?fB-V1=zkdsLvR7(i992(
z&-SmD$ubMOJ{D|wzGQ!O!Nd9T`EE;Qa5-_D;J(GJrRZAG6}iW8DDPsxXMrc!^2Lb?
zrlBpTuZQW6A>I?)^UJ+X;cnym1YIvy_3m7g@w0iYrpV8p<=59=eDbi$<CJOiLuZbQ
zebM_=_7+4Mz35{5WB#utjyRN!@ZN*?`RK2)fOqJ3o{VnUDwo`v7x0;iuqTfYgV9?@
zwE+On*pvn~ogn-5k6k!0Z22C`(k)2}7x%vVg?nnBTs3up!FbMG|MQAQpXEg<23DH=
zi&rX_oX*!zW+?Vta>oAEy(c6LUkvb*CuanQ60N-+d=!7-UTQG^y%rh5I@$BbgNi)~
z6%8YhA(eix!m5*yCW)0^Chk(F|8*@e(KafaVL$`X<<y6{yOI*(7EZ@)%fnw_NO=Qz
zyAQ<jy1^>E=aL@F9p%Fb@=>vZ-S`??war!6EaPG9y1klb3QWsyC;78nk-A{2<whSd
zqIk~cG);;jJfWItttX^NH?$*kPsn#s(@oVnq7{hz_%qK`Tc3Yl)fdQ;@pGrCdUGx8
z;ULx<CdBtWOEb@~D;b#a73zqRbswrswYU@H2RcQG#{CB(cbiP?oG6onZ*LyEN_#Tv
z4C$+|wzMkl3{4vC#1G!L3{_4$%ZCAn#4nBWbMI6l_nM^cECJ^G$LD0N=BMW)c18Sh
zzQCe<ZSId`MBO=NQu=EKu6hbGsPD*5o(l#GIVW3~2Nm-R-v<+aGm`{-8D_q~c=>jc
zF^tz=P;=fA%b+J}9h@ZY5EcHY7;bX@m#TD5W;VRNt==8kpts;gYu`SDE7EnaPpp=C
z>Y{KiQ>aB+1&%al=8Gv@Hg_0z=&NP<FZr!5iVv{V+by^~bLgGPw|b!X2j_~yxrx2a
zsMb8)o-7BxT{<#5Ndv}m?Ik+{!QxC%a<OZvOJXPTIqo*8rpKOn+Kk&1_2PVB!-}rP
z@x$V)R~js>y4vdjwyKWNze>;>to4@av!^{Ms#K(=RD{2=qNtoP`7V)lf2O&^x!m#I
zbc0Y!bj2uhf2iqgo>0UmC$p+TE8^Oo_NO~(%6H#$tqmbg%wW-tA~hZxeUWidyKzDP
z>8Huuvu806J;5!s<DNEWKkce=`%vmeUxa^LWHn-BeI`-m{HFGqu`e@QNNx%7GV{bO
zd>`;u_#RWaA66K@gIR=`JV@f&h-#_!?t4D-_4!QRUvQ+tyH0W76y+qSQOw3se(&kn
z8)t#?6YD33-JIMfCo<p`AFACsfw?;G@=#0I<OfIyN76MTc{~XSfQj@R^)E>ej3=Tx
zblp7(Yx!Zts=!XP(2<>}&zWEZ3@Q1<5k(OO*Wf*2!Mny}Y`$x`%m(+0)J>L!G1JiJ
zpEPID3px_qES|A}y3Ucm7&;Zb@ATqeb+F&m?kew{XD3YO<OHqk=&<WoKMM;Bv16#0
zKivPUa=BJ#{-G?>Z&M@;H&_dLq1T~WpP~%UduGaVx>vbACBberThYf@w~wIOf8xPh
zFd2{S-tscAQ-g;lvvzu=SC@_%)0mKdVMTbKU5YjUb3n*5>9unbbZ0eUyPJf&a0c5{
z^9*GN7hip2@%_@r*yo#eV@CF8NTv<SEPpa^9k5K4EpnQ=d*!3$tih1=>+p@w0apns
zyeAy<VuMcX-e*GmS0yg~oQrIA1J8`~a#Uzr3&Yw{l=$f`Muf*}4zlXH=SUCq21ZzL
z9kYv=7JJ<x5f-pJrqm2`KByDyA)lwq?2fdX>U_^wlX>L%<6(RsSxA3-;(bd?r?Se)
zwO)h@Lf-A{R|r?MS}J<Nn{4k1#ikKPW9%nhi91e>&JWkJ$<)DoA>j~a!t&*yPvhOh
zk(n1Zaquot`aWCDjLvtbK9vC<2kRrd9|iZiHYi+dOg8HW1B?n$JlD&6ZsIY)O!Uhg
zF$vbo2CJH|C`qvN8x3gF`kWVj2%W0@be>zSzmwE!8(X{wb5p``k+1JCw`#_^2DqOQ
zXchn-x)KjLiV>WI?}{|@PzV!JlX-#aLvRh_yy%p?QQXQ>{q;QAm!>6J)^#6p%yMF;
zG0gc>FN1HiHO4B1Peq(fMAj#@<swl>V56#l8x`huC~<#))3@84l7E2PLjiuJSeSur
z)+&H=@f1U3@XArS`%PdS>>_<G!e{AZJA#;T-z>v9J*h)OL|+R1z(dW&r+bIm4&=`a
zqt~7&%JI@&VhIMC^|+h;wU<^agNbCSKpB-P2_T}3vlVm*=7a}WudV*LK<^XCK2%Fp
zj;YkpprS0XEm=(*77r<4U{Mh+RiW!lHuMil!9qRv;A&6GKGMCjG>Q@#h+u;Fl@j-t
z!^;L7MTwoq_cT}B)8#>uzpn)MmX1ul3^<rC%hqPC+a*|D#8ztCQ`+gZuLmv}xl!rn
z<VxE?x3Z72R!ov-B|IjRL0FQ{JR25I`XWp2sgOMi0Aa@rk=k_Z<g#AxsfZm7x<nMh
zPej@k@bbsV7vZ0*<lfHNJa>C71OV~;m^=|u9G;F-xZX#@M_-gU(nt0wFSU*=jxHC?
zwahXC_u)P_+)};8KERufwB$yrh?2(IIp+Fz3+jV?GAcEUTP^k=A_Ki%J%bEl5%1+G
zo?i3+d)}{y4f&d~C)0C{6xQ_0#JGub<QfgDuJ-_Ukj0_+fo|V2M!ksdyb@Tq>xO#r
z9d*0W<y^0o)@l=j>BbIOpZ)aU3$OpZ7xKRA;P|Uj&a7##50tK0u#IgAJt*#7&MxcI
zOOT>E7r?3>fAO(Wb;o9see{J9q2j*ZqtrJ$Ep^Z^1#7}Cle1a?jmUlEM;*yCt~^uN
zZ9wn^pwT3mk?nQi`z<Md-(@dG*kSHoZG6=rUom<4uicQ)L|r$&-;#g6AJE1+b@r{Y
zOHe?ZAXgrM-hG$ecjW}^Y}S3IS;kq}#P)ZPI*>yBFjj@_m#UP24JxHpIeq!QJHCR(
z_sL;O2n9v$2g`ZoQUtpPnma`G<EQAoV7%P1e6VgWSQG$agsh*CkPCw~T>rlos~_Gv
z2s8y<Uh`jKyhebQ0^FjrO`(A6u-Vnxzo+UWpBI3=#l#U}D;-iJk46}-wo3d{fs)d8
z1$Mgf7@)!{LISm+C+?Ly@om2dBh)`?-@%!y4=Y%O2|6~gA~t^9KI)ZSF|U=KmNR=m
z%>Y75-0qvk&%Q;RcUk+OXgp4_3zk$DnIbIzskPzfP}%_q-A-wjEF=*q*^>NG0Ta<c
zR)uX3$;Is<DY**gFj}mN?g#3o36+K?DaPHB;O2p!vv&38tQG?mvzm-+?rJxi{c<uN
z`|u-f{vBNq|Jj8=07D9_s$K#{p7~<dgHeNBfCRQDk|m&-1vVoMQ|^5O!ctLlHU!8J
z>p|~I>k8?msohjZQi`f_m>9|PD9y-T6VV}TeSaL0t=JGocBOkeVV2(wVz+_zUYKIT
zO^;DeQ5XBC|E_N-bQYNWRp8-nU$#xx?mZn=S4sB|NQ_!;Nw!B1dK4uRHTg2nf3uLh
zuPApttoR|OymaKc9fy`qtULxNXcH)XoV);ZJK#o|?d5TqgEHs1Hxs9Edwd;Pvu@@!
zkJ93Umy^UlcB$^CVdHjuo%q6qZuwf`CI(@9#y<2;$!q=okV)w#*lGGVAZi`xNW1l!
z6SDppk4Y+Fvw-8W#RcfmKkD=73eYdxa?Y2FWVSKN-xFvGU+ewq_a#bBy1qL4`vM2&
z^{4FshZJ~Z@+*%EwnI3i)a7uwZyX{?+?yxz0aqVX+w85hDZs5fBYYx0GYhvm0{{$6
zIVYZ>G{ZyIQFaVEui@X_gv(xEZ74>aK7VU$A{?5HOhqXMS9;e=6&HWbK7z8wFjp^~
zQ!nX5^RXStxp%s<aNMh{5vBHpEK}CDdX~P+ViztiHPkGoO(yTli~y&$-XN*>NwXOb
z^2C)ytT(rI@eEmn=e}fG#D;65HSig&?7x2Ya81&qNp?hIJy1g7NkHY-dDaF}C9Y0h
zYO#g_!l^66gq1?2I)Bb2NvTH#Ov{z<)0c?w*u<gK79Lce<U|DFocqWN?jLc$tvM$v
zjGbZKHrS)z>XtOH)t{IzHD9*lrosJ{*;~0V=7GeTHz1wIjG4iv-7Jg6yK+v9<kJEp
zQvC=}v|HPm;vA;gUYDo`S_7<se>dPN*OC2JPJ+r&0rZOrMZB<1{<YWU4PVC#y~lHG
zbPX_X90nC`vCpPoP)WnU^M`B44yvhe7>C&`;ocx3WA7Gu=O<NMr=M&;Uz(+R?Zuf}
zDXoJfEK!btL$6l!kNUc1c?>8MK7JKwl5$`TITj-Qj!fv0=p+pb$O4qt?QJKXg|Y#d
z-n2+u{4`j~`!OQmk9>za>`8$Sk(qvk>%{{)!1zcLTpe|q^q|&JK~g!aO%Ahu@I=fe
z%7)pd_@)yX*ij->N_&B$hCYaIeVz(#H*?0LN>`gWH#_?iW!LJA)*M>PD0>yyHBvDL
za6;9&`@fBZ@?(8)VMjgD%dwoxfHmAA131;r=bIDw+jy3r2gsc^Xh+6e4OcN`$E@aE
z#_Menf`2$Xvy(m#?>z95=>7sYLlEhgmFVlW>fAJwt}nL^t~^7DBqD78T%ObvUv*#4
zX*D&tn|Lhi8NiIlUw8|AIQvPhr4M=xw&oTqjtW#r%mWPByIrfC498sOyE-e2kBT<d
z`vEBL%_1a_TVuU$vL5@nBAT`rY<=~^@=dJR4VfujCLy+OIX1@!ZF-vg%z_UgdR5^2
z@7LD@J8;aI>}<_<X14~VfYL|IiEx<bO)~)P@gG62efp4ipnvXTK)<#9d)FVJ{#x$1
zGVwVbQ{tHHdi{ETN+oLk@_@q?d5mMLgSuB3vFPvpE|9X{@uqEDs{5`{Z!uV6b7Sz0
zRrD~S4md8wk`Wdbs32$6utYGHVGm8?GEP{z$N;UG<&-PRT)W{vKqy$a8;V8?%!%Fm
z@d2`fyA43f=;;|Vbq<P&dETBpr{3l80T?tXH{WcZwfm@NZ6Gh(C&9gRJ=Yy+`Bhfr
zoimfX)9^OydLJBXqK!(00~S@Fs)tXi%Pe)NDrYzD<+}wevx?}suzo<C)m592|7HIK
zedGl|2xXlIqPKxPElhFyXgNX-Lss>l=ZPS7rJC!`@%bC(!R{aiB%i4)_Z-VnMGS~*
z%3<{7E1gaKYaDS%E2n~1Q?W8556L<gIZV^8&Z0KF{W)uy<^~HuuDYe9=}<2M$06pw
zkC96@tiW9%QGg-#28gq%6uV@jQ`<VIvbFvv0l4{y`N$rVz4z|iQ(z3gm<{P4tM*d&
z!v6#+^0QwGu$N)Y7aH(-&hlQ1`F#(N3Kbf@-t%CU7KF2kKHnU`i=QgL6y10Y(^HDD
zJv+h`$|2&y%8BGI_U7`$2l<tlvjErNa5f~mK#XoMe)A_KEKlW_t`WeA=s2!Xk6s90
ztWZOd?u-DRe_%p~+5#DTVV7gKx8*5?xcQmqu0y^i=Q4NU!wLop^9K6t(Cffm2j$G9
zrrA5Qg_6`m_ohaE{c#T%bMKLIjHE6MYZchO8zVk*2DXl<(JZvMmQ>zQS?K(N?oz9%
z7I}J}KnT8}Q$%1Al$u{ss*r4cpC`7t5bwD$9~n1=+K7>5KW}r-(*ojlfMHyL7Glr>
z`QgpBFES2?J}%MEQ)MaPIsPDr*ZnAFZDBClyH!Zijdrxr+H)j6b{fN(k0_*H!5?#)
z1^Y_=YJ5!j3CTVE!YsXc{&4yAFYDS~gsn+>Gfvr{C|0?L!~O@3o^)Yl<Mxe$mH?D^
zSxzy717FY(T)%orLVTYyhd-jwfHBzuKtAdILGmETk6qvt3wpNpAiL5bDQD0x0B)wa
z=W(h%Jtce9or7}Qd=@|_=80SD_*BtGPs5SFS=_QJvpf@c_z!k|a3dcJ4bvjm>*Pv4
zN-kL7RZ2%;hl?A5Vg1DB2Q@kh@MI`@5p$THjsH3bxK>udhQH^ytc=p9=3xnBqN6aN
zb^yTqyGz5mS%AYp(jJTwE99yLlF5TV5_WQy&@&xXxpO=DO6XZc*mglwW)*tmJ9658
zC#woQGm-fJD=tTGrUIg~#w1z}2<8(?Ij?|orB-@{HUvBeak>yw1f?1XgB_;)3bJ@m
zpEN*VjeqmQ(6fjziid(DfHdtdAteSda@fWCK<p2ceDxqU6maLNz#XY!<S@RhBnP+(
zcrOQ3I8)w$Z{pz;*Ul&Dx4~3xjYYnW8P{m|3QPbf5XTc8ZN&AnHIFDh2xqfG!2bGv
zD_vlz(uMr3`w?80+{C#;UTbJ+8i7!1C>09^ZMO<+insZ<z7OLG(!_^x?Et_k)!uk|
zvrfCYW#;A2uhj##zh(sH7e*{#xQAy$M*%eMN+Drp->ET_G}J^Wu~L1GO0EKExRDCR
z*r`6$O06(}hg#km|Bzo;3Wu09C@}yZ3@~)PZ-8_U(2gtBJ?bG3ADl)#IG?r47mxlV
z4_2sqCPQGeV7(DFy7q`$K$*{FjoVnlI571E#CJo96~eXxe10Ir`f&QpPaEYp01vOs
zufPunFaVh?5VRANd`+o?sSj@c)q;+|{>Wx5!fkwR7{6gk2t6TH&NK!=IYFsP5Na%t
zMWBJ_B$pGGA(97ixw2q|RIK1-u<Bz_%=a(fg7x%*I+HrU(sKJ8rfM)Z8)a|bcU6*t
zasz$5JyDSKqPvb0c-_adKGG>Q=ce1fNVzu^d}6ZQ?Fea?k__lN1StJ%JXJ7*o&aix
zCiE~jWTAr|z^a@mMV$R*l~9KI|A|Ve7)ek;yg(fc4SX7KM|)8|Tbbg-sv50AAu;e)
z$B;TUDi<8q0(uBkfFLMayaIKAWBwe-SzN~+oP&^qC@(CjFC=et&20<2T)o=ELx&;t
zG+1M0)Ys*NO4127F$edCOf+AY_L$QmA4i-6<r80kYD%FQX>PR>Y$6WsK-L9U$N+?~
zQP+Qe0;!g`)m|fRgU^8Ofqs$i@_LIHzHH_zbk{1VuA5R_YRO`=<km83HP+KY2i#&)
zj6c;{%rp`a%XD_R4*2zeq+?6zX?w2^X=ZD(k~Hg;!Rz3zKekxyEh4~eSNYa!=woJ#
zOcUi}*k0<#0XG>zKYnPgzLIkNTCv)XG(H#GJVq#4AJs>=UJxUHQ<02Y`;p?gcmch>
zg(7;nma?3>=RWlDN&EOCYC#{N_Q8lD9FiTxIgD&?jG54zlhjv*lwF4@8W_;!If?3%
zkgE(x@y(Ph|EUe(=!w=IpR4D|z7!7mNP)DSMZ#@b=dMwLyf!E0sc#u&avnGGxVW#E
zlxN9Mp2A!q&KSlN-MLhMYI=Nf59O&k1bPmGp*Yv7XkIS9)LZY$H8TWGhLl9j(Tbez
z$_@4aR<P2AdLFj^ebkqe5NtMVAdhKH(rvnHRtlJ~Lb0>4)R)vo`-XQivd=aOJ4C7E
zvM0N*giv3qYg0z^2B{Sz^P&Ub7w=<4LKieZ=^X?X2s0U3QWWitT6L+Hug2&{Dm9c-
zE4>^`*}9bY_O4dndjwsABqp%+J?rbcN17=Hl?I3eGMbozE<5{pd(lWymJz+Fwe=KQ
z+Gk^}?t+E&6j#N!bNT|>6=!9xP}`$Sxg9o#i9C$%B{#&_mlmc3X?y!oUq<bvH0abn
z$A%!9(tJ54iXH{}%7jdzx`31aEY}Tc%~vQI80Z_{b;_i$`2BOJEK(+f7gPXM0i{t0
z)(WOWiw20g{lu<XnU&_U@M)wb$5cc*H}w<tXlP6H#cNXkRDXhI2QxWW4sN7@(uMg@
zGw{ntn>w7A&yXF#m48))3zWC8cOPX#z?(J0?MVz@tA$7jn@)Wle`re_ERO-?5$fL>
zL!7nXe;ZlU)5Z73#xS_U@86YceX_(}!tnCs_Zy2Dw&69K#y4VQRH-GTQx4A0{_2J)
z#vMEvaSBt#N5@yy5aznks_4F^BO8W=EU|anM5tezT&2u!bkn$4wOzn+apJNh{St{g
zIKm>KPOBgzoS8;I8^oNmq4<l!?w?YjW{P+QjmWbnz~QK1e@4&e%yOW5`44b{E^!D4
zyorR}+Dqz(84$oT>||H~ynIu(cz;IBzD2j^gTU^*;MSTgaR>F1%jWh7E5IMr2a=Yl
zvm7>EF7~*YL7dC}+EmY(8dMxxr6;wdKnS!9_8C}Tfs42dZ<tDPOaLReyNIpsLmN~6
zAvx4~ye`YQ5^1?BxP$RS&GISN=ExOaysTASUV*uBOew;SrCsPnp->iJn?qyC3wcxd
z-?3Tc^37s0k(PO!@ZgjdJ0M-%{VXC;PkJ9dO=CcvP8}vddQ~NPtt!qRCM)^{tO|Jj
z@5tRdyZ4bEy^oJWJHeIZT#st~Lzhf**^-E}pFsPZ1btanI#uA0rtZYvlhqv%!ZzvE
ziCWZ-zt|vOSBfYk_P8W2PC){&s*{6Dt({A(!T}Jm>{%4{@Je;?bLYOgSbN<$!6w70
zY44$#@*~|PZnFr&kF2_z_`BHa)Ml{+p$B&Pu7CF9TR)_Ls;{;?<#21PO8=YHjh-`O
zh<D0LKIS<|=-@!P8=5VQ5!cxf21+aP<{sada5MK}*2>w`B;Fq>v<Ut&@Y#QUJm9~E
zCL@yiF6e1p3SNjuz}ZZ5ueC{>sUyF8P`)Rm@5y9OV?_sVi40JEfA;S?IHm6r8$y(^
zw=&yq8stdYsQ8ju?W(SZ+(3#Z&iUQ(`l%p?tgqgpy1-a-fyI0<)y~QN&wN#tY-wdB
zc7*ct&0k`V*JY6Ziao9fV~48%bgwQxE5^WTzpKYLhXYp5a`J~h^v--<RB$r~yFvS8
z9%Y#y565L0hl_5VBRIEtP)R2T-2T1GMCQv66JIW4Ii@qOMV(V>S`JP;Th`k*R(vE@
zyA6t(x#*tO!pEru?geg4ZVpyV({DjVK9$2<HO<#4A0S29=1V6vWq1b7_;qq0LG<!l
zG1ji5zI`s-jFF$zU^z5BI>~OFzr2g!`i%%ryZzlOM+Ay}g;LdSz<>I#U*qY=bOPI?
zC5zR{>UY*$c+<g70nd<Ywc=ZEp4~bUd}_>iBx*fgNw<Vn>!yrL*9|zPCQlGw<4bT}
zskjhRhU7ZWc+gJEMi`0lMg}S<zS01(ze&>UBdeM`$7BxK+>EX7ZrTtD&DNcwT}`;q
zX>|*Pp;8k4Ww3Ncxi|)8UhT7fD#tPN!{OSQ46IRJHq)I(jDZ`Gbe?WWgh=Xc%EaGD
z1{$kX&W@?k4#q3E8H2uR1OPkYE$h&{kutEhZk-20*e^uvJEn5D{^Dm0d|32dH2bTX
zVxa+&K}xG>agyP&0-J8IzU?+M$s*T*#$fRcB0QKWDqG*X>80X(#slT5l+zD1j0eIl
z9pzF{0DSxp5FtYI&?&Yz&ztr%ywv;(PCTbrGsj1)xXEq_pHIi(_8j-1>a^a8Nf39T
zHXI!gly_M}^ktV_fsb1zqD{gQZ9fJDh43JohGvjq6DkJ|<lh2dr;j5tj}{yqR?e2X
z*WCwjD@;$lw^GgaZf_kV`W7KU^mMU#+{0vW9m||ii?t^Nc?u=peGq%J_}5v*7$XUI
z#t%i2pogdD$Gt2DpV=7q^%CdLnNF214-4Kw)U1adLNr#N&wM_0NPuw}$f1Vya(`OY
z%@2=!_pl!W=3>*6I?Pw`VU|vU12J1h%&0ibzV4^piNG)h)D1}BwxE6oFn}PUcrh`l
z2-BV#$sC&TvZCmwL(|hNE3c1k>0$#F1l4gAm4!0d1$OHy@1(j9FvUv$s$Mq`gYls&
z=V0Yi1w{tZ0n>^O-@AU|?;-<MpC&i;Dns!GbRRDzPQ57BbZP<)OUg7-l5gwC=bj|%
zTK*M|QY)hI<_@fEng5&?)3*BNFZNeX$clk-9crYpE}IC5wN6i}h-$wE;=M=ulEisg
z!G(FHi@}PXw#)``8`m<d+Z?;O$ZpChP=q{`{$6Yj*WPCM3tks4-rU0XSFoSYdT0v!
z=Eq^ZawDGW<U{xaR(AQZ%ZF6`&OP=M91XdjabK59Hr{l6^!4qxX&)l^0!M}TD~YcB
zE1wh^5<=`OH`;G8o!%!qX(7?D#a-Zc>UIM<%T)#3JQ$V7H|k6~Y@%x2s4tI^xSaU%
zRJP3|Dlg7MO|>Gf;VCL|a52p&uVUHAfDNG>LT|Q2Pnb%zwf`nj7GV8e)TQK);mamR
zYm_RGpI%MostGU7oPC|IBotZMU0JcvFC;TZ*j~nrkaeZyAWppXR?+QTg6*KBcj~wB
zT4De>v(?ll2ur`k?;`F>X5Rgtw=qRzG&2EbaD94wq=7!hGtPf#v#4Td(>u!Dz9`MF
z{}6DSV)u+8O2v>2qKO$3Y;kYF{g`J-lZ)hw-jz0w+)|shL;6Hyw#uT%Y_x;JaUtbw
zvmC>Fwwftp4BLQ#MKs6mIOrv=eR29|CGIO3r_2*sz`N%{ttpxTEpSsW^x)Af*?z&T
z>__kh--fqQ){~@zCqQUMR*7Z2t=RiWH(Bo>#a`_hEuWC0YES3dqRP9XxRn`tGL@@`
ztto;{b3kIKdexzHt0EU`VB`_(nc8|wx6ol`p?>66`uwAHw1|s4e3;JYts-CctI*>2
z7w3XVY1TY@YX*E6DGl|dnd4%HNhuo4OTUU_Pzm3dOw*9?zIenp{h_;sNtV&%f^@;2
zM-p9~BF)BH$AiQgw|Ek8Dp8E)GWR`3ilec*MrCD;q3I|0Z(s@O6rLOuyT-CXyAMo+
zwl`yngQ3x(QutVS`2JN>_S3ybYCoCkAB*bI7(1W7KO+2aL+fxQBH18K0t|$gCW03y
zc77VkFx)zrECkJuQ?D5-hF;e1ZR7{kH!}+R2+E)1TRTVxd(D-#ae^P`=c<WyIyT6>
zTlv%nvo(gj9ZCXYGh+$%@YdMsyM?$02LrnH@CN>|%Z46}!XQ@X?Wa&dI9nygQODVs
zV-eWr^p{_G`#atf_OyCPN~4)bYbiKWKBxO&o7<a(g#6cBMqqs89WyN=$_3#cM$`ut
zho#O7BGZV;IYwFgyXaaz31;1oYQY|8Ily6uk%;Jw7>&S*k34TfiHriq{!~!9azx8;
zf5Y+KZ635LeGzbt?;mNjU3i3*f5O+}fKnHXLoXf}t90vME!wPU`D37Rn|(b|O<`YW
zxA{?%BNTSEgrcSdTcPF#g+2ZGwbneuj?P_x%lGixkg`@a9ZNbYWY18^5+4q+g>&~;
z#T-q0kQLbohOvpw^Hi>2Ez8I1W%Bk9(#n`3fP!pQ#bcN&Dqk;Ae|~c1;D!6K^0~WD
zel#h^De`8sV{$uJg0+JRGl^M$aEvb6YrjG}TcD}cf`8X?Z{3?+D>tkzd1FF1QUQVl
zMO<`NX3`wh4x1%gZ_v)vWBNXdJ4VU(AuqUyiz!UKEIPc|g6-*V*d7JYQ|%WIoyP|8
zu1q;u{mAUr!Bo~_xO9gmquQs+28URSEyQK_s0nnm_^3uKLESbT7d$pZbdJi6i>7XT
zP+K<c2`SU;4^7}GD%TztEG+xaK&sGa<#?PQ%41?o1<;yVt~3q(S9VZ2>50&!wWq+!
zNG@_vxJn0eu{`I!_x6Del_Y*%@Tj~bZ`2;o$or%UIm}p1Wmc|$HlvivD*+k?XLX@R
z>-QgK-oSVSg$4-qvzh7KfFg@1$#*N3mArQxF5l3=zm-Pp<8kQ{S(#xo8=b`5eo)2E
z+IXsZ^~u!h$vA_jLU$5J%;3R`KT7`;08_V}j11`}Mq2wcctF;*j;^C1Yc1jMSbC&z
z^O55%JS0p&X=G-0*0RBjT8kMS|LpsWpE+UfA{Lre%u!0=`-fZ0=Av2$J(BGiLK!)H
z`~iA1rwosDk)HMWk>bHut}r1_4=QPZ%yT#D&-j@Y5^gr|tPYm7n$DuLN5a)ieLP08
zAAc$hF*5qQg7?qan<X!;gol&#YCi_p-gdf{qgg5_S|bGyRpS{`e{ClA6>D$sRm1h8
z%WIW+cgdi9t0g}9P&R>W`5hEwbQQi7euP|PYA})mCqTnPhp3rDj_347gnU;v7%LJ#
ztIakYXpLuC1c5I0ht1lDYbQOX*qp~L0SxSRstPS+jC)X~aXrVt&cj$rmE?47&KLs^
zyU6RFdLpGmbF=(D+PEqI2wg_)c-nBi(5-Xx21}dwmO^*-<s~zjC-RnR!uw)VV}`gZ
zW$a(P6hKhU*qI=l|HM4$qqt$B{ZX0p<10M1;wlE#Y4PqhON6^wki#=I8OhPL+4@wu
zCR;ooKGIo6Km0bbv&%rDrm&N$D*E}||Nj0T9f7LN4VqI`4j$&EJibsvu3uICGfU3I
G@BaXcNc7zR

literal 33651
zcmeFZ1zc6zx;{MVQV^w6X<2j$(kiKRH%NnYgRlqzMM7E{>Fy3erMp48ySvunKi%i<
zv)%igeZLd;e*f=&zq|ZR<`^^9aEv*|`@YZfK6Bkn+{^=aq{XGg0R%(<Kmh*%H&eh<
z038(-4HX3)4Gj$g10C}g-tAjhShtAp-owEoC!wSuCm|!dPs2igpNff^jEv#YLnbzM
zE-o%gdOks34gnTUE{-2xf`Ea6aSQ7f(e2wr91qAIaQxGsn`QtP9dQ7u83}<3K*U8r
z!bP}g0Vu)$CknzZAK*Ve2#83?D5z-Y7?@b#1(kOIL<A%xL}Vls6l7%ZYESSyfQ*ZB
z_W`>o>OBPmG%7nh4xjK(=+sY2zu+ql?$dC-wD-lpBp@UrCZVOHXL!iS#m)1Gm+$e@
zXJX<Kl2X!2$||aA>KdAcM#d(lX66<Sj!w=lu5RvrZ~OxS-@Xfqh>VJkiTxNCpO&7H
znU$TBn^#s|QCU@8Q(O1-TT5$Odq-#2(D2CU*!aZv$%VzG<(1X7^^MJg!=vMq)3fu7
z%OCwh0FeIDE%5JOI`)Tt;e!1_L`FtJM*Gn(1Vk5bL&8NydBBc(S5yJb!0sLuhYvd5
zlkiWaUofaS75DL9+7Dt9&~Po#9{lLqFFpImI_CQ?_3W=5`>kJ-z%3*M@Zllh0>Z%A
zB}1Aw=KpU0I|lzd2mW^s{O=t2zdHvWat1YzHYlJbt`d#+eRKl$g|hP4qLR|y<|=ZH
zbHxoPXg~9MRC6TkW=Sk}Dur6-$*JO}?APmm>A4~(roG;Wc_{8!%C%W97LTVOW@HWi
z0scpB<F=_0B1pBF+->LIl#QLr{5zI7^x@Ht^J^^1#+rGV*d{ie#T%uc#~Q+fleDWE
ze0K%+r6XAL;tw@zvo?n}hRdfqa7=X54~jbVE6z05o^rgNJsddE9@KRseD6dP>k#F*
zTW_b69GNGUr}-{z{@7Shv`90`R7NLh#7=p${@Gw!5QI9FAuR~_v+Yy<3@I~@dAo{I
zSfQIkz2x?`eUH72yGaw4w%Is)PPbJD{wnvnenh#z>(0-Pbto3+?kC$Pu9Eadfrgk}
z`I7>-?eev#g0JUO40N3C+Pd&EROLae-BUNjkW$kco^E^%Vn{{&FWcVj8iZ7JGCnvq
zK}<NE(z`f+55K}g5X48DvVyKHvR-W~{N1C9g){XvV(~nN1E|RHKztBFFCL&E_FuiJ
zHEK+D*;#xsWv`Br6PZ{#NyRvP_$Xweh{VH&5Z9VHBicFl=vG<2wZJ7#*5e_eq(xDh
zYJ%bCWW6MGG~w!rPV|6-2>Gl;;iDd%DUb079+r#dTsz$N>%!@k;2-95XpEe;rnpsS
zyIU2eX~G`R)EuE3lLj<%xSph9kFBmkT;rv*85x!%bxjLq+CB1m1)fD2e&M!Mh*b@I
z9x$wIKSXFU-5X<&%(-zf#_didt*X5i@=?`Vx4+c7U$*XZXVsgIJJ%D`L5nuKyN)yN
zdj^xwGB_v#8g0H%pQ-67T<3SZmbn3_dD3qHovDj)FYNRrbJ1<Pmk${fg2%SkkGBS)
zW^@?UNf{pFR`Y>271Qn4q@vfB{Q|s_LwZQ`J-n3uvY+pdb9D!6(SIMDK&4*o=r6YT
zMsAe&%G_HmC&MENKM>`#W<UKl<7ipx@@z8nko@^+uM6CVAmyA4dOqX2Hb`=;Dlx@9
zcZsYCowvIImK;6Hb#8!Ev1~XRCH#@d|EEvK6{J*IHXWl^+yKo>H$dAKzv2OQb{6uZ
z$4(6%msT|#rZ)gNQC_fiQaC={Ckpddjs^7r*ld>X$F3n9J;M_@j)svGwh}{;@OvI9
z7bowJxChMKyDUz7T2P|pdVH%D@}JI@b}~k>>#m&enjJICN=z^<qm2fjI15qkpAX;Z
zWxs9vEoVJ_Ky{CND{izw^%bj3W5aWnS)$0fq1@4Yy=lph1L*;0%YErwwMCS_v~mo#
zGPW_!>}HJr4agkl#ecIQi+Ly^!zA{&XwbNhA+7w;e;#%JSZU&Bz5kH?w)LV7Pam}=
zE#g@c7FE}?io8mzYEZcW9zasgaSrkOsba(Bon8V(*WA3)gb@M-R_-5iqIBNd_S@Mp
zw&HorgaTy4yYahydW?&A!}ezDlI|{c^~MZY8dy3EGj~AKRYII^06F#eN%fdTXCn1>
zh4a&bsW8DPN0w2+6wc&qoYQgmdcLMW=;dhoU5C};qk@ZccIl30L>!CyG-!uOKfJE^
zsIV086N!uDHw@j3yu;4qG+w+4zf5Mg_OgH5Ly<5x&P=O*;3}(8(Ou0_R8Z4@p^cq^
z`BIK75QD0EV71{$bu4?tT0Or^1gFb;=_n72wza}1I^$iPUq>;8TZ3{T(F{wLbyjx%
zYS7v-xflQX7)FPdKhfHG{%f-FeDMm1MEtFaU1mH5&EOyIfL)_{jwLhOTe7<f$~aW8
zbpu>rn9uE1AEw^Eg^5m-ndZ%BLp0GaW;dM{@lu#a@V4#fHg?eF(_4NcB;5($;<a~m
zc9ieIh9nM)>WETIDKx12TIQ2999lmnW845LE+>>-4Sp?ihnyC|Co@e+o=C=-ljdEE
zV}d>x0+G5{MH<t(=XG!_bzKcj=dY=qTRL%`>UBd2gX&A|3Q-JCNXwsogC1hqTy8?6
zttY1hXL@X@Vpt{?>u}J{AHH(*j4zNr;@_Jr@Y1u`dUgCBaxcLZAE#JJ;cc5}mo)Xa
zl_Lulv3y7NuWzCLBDv-$%x<PN6@NNcm#*#LMZ=qxB}KyRl$$$3S=Ha5_+&M6^W`D=
zld|b_ajzpE^1Jh%;EM;HWa87ByuPMcqNN=;)-luy8kWBIbs^c{Ex4o`cH)w{OKCqY
zN6MO$52}2O*2TLw6sMt(mP`Fw{K1&Hzk5L74RGH>?{XE=y*0ume1SB11B|n)8+ze6
z88_YI%1H}43N!lISwkLs>hfBXAXn8UjUdh{BBFYB;-{-vq3u~WZB@g&7!a#ZJ3$L*
zbpybz^x%wPJCQel$kYvRb=q{TVm>HBoH9iZ_o==C&UT>ZdBRn4FeIBBU=M8eKqXrY
zFoC{GxkR120p==ifW>^Q7R}E&ZM|GmS`!)>Hk^!k>d1y8yGS1(B^mcA(!6=87kf?E
z*{lTa2EQl9<(q4#3G=esP(7YeQyirqJ&UcDT!3|`cQAZOgc2%>C~b5UwZFUp9KDq5
zB~nwd(a!@lhmY51B{f&7o=BOgmviQtT-5-#471&{xSQ@yX;+j*+7X#dku-N-TcgRQ
zqYFPiPI?a;yillw)(JBLEoEcImPY1GyC(L0t}nkPd!X{+n_d~+00TTX0323)1K?}w
zBMb!rJ@D_s$G4kqfF{cupj81@23;qG-T+?XH$YI~V+JJ7-`^zhyAiBdPrcRuyHTY4
zc?5^kyg7e2ipswqLD~Q7%^x-4%ACIMTsh2m?>rYHf<T7ZR&@h}<uuJv_Ek41a^`9;
z!BUnXNvn-aw6(-bhQp`1=?x7*d{#!-K@*DN5>JD^l#3CppI>};vtG^BvV0^jKFG(>
zrd&jtbE%AasrP_NE{fp`b#69^m03rUF@!5X58A%nq_?58zEiGJ>6uy8fsLl5EGyNk
zHz>T!33@dhwTt1FsqgCQG_b~P8ywP}S=vAucw2o4rL(5!Q5AwP!^YHD9p&!^-E3R&
zOOUU`)6l5R!+yvAe?3w9UnZRKe=ONbhE&W`wQxPHcWKk8k`DsV@6Y=RTC|$1&)FZr
zKd*q(JH%WbK@9KDH_;64r%I#uhpl=ds(Y^?)A2!(!PLFXzRT5T`|4U1<vhSTf26KQ
zo<-!Q+O6FdiIiy0=A4t;;-2F3-JE2mE4tk(;ggSUWh0aM>9L0NkehasQyK8h8RiTK
z2$Z4JHE8>Fi9_QGVb3M2nyM$(kr4b1M${l_o7KacRr{UxJEUazf{)cC7N5rzay4;a
z5L3Dm<8K%k2VRz2JZA2t?lugpuSk)pXPD1_*j2K(rz7OE_;y#aqE4TV43ZoI8o;9G
z@*}%N@=Qm>IIm6%nx#whZACk{7nRyQbqhCM3kKH~91CX3ikpwNx;nIqbxrCu^$yYq
z!a|%anu9~5Ph4NA2t4CU?OhyJdkR|64I)*i8{qm)#opP}g=&bY-VM<4T=oX=Y>EcV
z2En*r1=6V6)ny#8xX8O~@S&jjF5}M2O%kS9mmzI2$Cnx}50`a(%J|waHpaZ^Np=%>
z@L3-)Irub~`b4%5rI!qIO-W_cSNU>BI5cLE#q_@((@wr~G}V*56K_BnOPYrAy$yi^
zj7=4F&yDv?{9a$F5<N5Uy>7Vy0&}vR-z+AtiLDmnQ<WHmYrk}T7(5img7--#|Im{k
z+b=YFWTPsp>no{={VF$BO|Z#_ZpZ%w{NlHtFTr%ON5&1bo8A|&6e~_^JsGm1=iSjV
zm{hrE%ESIhEW@@!HTD!W_XZGB^ooM&TcjMV&~NBwR|YzKIpr3Pj;l}&`^#y2uc)R8
zlI-gXsY|8P54)^}N*5Xlx}QFQgGVtAuML`qmT>D`97Y}&iw;q_a@D&oD;DMY;#e%T
z$#Mjh3o?Da8=N%g6~s`4H1<0;n{N&;+k)3ax6=w$wB$}=^-e(VWQ>Pk@h_pm$BNd9
z?m<A?$ZJ7zShw7oz^i6cvN7|0Wx+j~8{o5;lSg1q0r^w8Q5G8-53A>${-u?uu8T<%
z@p2CD4`lLO-920vBl|dVnMi$W+8`8PuV*a?#(MI6%~d(RZ$t)<>p9K46=j$gu@Y#o
zck_W?`8d~j-ng#3x=t!xl*y7R)SiQLOKifvy|hXIAMF}0bpyN(Dm7eSU}mMRxq8}R
z$nV`uHX?6U*IT1PQp->?AK`kvm8HlAP`xjadhjii`GG!vki3JW!Jn;X2@8hQTQiiq
zy3q0Irc2yH#-72BDR<6}`dDf>il*a#;8tR^#=i}z-z>(Ia~Dcn@w8?Eg!C4ETMCL6
zxb~iab#cMBtS3_ZnZizJ?(@4W)|Fbl{c$vg{_>9%OY2AX>N`18y6SaEpS_oT!wH<-
z;)AY3zC`AKl<k(JW;VGFMU<R;NWyc~WouqJJbf;E>XB=#L4`08o;bYynx5&=JKEv4
z16EqKM%x>}WZa=F^o>17Q{b`3C#Ty-K4jANk0>Nt9Usq>j&hCp&Pw)p2LSP_+)2_J
zyUXv4AjqZ`IrDbvzPo0tcg3iwvEPtfPV>kS$vf`Vb_+P_UnoL!wdBn02em&*AuN*=
z>vVu&%A4$`YWiu1)D?UMd*`B+I2U_3TYA*Nom)eBODK+xVh${3+kLK@y{8I}cP_N5
zcF9AWC@2oJ!yjwT)f(|Ce>kDkoF3$&D;=gSZ}`sOOtX{)i9SFJSQ#ek2UuUpEv9Hr
z@@k7?GFAwgeO4n^*g#)szQ0W3X-k2BaO+@3!qEO|(F-?BMJRf_s4}}MwF=^LPrHP^
zTeXwuq+R;*79AsR{Obem;M(Y3%swy(`4E!?zk)IjObd#c=<z--O7=dg?Gr535hIEE
zv9=Wn00)iXtvaWM1e&^FwoNqNtVoZ058L?5rGr&GEIU}1=8$u#E^~Y3Qrw@)a67Uv
zWT3|Q_~R*vp#0fJ1fIZiVix6E_DLdc_#X2hwB;->yG8ZRY^S;Hc0~TR{GC#3&SZq<
z%aO~zkK9@h(Bk*&Y9jdVASwht?bVl=Z?6d^K0%9E$l{b@f9H^LYIkOaq^XC${-Hd7
zRzDXDp4%tIyA+m?@?u1@>Fu~oO(@ZhaSa`-kW2w#cNp)C-+1Iuc|pT%OJiFjjpryI
zB;($>+~RS2Wpt8H2*>eVT<a~1EAYz=wIe}VePGq%FtFALICgZ?SZvx8A>L*|p)sQl
zQ4mM;2D1Ow=c!l;kLf_iZD3I<dB2$!Z{~l6&-sojAGA2)8Ug8;E(l;)WEVnzdEv;v
z@5)?JvUZg{R&OB#Vj#NO1CqAjeP0Y4HmY1k1by~?z6*z)_;fNMn!8ltjKy)u==T?v
z1g;D{T|6W*9fa<WI57*$zuVsF8F(AIJR#X>3`FqF-)l}qKh6)a>4D^EaZsbZx{qwi
zJhDc8ZWpH6K4kq`EL&Y&Yx~~&!Vs)ATNQTpNr#YBE8XO*BH?#V<~Eu$T&H4clNxES
z$soR*!+XeIc1aI?zqLG$HygA2l2s9cU(#o2vmnKWu$T01`05zJMS7%iDx)M`5<S3x
zRO;i1le|_FV6+sREP?kup+&W9nz>Bivr*AtEans69yBjN{^MohXd^`Pb8S<V?_#ea
zpZtfx^y>_Qtq*MISm!A(NH$6Y8IWSeX~u6K^Hj0bYehY!NheE8yz*sh(iyEyqd8c2
zmU2{|W@4b7ws$d1Oexg4Pom3!V3yI#Vg{rIG5oy^Nyw9+YjGjl(SX`>F;q=h+bIjG
zuYL(~Owg2T%U|N?=F;N?_zfU@J_z$M+;{|oLl5$YwZ8$V8h6>;3H2F;cSu<;u0e3q
zln>`ZP`g5GAF{c+27Rwa$+_3pEyd5FPSHd3Vj{-Y9Nx+BtZLzkS50e&b8vX^`IuGc
zCsSB%E_<Cf5|w@&nlRM>!VQ3)90q#I9q_-Pb!`S(8aas@AO&O%nhN3EnXq&)WD|}7
zq0|YqE$nwqC;Sh;)skO*-zhleh1CP&IBbbMqP3|)N9ZJv-q8gJ7NKg_=GdQ%pez3|
za!&WN2?<9Y3DkWjm1)p0oQ?RjOduRy{A}>#V<p7ap1_!rLshpn+x%>KTGY)taw+>`
zjm=msFMZ6=+G`F3DzdxT)El~pNv}|zKUXhj*6)j7YaM6P?!Hs~_RY)G2=h}4CXa-U
z#hM`AC9g-=ZM9NHoG%U^sq%3nmu-`IZZ5lJnsvut;`USPwGb$2>UKEa!%FH}$~2<l
z3dYAPrvQ-Xs;>o$wY9asWKE~ZkS2XfH1Y{rcZ&6UIy|{KIYfTt3!8Q-F8pT7wHD}f
zcVaOaMOM3W-BbeP6Va=DGn*~rWEY4FZh&*yJ>j)6%ARpSPpDnaG;tAGsUVucabD%2
zde35|bdmB*_&8x#lws+{B}L6-Xaeob*9;FLKfg9e)B)PN<q?-Dt=BOZUj!#h#jdyX
zUk!G(XgMHEUyWt?EOb_CAeXK3>$@+-oZ{P%>Jg$mNrq|2TI+7!`=&{{8S5)$cms&Z
zHOPsdW^KmPy-zz|dR`qs0C7m+ChkNMWY-M{G0pr!Mw{j%w2At_LBl=x(ojcplT|RE
zMyu1RIr8|V)nkH;>YLJv)(KCrn@aG6BR}P|AAz0wK3VCC+t!6@d!XZ%mIrqXud+1O
zgV**VLY246#UA<@x7^a**}a2-sv+x+qidl>F5T7E(M~&4&+8B^g&>e3*H$n6$c$Uc
z={fy<<`LwWN%s3!vniU%T5lKpGs1n-f+IZSZ%--39XJ=#))huEsU#YA2sT3A2_(jk
zjPIq5aH}QXZDj-cD^<&ei=0rMs>0kvBl{p@=|scX&aY4D?DI7;bId0bFRi{rpb?XC
z-1~AlmUrHyaMzlOs%d6Q*Qroj$J~pi9@Dw3irC#x^HTQ{EFFnYCO8`nEoeR0|Gl)8
zS&!knT(pkl_CmAxE{m}%-<@z*r{hA4`37R@+tSKtD@L6~rwtYZ@(Ge>C6zkT7IL;f
zvLqQllP>>EnXxeYvb*>av>9bV74E8xT6(>1jxRs6wa_l8a?|rmD4HQz1od2@f`PQC
zThrbU)Sps+M0lO`5$sZKKlS!w2<J9QAPi*{G%`|fJWoG)kj-hBJKGTc>dm!Y&|hLf
zc}$o9htZ!aoZfy4_dSBnW!wOmK)FZGr1@Y$Y%IG-uya7TudgRx?%l;lAv$CnY+WDh
z(NFOEw}go6Mwfi~Dy1-6>Eq7uDBjqL3tB#CKyh2?3*VGXex=X~FMKOs&*@VSiwt`)
zfM&{)Zi&Rv{rG`02YEY@!U&8nZCIh=b6{UZZK!K`$U%ug{F<W;miC0jJss_tcHuZI
zaj3H>?OQ&Y$YG*9#q+z)Wv(wjKMOBh^cIftk}v3yB;K?KiJL7#)iO&z#A)gm7^DcD
z9c|E$*PD|i*3sX@<{uimMCpo0*4PfwsPmbs_Bp^iDMPHy<C$S0@gmiW<W1jhiLj2Z
zcEZe%y#5<TaX779=t~ZCK-cE#IAuX%f*a=&s~2R7BCi>cWdGl8??Vn4A;Nx|0Aas9
ze0h`$+}Bm}j@(bhiS|#E?fSoi7GeN}<N0k7@wo$@j|Vq^K;$)JOt`U^BNl;<tQhJf
z2cGyxB(tSVz~RWU+UzQ%#m|LTcclMZvgig_+qLN{w-H`R85m&`r;S!gu($#48S+aM
zx(t2$s(cZ*qSiX%FM*ywx&L7%<-$GTC>?&6wCUn9;ixD<eDHY7L;qkWDbeA<8n^$V
z3`JYdMa<Bf=&(zlKCk5HC_{0jm2$3J#fFDRGx&0Ei`iR8T40uzU*ijBc8&+NUkuUp
zeseJlhjX{8-T(n&3pKR_w=w&due0POHw7Oqnu*8DpyJ$nTxKEh$;cG1vUB}|YZd?0
zaIUu2<D_JTN$Imbpp9R3l^c4o0g_8zAe;;;dOFC(P;d?Q;%KNJ4g(_seDR;pr{2bd
z2$M8jAD4s6%<2az7@`Mv*8pixkQ!UeL3$F@-v;uBf=nPaIt4vYHdMO-l4GD}J5A?#
zz(890LH-TU|6KU$bnaS(XcQd3%oNy_4V=;Y-)R-GrYdMlx9(_3L!joveY+2}eRgV1
z<zR#|M0qu@%tPRE2h40ZF-kFI;DkH-%kz@UHJZtz=xtB2UK|I)&+(Itvo(^`6j8^h
z2%a@h@Lmv9ZSl0jpG>B}9OYmH6$pk`Jl$~52Oum)q5NK@ceH^6+h-ib1LLIs_T%mU
z(XO$@EJ<}km}gxEN2tFz!sQt30Wp5GrhGnyMj`TOKYe}B^M|^8v6i2{;3sbDyyM=O
zg!`f9zf!-Byx&y=uUw53rL9K^mz+j=c!GaO9DwTTrt_L!U~$ng8F$bmc~ej<v?JXn
z$}py=T6dUId1!KmjM|8eelo{Z=oF*k<Gd=OWQ}qEmJV`RhFy#^f=DOLc$4oZF#|r;
zUJEO{S~=2qdSBCbZNyT@N{qY3k991nIVH}>`ykM7a6FGl@|nGELX|MG>aouz$=E9S
zyh@`)3^U*Hk8!ZNbE0c%du&Y~cz^&;vk{x<F8V07d|o<$>1bDAfiD8w0v?{6ObFl$
za50njy=|2+B-I#bsx%ESu-$L4=)laeCMDkF6>uu@e2tHikL5g)Wyos~DE8`%cPUiH
zg*)N3@S;^VOz#47hheRtf!n|`|C?8=J%Lm*cW_v&vsCkOJ6CqIbBmES@5?S16yo{S
z3Mxu2=;=KuEWQqR$eWKr0FOB{RC3Rlj<2VS#~Y2Py(H_rY;_YtG#}fIDBh<em|s%l
z&{~D#lKqZKu@|=wE!%zUz3!m)TI<8da#8b;ynVUr*E7&MNOV#07s`VpC-{7^1pYOh
z>jdjkde3VxDx?nhkqBml-h#G+4rwoJMc#D|E^%7|UZ)Hv0{Lc;8QDsOtE?BFnO%qS
zK`Hb&^M)$<9P7Vu=;tm(o#Ahc9lo2FB1{Lw+yw4O*>OB2iP*ITid9Ozr@pu13Z(hy
zvT%!U6!x1kM->cDl#Ai1;cosZ;{7uu{OfTQFzKoRl7c!-rz-g>s>3kjaTplZe^>p-
zfTJ>}&eYUWe=<Y)u!n#DnvyE?`~3u!q?LDMZ$I4r#=DY(sJFw9a{&j9$qys~HJ^a?
zpH#zOdI#B1)9;|^sL(rWPQMcBhkK^|SdM^7<9NjtzjItsnv)_2wbM%k-abzC{G}Zs
z?F%;TDpXl{Al<%L;Iig=D>X&3q}FF4VvL$JSCv%a{=S$f7^j}b1yC9XqZ08_EHuUY
zoy(&z)3;W+Hx5<>JdDuy@2cB>Y!^O<OxYIyS_@e$#=~4CTIcN(A_F~x<)wUEi0t^Y
z;q4-s*2W6Eu4dmZ_AgnzsT<?yTg+u_An&>rJ9h(oau6W{IaK=n%Kn%-&-N(EmX;#6
zXQsS;(3Lzdr$*DFNu6gj<^(9hjxWAE#|9z%Fm!=*$ouQ}7Bqb{xmqw6HVnVO7yKMz
z_$t$|D$JZ_zQ_&Ce90rHOgd8@!9WuXq6#zka0!U7wrs90o0eqZ{h)D9F>BiMkvR2C
zxxNwusWnU>R7Un&x6SdCb;{8wv@K`-G9>8St5x%GnyoVUj<L31iO1NRc+c#px%ELu
z_<SA-w}0;bi65!!ds6j2=g@jFz*ep4%lQo;UAZuio$HH0q2-iU{g)%5eY?*g(a8eV
zWcp|Ln+h_6QWONVIg47Ra&CC>7F?&CTn{=_!}5;WMDm0rpM`%9j`-lhZ!aUXrCHTj
ziqT__s;CUJ6xvcmk$yUtPa^Mk5t=D^>`oj#;tGL3ae$6fZbD*<(!U5F-b;Yj+yDwn
z!RHEYHf?>IK@7#br%(Pf{<HiQbeS0>ZO5P80E3pADhZ&se_$mCucL>**93<C1W_aM
z-2fv^S6L;(rB)|4*poDVchLjdkv`aI-JALLZgKWeTb$iGdY-%3N!|Ks-mp04*9_k!
z9|grk3yGNLBBn{Y8nf#ztyo;vLfb)hH6BXzqpZ8b-SL|mgjbn$<Ee9V>(x@2I%SW0
z5Q57R?QOB`+67cRJo!b+>MjT#+$SyD`@q+()V$h2yn?S>DC_(#GV4<CRzHrb{BGzj
zOq6Ik92(-h?xPH_p{Np$Ers#0At3FAHu|%k`d4w7zNe^fbwAf;77*amH%p6Y&3l-$
zFb?u=PENNVJXfGwa{>MCheF2Q&)}{q=>)pWfcQqwUHA&43Ery%Y-nHqR1v|FF-DQh
zRuCa3q#zr%He#i%x#b?s3s+$d2r<v%tSrN4VY6=;sdmpSj5_!x;G-*7$0oPviK0wF
zJ+x}{Rwu^|`wknU)<$^0boN7T%eXvw*$oTV_V>&ztPOUaC<Uxcg)E4voke?JW>Gvy
ziJ_IzFCt2epBWw=%+|e!=uly0kK9*p8JDp8kgT^6KSVe-jmz~6_k&B&R(?ogZl2vB
zb!dzpdhbX~rUx@YyWGpMeSgDiiAc@+N-v}7MApAV9sgh)?W$%Ac7v5wB0xetT=dTv
z<Nv4Qe`U;~Ek=K~gQ-}`|4DA)S2+W|D(eM?Hguc|Zl#)6pm%r|oXJJz*OPzWaDEpa
ztsWS?O=SA5&h-Y!R&P4SRa?FRROg;5I|^R_=5r@ogm7;Lqz|?Gr>WCeR?D_TY^^FF
z(PF6#u6@00SGDvebXyLQc{OI1>LL#O_s=Iir6XY$qf)d+JuBjOUCb6)GD5pHpIe4S
zDDxU0=W-pxM{2JGKOWIeYT3v>w7%xd*PZEh5U{T(D>dQgA1x#mALEh{vtizuNqneS
zka!15;x*>kdD+Oi!VLY&od@j)SJ`KO8&@sK`r$pgm{nFLyh&7tWCs}IX<VL#nwl>p
zABUDr>NUx9^Hxxttl~^8rd{Ay|Fj^+=f6vH{84k-Tl!;~W`i#09th<N%~h?!uKg>8
zFV|Bpnaz--|77vsB3BYi-qh;6yT}#bI>He}<J%DGFg#g11Nrg@#|oum#OIbz3{My%
zXT=inMl{T_F#-1U2B@>h3IUC)rSRo40}`qpY8-WmT*ap=CMk-=Kt9!(@P5idB`AV+
zT_1MQ_m79pWJ}1n<8$283L<2$b<xcf$*Y6<-r`rce`u$tC*JC1@<PXqu&z}NkIH#T
zv=rX2XE0QE$$&_zu8C!~=rY@tO3<zu4^nysQ+pR!=5uQBCl&d>Eznd<T+j6zV4Dt<
zAaFY(WjY-Et_pzi6A@yyc;zDtOE(+)(nz8pF{7DiGy!)C8N)EtPRQ4BwLJJUaRy(B
zV22OxC%sM;@@No;1veJv9j4j&R{_i+EOQ@|-QAt?mcATuW$G>p*7QBO!`Y9NjK=-_
zWiTd?o-y$`DO=3q$gRMSv~;ZaADH8K3i5JJx626QRm8|A7JYbP3X+3*!gPm?J>R)e
z?0G>%^=v!%C@Ll`?ZoY3dOYzIBvb!rf%B?Twpe~qWK>$@O+pLmz*RDL#W;YH_s5Cx
z_v-nS*Kdl1x8k8Z`6}Vu#{(8e?f6mUDGxCiL;&MPGbG)hZuoHH520H-?6he~;xuUw
zhR7nkS9t@F03&@5AK_?r)Qqss5~v^74t6}yh?7JcInr+YT)pVAM8tzSgCS&c9%@%Q
z71k*+GJpoHaUZO4AIHhENT#}SPC-8XUj4zu)O7-XDa$k9@ky_clvBQp;>M?|XC(>M
zfMjO#TM^2Y%g<^;=c(A^wkN4<g4mWl84U+A2cawey|t4*3z8jZx7lG&BvQ`uGX^Sk
zbatk8;$Ih2?NcjHRT%knQzqO;Iv+q&5d-;C^H~tLQZ2!+^bXRmWY6F}gp_BX7$pSY
z*ZmwRJ49Ri4ymk+WjOgMo6_)>c1-vZeZ@fJj;a+rj0h8Nz6|*Vg?nWEKK^h&)Psr1
zPcnf%>rC6U$}M-hq9e7W%J-R?S(<X+Y>hnUr93M6T(Cek!Ink0aC~V}4;zMyt{`+Y
zB}+_6k3^ePsz|8!DyJ|w!!I%^N0fRFDmPY7Q2wUsh$My_1F?3gcw=xzSF7J@<$|Td
zHg#7_;fV5;FWQhdoy}dYc%7M^J1->@x<jO9YTsKCBZc=XY$ykYEMnZTG~u9RCbPk+
zlHhH_xsQ|>A1{oz@zO*AFQ|c2=*wC8{rgM9T^6BB3Iid%ed{Dr$azK&9+#CHZut=l
zxXU9Aw{|;Nx}Kgc%b?_IGxB?GGYHljE$!zP2*{4B9ZYcNyDdlC6B#(~BB#j8&$}S2
z?C`91!7}bVLy!wUtl_-@upy#WFQte_0mBiW&Qxqw8{)mOrt(5V#lenz>U+tzwg}g{
zy`m?O!c|&B>N>Qa`Mm4om(X6j82!Nh=Lw}BVYJBvm<iTW0_XL+8z5~AT=PF;&CEaX
zLP($;02!^__}p}82T4D?7PI=%Wgw^t8kHf1i;O`}I^<C{e_j&5xp#<kxlPkDbG9c4
zgMd$jvtjVBAnYht6M3vA{Bunn@kdVopUD3p-0s=3vOePbno2YNaWg*gGJ04FLLPUa
zR)Rl!9w|Jb#_zsU%vE$vc28C!^5aPK2*DQ}34f<t>RK)0=?a@OjBQUyY`(k6-VVQ2
zlSdCxQC^9n-;4QgBeps5g4&L0J_8E6?8l$}I3oY1A65kY@HBKBe8dSVb@_zXZ+3;Z
z5~000h@;@sL0FA60|k5c%+mj|O9dX9{Z)63OihiSWcSIuT9GSK^U3a1nTA8sH?*Td
zMg}BCVeAb%2&2Z6Pd>L0ozTGeaUkJ{Yj68DfA=B06Ftn<>J$HRBHRe>1Zu^UDu=BK
zGF+<PDP-^`=3KQEfu<Edve2S8i%IJaKcAon7^IGCj&`3n?P_^aUMflNevK@vCA_AM
z1Q8HX6Q=}Ng8nFIt9ov!Ne=9Ct4(8fh<<T^LCVzC+aA3-G7L*x=_X1-`}M-V+=1T2
zDbuv??wKT$_(n4Q!&*Sm6IbJ^xKDA?btkA<(df#PVq>i%nFr6dj1HnoOHgMyw|w2z
zG;A1>XK2aEpW=KfrqMmwoV2<2V}@=;+yIPimBOYhO4&GCQ%~btK?7a(dlBou=DJa3
z;2_02!>uF^I)3gHm_5F=%?S>CBQO5ZwGWt1*!qx)HS&`)!cXx05!3T;g3C%Z+GGye
zp(T6Sbcl!Wgtd_p_6EdYCPm(kMP5JGQc*H`CAbd0kV;Xbh!NAA7HRIag||P{GP@Nd
z{4SJJ4bwj5YjB>bzwo;xXR{)k=LgD!N9ZPUbWexr?~jYF-RGU<+=y3vleRsupn6a3
zJx$t&JMM}j@qYuW@ijf4^nLf8)_ICW;VXp*svyFy3}1l$CnOto1Lz&3VpXWH?u2l{
zeR)#OU_X*!zm>gN29=wtxcV>AC!upEpo0?rxdPOSDZ(d)h1aRgK?pbwLcpIZh&%Yt
zf7eh}Rdr_Zb<<S!RRk(rnbz}8f|O2-b>Z0Nq@><%&HeG%O-;v1t6?$5MAH@P7BvuD
z+n7U-uE+%=x>c&tUOBY5-{pX$g=i?a7h(&D5xpd=JCTSUms!vuk=pg&&QoQ$coEiM
znHBb}PTQK?>Q4ApuX=)fX(<G+oQ9t4;c;Q!%i3`!+<pn9?UjCoZC!GPg1Ma?RydS8
ze^7?(pdh@&$l!y7`=TAFFb-Z~j-&l!Xz=fa1-ZC4z`LY&m_yh_rB;F4tK=<>8ez+1
z8g;{qm!7qJUNXQd1&x%6HMlR~+!>f74TY{h04EhR1Tbp|@?#Pq=gXmKs($Cf)g5MS
z$#DaGo3kvB!P&uT*0IHiO3E&6Fa1)Gu}@pzaVp0m*-W3*#8FLo)+bB?Y^K-ys$X}k
zsA-!rI<$&f<!k6ZaAm<Cxr?!^AKGY1DYl>Zm?!N_L5|vwSR@z~xB;l*To%xa{8kr6
z%4(1qmK;ADfV`?#6hhJD>Bm^{k(p14JYT)<I(U0{;9iU#M{6&rlew#rB_mXZw7loP
z@D58c>qo>*x%LBzBa*Sw{ez14U4+$`_3tROUTvfCZn|!XkdCODo`MD{)&C3zQY?lk
zm*{%Xxg`-2$N%QzPQMy7)#AUl&+W7LT)2!zc;jAg&7;e4=Fp^v?T#<t1a>Fm-!*$t
zk{VlsKPzV<7zsPU(`qrd96c2=cG9a2%ar9)@11>)-W->UR^Kn_eOMn>JGQqw()|AP
zWfM~YwybA<;>ZV@O%C<wPMYQTQ5W@H8{!T?+8qX=xLjbNyA}5}*yt=%9FtX~_z~?M
zN8MSm@^Ip9j)@51F!n+%y4Zcwrh(QWuhrNAyV&Wj59!C}cN6swHnd%v7Aazo&KY)m
z&@!2gi$ZOM7Y%-yDXhPBsmD3~ziKGm3Z{^fev1_%uRtzo;K>!3$|or|H6)KH39jc%
ztgp8=5nBEGIP!-#?`#?ozRJoon>$1WiJ_t=g}r|;uy_dWKf|csqJ^QqK$9B)#3tSh
zVrS_$Kna+k-yR)sE^?=Obie<)<%fAKeBYh3T}YEG4yw;TLEcqFfA2l-J6H;WD8E9x
zNSIb5)O`FopRUkp^|8Oog2-|Dv*AeP5uu*l4jzK8E44ytp|0rV*D$xoCx!P&p08W&
zsm{z9`9FOq$hbC1$6V8Oanftx3U76syYt@BS-+G8Bj@!a2d*~P<?uLMQF#wF)3V?V
z#<wf>QFQa}fp1RUWhE8t(y+G4NA?fZlN`z2zQf&tp`U7+TP(>z_0U8=?{S1((1D%2
zLhh$MeMY{av%o>gf}&5+K1u_AV==XT1HVF&^h!K=RP0D&D;Jhef-M+KO_q++O9I%w
zAO%{sExgu;b2YCbh!)i(e0;@vROk-m!eYV2Dr5_tLk!!l$GJH219J=3LI2M2S~+6P
zFV-=$FCJ1z^^LY!R{cd*@0C^c4b05^MOR<+{_A9IMeP+$;oD4sdlTdQ(iq5hY{lFw
zL3IIvt8(6B2StheS)F!Mv!jj)W#UUPRC`orL0G0O>2)ygjw4;2V;M{0A51W0OHIk%
zKP#BeSn^H&)V<pwn>gsSN?`)>i@aX*2B`U+)LtRvT%kzofD=UEe<b04!fm6!X^Zkj
z2tZBgpT0o%YpR$rQST7H7M!OFH^8I(Xj#?^%xN$jVgSRn0hF$vBiuhLuL@{q4ov||
zYshew;bC2FFJe)OMgP?J&w&vF{OaCP6g64fkUq&`=@HiB8TN2%L!gGnO2qR0fpsxz
zt|@s@%Byc{*h6;+vs@{Y96e349bz|?Z9Iry^epe%gCBEbqf5BT`%}{X-IS}%M#85D
z*h$!tRyHoyom`T*p#!4LTk%5WN;RI+VTRG_6D61#kpl?2`Pun&Db~Sk-6X!kn8pd3
zvs#%wxJ7L%QraXns1V}b-dXYEjkZKL!x9BCd^(>$#=L)0{})ifn(FZ9;%k3%Rj0jc
z|B5{@ANN26--%fWzpgU;R(M71{m<=?$cm$O_w>bl2kZz9nz*w0J41Kb&&S%b;Z@(@
zpC#bFBQWV!ZY*Nv=_T9wOOhHXaj9~~L3_U-fuic`2jCZexdF5jE>)dY!##}IrS97!
zEJPWR4DUyAWL3w6jJR2KDhfh|3VFK{$^`@j`NYd)$O2m_FG%HJcAB00)t6JnXKEMm
zW9Oi`p$1n}(Q^$iJaM-oUkLkT148m@BPKHwNt0oGoy|R(`XnM+Nk-|CbqR~=99PR0
z-TTATb%CnpBVi|Z?=}juw=yS3yLmirCu89pjk85@S4}dh;!)7benxaT9v&Q}6ES_l
zu`a_i+a{ZoVG(XVc2HHw^eP8IfrQNNIA8C3d@Kw#>lZ-*ezBNsa%ng$E*Cmr@s}j`
zsYxa%Maca{ieL%8AVT@m<#<pN3%z5KU-Sm5jd%z@-zYkCa+l31ci)prZokl-0kJ5>
zkRZvd>VQBW1AOD9R8T5k`45^zJ2;3|)GSZ9C)CK7peN2vN?Hp|L802F`x@=wblFM~
zGy!Qw1QYyC63T0zLg?1VV%B1Xfg51?wk3SNh{@(_m>lzYTsoNhN%TPYc`p5%SnAi+
z`2$RicD2VGx^gGHT_}&RHwcbE2khY$2&F%`3Nz444A9A4T~<JUD<b4dg=<%p7FZ5^
z{M?#_TW_o1@<_D4x`cXDOfgd705T;Z9Hl5uTEzr)^x8h!^fJB9L8|Vh6X(>9pWPbQ
zB^jkl=Ctv|{V>J!Gy=GgXyR77(rSs>z=XwR-L~&&?_PdJE-v>Oi}I^Czy5rpQhq<v
zUV{=6e;4h?9leG`1_;7SH2X*0U~WWB4K*`|h?-s|x>F%$noz*q8KgW~@nd1>Q1BI?
zIN`m`!QYAlsG0wLX9k=|4~3WU>0vNUAi(C{#@N}OIiyT7@~xI_GjbN}JA9Y_a%8E6
zM4|oim3}l60`EMSw|^%bUf?pwRO$I-e)fCst;1X<tYD7tiute?UX?H9&?kC&4&4f=
z*<Mc7c3>mi0PX!C-=7I@OzY0&twA&n1(bLC<a#72Zh(i^c|D4*?oU!^OK`j!oM@IP
zGv({{cOxxx3F_j-JbWtHZ5np<gg;r-OqzsQ@qN~+4Dp^;mu9b~77h?e#aM+mSJ%f(
zx;_X=4>4luY{O{2wwG9a_}M1FE^+c0&A(5y{XDEMb%g6S$E9f_Ar^VJbipthnm?m6
zOi1*F-t7&e$E2xUEonvjwz6L(#u;t{<}B5j6WX4EuKo)6U#PJHW`ZftF@#2Kw+N_E
z5_TT0lz;q&o#69@GRbtt)naT1aG-k~j-fvtJ*h?+N%FiO^SiG3pay&N%ivlBEn+5n
zxit|IP1Q_-eDl+{Pf@1TRw<(0bIc#VdaUxX%Fnr3>LOG|@2^-N@#l!>@09;(l$zx6
z8%hl^)&0Q%{Q^^gy4cGpoXZQ!ODvUr-aL}uY6nB!h<Wbb<~$6`3}_n~?nRk`iTk29
zBvMRMZ?UhGQHTZL+~E$3`P~M!1>vI^t|K%lkGgC<99j_!BM(vnxpD5e&UID1eRCM=
zSRkZQ)bw@sR>l5gthl)~jXaI>x|eUE#3H&^=V{x!I8AXe_W6Bm4(Q{T=XITtt^sSN
z^3FJQc7Eg8+=EOqQld(q->wAQO|*ENq%rVDVNm4y;pkK8QT<V?*XvJnZYk#n-;t=)
zD{{#B)r<exo-t`P#nKB;`)e7>M)IhAu#!xne7uat$Guc@TyNbm+Ro;F2T3mS2k#Ka
zsMLJXENtE_B+Cd9GcUNsW4(!LOL2>$u+wfFw!GUjep+=lP*6=%fW)ZdO8gS1`+Ql&
zL&}AEVt6~W7>*00hkH_A=Z2)2btnr~Fsjd+2FEWK7GBFZ*l*bhZqxLn$;V+5Lielo
z<U}BPIswZvnVoiK<M%|}gNv=-YzI5_$!Q8^)CZPke<y|Rhi*WR)+kpr<war+m=to9
z6}-_b+!J$z(qb|@8^0^OF)YLUV`k~!v8+<@EQn($p|u7si<VOi#>@_67Q{TsJTd)8
zlu0%O`2N}J3L35nileclMT4k<?BhpYhgL;w6r^etz#H*ULwu9O*hothN|bU^QMd6@
zU&j3Xuq*#QXgv}sPrBq*qb>3}!THH6ycLzw%Qy<y&ocOqZ5sQonp2^2sHBqx=NH3!
z<JXplj@NL*s{3$}5HszGs_fl_mJSP{gb~#TAKdOhm9&c|jo~LY(r@x0=`o)fxil3Y
z8CMR|N~T{a=ie1N6(zdplUh5<Su7hiNR*C^rO>b8M7tm9`=#n+qYWa|MY?s-Q156W
z*vCt$*_g9F8Iv3Y(mnEFA5*U?W+{fs&7y;41-e+;)jw00V1@L9rh7m@CfhA2KwPn%
z7}Dyt_M>%94?fyZ8NP)~^dokqwyzmcih^#k3-OwvI42nJ^<2ou9q>{8LqF?5{0D+n
zrS=a%%A56Pvh=5bN|XDi)h>^?skik?cxxHD&aBoh{V5k(2qx=`!$AaIsYlL$Sh$;D
znZux!qpG6xfyj|tR}f7m$bm!i84W#u)!C1?EZHj{NMv?ct}T))E&6sfiQov{0H8?V
zx_NQv0hq^WxTkq6kD|paH2Ib1xmgUi2}oGTX#NAC_K!vSgj0O*xfnn<_{;9sWaZC$
z{GU`FKfigT2~_?ZN&K-a!|EeF19@*lB#~|D67#654KH%pY1zl;OE!@-6eCHxG~3$5
zeD?gkVTJQXL^f%B*~-`+sDFu>lDHC3sj412dEIN^b|<{H%>xDzvbnv5oWkgee!BSC
zhFFeG$z!VH^~PoZ_sMW##UbT6{-Yfi;iFl(tId3=g&8-ktUV|9U{|OvJxmK!rh&Lq
zy{|_bF7CTYXa}2mhqk1eHg5B>O`G@FK*P?}LDvRUNVsi1nfvCRO1*QhnXrkNyOKo1
zA2!mKVPhUYIotKX5%Pe{on&Gfk`O8bd4ej%g47?{P8TaVuBAFg^Gxvr%`<QJ$naiI
z*}KUP6dSENol-N>J!K<;(4-*_^1tHAKkN|;QV#F=!E2?ihYD3lJ9gpY$fsRlr5YOA
zOMLBo*AE3|<lvtAVDOm@YA6#9!mgnbU|21jTlAzZ1&{liF6$)KGa(5CEf)vvN_SpX
z|70HHgO=^%+Lb{oc>yX*=WjN_2C+ivjoS4G%=Ncp?BZqumA)2_rI#i{-t+cY6QKZC
zWU5^E(NX|_&Sp)+gZm**uV=w0e4@r%o+51ZCZ6>vs}ID1yzYU~LaEW+PE}+84PV2Z
zWV7)4UgT}~ewg+f_=@lhKCRtl$aqlt2s6P@AJR*mr)5=IHm}#R7j)1Q6x*-eK`a23
zJ6DVFSh-{jOaPO_{RNa~$2WjKg>^QFmP?>>!*DzVub@w>o6w^zG#E^HLE`7j0KK#v
zx4M+;%fEb)!f%&}5U%I_{3SnKC6Dqyp)sul*t3+~`21fpI-#bcx`bj?KF<*mI3mM_
z3N^G~F<nHQDa?qg-c0`mrUt<*?c*WiLzDXqn=$}Dmq`iBYmIEJE_u$*&`dOZ7uj*9
zN-9-iA-hp6Kh=$1NQF_pXg!_zpv)~na|d~g9|`BbA-MmUV?S#q{t4|^h%V=1*afjo
z(^mE|{&p`|gZ^6k?yHvLR-3Xvo*Pxv@m-wJQ?ymDdc5+vKC;>{z)#RCW}Y!O_spoO
zGC~;*CCUYyd<*2G&HWQ}*ZG5y8E^>23l-&J(wN~k&Ba?-CD2(B%O}IFlP#qLZsUCI
zm!;aRz0tktRyDqoVOP(C>a(aNeYsHLQUL6=pg{3RH7SDpG1=a7w`-}qCanmeAQYtp
z#m1T&K+A#JgCG}L>co0+6nU7lGPJj#IHcK;$G?*slvY)$=rlRD@<fV{o~}+01=^u#
zbGZopSY+`_MHc#_lG{=|!@eLKT;x)rAm&Ct_@9kBna%qzmgmiz`tYpUyP$f%&|POY
z!6wIoH%V&hP8&9Vd@g-Jg<1cekka^SBz_~~ZhRS^<$|F`Rv*FG=3<}Bey!59Ggp~T
z|9!ipPZOm`BcpSKSqWKRFgMBqYFLlFr%J#ckt{b=ST{<*j?_-7Jto>WaVv{@L$ac7
zA?YM1WSBjwy3<3aY9gX__HnHVKNBZ_E7Lffnh6d3T^g>um&Uw@WgGgRWThp?{6*h!
zPGCmeQe<duWp*I{o5bE9UC5u+HO89`34UQQ%*K9VF|dB`Ss4TV%2$lOc1%SPghU*K
zrVV_JQHZ#e!bxedv1@Hu>9ZRB<7ErWK5m$_pq%_snj)^68GWOpLGF<(44ceJSK3)l
z)mU+AHo<bHq`Pd9jTEU+Yq;Y3312(|=B`4@$8pNVn(X0*=S;>`T|o`Gr^PShL!_?w
zlgXk!QJN3z1T^Npdju<bap`=WU$TE%=Oo!<?@cFLvny!X#U=AZYh7C!!R+7&`{cXp
zbC=VJc9}r#&Y*8??Cut!4HR@<gOK%pv9u44nZ*oeU;hpY`5j6L_K}oCq8TSGbS-)o
zSGaA9m`IGncd0U*%@{h!QK*TR?nWLXQOIK1lYT&vOO^m1>D`_V+U8>R<W}#o2V${C
zJw02^m2e(gY`2B-Bx%?e64#3%W#apc{TvPaDF15_0V2sk3Ldnh8>Gv1gj0)6EPk#Q
zP2(KkJmQ3tobcNOHXR})!0RcOA#`W$YGd)yEr{qE)X`B+oxoW2x48=de6c_$>=3`%
zQuvVMGsq9^U2krD<t(J7CW)q(!$Bi(H;K%hI4^2@7BS<(dRKgUNwC!cD-&vXo`waI
z5z5xMOJLqSToq0}DV<_jYiu0in->AfH8jUeL-mN%^VsMfg=mq7Zu;*kM^TsB!&Vsj
zEVUB6sG4eqUm3<sAg+8(3_kFCF;GdGBt0hH5NJK@J<-f9RGrHbYZ58&MEmnJCFt2S
z^UO6{Ki8E_R?txq(jbkfJ(l}EJI9&Z>0#;cI#jNOYTA<1GsU`(vpUOTEX=oQ`Jph(
zPPj(}=Z^WiEDH+lXCG%=SmdaR&p{0&nD-sOcirkDlN~r*x;iBDvU2wq(-2tq$4B#P
z{Q)m=4#DY6;{AAz)*yr$Q`=3UN`CvSn)-fBy~ZgS8{2R{JLYy|zgX<YS0R2!sn`W<
z@Ii+g-~~v$b&VchG0S=$>0F58R(cz>dqI)ZpD)blT}i86>EgAq6MnQS?_n+%`bgBv
zqldo9VRK}y5F8j>+W{NvYwTF`<_h#HNP2tq%s+4_Pu<m|Yk&G-Qgth5n@F1ovbWrd
z>cYSYx)THKk>3~6&!Zf;6@(o^=eq0~%;}qSr-z3_N;EEyGEMyWT{U=@o!hntP`l1K
zMnzkD(l>%;$_@+XpL2QkA~GhsZM0d2g^7%l5K@{8Sy;*IJ`L0_c!ayrf6;2Lw@x^0
z5#naU_{l|aj-9AE7-=u0fE_*xIMI3|#~a;iw<C(6yA_!Ju!Fl(dtGy2m@D7XGLu7#
zF>YoeVkeqD#g@p6yMEyc!?BkFODZUi8jaT7DfPDWKL{ND24M6x{wlSEh?f_GiqyYo
zG2$-=W}bZ_Yo}r}vgPzs5z8t-6|OJ@BR;B1GcJU-^Yoq5Q_RSjf?R5S|6pdjlMP*}
z604`r9fM88_@mSkrSLw~O5uhFnh+H~N2BdD{MKX0YVH*%Hs61N0rFbfTR!LSK?XHx
z?ke{>zj5F6`ppWsSe(AR2E*O(zCG9oTxIah4dCGw015}E$8+_*&N;8ak#qzLN2*+~
zxR_K%#@QF_4ng+4*)qGjDrVC-2+#DTUGs+4qE*kX{ov|wtiy=oRk(}ct)=r3l4=#M
zDVs9&r)Xz*nALhhJDxbX{ue5s)yk0nId=I&86mEyZ){Sq=iN7yX6{vT_wn2<f~=$G
z$@rUHb|=NmPDb_xY|ZmQ$F`~~p8cd8O&r^_dV@tIQ>xWY!fgm=_)jX1u^u&yE?{Dh
zSoL@UMR`@rF1%)0o8mM5a^wuDj(_*J^Zum-g?KUXfy8xi_1wwuCFZH2F85+IbxZYk
zq6-kn74?ATi=R`kPB&Y0{sy>XKB*f?L+J3z;h{d891*@#B`X@&4nK_*_1%__ot@lk
z%4$X>rS|rp*OJIyrK6BCW1lG=%rx+{-KImtW+M+kgrPWGG7rKB0(KWVspk1h*J|iW
z@}<AQL~j81LW2eLin?%t7i%<gPX~)Dld$C9h}p5MpxxI$$+0>~!jgXXxh<pIX|f@u
zttK9VlP5m*Iq+$_^jTRgRCOdprIE8_lHFfVRC5*+oRuKtI%&B9*tJI;XED*PWbM%?
zR5{OsoEFo?T5$s+lOOQ7M9Du^&{a789dG;x*NkESk_VtdsR(l23!2$(#X5pA^T4x#
zSc916PDM~6<MZ2jjZ|#x=X&^3v=y(6*!-VTL-dy=3%6hc-{yi$VsYMTAY&fBx_W+b
zxNN%D9)2lxF%H$JV}p&(!8}2`|0y2$I{fK?$>Dp#80*y#oyvlp{~F&(pHO3d5nhEn
zLeRguM1S1(C(9K4@ka&(Hg=Vj(yEj=eF>oqmH7UqQT>t_-j%zYooA}t({|G^zE5U!
zk<;-IQcDxoTj+tK;*i#BtL&LgU4dHPzM0hzZx$qE`NzQs^s8D{7{sHKr0a{J=@X=T
z8#}574a3fbtLsag$>cT6p^$W(x6#D4g?+DN@l}HYI##do=To+|%xOk=o^wrf89rdw
ziQ-W`y#Y22p7o!JGa}?~oP){!n!50_ywS#<M+zAF;kulIv7ZVyRidT%q;}1v-#ly;
zhrASFe=dd}2d0;P)_958u~k>byyT#Ma(;Ph0J%c-cAlk6Ri^_i{r|Lg-BC?t`#J~$
z0%9X5B1Hiy5l|`8Ly;1Y-h1yb^dcYu1reloLKEqPBA6J8$RLAsgH-9#iGcJT;yup1
z>)^Z3nKkdOS@*rQ{O|0ub5>UN+55MD-}n3W7n&>T)pE~>QH&Xg^d*Cd!{fc5K|}*V
zf*hsrN=NwSc~v}_fkbl|K<pbsR~hVxEh1VDXo2%$Ql3D(@X9^<2xpBz!Zx=H;Xdv&
zC}>d+u{BVce@zz6#CI3!eZ3lAl0zoUkt>1*3)S#FW4$=<1*eiNQt18pHK(eHkN^<L
zUdxvNu(4NHeKOOzV#<!kl&?^juv#7_mk)lM_NJ1?jd!Sx?#%AZ&FWM9iuJ8?wNVh*
z1H~{amTQ3<Sp}#QMDD8KrbQFBnp;cBnl#}OMln<T3CKqQ7%sJ(ke%h?(V5=huDjWI
zR=*1Tp@7f+9jrteNtNKd6-l;11d2`hY8Qt^uKqAby)2Cm`!~Vth!Kkc`gg|9?pH0@
z_tJJ!NY)^p+p&zp<Df3MN0uQF-Q9DhS<7nb)1wR)few~7mzU>|24^iJjo2;e=GRO0
zQ3tKmZ0IzJBFFyn0A)wVqWZ+Rwz+F<w33U}wos|@a53dv^mFBgE{Y4WMX>3L4e;P4
z&w+)F`D7_PPfKi)^+)pkfv7ONKOigZ`Oxo4f6!1RJJSK}S|{Jw@$09&XDJtLSX|CM
zFwQ2+;&+UEblQjM6QXyKAO|0E*^3rqxizK{c)wJp(B!RT#DEU=K&ZU=rF`z~c(5b`
z<;nExDg#_@i{1SVyD-$FpT~quQ@kl+-Ku#BA(BPDgYUqX&|bCz)|2!@t+$Swt4tS{
zw<z_LZPvkgz%%QeehDyZ<ok(HB^Q_L_D?B{MT7iwqCB+9MA9=+u6?)w4uGU;UHF$B
z^~f@ZoZ35a>(I?~&Y??(Y5gn!ry4r@5g^DdKtHDK1E{P#;0rb=<TuTrF9vacT8jQ2
ziT&k1L}cgdQHqPd2M!Kmxi4vYk*WRl300ad*2*?UNxKny<}I>y<fa-ag|9~Qoj^+^
zu9nP*mDnfqVuAcIlaJ+4=t^GB7eQxGl^v&~;S>{qTSns~<g$cPyH>Q+PkB_QT6JEe
z6v*TaQ`%9|j2g}f&-8b`s|NI%Fa)0@<<VHI?FHRC4p`oh0qauPpakGe?pHt;AAANa
zTn(ZJVtwn?UP5)nIx<NW1_XcQLSWoxb$@r2D2KiQ0?Tq>K^?_Eo&20`t*LiJ5-5d+
zvwA)%i5AU2nv9)aR8u#pgCY6m`w%|z_NBYg!u+WNLk)L@<{7kn%6THVI5naKtQ-wq
zmejTWrXK*L$%8jcOpo{=&Aq{MEOi84wFfGg^Ng)W<I<lmtE-brdJ{Gg2fB4iu_i+C
z;*YaPeXIzHM3r%JvbLW==JpdCpP+p5+q9Vg$27gcPn7fbcYr#g&c2zmMJRytJmSX=
z;A>Zq?4hXEUW>+H>>A?-;(dym!_Y!Fwi@5X^xn@0e-P8zO?+)r2|^e7OuA&(JljGF
zS_C-p$Zd9{BU2eqFMw4jZRsZBHuqu}w~7zLetT3OU4^NVGxQBHk5&;yfZ8Nzdi8fu
zbY?Izw+|WfpFz_6)056Zm6l|0WsZ$R-xY?Yfd*!2h%(J{hjHa^hA%UIAZkGa?p^<C
zdvruo`2|KCSxlwS8P<udW_TKsAEfhB6rp5=@M;d2VO{p$v_QbCJi593_3Ljq^z`2<
zW{d2Amh-DDS_&sCkV@3n4D!fg8#Gnb#$cH5OtS)bPWRF<`ap2nhX+1h>@^g*-`_zy
zN*sF%trq2@@MQC9y#c@Fg{$vASUA4*Vo2+;BXA{;R+;j(rtTS5ml?t@3@P!nomFTQ
zyD_61*Hn%=U)AK194Sl`rrzZu%cXoFUXUs*2khl~qkclee)=Pu)wcLUP7S^OcMl*`
z_eJ}X+I?^0X3+>Ti`&jgSTjc?cvj_7yqkEt09b)@2Z&xz`o07Wu5thvG9$73K#sV7
z0;#R52`obG`9oLuAxSr}XZ9Y+Fnkb9&~`7zLDx?JIwK&TDw+NIrob(}6NknXeS?;I
z5?9{Y_79w)ELma~1@;Q{qIBUkwM3jyi^toA@@&HC^ohNd^Rx2!%eNXf#(CT8c}sgf
z`DSaC;R|ob0vq&d$T+a0`ZjPuCr<#_Bx@~D>z+-D>wdn=tZ>BE$y0!$yx|kYY{MkQ
zZ@t=sxB;xaITf{(mC;#93Rs6vDJgT8LV&Za267(wWmDpkK$7&;oaPVInz=$iiM2v}
zhIaa9D{@O9ll{^1xlroeO)ypyteD-*EO^pwn7j`g<&{{Ii5R$EM=CO(gs&;1U6Zz*
z#R%>9aZYhe$Bj8(Ux{iFcQabyYl2^A5C>z~BUqq*V`1I>)i0%NIYE`u@Rtw;%LU~j
zg_90k9JbL`WAw;VY7Rz&2JsFH0Bch4N7?Kj^&QQ0^-G!v(#inR0zmU~K-j-9@e!~D
zSp4L2NHvgjwAD?T^jC<||LL>V4w2o)`eRPE(O1n5<P=D}S|$xpYNUFDOLYJM*_i~g
zq?7}{7D75u@CXBZEq=Av#FWBu4Trn%)!grQmBW9jUG>$Vl#lZ{Tvsb@nKn+t89}4W
z%)Ll<_Y{}$j!q&fPis0N6O-86-3t>E+R8g#3$At*zU`4Km04B5I!rsh0I=nQa_9sh
zX)L0LEa5(^zi;iNYLvzTb(SMs<Rd@R9<eN811>VV1>K`C1~vj4f>-YXbe;6^;T*y1
zV?TjLRRa2pt>YxO9K`SiCf2M|Zjg{PaZKE?g<>34`IsT=t~ti1%+a1{H4XTkniu-`
zFqX~}3FmPpq&%D|3;UN|{iL<D&zLC-fM)>A45|W0(M-Si4uu0tC>y8~HtY^^jytLA
z0cNexEg+FyN%^9uo`Np|>v4h?uso{#X5$2;XTLw$r%PKqHX}E#Upf^bg&r2L7*RE{
z>L!g&0G4vPDv)iomutC7zgT63?Wjw~yw3YZLO|8!sFtGgaA<1epd&FH<9Dvh%GeiO
zil!?YABCO8&YmDP*NmPgLoB!~ac@C%Uerd4Dfj7E>?$c3dW9Hf26tqqela}s9|*ds
z*;34(&)i#($RB*gOo3X-`J>!%lUHj_I#o^){qrM?dkUi7phi`7tU(>wLsZ9IgkIU}
z_{PeFASo;{M!;qs_PoxbSDG$Otm>YwaLc^pdF=;J%)29ddbmQ>a-UqFLH*0okMC~7
zZ8)v6Epi@f#Dy7Bg>=UXR|g!<1X@0ZwVp~Ja?ZCKh4rh5QVd6(*RIY@KWF+rpQW^)
zo2O?EW~JlF8rzfwIjby9-bUsfm}ua;Pq^^fNaoV+N;d*P4=1t`+@U?2ISGA1Cw+a(
zFCjUFrP5mH6^)&28FVDxq1m^AlZJeI1F8KlS$Me}a7*XFVjjCHvZJvzOfn|^lcO5e
zrMIDJ7pAoz*Iq}SHkNg5v>esj9x<@kXu7_hEQ_t3%MjDHCBysS+F#8dL+3Z8hC}a$
zPuaKJy(q$vG^)8*Q7cs0p0)J?vs%A0q~4@J^PFh7+7Syj9nHBtLe8=)(jP-wdC$bg
z0(K)KVGF#e7f>^4H&p*9T9B_Ohq(S}1Sdn|(TwabT>qzH%h7nF-skyV0OCQl823K<
zX@$D9vuKVYmtyDC>?&;hj;@T0S%;wrPwc*IUL}9<4#N;JxJqC4#*iYT-#}HFFa(w=
ze^TWX0-`xrrkbg<0PocycrA>dUd``c37blmyKbFMvDikpXo!F|Ez*n286Lbiukk!t
z)_lEOHQ&3aBmyve@CHwWw`@pBXUkxltOpX3G_!lexT&*+vh=B{V(MCs)iQIs$=<EX
zC|F_XD^%g{e|kTHqnQ7X0K#|skhcHjsEO2xQG8>pA*xhYogd+{l}1&h$CT*S401xO
z!OsCnbKAXNIqUMd>6UH5;l|z>bPYQwOpCn&WAFhl!<=GL7biuO&B8+V<O`3@lrv`o
zZ!#&c29Nrhz8>~2%cVrdv8TO^rf1+>&hxzuFvpYnG|S929|kR(8(~OBzs9a+#YN4K
zGEt`8ZM?GAtw5stdI4i18_bbG_y@ZKv?(?n{tTI~lUzhCW8NTsk+w(OS?y=;xhJP?
zjNS>`G?uu`-K0>Y!dJajl(YINu2>Rl?Yei#>e7dU0SNfyat@}?f!z_A;pLe{2_zh)
z4O^`M<D*v_8j0|l9#N2jjQW6cCOdXf9gowCljUwdif1uyDO%PxF4k~9_waF)XBv)1
zmpj*YyhD#K5mOyy&g>qNkZs<BZooK0>!62w4(qBpUp$tUM^rxnvW!53n6FpAdM|x#
z{oVIVK1y79IH6jdMLuV58I`8})a(Q?3qMhvtn0o{RC)T++Bohl8$vp-kO(x?2T0x|
z0`F%#PiHUFakIQY*>(2HMa?mG&Rhy4hCTxR3nF5+0kcwuHhjc$B|<@Cap|KbbMVYw
zT}%ZXlR*cgVEwBzUA8vGC*J2Ns4S)Ft1g5Pt^|n=Lo#~BG{K|R`Jvs><e=wXEUZL7
zPobdy94ZiCmGrgo_2O^1Tl3|`fKXpkcY$<UZ(iQKq$^35<Rx^2KdHc`H_N#GZk+rL
zh8724yRfp(pk|6jtzFM-QY`sJVeb<B%NZZx5+<`jnl|o+VG_l34LYkfr=U~fH8Z*%
z!E(nz?ie4DsR@*zLqJ|Ato;F&u2FoyU%P%yRIK9}VOi^5^IJFkhH;vtikqaQs2YiP
z8O!jSUY;R}sHX0|zW;sEnh2+VvWP9J{}&Hg9tI4Oi<T@%^d7_{wrKMSHJ8izg@M|G
zk@}D>_eKw{rex?qb;aq{=Z=H!Jkrl+tjvH?wRHQ~PZvK(F=dRNA8Erowu%9%A`9Ej
zp(o*foh#EXfnjL~_({Lam0;+M0n^qyWY?DJ9>o}tzSt6M>REn<uX6*esq)2|5iIe?
z6p@g1r1Y5?8xo9#15PWFt0T1?&8d}hoW^+9-(M`-9_7t_7SxeFS&UBA;H4b_|IE|c
z6=O8;FvZq<l0jg2ZZcqi&Rbmd8MsTPIMeW#8^#%-d_h6mYQ9BES?(F$T&nSjoNbF9
zn8DI34OM#i8NfltQ3nPV)v!Cy)0f;S!<piJyjrAG))+$eqqAa1f{cX3GTgKRM01UC
z32g$M5k<Q6GCGvI{`lxZyi3@edu`JgthjwJyh<Z*<;k+aI292Z7CduTelH@d*(Z6&
zFa8m^3%B=k>bZhd^EXJ|Lw9JWuG5IG|ND(%q{XuTNAH1co$VeN>-DGn*#RZf0v4%N
zkQ-`JEJawwdw0K6_ZpPCl4M3ME(O?CoTgWJp3TjdF>jYg>v}9t_5!3k^pdu{SC<5X
zq#n$bb|zNPY)hQf&qGII%*mBxEne#xQ5dt&6S8zq?mCBgVcf(8g4R1*ip?kxfGxG@
z0_5|X>=}ATE$CS7-o1{eBpsG#T6WX9I&h5{b9c5j-17F#8`p%?`?`;(eux&lR`et*
zk4g)jW?g|p1bH}nMi;pn3emM)!1i72A!FeOq5d1z{%6?^oSq9WsRPtuH4U452J*rB
z2+q!1R&ea-#6BHhad(9E`tGLoANb7a!ARe9f}H5eKJM_izc9|kd<si#T8<Q0I>X=H
z?sGPm4WPbFs2v0Z#PDx23SovhSVM>X&<qLf`o6dV540-y#u{}+?=oP?r;X4mz8p;A
zMH*kPYD-oY1J){L;Ayk1MojK>L0ZR4Jq#{-pj?qTmy@c<m-V#^frOuNBD`R#%t9;k
zlM~$80lKlnJFnhRJaH$KwKgtsdrX_7v_3=h;(`9F979IN=kfbfQ{$p(&O=XGI%A4v
zbhO-HkdP?4_uIq*!@j!m)m1*V)y9z>XsxYg%W#C&@U6z)gp$0t^I<Pp{PSSmHvNUM
zcYa24Hm(c`)E%Zk4@o`&Xd=hJQ#bJ*QQGe}<hPAJgEr3rukuysuYVpf<N@#{Dl3G2
z8n`vEMM{Y_94zQ$()|6;RQ&cmt;V|?#ttriJMpN}1)m%9MEa`J8?OFl+E;h)0ap1b
z8c7-)7taJA&c*@6U~Afb8Bq2i6J-k1_k`RN&L?U1#<1Q0aF%_;m8{UAvoC;Zu&a6U
z_JOF(GhU{f)s}m&;1tVtPpEmI#Hm)g5eu9rWAkq|_-VL9mn#S&kerKJyG(00YZ*uW
z!-MhXgC3@saUY8M1Yl}AZ6v+Wl5@zJc{|pbjCfVn?0|m6?;OWbzT^MGbwMooe7?xj
zS{;9Vb%~A3#ETK2w=cUlk*fy&zUhZKjrc`c7Z8r`WOv6kvwcBX9T7ncX||&yRS02H
zd;3K<ebh+3Z<j1}=9Hry_;Os;gV37+d2Z{69$604I&MR$Z$pLg3NVRFZ=n4X82kxY
zC6^B_Y+?-<PGRg=0jzKr>A^c}N_rEVtP(Z{98#PvsBpMwz2Q*7hN5cOkuYvdpqGx<
zvmABX9mv*4j$%J*`5*JW%1Aj@vrnXJwwj!p%3W)UbTe8X+AULR)$WWuMl`=k#|||C
zl;*2LyUFBZmtlhR4+Hq|McgcI%k6F&i(39wxuH*Agby3OH!z5lp<wUUes;siI<p~M
zV#JBvW}Q}NJOG;-S$+b4i(;uov8(RWPfwE{8E`y}ef?)jn*YcB#K#hddjP$+a&AxL
zDMbSgBEc9%!5FDuCB8VNf0Lg5cj?_9&;NBw{KuI67_%R9;Kv;JF$aFkfgf|=#~k=E
M2maPMK=gU&ADA}FXaE2J

diff --git a/systems_design/images/horizontal-scaling.jpg b/systems_design/images/horizontal-scaling.jpg
index 9462401803c55c1f4bdd2625a20f9da55d534c2a..8957110098cc1464371792f8a6dc22e4c7bd0f52 100644
GIT binary patch
literal 52792
zcmeFZS6EY7*f6>Q0TBUbR8Xpp3Q8ZPcXTXBvjS2CMye19HIx8R+9(Pty`v~as<ecT
zFp7Y5q$EJ-0U-&!1;|+mI^Q@m-}C(c)j1c33oeqq*Lr(@^XQu1WsZHk`ydG7(7N*5
z4G3Zxfgq-hy)57pLiUU!1fd|U-!yM|VdsW?pNRMQ39Y+&KGf})4W=G#yd(bXUL#he
zaNL4v?rTIF<N4Lv2h@Q&hTid~mW_|^Sv10Xxvk7BWvhy;Mb1{gyj0|<;XkOIaQ_bS
z>x)-jA6}lmap+Wwn3y0oT<7sG7q!Q(9MTPYB~%pkdaXB0dre38Ho^np(U-0+G&15^
zku&>6HFH+pyjM|+5dio9|NR#QG+s*E2Zj@uyt*o^yz&Ih9nu|O0gL^;rDd_cRXL5U
z^mhv1op)6oIpbh|EQ;kqU<{cmKF*9)YTK||T)+E%{P<6G4D`p`uU=_mQQPo*k;D<~
zX;MWkE;)r#PRga&6;Vwh8;jli6ued9Rd`;d?mli;{_HbnqUQ_eAeVt5xEYRWUo_5}
z=aO0s6Pyxk55L#m_%r?3w94~0B<dc=vNN}5Hr&j3->JFy6m@2soV;&VCssQ!Yx_0U
z>~4eIHZGEwuY|&B=ZF42qejwOJrS_g(6k_=x8r-wwW_gGt~<3>N>O=h;{61{(*17B
z`Ep{D>%dtiA$$5QD4XEdKB#Es%Nx?CIZ%riZrex**tm$Hw+u@1k;+<atS%;zFmBkr
zxLh@q7}lU_>+TJ;ph?Z(Nwph`>$!>}t5@6b;SsX*vozdj5M#q*aN&XxWQ~?78Eq5(
zxXFe*afPcFFv$~}L-#H>ZFGogwXv8tMy_y0E*&5KWr}SiT%=LvYCfJp{*Q3C09U6n
zk;Z4$P6s6TTpN$R;%+bI5uQEc8^9S^d>rrTD)$Vx)=5)32(r6$#fH^r=B%|_ower8
z&SWPSJ07m5art5#c_BAfPu(@VBh90Z4u?puM~)ywC~y_)A>YG7QoLiu)7xyP2(td_
zddQMpo+SMAqWFT~l*x`{@zCI`{#C*DC=Qc58K;AI^#?8?`}$~5a!#49X*N~Fa*TLJ
z&c3uA?wydGddRd3$(1Y31gVyGYlA~y|7_6bX7;+Hfi^50s(v`RbiBvl2EUGVuOh4I
zz~KD>eh*eH7q2@AD3;kbRIP^oIz&A9qWHc3pl9UF=uH(WE|<GqtIT{J$vrZ8A?ukA
z*T@)w=U08muw;9=DrqA8RHBH}Z3feUSsLtd7gS1KWY{NU*c+QkoGfO_ZFr5`DL&~#
zEFAODt*UlU#&x;{P9XQ*UN&+}M${dKsiy=w6-*3%5va4CRdwgcwy!491k>o(0F_P|
z-ENt@Y)F!0s7Sf$F=MJX;c^(+zXg9=US}$m$w~bViL19|58Oq;$lXcr#g{$sfznZz
zCQ5X50kz)Nw0jR602I}-^T{<TNr?AqH|;oBXH2kcG3i*M+#zdEd4oGg+@-z!Jl6&_
z-OVDSa>W8Jo5@ApyZ(s>|A3nt(`GD;!lf(@>bZJ)wZ4K$^45Kb;JBL47a`KVk>p^E
zPJlQe$l~d$=$7SP$l|Bt*>XYmxOpc-Up={yC9{0=QiRZN5zdFjQ-i%5CVW1{Z2KOm
z78c~NkhybtD<Ojs({sI~_RfgMGvyfMwK7MDr{IK1yM?P>Q6(uv4cno`r~r((?9V`}
zbAEntpTU$riAYEZ3l0B_-coVS9)DpSTE5-1dWK^xJfkY3335VP)rJdGlDV44V3G&x
zU?P1DWv^gNLnl!{D2z@p@I!^7flZ|!?*>~VURk4E+hO{GLb}F2JpIy&>c9Oi>_>tZ
z&E0jCdySLm&&(U#T#KAVcw4t{ax3hNPLwtr?fbpEw^nr^bq<4gQH<EKF5oJMh3vz{
zukKh8CZv@_aB5v0_WuJjw4Az29Xc1bMgD>U(x9@90LJuQfq+@-2>AbB`Nrk{_bF!0
zFc@<aC|{uujVTu6L*9gB>XPrUTf6L<|IDy2Ubz>GzeL{5TbN9AK5AZrT$=8BW3noF
zx9YU%9tbkNK;x)mu1rZer8%0NF^^OtW=J}U-)!rYuSaK@RUns|-e|{qBHuDVD7gbP
zcg3f@-djCSoHFrWGF|r+{^MXh_)y{)O<3f*1Q3G@k6ZWV=RYC)E@$ddiHk0S-hD$i
z1JUbx7(VAJmyv@&|75i2x4y0{7^KW59;m4%Qz<nIU)0wdGpU}kL6zfem7>AUc*j_0
z#d$UWUjkhr<hr88*3^!p90GjTVCZ(9n&h&?2qd^2B}|h})YB40w@eSj-eyGjaH+=n
z>Qm2!u@4fdt`L-VhEALlFg>WR+H<m5b=(B6Xsm!#PG%={y&1Vl1L-0iq?4M4z76O^
z=Z)4k_3}Xfpbi<@|H9`%W<&?Xu*X{0`$U?K*fH&X{5Iq~o;oa2!YxaGn0faewh_7p
z<@`b?$_q%3c6OoY|Miz$8GGRJDywtr1F<ze*t?WZ=V(WuWOw<HO=cL32pH)eZ&X|B
zQjqeSyDa2&m44It-J4cqQIwaIRDS%<pRpf{O*glt!UIOsXn@v<?xj<#rx7B-QoWqE
zG6ObNTyD=4Iq&on=&;Kkr1LskpTSfKZKBkOd)3vKalv38%?x}!PRHwp5F^H268*}1
zm^(UOOrZV-{ciqU!c_3ry>Ua|jwisb!%~Fk1aN;qqg?+LGmep|WZLJ+|M;AJq)QPS
z6HmyKT56zkRPr05VgLvcljNl;4?ll}zZ1Gt6{StE&?fxukeERTrGsp?D~UG}nK168
zQjgC|y&pD4X((y%e8agHBJE_F^CK=+6wt}JMEkbx(tQUA(QvQbQy8VacAJI@JY^SN
znBc?3P*OnA7exIVN(?Fe_-P>UkLdtD?U{lk9n^Oo=tl@qyHZPqy?j^S6r_-DMiPFb
z9q|{+dq>7B&rp}8YKM*HW1J|hLKIW6wqV-%(~P?W!yc;J?rCU$Vosg5{pfo$X5#@R
z<%l`pS-vV#8y)ZDi`}92citQ~tfk(hgU$BWdqbN-sX_r;>{1az8*{PxftWi>4XUf<
zu?B)wZ*Xz4?Km!T-<{UlrSgRWwVmLFcK_uFW}2TpxGN^5zoJ^OUjRj@v#cozit034
zA6%+>gZR^Iy~9>75S>fI70Ul65v>fSy<Lp~^M2jr^V$TPoO}KlcL8V0pKdqN(VWjW
zoCSS+wzR3E<>yA}nld8(O&|``Srcv578}Kqg-EL+HMi_j(1~h08*aM_HKOwEu|sv%
zOARzi^eCyDR?J1T9r=2;nn{YIulXTeA?v(%q4tmfP@C!36fSSUXWR<>CgS58bf*a3
zbSQ6~*p*O2CQNSi_&U2=J6CM$lAHsksmObnF5h3i3BwBHG`um|<vrYWTr`u|n1iQg
zXD?OJ5q?XL&iS&X7)-JGYTIL<H%7n45p-#Mz4jEa&L}j`K|%-H8#P%b(y~88{M;YC
zvMqM5dBy0D_lCk(3+|glkCu9>*ryN5jx?2ey5|w~1^M)i=UuFCE}ucQ7+0hKK1~w5
zeOnva#Sib^*+v6@wlLb1%PZt&jB<*&n}T)xcGFpr!(}Gib-@#SnggOwUfs*X8dzQ{
zO131un^U?5HGZ7A2gR16cSvsM2%)%u`EIxNC1Dx`vMvE=b6c*TRW-%w<%epB9PV|y
zW|?>q(F4m{-?R-VB4GqBH_D3I<y5tSNPXBljydRZ(?B5z1IgEd?#{SDv1OOlD3kS;
zXSyw%I=|6wY1@*1?rcT6xG7GzZ8-k$zL;zuks+Cv4`x%VxnaeREEQiyZwl5~U$`-a
zE}b)Vrc3Mxsx%XH4ZY5Zel;poY%wi;hU<^9(SzO6PSSTIP2?v01@(56f9q2l@C+AG
zCj?eGCWl5^uZgsXyV)8=JLEgo7H=$iibw=-cKa#D<vPeKs+$iVLnK{}Obz&bk?c|;
zwXk4|6N;)rRCb=lskJRX_?zLiNG_VsJZ&1*P%f^}to%up2LwcaP7-8W@Wk6PRAZz-
zRQ~vDt8(|mun_p|{PK^THQYp;(+#yy(<;*|Q;7jiz5H-%+|Y_k#_S$A9h=)U@tAeL
z=1P1Q>8ry2e(`}J_sEA)eeS&i`o=y4V^2dvH57Z(zyYak#mYp7XGt8m^RC-^C6T8J
z;z2H;CoG{Bo@XbtDne0-+d{0adzLsNlUO5DsiPD4^lAQ&jpm2y1b&MUI+PRvGOY?7
zNCcJmyKPrv^2rYuegV7{-)=kxp(?C2P1H<r`fV%@cjk)^O5BtSvgS9PJlu*f@Z3Jg
z>b5cB{7gqktvK8v-=(Qsi$kP9HO2J_>nYrz*d4VfNA+6@Q`KiE`;w2N4%S^P6ZRuo
zy6)&rkD!@B0Qx~F5E%QSXj5vS4S&8hqRd)TUoL6FzeGpw(C=zNygcHG@c<|}6`N>6
zZ1q%g_&EH%M{1NxjUB`j`sO0}-jyI{_aw+^oC%}go+x+Ac^(JK3Atktnh@mCywefS
zY%`E-;DU-$^)#KY*h;?Jy`!O|5AkrRD~j5QH2E-Ml3x(I)en*N!UGNom<&EHE4PCP
zO3#NusB8rp%DU5aU3($)Fk}JJje&4ibpm;-nWVs{<1fjc^_6qPrnG@M+&cxzpH?VK
zU;3%tTfSNKZb|D!CQRqgjqJ(CP`EhA>3IiTr^P`8pwWH4s9&g|gjA}df;QU34-7g~
zmbYJ$lNyv>Q*6pnM&V%72@Y77KLcdi@C;thazV0D;FUa$Fq(BdShpgNqO9OCGCL{c
zjTEvrH`kDi?reLh2&8cW*c=&&_3^q(J3pPQba04EN~KCfwrYAFF)Kba^z^nNgh<LI
zg%?;eVZ6LPzqYEK<pe3>OhDbf$kib=obfM!J8UB|x-^78)A(-m=2_BqLv1gfJB*y)
z+`bYsa5cZ30}&O4Pc{IDNn4xW2#q8<=S?T%%qf(;SR9o{M}BE#;K66daa|7W^j(ri
zmX(H=NiZZGKP^@^;>w{!i+@TULY$}!=8KCTYsnWIL~X)dTR8T`#LJ`jgl(Df<~&?R
z+*R&KZl@DL5}jlM642%yJEY7&`<B{aX7?5rxE4sdS^}HO#w)qkkWn*d83sS@fxo+0
zj{)+ebP>kzw+oaW4O2#+I7AnX@<dwgK$89{)B(P!RWYZTahzDyRDvhJ@+nGGN@U*P
z!V_1VDWLP!w$L<}E9H~-bYe@-pnMw_c$9?d1XNZXc^EM#`x<YvjX%V5Pai5}hC22E
z1x?^S)WqkYP|mG|OS6jCEcx6PH5*^#VTIdU-iS``BSt$e!CjxaOW$d?XlmcMdqYr0
z_;C9NrxN{{jeb!D{f0rg3r&hgZw>DBPAmYF)*?RyUa^aoV}|?oVNC+o%G+4r1>WoN
z-S?)Apjh&3k+dXL{r5e!5*=smvqNcz=?p*pg2C>5A|obuyCo;}t%pMMZC3b9h5ty6
zNUu-0!J)dzH`K@ro9co|Cm9u{dH)VMB=hnq@U#A3M{PeErux4tWf;^IqHe8!AyaRi
zAlT?K@OPN~^ByLQqfv9}#wQ_q7+`X+Zo4Z0gm%CoSG;orp{VFJ69~!!;Zd5s=JWj;
z2eH6D6It<V6YBzv=5{Km%K4Y=xv&)AWefNG0~Qc~_3o@N=|3g=EC!bXBo@_?)W|$V
zE=C0lmVZ3!z+kGPZu-UYOf1_-*Qjv7+;n!YKrO@>r};MlI1A}c--lvbxz?ue8-vXt
zkW4{Wa|@y&&Mb|8Jmw1V0Ph{*=)nwUjZjtI0dbMt%CGDrsG~jHkcJrW<95c^PBL`_
zsqKL;Y{3DwTt*>MMnpi(ZJHxToywAcPzE59>?ldQ!ji`3w{N6qb@Q^in~gu_4hSsU
zaXW#jq@G{*{l|$c@PRG3^Y#$oDu^cInq-hP8kKndCyff|cw-kMGTo|5{r>Y2GJ~l(
z2#Wqmi332lQFm|r$Q_!ONsIjv#XSs35a;x%9|^7r90QY&){j*CKRz<(ErV&aC&3J1
z$Qe?y0+Jm^@gI+WnLke)LJvvKgQ^DcWf`P28nRZsSX;dih~GFNuevo<>$5&Brnb?`
zMdcbVc|%QBi&2Y}9M{oAfFSA{XO!yEot6ID{ije&SYQT9DkFI#Y9}SQsM`V2%udC|
z6^@&{wwx80X$JV=FGo?r;s>kD%3a&ndlBJ#%p{!DMhoBdaBDbJZ#<yR)cVe*2T&Vs
zH=v!%9166|XZN2+|Bn#(lFA7UVIj`)_{GHY`EuwM`5YHZw`>WNLB+!JT8ch_bJ$hF
zEc6`P5J+OaDFUg+b+W!{6qk$`k{JB@8-(zlKFG<Z4FJ^>7)?Czcfd@myj*6RqkU7e
zcx#4S2xbrSI7{#tWXnr^c}JO2<_=Mh5a;s>)7&7K)n$Kd1tqvP3LvV+QhZ6<UAeo2
z1UFP}oaQj_E3!-naP=BpTo(=sB>g3zTIeB996~3Ni<F#>U@J2omNcu`n4l%?$OHy(
z1$WMVd=R{Y<C~3xN;G}s2h9*>8w7-T`C1=-30$Uyvs=!`NtxGp_hhVwn{ThAqicw<
zA9YL7)Wrg1h6Ldkjv-02ibI1dEWZK5j`#jl!#0|>{oQD#Rj~6&I@a#26bQ-p58AVo
z#A6xldXyUEkMoxR`K7stv(V?vCWz!w;A=L|2}xv>LA=E}>#N~-|4I9U^_l_SIZ}s|
zG{wMsZb55r4Xc~s5gLgA=S$*zHPu^&?WuCd`IkfgI*?Ew%$}aXs9-B(r&!8d=;;yU
zeDsG0GP5BP)-xj6FKx1iyUzH_Q5w|d-=Vfp)8){NX9;Li>u|l#ZUHl(Bc=ZR>$Hl#
zswvsPjF8kS_-Oqj1Vq2&8#RF;qk9bK+E6e%k7we(k*-w$@coubs3Z={XjBeh0eqz;
z&vd?K33JqTdG{ymAIXOWOeaIeIxvRZT?)DX4~68|@Zkyj@kN%WyDg=wPiSZZ+@tM(
zLFR}B`8Is1U8wb8wXFUQpG8GqHOb>8$EeAndI7dkR17c(Vx3m&WsZB-oP{>a7C5+0
zj?1e&JJLk2!_hSbYD*kkD8ns3i#+!b6X*cLRWg_Sfo04x<EuwsynqRyzN|f0Gy1?;
zkz*tXUU>IAl8zNJe_kcK`fksf*CL4cZMh+$frnAE11yR})u%4&llM-dSOBcXrDu>P
zCxd*)JI$#!G$~yHMqt;BN^x>>?x4eXr0!;SadJ8xalWMNRr6JGfsOHgS{Zb|`{O(;
z<p7DGHlIhR2V#>O@tw<l3o&T^n(f6_^pnyL3Hk@FF_ki33zG|VzI`4;U3*TgkwG4;
zfA8~MemZy<LB`*q0OX-WGRV33JSL25%kUhN0ys0~uQO@UE5p;9CXn{bjdcU=dR;!B
z8+%!2K^C~H;^uonMMh&B2u*zq8@|hPlFMAR2KazG*|%?d_|25%aH^gG*!`u0QgrL<
z0;K48ONjGQ+1n{I=Pxfsg5mTs8!fbemV;^8g^V7I;WKP#6!(@9;~koEsQ&%^zs%lW
zkW0r3*Q0Omfrrs=`2zBWZ#4AZAq4nScmfu9sE^8wmUd|;>L7|Vxd@>@cSN37Fyi<w
zaZsA@efG2$!VTyOCXBqQLY6F`lcwr->48uQSrVxD1Wx?d{Uc7ub?1VUG&(N+_<c6^
zK+TuKb=8xdWL|URNI{+q3OqFS<3l%KZ1}JHMhs+^UmxJ4)q3bOgrJ_^U<`-u-&{Ai
z457c$i9yTR>FPiSZX~HJ*cn8Dv%ECow|qwvg6_X6gWBxw0ZE3?ZS)suMV!CAn26=A
zkvLc<`z!56?(baNy)o&&+j^ND)HgvRM;s_n?^>Uv?9MK^xCNv5QLBN%mjven0@S)j
zHn|tTQ2EiGUn}O?Y3-#cZI;0xjU_igj36C4`r7}f?oMU%noil4KWn%YMQ{H(L9ufQ
z;+5zJsZW!qO<`XZp&stSg^B|;5<k~%*R$4Ed(eD91`seh*DN0J3d0%?$EZJvA)g<*
zd8o{qVa#*6-}46lc_&v0!S5%@8QEIRen2i6%P42WQ;$Zgu5x`eq)v;7fw-wCRLK9s
zdI)RHn^J}(a4HY21eNeJkSFnL4OTGU<|31F>q_3b!vngH1Iu(dM~d9gvweHy62M_S
zuSQLH{}|eQL^kuDUu}ulPG7j3s>)vr3~2;mCAuKxiIC4%i>(Y+Rxz$Ff8xD{g+z6X
zL{K1am?4eaY``6HXIbhAQw4SI$gyXKi}t7nTD|jbU~#L;XqJ1+0%z3%)sSaB=Y)(a
z^i9~4QVT<fw^R{fHSH$;D{1EdRUQE4N%32F*IoJ9;AoBNRu5mJM>#o?BE~U7@<Nhj
z=7B`|eaNBlXb<oZ>^;(yrj=v)I&vpRNl_KH@`}E(pmu~36RNNpHHe#QbSXjdE^^q;
zxz!wQ)slDM#9S-NuO3t*9iF?lIoQTX@QuRtc1|o5Efvcv7Brp<msg9?bX7h5H1x<&
zeqluVQG!+c+QzYR!Bxhgv@#S&vEzCS#}el4s4#UpY%P3tb=@s}fiI%WfV<8bF$7#i
z$`~l@Y22iR7|i$Mmhq1M=vUY5mCFUkf?ibEsw?t+d_4=wAS}A?u9u{UZ?)9gWKPIh
z<35qQb0Nt@3h|^;jh7_my6b9wttiE4QrSmF(cC4g%)~YKa{0If`{;R+scqxITD2ka
z9YhY1(6)4)lq613tJHhow4lt+_d0wYcAH^P*`E?UPB7oGdZR(q-x+flS4WPv>zQog
zZzmxqy+%>FS0Rz0z|F^h=UP_);>GNPt9Rvo8~4{5I(MaQm^nIF#iVIKxpz#R|IY`X
z{av@)vX}Ac6I;*XUXIC~Uru-%5#73CP!_S^MmgN>(fR9}qROW5Oh?~CMDnq<!L*UB
zq>}`)k#f9SKv-LM5qU}TEcHNwMloRX@vr;v20zt-+M!&Z32%{^-{yyfg011Eb?VMY
zcQ6rz*8a%GgHlgYsY?aA$$a@F<<T)nZ!hc0p&z8#QkT1HBJ`)vf_TYn-&GqV^~t`w
z2k{#QW#%rYJwQ=H_#8WC40@Lj<$qO+8Ax!H+D_Nn;Ve<;!Akafc2eF&C)K)1*0A)8
z^@rXeNEJ-0NGz%G2(Whe-)HZKK%AAccceKac}t(VQTs%Fc|a;Q#OV&@QD}-_0M$2j
z-KKK$b69491YfvoG)>iFr0#;Er_3pklNqIjG%+SRdcDUK3JKeWa*Mz9y>#yW%k7D+
z`Je#@PBH(~R_sU1_e&t-xV`r7vG^1ANViJ)d#TNg#gT(*jg)gqi+2r&@b;8jtAhNW
zH`JJjnPsSy9AzXZ5NP+^_Uyw+ZME6jhB(_(c*wqsI-rQwr?#jwGX%G{D{H1vs^#zx
zlsc{l2+f~n^}d&;CcW?{m0I3uWrhosIj`o$1^*9-*T87s9%{5Ni(Fbtn>6WEi~bV3
z;U-9K_vD}`!&1Ncq&`@^X`&I42V#qJpd{`m#*Tlx2i*TWCsm23=0l!%P>zEdrigZT
z*bg@6&(SN~?r$!f_;^9UNjKXURG~j0o|K+Kg@wj{o;r_9&b?>*Q7w8%F$RzJ3Sf~n
zJ+XHL1^mEvsoi=^$nWj7TTKfxfKEbwtA+6XrniWi?R8c)Ras;UDM*YreDP%_r-5J{
z+o;96A5>3)f8eQLOGv6p-1Rl_b264+;0^}IN}G?L2Ceasrh$10IWd%2;yowqfhgsh
z!?PJ7X@}}G<+CNyLM4ZJYVLK;6DMnZ{8h9C7)*U)&7N1LAYU#HIa3LK`k(iYba`%Y
z)fi#&<ON}QDku}Vpvw80`sZ9}eLq+x7lju?dC@HDcd`!K^r#lsC%+o88HUduix<3N
zjrjC|!OVma(_n`OO;=)jf2PZOhq3W~iT>1A+e4`?JI%f3%fqQX%e$->^l3>i@N&OB
zYGTGP7_E+6DPQs5nXG*an{GnV`vJJ&ywrX(Z3um9@7m5e>i9v&-xfrHUp)iz@H$3W
z9W{Q%CpG%vVm+!02f}8S?pQ?a@NsD$;fg%xj5(a)c!CqUu$<t{gxMOh_rNnCZp^Q1
z-QZ99z%b}f^5S~2G-~>(+IC@q_#1AZV13}UlD<c6y9NbN%hqXY1hMl;v;o~C<hL-~
zeZVQ+K<4u#&}A*y1^p>p`}V4BJB&Ob)|knFJxg35T#9bTy*fU~mv2y06L|Lrb)IN=
z?)B-<>c<}XND)KcRsNH<4R5xn$(2_y9t!vPHvHc5))6Oq-_`!9#{G!UrJRyWJ*gx`
z>HKvP?I$zowWhsFIH?qKowT6&q5V>)_gjh|3sxV-pt^_^3m}^q3e@D?7y=-f@QL%*
zAAS5nSM=}NdS>6{qHEUDmxm7GA8~{FasKC5qrLu3a*um&%A&&7MAXVE7%{ha?+c!?
zZOCb8@*cR_7GkskBNI}jDk3F@Q;CCRMI+8B>Yt;MGnMeRY1=*A9VcqnI}qE&`612$
zi#+BgO&yUgzB}!;y#ohG9EN5N?-c(>S|kcpH}tTibvc7_eDNV>!|uB#?i_`(-pCPE
zi2HRJO0az9Ie7<RwjX~ZV7)#y&uY2}<2M#2g`V;vaE=ZK*a%uppZXs0Ob2_D`Q136
z+=u?mJ`)lVHDjHUA<o%3`n8y%mm<ZUz_6BpHp4#fp3|_+w7_5QF@rFeW%Ka#^S6jv
zS`Z+BZUyZRX;~y?l#*&HiqytUs;~b(8&2s{lgmZ&4CY9t@a^OGp;tA5$Af${A=Z-j
zM%^W?j?{7LBGK00e=6RVm*W-a3B_tRpsBO(^`!)A-Vhs7eY1-}^Cn!EUMt#JXMwg0
z)w3l+569wD#0vzOzn=V~ql5znlK;mGZDLdd2S$wgMp!{K3*1*W$k~3EjPtDrq8w?x
zEnW6Uv_2Q~X_rd3LtpBc@YZj4QEJv?kd)27+F`q6E2%q60e1#EBJXIUJDcW-d<=sx
z^%eX;VI$4{+mMvvF2B4%HEqaqE1=|;xXobv#@yAA6djy{katGqD6VuhBquslBD9U3
zr91;E1Zb8f_1)d@#aCQ`<em2-RwDdetEN4RRy%FE+Vj>fq;4<L5BOqxR|Q?|F66X%
z&FHP_a?ktb26Ty;7k&ml(cwVPntleDfWFVjM=pOtM6Oa$&IwS0bgnIeA8DSG#3+TP
z=#c%zc>T|EbZ~S0S>)L`?kmQHABL~ElPsoH|3-z=3o)0?7p6roV3Zg!C90IMdxYL?
zk${C#V{im+DPX764d?weIQ>ln`YprY*-;z^SwGy|<JW=3Y@37hr05EW)*THvV#?k>
zX~b?-CzED7OxQq^=L4l4A%5^l>%LJCyf>Fca`KcnzZ8k({4lk5Bxa~>mZV;t67=-U
z4lUR}0}76i+~w6|9vhX6kUh{JgX^F0+nG7L?~)#Bhlb^z2-5DmF0*W9hNx}bHxk2v
zAD%~1ABDBP@?zX&N}(b+3Su|Dz1PqdTBFCKEdeXYQO^{=nVfMUWuN<`5eYxtP3$k`
z8(*8&b-C!S0I#vIM`JArv`6cvXzg8b%frV_lR=BkY5UK$nBj{t!|&<#TM?-pD^W2k
zv9ua7*TY>C%?z)Xzox>_p-Yp84lZ0Ixzs+gx!@NRdnC-zOz!i$JWZzoQCX|99Z@$d
zthHPP(jXo;9RddrulQ0aJ>@-J*N7YHRO~vC?->~@U*d`Oq_XAO?#3=c2D5XvjCjsD
zq}aZZAm_r}>;y<HigcCfb%O)(<fdB7{oJ94lfXTVS+BX_R7D4DDk50Rw_C6~QDnmP
z_eIvS6D6=i#O^e!jd6!oFd2u6|GIw^v><4?SZavAy;n5nPj}Gn$t^7RZZj&3@`=-{
zUFShvHm$Pgz>L=-e&d>WfT1C9A=gWWkWgGLAL+CY$*L%IVKM!M(mT72$QOP5lfCFz
zUvZ&jfy<OsX5aKPji61fXGSC7po!pi{=x^=9jyF?EcpPq?^X}{<<em1nTjrt{9lk^
zOtd@o=`9Z0ofN#~@wGwA8~iFDw0I*yz5F!&A&fJ9vU^jCPtZ+Fk*_3pdO_SuI|B3>
zx3a8&fyX{gX(_8tHsxAcWSFesJq*QN7NB38D9E40o<8hV;=$`E;U;goiFFs4sW3QP
zW6h8>&#{|8(wU|^uw`d?HP7RPZ&f}-!i<z}KO_`YHiuvBjSYrTnDH&Rn=wL%9mg#`
z%6YPvjYgb<>bhb$Mu%7X)w4XNo9rbx(1HO@w-mj!W6i$6BQL@RQ2OgEgs}58{bHl>
z%O9D_AtGyl<-A%$OJN^RIq`8jo~sng7w6}jyk9?b6yK8mkazJU_R?v)0f*Iny^#Xi
z^FJ{{G4CAr8m@Ij78~E5-8cNzu3lb2`!7;ecGZcd=;vj904I8i`e)jxlVftF)F<v4
zoDeiLRf~6-bK#p@T~Sy=%HfkX@DM6k=4k!)Tws7(e&JhZ8VzV&-HsBPL7L83cX}tI
z!YkZI-o)w~9IO-2zf(4?TuOpS$Ift#TxwcThQf?Hg{(b=XFrF!yl-TOjD9<Kd{7EG
zk0WsAZXT**!>7g360BgLK^pQO8cv4{y5;abbdCDVQ`ef13L8FtI^xC5g=><&y3g`v
zJ7@>o;;kQoQxM_fp4|-vM!?F-tISLA@zIU~_2lnIS>w%pncD?Ka=>(=n180Ap1;~#
zul);3WtrmYqWzggl~Y|Sju+LrgmD9+Msl1G8u=%RchgR{yQDiN1P+36|EcNPyQeW<
zFF+#5z!`c?fo5hZ&ak7$lxta<1}gE3ng&3=?|vZntiM~9H9195{Nt|M&tD$lIu}E=
zTp;w#qNiJ{7f4lyzr3W}zm+D;$g0~7;zx<I%U0$zrTGlH+G+L|1H|{BB#&IeTY_Ho
z@iU>F?U$QY>KuWti*mN<xvFQv)X`i1q>bw&g|Pddw&Ygb3c}FOS=<{ti&&XkScRl4
zwC?X8>3KU9Wa2*E1lk7m^0Y=dsHlw{L526-T7XB|Ym^@JYn&t)IsAfZSzS7*$d~&D
zu-(zN)?#2AOrbiZKgKDD4)iUzRWv-DynJ(&%|Z~InP~7+y@b-TRUb{;J{yXIaT!o}
z;AiS!+VF0}-p6h^SU1YXx$&8}Io%ufW6V1Llp*Q5?Os}~$BYx09%&)Et9X15g3@fj
zc}Ys=G1j3ebN6W^-Po-x@q^y4?9F>nFi?#c0iU8UnuL8Tnz-x-MH8K;3{l21K@>EX
zpNYhSUcc1A0x*ozvJan@NN39Fa4<5Jko_wvdx~RpXFGJKt?Pn*&4Qi77VwIVOFq-t
zOrw16&uEgt{NY#N^v=n$NO!A%urOk0v+IEY?`w(sL&w3TF?9c|`Tf#cKZnBAz2*fn
zi67I+`F_()*7fMm0uf{&W*2_ExVh+n<gBt2W?R`oz-KXoE7-+sczHx)okd``+VuUz
z&!;#>Up$2J!(WOB0mV0gV)M1vS%!97Sl=HKA4FI&m<n9b-@!J9j90ut^neS$m9oEM
zdU0?S7T_?;q>dmXz5rpuk|-1YL<Z9#xA$y#3)vr`3#Np-D>N&Gq~!XpH+=>rmP0j~
zth@Ed@3hxm5wMrOeYvi5pNP34_rJeh6YvOv1Fxq=WEi|D#SZ{t`tc6q&2Z}r7<bI4
z3J`5PnCDQ^_$Gf~W+R@LDJzd`Bn;-@7OJsK7;{ShH9(plvF^blK%_jh{PLPFv^K@%
z#Qv`<u$1tN=P@7&N^To4h;2;e15oVtq5l$q=w*ShAoz@cgU5Qaq5el_ANVn3VEAqo
zQ~^v#-_Q668T2B=f3E-XE6*UvVGh@5hW<ziF`_az+o;;++-UtM?t;F+UVPd;fa)Q(
zbH+osx0MQly1i)md*#G^jS0>sVoC(%KCFwoWLY}-Yh=?sk@APf*0UHPjpLx_xL9-V
z`2iA9Xh2cms%wg+NOvDN%NLxbQ#q2<+eHpnlAJo<WeUl^^~!Z&7gNC7XCZDBCSNPu
zK1rLz(D;(TV)4eW@fVt$mg$l05)W6sX?gu!?7<-_3CPP6Cj5H^q{{Q2$?((>dH8YH
zUFEDkqlt%;$U_rb$<7OF%L|Xo*dfTTz#cLfreSVPY!w<5q|#)IqE;S&?W!CCvT9K^
zy&2@(AqebSh8aBM1p)nv{0wO)Q$Ra7&mrKgzfgpqJ`<#oC(BVsWA=GWMZ!D>_JhzW
z6zBQ=sEv4R>mAQ)^QPQg9}p35)Cmn02VhdktP(Y1F!^`^5{F2Opk56As)0})hsdm;
zP7FTLQN0X|@-{T>@au#-=ZsV;;PB&3?NryUqQ(f}2=c{(rn1ySj`F_#0YzM3+Atej
zjNJ?uz5pyy39b5W&y!^N(Uo!vf5LumRBE@l!_4@?MawHT?UkO_76m*_3+Jx8`W<Py
z%?x*`lb1B|@BI~aIBE7R3`;pD?%itXs<v(t{J>lQ%#0dzL%F47yI+D1)@UjNqx21-
zV8@Nh+#-v)lg5q56qN%^xqE{q9F0m2O4JJFiEusx4nT3*Q#e9kqPO%bB#GP6B=K7{
z1{@I}Nc$ksV`~d{n_Lc6t5cc=>RhE2r7m|Wng%B~t?HTTgDK2<z+9qVqY@pP*j;R1
zPHZeMG)y4lVwy?ySDE5pjh<LSWCmOLSi}S)7nrTNO9XhtYZG(jQS8hG?I9ifQAo0&
z;g(v82&$#6yDe&*P1a9stV4oR#f)}ESprMi^O}1CG|Pqs6Crga>}}~2bNo&hFQ}0S
zcYUSDD^ICATF1FOP!=`9+cnFLt>h`8l=JO}K+StW;6ct2mb29qc-)~-Cm<CN*0dXv
z=|$w8rBR8pOC`m;4-H};$KdyGb%aMQ0++Aoi@0+KbFlrr9E@rxP)CeaNo6qr#UDE`
z-7jzYUg$_s2T?j(O+9&*4V(z*E`vqn(&;V_)R0DZ*NDuQpBJ8x!;2tL<k?r=SX2(u
zj~j*6cNlOWDSoxW^`iKt36f{@dQk%8B!%rg+vS%kPoJFWm;x9t)TFl^&;v%bGZ=Ep
z1xo;VuW!%zUU=_z+{Yh1vLT+Nl-u7PI_N)1kQUpwl`-_7ELw)IjwoVF{`m<}m{`dq
zS!qJf3Tf~8M2-dv1evu|hOM6jIuN;8<g61k)Io0+4DoL<I2q&luBNn;o?RvD;hI&^
zLaK%z)U}$Ks=b_w<=PkwOLoLRDTyk`hc?}3#1N<75g+<tlS_&=M$1IVIG0~gU=;vF
zQR^p^(#S@S`i4@2_=Z#Y+XZUOe04XCow?k#V*%BB@oO<=gKys7kdv|6kt`T}(wC{J
zuheJanQ6jb$8ohLa}j_0&L@QFd_v%BP&?WoRcX4nEjCs-La`_N8j7pWG@i?XZ?y!u
zgrx1cX2>wT2KhA}DyWEatRB5zWWJG)c4)~cSm@PQqfx(iE#yqgpABcGLZ3bfJ*UI;
z?!A@S9fcT{>jTNg#}$>W?rnPUj(xbG|B+H0om72}WVPtWT`SC9k+659XvtM&Ad@(a
ziFoCQ)6Zx9-2<#d%zMjt>xXpux)j!x$H_kd*k<KG%f6_Z^oQ(Z?J_)EcA#=}yUEfg
z6sJG<;z{=^bud;XWw+ff@qh%9Ug<nC$GMo6hgn<KqU;N0V0!Nq3fXVQw46^@fST*G
zMx*+4*gx5@HMs)R_0TRP{=-9G3@-!RZOJ=fCY{L-m)`#T5r}HfZD><f1OINYED+7G
z3F-zK18WzsHo<a%b_1{2{~VntU-lK|aPAtBP<K3krLBztp|F8aMkh;qt4!QY%nOhz
z7o6kBoV$6p@z?0=q8)d0&R64YLT;X+#z=k;E<G+gN8BE0N?y9Xg?GJkB$n$AsLXy9
zg|-C&Z=G-<i9sp5KB$0PBC|&)urnRRx*aw(4h-9Z8kH2zZSLhK^ytJ-6{3@<E@Vw$
zQ)2okJ$Tymf#|G5agddlO*&{J(+S+mD^OZKV+WamZx}I+PP3(Z<LOxj4KwC6Jd<1%
zxx-nr9Wd3-xTB8=Rk2T_metV<{}TT&Ww(u0zzTUBM)`B~&(~b2Wmes7QJHh?LR~oO
z7wXUMvl~Lz2=0<E?V?{}VeoeE@N14L-EZCc?@(w;Jr#yk-t%j;Ya4ID(pnlg-6{4K
zn-!CRrT2~dDrgk%e)#>Q=@s(t)BQW)Q>OmL+I_Nd_sskhV+$94Kq2rhRWc-;NUmZS
zBuyMCmP^V#;k%O-;t#SIfggcg-bDN=K99|7nw>gY<0?%kqXp*O+#H}}P_FL1W96#S
z9bOs^NuFG4{|OzP>-0xQ;YdYGxTWt$?;y|=pf$n16T@e_^2n5zZpECItN-c7^w$b;
zT0+`nY31-3)p(V%bJl#Jor^OLp<3GvrhmjVv0gV}rl_XO^})koljO3NwlDs!YPrpe
zsOqM2#pdL|>emV**o3)0EhqJ`m?6pj)S{OP<H%ozQ>zDkO_uNUFU(%V(Ieo$I8?o3
zwjb1_wAw=DHY_BB#`rI_gZUFK$Hn8F{!V@%p)k7DxL}P_lJs(N{;0NJ)X_m%QK;er
z!J*bFv9W1Inh5{sP!?INX;!tR<rHwfWH_?Pn}1Re2kuTERI{Qb;<cfXeqn3YxPl`v
zdg`J1o#!+%-ZE8Vx4cx|w?CaQw$XFGNv^9yg8jayTSTMg4Q^MC7sbc>!3f;y1VKi;
z`C(@D;4Dk0Luk2&HRYYTrAhjW?N-v1a+7LJY!v=^40G&8;rwf>jfRJ?Cojg*U<ay&
zSWi(Roe&~xDN)R@JB8j8hEL?^dE^iD7ZvBT5wA6zuS{;;C^IQUb`IHA-rNjTNJ^AP
zi8(Z$YP?Z`A8;u0Q^|%)c2o5(<PgtL<ir(2aW~rnxF3E%^urGGH`uwR6qhd-S%-y$
z4xTXzs8Zi}=2|&%WQ=$r=RYVOGnBYc$;Ya2(JjLIr2!bky;WG_)!%4OQFew9QKmvp
zzp7`NY%Y<aJgg|m5&_p-1>b&_k1eyjA?SEpb;psf;b;p1EyM~x-sicmSBPwTJx#7z
zAoRG%%%LCjH?6NW>}7q?0@C7QnRah%h>1wkvU2Cy0W+8MqZE@yet6)7V_j5jn1gNj
zwj|ELlLuSkaflh7{<yJNy>X*o*9QNSf&@zJ=Y4IRTCUsq%67CB4PEx{=Hc7%VZiXB
z+|F)zD|pvT>lMwt1D3eEtlXp!?_yzaiZ*o^ax*ltFJxj4Z`^yhj>8R?)XTz5u<We>
zyN8yh^J140|BFP)hd&<T(DaUqYPXkz?QI?h5ZglX;{D_X5N5gzv{ST7At&4BosX82
zXBkYtpv1M>cKkBGUVCo&V8_Sy!5SMcJrfEub!6DJG42E)Z$@&TjcTUb3g-wzXK>-M
zsobYwr*f*9Kq<w8l{rE{<O?H4LFaS(BOW0FIF)~5G8Fkaq?TVd2A8tnZ#66C+uovf
z@Z!?;;oyW0C7NB7oBf@A*IK6G0JX;!@2p4dR4Z{JJzo(x_r>5N1hvh1@Rr=6GJz9w
z&z=Up=<A{N1)l^KDnu#iG&5l^F#Q38PJsv6macMthM|9ThUAH=XLyazRnE?5jU>&9
z5JHb|+}xbCZwU50-Uk5=JpF+K_S0t*y3V>}MFn4WiHmAu;11Prsq=_S62dMhVEyHK
z#!sVbkVfb$5RVZ4`uojrH;U?Km{>}IlawN#)nsVa{!SmgS1V*fI6_|OV_?%N58KEh
zxyh2G`Y4v8X}}wMDRNtsPgLe)H~ET6csSXjh#LAxab$Y$zeJ(fSeyf?_hRf?uHBJ8
z0|ysf?4r3UZh!{s0ZI03&&Ur<m?F6Ze*NbP(k-cB*9xVqM~&3xm38v*KgDu2bF%@D
z?gf$&%lArUkz)snrcHy6Zm)R0_l;(D_4Ti|Q>NXQ=<$wu*IyNScflo2ej&T=YuZ3L
zCFC_Zl<|?2i?;9D-~z2w5rNjYfrRm`-cs`!O368b@BXK|V>jRJ?*F+HvS|4KlDE|0
z8+2(DD8S6-i&3|lqs6Fioh2yw#O_~*{3*!=HSRMp)!MO=!C<J!X=4wQ;{E+;4nH_n
zlyLPn(V6NDM*LE^@V;c<Mq_y_7}`?>TWu0xTTBv<d=cWJ)~fN_QwI0EA6$Az)N(!=
z%m%J$p9d>$2)rjHexB%9x$$WTUKhm6G;REYuTNvMzvedCT&?f;8+>KB(#M6rc7=q?
z2y({T)w*oNTu61&05=r=cteo8;5*&D_+d&NuF;S>B9yv=n;gfiB&WxZ;^c9YEf-SZ
z{a*ipQx!pVZLpXPQS)Zhq_@ILWDsn*Jpl`7COM(bnGA!iC;pfB9GjEu&1#rPq&3r{
zcw~!n8&8dy1C0h_V0cmg-xLVaWgDqbVjZLr3^DI%BZ<MUKZT{b_S^jjP>#2tzIUr6
zoRhgIQn~uumK>k%zfawxX{d~wHmfalUk47d=ZFUDj}oVw#k<!J^y52>d%y(N#s9d9
zKAKek%2D|%KLl|J$7n-c)u04X(fdQpX7`Xbd9|GIA8ez~iaGq>TvDjTFvt<1>Wke2
zuVcA>4>FtmA!wAbJjjR<qSj?Lw%06wahY0>+8&s>2d18xvi=Ql2LU31MKRZ{e!^Ye
z*mCL&kA5tOm{k7*h4Vs87$FS#(ZU-%bqw=ZeY>R~0>Ao*pl1%EHJ>a0rgKmYGkk{M
z**;6I!2OSA$yP2<dlS9!Z+KsVZ6&2l6D2gRsOz{`rL;Pz@MitjdHG-(iQj3))XAfA
z`;k<s4{fpT+VlUQDOlI*Qp9zY;|#J}X?uC7$AHUyn?FS1y3@Zy=xG(_u>0d%w7KP9
zWLY{&e~6Sd4ptnhd*fF8#;rv5jqd+`&Uq-d?L$mkQ!h6xj<z0n>-E3+e;(}iIi{dJ
zIOPYTX}f*@DOM%2D0+*ht-9B9MlFK^`t8P7|3z2!Re_n(Ie0_+d-x*RV0m5IN2PK~
zA6M5nm0QLFUsK;6!-#eH9j;@Lc=Jy<UM^jVl#|$xOBOFyw~i;;nc*a=!iOTj-WTp}
zXAS=)KY~KJV7&lAP~WxXfV~40%Sr6d@WyAfviAKc9mS|nhmS<1to~i(r>m|9J2WdC
z!6vxCjNhmq5&rOC*#E5RM9#PZ!QS%2woQdTYm+?5iEl~}AF=8iZE0a!>dlEM*`5ZI
z`9hRI?L7A3F2Ad5dD%;##j~Z#Hf{fRvliNhOJ49*xzZMLL-|yTHACO%i@xxjin5`U
z<vT865vqqu@($l^h|m^PUwodM0ji_8sUYpO(U8Uz*cK9ueJJL$0nW$%z<Kw({Dp^u
z9R`x`44A<w=kh5b=gMx|RF0JrExOiveigyK^6T%7YP|5lVSW5XBbVRFoSCb%RW-k{
z@`co$$-X|?ilPpB=udbgP%5^6X|9i@F(#(fFlI=?z&*5AuZL&9Yu^LQqVUM9f=}j+
zF&td+wX3R4ssU%ck<otrr<KA32VGv52}cM`t`gy{ZIAPx=9F!De+K(eoLoLpJqL9>
zY5N!^)bXWp+Fsj2J8~kT5o}x1_GC?G!6so@7fcVgMq9ERr)?)LyiXv712eRfvS+#E
z@Am$J)SSrVs4=&~8_k>CtNTT()Kc2Tg+wO{?u{RtIa#hozB47Q$anVXi{b};@Apv(
zJEO+`h&Y8KZ%;U0!z7y+?kJEGO6C^E2N!sl;U?wd?F9%7n-I1PjM7l+TQZ4XyTP(9
z*#5|nq>c-%FJC2uYWF2O-NUNAM*O)wcbV$7l@k##3g+!4=$!5V77{h4ZaTdTty2do
zDMz&0D0*|j4I_}{3-u>fKMRbgi~ivUKk#I~z(`oobIa!PJ@e}kb)N=eLLMDI8gf#(
zA<W{;ix>>wb2$r*;}YJ#4ZN^hiqU>_?-9B3koo1PE00>P^(2Nm#AA6#FUAs1xY~C)
zME-KIIsfxH+=smEysvLbGbwNLcaSL7o>g~5wR>N8dqK_H%vIyuf>6EF6%QqRpJcu_
z<}I0IN|D)bEO~@ABck!}cz@A5SXpWlD{R0Q)A}@<%cMm@y;5LcM!A@BvRX9XF1e-b
zoF6jVN=1Mtx7)bMUze#{&jF}X*?hk*S+#S`V>HDvy-M9Q&Z+3Dn)B$sYOdjcuPY;<
zdZ&=OXBt@Yx?p;m+}n4-_O&5Q;?NWMZVL&HuSG9!$OR>c9bpA)eT^|sVHC4uo{NNr
zTFd;0Io+XP3u`MnU}k%ooBb}@sAxMK44P%UNqW>~9^AK)eHtfN_l6jW_pczAM2%i8
zxjrbA-{v<QQ@iE0m`zsm)1*1VBz?wZpxSA77xKHAEDHYI^qGF*p3vy{EIPzwsXCzj
zH=dBI?AKj7dYpYeX)<DDAQR$>;zn6f*sm_hYT}h!{x;`kOXBVnyq-Ez;{?T;5#sH4
z>h-QdJjOl&7)1E!4jhq;tXWiZCJ%4=V%klv&;RYx;YaMrf{^bSI@X%lOJw}HQ;i7T
z<~N3w(YmE^HJ;g13T2Ltl|K=a+KO_YDx*w9Hz>%b9=Yd23i#?IrqnXCWwjVgS9iep
zn@x^y0OoRgmC>x4vsh^A93O2@l@JNh0<$c{*!fJ>y1S28RyvMuWS=CY?`U3EBL3dl
z6FuNElEsKA9d>KR*2irY`ZElkFF9wY-FG6~b2uWejgFL>vm3UyF!D&9HJNJ-hY%9_
zx&ya-+Z^FH?mp=^JWP#_ETygdjv#+d1DeOMqDPbNe(iTPf=Z{VD<py(W~%#Qu7*>j
zS(3w=GcV`}r4}fL=OsLJ<-a$q<Y!b1Ims?<A|VWa{6p7VVMP=lK!_5da??8%y_T1H
zy1JdVigWD#ev2-eNpq){ls*7PO{|~YqiuhLXYJ^?#Ol!qVZXcTS0MC_&h{X&wGfV1
zUzaVn88NL{TRZUCPA^8xfEvX!W3A?8D*{Xd1VfV5>Vt30170oez&%JytM4xBaq<5z
zG&?gOhTYV4!zB0)|DNh%Vd}<T8Ry;VsHJ`|U$i9zcCK^dfMZ-;ww{myVIStpppwMo
zs=n#H{pRwh7D<Ha+WPNPZnIloT+BfBu@>q}t`=dryLxPmwgG(*M8G=qm^PeVvN1B}
zN-mC9%s13diR5VM^8Fb7lxdvd<GY#dVYydJH%(avX87fOsdt}x4huP%(rKr*v^ifj
z_r*snzAt3OG^>9Vh^Yda+E7$vI4Gghz*7qLyZ}LKJqYibtuxlV`D`k*82F_bdXCh+
zrU!CIXgN<95DmqF1NQGG6bHm6<*ueghUj~c8F(%#Gvy(tqqw%atV56GXP-G8I5~|x
z5SQQW`kqp7+mUjN!F2Pe<J4-SPilLvTLmu|QP2@7?;)r;r>^(n!%unvB-=z7XpFl?
z{WDmP3swE|?Cb+oIozzTjY+>y+klX7<}8D$ouTvA{6lNM`JJ05IEF!}pbY{|EqaXi
zE4?r{JIi2KFS7?e>bKOgPct4!1mnLX0@@8llR+FOOiwEs>6OCV0@gG(5OJCYOH0iD
zE)(2ceEu?s3jcXJEm}1^HW>PAkkf4Zg4UefgGV5y`Oky&_YTFNv6pOgUcla^GYh}q
zWr{1IMNzvYJRtZe;k_dnN~oNDLwn%T8~-9TB%=w*doT<hdkI8aIQ73@{{_V-2kQUt
zCqNH5k{(&p8g?=gz*@{US|;>138QA6ptXS<s)~05-!Qym&9qylLDAx2+r?Qly}9?-
zv%(-k*IhacPsjja;Y`khBvw{WV0$&XfA>>85~_J{51hon6aVmM$WEW*_0Ge;WbvbA
z#~y~k9%lHRz#tcZDb%C!Rm$SpH-@}d*q_jm0g;&2QWK^j(oMXdk~e<ykrvq7ds~m`
z?_`ATA6wy(KK)I;EcjV;?QTLmSmz;c@p7N>(1W10N5LL!`hegcD&Cd}fh5I(T*6FX
zsvwI-@m|?xo};h10#%ph3=}SrKxyNEGkHGfx46;E3K#O7a9<=<h7&h-j)L`fS-xcU
zaT@^%D2?St07D=>5eM1?FbDzxqJ8D^to}(Zm6f$T_K{WBilz`I1xN$n${0c~7Xp?&
zX-H#(agCfe!QLOeT3ogVPNp_D5k2m^rUD^Ch4%u?r@yNT4VAbcND@}-x3)l(&I7-r
zRAnPYrtk7+6aoM=|B}3MX}kK9%m9Finnu<N^+6{lj6QPKnXjB?)u6a~8lHcN4Gjih
zXWtOH1UEJFC=DEZb-|RX;2B{Yh6sqBmM;5jlU<2kzy8KKU@qB-Xp%|{auKH=p@PD#
zm5T7z{;y}#JYw})%4uNxfaZFs1o^=5cL9GoI{yU+uvT5G4=DO(@BoYwgDIvRN9onq
z`RoZsCH{jN)5d_YH^{)2GGXAU=r?Rw+6q?3=)aHMKeD(M%5G`8<J@BIkEEzM^Wa_F
ze?bFrgxpL1NxJi~Oc+VvTmB0`S`G<mgwbT|FP}gY6k47Ne(2`ygC6sa@3w;`s`NA!
zD#`li9rP>}>Ui}pQ2%c)xF(Ov!Knpo8x!GI_yU08gAN)nW!L_tih(XiWGrvJ$Gr~>
zebMf><MR^qN1<!r2~;1wGzsh!O<J<*(M)}QdLv*7b64M30iHAiO_REQ*t+ME1bSbE
z@nAk??C~AED`fHTUnJmHa;L;wHlU@3;pxwET8UUDzM4^}F6hfYg&0FDyAT?}hOe3b
zz_-UVk832~WPyVf63+c6k?M8jhn9;2L!47<{dF;4R()&Dd@Z_{BcZxI|I&=|m67*;
z9uLuhtX!x1{76fT`C5BNR>`Srtt^o6zqF&-I@V0i4F?O&pXR9<^1;2IsPjlY=%ia0
z?OZPpkaPG4e=~-VORcpBNNkAd4x(+*D6SPfC^~q5dwZBOmxvD-y0Q1BUnB#HE&m_<
z$4-RsIeFc~sGHhR*2odK-u$Y?W^`UIQpWzRng7P5kaJ7TJd7Dqy7dp9UBh4GF_Uqd
zc@rzFTk1zyl~_Ln277=aPSdCK=!(b?IDmG>+XONUCh3Dg92!sQ^P9j}1FlQQf!Fe6
z57!M)Ai80@1%#ucgl?YdENIf2obwN8kLcWFFg41r=7O@oHyZSk_^t@-&&c+zgGnHU
zhFR(2kp_M#4V6JRl1yJI^P%c0_@3p+jI=$w-wOVZ@bmx>YodjjFnN>h8~=gB${Y^u
z{IY324@^dEp8PkCU%*ltn2)%ax_8&ePJVMo0K;pNdz?*Rc@m>0!a*h*BdqEQvj-XJ
z0F2On<0yf9b{43h0{K;#WWojwM(Xnjq?I?m#xD`ZKKwZ2^?t)YVR_DT-Mb<`Li=%|
zZz6B@Q~q9d&0EQyfB}+k@_2sFD^+#OIr=Ftl-T5m`+dl7jBgL5<MQ2aNhh=^Y1xz+
zSACg6V{a7XIhK~*H3?W9u#MEIy*n_x{!w1|=xqF&ag+GH8uZ}NR7T+cx@oG^qUQZ2
z^Jf@l>c``ZGLudgSJ#R06@FRGkgv}6gb*8(u_6~fvAA2R4kfZYX|QPDYD&%BnJHz>
z*De`Na6SM@fB4HzQ}q<IrpmBm1|~!I`I;onJigp6Wx`w*@{>9G{ORy!C^2p+`=QH`
zCt>uTK%w&*%nw=EX8Mx$p@Z*Ql*T_X8nQp_)~z3owQ;6!n;vKVXeoV_Zkp(x4*XUV
zYIz41R!zx$+LNR1tvH}UdD@4|CXlZ9PZ4$!n<0|?@CtiV!~a9tn}<WazVYL4DJn@D
zig27l*-zF8l_RH+HcNJueJAT+oC@bCsbtSm4k|HOXRISak}X+hn6YIyvdkD`W`56m
zCUria&-eSge%JNupRS9yXStvIzMp%0-A^84jJ#Ze;v=bX&DP8Zik$?y(t0mIw6hO-
zJ2=elQ?E}2#+4>q-s(;Wn;FCXIWVsuK5d0qnT)Sut`iQF6RKA7WH>Q8wF|aMwc4eN
zjOpTf--adq1D%ody|jP`pM$$VQQ>#J^$W-i8;&_I;lJE>Yq;lOtc@g4vkHtq^rFH>
z+?EqK@FK|7ug`}yh1(-ncg<?vIwnZ&xZ}kWV?3sK@ZNurBRTi-c!kU`SE}PuWYR+k
zzQfF+abgozL}QPPD{}}NuIsW!##*0J`|J=Y(5vIF-=86#oA)3LaVd0*|Hd~l<Y*vs
zr9+#3Pt|IfcMFt@*;H=1_A5aPqF!ZrsT*DSPESzjK}cWkv9=?8^)rUL*H!4_3k?`G
zFE88vc8<K<+i~g#GC^rMtZXlVzG$7Rk8eKt<WUx@vEwQx+9J8q=h=waU}4Q9@^I@)
zJg2c)MOlq~mD^65Pdj>NqZFuchcB2F5H_4zdil+2t^E3A3|dz|Jh<a5s+9f(sZt`<
zZQSc(Pjj=`i#~o&_Zz4rVVy7?*dLV|H%_U|-<qHgi_%8?W4GEor)M(zu!GCfQu!AB
zVk#saCyfg~mj~MabvAa5ZoTLAJZwFY`MhfyKw`o50jg)7Y+iFyqt3sb7kK?SThK<M
zH>fiqGivFDE%lY@o2$<D%r9?=xTw+npcxlzBf;QQ>%(%AEf-9DSL(hIJoGvf(xaC6
z7;{)JBS?^J%qvstaZDR@+k)-GUw~Q!v)_2)eoaCjEk?~T-D*AHa?A@cJ_&kVMAEM|
zM0p9v05!={q91@NyzNtJ-k_GbW?ZnNs$Ti2S9mLOAa!+z++3zcIO!p&rb})24+7o-
z468A<=BHrFrO#aZINf{C+Ft0Rs*%nii+&xGj8n7=OAjr@?uU(m!v{5bu<``(<E*=d
zp^LW)^3gE)j_?(FG8Q@{GLc6wl65w^TTE=3ujT_L=p`*;LlgyDFXY-p%6K;A916{(
zRUR7%R2=+f?mQAa&=*NLPf)5xnqM>@eu);JOVS{V1)qbWNB5J5=S=S-Jj$DvolbOQ
zre%%E7Y4ogWI?JhxVkp9J#+O!Zj-e)26XcJak+@x{uYZ&_~JiPq4@+SCbBW?X1hl2
zs1_}b^qyN<Mf#kHC{L1;)p?^Y1jIvlt=7wuCO#Kesl8Hnoa1nev2$V64iAUANt98i
zkD%G9M6UbPJ-(@&n1oNYsl8zkWa!CKhynn<7O^{c)=BI_A>%8bEBAR6V|-#<Mqi<D
z7yk3xf|e|g&crBRlRvHc8E?gAD!)yojHlabNJjwnYwJ;TNqZH<IHyeIu)@0yc%;Y0
z=;pcrsO!7AXS&;<<hLwVl7j(2BKx*rIu}lcOCEY3XQLJW2FXlEMPC`YP^>sVc66Jk
ziJZG}f8lN626EKA==+gwCv*ca>cB2aqt07mUAV@E{ZzACb`#g<xjFEWG|yrCEs&wz
zzjkn*6N9#<Ut0QbRpIE}^>1#>N2k7RaJIz8)s|cxu^g-qh@9uaoqP%6AIVms&6inY
z>+|ksR1Hs7Oh3IR6E>5PGK?r(Vbp%61$OaY<Eg>6kq6I`sLxk<!agSchMUCP2N`2)
z&ozQ@iigF=Q#!(R6Ma6(gg3Wex8@8Z6et6|k)JAWCDoV~*Oa7q+z%n8SzjDNVB~%m
zyl7N;z*^m5QZdtSjdsHe5Fgh52VV#EOmp1+9eBjzc)_?+>APl|b%K98xjrY-k{(Bo
z9*?0B)F1z8X-;~}u-B|7@0u-)?;vd_Z1p~-{k%&^Qur+Yw(Ck=?J_T7W-=<ACl4eH
z2o$Eaa-Vj=lwDe?jJ@NZ64!3~r&;L(>XR{f`CwW3U{nrXLq6%vSV#*a<^tJ%pi<B}
zC&`)|(n5CRM9r1UCdy{FhcSAk$t|ARlSX0UEa|B8gz>AVqi=CyN^2&|kF@wH(A5VD
z1d$ta0gqOD_9sbk*RGN*4q+l!cg_m-D!n0j)+{c$wdnKdR2%``{qwbZO>W6KFGGcz
z?4DE5J)fBEeOd#TBx}6PgHY~MPk8f-&vZE6X6$@D=O&=k(ZOx5*V_LeU>H{*9btg_
z!?L5=>Dl#;Vt*^y>&+UpkRv5?k@#Xza}mEls+ii~|7#kNGx}0}S6WAys)<>Bo1S1)
z@IY8Gt|M43wf(pj2TMPlyHpLl5{-Y3ff1vsmfpp;yo`J_OBGAMpqf#u9lX|(U!E6q
zn6i>EeWHGebz$u-pP1KK`n1igW(V<7=vf)p<l8ZIp)cbv=)Q;q2xD>S-L`j9rb3<L
zc~g4Vt8<-GTN`5>+|LPe{RO)5hFgDJ0CjMmKqTbYbr4dq5$=lQFn@Nv$*`q(*^JyK
zxFJW=&aa@PwuDBxagwip+pgn;U1lruDi&T&<ca`r#OC`>Rg1ij9gV?Mo;{uDC9W>x
zrq@A`8HqvfsjitVyqN=c+-sClwrLp8v-)(=Bbm!@y2nA!-&iQw<EgAu8BvA4pozZZ
z{ps3Jo@asGq3oT+nZhwoTJ#J53(_|6g??6x=3P$db2rjoYfqMGXD&xI@Uk?t9U8{W
zW$A)m2y^^C_O2iGGeX40&x>j;kCLy&(+k<h+WSS(#V$VT!hlS2qF)?;kCw}aVvC|@
zZFl-)1yAWb1VshKv}8H`F&;4M%>)d^#;uDgGx{XPUz+D|U-lB{<wd#OS@)Kp5j*3@
z#hy0{2A6h<10T_ymcSY3Zp$CIQ6ZQoeH*bfCxbJqs+k<#U#81e4SKxsQR+&7vKNH*
zH3Io9hGcq3G377%-f!zLmQF1CGO6OzcoQ7QkpG;MO68)chudZ9fmjoJGwuG5g&m)^
z_Xa+qE6+{tVzc>a_LieS-GM!xM4+m*0HGXe>6`~*CnZK}ntuLsUS9prE?f;YjbC5z
z<nbL|<@fe)D0nUN>az^7m*-&>X0*tM+k0R#D(q1Wa?q+#17LjP1Ga(u9ea~3_-dAJ
z0MH;flr?j{kF(-@)meF~kwh-fBs^uUkdwVZBi?vk{jb@};s!#la;9Ijsw&j_vpDdB
zP^&XQpdL<$zInfEio}8LpDYn=)FSrkubkv$M^rAspwy{Hm$|+5C=U&ED-=B@w3<7V
zML$Jm%`Z-u;JVM}+T(tq`0lU!)92uRvjzYOy*=2nf>q-8Hzv=#elgA0O=%g%dUSfb
z6?L3&d@*`l8n>@*m8Y=y4DM{pm|sQT0c({c>&yi0*6Si~J7SvG{%dBifBGN}6&$4b
zjK^c5_9jk_cY105ah}bwUEMGj1tbG@wyK)ZH1<O8c^gSCta=!$b&I7eOnVin-bWFQ
zy{>JQQoOdRh>nzbdZ5y>&A=-`ZeFzG36e?qgEnU;#cLpXYV%G|G*j4Dr1chON#wAG
zJP^S2{FK!WF3{qy>T<F6^yGfZV92$@OFh#iqrZi>vu&(h*VyU+^leTi-$#D)&K3tg
z(u0QN4?>b+4?j89mMp8xX6!lPpquQ@6E}G`)4sj{bK}smM6<Qkw|>Kgu)ctzhYqS2
zdJ*E4il<uT5f!)6)Uwmfnj8o>b8cOi(OtRz?Vyem+cx523pCvL4G>#IfHIT(f)V(e
zG+##jn4Z~{wiQPCVE%p6>}9j_6LKrp142xCu4G~-l772-C3_+Xd#(85atc;%4(#!h
zQ?KS6q2dlbz1CJ0lR8h=3iIe%Z>|WJly$41Y$Uv7BzT$7T%Kksu~kVK52(XB4FXMD
zVbf08u2ZJ@27MRncW2CCE9no|6dzN};s72POHYOXJ5J;%d!?OljStJd)PhZfeZUc@
zQ{Uwru^Ey8e&cCwxIZpyY<UgA*KNI_3_}t%+<=31!D#?oT<00s5jhwQEI-3*tm_&?
zu>m3l<b#{+fq}Q*WYd@4oEC!We&38j{1_jC6fbXjO#iP#cCL>}7X}&f?tm1n|N9Tl
z%*N$oMt@T|3f0~IpBV~t3P)p_zdVAV?*Ca*DFYKDBYIUAm>g#Ry@$7XZ0Bvh$F%iw
zaB?{g@_g0ji0~*ve|kGdjq$gd(Ngo6raj#;Tk-_qi4{75eULDWb-FN&EJve?J8Y+x
zL!k)yzVBg|9~(wEYWuwz$2n%g+j%pCv6`zvcAZ$}=snxw*F8CTx2nP>)_euu^F*ka
za6&bNbp6_Wfiizv8OUzuW;i74F5LPC_;6Z#?-a%k`|K+mPo39F<ZTwX@DR|U==InM
z-tu}{$LjU3?xjknTWwm(5AjC_3@mz75UEt56IBmZKLvbpB6png#O8E#*oX@{Wnjl=
zw?T&2|Az=tKudK?wSRe2cJ2`9g=dym;3#VO_ea!&RxbPdHO*g7#I;d^85ZwOs7fd9
zbs}31XykO8%ddxUKv#bRz(katp@5EWN-f9kQ7YEcbp8luwqwtS&#!xtG$LS45qGO*
zccymQoX(P=Z%bGl56q6_k7rwcQ+^G3mKld7S%0<AYeQ!suyapSmBKQxri=Yo8c%%2
zMpKMXxt4MGWnNa`1ttt60vcH*QSb&j!@I|a!`m8SxxB9%XM{;mr$(fJs>`_=Re;_=
zA8eGmB%khkVr5MD@;9xvnD2xup4wT2u}g93G!b|>L7FbV<})Wa#3`>S@zvst0j2fA
z8M)M&7xM1iZ%_vy#hjmf=mG8)vu66oKlO$9h*uP<H!PMi5XQ=T>mobl@WxWeC#F!e
z&q2eC3M*s=Z&q*iH!g3zj#!?=6b9nCqmjAE5dpf^tAS!v%5*_@$h&3JBW8^pP`B9+
z5&F^u$@Aytx$6RG&7ML>$V{LTwqELQS+*ROl94FueaVR_bAAiS)8`NM@O$fBwUFd*
zeYvkN#PUNm#dDYkvb*w=dj<j2%&ehIJi<U16FB7Wei(#!qc5r-syf6QZUP;Qes}AS
zhJqKg<O01h&<2`^A)tSkz$vezb*o2<sG7ZmsEZv%%UTn7Z51H9kDCF=th=CB;kJ=s
zZ;$Q7J9PbwLne@#^OPj)O~lLbqLwH()7n<QDQ#;uu>u`|l(VEO&&tZHdv>RKDOD<7
zYAu{Ro7sHDPXcQxb2->qkRei7Y`IXQJwqpzy$rGd4LoLfpw5XO4r~^<08#XA9VugG
zLu=$bRjj6RcKTT0{yK+DX6@?!7AdsN{=vWuYV)|1<*aoxa66)R62g~>lqVqYV7o!c
z_LCBb-Z8YqVfDgA&f|2^#MDNQg}8c5_Okt#kgsU*t+z`m)+Oa%29FB09#)P>YkAY`
zNb>jVYVVXqmR%>;y60ESOIKxDh96R@=__zde9YxK@JMb*ZF)IB_tRGBpcF{6oq(0A
zkUu1Nr#u|R?3t}i3Efz1nV;mH0oLECVo08F_7^j?d;9BLz!epxX!)6$clC<Ao*<Vg
zLZmJyE{T3Ivd&GOvQhD5(u@2`oF;d(#O_dQ*!p2JEC*x+wCxc%ppaDqyt4VGBgS5~
zzo~t=_H=9~@hoC-Wx!(A2Z&PIoqZAZ_p*)|<|JP%QO~4V;`6HnPN<kWmsC{BGR;#W
zhyBLxVA~vr^PRN>5!kD4HU8EQKHe={sWC;M&ZDlSwRsqKok&z_O(vB*sJP=F6P5!-
zaDhzHV_4f?iU++t^zeUU5k&#pDOfAohyE>?O0##?q0N6Ra3rZXAA|!!P=w=;Kj;Qn
z@0p9|gQ;c@<K#g4VjyXqkhjoMg4)GjYqHh*`UrDGjA2U`ehls+fTjVh(jS1FFW{|x
zb=FHcq@JC`UgKwnEFsEs?u#b1&DK(xVxYyTi9iz^%Yw45g94RXEFF*tE#MJ4mNNH*
z%^(ULOS?RQs0J1$;!vGK4yE>b9QX)CL_jY^_A$AF<kSMUS+fL1OB<N4?Q}x@i6~ye
zIT-y8LGz%{_Z&#Qbe{15cJ?sOLUwfK;p>oKZhAHC%W}d9E>^!|PC670`$MPmKp763
zI=C&E*tU{{GZtM5&i-34PPQSds{!PMz9*I1<k;@2-N5047XcdIe_wPtm^q9X#Y^P+
zR^N(}0EzJUYTyhU+3|n)(sQC!-*RuAR>;@Jd5UZ$0k%OQC>QiYKL{`ur@4)8K!Sya
z!hkwhA$hzExR$}MS2ox7NQOAW^N!FM2m(ytA0Pv$HHJ+A-mkzY=Gpuqi-lb+p}>xB
zPBOZ0Urhf3IxFiv?+4-~ICwX&LsEyDhb-i;=hYO+Va=}r-YWQhVxSdvpIHS+ed&YN
zPH+P0C@9Z!EkM-sD)Il%$Dpygm>R>xVQm#CZuwp4bD)IT?0wJW16x?#?Co4P7k&wp
z25FdKht~SiZt@b(=KJwmb%jl_2&t$7>H|N34QafT<G?rbWxnyB7-0HQZr<c0&RA^=
z>}#0>;R;}IfOdZ0zvJb=qiiT`<N7GZKfNpQg4WC4GFvdhaWJ9;m@6wFmB<#dTuuz=
z%9avx!n}fHz62YVGPzkB{c0Ckq_PY7!Qen5k^`2?kn58cBbJ!;c@HxkWimL{9<O(R
zx8zykFb&c>Y<4o*>YWrijc5T9^xL8L2v1O7JO~VIa9!o}uJ016Wpnk_&GkBe0h&4q
zr`4P(=Pv#%AJJ&po4}V58b%%4P6W}RSL3<a9TEyyvT<4OWS5cxn{?o!VDn=qxFarC
zf%~_=XanS?M}|EIU~Y`E$fMv9XIcEw4N`I6kMD5ZL<4$=%R76qtHF3T|9>y#Wh@6C
zgbUVI5w)PxZxsk0J%{5ufV{V3Hd(L?NH~cp!!3H;I($C|o<{*&PG?m8FEb}X@`h?u
zvYTk36~l%br1=$U$EFJZXE=~V(OUY#(*m|^C|~;x^#pBgjiiq4Cf4_OMjK}ig=68%
z>?pfeJp|jR?5%L|66;qUVFT#sXxF=2J??UOi_5|(*=SEv1?Bx84XW&A10~FsoO#tf
zxLMGT%;+pzpq(~(k7e9~9quyR9Gcx`9I~_96k*uHhBXE!_>aXozrgKa!4D3Ch5+p0
zcMv7zBhqlLJhc_z=ba!$&Q?MD>WqGe1ka);3d(=uz&3*4De`U}{2x%?AS5qV=>R8=
z!CM<Y7-$Q|bes3GrH4bl$2q|$7N`+&=KDFMifCOAFF0&?CIEzG>zShwZbw18Xm)Gv
z(}<tj^Yj|@65X&_iej!~=|Re&Q;B@UeMW9BK!+!D{rqcORX`UL(IAWtpw^pO#%}cn
zq=O*4CqEd?Qk&Kp1$px2W>(W_!WGs!`+0TvbB-VTZ8tp9@XuQu9sczlKL=ja@J#U3
z)P+X<-~IqMMuR#)$lHbdv{#0grcrX+iA{v?F(O5fYt8(#qUVu)Ap8U#M}hNgS@4rY
zBCClV+NJUl!fuv?#%3jSPhxhuJ)r%VBDjF23%=*rA_^<#@|EKE)f?GC=<u#yhDeuG
zLX=NyZ7JK6@%Ui?_oo$NoXB#S!JuwIt&;puAq=^Utns|ri{|+ekbVkZg7`EYYFS0O
z?GCjw9Qbt<VKMzALHb8Lz7xQD?S!nzJt^q$^>^SUn8kTDFQj|$z3z*5HiPVUb^~rP
zeC(})x76_qGJ@1TJdM}yvs(Qbh35hnQ1V$X>WbNz>NX#bUBt7CWLBu#@=~Y}?1I5o
z7+h^pcR({x4}Vw2i~30yXv#g6VAX1TBGx{Q!mJI#-@O$EPGLD|FD20!=`kXgsa353
zgjv&*$(ZpvyurAGs0QBb_XI>XoRP}2Ifza&Ynu0ml5D0WZv(#)kTemF_p_=Z!XjOy
znRy+jFc^^!VdUqr=XVi@eP|T5a!xdk>DaaMgq?l(QSM-;h%@^TrV<V!(^fm5v-VtI
z1Qt+x`?lOY4-$r6loN<wH=o<7rpV$KR`LX{ld!whzRi#ClUKCgK!j(0%|r=b0fmPc
zPR}KoM!L<4TjBP;^(eE&&KFVlln&5XvnsyZw9!wG)tk5~d95kz9^B9V)erOiwD70Z
z^$>~^dt)wdHuJHAc13-C3WNOY&m(_~B>aZ5zV2VO<v{}wtAEve47%r{j6;|pF9`qq
z)n=;6dGJQ5QiKw(1e?VyH(9K+bk*4jauT}0-e&oxSY(~2PD>f-?qIpm-R7G<fbwx2
z`adqmKrR(XhtQ^UL`W8#15L(WTXV8LzxpG|pzI(iy_@h^wM2h*FD0B$F!U&E8*o;n
z?ijcvCHt&U%yyt{RK-lV&HW@$)-z>|&X_&2VW^6jNx9$YoS2%O?<Ggjdsy44wBB4t
zyv)OOZu93JzfYbmv$xH>$bIsUJxR47=`rjYJFzaemBk${@H}t{Mnnt0zGg#VX{1cE
zY5AbzSJLy$%<1LzMm*vk5;e)tcE*ZOf-m;0#3N4f0;_;ESL$Z|9{h3N)Dc0Yjvapv
zy0^@ZJ?YCcd*!jK%d0so<0{C}{nCA@{r4U-oI_-oq8ia_#NF%AU9LMywYfhMQpwt^
zCG^c5DY5VK1w#m-L`n${X{YjB*IP<OVq-`Wf_DnM69^%<M@kbM%x2rjHu2hlN*c(H
zs$xR@1n@mNBDHZ^1O%$>gNgq!ZTlN|xCX%+6fKnF!@rVo*r(3(UT#Qg<oF<GpG2Px
z!p?)qm`#+gnmfU476e*x^Q7#28#z}VgFtELtEp9=mf6o)?vH3iJ)khK`=)8xBEI4Y
z0i`@{(O%=kpx*C_JTv6@RVyZ(r|(6&8DA9A>-R=`$AGFnU#9SZ%+4F)rL0PeEd?zu
z+<c-JK;_9`#iCp{*%o2v$7Il#YkNS+$7Xd#-FOW5)RCl}8EIi*&k(0d=X!43efH_~
zPU6?>b&x?ZJ%P%Mjmdkti;1H2+?nJSP9aoPd|ED{ITYL?yjdAYQrd<~kMi@YeF4%F
z^m|_Mg0&);1wX-iUYd76i(g1FWm7T~D@HliKe$iv3s%>@i6pvq{_?85G|{alK=&&(
z&{5PFm!5*nqo52(&8Esdw?cAoznHD_TXUc-zR{AoLhf(F)r{o-J-T1AfmLzRz1K>_
zaA9qoyPT=ng7X2TFJ#`~VzYXn%=k<Gqo#$u!IF-2nIPHp8^7ta-B?FQim%TH)vbQ4
zmG@ZYC#j_cd#)K-9`Bc0=BK$75YdV?X#54wu+NFLjum!QNnt9NfisO+CC>L5>aGP$
zsxiZSDYneCdFDme?Sb8G=r217HeP);=uzR_kfHge2pblv3w0cL`f87-oc;vGB!31y
zCe&g5*Nm}lN*H#}Ym*^;dF*@|=Y~M9bzYe`8a}!$+<e2~0J*~;Hwt?mmJP*ua`%Qc
zfTESnG7!M@e4YBaSEUP+s<juE2j_b1?ylf`VkZT*c^gQ0loM6bYOr#@PonM!D@Ry9
z{Mb-hrac=kADBGP)hJb3w}RL7@XgDr4xd+u-cD#QYn88ZZ$cl2lCw7TOR|+uoAwE-
zibNZ^@+(X0m?p2ruMzZsQ$*EWLXuI5nL>UQ#4v#u@A9(ne{u1Ma1VKcGzpKPF{Bne
zPkg7_GKsPk)(FMb3gQ{`a8Pb@ezV+)Ev^mBWldf}J<`d*MvM|1w*tyyIcW2kCcnuS
zprwS)s>9{vWZS+oxr2DwH914widgO0nl#qhBeL>qMsR=5YNPWP;hM1TX+Utv0y@u#
zSw!Z)Q+<(sRWq?hTRtdmLyP#8dk#I8+F^SiBqVNA2VN<4%MgqIBpR0bt+#9}m5Afq
z9ciX7Mrjoel(w@ZdI>E6c+guwE??0eek)9k;5%D*7q(gzpZ|-6ot=UX3_9K(;ddA*
zYK-YaISt>eA!?~cO`%Ij*S~x{F<X>^OPs)m+(N0Rb!e#xzmU_{MA;bRy|ilg=y3I9
z9-s>pPGpqe5!M6zLG0OPqRx^wK3^`-`_EE0NwdS&2cJ4{W-EV46&YQ1vHY8h@9C3N
zIa;lsM8^)?rP~wMjG5Zl;hWU?kBr)a1Jz95uT;0NaH(bc@e7&r57}G`zas!Te*Dn<
zr3Kiy>~(R|py9cQ)<fg;tA4ujJh0OEuc9`Hu0_P$l4d`I_OoVgg%UCL<Q3bH{aG>B
zN#J~Fkjs81?PtB*X(XSze9DFHeRW|gi}5Y-PPPM{Vj;w*z#hy>-y~@SL)6>qL_(!#
zowYA$hXP_T@znquu%HEu8p!!a+%*f!eK^T5r;y8=R5@$zJJzLiJ^{p$&db-r@8A6_
zUidzzHE8R;-rn5;yo$sx{28<&uV(_l^j5aryr)3^q*>zXD+Ay%p)E1ZxVQCg4NntT
z@$jR-{{n+<E^JR-B%*?UXwt)cq^ABr;%3M^0C*7JKY>dvDW3U$nP~emDgy*x|5cB<
z`H4z|@QSuqgX=6Ee#-2${-)mlPG%!eCArX5o<^(opZLFwAOR-1B@F87CF%d?FF=GX
z67e<?QB-EsO<_HyCbDVRLhNIM-#Wu1JQNm|Rsa6Kd;y+TgY#bTzrF#9Kz6+v4`3kn
z0bjA?#Keh)``*}sd0V(i2zfxS?^O55xU*y(DB`x7;B7xtuaOGshFKMFfVaR3>W+#g
z`FP1zDK=&r<8h2dLdvHxo|NY9-;mBFwVyT1PJ%LC;00%#0zr%3tzN**bwH%2;-$XR
zbNN?R(IyzjGp@DFW>zptjtt~z@}yr1CDm<2J>X<XxIYe`-0PsSOuZ+dKY11tiyynZ
zaPpQRfTX1-f(jv9H`ySbRt9j)(Kl>?l@swWBhA}pD_l1V&Z&Rir^586VG3`QqjXcQ
ze`3WRe(sRg%gje!YP~PgM@-WN;_S6XKhdK7E&gt|9x8u?2t8RcJhqEd$`lyWe0ZdE
z1zbyP5SHQhO+-H)aOc4CqMWRfY!zW0>qY;4Nt1F|5HMl8k-EZ`@r%A-0f4LxqDlAp
zJJMqVqOL4UbQo|J_E;A#W17mv>tg)ms^)#pq#YVNsC_&*bjS>yp}NgGlbPle??qn}
zi|5W*r_KLT2rw7GzZF3&3M5|k&qN1$(djqio?T>YbcsnK*O+wBmkLr>8>!y@Naiz$
za7>Z@w2y0buQNSRm}BOcWA;wYOxEl9jq46yT_1WhAl`R5FZ?aQH-Kzg2|iVLGKz34
zIJ5_z87`HkjW4%=LhH-HNQ}2}x#YsKK;d6-T`_1fQVMICNy%q|9P+Z?rx`k&M6WMf
z33r(8xuIv~+~$<1mS!1_N5r*#S|4vNa_H9m+FYAff%PJbikVv7)G2T%zbSzhd1pxa
zwu-MTAd|0mIbA_dP;L(UmimQst~x8f8~@!Ie$Z@j&1-0YDP8LARSvK_^3}~Igy2e2
zas7c5xHNkl)SHLs!x$du8GO8$#iRECFVnT&;>LVWO7r!7t~<Wf$faM&a%^>gmNKE6
zv!SjkeAMIIBngpd0S>~@t*gDx&EZ4X0sU1@%!~OCo(7e}tzGR|-trV1>U?!h-{)pE
zUmSSdt8Khohgr+hy|^tCF8W3;cJeg=cn=5>y#hx8mvbv@2bcvY!f${3eMk@ljDQ|H
z=VK*c{Z8P0S33YQ4K8sQ3vtN_%IbujDm(}ynZ{n8a&8@N@bLVLJwLd*=098{qzp+-
zoA~I>T9v0yj~Pg0-n4pq(M^J;!fUAM@nj2Th2brRVSf38#3z_R%ZPa;-@qRvZY9I>
zzq9*W<^C^@%ADcY=HoulUry)=zI<DIL-?ySMqNlYqScm~G#uwyMD)KefzyeB3f(O}
zrc7;^1f^%j_<jccPltTxDy#`&@*DHIe9vA#^E`pfgs;pjE?=9iFWD;cV2@AA#pPt)
z;?Lf0wG>jyRQ)9vP)CuvZp3%;4=9Pt&YnJchXtHE+`~sSl^J$ZExC9<W%YvV!;x9=
zevf}f%2$Q8e_#d#*Z@v2Sxtv!&u#Fq9P6n-*Iy>}BH#oj;OxsHNiL7dyJ!@{7Q{c#
ztwPEy2d>?pc1v=7c(b*sT)3-!TDEl%!->gxg6-%tZ`QcER>^_CvEY|#5ieTD3r-GH
zs4MC@U{}}D5f3RWd=b!KCl$7Q0S+cmat~%OpNu6=immd+e0CAMpIi7z9(j!eZ$Ucg
z;9(D+R}~LY;6?fw%Sut7(&cb>|E5Jy(y$Vo*3H;P0@$y?A*oDMwGRH+0t*rF<uu@m
zRkj|;J|*9sk2{M=97f2AZEsBZZOZDJw#be3wNP*{JqMnS9b9heTG)c=`82!CLG-<~
z^JCG>6<8LuO(@Z=gvt54l*~aB7(~YAdN#BRsI`M+jA3(<xcP+!45kC2@Gm@6k=)3~
z8vDC1)d#I1^q~ZTn5UKyu;Xw}g!YwTwNh#!@?8~-Ie?LJ01O3J<r8Tz5(=bwmw&CZ
zlY$%B!c;$;^lu#0M6*hB(fyRZPmZE-N^#NoAB*jAhPSo13QKy&WOrF{pi?dLa`245
z-5#)xccO4o)b>-TXF67+uod8aU@S&t_mwC+&;Fm2od&sR_zHO$*V^{U?I#FIPDj-4
zaN01*<A{b%qr;>0cApXosmFPeJ`%MTK8&wQD87zXn*#KcU=Q<-$QTc?qY?N0Xgabo
zh{mCM<<NIk0QhkA%Gaba90FAQuy@8Ps$NIfeQ9=3{oO(~_#*j2MeLKwe@3njA?ozH
z+E2@fX-w#1Zx4w7<>tEcquogjv8}nYrB;g!H-4NpVCjJ!79<EVT0Z~#nQP%(X%+OM
z;Yp?0!>nLmmL9An|Adh=Ko{iBV|I04ZR%=wk;eV<ru!MaD3BF3j1cGnyaDI%zhAwu
zZPllbNmaFK6E55r`)@c4+cc5@qst#L)D>O`JDB@Vn{k_vrp5O{1P~AWenD@+yy7Dk
zKezmx*Z5F?eK()^al1c(Jf%4?l`!&%U9V!sI$qdLIuEI-aNrgH`&WOy9=p=5F|gHp
zh?iJM?V!c0)l3^PwS}~Av!DI0Oap9E$ezHYIVTr3Cby`A2f>X%Ob)O<CrF@x)!P9p
z)9}po5_nB@!FyRSq7@2cC;<>gAnVh>Mi>E2eh@Yt=~~d$S0EzPBdqgm4f32=jE@Ho
zllJhA-O%TOh}GL!u%dMYlzRo-$~gt(7B3yGA`Uz^NvEuacR$EBI5c3|;AgPGEj;(+
z=YUp&;k1RZBk2!)@c;mWx=&KC%%eFQa##&-m|Fhb9?60^{l_A}`)-5U-pp6y3-KLj
z)d<>qG((jN6o*=|7x@^FL-27wKTwA3#Q-P7;-gN`6n6`!F+B`)+%^uQOpnuTPY(2J
z!wCgIk9ZJg2NE0c>I)f$5CLG`_)M&rswfK$g$Q72R(OYSYgS;uCSQmL8EY7}^M~h2
zGCl(Y$El>+S#vk?U9c@Md-7J6)If$g=Xqd+VZNr^gy$BF;?OuqxRiR*fH@EWPUz_7
zF&Kdd-G;>$fcYS53GC73@-OxCu-W|Yr75?tP=n&PgiRo{?^?_FsOH1+khK3E%3nO9
z6$}L^!zWS~Hfo8)y=F@@P}b)`-VZQj-8Gg1Gr%(5KcqE)u7xAoEacCN^2_YgF@&3s
zvxp}MlqkbHbA#NS12QO%C+>OCYRSL5v2j(v=8#O^JjZ<2>Yh)C@lk@@Xko1D4{Y%t
z5JP2gn!i@WtScOahxY_bBNn;Y?hN1uP;Jj<u=A{9b@;RezpsJq+`!bA|4vj`;&!tb
z)@t)SSUwa?QVd&g6%*Jw0I+Evw!qs-_wW*DO4Gb5$^sPsnP<HR36^5SHVy2gW2HlB
zqr7T6tHF@)8Z|cuI=8pBfIcC3&l=1Qf$?}Ye-W_1TI5vFG3v&u+nquIHG((1q^$Fs
zC$Ag5TT9)2Er3|rv7=%TU#Ru=D+p46y~0m;vvz-b_T60?7carHcEWU|_xG*dee!Ej
zobcp7R%IP9;GhJDCQ3cm0zkZDd%0v5ebNnOxjN4U0s51#98TxK7tb#hkULGQ%86df
za^~0^!{&J8De~hj2c5UndE#$(8|ffmWX|h)7W~ND?bpFSSNFVGcVx|la1r<0)8~TF
za%kR&m{lVk*{0aJHDai8BuaR=pA_!hhoa}$<xhAp%eYl3B&=r(`Vh?G&h>`M=5;;q
znQq=CUn@P<)j4)4bJ#tt@9{?CeHZ(@w1Q|V;5oLbOU`a?$l$TEK2dYGt5xeAsO!ve
zlgtaLuE=$#%<va-v|sOe!ss9CRW25BJXBr_dKXyeKw!A6F!DT3EfB`}@T!`nazGC<
zmVZ?onYpN2VMmAHWd^vOh@gGY*WO11Nr!Xo!F!Xv{qvqbD+-6e-cM`J1Ncl0c=-%~
zT&~2i|GbmKr2ACi_wj4M_~_nikQ0d$dJqX59r%~>=IqI9Qg;%|6RYh1{k!%bze~My
zVk?rY4b_>0BNZtU;E%TSIG+14_qj6tXvCkAkYO2L_~P9XBO{#(fblT`IEC+D9^~h?
zy5GwOaT-C+C>Xq?%3l{5(4{AslCTxBTY;~r<k%R_!t1l#@HnMcw`1$W;OElH6G^pr
z2+E$U-hTT-NU0Lu0{wlPtM%wr@VeD)p^u8ZxyE3Wf50faTa1@6&TKM~sW6Su;-Rhg
zyl2m<LlKXGm8fx4r)})bDrep4{m|g^z((AS?yDC~xBAFfdbH<lgWkHq_uxN(Se9&h
z91?%O)2zZeWID&dl4<SP-Q(#G%n4UFd%DiX2ww-!1O#z?1#2_ZXd8RM9yY+q!C?Yf
zJ6GJgyVpfVM$9NTyWo^%VCEVZOAlB-zPQ}qJ1sI9GCRrC+F_Tq11g|MA&b}Z`b07E
zT~TheXJ9>fI_XVmD7`oIcZe$$QrxjA*;z9B4o^P0mj&gwd6nhZSPr<l)s$zfd;`x%
zNb>h8k;<N2ZwmFQP>Qc+k*V$_8;00^zwRHAu=6KyJWq=`Ow&Sr^20*&!(LMe3gzzf
zVh-#6xRP2E)=X?n4_H7aIa}^0W@yLQ+b$f|UZ<+#FnmCBF)U;ZP*A1wQyPJhxU&j-
z2A{^N+$cda1pzn+-W349!Zr>#71hI+Cl}(%&Hcqn?W@=0lj7S-2thUJAqx-3N3Jr9
z0(d(3P_(L~+RW;uL4uTrHMTU8B7ApscydhJ7hV*=xxmF6Kmb!uJ!v1h>+W!Xqc<>f
zeJ$V@f7)YPjXqI2b$kKKP^)sKh|zn-*OW3Z4pxTKErOW0uiIDHQ;+PNs-NVikzwU<
zIz?waTPL+@>7xvxw>**2UhXsG3;LzP%J%)<+n%lsW%l)Nq%yIj&_^n{duB(P3F)Wk
z_15Pt`@F7=SebXct<{b49a*+q^xy*02w_V=Miq4?UcdeSgbhL{@)rgn7R1Eh1&z7e
z(;EWr%^$iE^06N+4D;Yd`xeNqnhO#9{#jMC<@_s2<jPFSxSJGcR*DZ=&bVhx*;rNB
zrQ9=agCYz^`*;lx*S<~Xyl6Bn>H|}T7$^WiV=4z}T~ChsS$bq&yt9AdvOw-ReCylk
z+UD?+)aayH>(!q3>nhsT6TJZTP<TAF-LH1_-+$Zp*jGLj_r_0e;Q0}3_2kHv?F5@w
zJ_%-5XZvym%CTShebRvR0Lfj{<bfi-2|XA)cJkjKpbPecEgBSrn=5^Au%7WU*jBy!
zGEC?Q!gUCG&}Vl`|F1=(?NawRe^Tq+_P9q!ufM$DWD_)Pev{*KLmXDqWqIA`EDtR&
zYMVYM%wlWl+n~B2-g7?pjsn2XiDek@BYR4N@hLA}6-78&`WESG?xPH=yv>OY=>GwO
zeUxCZPg8w1GN@vGra-dKYaf8*sJN>O!P?bsyFrbrC8+v>tBsD+)6>E0CT~#tA;mL*
zPiyu6;067#bW{XH%fjfA&jCoNnKbmRMor^a_-_wZ>`^ROwMc(O82hxGBsE1*{E4p7
z)XW@ce*r)jiaW+mXMOlKY4c{6BjZ~_cbn0ffu+^7dje$R1gVbNC)H!U%{TP7!aF>I
zeoAe7skHpw6+}|^uON~Oq&`DF^2_~J*AAb(=m()6Q*GXyTis#+MU=;K{`sq!c2IF|
z&*eD!V&!9QT{R?S@=1rzJ}H_QV|x5Giuom=YKbv09=AYCLZQo11hMd7N$OP1We1)P
zT#>aUDZbVzi23%}+v>|+y8R0Npu!Q9GXWlq`1XOz`+3`H@Pgq&MLc**?)n4pmK*@s
zeD<)qoeZjHPbG51ScQ(+O8B!xmaLBqC+?ZzAuv+<bl>dJwytF;xJH^j2PA9is$Xgd
z`3Fb|_D>S6yi5%6!z^&sfxQ9FNm0}VLJ!bL7cwVv#d|`oi2zi2WMdbR!kZ>SRPj%|
ztQKMU_YAjp$&vMR-dSa(_l&<Ob|?KQLvJ&eAL#Ny2bCuEvNF-(<mclvUW}}OOUpCH
zHWzDsS4Kacmf<Z45IzT%KrYUCZe{X|V7bm*bfxF15Xs=lq=%sT1U|nwI7!jY?c?zI
z_>S&h3XertJ_xXpNGjjsJ)xVVjE_Og7CjCQ-%b^f?mbCJq-}^cNyIfukjkD~Hs{>&
z-{leh7riDC5w|)#=0J0Lg|=0bE?29PE9s(UDQh-PS;hKW<@ZZfQJ<N;ShiPym3ZgV
zJ>HS5a?@YJfn49B(@3FOD?7|wBVG9QMKr*2Q{C+m^#M7!gXL=OlwUyQX_W|E-U6>S
zP5IMKrV)u`dO*5OZ&LS}y7X=$Tu5LTgaw7^olnaWgEN)kN9St6qjRn1GE}Vx2BHQe
zdU?t~?OY8JL=nyC9_KVkch&ybE;!licXII1Yq>=C*$_`e>sip71Jym>Qmg$2+0*0N
zT0yVQz)4lnpT%B=?Y%4)m%7#Re6b6n;BA>(mvqAC#hyrIAb+X&))n|r;+89IU1jKh
z!A>wwk0pRI&Fp3H^qhv?nD1AWfwwZ6a$^^6YmcY=9bi+GSo2y=_=BweB<k5trgfbB
zvwcd16%Q~(%G;TuVnj_s!Ofn8K)smq<A0zeaZ@F8WuMmDzcN%U-y&7Bc~IuK!`@-{
z$=#khlL^j?$CWwY%jGhNVk(cXk3P<ex2La3DM;#P)*Pu=E@D2i@?i?=3)PkR)5(>Q
ztGj2#%8$5ryj{?sZajo@I^d3~>j!wFUwB=Xy0_=Xb?AZQ^_51i4vTkg#b&h$1!k&G
zE&g6Nj!)sT%HM{KX2Cr0jx8kj%igB9a?#a$3@1>hTca%ewzbNypK^S`gL-y9dvyBO
z*#&HI(eI~TbW}KNLQqp<@ZKpYVeg!IEwsq_48(MEi)YQ+m=pT$3seT?)XBvHBzhJq
zjGa|m5a^Y8V+&s}RjY8#otW0f_(Qlk5xi3K3E<L&yqn`U<mqaEwe3FW)lHOeJ6Y)+
zQoo|2XNGUwhIKG$HJ4kXfkrw#PY46{;a=T}@(c6092g4oN!4%m*^m=YnD%VtEY2(a
zqxRhd4gemA@bR(Px_*2o=5u}<j7>b@D*k&2LqG3HY#z#3G<@mx{P6=cBfbIhs&J3;
zljo5WkrPo9alg8^;*jGhJcS{^xq&4+fC?Jf^jWH&K7Y5M5$_hW1yelDE111>x?sw+
z07Ik-hh=11qhjw68sM66P`y4L81RUItC*^%!SB;)Bt%+M!!m}P{8T6|>40`k9fu%0
zD{#8uAGZ{i*3eU<(RT|kTltupZO{7LOI|gw+}{4tqHCFQ0W&JM)eFwjxWLgUaK+fY
z0hP3mxUB76-_Ko(R;uU&o!xM<Yg!LvL_r0jS{j0J!7KBge=^EEuUMveX*O}lspNlV
zeZ8e{j^D|CrWuAL4H$UXV#`BTKHbM%H6mAyem{|nV>^igN^v>e#)Su}9UmP(Ml&)p
z2fY_|{?l}F+XQH^5$Wu-mT1CXmoRj*kZ|DXGN65KE_j)a146U_p2+j8OYp$@5+Bd!
zw?EXO+yG8`ZZFCRU`Icad*FJo-{(6w*_0o2^8-b}Yv*+VHC5cU#U;?m2ezq!`Z1Zy
z%+t~}XFbb^@O9*l=fJx<4mtTEEep-_{voOi_?yf2JL%DGSKMGGfa-oH?8z5DXdATy
zvt-}*1BC=PeD6cKfKE}`RFJjc69MIVEKOAP0+Kgx+embOS}iGDd@Ij<7t)wBdyz0#
zdXFciZ<kPAV_4#2UT6#)@9XBz{w=oYsxvY~RUT0SxJgRDE3VIQ!wFOM-tz5Xjsx>)
z9kNcrb>9yec#qEYo}7iDw6a+&J%p$dBhxup8;%Hzv=qX?Il8Ldc;K7@Q)ljPP^PTu
zFnXoMZK->YBWir7eaD4TB`b>#Eo3KHUx9g(MGMIuKxaZ1v=U`{eZUV93N^9AG%rVT
ztFL3)QmYNAq^4DZ=B`vC=T_0|#C_P{{mqSMEG;7WK!Ye<sb(n@66qpNIvMVmMa-X{
zRV(~&BooZ-ozf0~!=j{1Bv999m&2)vHFsoG3?aBlQI@;q%rfF2K*CyQ&XvbXNAR3|
zSs^;V3uTI+IY<s3x-pSd^Nfb*N^l<tQ%$lo720Uy{Vnk?7P9HVeQ;rPU^olI*^s>O
z$Z}so(R^Z*or@c7J?H-eu8Fm{L*i3^XTRH$sVaZ-Ft%hm#O(Oa!u1+ed2>|C@K}k+
z1}NESQn9(a;C6yIbA#514Z?KoVY3+&?&K!C^0BC&qyyDuJnUOz;;Pcj%?cYXE;_wy
zizty$EJ+<)af}eo;y(D`lp)_?Lu1a0>&kZ?-sIDA#&G|s$+NRNIcT4bg0qp@p1Qvt
zulPSHDtNGdKE_CDeI<VGgX-AYk&qZ{ys%VJ<{Q4&%fI7%$DIcsrXSle*|T4U^48O&
z=!0do>=Ue*_b*z-=KilgNDFi@GyM9k&nm&ukGfb%=<pQf4Tyte4N=_QR^4-iLm&~t
zMv!_Z={g9VoUS7E*#+)sV|hzzsgQRTp`>Bab$cJGBGjvPqaVi!Wm#{P{`mnB0qkdr
zTjwv&Q(%XNcy2!w+OY*9hVu#?Ro)N#FL+>Il7JzLN1eI*bG}6_U<%VzoF8=>!mf#T
z_714li39S+a`Em<Wo5BFfhS*YXH#h)>NZPpKY?;1fLGT#KhjkCjeqXu%UZ2L;;G(V
z(!je=t(#sF&}kX40iB=gyEI0VzrJK{iFJa@h39K+@6vy+>vSxs>Q>854|)b@I0==~
z!g<N@Kh{(CZYI)9xAY?WoBTh%;&!W`)84!-@bnx2eRRqh8h(TRrdFbmovn-DpVB|q
z#4W-5=%Qz$%Zhd4wrkD&gus?3&52>QxvjhXaOqFoOXBk_t)e7w=fBb(*_O*j7@&WX
z9yoV7y;7nzb67S^Oa>xCKL>QKSVMgp`y7Q;M<KGWqaPQW6{AcXu6~Ys-yQt7ux$6a
zPo*Qu9*QD`7$j7xEAVT2J5xt2#@{V8t^l-(dNKc%vo6#NbAAPX+omIk8k(&7(mdQ^
zDfPT(*j@ZhY8FZPHBw+MR))+0*%5XSvtroWw~*g4f#k^aa;}<-LV<E=pV+XrB%`TB
z_dKz7%2RU(Cgj{lab;A7?Tfjam%9aXU7c{%{mR?64T_QKDaUofnRn%yBeJ(NcQ|p}
z2&ekAs4n?yfH!6pDknd1KW(skcoHHi{>N<hd7Y@fLNmMuWo^Q3m9bA7V(4j!b4<xy
zFFbPn+l9nRBD|mAl8(w|>THh)n2K7m`SNWQIY8;x;J~}I1llqxHpKoJH}WG;ztx;Y
z-JtrsQ#~i)-)`e)^_I86XbU7eJjtQQX1-3}^RdE}rA2bIe7Xydm$JfV-8b&TsYcQ`
z$6oW3i$z=e(@6b{jmnI~%PoPHS2?V@#9CH($`A2zUSHADY!5RQQJ`KF6%0i=aNv#|
z;QMB^lCIW1f1h9s)ji)|cZQ!W2c=e5mZRiFRf}wwLVGdEs#&~~t^SGbnrQ@yu%XMI
z)E6PE4Fji6=vPeiR<!qmvazUc_uA?)Z?YgQWw_dNfFTyWtn2LGFdC{FPsK9hs7T|6
z(Nibsc=G+P6SHmT1i72xha=_<P_5rWU0b8nJ*6WwUsJWP?wE;<M{xsz6D}>}`%!<r
z(fqQkZq^stLG$3f%L{day5E<@u5~M2s2X**vy~Z|I?UJsCRG!uN^7AYi;5t3+^P(y
z!dx{_P`-ki?ZBR@TA%Q0^JK1dZ&4>+Ix2(jba;1}p)l9Yg)NS1Qobeas+@LjsR@&P
zN4QNrE5@M9N+tj0{yKgS85@TB7cX-w2S$a1AGoF|{mnvlZli8~>qGr~PBpbr_DbOB
z8jJM^%SPPZ*_TA?9FW(pn8q+(PCD1NZ%}FpR{=ry)}2Z4*k%<>pfU*foz>xUg&n28
zMp&Z5({>YYbkuA#4B${YeW2ugc0_T9q!@Q<!o40uok+r|j5h1UdySXm33f>;7cVwk
zN1@+1S(ax!!r7d{wsnP4C5674?jYta`|fKO+NEjlQ}}FnBY9VLGoq{5MWiI^qq}(_
zGk`&meR?W`S(StfuSR}TbQ}m76&1|p4YL_N*Y$py)4Lrrig3BAd+A|=D+j*#B+*pl
zj_<zL(OK0~VHe5^_lqe&#JcUotP7S~3PVXHV%SN)0)RN_C7s~Jd<sM^ew=F)L%0fq
zti)ofD)Fmu@;2|&@lU*qP7;fo-mh3Bh<O(8j}hL}?eEZ_&@`%u5~MTFH?ES7TG>Eq
zGX2f6>asKZk5ud)UMN3#?7H^xf$%H7&tiJ5ul4ymJh!Y(x;eVSag5%6EVW}<*<BU9
zn?uz??t2Y7ZE7FoCulw&5B#WpjgmS$QJYt}Jbxf8P{fN^#S7UbEy(@(tH&<PiRs0-
zDpRb-R&S$7Zxw(MhfOK>3s0(Q#|;=E*93%k4SIEUPw+n0%N^P9j_Z!`e;@1HB1FSp
zfC7uZR^~~>f!3BHCir_!HFNTxPp7Q@AqzLrgL;a+Wf)`kJ<aFniG0N%SjuHkJ9%I9
zzHULNR@F8_$Jon-p|=OWHWG65D-h8aTgdTvADMM+(RGon&|y#%ea!{1lPiM$c^+Wi
zfE%W!MIM&~)^f%+z@aCOs-U!{{a;)9C<O_<=B$ptGr#++e`gX(7kQo@uR=y9KnpL&
zsil{{1%*E-roT$HoqWMzm9Bx3<{7$pmVR<(UmjoGN%~uL<z;n>mH;36)Uk^8=(huq
z{CFXy`_3$q!RHpW4SRl+F1v2?(d%Y1Vn~sqbz4Xdyihbu0ZAO^t=^aPpg^B#JPe(?
zVusx)0P4|17bMx=9zSpH-XCMYK=tK&a+y^G@ET-@MT083<Ne_Z;7rZR>7hZ%k&hj8
zW381VS`(|LtkhkyDqR8Wj`JmDXdjZ>uzo<y=jh1BVK*FTkXqZ&O^|Aqz#S5h)qJoZ
z*d)>XE2uTOa;4Ax!>r3Yt@@%ke#koltS4tWVm1NGj2_@&68Ltu8X)OtOFm+1p>4SO
zNAMcMw<R6TU{`Ws8tQy&QtfJ{6Ed)5*xw4tm?*19_u10A2at4Q<^WcjdZywcq;~ay
z-u0rV=M!a>9taJ*4yo%Axlx?vhPfY2oVgc3iIA~C9=4g73=xh5HiY1zn0!sI_s`U&
z4(MHe>aF_a*1j1&Tf9t#)XU<TJuUgYJ0LqTa1UJQ<}eewWm3bCTA**tC82cu+$vzk
z>r)`#3=GRHg5+&KpDy&=E){Y0fW%=_NRV%b$$_;8X1nf=p2RKvX#ucf;bJjoYlA9o
z#iC~JgV&*KmnS`5bK}1~p~${+E<I3pJm$qQf6`tE>X)auU79H7EX3fM6M~+rf4E(R
z(600)-OE6Q8nljeV6E~+(Z~%K-Ah|&M|b2$-lmFYoinh>)XwBG8nFH7G}7hLQmn^;
z2coF3@Mq$iA|`kOVN?`BrH+Ky`}x&1)@(;qIFwXG=h_FOIKU_XMTP)-{HV%V_@;T_
zDw0}b%H{1plSIMd=@qfty!{dHYQ8nZe&P_cRDs_hGP>Y8-02{06n^ZZ=WY50-7@8C
z7w%@-sPlXo?R!7c^(}NDTzytfwS}%Wdt9&sl{jwG9VLEDY8gD6qFD&uY*6h3P%86X
zGWsL3hMK(jygO1`hNDgDF+gKM5F~sg;;uAqH>UWC>iA9EY!U^@9PU#ET`VSW1XM=e
zLPZi1W4cxj((XCD=xMw*^_&BXb=!n1m9tV3t)d^ET@~9qj&Mof%}L`rJ#?p8lOOeW
z^i9LwekLHizQk(kfiH+>xUYI!Fc*)Bom*12a&Lbo`@oXiEdF;l3|mtL<y$6$`@Dx3
z&viWfAv05Kb<0%+PuU0>)mW?Qwn&`T@@HUjm|utShN(}vZ0=q{HGjEW>W;ppCAB<z
zO=x(9C-HutN~(h9_WR=2I<mXZq?~-%tFz0=??Xb*tB1E3gW-)QT6;6w@)PF+E4|Y1
zjNv*wl$bT03Ii7h$ePQ|`dz<Gdk~eb^j_8USqCesYx=IG&HCu`y`U$-YQFG4Dtqg~
zRuz~b(;CAYMS1c{FhO3sjCl^?z+*v}u3MJHit@rcLH9MNf7kr4mvW3a%rpoVpi%mZ
zb^Z$an6VlF>!dK{hMFozEIHXWHUvd9Jh$HZy7V|vI@PUUepP0PJlmlHh~IEAe0(4&
zG0KZV2>Nz*1f=v~Qyr{qXX*XZ3FX_Y^172OMd~JI&CpU7>Cgg>z{DYC6_|?&*R4rw
zbIXD(_#v>E!QYqy1O0WW9PwjENiTU_<xpM0Xq8ToL%?b)A+=_@ND4el2-NU@ek(*@
zh&AQ*rmlO)M9{_rv4L*sddqEW;~fm?o*c0E<*yNL+7SkbTn~+iR!Wq?WDMX{OczL?
zL71b1dRZ}$ry8OzVH?tG<L!^-H^GMN77Tp{@d`LrkiGxDtz7u$9y}QB^)fFs7_SfY
zN0;{_0IPg)Y0g^BHYu?=6B$enL^Aox&SLzdvw_Rcp6ccKs_oZYEb9_#Yuh-iYQyzl
z(*y{S4|SmBYKa$;>E+h81KoZJw0nnu`vU%{u%_CHVW4TuDg64N4YryT%JkaVPylX?
zH~Lm0dg57|>pHCqlUsG0m0nFN{2`5btFjA{m-7#K$KR&=-Aw`Dt3B|6%W?E6*dlYi
z!#q&7!_3vkDECtl`Q1DVMNT##TFYK;{{i?*UXDIvJdHYF%bX{asYc|#whdov=^I{6
zG2QA74jiP<VYdl_?5@JodvII1U`$j>fpiKAhi$YB=+KZl-7(_F2;T-^%p?2cRP_KM
z1{~`WcF(STBrtU+;GJP8xVT~J`zB6|Mh)Q#ti^sXo>7<l7L)S5EU8P^T1_J4^B*m%
z2~SZ&F1Dg=s-_`W^3C(L^P{|ekWQu({7vd^%;$>F@IeVCDsQ~TWxE5LxO>&0X8D^F
z!-tjzo}p!2?PwRpd`lnTv!T)~R;hr2e$eXedB7X6e(whBgU!vzdE28A29p8zTU&KP
z9SSsRs5gy&GTIZsXrI4E$cTB)pQX$1t5X@7@5{85fzh~Zikklkf6){%t4Uy{A)j6K
z=$k>eK?@9Fg+f-`7kHb1l5b9bXOlu^Gl_}^=uP1nbS$(01Yx3gU11*_A^!K527r!}
zYv8VNoF^8@tyaxJ^426_ozSuR|CU8yjb_r8N$tbbHKh`@VWxhGSk3a^JltL$uLwYE
zm7;O0leV>GwZJU7b>!VoL5_is)`YY0_F7|RC{wUc+K9`;qrmn$loaIv4r;orHBE<n
zE!+O*Uu<&*GLp9Y{qBON+q|nT{g7GL&)`&kI?_O?@WU+r)Bgl&1D@@>C-R-O^k5PF
z;oAZdz5Nxirk*q0QFxQIk6|hQ;k3hK`~#42?+<qz{KWJhpj@{92oHdt$o&6WPEtbO
z5G5x=X$xC1oaP0~{OCan8@=W&8G&fXw$<`ih5jY_!EFdpu^sJOy-~>VrVj%Udv{rq
zU@sHpfyhb)_5F49l`<4Lo%g$-z~pMhlZT}w>r3wLCQ5>IAzLxP+-)%Q?eB+s7VJ1N
zEpA@5%!~j2o&UxMg|Jct4v~?(vun2$SWR@T23?Sn5fHY{@tt`9eZH(36IQ2faEN+(
z+!jnzNNvqRt-@;P%;qO&s<yuwe`tK$W_h7G+JhGpzM{skBk#wq>TkjDJnhq2Pk3%G
z_5EY3h=9H3`h&s?Dx?Z+Pq(_&?!MX+v`I?%83_IPQM_7HNX_@Nat2>w{=yB@|Nh75
zjFmQV{S_bMdj1^@T=%<3j*7-USySd@)6My>01zR}*BTWS8zN^&<pSIOv#5`bHlx8(
z_u5Y4=g#^3?mivgoBuQm!+{{cPrQIKv6W-{)4}-D3=dLGI4p3yapC^tcs@qUoNYD9
zfcsG05S|&ISxfGzJvsbcnA{%)?CnnuJ{XvyHD<a4Q>?gf0?}k0041&7-e38B<(S_G
z^@zp)G+blwk%BkYOn;#aOI^eXc;|qhv~t&m$~>ZFF09X8<ns0kTFK8tZ$axb=lT~x
zwHxbpEC0P}yL(%KsBh*UHp|1!+%Er5dtd$!_5MBnlH`^cZ#Q%ib)%H6y0$PRR}!I>
z$$m3QwvpY8B}A7SHN-7zRLVM*7&ORSO_t0>jD0XM*_X*O#`1Z-hP%AqzkL6J@BH9_
zdA-i_JkRqy&+|ObD!=?}*+!<~*ig`VwmrM97B^%b!p@+x?%M;iEPpMo4_g$Pd2tb}
zp2u$;glRAf^c+l|ufw~xnMV$67D<vsOYp?k>zd;HJ{rw{0e`vsKFk##WhubZ^=Y9B
z5i%+-SfXxQOGC~@OBTueg$!8#sf04|?s-n_H+orRNZRH|?YptG9k4kIY%xk%ER>w9
zQTz4x48iS_uLiKAO)i6N$n1U&Z9kR+KX&I-?N?K&J=@HQy-@uf#-*yw&{=&`V|%ov
zhkpMVYL|*`fLc!^{`EhwXNTHN>wkfq_g~n4mjkfE99tlpOGJtMd(@b<xrC_aJGTcd
zf(IRu-N%nPDkQkQ@W^c2olEDnQW*|*xzg2cX%<p7=$DKFu5}Jf$EYlp;2)&XOw8Qt
znUqbywHDhox|Rx0YUXQr_5|E-xAvwdgePdZy#I9&(aB>&r-*G2FWshGKWKc`w>u%J
zWA4uD@|nrf=igVmrn>oFXs@fWMEdoZ-H|fcW}+#9=^v-kWEFRzP{vr)L)ehECYvg=
zaUx{h>%G>IHdch1S^1h)?1h|r!9_t+r<5c^+W(;kpwW`qWk$pS#IL{ax-)>M9hEDR
zxnG*@lb7z+$hTA=p37U66<p-4Q^gvsk_^yG64a}lIFXnZbF*V{9vC9vb^CKiuVJ^g
z@h60z)ZT{|>@q$FxcfIGD51PU+w0!k{*L0JDRV<~8rwO)KXT-Rn-!s`Bb+8<RMbed
zrU~Q;R<kALIH%G!H#HTPw5D1%LnT@fDq0wcZ86pj<nC0O(|v@WnA=5guSk5SJjtVh
zVmO&x54d<#ahGXMTX}5Md&S=662@c1qFFtA_;jgO;(fPytvGKgdbpn+xq7Jok}-+G
z$I*@%te#(+_iC)#W+lv1c!}_$y4_v~g2(&GgxfuCD-=y=vdF7MPT}2=Jo}mo>l-vp
zovEu+oD#~pwi^Gt6xlpi_1OWh_qu6OrI5<?&#s;*b_8DQ7DtBmlYjtAzt8Kv7ti)e
zqTAt>yuRW<X+8pcC{H>Fs}^`K^I|9CMyEp^uN{I1FuLCX+_NZA&v90bSH+0v=e-9L
z5uK+~W#ZSWN~-ks*-bxPieT63o!<1fnGs-Odm0v{JG+<HSbq^njJy7zt@BI$t70N)
zQ4PY%!5(SS7~cyUY7~>M)33V$_>$)m6uC*zi6-L{(@#Pv;r?A0L|MM2gGvQXtjX7#
zBO=4f|AH+OC215BkB*$kmwvG0A0=yxM3m=RgbRD@5~7UBgw;oQ!{>G=<Hb8}hXvZB
zL^*cfth&hV7A1oLUz<(E9{GCrnMDUqMK@%g&@Rjl*HTo7cs6_UMm$blE6uZ%sS4A-
z&JjEJo_~`ABDfx>NC(fi8R@BB>9zkLvr^DAu-va*&6&Y|uq+zXCNko*O%)&r9PnZ=
zEuBfPkH{67AGb^4v&a@TFMlz%;0^*nZ$61~PwV$;4kDrruBS&XJU_`ucZ~?g=dbAA
zLe9N%Jo($CwkW)5Fahm<jt#rg3coA!%dx3m`ZyIlD^n{`V>mi7uxwgnM+*9KMGzj%
z@BEz*LPuEM?YOrqi^dI;{0ix3^1yA`b=4%D{!KXXQ0n4cllaa{R(m%t&+A}%ygqH*
zIH~7soyJIt>{PKZE}OoRvjdhDLh*C%%k`kY+xjQ(;l8uNAT|X8QdB`!O}E?SL?Vc|
z;7##poJ@%Ebt=+B%>&-<PF6IP5YrJ~el%%0g>Ab@#?(ajl?2CPN$8^Z(47s)FERC`
zENKjT9W@$kdUv)jca|$<yMIFH%+=|g{%vTYcZyuQ>0Pl=-OQOEGC)}F^7Jw%+ONK}
zpI8OM_Zm7><6{th5(_VeFX{MqXO1iyzt^gAEMB$_g*UIG{mAo!oJy_KpQ*mbmq=fW
z?L0P1Y5sRPNky(=E$GdM6b3cCVyau3X{X(S)KdtUE(vZda>eHvOuTlmg?V!b(!ou)
zRSO-$anh)ppQjFoF3<;7XA7e+2%Qy+g1Kp#=7HrnTs;po{UgEF_}hDFs!2!)p=3^J
zbJe&k&iMVLIZd+%FKXA(*ohn%l(&p#;HxZ=Nm{>3XGF1BuSEsTPk%g+Vx<9i1RvZO
zx2d@=`e`Fx;Ipj1=`L3Av#1I7G?&lPtNf<hBzF*(lIb<G8=dtP)}!ganu9bp+nwbK
zyBi#>r4(NxUkAC?=t@32iDEffFZ!kt_Fryz-gC)tAWyn^?}a5#tINrQcy!XI+Uw;i
z<A^s53698Q)CfjR;LEoVSl-v&JDpnD;phKd({j8X;oQp7ol3y9Ypw7)Lz0gp7b>aB
zSsM19vv?JqadmCM&dskPlL(kMZhXb;APy+d3X!L<bPmNe+OuLTygEp2{un>}E^!Vb
z4ptBHVt(CeJ1s~D9Rf8}_Hhf6O#cWe>wqtL34Ha1OHcS^f>!Eb4H^RK$WT3R*d!9N
zzO1ot)n3oXz~vGggWYQg*#tls5`X5)t?<6-AHxI?P~kH4=T@l>a1GdgQ<Ymp4+aGg
z7z#o_f?L6L0Hduz&v5Io0T<EVATkYh4-JN_SN3>=i}rOkuudp|7`iQFU<fJ2vpoIN
zGND0!>+EFb!10@&8{JpH<%tU-UH}0jtm<md%QaC>fg4I|QYCCnA6#(+o;IMs)!pZZ
zXjtg>N8MeR+SQlhx9IEd6-ukx(c3pYcz)v2kj*U5(8$s;_|jy;46wFb?e+P1;lChQ
z_37@!fX;G;tak+pww79va7mtj=AQ2cx-a<5lxu;n^SCYLU>vvS{paOsiMj$UYF|~a
z7Tmk;U({BDTh3@1^%;%@_9er8-(aM-F}nQ*?kjP+=UFP#oyO#*FaEU}(ardN#fX%b
zp+l5Ry-m-fLGNUc(qoikO13g7<Sq~@pBAB%7F*z6j{NWOqFr=Ut~qwk<DNP;oFd(}
zCCT+kwNRhW%gr!P<k}Ck_gUDQWlf&Hfd~Fb|7Td8FG<5;a26uduKKsYK|e3Jp&q;k
zw#X{fp{a-<k2t)(QqtmZ-#c3-hL_~{T8RCun|kd+$-N-iw$%=;hxK`+zST-f^d*wU
z54%bZ_e#_ums(6pZ69}m0;e!A%rH;gqO>x39#8erP>i~4#BJo($VV->xEN!?n=flQ
z5^TQbf-~=;yuk5N%28eXJ{MPL8Q68EO`+uffnvbz-G-v(=Zp7a8Ux$xOA1brEL6fw
zXpbXrjs0xWrIVp88h_NpPWwTea~p#Tj3u1t88p>+eL2!(GO4RgI1yCR+GdO4Q`bNz
zI2;<~S)3((!>BE=?Ni#(M%;mpukRYEJeKM@PHw^lhZQ>5jL8dkQmKsFdgm(F&-;$W
zo8R@-ekxO%<!Us5*NY1z6Et<c0<WlP`&oBTf9x)Yl99eXA4_+=IJeZ_toQC(j=S{t
z|3zEciNt7E)KKECi>U67g89_|-BR4^M8wd@K^KYEF=TUUWWysDDKXxnwr8BQ$W`D(
z3;BbC@5JsGi>SBruw}2~Zrhbm%)L1vDbM#VC&S*8ZWOdRbrx85P1pl6?@HbdDGe-X
z>vC`karghtlhJvv`K^!dj(vYa4DM{ExK~0f^=J>n_?wMxm;zR@(BRUaV$|U->zlO+
z7J6aL<ubEIIyh&XX^EYep|5fub!uL}aq-Bp*B!(!#9Q}{VPAmE6l(B7PfuUS=47dU
z!zs|c=wVN%O6X)eh>T7dFVCCUEKSI{rN?S30yYC!fN{kI`2(6%K63DwfKQ2olEB1>
z#WA7hL43@{G6(CtotSGR)>%z~&8~62<VesW7)Pyj)2(8J(+(t0g?`Ut(?dv1!*mHy
zEfTS>!1$bvslHMb97~U?yT}anRd`^nuGbH&2!jE0Ngg+QbUZi5##pl}{j5^@3d6H?
zgDiu)nX!YIjZy#EV+6D-{tG7qtP@%1gZ_0fj{~1J2X-?JUWUjEJ<E-Xwvh{K-a#k}
zG1mX#$-BZh+0Td}v!why$<A@jTw4Bz8cMv1z|e@+<fz}7UeFwD^f2|EDyIVYrp7^k
zzEroq-<e9&|M4H~u&)(;helI)iLGnBk{~2s&0h8&G1iS&Jg=R$S$$;zMLk=YUt!&2
z5!>U+&)0WDE=*f6_F*#`-NDnJ`GuV=;k#FDsni4VPsL_v3d0<S*WD-z&8ZT<p`~H{
zJ&XKua-~y+WKmh*^PnYk8B1*mnMT-KeMk3G4U09X$eq0S-?RP_jc<ucQ51+NaTJe@
zD*TO_09-CWij=h5-^@tB6hnnFVv;qbL9&isy5$x(_24AMyH{j-$Rz?iHrF@Szo&P9
zU4spA#a%j{wF~!aHO1deTS1l@KEO2c_hx(EP%`N50(v8ok`R%2jM%}&vuw<R9)=NL
zAIkZ=rukh<8oR{-8PCn*AkDo|nJ@IK_tl|U<n{ie8SXwIM4uiFl^-TfP2Wq7az(%I
z6WWQHjD$-({Vk@;ti*P_6s$$<PrjPU+k<()h(Y6Hra$i<I%m>aS;ic!(!VOA3<_Bp
zu-7mNgr`uUwU?VVYw^|SM@nGr)D0;4Np$*J>wVC-Fk{P-PHbG$@vIi98(7RJYz_Hh
z6!Imfe)V}umOSu<G?niO+l2y0%kwC^8Oqh36VdE*Ba9f9?6H7C`ADreyN-v_=2?^u
zJG57K*KX%S-CFmqh&&tT@yF+N986q3UwIo6_w>hO*EECZ-{Sgy0%r(%w6(*tP)E;3
zo!VD2e582{q<g|{mzXS&`XX2Y4t4`;(`@RBapNgUrHn0!JD5ig&NFA&?LqTZom7U;
z#%uyXQ?FkOI6<Kq`Jmt`n|^E0eI)e)=g`KQB9S_|N=Al<!i*Pf`Q)G;NChm=(zDT`
zT5J7`zJ?4L%eK!;WqyJMB*Za@Pz1;CRF&q>TFR&+GspaIl$eU?cBb(vM>d>Mpg&4Q
zte3dwJp9}z5q?T-ud}|x^&H3ds}z%^;3pvH3Gu3uaq>+7wcCpWGPdCTPzF};2sj3T
zHMrbtf3l`EFp~to&=&(|LwCMUK$EPZ(3PHDE@?q={3#{ofUVjW6;ouC^{9Q;y6ma@
z;S~o2hJNuS6aVM|=E<qUfE=)rLJZzJRI*U0QbPdXhi7$33p$=yvATwl6Uy}O)xFB$
znVjd&1XA_L0M<p^1a&hPW7VYkyS0CM1yX2ep?w(JF&qKn6#wUGIw;M3zG<yoS&P<p
z51iZ(gf-uWWX8<}fHa*XoOpn4k?F-vgM#V~bsQ9c^_qv=upI~zdI~rM)=yHosR|J0
zqw2>UKs`Id*iyE_3|?^w07)F(DwHO5YI|Oq+*B)Q=#k4KKF$0|63hfP7q)toKmZ6v
zo`yBNw9gR!4;Q!O&j$s-y?g&(@4=!r43vT7ei;oav_X(+ArO^mIrM%u1l(e$!EprD
z3BgJr^bol4G>E9d#RhRd^)PJn(G1dC1gwXJ4ZuYyAPL$l(2;DDV^q`i6_W@e2ikps
z!%ahZaX&l^^lbYfP?S|cZ@JOgStfAoCGY~llHm9C7NgqoCpSSlF}SWpfs+WjZ3BEf
zZdOg9n}2BB%2;L9-nj_kpF&sar|9d0KUr%Z;f_28cpl8)Ei$aRsdgjnsIz~1i1#E<
z{}c1j^>%n?0KDBmc}D=RzYru%vSD$%^k)LS@*6NcZ_ss?oLuAJv_L2m)Hne@y{Z9U
zu*jVUk`{ghN?HFGs#*G-femiO!tEJUfMhywa%k%=uYK4-^hvMK7g)B2N%tq*g$Hn(
zt<ca2d$|1(XmbWgSlI&%+}WKR#edDMALx<uYZ#aUZ+VIK?0WmMJLzzOI8-+V6D#b)
z^c5gzD%Lk>;$zX)z;nfVCm6asp4MvwKXm3Nc)`vvmQIE>k40l?;`Z{Om$BoKj=AZk
zoZ7+OKsdh-f>MBY04z&I5swWJ7dIB-bG+ZZ4gQ~Tuuw&jAs73-T<rhmsVzMIn>YSu
z=`C9Q#n4<b|HIB)a{tZDTc}O|Uu;tZ0%@bY|FSZu_6g9--5Nnnv}S!Ncv*m(+6QTa
z<an3~f1Pt*yGIxCgP(!?;CxiDf`;K0t~BYVq}lbG`j)Y=;3@`jlac|=jidv=%=?nz
ztMbJ|mMP$d_**czA^tT85;xuZ<QlmGTz0I8Z$Vwff#3{4qOdz#6Y=l&GGg|=HS+u{
zNS6+nJM_LwC~?zgnRHZl01V&EMf737&^`W*#>4SCt0N_I(-pJT_5jjoy0Jw5suQ5I
zBA43gV>O%^PEqby1a@<UH@qMzInST|6DeqM@Sgck0Nr4CKnF(qAO?Z-nf684W4{%`
zh76<jQ_`VB8`ZNl&i$|MGClj%0%=7Xy>8Z{w9O3vP?8emN5O$YJJPeSAQKNFXmNQ3
zbX2zt^2GM_-Lh5;0ttA~6c3j@oKkrDt?8>>e}JfNh``}8!(#=@Lep~5I?~eHBDMa*
zfYYS8by|New5dEbcpYMX1#_5!Tc<&1oUB26_UUvj*lEiFZdeEs?&%Uvbea3tLv{Vu
zg9}MB<xv^$?v6Hn=8h!89m(6W(B?FNn4CnbS$cb57D(c{87_<TCq~(i>$vsp9rEy~
zolOJKySelj8u~=8XjCUxxb1K9*>5`g9eBfo`v(7XfoHI5d(@oLp5Y^Bxv~aM<%fh?
z-%<MJ%cE0mME(G#%XEJr)*P0(!hn<%W#yt$Q9+t^k4V`(Q2wUEdcg6RXOh>AP5YJm
z_L?G1fKX)_Fh_Oo&Tjh}S_3ZJg`LN;+xncNFP)<oVoh=305xS$gb;pYb6zifZ51{w
zUFlNL)d$}sb9r=X=av+8u;dP#w$&~Vn%V=CknsJs?6&1fJ-@A<c@RMXrcj;PR`nss
z57xQC5Zn8xkh>t-!{VXy;@DXnQ#-WGU5;bh`Jrlb0@zFI<hWvZ#g-2+u1pL-B*YR-
zWhnYb@HhP$_<Q9!pxnQH9r722pOObF@LzAS{~sX!+!GNvt{j+e8d~FaH?uacs%^tR
zI2C|u;_d`fi4zZ*FYRx#Wp9KK4QfO2a`8`ope7%X8k)_`zO5G<2e5+pmkdA{$ZKce
z^>dm9#cRf8YXQ+Ao3d>;QDNP&(v$Z`gclz15<9+ndx=c&CBZM4z>MZJ0{p<F7_@dJ
z+Fvb9;jR?O@G$_YYp{+V>}LMF`5!R*M|_wLcBqkP^Q}XjvWkeIc6L3Uu=>t%K-BJv
zvm_`jap|>8ov-Ao?USxIr61;vl^wNx;|Ho{y(w?N5L1%y3O#DvL3Gp<7-@1c5V@sq
za|!a762ms4<phZf&rQTU<XAze=bCd4*@qgZvCvlYoTJAA6_2542Q4Z3`Ug7hmVKC)
zW_F!?s%Phi+r?r8RXK$+g2$suGgYO3DYMLuW5`jy{5Z>!PrXk9Xk%dso3G#+HZx;I
z;;`^P$G;T(!-e;5Z@^&R{CY%eIt@j{e}WTe7VA+D5+X++kNslg-+h8R2>VqVKC}gu
z%&BZX%f{0Z-EZ0~aB)fDxJyji>xlOQ^Y>~>R72q0_1(jG8)UTO$*bDRJv3vFP!P2x
z>z`k`{;R!Sf!9OHu{aj6a4E0qaxU%xRFKp2gB-L=&JE&>vAj<2&3jjR$L4ZoEIi2g
z;DX~R_}P;pV-(`+_cb#c?{$CW1@|Da*I&>EszTYcKbRgmiVXRxB;Wd9;@=W2t))Kh
zC8MZszSSmRLe96m7*of~(F(FCO=Cd{d5n^DkSMcsEV6XaDMz$V+GuflEPYZ;D#JyS
ze$&0`m*CjA4nsQgv8y83Hbr265Dpm2OBd$7e({h_5}Pp?2)pyHzQ$u=@CAs8RX0ZK
z*Q=(^j-T=vFOI$l&=PJv`)ut*cn^bQAyp@s1g_uVv_FvarU}vL%h?u4(=pjpgmB89
zp;vM=a@J7(dFL9^x1fYggILYa6HjbRwD~5Rms4YFop<s1TKTO_*sxR<bj7Cuo74@0
z?O5jr;=tY+co|Eg8P6MzDAmNDPg0~Qbk|-gvp3|_?vAiPO7(uEh_v!ydgj8t5U)aJ
zY>w|4iV08dCJf<P?7U09JVW_Q9_6EIh}NYg+8}7`;Lb){4!_C7Rk7bMdi%!3qiRP;
zh1T?3ttTY@Y*D&1*uf+qG{UBV5g8$KpGA%l9dD)epo)bCM3Ysj;?IK!psZaSEiIF!
z+E#Ve!y2^UH0A+FB~hnYOJzE}@A7J3r>0q=$&%913uoLdSkD5hzVs_isL`%M8uFFW
zg$tZq@uX#8<=iVhzCVSwFm85L*DYJ5F+P9hfRKBF26qV>_t43x!`_#8nI}>`2^W)R
zlk*h>zby#XfSW_|rTm}lX)YdYyKWpLUZiL1A<;@b>5I>^u4=hmlVM1yGDE5J+c?(@
z1Pl@r9OTuO40OX{i}VKwnx7qWMsOZLk5sBGyoxLzhYCUMBUQa4##U?O*etCli&D)r
zCEZ&C0wD+`Z8P|+48zM@g6c*u)B{hi*UY@J)!v66Dk%$sSzZyIVpR>pov$6(E;DL5
zZJYMjAq^oWxmXyP-Zd_pD(IV}MsyxN)7AV%^@gtYb;fO((olqVU;J`Wvi7a{Nptd8
z6g9H>^1iwQM)9DRi}>VTeUzH2;{fD=I{3Enki3dS-J(JvsTl-4o*v7M%GAjXD5_A~
z3ETXjZdZU?cbu$^+jmXGd3Ac9lE>ADSo9OM#9Nck#**T(@n4vsF%ck6ZrvVO1tjiZ
z<tTC?It80fjb6uGEzB>J%jl&~FB{LSTXmffs?PeVGal7I&<?fRmqu-_Ps^HY%LTsb
z#z23GR(>DQC&4VMiixEPC4Y7ii^2Baq8<>JD$Tm7Wiwx;mKQLaBS@mcQU<R1*7rEF
z;X@0~n4FzJ=;kPv=QE8i6;=9>Triz^#G?-k@)SQFm$>03tgI5Ia7Sw99Oanj)w?aq
z5_NK-%Vx%!lSpUz3x24cz`K{d%*4{DUh#eUK6XC!BZSEHaPMN!vi+)C_LRiiJCMfl
zN;}m~UXL4dE2{hWoxLE9mTAv^Ug8xDZUN~NpEbSLa&7u|x4B@TuXMxJa{;+NXCx@P
zTYaL^y(N&z`x4Qt1*hhh53^hj-wyd&vZDL^_2V+P2W3?tWH?E!-7kCnhscI=6It$s
zl6B~ZjX{;g)TY*ikcQJJKV1s4vV{Eui`*-g77GOa=SIByZ^@}Nbo_zQu9G&GDc5+3
z0m`Hf_9|l-6WyjeT7i7iO?PZO2_)rk41-dwu;FK_zM>23Jc8gja5EBVrP8mf#`m@1
zXXnsz^uy?PPHd1(^mowchN^Iia!<w<GDuT19IodknrZx?wPI!ula=|UUvWaI$_x?*
zF5;_x$h@k;L|fOGu?#m5?YQVo<BYGZwm(gF@dyS=3m>i4vEk(8XgP@DBB_OFACbgm
zfFpAWzW0<LMlB#y7cr75Y$5XunX8Eb-9^OWC8rIXNE35+?j5&_^?tlWVzIx(v}@Ir
zyxWm5?KhX4Gp#&Blo$PQk|`^;oq2%=l=c+n+F5@?c0AP^93U?P-pB-v0)S*~#Lo_|
zuo>Y@#v%F1kBA(xSZrzMf$&q(amuKhn}Fki8!-Jq@kK%Xr=&sQ#5(m5%Yt5S#oZyZ
z0Kut6gdxa2fAL`%qr-1eQ*pLS*jjAYsKFaeohAgopHvLFT=C2CXGY5Z#A{Y2#3|U(
zd?5d;^XX_ZHjX?NlmtbuSA!k}5La^{{Ct^#)lBD=m$}-2{Bso?UXzAJCS&mp!<UX$
zq!Tqz{n^Sw5T}y%2N`w5bt?1<a%d##tLlo@?pPk19ETKOWSaLgum9yw^*vEJJ8SdQ
zxmpCQ69LF9tfo-w0*N&8T&&}aqF{?zJxVi4CjAt4&8Nmq?8wD>lnQZt&DVvv4{`D7
zeUo|D-c$Vj@`}4WDUK(JQ%pPW$G|+|Z+g!0WSuFl?EP%6;16SkF3sQSQB)g1)1^5u
z492dcei<VsEGlStdT;DK3o(M|C&A<>qlEqv7tE7I5rsW?JfXW!$vRZSO(Sfwb@^nW
zb(JTI?4y%ErdjbRb|)yTzNGtG{7pJVVyzHpYLMPO9*58u$OCu_&y8XaE2L_37u{vJ
zhBh$!%GVla3f1O;hvs1Is&4i;_;t+!1PA`>*STtNyu(l+DCvh56Ms1I#`a0eWbg8I
z0Dg*Fxt-uy>j~7hw~PLr4mIh;6(T@=)(goz&b1@KhAVLeak!r{)ct*ktioUa<zCwW
zY|Rs-xrr0_v>3Gd$(`s^biV;~f@pc?Cnf8nVa;9k&SurEG0os*@F6hUq46)bo&vVI
z<#NW?hOlM`c4m*GM|A=oq?}0IACdMV<ELd=!5>w?J@=Y>_G_~N{HVESQVoc!hCg+~
zO=n+pus4|o#kitEU~)7r8^A%o&kAb%nx4`+`GZOZqGOk6v$=`gPmKkhkFbg|-_p)4
zQo~7J4Z2(a5C+0qNT;Vojtsp4jmMSP>Axg|yDw#rc05v$lrH^VETUXCNJpTjJ@{*q
zqMmZkxf(M{n|Dt+c382cc{_~;1{4<Y<WqdoKAq(I*E;$c7x^$bd{jY!^yZ)^7cX=r
z-*-pdPL7<gyKRUZDslfU$&EpDkc>)!<2J$Wvk<WpOxVQ|p?ZqB9uHG^R$X9E_>^yH
z1Nia2Gb+>1=JIUG=#`G!lE(Utc0b8mnU|~l8ZXR!7kZ;gh+$q)I9?3qo*mA_hr8d}
z)Kx~=hkT^uGY4HhjRJ)&z8R#Sbo8@&aNc8~Ta?$d@bWBH)wzJplw+ORn*z=dg`|u1
zV?a5UM+|)!&gXZybWFly0c3&T_9w3dz&bkwNu>wuZ;)N?e-)J}6%9=4XjW-~*3MDc
zs|fwT{}`8XlP%!q!pI4H*CN81Bht2pMaD@w*N+Ia!~~Ve@%8CE-Nat@mKpK=c05T&
z{PUZ9noU)@*|*sloOW6`ngJ0QhrxjWJ{T*Ip)kYl6pSU&7xb@#Xva%mlOtI?HfvU^
z&&-UG)ordNcDLa)h1;Plp8iW9xv9_mF2&u3fFQ>(xgel!@A1@IC}QH$iP-2DQ%0L+
z8O=LNn}vohdtuZ+t!pch`xnUlEJlBb7@rf{eXn;>Y{lbUJ~?eA+2Nyb-U$2&BPZ^1
zoW~>p?o<s`-pyoM^__!~JG~{uBHn(ZZwLPGbtVmbP^&n3?2T)0>C6iUwwED%eFY!Q
zgY3Z8-rPGIZ%fuE3W*O}WBRP#nr(ge|9`?1sJpWf%A+ob<ZahL!hahZn*CgO)*<}=
E0Fory#{d8T

literal 28643
zcmeIa1z1(<wmv>-2|*B~LqKVeR%!uCi-d%<h_rM_2n#_3N$HU8M!E%2x?8$ix?#m{
zy6?T`=)UfK_Br>Q`@iS;Z+PZ<=2|np`F(TDG2ZdM<D1AY$T{GOytJG&fPxADDBwSU
zoCNLymoPE0FflG+VPRooU&6s7zKn;9i$_j$m4KL<f|iDwf{Kcck&}szo}Gb;idm3_
z{T4SLA0I8#9nsr7BAmQ@Jl{@&f{l%hhl@vc`7#;Lb*k$;fA=4<2_U?L+K<+RhC&aZ
z5~83Hq98v5wBU7Op#1U&{O2DEDjGTlCe|fv99(dRiYovr3K|+JIvNHBIy$(w2e=(T
zC&VDS&Mkp?RmBjC-j0~(WmxJZ2Fa3-B&q|ujJ!|my|Hnwk&=;9+_=fa%)-jYFCcjP
zj?mqEQqnTAa`F$=)HO68X=xihH8wFdGq-SXbaH;~;_Bw}%J;RO|C@mDh{&kunAo`Z
zwDgS3tn8fJywbAripr|$n%d@1pIchn+B-T2hlWQ+$G(hD%r7i1Ew8Mut#9n@9~>SX
zpPZhZf9n?tfc78V0zdzwW54PbA=ocebaXUytZ)57L46J`XoTn(*SRr?Bvh~r?XJ@E
zyu3s#8J1e|5u1Tmb(iFc{Q%B2M!xwQd*8bDOV9pT$Grccp8cg`f9=-<fQN<x-aIry
z00NwxGpBjs{JH!&2ESngXoJ;teT1`ZPRv@PeE5<@O>Q1i&QZ$~jW7=g+|g!LTh%*Z
zSS#2qBvFvRe*_7<N<#t&C@JF9U^g8>6o>@QU<McS(B_&9jpu4A(MDdPiq38_uT+Q?
za|~yx?h&AExQ|KciV9iIn37QGx%CbNFe8Cx6(|ybfCs<eI#qt5;)w<GD2DGg&dU{^
zYJDBpem406En3o51uo^FuC_b8!PXL?NvR!KV@&LvM7wu+>o||2h+1DzRi+aK-C?43
z<DeKD+U`kkqH{)ZsJ)or`gBl~)qd4GVuM&kO3qM<SQ+Jiw2&8gnCkn;E5{x%S>JoS
zNV7Uvma9RWwk-Jc=GSK?0SohciA|BN#{;nkz0DG|i+aYHOM;c_d;~RQP6f87o$5R7
zpEHtL0+`ck1O7EnV%~&r-<R^q{FJ&NZoYROw%9FzR$8fQmj*NLMrVPWZ>26l)&uid
z!x88j7ZM2X5~qmNF!<tRaE^-vmP!YXsWlPa;EiN2N6D2khWn`_fs{ss0taTBdK=6a
z3G8c`p*D>?(>^QE*hX`1cuaJ8F$g}>a3}xioJn<HAI7ZijGitMFfWOI{?^Ak^|^S7
z9{?pqce65@NfE;txmQv<+iE1M!En|3Q_kZSY&2o}I?o^%>Ly`q{staK-{r>2U{fTZ
zrms$kh}+b#=1eWGvV5~7yP#CRZHu+|$aw;Ncb$SiU5?zHT(AzXovm|PY}BNUG9*CJ
zyH*vV5KA*E>|*GmB{y3U78~xi92E*9sJa7e6&7z53wp#qjl9m<LP>W;wr%CIRuM(l
zM?q&^$tOv(UBRC&z5l4TD%?bN=4U;XFec0Hq)Tx6?%R;`V-}Lc{B>A7{xT$hg^CvR
zFXJflmoe<e%=|xifU9#c5};K=0(z8ZV{Xr!?nB!Rkid=TYHDSYI3Ix({H6pWv7--^
zr#UOFP}IAQ{tPw4=>h6^L6i);{KGf4R$eFHvCO|d#IzbZw80iNSY%W_{3KrY6*>CL
zA^KVm4YhYt@v>7qS8hq1kc{i;%ZY~aUS^Z1Zcur!y|JU=F?O%bX5{h1HW=<`O*WY`
zT9%?CPahTGcG!DixA@gZ+x8xcmQp%aL3TuSigjhrn+^79ec+=A=?0?up-%%n0y$xm
zeM|D~7f-)XntxoyDzr31Q15YM)j2r07M=~%>!_;M)%gVb`NG(`^7qQ7J|O`dG5;;I
zg2wk7jfbR2pu;%*t57i<<C_Ir@*1fIbY0-*BLN90ELvOaQyvoN|7A41_?drth#A`d
z(h&mxb&=54?7{5#h4zZpAyzrY`^t~GHP{lIdwIo4&C&t@=HFX-umW1foW2~k-#4$=
z)_su=pLNh0$;VN4cvmWEJ^7|+vt&KY)oy<K(Jz~HnMo;pXT;32qZ*0Kiy5mlF_t_A
zWv9xh9Q3k$%(Kng8`qup^*TP%i$hTiZm){8R=g`GJvxcg>xp#>eQnMDOm&{Jht5PD
zZTlirMV-$>-->n7emT|Xplx$obaTMOW#LVdrkeO2c3ZYrV}}>F6Q&<cH4Q`@NSC6j
zoxfbyUc3d>u&BVYbi|gPNUtfcdwo33^zsvfqgc|2sH;gtaZjfHwr)cmm5Aqu#hC`y
z&STt*r%BVFq(AxSN2Af=skzHp2Q%ED?;%#ve<|@l^6fu~4O$Z?u)v8>xLXJ42jd3{
zw%id?TQZ1-r=Y<o0%ikJ#DK~_u+T)UP^9rrwQH6KC-*i$3XP{up$}@qGQ!cK?+EL9
zDeB&w=X`3a5ub~7%{6*RHRC`A_jAZSo0FK5VsSCjfnlP@k0G1s&|uf9H=L;zV@y7Z
zQHrIH@u)xDUQI4^6nQ#(H`sW1v?ro{U;ZLtX-FVG^ivGBYq5^bY<t>t7iM2qMERWQ
zX24<csnnr2?~=eTC!^Jkg_=Ix?lowBVYv&fo$YKOD*MW(b6MyvM?Ix(kTttp+oCo}
z7mI^%Vt+u8nx=SK01Gh~Re_%^B+2PWpsfH29GyTA!4~}ma9V^Y=-G>Fkiem(GNv!F
zia5q^E*hM5MQxcar92eNew`nZR?70h7`rN%@~$%V7waV(BC!3mY@p<zi#{YL(!*Y)
z_hqSM=b;SsXs)~OH2Z!+I5c@M&dJ)!I`gGJ2PFxkyJp9t9X~fgV!ll3tBjcpeg`=u
z@U|ft?rgBCwwW==cg?SJ*d|NIQ5rvQ>S{>bVZnPxR`t9{lCO*vLbOECcGS%^$l-N;
zQ@fj(ABT^MW$Ql-IVotCUf8q5c)2+wyUiUH5^c&RxMs**O%7LI^JoZm)7qvf9JyEi
zer32qTHRvJZRwnUbh)dk?Idiqxca0ZufaT1*FZ~GS0{J{Rgi8&qK{#}80|7^NlvDM
zqh!OOs0L{2n`+hG;%lG0h1KKt6A5&arEA)6Y)v8dAqI9k`tOY0FT-n<Z0KC3o)W_H
zzuJ<WK1rWYaCDTkkcwwcYanV4U`|2(XDwwFJ7=U7wC6_=pxfk6|MAHH2GRnUfxmz0
z8Qa?CJQU7%*SZm6u0~(4SP{ec)Mo?J3{5^@&T6v7+<vHoq?z)K51%+2>tdI3{i?+l
z(bXV_&{V4~mx==8mmdZg>cu&~3_QOUEV#{(g&kqd-Ttx9_OebWX2s`HVGAt$mde<J
zAOyc868LDR^{B_;_!X4nxz)aS-=@lh&S@C`9TN`6d`ejroLtG*vhN#&eeK=hyj>|m
ztFY^10~@Gj+b!X&44?CfZK`Nl^p&i}dxhPUF_KTkpCEzcawO1*2D8}mdo|IzPu{X;
z99;Em+zYC`!ZiFsDPzK5d?)JZP(e`MUG{dhH=Sj&bKFgjT4l*u9rUh62-KeE$vi(!
zx7h1=?J^)RKWQX@#aJ}M!@cIvgrzBE8~@Cc+4t+$?kdSE3<nu5i^9?jOjuMUHy?Z4
z60%hg5udqHKfF`OvBmkJWw|kOLldLEqzWC7RuEKmrLI-R^7uVhs8!3G>%Gh)$T2nP
zm!%taeg#S~m`6&%nfUxp{6a7J4F-(Pea|c}t|hmDuuZMx-H>(KLjoVfSvrDnngQ{0
z7dp#_k{z}wEmLR$Z5Gae_KOi*tc0G*IEJ2MeFTwwKjs@JtZ?Q7(u+?AMb@*Q-1vLb
zbFdFLU9YjI6YB90yPCPc<nohu{ZHKyUZVylOUjsSv5hmdi8SD-x_CN;B7sYxevNCF
zjgf$-6z%_k{V)=ZR4F_Y88^M>45i&7^xfV#<<35~j&{`vhxW;D@*7~9?SGMFKkRyx
zjmF$ThQ&}}yEl;;)$jO9hEFl9jn2ma@(wa1^#GQoE;xLcNGatf?-L}_E%yBAm}Vr(
zb)Lm~$F!Q%B29+FJFXQ<G1PxlT_G!wz|l;QDC*Hx@zlVjXl3-=<=PB=NsY3c$U<$t
z2<iJ!!B71*(G#I%yDz=>S&XZ-2r2CpV|z?az0bBQSd7^3DOa}Wk5en^mG8YMoo=E2
z%$;%niwXMPj@ArwN%ZL1iuz6L-mS$H(H1vy-sZ}YtD)pDE(hx@;?RcbH6cx{G@s%%
zL2ak5<+LUlYx&jeC5fWDh0YZEJNPc13y66;zR%BstC{*eGsf~`FK+n7lz&-ha&Xr<
z+|U4XLrj}9B%pM03~jA?A)F%S&xzJsdRFJg$sL3Qf*l%nlV*@WUj}VlAriQ}d0?qv
zKO{xvsWD~6l&}h8TY7K9b=>u(*nP#FaOuNqnE(;)Di3&o-RPr8&vY0Y>8JSaTK!ZC
z>zgwgxb(;5iwrXrFO(Lb<u)ZH&}qkTWzUoM#|4U53Na6d7t|guGhjy5p&)M7!|tUX
zjT|ZN44q%JJFlK7X;QP8lV);w*bDvB+~hZR`**p@`#v*X*8*5j(B~)sZDuC4n{ThU
zDWm=YWP#E)eVVqTw8vO!V;$Z!RA84lFHrO)(21(jxR-apWAoZ(TZBdYi}lNibqvyK
zuVTX=knD@;ztc$tRtFo%Q{IHgv)t)pXuLmaU15ptc4J&NN;YT_jVuM<S&3?glt{uD
zFHE`wb!9Pl5QC12OCowzRQzbsMsg2rlT`3Z$FsL0vZ3V)D^vn*Zv~FfZRL*8f@bR<
z6*`_RKT_V3bdDl}XfL(-7o~>9X``EL?gNT^@4hHz)=aDD%D`@DHXcmSUM#5~0c`ah
z*s&ktjQDm}iP#`@?@Yh~WS+GF2_*F+fm!-^1bc%zqXM?rODQoqX99ElRR<}<Q_Dxm
z8s5-yjM=OBYDRQO;5^?x<Na?%pLCIhfHwErM;uSqIfDwRu*vReX#tExN}bY54?aYq
zlt_U-43Y&JBMWqwUJ1bp`mw{=vt=#>I*1Wkl+g+xOE<s-Vay2$49IEo_l}!syIW9%
z$1XSDPw_-3ovrv?%p5@xgm6KGs{#^uNd(<fL&^RdXT?k;i36P+0!%SQGLb;j8^~!M
zWS({ix*FMdO2~u+NW>`|HB4a)=QgnY7$ktohy)gLz{d)z2o8-Z5}3P}3{wZp2SD!}
zy54xuX#l$f2Ic_JL;rXkx+nf3VpSW~9K*P8?;P6g>}WRr&<xneAFrab;*y5Xt5I)@
zjkcr~_G3+n{_=;?p08--72+l~R^+CDLGC9QPUlsxwk9xRl!7uA!^yjBU>z&fZ5qMj
zx+KQ8>GlH7*i9(1$S(xoGp~sPLwp$RC`|VY3$Z>soV{JIQsL<4xfOJ6qvkeD%0abb
zMa&&PDt|s7H?YTKI`w`5XQ^yk3NR*yU-4*xK38;{yWvncQIhg9MXSzf`6=#a6cjc5
zY-+m}*W<zhJ&S`kOpggYmn;XM=SS-lM;T)i96j}P<mA#QqP7x<sAbMz%2J^y@S=_|
z8+6YrjG0?^qKZG~1;$9dpQy6Q>9aHyE$1jPZ9S%zC0{(si%QK{7o=$T@|w_>s@^Xx
zV3(OS#Qfp(+v0w{VERSPx+~3>B)ZyVaM*?prv+veDiquun?o{=j5f@M9J@StdaSmF
z0FMQ?k|TcS4{cms>As<S6%j($@s-m8*oN4DH*5R7jP57f*aSag+4%7@c-vWWDV->q
zYuNZhmh^|An-fZK^nNte15HOfzG^kXw=|pR9^w!C79U(ZC_w_^T~HV<1SVy!B2M0D
zJ_=bQw*gHS1m^zfTS9GcG!7)N%Z>#0NHV1W6L|I`FzqpJL|`N%=tIjlX%F$LKwB+C
z0-rUah*91hCmJDMMk9gKYtYkxrJb+!_h+uhs8j~0eMDi98;=otxachz#Z`4j_gvFM
z?&TUYTHnk`YZnz86|d~f-LsIcD_yj_=9BRGS35pQQ7_C%W0I&!b)xDo<Tq~2o~#J&
zYtKd08KImAJ8$WQ46L!(iZY}17DMNGqCau~wNQbMSG^xpx59kp@bJ7ZNhBZv(nZyY
ziPM<-;p(sSM67tN-?A%RH{kI|v2JP=NjPj0F{*-sSJ8Axj1tdT5d>`)n7V+2tjPP!
zfAP?W4HZE9d1k?<xDN>sYO5(@+Dtfwo@45OkFgf`Tr>Yu+gBgwq<=F)J)%`se%0G<
zj9AI;a=EnDvTQn8R~-i09v_Or4|kf_<NLc@+`{+p^NrW{!Uf3jgDye*bFL3RTaCR-
z(#>@p-B$}mgh<Fk0u~Ht{&2;#KNwOWD>Itl4^5EV)v6wO5bR9*ph|teSGKknayhDh
z)Uyr=&<XdQub81mr;FuGIBs&h!Y0346TNDOwq9;hO<8=jy2dtCVRMGA2OZ<pH+qh!
zhhsQB25r^W1k!xwo0)MkhKo^4`u6ycCaaE82}_6L9mlZms@=)kIi{hpy#i{?9_xEw
z8C|l1azpOjW_1Oj#;GjlSB6{qljJ5MQjDg!Ok;z!+(bFcU6}TU*X6laa;okW8r-WL
zG~n`kmB1c2w0FoKqf;9(HPdpV<!fCmUWSFI+PMaajbcaJ%+yjLS?<L<>T7=amBCrF
zx`n|bGdQs5_397;0}1UJs=XJrqscdh<MlchOr#!Zx&SD{2@ZXkydTlHXW$Rd$23aP
ztiJ@*g*?FI@vv-jPnM$wk<pe9_>A`4MZiM$(l5ZS_VX%(IR*pFQa<1=FSL>Xj>b=L
zu@7kt{cgu!2K@V-%@AK8hj_z~opvNZF_`A{FFEkmCKm1f<^ODiuTMxPzpLhPI0`TG
zy$H(p`9TR+L*!uj4}yN-+cBN|V6Q3+&bJ%SS=gk@evGJmKc!Fz<5yq`^RruI+V0BN
zmZfFa7-^EV*I6$080o)a``BzL!53d9q8^z~V(5*3iGR%#i|{gW>0&oe<-u$vL_XbV
zzGAqX%{^cF+LqCh^IJC$kIjU^BljMhby&rQ9itKmE?ySLWh*Yn7Foo%9C0gzYbU+8
z(>GdJe)HlkB<f|9>M7zF0$0zrTkJ?eeXmtuPZ->N;RU<JhNU#LeKalZCCC0;fz46(
z1PN?vj7Re%adM~Mov{kBR~@)K$oDQ-|LfgL%^~`C2c+CQ-(~5nI|tfWSF3awjfCc=
z-yh;QtdpvGDUKFC{pCEqPCr^NMh2I%ON(dzmq;=EPmL7cq7E1>X!p4+AV*tF2yaXI
zvKJCafc_YyX!Hl6Yd5|4a()tF{#&#X!C_9p({bgu+&#IXJ0XGXtR_=sj!)v>A>5|x
zrZ#IjiUigejF5mA2vOQt&S_!ZLx@@sU!+!;^<x^0A2ps|`T}~qtI)m9j?qKW=PDs|
z@fkQ9Z8w=`xMIi=dwt!x>#aN58#yTi5F3n*a2=i=*Hz*7rUZ63N1J85L@|#XKo<&Q
z)9Cv&;cX@~9Xvfy9epTE&(o==Y5$ghRp5xqVX(HA8O^_bx3XZ+udMb_<6yY1>pt_P
z94}_HAR@*-+LmOCY^ymd=?<B3YoeRnc^}57Y?}9ZzYr;jmc<_mF{2R;_Gtx--X7c@
zB)NxXbeFNkWxc)~*F!cJ(FeMZe(5$O0Dzz^L?e?JCFa<}2H`CLIYpm^+2?HDvP6@v
z<1rZLaW$pWzQwe6z?N13e~u7;o_y5Zk3lUttDz_4zz<Jvy|S%VVa(`;wnF8p{!tGk
z#UK*;@A7F+BSGZ^baduUl&+a2`+Gf(^NdjnWr4Kh@=<BE@t#z5udz)+G%pPrS-Vl0
zlvjkFo|Ym3*TyLOM`BT?TUFAx!xG;6hsP}i1!?L=Qk_MH3gM?^w=eW?NSY0f54>A7
z^kTzLm`n`hW=zV6zfUVa$n#2L<)N=!C#+yggaA==vXMMmJF!&%m({(Q)d3D~Fs1oD
z;p`uHxK*T{Sj11P$Bf}JNNWf)*ilJ&mj~h6@`91s@-FS(jS3{-a30^iNAQ|{L}`L!
z{7EepksD+TW|{c@)GIn#AiB}yWwMdCVk<z`<&#*Sy&WREzTPIl4<WX=WmXw8dLT|C
zUHjzu^&tN#U-Bn4x^6GpDvY#!h5BuCie3%6@l-T=JKed7%N@Xc&}H36(_B|5c)x0J
z>)On;Ef%|yhFDhhW~e`4@$lXoK*1c(l!r<#hP%j9H+L$#^3G<6g*%j1&cOz6-Oz^W
zVT##|Wno_Sv-@`wv(4b!ynPInF00MUhqronwF9_SzHF@(vAl4yV~;2hdWJ{uO3LL-
z`idwbA%w?hQN*w;i7k7OpD=H|M9(X~@eYn0;4QI%Ww)-^Li&fE$UpMbez(s*#S4Jv
z>jk~%(zWEHK_&R*eCe`s$Qed9+!0Ja?ph4|cfzskX!Z<c28`g^B*{fcpdJ4JQ4<f;
zG0O2NQU%tKJq}fQRO<3j@$K@fS@EM<A$9jJG%KBE3=v(=Ra4=jYiLADxMsVpgR+D4
z%pE2XfM&EpZg<)3;K&rC^2MAj{Xjt<&LYxh=l)?H)N-`BV5YWP><2pmfodZkO2k~9
zrIo$H=MOgVw_fw#Er06}0m}y=-zyn~!*_^_f>;>(z-^c9RB39QHg7f?>4Bp1@#)nD
zL7c8~mOiSBc%U)cJbL2kP2s1kWXo^vFphNoZAKMuli&>7qVZ@NdZ?-qZ2Ab=t^lg2
zMVm+<Exg?9rzB~X2*_F{lEgYP+Or%gW9kRmTs0fbOjmU_3fs0o0^{?|p&YjL#nh}>
zejsMjF*tz~nkl18Ph3rCtv^~U<O;jSU1ICDr>Y`Oc*eby=)+V@ZQem4ovI?4GY8xz
z-uOqT*}r{E!R!@idjpu1j+G~$V;8da>|y;PmbimHKP4U*{H=uiSHGhP-vzmNZRnUB
z<WQiHV%6~tzjF!1^mWe@qE6y225W|HYZoeY_{0wEV5o5iystRGP+FOwW#d8L10?Wa
z7RCm7<nuX3$W=k3BEYJvA~o#g(%cc*9Fb>=GS<CrVu!=bBD4#v7Sc<t+uKiCo+zi;
zRmi%c-8vM0Q5H58Ke&4wSI{E*S*VV$lFK@bktmGrBJYw2m`+@C7-J}Yj9(eA%cUyH
z*0;F3(rA<s%QrPC`}hqBLnQqh!J6l{H|&;!&P|KuUqf&#EpskQ-Q}3<d}<Q@_@kU7
z<DyvLWIqmY7{Hc1m_C;BK15J9Ftpx!mGkU8Z;>YIxig4>MGki^w!kU~FTTyly}=FB
z2fl}cORc)?am_+eldq2{s|cJ(O6tHMk>vIqevAa>m8Y~f#s=U?OXF>5VJl=+yd=G{
z<gL6zd?>w-^jy-&=1Sl8cH`NV4~jqf+HIII<-*Zj?~H>l`Z!r-PpYTfeQWjLp43vv
zZ7p@3PD*ixqDPg|F05G8a6CL5>5D8ckuy#amCLzd8Y?R@wQuAV$W?DWnHnc+-dzkK
zV2U4XOxCa6U9NY=eEuO`Qd=`<k{AaU&nI~S=fhllq48pFOC4@L2``4Ko|d<by|1P)
z0a=tQ`5ml~SK~u4>#^$CFKH8X(i#TBQCb34?QOa>I}=_!jC(TvHwZiM>{H@h)71og
z14y(2=vG%4TT>fuxoLFv70jBS^mmRC%EyGUir7VVo2XRddAaCkCo3yi9MABE7@F*v
zqZfRA8fv-pa^HJ=(#zp`uk75_BymxJ;9MkNY2M}dWIwiyO(xv=tt{OV+GM{nCXJ6r
z@$__PReA>Y)oVSC(fW!duyj!$J})<4s-$d)<cB@X^ulok4;xoJ78ZOO0V!5PqXRsY
zPYI4+?}#e7{#^9>UI_cub8jj12_dOn41aC_Cyq-0P3emqL`^TPpi_v7RIR_R{^st#
zt)Ts$y7sGWCZ|6CA!=rP6E%NDBw$AUrbzeWX~=6yVcs!_T95%trzp=C1of7;AWbzU
z2R$^>i2A8UNK6<eMU0|&n2*i-p?A7872oLLzRz1B$962@%d9ObZ?z=}OKR>JVUe{;
zi~22VGN<4)j#oYk@`$FAmQ$JzjZ9h$VbyUrv$}p|@^jcdA$n$I;av=c|F|`eEkV7_
zY48({%*k`2x#WXE5Gl>G*B@5GLQjWYfLcFo8=^XN#WK7op3F&I(7}%+(2+4*QwYou
z6}Ut>8W|9L&}J>yb*nSly@Ep8PgUBfL{-}$0{kGuaY#E_!EbQsS!nlAY<T+0n?9x~
ziW}0ArkzX73zqU!8x*)8t!ccPS+xXh1xY^asEOW}=`SN7V*L)G)|OF@F4JMd`79sN
z9|v45)Vt66imFJ8$}vw(*{<X(T9_2w8jEGn;WyBQ`rYym1QpQDqCvj7R*vF}<k51r
z@7DjeZ~v8#{%O?ut$qGkap6}s<luIDl%_qFu{4BBNI6Y*{7Wcz4dX3X{@t!I=;|UE
z3K|JOzV?^uo8`^MgS~9%EEp{pHkovWUdXvpNlq$zGvVDO!)@7L6oIutcyi8pm9ZWS
zrU|9r!kfl)g~)4$G3fPv)ErLGL}Bu+Sl^1(HRxlj!*miXMez#T<sMokay%l*wMw-p
zb8*)x9nR9Jv3`{#9xb_njb%<w%iMc=D})&>UsF@BQ{v$i4J%(=Rk#F2w{Nd)>T75p
zW_4FG!R7!@u+U;>kRF47%TQW@g}*>vF>sCOsZoN@VY=zuw2=}@A(P8gYd+KY(_{gZ
zcJzp#@Triv9>7hM<c&Fgb#w_>gdmVYX+pq;FZ^M?`eGq_A4FHDU|jqJl6H>YYPQbY
zc3?2`*^_zDlxsyAo+CW@b}n|208H;&!IGyw7;_*L&*7&~1ZOB07*~>mg%L0aNS^&t
z2^Iq)w7%9vP<Eq50)gqjKeTIqPvZ_VTu2~v5eewZ9PoE&DlACV>O_-<;&v_LKaor)
z7k$IuqnYV_O1`*a@LAu_5~Y5i$x?D?;>gljr1&EHTvgvCz;a~2eAz5ANMsOS<~>b?
z#l#9*&NW$Gp~WhTj};3{Ajk@a^_Y@L)m7x$C!~{*iIPX;$ShA2*2IQ|ciYPy<*knv
zSP(H*-AlIyP{P!Q3LP~OxOZ$T&pW{<FD0!y@xg3sVbMfAsYcs_tGULnteRI(Ki**&
zM$;qxaa@WSPkQ9pxPBO&f$xoO?OVOj52NGy{cQn;(@J6A-x`|lZ_6)5NI%>fnID@^
z!TRz8sI-VqH08+aKIks(6G?g+lwaZCm4Xt{O8h*({HNRsSh9kWoC-qmYh&=fO%Rs<
zb^RZ!X8}+6TMhm2`wt}bXw;992QdGGr$LEJ0k53}x>?Y8&Yl0DjF0vVgA48yg9N1c
z&HMjIeJ2*l!kmtB)6yBkS^QEbPXeKjesa!Q<wRh9r=BjJwImiv{0qwL)i`U&PAY<A
zK<3JNKBN7UTVVx5&laq#v&&+-Uv?%fmYfgDIq>;Eysaun_q?OW?DRwPq`3EZ;SJMh
z4Z4C?G{9ynTR37g`Jx0NUA$?1QWARXXk~3;`S|?d+s9)z1g{*|4P~zOPDWC_CWB-u
z5xnACTh_w8KmWkF43Bm&>b_bwjYeSR%iue?*(Lq>-q9hEnk-Y_V~oGGZn_5D$M_|e
z9`*fx{pZp6H!6AlRwKXOPV#Pn;Fm&?V=y6<;Lp_hK!*gv+(D_Y*c@_rRh&ZY4>n|C
z2HD3kIN#(#1X&Cf^k5+*Ky0B0Rs;+LYdeBwC4LgUS0fY8Z#aAn0D&>#SwH%rI!d8=
ztJ5pJmWG$Cf&}l-m}si0&AFWFs3Gka_rg(Z?FeO)#M{VQ)d+`}cEuu5Ql(7wEaR;b
z)2EeOulN#k8(U3Xed%>aWUtMQ{isJ+Ik2aqMl%!|O_^fSK}NpWf0%Na;-|&a#Sp89
zpWo|S;o1(|wG+^rXD_6znXs)-W@od-SL)gnr+KM6nrWQ7q216tVNg+To5wl8z$r)G
zM-rPvw|CWeX57gCz2eHCq_XEK4+!Y5FA2K^H@NTzTIRWgTRk}P*3~KRvwlQIH5bWb
zV-Sf7Nd>hKeH+y2srIKy3*=8lwYs<=Z@^S+-ar9<VF2>JzIuZdiPl!?bM<~5p<5i}
z&@%aEWg;=P?axLxLfmZKm*Qjeua6ZR3BMLNkg;?U>(Y!yV@=CienNu3^KSVuzHmQA
z9TaEdILv?R2*QFTC8vvWs;Og1*<wj-FL0uU^6pMY+s$ePD2a==4)pd!&Lp=SgU+2t
zMKn?q__p27#kN=sxg?n$Ih)Sfhs`ABRvBR=#FKS%C^TwUY<WN2tqz_0n1Wv$u*h`;
zx9^i5pf1!_$gdvR{;W}?Args)iOnkREV3$0ki}-&9IoFrzecOfOBvo**NZM7m|!aQ
zCFOG7Pw&IeCphpPLe5YpkU$OGQnKv3^?&V5fFJYW!5?8!%4OC+)PcN{p$@C;DJ8ro
zT1IaY8JH;j$x*#-9a;&ve#J|khzY}tf5xbTnsY!oB3DT8^-bd%H)sX3U<UqKL(|L2
zwIUc}HGE1kP$VGs*>=a2(#jVYTW$(o<Bxkv&3ZG`kAx!><>x!gpJ_;;mpnXp8ssr|
z#SuZVv6h0*ji8z2PtfRcEitOPVr+<ZTRh`vkr5S2ILluk!WWpiUddut@hsWpIzHu+
zaVz%Ri?a<kjV)r77HD&wmz=f6Df(-&)Gr*Z<jSdcR%^teSI2^suwEKfMw2r%=zbnY
zDI9st8{zc;&GF+_kJGR+ror*O*+a5n=nj~YEHES5-ywV`Lg9zWFewXAw}g&gh4veP
z4&?*rVf@oC=xxsNEFdR?&^?k|DFAd3PeB4&B3K4-t^~@KKlbz+YYPt(gk$p4UaUh-
z10bb0L9(JX9SL}V_<>M6^6zUrbEtmJrl=sZ+TAypA&l|u<u6vBuz=?e&qfnXLFmnJ
zc?a$eQthb<;uN=OqS`mkzs7S`v0Nd45*E`vfo)TZ>PwRu=i$;vGNwscU?78E<Bk{Y
ze1fBnau8wrQD0_11)H|*R-7u?;ri#o<?zxgb@qE~Xlvqe4}>pJu^n70N1e(K_&VxW
z-x3E05cv^Ot%|<-l%0Cqt6ck@2#exoG!+JlZ|xFB>%gg%uG?cbwZPoT!lr5p{iK@!
z3R9%uV<W1gMYMgI$geGq7VG+~l{Eq-Etyl3Qcet3&&B-}fU`dPNhCl-NnVsr($tcp
zEx~AiH^Y3O{+Sl}bs$$%woTIVE`q45_-qkt6Tw%|ytY{)Wq-@1*|a`@h0Z_y7Fe?!
zG^Wc;_6H;TH?Z(;h)k~EPQl1%&*9>X9vzhXLUhFxwMID6{&+4yZkfyY0YrPgWpUl`
zS!Nwt=}dY)PH>Ucu0)c^`8ATJ`fyqM?QZDAovg7K_KP#a)0bmw(a}OT<EVqKwk)S}
z)85+tj0Chth|=-$y+wmvr<tE*)4lb`Wj{OeTfj<t>NYrri<$3kEurAYFc30-KBkzy
z;inROk~MynyzOrMp>13u`~8}0L6_xOcvvh4e>00KSc5JZHh>Y@406a~DP0EQ!LZjS
zhz1a6^=E=1@1XB0h`5}Q0Q^hiA;qE458ny3RZj<^pz{j-O@)bIrYw|7B=Dqad&z!Q
z0&Yovi$dyQ|68_7@0A0oX4sepLlvw%2&$r==-SCTFtxi|zR05Q&LFJ08(G=ZV^sU7
zX@&R1Z)mh8{L*bYZ?=jLdsJ1>+98R15Vv_hr4uQ8!QAEP+HDh21?~>UBmUd2iuv~o
zbj`Efpu4DD2(fuE2MC01j{3>(>u{Z3_#tY!4vMv@+5E1;G~BAW=I()_R@25Goq6-`
z7dA5U%5KKEw6|zIw!ie%IlfNK33`SO7TS%0S>M{t_^G%T?8}EXl;iq3fmWJVx}^t~
zOawtfwNcE+#)I@-)=ZvHI|F`WZ+%*(_lmpeEc)QRnVc4-b-md7wATy^GJy&_3F=uz
z&q-;B$54bh>EA+2mzDPOIOc<0OySh;rsNwJwQijj>v|dTlPg`!K@Knri$f|#$awF~
ztX$V;Kh=nMt_TMSdVJr|w38Y$7gK#vj${O)_;e)a1zRx@PY3PA{wi&>IcdvznRG_S
zHCZh9qnwOAfnvIkb*zwaDcZp-5e_*~oeNM#B-kw17!&*o;}S7)I@&KixfBamI#sW6
z3TC?J)q;l2h*&aZOm@%}IT?En+1xgc7*7aO-yCjUDrXkX%#A!?vXr0+o^Oz}dN8`M
z@(k6K4rM@kq^YoTMFcc;y12&88qoGNYTeYsADYvIP&`nJ05vcTllh;O)oN8~ROROI
zF9(XZ%8uS)ct`gl)1NN%B$Vv%n>5e+3(X6b3SXRqS-7H|&|bAr#mU4gNnM#R!W(Yx
z0f+GivsY0kj!uDyN=~ec3daw8#(MgZ4R~bjTFOZ;U-Hi~mh_OuQTj>VrmsfLpt>S)
zuAa|!5lA|Hl{$Op`kLiXAqjuF$bFGz#qx!(Jqlc>2X~JUP7$7)Hx^5;$WVo5@^2fP
zX;95$8P24BJj@S{sC%juFW+%hYjsP-s0iG3P`7K*a6#C3e+ybxm2k$m#ehZGLFqTg
zt-G8|Y73f=6vAnfA=9<m&n@WK);y2<e)se@qJRT}Kr|wOs|vpm)Y?!u9E!MEzE*&r
z{;N(?R)7_C*&r|(0|UC{g8<;i<E6KrBV5gqz{wFvTEq{56${_!{VpYt(*ebr&jUZ6
zJ_WA_6a)5$kiZTos_gMugZxi)G7^9qAb~f9poaTz)VS<}T4{7Q`_;zSRod5VssTW;
zq2)2#C61~c?iAH8t&3A5-;sdd6N3M=^<UKjfYj}Gr2^mT@P8yCe`q&n1DsEV{Vi}j
z|Hd8b=Lt2!yltSH)8HhJtBTh55!YNih&4;C%ir&w>nl79D$&V*e~HIaMSsK%(K(^N
z+H3fJX5xIJEqFjb0xPIq)OmsB>%<LfK?R&BICid6Bi8zPaD?u9SO)LbOp?J=#3VI@
zPz!DoHIebm@`%%HCNeUFlj}$hv6ihVF_#ln!K8JCN@Bq8ZkQfsS%J1WsX5v>w&2aL
zUbk04&*AbqyMt_sWnL}UT~5CJ;GAusB`L0GJ^yx<aw%FxrLVE5u=`kIXOdbUjYCDi
z>KKV*K5L9d*}W&Xwu2M5<EC7g5E8u5F$WMY7CIhv|M+!96Tu#8g9{@AC$?x&|0V~a
zyWARhExXX5PJXY{zg3fVx+o+^8``d;a^41>wjYywS3Ucoli)gnq}!#km5YE<!iFU(
zYf8%?2aQa`LupyhGe3LtxnRMuW<D`GK-@0T=jmN@k&Lz>7(rfS>}^h<5pK$Kri?{-
zEtfHZo>-jRt1r_{33lBXdT{dXti2Pb6qa32tAnk)Z?{ivB`@nJo6*o$`paBPOC|Nf
z>$W=!02(akafRJuS9ld}Hj}ZmVxKJ33OzH7X2i2^0+bqr{<S&NAIgcoOY;6FIaYc;
z2x@MEFlY7~QQ`J0W9F~nJ=K~&+MLLSy#YhQ*jv!TrChO#jgtmJ9s(CvHXy&pA_vzI
zJ!extnt%Lb5~qGqR*X?={-_86W4Mbp0WTxlZQXN|noR>gL1~rax-Zcp`}F7$XNx5L
z8?`NdzU5IBJ~j!tm1Ghf=gAfcijPL+uZ+Y$UhDL6VqGgx-Q87Ln7+p~jd~wC`=r7t
zUys7QeNr_}RXG;t>10?0SSsR8oiSqk{6<^~W5m>wM)n&%wjNc)okCbcAk9!sNv~W%
z9%H^%otdRvm0xY}(d3HR)Lq`S1yQ0$gaY%jtD#0;#uB<HTiDv@qnsFTi3YoI20nIF
z<QQBqX0mg>bEX-JsIYY_?9{i25hNrCn~FN2smLO^7*tT7YNKjs?^wH_hI&Jnt_s4R
zL(Xx=lyuvE_!b4y#|#6_NC5LX7&m3af0hBL(nOXkV<k<Th8oCm_<k}}ojuv_!oTX?
zL5^>Wg-sdq3NO0v0e!`ub>Z=3oc<uCQ|xuqDB3Fv{E%CVcR0!&SI08l1h7)_u6aQ%
zEky9a^42vzl-9compv_G7tueibbD&0G5Q>rD>u|i>ujK$k4F0}D9We|6H(@*S81Vs
z7}K0O3$?@kg24c)y)KSB*+r)>`GhysqNkI{pE%!;?Y-L?kk07DgYSW%{H{%djXqCn
z3es6L>v$y-H;FeP=&_Ga5Aay~G+BG_*^3%F43ntf^!q94(nK0K@9^br-bS3<iQH=<
z$;JxeC+8&Q(^z1zr+<>y62l{8^^t+YS7R{&GR+Y0;rHgS{V<U`yF4*NGb(0D_wz#+
zXOTVM>7feqwHf-MZBy^gnO;i=Zf7NKb+x2NUJeH|8C$))J%EXY{`FDEI=DE7g8%2_
zwY^w>c7eA2T&x6Z6UJk#Y~wxJHx(SL6NBhM{5>r-JbZRkY=mBF5##<}-A$=4?i0x0
z62$;a*Bq4WG7DnZd$`^)cj1Bc@dW)i;B>CvpJV#Jxcz@pwZa+#;s?6G+4DJYk^px8
zi2gB}ld)*^?E{9VeOb~hg&onkNmsSsEQmhgQ&W_lSC<AZ_p2*xQYH$m7jCDSEj{c%
zIiVTRZa5+9xp^d}6Yn@3QIdtAA7zvb&DDMD!AM`G6*pB@Vj>d$KrSOK!H^8bteTLy
zC!B~8HQf@c#j$Lbkb<7Or3tBWQaVGtL!1|UX&hm?NK4d`C$!!or3jbrh_<%b-fki#
z<!Q$<c^2B4uOd%ef+E4V3uJ|BU%zul)JeD){hOb%Ip2mJk`yJqhjAG4zmBSOV%@(J
zVUD2k;y%|{b{UCxqLdk!Pg|5{`4)lRfge9tjg>(l`nEFtC=~R0`A3pN2+4`iQ3xE<
zi?Lyd{pbqDFg7P~&Xf>dzTIhFa+5m4ya#cov5+H;A=z|Qf?eAhq@xhj6%z;eIJgTQ
z*9zFieIe>qCUSTSm4xzcYHOU|Otj?V`D78WyK0Eo24iK5;EGv);}WhFVjW>p{;w4t
ze@l@3z2ARi<^Jv>7SzP!7}H!yqq<5t&C2=qbDEJZ{TD)|QGwdJT_}*|+1s@3h>CG}
z`Olx7(D+wNz@k!I=51>uZ}G|$*+xG1ZA{$9^Y1fp-uD%2SF0z8T{BYk6-p*z>)G9W
zc>hdOU=V-&2AE*k%qco4UHLq-$&9GzS6FP*A`hQHBO-!~MYCgHr@U_G<1LH+7Nw8A
zi0O@u4WGi~@M|^+ytkjj$zL=*|H?iMG!cC46Kz`8!=+TG>f=niNPs85c2Wp@>N2lb
zU!)L{GKWYjmYHjiLtHfZOus=ysS;3iWj*o;l0q*FEhmo3U@k20?)=g!kj&zTRa~KO
zLsK$r{F-blj${0@*A(Fj^AzS(*7Ie2QnEW#gD#z3r5kKD_5^5N64iB#Zqn6YUZ!#M
z+Sf4KFxAU7dDbXGw;p<BF-%{oTqZ!!m^~s~b|NT)v*&Z-=@LrVSePD@-;v3v<ALK|
zfvKx5<GbO-YH$=acnj~q?yqIP&QyAou7-!B&0Nsa{JYrnuefUDJQYkXu3O1$(jt7s
zN!LK<)%RDMWP^OGRp6+)$Uckj|3P&B0qg!=TmQ;!e;A*$6xjy%-cG?OwWxie%4a{T
z!;t$?BTj<$wRz*DkO3Us3bF$xpuw60>{}0fAGcl#<geu=@(P#tmOEh_K>{V(U_w`K
zaMF}=2~z0@*6L0`XTfxg;)gHEUo{#Jc1Yp7%oilZu!|OOt|t!Qb72Z1qLkolFts-T
z%htdDmWybyL;_-a&{@>b|L<A|+R$dhqwGSxJ=dAM_!Yuhb<AdPb`pp<CH4pyLwGEJ
zR5Awekm9vJ3hJg3urD5VXOXrmKx2f@5chfmSc%(tmK)^3tMPqbbnv712u^_%93hT!
zj*O-rRKqGBYl*i7pF^|J?KBZxHVJ2hrgwTjj*Vtf;V`3Kx3ng^<xSVLbj1gh!@|wi
zDel!7Nl6{5ynOH-n*A;G`<?k}Zun-yd@E=Rpy!tX1JJXfeQ&-6a9o6V<?MFyilyZL
zEuj9bYkvr=i>O`I*O?6J;b9sc?v!WUdMRq+;%oix(@ATmM!>S6NpMV&crS$N$vY;0
z_A7Jpz0mQ8%CuLt5<)qjK&ELIbqCuF)6?Tol5ljw<~i<cFPq<R@p*du@I(fF5HMRn
zRxf3QCr51C8J2>RNBkINs6i|AvjD+Kh9g)>O>mfY8^%`|kERh&h;dZWcOEwYf4RD!
zPhV?vyF;II4wO2T|KXCW-weE51HX{o(DrMS@F7@_nTDtDw<1rQ6Qu+G)Sn0O-wN*k
z8^8Z3+W)t5F&-^dvhMI(>gagM4gnrUF2x8bcMyB6!liEKm%mA<c`|OP5kAj%VySzU
zG%dapu%Oq)ZTdvXzBP9ZAzWV~<$VmPxL1$aOGQxZHe=<`Tnox}nNOG?2Ltl7-FD|=
z$?;D|HpR>uJ}ky3@kB|bmvK+5pl`BzI?+yUL05BN!B(M{UEB`d>B*3PjbMWcJ)9G^
z=ZW`Ogf~G8UmTXccxur6;lSGDxWw=H!r*KJ!l0y+Lz&TWwoobKRoFH&Op7?BU6dEO
zk*4Ed=h-%%p-!A0vB-!ZIq~DGjkB0~{qT@(%s5TK;fB9u_;_EtPOf%a$mS;@F~w>b
zJ9xh?!Ze_7xZY5-IksSNpLnl6p=y3zAE6bYna*hr+2_p-%v7{E+82&pmXlx}2cjS<
zN(D;T;S=bL;c}*oNl1XZu=eN%jTWEPgBQE1+n~YyWACg|<A5x2<iL%<oYeyUz2&9g
z9)j|_>6*blMkNvejs9CzcIsbj@0Zy+zsX+wjQjjo|EBe0`GB_i59I}XD4CCD*g&<y
zKpABIp~D)j^FgZtt$SKn%_paj{l4>noENgaRlCb;eUxcYYGoK`j0rd(AO4C>AFO=h
zg84Tt>K|s4!5*}AOD3%D=EoAxeZBOF@N{%IiC`>Eul1up5-=VHC7Aa38B4ADeE%dC
zEOjS3M0sQ?M`9bZn&0Pm0bFhb!`YyE7d7XODklg10iMhB0ZP!}<{|ikgFuiVJJ<y4
zo{CRLAJ_(#nN<(w-*9{<ElOg)Bmdz&Wsy}P>BY3n3TvWvxLek}w1ur3Mg#RXz{xp>
zv^x;QD@*(Lu$y-CYmgZz{L<*$9deRI_0!qh!&vCNOh2e)bbkRq{(GjDH&*ML^zKsp
z@jPA7d*xnRY|%#f7lO_wR~UEusKSK&WHj21MK6K%5BwzBIv0;j_MgUSC~;&?K&z`e
zU_1~ZtE60`97&V%+7PpktXc%*#3<GQDHEd!RVHIw@}>muTl3_wmir_o-ByR_i?KA;
zB+h?6V_h9r=?vEb0?r~mq-fLvr+MG}&t!w|+hzYdVK8wtm*=WjsTGmX#jNr?wtUCB
z^7skm7d0wjC2P``fv37_V}03O=x#mZmnrGf3+~a}LJ{UYJu1?5F;(w}v3MMBS?Ijl
zf6ozVOd2*_11r%}9EmRHJ4*{yeJ#B|t_dgeGYZu^?fbwMO<@zjUeDwKugH_()7QLG
zx?|VA0fTD)mmT-sBse__h3~;OzlbR2=$gBspEzgU%TYu9#1M^kJ{I~BENvwO@eCx<
ztuYv!rlDGk1l%BSJk88NxnXbUXj|w@YrZ^wxV61A^okSNib16m-hk=KMBO6~VNJvQ
z^~xm1{?B2)CT6g9#x}Y|`g)%R_nSUf%@Jf33SsZt@K^hGPgcrW9tJa!-<7uX&KK%b
z&duYlzl<oo5PO3J%2X|DS2B$YMH>nl>2M^UVcj9#L4R+4gh`G6>AXUJL`3mgTn>Mk
zHlMG!un)@EZox9t8a^2>*>#z+b7I>}iKp_Faif%C|B9688)~+0%YmB}WqZ=G5p42_
z&ak#+vBlJ4vFMwxP2YUj=YDuZQiR_X=X9%^^UUDEssydyk*H1cF30N%{@AmR{&)<q
zwp`j<aL=fIbM2eyrWq4Da)r9-Ekx<;=7h@PU*(^M7DB)mjd4jJ4nXEex{58JxD~GS
zkO0PfPM$m-GkZu4GTV*H(7jqn8CT<)Fc`-?K}B@Y37p*j%miv;0PS}^LBK(MzjY1K
z{Q-o)TRZS`9}r`YCK98>!Q(u@9D8#1;s^@~P^Mq-Tp)a^8c#L|5Q5r{%9y6d#wTzr
z8|cn3EzCOfYuC;>KIoWcb0DYF<^$q?>jHqk*?#YaCuPlWIQl!SddC36>+=jEsJEZ0
z(;aL+@|mAX6I6j>?a&2aPNNuBh}7@ukcsKLJ-sG!egYD5Y@mvYJ!LkLJjqlaFn5MY
z-%MZh`RqjryF+jS{&?P)C#Ge-Y0&iDhO|dM^_06G9Au}i&f3!YIy)+3;UyDD)~mkr
z7wazwI$$SrzCQQFAz|qZEXeRcxKn8QSszYb+Dae6L%}2%w^~%U2Bz-577pQgV3`Vv
zK0gk#;}0Xe`AszXag+ys9N}M-pYKOm=KB#YUrWL3`(c!6f4IfpM5n*ie%FufkG!KK
ze9Cy!oGDskma)``-4^RHFo)8V@Ayj;#rz(|X`PdTb^VRgknU06e`)m{h#3B%^OFQG
zG@g+h5qtw`&qf6UAxoOWkj>;H66MpdM4S1pfh19E)CHagfMLYxSdoQb{I&eY$1y^Q
z#gR)y*XAYWR!8eS1CA|~j|+t-+WHLlI0G!kYSx{PJ@E$<bU8-KLlV4)Twi$rkiim|
z;v)Yroq&+7@yqIP4Khwq;452DiWA9|=1fj=;nLOMh)_nN0FTgnyH?W;1u@BHNw<B_
zCmWhqcicv!;ICii%<vCSgxfqu!4*Pju`O3qB5*y(eU$U$%skJUCFA*!W$lCD$8@Dm
zkvYwbrVL^kV_1yA?8OWTWhGBMdISOnqsWFDs(6e2qb!-yWGvG+C-ej7t0|Qm0%&x7
znb<vz24rql74j#F?e|i~Zl__hVkvK<d_1DgN0Zq_#1y(%V+^yW#V$A5-}<y7O6H(5
z8c*}i)ckU}vu)|Um&CQ0Pq1>^_?N#$=^aC`43Ac_ZSrg5>Ndf}DL8ApY8=`(MSHRf
z4HmrM`Gj~;*tj$JZKv^Q+Jj{)(7(jM*mw<RZNS+I$<>e@khP=`n*}SHAhyuij|jfm
zuU!OZ`yg;@R6r0zO&&q}qN?EM2D>R(9v`|8p5X3{J}|Qjj~Eyni~~@t(;;XXJ7l$U
z5&`ErRe{HW7bK=Jd$JB~_M$$%;5xhTK_CeB(zlKc4o<M(Fxo{$ME85JX*QdS!^U~=
z`SF9D=|E>Qzs<RN{`Yl*8RZ}9Mc;q*!ZI>&fjTAW$hxq;+G;wYJ4AAv{vjC_9iW3A
zq6D04KK#Bnxs9*O-;i2r6^U5~N%LIv-Gy&^)G1@CuZHq{F|517ST-g3E}BjZp)%!x
zNm!OZBSZtf0&<UULa(JJx`Sd+L9@nH<6(okz&47&zNcM?>q>#bJT;EP^$4Y)IBa%%
zX@`Up@SUcOJLwx1Tdko+&csT9Z5SUbwg`g}!`=jh6=)iM;bdd+G+?IHwTM1U<53`M
zBnEZI<{07oww%L{`9hFDhGF>@(Xvl=L7n*rj12Ist#C3=5+@i}y6ESKig4FbUg1im
z8&#%_7oZh*&}zH6ILOJ38XD8aX1sl%#8e~!g2=HH+~oiNTE;(a-&q~GU)m^zXC{4B
z!tdv|ZT?`_nD3rkqVJs|?Dvle9rU{1|B>QGsxhm)^+&SXA_4s=czD0TqyKND+P~L^
zMq_yhqS;-}VY$=yfzU`ibHl5Vk+{X$HeV+Wdg+@C{MGAxMhrBI6^3IU1O|pRjJN$V
z45+3aHFZP%IY%M>D-Ad<$5C0KtVNIBH3+y=FmJF8XYJw#vYessxiiKgT=RN%SCx7-
z_LpTo48hr)LNa<yV>I+aqyx4|KMLGCaJoYSPUgo+6rs&*>xu*GG+p;#CCYn|t)=IE
zB~2P3iD?EF4@7bTTHV?gaUiV?sAKnrtZbi@`4bMrT0`OrffPrw0@Gldc^O6a%H9KG
zJ%JX!O|n8G##huz4pSqw%thC>xBFBWquzqbA>L23oS$Vr|7O2^+QW<y$hONqvwSwt
z!cd-U=GP;!Klh?8CgG&VK{H<SO_2$wAZcK1lFWT<krAs-ta}srUaoU{n`?X^*5ZI^
z9s7T_zh7Bk_r~}xy?2WoqpdBaZQF@>z8Fo#9$k&hD5uF&La{?($+%0QS!Cfnj11ZO
zJ^^2uQwVMcKG-7(d3R-q{br@{YxHn#))#|mVymrR4c|y4EG;rpJd37bWuq=@aXIcB
z*r9i1ckT|+lC#Dq@mj22eSa7azRX8U#JE<<xCVEL8G|usxe0uG$qOS$Jr?!Z*=t};
zL@0h@X121BA<_gscqLPO>U84nQ&=5JXE8(L&05y~dqU9fi9~;H`}2PNX#;=Sz@Iko
jrw#mR1Ap4UpEmHP4g6^Xf7-yGHt?qn{EiKvA;<q8?rIwA

diff --git a/systems_design/images/microservices.jpg b/systems_design/images/microservices.jpg
index 1e5cd67c3f7bf50ac37a83328cc32cd2b010e802..10ade7cbd22bb855a142e76e7c06616cba575e59 100644
GIT binary patch
literal 107515
zcmeFY1yEdFmoD4{O$ZPYBv=E%0t9zy2*KT56C8rO69^6sGywuZf;$9v2tgXxZlrM!
zjl09;eZQIipKm^yJAY06Gq>uVt~ym+`<%1(S!eCFo@ec~?x*jU0MF#4WTgNoC@6sM
z4?n>DEI=H9g@J*IfsTcViTU_3)|00MI8U*$pOQR(fk!|=N(rPOB`2q%Wo4jx^@fI=
z{52or8+HzEZf;5j0T4f@Fe?`~=N}J2dHneCQ|zZNad2L8Qj=42{-=-op8$L;G$r)c
zs3@-hkML1Y@lo!(0OSA^0P4eRALje72Ra5O8tNkytcOw4X8;sb)JLdj=x8{P(J;{;
z;h_Nj_=k@{{hUJ#^M&erf>)eQp9qQKt7y1*->H3Y4uWJ=c8n3za`T9*Ya|?C(PfX*
z^GTSxR4+?vy1E^j2Y<==wW8&o*vY`JZT7kA=s^hCgX}-2@UIg903Jj<Lczd%805!)
zkof42NuZ&jqoSccT!Zom6(8+6H3#|&F#=VLSMQx@IJrI%(pGjHaKFnUQge=1|1frs
z06ax~xDy{0A0P@?9K%P!e}?~mPybg3f3X8%7IQngro>a8MD~fd9m(?CpQ0UF(t~p0
zXZ7#h<bUsQPf>{L45d?)r;PKonQx*3O<!}P>Gn3c=XoxGJ1r{TxzjJJAtN|e(0owW
z-r?Ys>?w+}xQ96|IgPk|EHGzui1VC_4I2-ZGSDQ}_oJfEZ%cZ{M=zT?=SQc8Y3gn7
zh(1|->W)-&>)spreNf(S)LTPHJ*elLKD)V7)yFpJB*w*BJ08~p<t?b{IUK5}2**EQ
zHO>?{3A+d6xr^QdtUB)joCmShtz=}LQb{%V7qDojD;Z<szO$Hnz=_t-Jzz=o9)Jcc
zo4isSd1_Hu)i}%#FnC3qiD&K6;aj6A6q>Om$yN6f?9RVG5U<L*b1n^PVUX87a7V-h
z-cqp&X7tzaX!t(2ZsLu`KVyA8d}l}Xy`i?FlZ7f6#+H{6@al?{!D&o&Qe|N51U_Ed
z+4(J&?nsEEC{I{x$fMZ0_e`J1B!goa8HXu$AeNmy+-Bz<>p<?RhlDI)R^$Adp5z-~
zd(V1Nv6$qeR&S!YWy`V{U^8!IG7H@)<d)E#Iw~FTm&zGO1PxDKyR>~7Kn=L=Ile&W
zvEC(<Ubv7X%Fbf*>NHJKT3@@sXh*xnVzFu?-Du4kq8_553Xao8JbFd->ec^orvh6X
z7v=oCpc!#_x(OAnXN-0~D0PA}4LA37*gcL8&;oxL+Mf{Vk=T}NI*zM#ac-G=U;&NH
zPEef-13)|?)h;WelSvc$5j5)q-&suSslMj)7_KQvzk766>+YlORS|hzu>sz8BI|fN
zb~7GF+4^+tcty#dAKfa(R_Etr;N+)3z)uv60LdB2w)~=c99^d}STaUhu+Gu+%Yf(f
zX((&X!igK;NXWcgzm1@kb<s5YbXGJ+4DjtoVzqy-@7HAI(G%KLn{yvE2-)0wq<=1m
zPM}7e7Ojb;HCG84wxn>wk>~F{I4I~$)A2=EO{)w~Dmv_T<@&kgeXEgJ(!5g>q}EPL
z<3rUOD>bfSX#tG&*sO?lX+su{n0al*$R_t#Vo=6NvvZji%liVi*BB#Sxg}l>#IAiD
zR6x2gT*_w!nsS#jZ4el%YvQDwJB<I(TatgzY~_&Eg46F(%uX`Rw||l}U~>GbM=xBz
zKlEbZHf*33SS=k#NqBjaWn79Hru`d<^!&D~J&RQoOkuFZXL1fvvBoNyq_E4c<<dWr
z+(^oQ$2E6&&@aj{?Sa%HK$CbYA@P64Nm6&RshoncAh)57L0Rn_%W5l?b8Ew+Y82zn
zvKQEZMRQtSSy-#7Zhei0QwpnHy=-Ba{*-Q>(2;{_-(ZB`k{I8z+9=5|HTEk#Eh*>R
zyCnCZZamWy#ta-$@U&u~<B813KJ@V{f+ce;OliExz{C1B%9Dd?S9gF)?E24DL@2ax
zDX6X{vsJP)`UK+HN}tI-kokOLDPg}q&^>udPsbzGRL!?qYVkJH=QJ}GW02it6g7}2
zDV(d=9&Ys;Ng`RYONg+qgnkyuOJ5fbJEXJfIA2BWHu}A7ZBGynSJmiLSEd@E3t8TA
zJfiu~Zd1g#U1Y4NtxPEK{HX||4sZ(Z5pK5%vY9C-x6sc&u1RaFX%qO0F~eAy`o=T8
z5(qHCLnCE+(}x(*wmKjwEd_pix8UK!&Sone9iKkCV))}Xinb6@VU>-Iv23-$*7i#P
zD}M8oMZn_%_nWt3+~MI^;er3tPgU1s%2pIP8a4vrW|cZXq`Zz$olWd6{c+Dvpiv)L
zP=SzA+lbki+taKSKIW)dhiqFVa`WVm!K0yv_#2N>$Lp}Td%o7sSRd%iKQm3k;9ndX
zzGz4|{NH^0CyD+$!yTR_JSSrVmd%e0W<zRk2h*fes6OtT(pnA~s$!Vg>)it+P1gmb
zkj>%(@G<H6NvTC*>Argao)^<ter-<%Jo+BsW<cY+OXBw?BX<xg{A0g9y!Tj3Qw=ts
zIn5(KtF9@B^ohc9bvv=&D=-bC=@M8S;r|_kh~glm`2IT#1J-fe*1x!GLQXhVKh%<Y
zVV050ERr%M7@!r#Iim++60K7mUfA>O-N44ZcBVD+`d*#=KRo0NvvzLc*=hM$pBBC0
zR&J0J2<8s^6nOb53@>tQ(q-nyrP4j1jEC&DskypvRfOa1=w$pp<|zxwe*!%dDyyFb
zn8G<Z%kvo-?VaM@H>fr@6-I-l!(E^mP7_b2!@2MhPuqe{*}jy+CV2yPpU{6OC%WjP
zT=ao{qMIk2>?nSN$PXLesmChL0nX|<o>5|Q?=6O_%f%K7an~9$4=qe_p9wAX+4-R?
zv5KC@kO>1@B9JOZ_!b=7c49dU=D^n6k6&1YITi~|SwCNRl%l?2=rtAo1W3$Q)f%6B
zy;7WA6q%o)+D-nWMW7rg@iDmQe;_yTfAv~_{Yc0__-QAS93<uGm56Il+pXKWsftJM
zx?RycHXFFV-Wf}e0`Y$$f}?Ana>L3AZR0%Ky^7HA%7=Jmz8PVQ-(+<{woHvIPI4-q
z%j`rtD|hOc&d{JvFKxufiS;t~)aBJ^5b`LWnM90}UvR&;P6T%Q`PGRLbTy?wod$ng
z#4ZqQ)D}4$c@#2H`-|1Why=oV_)LQ88q)fmnH!GJWc4NEDZt~h@-uE(<F|F+<yFqz
zJjlURnM1$YiWe<+@ZCM~5de}p^=1ctM1Xe{Gx+m=E<lPcb92BXE-YdoQfEo6u~saO
z!X21jb=NH|>v06MSthEHXR~=e4I4Eu$dzF5n!u0CSSsvy<MHS(l+WU&jUDYE_W*gi
z&>JiaNa->pZRut1+LE{D$q0{+N@|$G%&B6_n30ufahUV3<**)Kz2#=*=9R)<eyTGr
z;x?@es$0Cyg=ZzN^)EX2r!kE(BLQeU5~@l1yVWYQuNw49OiS_-5~jT<AK~tbNW0Ph
zPjczOhxqRn+2Rq)OBR$W%Sf)y!9wTta;Bku!Ei6G>~ml66rTH_NLDAzGAu=d@lSiH
z_=~+HDAFE_=w=wx3>&P%Wp!ENCgtdhllZp~e#yd*j+gh2?*ZcL$46{K1B9`ZSQZxJ
zXO%kXPM#Uxi6*$Oqr-lBd1juxsgEKcexeoL`5}pSg%9OZEb96-L5y%scQ%vPE9xAJ
zA2ESP*z+S#tzE)#P-!#7?3b37^GR~g7gJ;j!(%v$z9(f^c5`9VzVA%c24=OuRITK9
z8S0<H)PA6zhy09=&9m|-X7(G$rH8%k55-ecqHd2rx{VTTc-u){Q_I2mcBgXC5!agX
zM@Sf?x?_a6bg%umN&p-&D>?oY%tHJjk|v3BQE3w5@*^fo(M31o8w|GwR8ws>n%?mC
zTKg*yNOMc^iqSNKn${lIG*tXkFSWzL<@6=boYys7S@!6egrwK#e>!{z3$~p3sEfJ!
zJ?KxfYQoKF@B~ab#Ecm{4TAVeBN-yxxBN$~_uz}Kj2X?Ukh~wSNP|DItxD`EV`3)V
z9L8~0JZUdF3CYwRePUb2;gZuA<nCSdbN`oVBUs#C8kOq%k5>b_g**(F&v}!zQdqBi
zsDCUhzjytC`&MbJaclc&Cf|!sIipkK28Ao7Sw-Od46Q@yH%hp+Vewdk|3lIv|J3K*
zwl1vJcK#d`$y@!?Xi5GsTJC>wa(^1F^}iUcS4G0cu|r=wqH^V#-u$~)OiDyJ6t^x6
zcPLjwTHEcXAcs5DyCO{%a=iW{a=ST-dw@XktUDTl89+jhx#Vwcth#l5C409`aHnM=
zV?}#}9kI{mMCT2YP53E*Yun+QWUDZorza^|;PzryEz&#4SZcLl!&HQ3perB;5LHUD
zA9U!g?CJA@Lnw5FpmOMidCUXO>~$1CW2^l#inL8kg2?<{3C;bePcXs)*!0C8m|tDW
zrGcksH?ix^?1IE)dXvat)a96k!`r+32K~-O4ZEW3)%ucIxvz%r+|Q!t=Vx-{rP<ly
zEYBE5L`DPdk{>|NZbQJjcKQQzUUh4$vVen9r#NnYMy?VB18;C{lBY(>G*DP~R<?if
z@fU|@1|oySBr}9+qDt*n5~}Bwe}c-fNLOR2aJLWKE6CWHxV0(+Ej<LMs-+`NtFPj$
z!mB4{iBiHT6@vDqI~z};T!V3LSU%18SJw@XELOG?rL9ipWZp@TK4FRxwIO|#y8@DT
zAY0vmcm(J_(TmmCx{l~3JepDSr7kfYLB6KP_pKdraURDyMECpmr19@_c07^~W@8V)
ze5&U_Z-d{AA7}#3vLtMJwV!L7*JAZp{FP4>vXra&vgMAR(|>XwH?1Dvn9lP|(-mA_
zXVXg?Ni-nsl8-1~RO7e!)M*;$6@7Z;=&qHg2yenoR#nECjLbS~6_ayObSil1vDV^u
z?QL@ROAI{GbXJUA%{^RGU{`nHr^AGD=U^l#$mfi9_ZaC^dHUAM>c1VuV;>UJ{VG&d
zQB;%iB$WX&e818rs?nmKIH1}0XxMc;|JaEHg0vpMgLtYnL(0+M(IwD%6IdjCq@i?~
z@8lXQ;KbBjP;;J3q@~5RW3U>1d!BN1+qM_Lk<4o3Zy$Lf#>JQ19jr`RPTG{eg5Uho
z{~j=S=?_N{fj|FrVR=@jj~a%enL9StN0YhbKrWHyh__Pa+{!ryuIVQGddym;H2-Ct
z>wVR?v|)%rT?SVe{t)!1|0&xstMENQA>cRqyjq9ZL@YRcp;{WtYZ{`od77E!^y{QF
zAr&;evs#c(KY55JSOQ1S_2zjawr9~De^rJ#cu~%lVQ2lwM*NrZf+#JX)03)A6XNHM
zz?Jjo+6dF-)yQpymb9I3^Oo{uzeXHjuB@fsUC311fMd~_nCNdIeBI1B@p%>RSzMIa
zrP)hU)#~JIJE?H536^SqUIfaB-0U8zPbpHP_q54X$okqRkSpS#nLRc4tuMV29$J|;
zZMq}RxDzP^-vi$4>ej4hV|Q0oF=ApP&c3dpx~KV%Jj=Z^>An+G9(`id{lPp*KyN0U
z%~Omv+7z2FWJ}jJiGd}6$;R|+#txz_D0^1x$~)AtwIx;>4}UGsbuZhmSXEg?{`Z^*
z`JiQ&muKvW{dp7!v=Z0-dO5xsN<~)lz;B*a3tl~mveVx}lKeV50+9<#L!uI)16!A-
ztc*A9$2Bdr76}cuas7SSALIE2z$CU05zKpCrABjDO0#L6CL(63NjTFCY~qFA-eD|Q
zk+Xbc8Xw6<InQGUC-Zyts^PbU1o}EHha47!R~SFIYt&hoxR@%kc*0$9(h)vmH&Oqx
ztESWw+V$GIZO~QH<dq?Zy?sDqRMXX0EtpuwJ>b<9C-LE^n%3;vjiBC^-hOUF#itop
z*bQs_cDk<8#`POWgZ#^*Wfl_h#xlZZmg0);31Z2r+f8yeJ{;P!FFOuh9y{M&%GcWZ
zD=LO5&4)>iYPMlgMmMwIKeIIM2OTYN`R<(EDz6}MpY+6f*|RrUU7L()a$N~eX{*3)
zPk3sM-s!K&l2hGi9y)937nZYswJl;qX49Z2bWPRVV2Ld|v?1(=R_YCYmtb(+EV%cb
z%BsmFIPYXi%w;YJcB6Bb%~z==zt!`7`yN#k9q1zrBWgX_Yim*e)b8SBYfBP~(hbHx
z`92nJiLs3c`MlB8Z383d+~1w}N{`xAd;MZ<w6#dcXd(lG5Sr7b5Y^fJ%qOTVoyoo&
zAItTb^a-mRb_~UEVl6kJBmC#Sg$^yA^+imw-akuLz6MF>m+4i(S?UhuW|rJ{g)_;T
z1i-%ouE?W9_`^B-$xf%LZF6}I^);@BKq`BC^FE$*V?w#=nH~&YmPwvG7>yNHE;3Zn
zL4xJ-F-?$NF&=b3AtpwP_h#|34UYE!L$8ojadoF1aM>4aVweH9Muja^nMVanLwYa}
zV?AZ<?QH(_vq@E#37EL9GKIwRDl0lGUuUVMjn-VVXVUENe*d?oy~Hlz(ndv!=K1*;
zPg@5Eq$9{aU44mkQC*1l9<p3B`~1xDU5)jw_&ky7q!4VK{PVSl^uUmh4GU<2cyg?o
zZS#%kehV}cQdp7rb?E0%`z3qD0%Wopxvp(o`da6ly+buAjZ(9{TUv+baWrpa<z2<=
zHHPH)qX#7Xu2J+PBH+y(Jg5Iu;B4DheY0QQxNh0`a$W4UTlshWo%w{p*+R{BZoaj!
zQMI1e8U?idL*bJT-2ryRMk~1q%8Y$fW<M^jzxc9gw>JZKdeRh|R%{)<aF06)eRjs~
zGh%k_rWlPZW(w_Iu$RYtVYtCJ<Jg&P!8!>4Xv=k8N*jOJLyS;QiG(jqpD(Q=VN!FX
zT8XE8h3hzjj*m7o0+&8r-2*;U8}Mkh&FWm~>NDqB@HdcRk&r-nMsywPt-W6;Dv%<B
zcrBb|Zx|>~*9u?A(@uz38yM2e8EgV`E0RxRb+%fh8283Ils}}4GM|r>Se|Q&eiw~Q
ztTEc!$M3yz?;Rrn90m$pN9ew*+4@#P6lMPLIIW>ID;m=y&G{Yxw>Y>praS5~{~B3P
zE}OE~U|0@2ixlTBU=`vB+*`eCD(zWzENp}~WqX)I6Qt>50m;}glEam7LcD?4s)ZOJ
zinpGfCb3Ni8Y&K1A2k_!KzU>ZUrNF^2*)aT5&zu9R<S_kq<YJnMUxh$E$E^Amh@>E
zo(rc-Qglu5pyg7YXnZ=IlEJnutJX|FYfeRcIVRNESFTy#uI8+mcjD(9xBVv29wcix
zGw(-<8YBD>U-o!IU9FWP-;N$KdFATSWT`#i9Pup@dsU*v-|*lxEN<GX$d0*urA>Rl
zqFF`W0>-_{IjXee({bS>v_D&~JjtgmDY46}(6(z%{O!Ff-!-pIp=Go;G|WRP0E-{B
z9xV7AXHy>W+K$aPOl|9%+r~3eM1wv}Dy}C*-_S_HCrWhAe@`VFi+^vGY|Sg{D&k1s
zzI1hA2Nf*f4&*&kVfLY&02jO2CBi44tlqX3XN~z{d)NyHVt-LP%gmQ$*V3;wd<mUK
zk}@(mEs=xN_nqjhUk8hR-_;vt%E^LhxFMVyZ&IAYtN4H|oX#|ZOUy7esIX!ZBN?p&
ziS6`G7~V5!o>j*>Rl~wXdB@z);`BS1dJk~ofGL>G!p)sTQ7O1xLpMYDMIqDU46yj}
zubrd>_-vZ<FC0c9J4~x{Y;^V4wd?Vd<qVFTn{o;@&dm#)x|yg6t0CXj;ObLq((1Cp
zE))Huzt<x=20cMyWY2>0{$V!81vVk3t4Ie@;21(Hdjk<5C7(haeCAH=`s!(_o_>Xy
z8>hzXjH>gPnsA%VTltN;1c<@lact2D)VE=aw>b|7xu|UHP;9RFW_JZFGao0tN3|o(
z?#^60WQ)*S!lFR~masiArFKgX#(jhcrpAnghnM4z`UGFIKv({av1OPEHxIYUm5+*k
zEhs5t+cvW`|Eo_L)Xg^Ro#<r$`~O6a?7w~|8go-p4JPOl-BuNmQ7`ZcHS_E7krqtz
zlHA*wal$eIpQFeuybKYh>~uIe#x=P~`_|<c=r5PuCY{jJ4!q^P8?Ue#ls_ECv36P`
zelcgXB6pIZ#NZff#zvUwWAD1674vixd$4pxn4*KOaaLGy-jEH~<s-b@n#J+c+A~M7
zWu~%hmPGvF>*$!Jh{LbbczpJ_ezVMWegY-+u!-7^e4VtP%J0Omw_631!N7c>;YsTk
z<Gox75NEj?qf^&}QMgEkJCRIhkgzWla$rmYsn%D}@2|PUC-y6btGbswd&@r70>Q7w
zy!zb=1<$Y$mfD+z&mO^T3Y+2KR4=U-WU*#~Z(a5L>SmQ~ay~xe1N^b5Md(=S5I%-9
z)=Tz)xrSq>L*_=mu!1W;PdKvPM{bC5{8mD;c*pqjBX(`%4J`^J7_{To7MopAU%#ut
z$5d=}51^G%-e(rq-8Z#AiNV?iV-aJAXvzSk-ih8MX8i-|g6o}X#mtzSUlb&;6yL%Y
zsfEeY`7^i@TexuNYBLX+*Kp?NNMP?1ouG^C^P`0xdjGhN4eZ61mmpxqwARp^qMzZx
zp-sX*_<15%9jf3G_#q+TlW>c-C5bj1r;r<7prM~G?wJKH2HLUC42pi9!a?};e`e*|
z8(^Y|JXKfs9%pql^T4c+%noJ%$j2-U9cJc`afg;hr9#Rx+LD->WLGmXEHI&O>~U=o
zUeDfb{lmyDmbAD_c$;Cg0dI0nIo6{W_K4CDp|Fg0MsuM#H;Z{R;*r&ku-;4B>N-he
zS&7-*9t{$F=8PpA&Lj~i^`yW23n3_RVXb{;#Wz){{H?wF^!bT&=I#mw*#HZ0PiGlN
zmzV{|ji*196d^DJ;@-gn>kR8Hc|B{2`>$Ue|B0pP&*YywG3-NI`rX28lh%&>M&|hF
z9w4>Q?pWgN30qUMwoEEju+hmr%MGcX?7&VB?W56?{r&h?1JaLU;c#kpX8SmaKGt@q
z&7Y>CJ)JJMCJZ$QSIn3sGs>RT&<wnYEVCK1Y&MUimwZ8EDy}n1Iw}AVVADkZ&^|G5
zVk(d5|GsD>yt*PRy`y$CLXO`gOKYn$2H7MBv`r9wbcYg^p6NzJ#1xYrrHbsO7QAP`
zkG_bHzAL*+lvPJ$pA6L6lAsJedqlcp8lGV}|HFW&L{oC%hZvw!>PSXvka9cw66oGY
zUKGvITC&*M{O4%tzZsn<dsr}<WG0^)P(An`77U|Z-2`HbOc~V?V;%Y}Ho|b=x1Z?5
zc29+7GeTW0oed_TSKcM@R`b@u?GjJIs9bD0HWVyQ7JL5redgh_Qf&TRgQjiV%yABg
z;?YXa@Z|A{XSnZYpH}q)G0~abiZ!E=QVqKF*;y%Q@1SYOKDj;cj)Bn1nChVd2;hvp
z^^d=sr}9%b_BN6nvv`^DsmfjSa?B4{!oSWXNE9_Q_Gj$m_w<}e>;<)?i6;@LQMtK?
zkmp{pM41nno+g~gTRT`%VYyauK5Rn1Z)jrzUQXTtM3*bAR?}l@7HRD(t(m7;v`waD
z(WfR8XuS5dTO(g+f6?3U9X2MdXaB{c#2nNg<US&+GR&WAu@pNe{R(#}h#>MG;CD8X
zY;ZPlH`hZzwYL4b9Jl071<vw$_4KR9ZQMeGvJY=qgJR|UaIM1XKv&P|UG*+9zPB&u
zV|)t;j56e+B!(G}?m0E8Husw$t1KizUFlb!sb{Z?vgEgEW}9n17>6};*M4e;&e5Ct
z$D&mXcO%qC*Av%ZQqt7_<^qUIrj()+sJF4P80Cz>zzgZxjYU!Xsm0-~A%9bI{lxBq
zSLwW7HeEe=krf3p=c_S$?z|)dzed?eMX*1Y7v^~eS&}!HvN#<=-xVR$5c4Yb%8~Ya
zPo7-9Ho7A}2U~FJuZg`J8Ew;N$a5~TPwiPYazaoNm1vyXRQ@Ya^t=cBuDLd^%YaKw
zQ`rMHR)?Tnc}=s5w)r0k2A8eo5*nQj={#8Wl~1k?OW^irUtk6Dr}#uUm45;di@Mk=
z#aR$yGwuo`q%i9zs$%J{00yEx{c%G$pkZt>A!xDcUD#nxOShc68Z(!=7!^)Qh&dAi
z_F;|4ck{q+m;-Kyn5MBSRP8tX7WWi8Mn@m}hsfs70pG@~pFt>?AD&!EkSHkJ$-8xN
zAGSA*Yj35ILO=F1RW|@mOapraeZIAoW;;xh;>ep9)f!|yS67;&{AK-nBjYngho;id
z-f87GaBQ1`S@ZM)%}1~hOr2siVdMkK&D@@f)$4zhv3f$RX5EjYZB|$_x3o|7_2Uls
z_59c_h+On!O)gb}WFZ(v{6r{3D;!o$yihi@l2_#Uvpny5Dj41wzr9aAAfb`&msjlY
z#r0gDtCdn!FLO~v0hj+C@Pxs$w$tuxBwiqHEVVpSd)l<23o5Qj7OnYZWCnK3hp@&B
z@Q6R`6|?y7D4Wp0oymi+_U)@l(&YH~L<@Wl5*eXX3A&5wr~G|*_x3h2(PN7E<ta!i
zW5V0(ycoehOJ_T;f$-eA2-R6&K<!!q%?s=Yw!SK`9&(}Bm~w;UPiacJ)HKvJAw-5~
zaIwF2`~vw?;qsDDT@SwB#od-9Y+LpjchN6}S3${a=JlX$xSXhlZ#>a+eA9<H+ODa_
zh?D(DzI4%A$30EjbQE?h_72ulbbzs2&w^6*Yd2&-bfXd9o~m?rcXpkpt@?ij2}{|M
zzB}Yut+R#IYHjVp;}9Q0vy&`&dicVE12=Y-#6O|Apkw@q{4~p5B{>5^%H+B_I5>r|
z$4SquB8iMk*#wn_(1_;o^gRpP1%~!=>kaZD^bM<~$^62Z9aa}$8J_ZSo_XG|35W(J
z&$$3XR}#a+rLwvAhUi!n1@7VwGJ_1w47Chn6;-g7e@TESWb}#nqNE(_lz!1nO*+Rh
zm*nx!OR4%bn|m0|F`ke#F7cMd%uZzX(yoqob)H4Atq}pC5c02#0+~y&rA9-wW>!*4
zp)bTxa`_**L+KNig68^il4G0WW0#z48w~IslXo02&zK{gFU=}qTJdaTWEV8R+$x?;
z^cd5I!8`TF1{3Oc)!t0i+XxP553{gdYvPQ%t53ipC;N42I^KMY{>j1sG;v!Cek&>2
zyxrdfGUxqTw{^M4vyzy|K?JMgC4z`Y4TKd=?zXKZM6*T_HASw<`(7Fa$xE6?I~h>9
z2E8Z4mhVj6h}9vg$&g`{sqXcWuHc4EMW)jk;-(eFmqoT#^U8XXzcmAY$_Zy*bEdr{
zk3KWvX?69^HUt%XRBoP9>zc6zUd5wnEO)Y4J7KcY_<B0D;Xc}njKH%B-1>Iwr&x3{
zrT;=Xf0j1wIWFfoEg)zLR|zU!wH{luMV7~0t7xBIoL4Q5=B%z@X_~2V-oS@r(Org1
zGb!A2@jH0L_#QBBXI$W_;9o1Wb}6^9kP%CAs<#XS%>X61%jiDbrY*82v#4v9u<Cgi
zPS}uufRHLokD)xUa3GZXY3=8FkEKUaGUSt^|DJ^Y&6XE7?=CRa59C~Hdxe#D$zs{i
z&^6Hli{%$N8g~X=3MWAti?>WFvNOQ>^aIMm_K`aCeM62Nm<vzv5H{h=*6)i8;;T9y
z0;4mZ<3@uS{+gH}w$M&ezKrX<{evp^N`FiaNGwyIM*B+i?DtW{34f~^`^N>WMDI%q
znQC}*1&@YM*RsE0?boOVSOeYDa}K^uoj+QsIbEk!NM(T1ke=}qHI|d00Zl#wd9RSR
zd2Ja@krqRWLTK?a3rf~xgp<`cbTl>ewMAou<nQ1{#=2%cX)+GFRDA~mG+RQA*1!LM
zFW#x%n+-sQUfu&P?g5vFW$4dTvvw`t@nUtrT)&3~`bl5-%T-Jm+g)MS%&YB+(-ao5
zfw~n5^|PJKTAotxtXK&Jxl?voYWd8PVJ|FA#`G}&nEV!Nb_uPo2^Ei0v(=H|MJ_5U
z`%l@Q;k9GEu1P#k{T5)=G^?bpFlm4;WLLqF)TGt5KtgA0z;`N3(-kC8oK#^~wLP<D
zS8d4V4c=7h(U`N@EKDC$uLf4KI4xm@2a+`hqGjmneci=YHR7Gn!`)(5W{S%BCJhwD
zLd~Gw6EF@|JPY&dYehEcgSc9o^l34}gYN;}_W<33L31=ZrShujW}PTCEjV608}EAx
z9v@SeRNxGseJ4%QwF}KMs`cb)vd9z<&V-CErPoOl|8ijCZKt^YucxuBTU}VFAEX3W
zNEc`9<7#BKL+ltEHEWz?b=|%Wug11{5SP@0i9rF@t}Ysa6FDr$Hq21~hhqiaB+5sZ
zesQ2#a#Lz_u9{||if`4|dD|K`7`U5F90<FzHwEb9m2J(jr8lT)K#50BijW|&T(-S1
zCF^D$3JSD03spiMUiw-atN5MBWbTIB<6Z{e)tBy-vNP)gs@jsSyN}jb*-RUjYsS~V
zI8t1K9YpQ{PORACp)a>q%-DN+S0Cs=4>v{)?pu^zs!n8)gST-t1({t&u`MB?#O8Wr
zKd%7f=M<1W%*2U1zB;`QtD|?uGjf1}()!Bi);?pIE{I`7mTs~s+gg`Se8opx&y03;
z<}`3w;7ET45QNn${Od|ARNBy^_P77I%}%J+B$pcO7D99gie@wMNfj2CUCiJ7_}WmO
zF49&ryL`y4#kftbEWfC6o{5P8@;W6Bl$`NwWfL_t=<Tp~#c%i#DJeSuwGYF|tT?~H
zeaf*sFFrwxCkV5f*-HSNKov_<6<S;eGjj8=bw?_srbd$TN{l*n?Mw07`wlM>R=#>#
zqI8z|F-m@Bm)kXw$2*jNIomHUu8j{$Bd&9_B8FqKnQ-HT<DOruE2Pz~Tx`4N-o)HY
z1&ORmDz^IIWy)^^ZTw1tndF7%J<E>5fXa{}%~NhqjsirZf_4KligxY+26Lq<^O+Qi
zFQ%_UerbzN2sO;<{T}FZvKr=mJ3^giw_38VSm%!V{=3-+y>Df8kR*CXr?`c!a-R#Y
zG;Y^58D=ZpycQh8SqisKVfR}O{G5VC79KUf%Fdx27Md>Z@1@pP#X?ef6YjU@#U<q@
zn$I1zW-Xl{FHKNc<DQSr<2NpE$f71eosCh-tZBI)DJfy{oc)JB6)QZLuOuclpkB!J
zFsRp!5G_t_)ZO)9xnpxA80X@$jM~z$G+0c!;Pi!`F@)`zJl74i)3WEqdX`n;Kk-XJ
zSrs)ksX59493C#7S#g@PHYgotLvv3rfJWr8lKWYw3f|31P@@eGp2~&}eI+prlG$B8
zOs5s$Sg>Z61@Uyx=Uw_Jm5F$Y9F=|q^A{8E(!!3tyrbczJEsj5>)-zfRsNG1{ckAZ
zuP=$}@mkK09uThV>KHoW=f;Z=+leeOM)1beRSp-y>UQd>heDm0KT+`OCS(SMfGW2T
z37r;MtqWkMyZw65?48FG9DE{Ip1Rr!fm(Mrt?Be=dB<{aTC5M&$hL7l?xa1*b1mx<
z1&NQpX&_$u2Oh;LR#C&UrXe9mpi+~K2LfKbzjm!Q^<Y+KF<xIR6PxH&?e^`RTS=xT
z<Ku@Q>lD9sg#v0T%H#J$Zk~y%J#M-i<qoMVKPi*_X!~uKBM~Ql^;kdQ>I>@ihY2`C
zC{)tBt%V%lzP@+w#b$TsH5?KwVQs5xTUfJO#ZdnxC?#a|IDBMVeaKd4bTSaI1`x}*
zS>Gi>%G-G}CC!tyMn=^-^4}EBY~wlm&g_zIwNB})&6<k9LHVEY58^Kz^_Yqmg(Swk
zJtFFv*O}?8J3<*es!%s3&0-_5EY3hC#g33m!-pvVsgGiO=16^mJvGbW`5(1d%Cx+h
zxT1;0QT0~$-8uc~)JLoYL(i~X%flN6e_;_OOFxl$z?MQSKH<y<TOg0ZdRS^>9l~^1
zb=s68^EiDQkE21%t_`^>ns3V1GQVYw%m3NI-^}sIWFYn@Q}R)8ArJN5iPG0pPm2C6
z*Fl1d8~S>L=efxxV+pavmAbOP0}H24EfJO~uh<z+cJp{q9TY(PWFeR*wp#G^?U{z{
zkhrQx2QJao2b0|Q2h<I0P-*W1DAT1w?I^-(M%p1aC@CdlP~`_l&IoEn>fT=!V~e4e
zoT7Of%g$ABnxtCE#+0vJ;to1=ccGKbv}GnJSrs#RmwpRTve`D;x1NyQ2C_ZJAj|Al
z@gBU{+I^vHjR9nm6F+M0%W>4}4FBpI1ztLFWS0Mj`Ln+oAlbK>(nqZ^T<LRcQWG--
zQ71j|qC?qtQGUTLJogjDC{?_sRmeNPYF0$UEV-%J!fB$8uOWhr@<oTE16B`3BZ!dU
zHv8l}z@`rQS~qz@czpQnHPn9GH~16qym;|iaHf?_%fNmgP!;+`YA&V=LJ@v5DeS8f
zpz!w#D*lqIsMw|uA}StF#^(Ntk^PFs>ADYN$D`w?FJ~!MP}a<3);Covq_r*QY&uO0
zp$p|Muhp5mZ*ONC(?T^vY>Hn6=UX)Q7_9|j*N<+cYrYK~&<K~7q}0D&wf{Aqp@Dgy
zXu!by96OPY29r-iX&SmstyOZZJzBT_fb?bY?g6t-%BLt|u9E4%DLXfs+Yu93vU_||
zpR~Qx`-Ax|a$n-HNxi*#QTj8FH%=L9Q*)-_u|6D`lfmMW>EX?~<?gga6GRQMIw^0)
z`Ih|D+C@GfuSO*oYkZ=n{f`!9DHti!<}zWy5)Vn@tnE{+j9UJ>wrjgQ&+D1uuTy?#
z>zbnRLm>5ACqv&>V8A|h)cmQZMlGI&ApPP?GeL{FCDHb%c2W5w6-Ujp?ksDIy>C8*
zFDQZ;i`EiER>*=+%H7X$SZo{Y1Q|56oP0P%qQzgd3#Yd+UCN5fixYdu%A*U3V!ZCe
z93_@}`Wp!x-y<RLeibwuj~sAp<P|&o=;_hn|4rK_8UJQeO~(!tFn^+y_J9`Q*{`1N
zoH=-xQ%`|MPoEBN|7NozQ{Jej_LH0*j@d_p!`wU=p=Y(V5D;`R2<3|Cb2wGmm5`!d
z2BnxuoqDf;ECn-ayF7`y2}U3Qfcwes)gz|$W5X>wfu7m2Bk*J0;b(UO(i?oNw{mqp
z3JnV&L%JOMDc<Ip;^Ie;^v>=IkJ`QI?_*PRc7AkqiEtjcirUZl`8P)x+&+CXs_4lz
z16%h1FC?>FWcuPXqG+%Rf63?`V0Kwk;mz9XI_QQ|((LVa_9MW-t=JVh-&rkl9`wl&
zv6mc~2TQ7-G`5w#&44RxMI5ip<oZMyY+ND?F9Mos=G(fJmg7N)?|sz3SG@KUYfBYh
zw628gxU8*SFXet}$q8cbi4A;dXvGz<*57uzZL|B{y{YC}<4c#CdV{Ax%;x@diDay#
zbviHEkzx`!RVw<iPaC7C;*8Uk=BK~IKRh)w#AOv(6eVK7FLlh~_xN$FNNBHv&UNnr
zwmcIzGX)bToJrb?$kqBDsr6E)Ynt#IAVust)!|MRiGBS1X}Uf+BI;DtmnER4U+1Xz
z+f{4}Kr6bD<%C_I1y(~4y;P7N@uO!EqXzKs{r_o|z>S1KBHS)3J1JW%sb}0#@B$5d
zT#&$l-{@xU|7N)S9^g_O*9v!*;Hv)MWI`#uZ*UJ_nhSu!1Jd?a%AmN%N5h$_`PUM)
zh6&W-TPbF#-Dr^B^Oj`u5!!@pV4h|zp`RHs;_FID1}`o-59AqUvEZYue3I6UZwHkL
z2?S6Qdf^)K>v(fxCIeBZ#y#NSsTEB&*7TKcFKK-i<f}FtAbzH>@~XpKFdye;>|nXA
zYnSz5NvSH*j?T5Zg^x!?pfcI{W3ao>($d6%M)|Lg_SI*8TQ7b<RSh+1%WY@FxVg_w
zD5D-<l;27l>!M%f^A~TJV&anaVWGk)P*fEfCM#Rsloi=ZOZ6{_+U&K+>s1OJfp4zH
zCk#Dp=6;#I_Tze!pi{J#B;C3h#p*?ysdLIyR#>u4-3Ega8XW#`TrQ0Z1gVY^60#5N
zb6?Z<^+lRSCjj+u{d%h^5?Lu%ivxx|4z=fbxD#}~`$7cv>1JH!WJM~G+Pa=+P_h&k
z=!P~=(+BRaw4V7|eudlHRP7oM4<0mG?$oCSc;|d)VmGu0+yj(~?*TlE-5y4CWjbFo
zU+<5UvG9C7cxX$h8M@1^%7VGsuLj@|IP^S*vTN3gK@#L$`xnS-2aJl_Rq-9a{7t5e
z(9kbGy|^Ys^C@Of+Zzp4Iozi%)$VcLmhPJ!-QK?qWq2%Nzc)2F!a(Ws@*H52Z^#zY
z{8gIX5OdwSBuvG#qQa96Y-`qN;$n{U;51Kq;L+~S-=x8^e<SFhckTS0QG?prlO&`I
z$XtV96zr@>Wh&jZ6I?|2Y85dVUN1-Oc1D__G-OUjA&P&19vFS2jdzsnSpKs5H;cTA
z|0!IBH<i!RyDPo@<c|izJA+-RCA{n{X34@6KJ2i7tLzTrASfcF6Qe{MVP{!lceZ!o
z$GP-<OgltU6GUqv7qJo&{4Lkh>PqhWJ%FAEUWTz>!2^<SyR3n~%HZ?2LiZ7yUI>pA
z14)+aAwLc4H5Hk$o`c^|W}%gNSRr^9rUY};^_2wbm_qxP4=m(DKvi2_eMDc&r;=k^
z>Sx!S?g8O^eY(G0-BarL1*4P^OP<$fYV1N=JsPumr0k;ribqe6H}49{JF3r|JmY}%
zk5i<<eiUC$+9p|X26=~gY^*n!3LuvCbGpbss-P_8+=Gp`wa)_kwJ2>!u}v{RBMcD_
z^>%awwG!XzieTrwnKq1jv{C^)-%YplNU3s0-6gZ^pph&fWttWn;AQoJ7tJX%3wqFq
z4M4w4gZm--ji=Om4=_=)`ZpmtGOtKTVnWYIS-QO9`4q)Bak+&v525eNz&;RvxQg+c
zvxwrOSx^QGkAnx(Y(a&Zbkut??n@yDZc_5&PDRv>!o+xqj;>2uM_WB%Ss`@U2KV}W
z#$rQhyQK0<0|9k}30K0N<EhN~^A@U|jG#Jq4P<lcgsMgmMW-eQ7^A`MqoPPfGc9vj
z-GoE+c%;4^ArCEJv$-Igqw(-3GAQO~(^~tsOwcB@Tggkq5cw2>zd~cNE24zPaAfP&
za)qeYGc3mufwK@XQqgn_In)TBG0R90exv_1-sBQ8*-SyMR_#7`<^jPQaW@c2wD>2@
z2D&X~Hukf*{v$aP1j494HI)ZrDOF5+YmK*=vc6|$ROKzliIL^SZzkxCLHq*?=i}8B
zcIiN8MIp7x$eHrzm@c*kJKU(tpW-iNxM}~190>_ZCNfRGVYt8L)Dv@Q<JW5qdX{<N
zpJ*B!4S&r1yj!0X2yaoi9ovXVa}U4fLgx_6-?rzDE($ro5aq{p!ZeM=qnkSB+`L`q
z+iJdGHUx+2`{grPM=3<J_F4DNC0tL2+ABx~(4Lz)HE7kgN00_VC0W`gaJakkrHIXH
z*6d|(k&h1ZnM?L2;O{OZoE?`0x+qdH!yvT}#UyfXGdx#Es8$<|jG1Te0o~mv#XJKx
z2s@y8kw1t{CifzQYr}lty5C{K<3MYcf}rkNgL{G~<)tBHBEFH~yuu-I_a3maa;3iR
z6L8Vcmbj;I-bY%UW?<l12G_Jd&bPHKpMXpJTd7NzDb9CC-%jRl2uJ>M)0a!5#XDBE
zJU1gHxh@I*dThcn-pu5fKi`w|-@GRbeN{nQd%mDJ<RE-)`KL>`5H}tko%z4qEuvk2
z4~UA|GSFrzv99s@Qr{sz&L~2y@c)XdgNn1X!T&`s^-d4dFaOF);Ks($p-vD>c2L_X
z`VMKdHsl*$BGB0ljhxq1uMo7TYug2Buzi+hz(q|HoB8hP#nkFXUU${Un8(5?9i2oT
z^Ha3dmOQ9nfqTf#58?gQ7ywox$K(&LetU4F#eb6$u~l;xqGbG>2QD)=m{l_}kHgTq
zs8PmHT%db0<kq%}qc9R!`FV|}E4>2<v{@Z|-Kbr*-_&o9E2K`|onyEt6JApBw<Nkc
zW3+wls$R;*eW&+fr}_KI-lhW<>yb6ub^lnRbWJly+nI-VPV@^d6Rz&gU8f%LpFqnn
zN&=!al~k!C9wJDsVbwUY*g{0<MI3DpPy`pvm*D?%zw~SUy`oC%RR6nU*Mb~-?9>^`
z?H0TalhgDAboG0{7yXUz1Kbvn(vpZyc*9(5j{2p*_r1e4ED;&*JVJLEuPwp*bK5eC
zXEg7Hhu(WMyhu3E7)eQ;yxz6}*|LzcZc2ZMZNxd3^ZW2nR-iO7V*#!aZM92f>W4TZ
zBadu=o1PhO0{wncEhW@m(`kfKfE=2UkHd;3(a8o#14xE@Ff*Q95*xuBB(5le#!Non
zp7!LzWTc}c9=i6IYF=i8U(S*%*uESKoQwtt2c3$g`*y-Tgl}3AguOrR0p>QJzNCp5
zn9|028lCvXS|PkbBn{Ed1>36Un2edz_epR>-?hKOx^_#NvW|w@)s2mDAKP)`L<jtO
z6!-T%g5)}FbSR%JP3Ox|gH8S=fB;0xTC<q#>Z-}dDBL4U@4bhIb|J037)W1fv5o(F
zzXS;(Vo^n)C(A4J%cirKPa0s^)qLEyjLR@8Jo7s3@#xVY?i1Y9{~>ay=h~Wg4>%+9
zxhP%`reveP4m_gPIcW>4w&u^c!ZKuWZRDDQWgK}$2nZ{S_+el|-K@m)CsHYut#vA`
z>m&)F!ftG*8~$GFo4%B|MsmIXF>!lsSTQ-EICHB>$k=T@X;n6g_sbPL-%b?9oY)jZ
zW>^kcRNz2=^CpyIX)+KK`6QxLbm6whY5+JKnK)r+LpBl?_<_Mc<K5VQQ19XEW>Ej+
z_byDiII-M?Bs%nIdM{<G+wwbPMI)kO@M_sj2U#PLGhkgtKX!;KngOGn)3}QY*id)B
zn%?79D2}MGrA)&N#D!8en#)U#XS$r+o!@>aJ!03U@X*Aid`KMdRAH*h>?a~QonKA{
z3S(l4wu*UM-|e3k4N2cRXzw||p45_CXdirDHO(vG3J5b8Y_ztSBENLK`s1R4{LH<3
zfSxz;?dA<LQjqsCskuwq;2s$=;c)ScQFP!QFqHjJb#M>hzC4+T$)S|HIhnXX-O|$Y
z=_X|1D2Rl=jOfJ0P&o8Cn!jUuUiHK#!gDLjjo0gkP)s{cD1loWR?58FV~5y8{H9sw
z^*`@52A6u-qrN>hHVS!QPY-*ne+p+ZekfBpwh9;y7y^}!gOZCGIHsLa${2dnC}DCi
zqW99o+3*fgVq!NM<IZSHOnxnG+t;g}w!guG2LljMwH!M)r4}B>wy(&en&T%J?Ha1H
zCAqmtjB^)<ke+CJ6r?Y#l}E$PwG#Hug*;}3vU8z&UiDmB`!Z97(eq-Ju9oR$u&!IC
z)_>a&w=kzc3o1{b9@dve%x(HUlafxj+K}g5T=w$8^)U*(T&1X0k4T-d=B?hsC&2#j
zH+2eZ$=v+U-cs#|8OsC<>_n4do1ZHk`hkZ$3-beCK&Tla8qXmsHRkDC?pJspNhc$q
zI3<zbD*F9i_FCvkEE4<guf2bcW>u%6@^~O)x~?Ux1Sdb5tofy6aY%kr$gUAY_FV_G
z+@#MO)Ytx$buKcKu=L09-V>GA5qZtx=9jZ22oj<=oGPTtPPS?;ZIY#^FDBV_vggEl
zIeekHp=G=4>{)hr1FI7Ka>@}lIk@<2SOIfMnqBVBd*?1z1#bI<k-M9VuHo$+`<5v#
znEr^>iw5VV@a2U=$ZewH7BC7g@7$sw&?BEpoWHUi*Q3YF99^w@2K=o`BXx$+*rl=I
zP^4|`?oL|>Iyp_r&b3kgH@kFy6+gbag?yZxC-E)Mi-W2viwVaIqa+ElC#B!uKFQFy
zgIS*V54vHWFT@Pa9)>&Yi`^XSB6jyxXSd!Uz#r_=fAdtS{E${veR)06jyL+~E_n>j
z+do8Om(eG2#caEbfkhkD?4rNHw>cspFzoD-c(Xc#X)z2xS9NXdk%YvrhU4GTi?su8
zREMB*f@=X9l`%0frh254(HNfsF@x|V{^Ku)uDOd_w`(`5ZF5bhoMXWFVSk1J)i|{F
zXS?Miykd$my<|E+0zPItO>}YbtOpR)`%vA3hJQjp*~gt;j`X%u;CWh}Q{4DO^xZyv
z7;4kX3KSb#%Co-zuDr6(Ikj7yXFd+<1R-k6=GW7k6pl^`lofK`91CDMQ_rDmaZjOO
z`DkoXBeR9<Aaj!1;b|vcwf|0dYyWQm_TN!|@S)V=YqJJ~MgHd+nLTo1a-1~0JvHGe
zmS0UmZZD8|xc`q^^D#V?YH4VZnEbFn(4JCHbDQ@k=rjKV3>E(s7_uC(4LBzh&0f6x
z0&i*(ih045ZHs_zqAa0SLif}++H@;6!To8zp3HWu>HRr{4_)2J+o7vZZ&hz=?&LCI
z0h6cx8@F%2zrI5R(0PPiX?gYDwNln{wpKrzdd6#Hc+$Qgv}LSm>>#q#qB+N1IxfT|
zK*C01htGMkpLch-D7Tf9U(p~xKf$w4ld?v(4<fEjO%3w?!OA5_Pch9A+P<)tx$Tyt
zuHK=DYFc1Q@{$ZACeioOHnv8)2}+EskeNEUGsJ9dyL)u*#^UpM%_XUMPMgh-?Hqii
zRiTPT$lfHdYCG)}_B14IVXF*wDp_|q80^oBr^7Y3*S_uAk<=)p=+nCXp)XRf#J+d$
z%6OmRq#_BTwC-Dxf2?kqXG%W!4#+A$tP_!9b!EKgo_u`Q{Do&zVd`%HBv;<urgebm
zcB7{@GE&Iz<Cg?Up-dpB&ZyK9uwcmY!?*5shNO1-hFwFm^mm*i`L<=}I!yV#bkPjd
z<+OWP2gllksA9#hOSVn(BAG(l6qZ`Q<Ai!YxV#iQugsCPRc#7e4zLGau7v8FzgmcY
z+DXpdNV#2p<yi+w#YZ;o-7n84s4zc2!{TRnBK9nRQV}s+=w9glJ$hVyZip>QU?<pq
zKQ;=zoYs=cVZ{8FW9C#7v7E)ibKYMeTTv3$?wf{Vp?74^5gG`BEJR%n)PRUt*gh&(
zt7CEswJJDIq**?)d=Ewa9`N!U{nl6+O#^nQ{%dqP+r*Sq;9&uZd<OphkE8y-yhQNY
z(fnIY<gDA9Q1&f)s->@iG+VTmOHH)|dj&t>GQY$d#GQp70<}ft6lE;QD~rK9OQvZH
zX3g!*TFig3+xfPCZ@0Q?V>JbHx1z200G$f2myF=%5-<ZZy}shd;|e%|`_&91U8IMI
zuvz8zn4ci!)XmG?hb{~4Ke{XoVAnQG?SogJBp96zD-rRWVQhRX4m`1;B@X4_Rf+z>
z)U(RVpN@bXr|TpJL~C7vp6!*qipx?RV&#!H7_cKtPcAMcrHmC@2sKKXaxIuU<!fEk
zDGtqFRE1y9oRXHTcI%s`j)WTw^wzR>uMReG4{4>0^Csz+5fE}nVb0L9SVJuRU(BbE
zAjtz!&E4y#q@A+OH57exZkB`r?)<j{OnSUut}_eH+qVf9X>d5E+{C-q%?7;6GTg4R
z!HfEIw3SMm(C8#?{07XT<A=l?s8F<__?GCQ->xJz(@ye_K>Ip`RfJbajb3GaW4&yn
z@&IlJADgpE(R^Vv`9Ku`6kt*3=s)y?e9#lv67;ptREiI9Dq=e!=QpB$y?7c~XcN%%
zr<TN`2<?(=MW}80UY&I6LsN8mYU?*Cx@B%A?*W8dVlKIjU1oW4!Z>LHMAyFt2sXYH
z`tnWZSf83dv<v^tL=en)CPpeuE$d?n(N#%0tmtvRV#4|KZ;RU;4Om^1ravdDVW3t^
zbM8B;Z0gM(gI99zYy%=IkbR3hS2}abPZe$TKueShSwx|%bapbeZMr0vQ{}Q{!s73;
z;M^Whrnf#snp|=PZA5?MT3yTC;~ASRT-1E+l4HS1%IQJnf10_K*+i=B(^jNSp?MBc
zzsxjv&H2!O*lpTXYO-c@Vdr)H7eJ`#{{RRL2?X=O%eoYARFx>{9Sz1}LVbOcyz^?N
z{=&(M_Isd&DIo?1b9F6R{@T|euI@+%c>k0@bdNZO(i+}EA>!AjcyUduVO&#rN}^J@
zh*o9e(~mJOfv1g0HL*DGk_VCxyR)3a7EpEiF-2?Ncj=q<wT!TMD}T>DQqWt7t{9@{
z?fI<(n_n6W@S?GgHoZ@{kEzqC96T>|RV1EH#t}D`(1?0ojFEDkm3Q8ZOmu`ByTFZ8
zPJeB(GEKeF5|(cvk6Og35P1(hMg(6+R*X5^3}lCCjLk9A<V7-et_@?Sa{L&Hg^Xy_
zrCw*{{_zOV#q_rBSIzFB0o!iN^?(L#Y5QzHgEE(|gJ#@jdv9-%FE(r2uOrj$<R28&
zRI=w>axBuI`ztCosPTWX_m*K%_U*eU2q+;UD$*gK2ndLDi*)DEh)OebHww}vC^gbu
z1JVuB4H83lcXzq(8S{DH=f94%kG0pg{l!BChWq}-73Xzc=S5{N*SWCJ><D%5zWz}~
z(?k!qyd9Yb<uQ^QMXamx$;1;kV`poJ!I3OIr%o>^n|V*Mt(Vr0yCIY&>%N_(#*k4)
zzkr;7)W8q`AvsOt+O>R@@hm-NUkT<Ls7=V^5>x_cu*?iQKA&vSJERT7VN1_1*I8A{
zFC5$NvK#JmsWdWc<m<pML>A&gq;DSnIrlh-bKemeoW{Srdbxep?9x^*Z8xc9#ijmi
z3~U(Zo|#fM)GqNvsbY8jVK6E@k{uT4HNn}Us}rf)r(4PxR{&iZ4q`r#3Jne!^#8==
zQ~`F%b!F4EvvnYP1QH%D3GG373&1cFDfEXTq?M(T61s7{2EQDHv$0&onup6(0SH^}
z_{S|}egiG+Hf&-rSa=x?cHDmi$t+y03O*`DHz8%4s({Hk*niVNZ!;|EYhK=uIGffc
zZSjv#VB6H)f4hS`GJpIe%V<n#%ROQ0J5sKyRuF3|aW?<|sSz~)Pb2tAAHFUsz`EFQ
zZL~-cF~hCSONi2zGvfDxgp@A(5X*8?EyuJ-eHTl;0zaK-inpVM4O+*!MJKjYc9I3b
zihI~Y_3+8N8PnOevZ?!O8LVkSv$f5{aygG}wD?i4zNL3I<tiG~VUBQ(GKAB6-02I$
zl{fuwH|Xcbugso(9+!R5n|H4xq*kHbvba|Y*C=d)lX1j!#>0A@r0L}&_mzF&9v)%0
z7|%Z2tnWxEh(s<YfrU}%ToM6Lb;1EE>AwN0oY>sr8a8!<9ZS8|aD%=yT}2N~*!kzf
z7jIL}jV~hJ3|euO`3L$CQ)y_piXvSmW<J){v$;Kd$EwnoOmdhshhN`<onDi{g6zR8
z=xBcntJwwQR(<ZdtD)wRp~6IUR(d(K4q|0fA)tz9uc<BLk1tr9c~^489`kr{dzE;d
z8$+&;d*(Y*zLicX#++N>V@)dQ+_^ae2eJZz8hb5)ob0+CokPhqv%@YqA8$&&@?s}H
zVUQO6w#+$oe5kmS2;pR7*Wq_0O-7SwT~AMymT%Yj<A&344j$J`*SKm?>l(jom?4?{
zvZj3K=MQtGA9K!u8BZh*4>;vV988(WiXANC;GDtW5s))H0*c^Jc7ty#40ACZ=aMx2
z;yY5_BDUiIUdgfXT9WHEE>265xm(>RjqQfJ78*MCk!3ujg}Q#Z7M1wYm*4tbCJ!b1
zBe;9h>7mC)CTXtM+3$WBzT<%E=#&#+ov%4<7Zpol-x~6!FK;_l7&QF;cQj8<A5gn2
zW#%WLMDdEhZAp6ztHe;F(4o^klH+dUU5%ko#~a64U)~%urJ1WZHHK#MX7rSl9rz%;
z#R}jGR59BCS6~Tu1#j62clXrSA_sJAS>uo06rp-^^H77=34xy@hy4;Fu4c7KEBy~`
z*m`uCKh(p`X{Js*;MBJ0Jb>HISOYrdfxC$(iy|%cT47Z*i+k2@idCSP2rCLiaI{{(
zt?0+{VKMU*H|3<B;OI7^_KA1rLmuhwE5>|VXK7k?suPE*OKz4GodG3)4$7VF8<fY5
z;NECu^TYe#yu1RPX>4)GkO2uV_Bn-%CCj?o>I6OLRu+&Li~S=pj?XfKC&t?jFgn**
zQ>*_r)!lGY{S;xU@e!sv0dDp4|ME3E2wxMM3;3Fx|JiRQ{Lg+91S|-nHQ+ZzbepQ`
z<AL`W@8aTj9<Tcuf7E2L>6a!8630=aZrp?-%)g3jz~Ij6P8wNKBu(vSBrdFj%wQh*
zvp_tSDeIa3iTHAAoRPFhvz!4IY=~xFfko9SE`CVU@AH6g1po2JZReaV`wY1E=@?q_
zr1R6h*JT>yz+SFL?zwp1#qb2vVh@r#(@U_P<>Nu`Z#o<(yo#H?`3b}>{tyz5LFQPv
zEQ-Njpz@d^ApXI<CtxZPNZ(uhg?m7ROX<U2$lRVwfGqfusYqc6;%r|uh~nQvI1zN!
z_1MCxBwc0qO@Ip3A_GIAPqGm8;0L~~CE&vZ@b>o@$}Z42PGznzOZFq{c9JjA&i5g8
zEll6!x{iz`wwbYPZ;Qy?4gf$z-H&QduPsAHMHFbmHN?q|ZER9d69RHCmdYKQ&oF==
zA{!J)thnf#i1!bcY~5q~@wwXa_1L^G9_xY$xY$yV=t6q}z9TjG9w;sIdCUr((NAi)
zhTRJ#QeP~U?|l$%!b!H@-4k@joql;i(*nL8pD*xUkENGD+g$~cYs{Rplam+m_@t<q
zJ7&IWpi{)_Ksk)KjalaIw^0N@9^7Lt<!pWQ<rP{l8~in&6#stBvB2&w*-05NbC!>8
zW>QG}xdQOL>>R$>MqkM?S85M_g4Q_)rDH_?(jOHCseM1k5l~+!((B*6Q>vClq30E5
z`sz0HQrX3g=)}+sFNH}<8f?BGtUUG)Y^R$|U=mMf$xSq$LExqxeuq(daDH&}DA-5v
zQ1Y8W>9;{iy~uD3YTk*JdYZYq*QN6H^!h&G*TuQ+w;*FKSSK?dfM;WP>1AKmw3LdN
zCV7f>;!)oWtBxJ{`oN_d6@<%8n*tu$GIMMbKwH*Pe7s_iNyUrudQP_SFhYepel}s_
z`3_)<VagL-#cxXdh9c#{%<5)n>pCoUbQCmJUWXNmh@nth(6GI|og=`NNA8Wk!qgi(
zjMET!fUgtND$04{U2Ec)O=+vdT*y2zHv7RH>*LRjfaE0n`hhsS`R$}jye>O2BbsE_
z+?}x%;|0?K#pmreXxN{kYu^>b6P67z8mA)d&Lg}rlTFS|4*+=NeR6Sl-;um=R`LxP
zSjr0ea5L52MM^#1rhiAGt*dtv0VjE?bmEb~-*yP;MOJ4Hc*Jr5D|Ep$w^S;sqjXnZ
zgP6if_v-@s&dKeM?59x$l1_fUuHQry?xsN4YdLIyH9ny`N-0%P8d-bj6OKMLMZ#6^
zRxFo0hi(so4u2=n;TETod5ViWk&v;6Jz7@IU9N>9$*Vd)f*b7ws&Rp@N*<qJFjQP6
z;gKX=-B$|$W}a)<OGuyTEz5LgBp=37R!K<*{qL47K{!&I03fx7^qRmgd+^r+ep25|
zfNz0Gkr%ISUOM4L-ov7o40lsSKbI;fk5WXMh*LYwbpnU&tXVD5lg{zId_iuIHCPl$
z=YvwS9C`r3SR3L@qdC@gi)k3Ij`hmlqTw{OW;uVFRI@Y`quCrls}}mHxU_@F|K>-<
z=f_ouldIa>Ryw_NZ+emAgl@P8kP(FM@pg~NcO-&3K>?Q0G@9xrhHrv+tiatgwF;4W
z^%W}~tdA$0E@4dJGKsi^bVd7+*?IgGnjVu27x^pC<$W=0=SOVx<ZVNUPiC_dLS@}W
zPYMPy5n!RR1%7RGEa1=K8*OL2C#=W|bQ6vW@%l()&bah)a6gqe$xrxwDnY&`kfE}N
zJ68dRC2QFMfuEEQp9Hnidm$T9csjWkPbRLW_WEg3c+wfYmv0%FCxO(z#pfM@ziDCr
z?>9AJ;$Y^nW6NzxCk#pU;da>+2EKP>iUhDX&MC>~0|GzXXny~=k;%hnG7_laWahT7
zKJJP`KRuNkeUthw{FX?;+ZSbr3Y)<7i#t#Ws<C2*R)ygz8T<VUSisMnr}-mulKhi7
zRSq)#4DRqjAvwa5yrqzSGxFQ>i1ZyHlE7gB4Vf4HnWZ}-vUKHQGumSTxowXjx?U<Y
zt6@9&*}eS8ea%PI0bH7mR7AVIw+Q8lAP{u3g38CbuUU{Izo3NR(-Q^O^hxMgY|TxH
zR`Vss8b-ISgNRJ0ayFMI@B<Pc&DQ+gD6!jjy?ghq*RRmNBZ*(pUGZy!)q)-M^$*Tp
z?i(dMPUq_bdhZx4Cji-qC_v?fekDC4%Yx9=9IQu75*9rCsgyp5nP2_!)DUx8j}_G`
zu6Psrx{RwcrU49d5W^Cg>buDJCtGIqyZwa(J|x$-1S+g5dRziy=d_%{YhBJfwv#WP
zrmk*8VP+EY-pdQ82`c#-gnN*$8zsJrLo=`^_nAs{z$r`TbCk{w)0x<=PVPXIAuqD<
zY<${RoUw}b4(KYIpM#f|sY77biI#2a#3s}7r2`Y@rh=GxUU;}#hRyu1fL@V3o5iAJ
zpuc>v%Y4D{<Hxg(q_xmWZa7Y&IzJy26&(?80DhCIQD>LutE@0V4-bIGekR=CPH7h*
ztNB2F-E)>^EHx#{*=i=()NNY)S^dB-0PRPQ96aR*I?o|%KXC<PsQ|D(ws0Qc1Iei>
zD*8O-nq|D0%FKbd4x?K(I*w&h;HJ$q?Oa5#3yF3l;M<j<n8eyQ@314h$j8qFs7xbf
zwztI*2af~s@9eV#p`^&fpdD;qe;%A6)rx(WkL4T7!7WEQISx^&a2uBlVQ*`-0k;UA
zFzWogJ(!hte2rY^=zDOB@9v6l!<diPLNS);`BjX}Y@doh3;<lqlq}%5DrtalBS=Yf
zl*)m<8VENs0k7?TPbcx0O{d9eC&eZ54qX8Mh(c=TO1=qFMAC5*QaN$uB6+Kw_UW9+
zUj?|X<X=4Y5OJyMa*gAh-zby03HT(glwVQI(kapS)wRzTfK5l!IPKLwQE(5~i&7c>
zGMkQ1-abl|jS-;P6WL~F%esewxOebptAU3?argR4Hh2*pC!pQ>RAqvW<l87pAlZ#4
zp*Zg_Wt>=e#xtRB*lt5jc=WOP0@B5eUj=W@HUg{Z+?bsNH8FaV>EG8)tQR~nwhMTz
z&kKQul8A6>cEQDN@K}Cfr)C_0oJoN64@f(=bCt(-J<+q~OyO3Aun`DsjzHUdDlzAI
za~UF(b%tw{jEeu3!~OZc2PM>nLa(#JX==G{+#+cZB>S?KN&Yt}>^IQxZFZ<geS-P)
zs8}ypu2Fp8SuGfkH=J*e_ZR6*wS?xdMyH}qnf8+QnC}K08O+3%K-A@6m}w~|Md!t|
zESywFD!4BFU%1U$ET2^-$hS>4*d$ojxfW^K4pl|U@(XA?Z<-1DaHc{;Tknz_m(Q@J
zQ0HLt2SXvz?W_gOv}Cz@R&LbRC;Gx?S~|f8G-=Hz(=P%}pY`qyOYF|p>nzt!flALl
zyVguf%f4Q5=9zHL)1O`qbLaS0$H&Oja)xi${jsU9X?NG6R19;w*h5qPJJK%h<*OfG
zz1u%`VUZ*TvDOQ=UF9HRep5W2Zzkb>pw5-;^nokH2Fn4J<aV(po^(W{hH*Nt;{6YD
zAsB?m8(CvT>Vw5O&Ql!f6Ldr&wS~lo(pI2e;@^Zf9f)&nA$XJiVNSd#XBC5O9>rNk
z5`80(<G}z#0|Q7_vf#;zQ8RdBTj!>1m78qY{?#S}?tNX`zl&jnODXxeK9`DZf0OAD
zpRM`lvs1m+;@{_E|19}EiaAe4;7b{J`9(FZPb)VMxu<*2^NGC9LNfN<zo>Uxj1zBZ
zuqR%nWL-?>-nY>_YB`UPW!f)xn(mK!MvH#(CgWD?bIH?#@;c%bmCMtZc*thLL5W{T
z)tdgXS)s}#X|(QaAWz37L?E=@L8};QMlkPn+T}RyU2b_XRfk5pY6Yx*d=&n?8zyb7
zIkeg3VGyr-oJ`f_1fPP#nI5o<OubTpyS3g=4C=0$Jmf;ZBel(0Jk76UI*YfsdN2*j
zPC$G_t&Z9h$y1V(2u(I?z0xz=iq_gEpw;zp5FNQ<$B8K$PKa2`ZautVGM78MB?1~3
z<+s`t!YoNb(l7fAnX5IVqdmKJ*`$tT-CKvm-O>L%cPU|3Lw6(DH4BhcB2~JwsSBt@
za4F@e3;D&uH!2q3B*@%JqcPPj`yXJ-mNxiaun@;P7g>pk3mRNp!_xoAjZlRJv9lhA
z6Jtw<@$I&8S}xr|KlBAXKUJK);?B5O_P}!kkirN!QrL6f_f`p{XEwCAB!$|<ok%n$
zVjmzphHZx}RQ)78)?^7FYC%bIt8x`9d;nth+(d5Oxz5Ht6U0E?oG_Ur5mQfI_$6>E
z;@yBb%e#odGau2dyRqjH=Zlc>^pc4}tKGBpVXz4ab2D{6J7@HAO)D~#@S&RVftl%G
zi$q!ot@xoXRp2UBR3jY?;_M?X$vxHfNRP-$xzJmf0J?p&2Q3>MU))-IV}m2qH#HBl
zVFVQ6;2U;|*q5q2)A&arG@*fRg`BExDQ9EA-~+$Vb+jK}{ju@910Siu84~4vfq3bY
zE+$gP$?e@rUGKVVqBYAYX1tR}vh{Kc2V|J%J`{VpT8j79>C3_(J!xs0L%Wqdv+{#>
zhaaZ1bp!GoM>s8q#GeDn4(7!G?C_(Gu{wj+9y5@dq*>j7@nO6qO4$m@-{()1VL29o
z=j!yL^g4#lCvWV=*X-&Nj*S6*MB?QCDq~Yp;xrSxCWX%%Lm+qh0KS)&CA+0Sg*c$V
z1z^h@FiDan7D8-7o(}@fM^%CFx}OS|*#gtBYdq@s({%dw3^bCP(CjGFIGy3y)2fFV
zRMv9a3JHAB??^ux4k~La|G{vOgPa=F#q-cv?an~ULL3+e0T{-+={&8L<9@rgWGm}T
z$pGtZSFSu5D7)_}LX}T2fA(41a^x{ri>%cq#bK>Upxwh#`$iVJ3>PeQ68CcI%?jez
zdfHuelXVA@gIBr$!34NS{s7V7;}U!b1;8<fYbsn<pXj^<_+!FQL+Ldvn+;`4DFssA
zZ!bos+U2fq67<Nna`rYmUbF%#mE_-%?tVvFrs?vy>I00Vz?C%?i7Fl8)R2&-9Mxod
zZbWKAVqUX)>8hYbxe#czX4zh1cB>$+pqH-8YdIUvv$AXW4@wrj=Q~7osGZi}@9I$0
z%_)Xc-kd#f2+XgY`@LC$wCecQ7m)OcwCV5C9U6+zuhQMy-{_Lksq|1y#{MZMtW{&3
zWQ#o0FInx6B#CS8xx(;}kb71LT~-P}>{Uk)d+7z$OEb??axQu^@#3k4r|U+A5{!ea
zn2%jn*UsAWi*qCMoCxMNO8U#;b~MNBJJMN53ScOegMS_=y4_5HEIJR4b<{;+k$JI<
zF+-B=t)3kBk!kBCZMHg7iwc+4Mm$b??rR{3-qG%G=~0gB%PsKn;0r$Sanp!0F$02=
zH$8iG2BGsiI%IIWh=I6A)umcRq?t<B3F5{d%|5W|k0>_Vrs$S_WzjIf>29Ip`3~S`
zB3#&Zx(ML(_A0E0*i1IsebF-PYGbhus~a{ECRz?*OJRF@B?jEQ)vdmyO!tp@8Hs)y
z)0V=FAr9Z0H~1e)8EcG=I))@vTLs9^EQMQr!06$%S7r!-T^WIu7?>`KN)i;MsM(2P
zC|%}1Sk87)<F4Pzez%v_cwr}Z+H*yB4wzFqxH*lbujU>y=JC<tKMD%VIx!|PP=8dQ
z)J`4x$CSN(0hllZ`mQ7yB0C%zk1@r)y>TWi(xLEoG3w9e{ruaFpl>3)vH?cp)aFaW
zH@$YW5~wtPq_@3U`r-6=LUUoe)jyvtN#0$#+#@6#IOfyMYK=a_dF$K?3wz9S#UeSS
zNvO<94I@dx1ua}`UPyE=Q?JT$jycx6Uk|WI@CC%}{aYaOIQdc8VD6zvft^?v1)~1$
z3WI~nX9!4oAAvKA)(u^Cxd46Kty{Y<2M0^=Y|sITZgFQ;_i41bTy{VDETd6P!N-j5
zjx&y<Bh)yDXM>|=Y{3nAbavxPvky)BHi9tBQN^#qSkF?XfTr3!@X>0@d{ltO4F|d9
z$?~&|31^QyNzv)d)wOuqH4WozCkJa&j6GVLLFG?`{xO+Z3zVTr`+Nc>J?q`WXQh03
z0%d0&i_f!DGgG1)0Z_qlWwv*6u38z^Z!-Q~HXgbOR<C;SYBU?qShu*#VXviA4O++K
zJKzK*m%8lfzw#Ki?ji2}U5JmgU^)vQpYaeSwb6VGWSvqHC{tVJHpnz{AI2XWFWzaE
zfa5R#T%rsW(a}WE{Fj5he6jW3Bd>+L&F|*ZQD-}f<T6<f3t{ZkrbR?O({C<GH8(=n
ztj=pl`HuQ<aY06Z=cisi@Vw+#{{9L8uZZ=rd6VI3NASWDfG<S=Z2+$jZ2iC508TS<
z)*sdOxBl`5)a1$s4>gXM`e3zP+gYt!2e!v!^O*vfYrwrliygWws9j7k!CB)@=sv4A
zL|j^%<}2Ik?Nuq*ccgE1tc-XQfFy|y1Rt}aWmlkz=krqCmvjaV^U_7%a);Xqn`9hR
zZFZM|K9kb)^eJzvivsz-tiF}oQYmM`JBk&v3K~=j_7>J1BHO*HrO!Psw$F$nF;y-;
z)Z5u4QXB<@u~1Gbjw=p}&iM&I;B*MI%s}+k6>=T%^%*B`N3$vKL4#b7*u<f|6ZuV>
z-tc@C6G_O_V`$j1l{HHn$H}dP_3$j;M=$fgBjrrQs&VVixwB>@ALsZr%B#HuQdj5j
z>idz$#Cl+*)S>9}#8jYokhz%HeG_!Mk`|Dwsrsz-45!|3OlQmI<Nj4jL>(f0dL}|O
z?>O5SElxE=`l2~{@{ru2-%iBJ-2K789$V1`HXK~V%0{Qm@DsUd7J@)&^{4431b+0S
z<X0N}=pJzm<yE(7r#@@VQe0{@QMKVwnYXrDERzAJ_EXZWH~g3D-G!iM`1i>mQl1|`
z-Ot>u;_ykK$eT=8MShMD5<u^R@AV)ZPDd2ZE=*^c=Ol-~a_n%@P?9%Zlvl;C#D0*%
zht5&+H*zX9n1G<o$men!7}FFe)r!^r4(PIve%<|h!b4{f@tLKJnWyj3$j9Xt@*(+U
z36?s_9%cgJwI;PwZuLgPXVash9%pKoQ}kny$mG1&H*tY3Hqp>=fNkT`hi1n>OmFlM
zt+$s1hnNTT-Bq2&XNL5Ga!|8um5D1gRD&<<9m7|D^8QB&$}YV+hu!XztghC(QqQ+m
zFV4%zmCr-v4%@}Y4@voyn)#$;*yI?uWZv<MFggc>doi=H;qks#IN&$T*i@f%s{D?m
z(pu7b^c_j=A`?$J;+_qG38k$CDGAqkwQ2yQQbyC#e*jhk1#{><A!d64ePSOIa-}v3
z#w%OgIkR9(S@ozG)9F3iQg8h0u6HkfM^e;u#aU_0`~U3Lxoqg9<hX@h$_hB7WYmsP
z0!Sn7zu5R29o|4FTmlb;A-n-I)rzi3CYkBxoUzlY{1glBUn*0ZG#)7!Ah`C=7EKD*
zOnA)l=+s}w^}M#1B0`^RIyud*4yz?3B?+=28}J;yd0Vw(xILtTKFjs$NmQfRa3`ot
z^$)d!6He{uc!pq0>ZL|<O&sa|sxha3I*&)NJ>&<!BiVvHVh*qMHV2e;vL)Oe>TRoe
zI<&i_@(;G^f5viuu~jP<UZrzRD(wEhFKGw<UnyzRlOqb~@RAyBmD^u+@)iWmR`N6@
z$9T=O$CD5%HT6?7i=+6A74nQlFU&=Dil07D6jL{EE!4N89T-%_mq(NwG6`qD^eh(<
zJ~3*6ldcr=4#OrGi(taTY~hwOz#1Eo@^$9?OlvV8Xw1(--!PFG;Bh%^yU5TqNovZt
zed~7z!g8sG#8qO~@ConNuW^NMk%%@o>7uk|*Jis`2`_Baea&qFattP*G#T}$6h+R5
zPXfnGrT@ZA4M7PebY~+>CCtsLJOsaUgQ#0vH6`l(byN&iijVqAhKRLM@34y-BRt5L
zYxp5QlU+OkIn^N<xAYK=iiOvJf1>x}&svczTl?u3oIaCgnQ7Qt6%I2vs15Ky&vo58
ze|QHby6IAmi5i_tto;`y0Q>yj{8@~EAtvQonG$Bl$_&$!x!zpvSHO^t(>T$^k7_Y-
zLY1%#dULI3Ts2KM&c%Y;_DDV66kiOKIx|^)y<&9R#)l@1?ljE%>{=Gj@dOzpfBuje
z<lHzVFx)K5zWriNKnhQK%L9uy)Q4-i-N2wd((vGtnAeq)vNAz{M_~(MUN{*;z_TKH
zVMhFJiTkm>C3G-?t*O~8)RR%v>H2ph<f~dts4A{c;+N|3ed@!9TJ_*AlZ`7G=B90O
zU(e6|z_C|ONH`=(x;GUCzy%0@fzQ$O<jiniJ+T{Asc9uWxKMP<%n~TrwEyu235uQ6
zDs;Zhe>slC3q&#vf+y2ZU+jGCA={Gn1>I(&KvlCBfb;M#5F*wE>H^o1US^Za$WR|W
zCjUp6C}<R2+ytF3)(A5?1@x_VNB)JR`G>;kiSxU<sxblJi&)7q!C@gk0>!#tbr8er
zj;-3#ET>vh2GtrgvN8ZTg}|y&6aaw$kPARDs1&@Z+{gY{ZAcVe+<WX&@_twu60Hv=
zn?dpNX(hEecx*6UJ!<`Fwe{ZRJq^)vNeNWvTC6!ZQho2zE+l!9AQR#^HO%vttzw+#
zY7rS87-BBnj9=2e3ffX3X!c5{ahsxBesh(caj~5XVwM`)4owdJBH6<!$k|#v5qklO
zJ@~9z7)t!m*lkq6F5Sn)bvvBBqOWC{^$-;Y56i+oI8C?lxsA_qc1(O8W~YqO%m-cv
z#<n$f-Ugp^2&dU@rP%c#_rvRa2f%Q?oZ-7TmD?+d=XK6+wP6l-d8Dn%ynSPMJ7!f1
zhTiaG85C<wCde!m0~AgksZ&5ux|8#7_fTE8CS~~U^0AVg*d!@X1AGoK+zR+OwVe$*
zg1ZPG^&f>5L|_Ks!HB9NA~3_M%MP_j(IFB#P}+9+d^%o%i^m@Q_x7>K{3j;m1{oDn
zco3<f1~0=#V+h>y85Kl@M$(DH@mhE-gCz6ljBTgujP|&u`(ktUR{$5U!qy@>bGOWM
zAcyv|x)=jb4@wKmj5B$fN?O02AtiU_^IeKX!9W_3$|#$;W7>fdvvY-4SLj-pilsM{
z*i9U6FN;cHkcx9E0Cl804(bW8k88L&LjuCVfoDqz`v6Jp88QJCMK&6n@TZ8I@suc|
zom3Ar9y1Lds_C8h=&-CM1RRG+NgoRJFiJK%8z>xO(m8HhwX{KoxcQ&;b#e*R+aV!+
zB|vrsV#xfY??_)Sx3o$)2$DM0*XzDoli&0EEPR&@ny!T}u$p&_Gg3aBI>7IAGqe?V
z=cP%PXo{o_Pw9ZO?v^JaIx7OX^@89XX&LGKD_H^pYg|Tmg-C@N1B}K_CcE>2(quu|
zfZJu-fz8WmZ2?EUK#~4Bn?ZQzL>0g2&%$I55VxiK7rba`sc(l8Aj>51>g6TlIaW(F
zyJyAK^Z^n0A4C{Ez(2Pn!i=;Bn>lTDR5OciJVEU;BtT$W|ID8J>;~#m3M`U=L7b*~
zLN|SmP)~g>T(14q#3jKlNM)_YDNF4B=YF7+Iw6N`cJyMH)9J;uniFZgBDZc41dC0s
zV_2QkY48~t7bBZ)P{|Z-@y1tfT@PMUCUlmtBsQ}_6t~Umb3<|GpQRa6vG;I@!?v+j
z?D;bEjqx$hH{0T3O}3cqZF+e*mtjVJUeEG2s>F@QfGLCaWrFI+q!aNU>3744>}~uO
zBm)3@&<xZY{>2`EZ%{H1D`Ar4F~AF$8IOK>e`J7qokv&GeU_vR1d~Re?=hEzg~%9v
z#U$H&%?5jvPN>mZjx;k{(5iKbiBY=Eu9?Pd)hr-#KP>M~xFA`+=SlXt(=nQWwr*yb
zDBYuYj*^}kY;*gb??@HT5mclKFPe%dj})E=ALdu9{?iTt6(e<706U6j9Zy>EsA_&C
z#q>^5$Zc8XO%56XJVU-mu#J?Kc7WR>H))&{Kh3icoM&rQ(ak4_()?n4PS;p%=Nrjv
z#ag;yj%VS3@(DE#X=fpKaOl&dth5kfSJ|-o6!IFuP&aOkPLso?#;vNed$rqBiTHNf
zO+5o7X0xxC<ers-a_yo+*3_Z*%MAaQDd6aghvdCqT_lg!G#RcZXNACQ-*<~}HHG<B
zRJ7)D7^9kB8%QseAC%OOjJ#1Zf#3!JS>mgR!rxh<wi|+Y@Y6z!eZ25J@&ML{`a9B2
zd)=~5N&%GW_H0_nyyW%G+ru3wIDYLshZ;n5!R+=fk1}3A`mDNkrgOd7mY3pWYvQVy
zG{FQ@Wo~ke;piDls5F?aW^}H_!?_Rlx+Ckbv2w=K^)bmVYco(XJ5HJ}{Q~Hyz`~ei
zoD~Lx60=7-JqVk|KdaE7qv)yoL@Hy!RdZzH=%3(i9utwVV$OV!Zz4NVthX27T=o8F
zEboiz06z`Kl%)oLgohUF6KfgzO}0;8l!cuNjT*<?(QbHG?wVFLPHCF6MihjYr^gf`
zAKXdBBbpz56jUxX-D-Rfk74rTH}Msc#yJ$ZTkcrCOYG31Ynwdz^r^2FWt@XcWE|dZ
za}~RIVw2vtWRo+x&yZiq7R9N#2~u00<J|L}DiC<_q4)@znrCzNr0lL~9@!*A2aD_x
z`8Dme<u=a5s^k;h@jt`DHh)$2t$RhJl)U&@6~j7%-(JCHf3ai~(NznKL!<6W_B#1~
zx-B9D5MzFp=l`2>;tveRae-H*NysV3J-!Zje8N`-xH?S$SEs-W&ZRjN{w#eOPOG+k
zdk!*;Fz4dbE<Y-Y`jY{2`=4bdw^TXj<Bb`^Eq%-U3s?(6W?u1k3R-=|QYs&=2bY2-
z=(HQro-jd#W`;cF*03IbM=~TY*Ng(j<~m#{gQs%brewK$qrqQ(l=<O=p?|NRQyS1%
z7?ea0HhL|9El!9m_B_*$q~}5UHCp9?G1^X9kSB5Pb-ja8+OEH{9ybpZQg40J|Lj(q
znPS^a+lUDXyv^^CyM#nc!ZQ(ivImR#Y-wbW!F$DZl#MS@WwI-JW>{oo^-KjXYIMWx
z_ek-kG>F;QxUwLakCTu%JB|vVC`s+3x}{iyQ3cs~hm}h5T8V?Qwzp*@WQUoHgVBPJ
zqOOtla;_o2Y&cY~0p1bZjpjm5+S5ngeyAY+bSaXrnv3Kz_U0i)hVtc<i*5WFc%w$W
z*~KikLO!5jqV$t&&ray=u4Qtxb-o^-u<elaN(g=-|KVo1N^wa{D=z8=OR3Wn8_+7L
zfXIj`M}V_9RfUk0lqzZW+vDDdo=`@nUfj7k-k$5CTxbtejS~mmDm3S-1@WYHWyR!Q
ze*!=QNqdHc*$PfBVkaij5=pE$?EYxw@pa?18JcSvPMTCUvytKW!r_JJlhmQ$KW&kQ
z8JV=U-;vDm!JzC%N}AalUC>C#qn(z~_eqKG+Dv5|&0rskW!N-xSlvVleT-sw(n3@U
zt%VhLIC<Wk5Z1T$U&H9M+Zu4#Mk`$w(Rjo8K}q?UEXs_dM8ip5-6+(i6|G@YNP^ev
zNl0>9SVdzSr>BaOZdR!R*hS>wzDSwOv<^vbQhbQ0Gn<r<o54pi<dK_fU+2w*gNAH_
z@Qz!ix2#tru>}=C*74i{*<(k{yYooGfU@8hR@}CbcogJ(6B#A*{-c%b^>l+rk(|k)
z)nKhFnv&F@xJIFJ{~gRXn0_XSri1%pta5~=VdaQ1gepv`8S7BD$Zwh@XtnpdrJTJ#
z1%++Kw#uH42%($>cgium9VgHfzPHo=b;Ni!gdqCq$h;BIhW~biB3S~up5r2YS_951
zES(k~nN)o!o!ZF~E31x=(RzDacX&l*Em%Y^CC>~SG&hZ=S)tUa*wW^~8k@~f=^1is
zfUQLO{+X(>V!xuy^#|sf5A@zgZWd7AjL)VQG`i$*--w99f?~62>o<Sw2I;VHrp@Cx
z&f)NQPS{d~?FvHWRORHTt$KMC_!WiCT)d>(2sv-WckTgt<CVyK48lqc64%7zN%{rr
z35iVwv91SjtZ5^UdNDrZ+KOB_6RYOAW&5D_wSib50g=i&&_%29SU0Im5jbS`9Vxxv
zLCs}l8=J!A?Q;iya+0wmwGg<WZDGG4b;#24(>v~Tri5-)cJ$U?WKBfg*e3p>Excs<
zjx=Z|@cGd52#5jY==A{V(*g;cLUoXvZl+CLygkCJ%YP&3Oo?B|e%z_Kp3|5uW}G<}
z92ESO#sY2aGV_ZEDm`_jV(x+%2%U_YBolLlRC+Yg>XxnEm#{%EZ<zI=?Z8WtX;jtx
zM;8qY;v;o=#(?i#iy)~n&ZbVy)Z4vH)}u~{rPx>5^)!oFQ@G>mITflNo?5wrQmab{
zyYNs!-)>}xdixdT3(reAkdK_7{yu-!Ngg=i@Ic^%yrv_L-eg>{uhZmZ*wb?)<hM_+
zy|4I=B;!!--aM^j6+luFUv+Wg!LGtx>C=U00wiMfYOU&1i>hq%8orQ!&%kbQG%+{>
z85kIjlL){|hAL&OxXLe9(slK8D@qzEF7TP!j(XwjC^pslcxF{4ERr9rte-(m)jA$)
zH9*EP8vhZ?0OY7qL8mpKx7`NMnHKL{KmphK!{7Dg|HERY?Ek8m`R^3~FBsBiEk}}c
z!ZVUg*ln&}rcNQ(jzL3Dx@dq^ilbXmoLRQ&qUSplBDaruOeWFF<Hbm{m@gC4iXnTa
zSO;RCu$B59>1m$HB(tfHPqOIKf(`#3aNL7N@f$V^8D~{F9=>x58ZWzcILj!!yn?*?
z+;7hZ#m>L3dw6#b7|-+$|C>jED^y@c<bZrG0c5knoaQKL8DU?v+UceZ2}pOGST*o2
z<SbdZS#Efo_Z{ii@5_KK2sG}pd_mU`g&3PBq}@U#;hZ_a$6J~N8s)sIe0fN3`eJGa
z=_!=5v$6#vu_C`kT1l)~+OJS=4qzTmuf0bqW(m~sl}JD~1^**j{sWEJfsxzV!67N*
zgi1Pi1C0i*#yQV$BRTLm3Q!<ZuaXiLiJttsaB|%V(6f2)ThHca*=rwxb)><u4&A`Q
zVaYk1Z09@GZ2ytusl=+(_8jgstd|Y0dkAdx_u(3FsKZ7>?Cii+o(3KQ9rC??1tZjV
z7m7P_*zio#)!*>VE-jS@<^A4^tb*lI&Ov&Ex%qCMBJNq*29>~l*@4T!ge5%5A$bwq
z{Pd9E+?hzqWwwQIbl%fFfeML32azjs|0eAREidQaHE=BO@^#L?2S)s4T%gx_T_|6D
z09!aj4S<+y1|HbH=b#8jC*wChbl~^88}&W|LxZWCNA6hBBU))GF5^5)po<p%r8`+^
zW3q|q6nEe5xz;E`$HG+`UuU^m16cA+1eOf5l?SG}G*v>7hQmDPB&Z$r@?=2ATyTQ*
zW7;V|%ezHwwb{(=liXigLcbJ=+V-@gc*Es#og+R&i6t+42H*`_Rh`f`VVMRyOvddz
z3Ge49pB#Pto%?!LK-pNGrKCWUFQ@hlkV#qj^a0ydC%X(NAx$Q%N*o-fOOEFRjd?C@
zi<b}bdOG&ZF^ATeTfHl_2`=!1N)Kf5Xbe=ko(<YZYddCJi1Cu4`&RRK*aY;;Blca$
zL_*J}QHfg4)%w;Cs2nEG4=;rQ*#%Gv(*Y>(i*O2jk#|xf6qq-ryT57FPL$vimagwQ
zMCU~9vf#wn881OI#3vaoU-_%EM7clZW65HMr$b29ImO}gN5f<{Xnov$>DYvC*>vuG
zn|@Y8I1`YLFT#QXP<iPX&R&i_I86C?(NNPGZq+l>=~Dq7FtBP+dJo0_xiR#RGHJ~R
zNtt0mPh2Q%Aj{&G{m2uiv{!j+)3Ya^RHBM_Z!xq{%*<09=)C8gr{Ns2XcxZtbvfzf
zPH^3BoMgbX&TbmNyc7FSJNL|bTGb#qE1rW}J;^kL!3l+t@N&KG_bG6~*}0J3xOP7*
z9io}BD)jEgElz&4W~VYqV1mrnY)`AugN7(w!h2@H!PvUbv5{UOaX)5qs@_tudJ|-~
zn(uuBVA=h+L>qr<$N!s`=sn^RwXW9<f`45i;op>cG(3kd8ccoYc|#qNLpX+Y{`m~Y
zcgy(~>HJt6j#SKWSd40ftiJ$ik1|t40jlJjQ%<MhZk@}^FUtl{e3gu?Y*H<_&k30*
z94qmir>NsRff2ffa$qP&_9&40W2Cpp@bscWTLlzGcpQVPVKE@P`)>!h6OYS?wcMk+
zODx?24B~x*t74rN=+<)~=VD0bq~A=yVA%tFj_ZRZwKqR+hc22je-TWlOc|+?E!3uW
zmo6`LA)UEBAYyG{J156@gETHa)_+I!{U2{Zcx+m7%g~^t*s`J_Z=Utur!M3Au&uDv
zVwbUD#+PlzDJg-f{S7Ux_kakDow*u9+<-*>;xv;5><)XA{_0w1n*N=xIhN@muG&oU
zu--PWIrO!SzMAe~EhVqWU?JX$^(de4+rSJ*uYh&6al7QwiiPU~g49j%@1QitbinHc
zm)nz@7s~M-><%loPe~vfd7$Ro_z|L-59>xzX7I>B^=}wJ0t`uRDDacH=^fr!w~p)|
zd^DPBI(Q3^)JpOn-322F<Wj7bXd34pWlNb6OBrXqHf8oDiN7CoGd{x{%nQtjQW&?*
zE38wJ;dxZi-!vADK{^oI%E~sQ`(UJPIrvmx+kC7_c0_N>ysVN)B80#B$yb3JVYADj
zysz!Y^N!Y=1yaZ9S94z7nti4uIZA}{j$*@sm?C-LNZlg8^qUgwrNy(+F+$D~{!}8@
z8M0eiB3{HCJhl(SrZ%kBZcUzhscVWnA#y6JR}x`zptisx7@6@zw|R$pTaaEu7|)D3
zdDXUC-|g$L%7nSy0#U%&C`$bE1wf1xEaqF4h~!`*!y%Tn2~Ey*-F2`obTrKHK>gA-
zuvQaNUr&6nmOlKETF<*a6kM*|ut73&Le7e(>F#@b+L-ZJYO-S+^kTU511P$Ya*luz
zTUS&&xKNdMGH#&R0a`xBR2ImQ!C9M!Nvk>8w!g{Cw&{S?>vuw5Ns%p=nA^W%mHIW)
z3<;_9<vz;|U#sI-vF-A*#gOQh4)b9lhRR7iY8Z^IUo3V|IWmSkT=s$jyC_8Kts+(j
z7a_f4G@vvd<Q4Y8QeLEQb<Ko9#HQw%x{iWn2*ILm!Ph<l3d_y7lMrjk9D%}0_GVQv
z!AvIma~aLR#WE$?zT3U*Un0YYVq@PrbbJd#dy^tEW)M)1`a(m)g=7;F{y3I7G6-o-
zklLc6M`A5^1?Um|tpcaq_eWkXF?ak|HKX?qrN#6{Qg3k!XY_f^!J(U8*_etHh&RZ}
zUSm}P&OXw(({0;3iHFb)qR+NYrrb?=XB=x&SG7+P>0+-Nr>*hrsdVr1sg$q+OvQw5
z^k#UIOJjGp6(MNOj>mgkh2ieqy{>6o-7n%a?XH#)$rl5~%bS0BHo9Keq}&QKOWvK@
z&Q#9M2}@4V3t!&~2k>Lc0#zk3(IHC-TpP%q1S*;9DfvW>z;By5@zZA78DB3wc64J?
zBA$GPFD~>9gW}!%QoaZ4rog1c)oZz&iUWd}VGJc_?bJ2QH^`hgG@UTIfqhxnWf$PR
z#|4d(%I>Tgp}Z8u@~56}d?@yjt<d9{DX+=vnAKC8|7{-x_SNX7vFu$Q>kDTSz^0P!
zq=x&Tus=jn>Bri?FnVK!_OZQzdY)G8%LH-13d#SKL@Fi4&d&x3I6WBAjRfcMUjM=4
zh0{fdv4sIv-aqLgp}*-Oqx6+MpPYDu9HF=-o0;{f%De2pdkO}UeFs?h!S`??#oG3p
zqxhQODvQ#Y4C;Z>l2be)Id^deg<tY0g6*_hAeD|(0nw#gT3@wV?>wh=zvEN+a?8O)
zbwG;ejrTd<hawW8uK>S$DBh2mJe=xk_d8M+zj)|*>s4Cmf@A)mV;5AlGcG;sQ-O4Q
zl0lbgS1<Zb8%5T*XhwcsMZFZO@@)7W3|%c8O6TxA^iW}8!A5wKkP`KeCLtifqQx%s
ziC1`{{Nb7Co{cV&x8xw`@QaQKK%TRI`dc;ef1pcPAm|d=2)e|$u&@Xy`R@h4MF{=G
zb|>ax>bq?R4z9OA=YiQL);)hX0~$d9r&CGJ&-Fw^wJr6HK7}uk4#l3UF2&~qZbpiv
z#HOu5I}%XTJ(PO^$~S;>Kzhz%-M7W$+=_*TK^m04gZQ+Ywm0MB3MzU&J@xezeJb~Y
z_g(`<Vx8Kg7W&OJ!|34AOLI`b$)idY{_MhZ2?Kj%YUD2~NFxjp?s^nWwLex7X5pi$
z4W?UJ(;?~VxrGc25Af<X_49l`scUP5+}F?3)v}Rr5|P)b!_YEHD&4L7a&AUQ5Jfj6
zTjI7m6JcUNGL0Au@z1888tY^>>Rz8l1!_fZI13@99^gmgm-v4c77B_C7&34t6@b%`
z08DIprt(ME%g^?X``UZZ#tS!91Wzj6ARIV4;fSO2BXHz5WlwWpDUs!%Ap?ldl`@o+
zdDVZGy5~UGjib2R$(E<2Xh1>iq-MhX%bBH$Ur}u*5}U^4$i$j+eFBB1ck++9X8-@O
z|G#?dufaJh=q_8Ii`F!#B%I2G)G=<5&bt|q-!C^GSVC8}N-v4`JAV{e!F_6Mc-30L
zi=j4I8ldx_jRbi{au64dMfxbvaF9)O^eJT6`Soo0xYpE`yw!2V=yxRS-3nwan1hnh
zIvF(ew)ToT%NULwkDK}%eg?-0$N8|9nQWJgA->Oxhd7^=SAAR*=T8r*T;+~~QSxEP
z*HZ%?HD;P=gpYK3Cl}IHI+#V0j(MPc-5OX>E(9K$uBCb~MPj8hcr?!_GlU=0pvs*#
zuIM`VmbKVhx|ZXTARA!91gl<oEE2DZwn0Ef@ukB3l$`5)3?`Wl?Y1LVQ7jVI9Zs*Y
zljAhBY1m$mIn7U-^>pBu@>XE8+ZW%cl$b)cqUnrk<ZV|VBAuKzCQTf`tuo1a*tY1~
zWOaVur>L8k5396B7x_C<nL;0o)rmQs<*Wl68<-3nSBR^S{GfQjSKC~<Sf-UX2Bq%8
z+q!xfOU9?R`f0hMlEhP8QHdF2PL!D}jeL$CSaHOA{crLZOn5Rovxlz*ZY-~A-0Txm
zxcLDXN4a1OhB$jZeSwLuUrNLja}ZTo9;5D1`DG9`)bs6>nh_W{@Bsw{MW5k*Y{AM}
zRZn`V-lw4O=ys3{me(uFr&=!wkdQ}iczF1C8?@gl+Bl0jqI2W7LxbRR4dTgz3Tbu0
zvEm`3Rq+^0>?o}tB1<&wL{ssdO61N9eJUdcEyo^&eRMFhe9+G~W4`|}=#_4?;LFt9
zO``Qw(%jYU1KZhem4#TGiQsu#8C0JbocyMl8%!B)b>?Hs@><jzXENL;uk5b4E-4AA
z?mXpWi=jSOdu=mWK-jXr=UsU=kQ|p1la3~$Y{?%GzfNjv_EuET=#$s_wQpiML9wp*
zw%nBSCe`*<*sKhhX@w%n9jjwIC?qEkfbULG7f3+tM6r^R54#_1b1S;)WlFh-brQr`
zW2mo?kRqnMZ5Fk-_-5D#*%?D!$dG@zmTirf_8QT8al|(Tt#yJm)#oi3Yhn)mQg1sQ
zOD)h3pK~=-Pv#C|h77VEPSIJfVM<CyFMsw=dDnyTUYCn&53@`tC2w!st~MgKtdd)*
z#7xHSVVh(l;WNwoti@y$f<`?fBd2-~(ua=M-Q&!Y-D?M6B}tx6rZ=}Z9VG~ZL%~%&
zPkC)>Mb}!L2P*^0wAIas>;ai~O=uPj?eI1RDp{$^gsD`y7`ny%XS4BAo|7V(s~g3U
z9t(3r<{!{!>{`;k@kex<BS-tpF2vq#xbDy!UL^G@FSLXh)KA1-Ix1rv9?{R@ovYhf
z4;Hfd@Ra)|Dz1G_dWNskOIEX<gRy{?ac?^`*e6rnvHq>Q&E#Lit&q&VEyqu}`6*2Z
zd>rGh%!!R)g<V&|W=RGMqsq|W;*b@Uhg_902IwsC1Xk%r9vSzxhkkJ;PqpIMtT}PG
z#gbs?I*-*^gk?4_yIP;YSlarPVNY@-M>yBkj=?tHk^yO#V{GC1isuO&D)3t7VdO%1
zSbf05{^+f(;s!X(TJ*0Fs>grwP&zHn<%j<uxaj|b;9}Ct3WTS_V@8WWzsa3nTxKXb
zX;e(XSR^dNketnW*e;kq41eiG@N3*mMkS3ELOvc{o4CiXaZrO^#lLr?>pTpGeFYS5
zo%|*fh8Eq031F^wwdu)0>Ppl_JV@b4BeqDU_#ExH-;n_MT41O{GOw=viGImYVO~hu
zZdcdL%x%FXbY56oWy{Jpl$2D5nBY-?UHY|)4n8q;`o;2bs;rn?@PronD+*I9m;@!o
zzY+m~8qVhneE!s!T{RQx05Q?sMqlO;I6?7mo=L$Eo=Hmk!u<a&p2=Nh)+#yJ^`LW_
z84?WjhT(_aADd26k-HojEcpbL$DnwepCA(RHW(vPAH<rl0Zv_2bGL@@P*<%7*(t;Q
z3_E+evo<Q+Mpa%@5(prHJ%jm;b+Az8ji-d(AGPi5-mcEy?F5pvKs!N}!Jl>lS()82
z0j8+fCr)6G-Wp^1K~>Bjv?uwN-wNN!SD^CmNZXkC`*9bb$o(HmvVf+m#cvJP=HK$P
zv{nm^c)_c;Ott*mS+rO62Nc`+0&a9t{egmVOz6E$@z($m@wgxoPB1kEj<PM9=Ef&Q
zO{n~Uw8l$desFAXyFktJDc0uyV*1maK*c**EU=ui!Yx(kYjSjctCz!d#tjMtf410c
zA(XwnUMGH*uU#7BzfWvu`{}Mj24PtA97BsW$4D&s!({cxX=P)t)1r&pdY<ecex+S|
zDOa!pIS!f0l=E?#(61Y!E%b*17I>;M`yHv8t`3j^SJCW=&daZo17XeL*7+j$P;7kT
z<&DDW>ilrk57)Q7H&XaIpyj}eol$rpCV180-`0ZX=UV(Fs17}nq-7X_H+?Vxltc&O
za1ZBq)vJ)T^V~!ET3nJ?xF)c{yV-@Dxe}@;-PH`s=@Rv7c}H1NPd>KkMT&{<cLQqe
zyL3uY1wDhTsW^sy2@e`n)%qOni0Y@4xyoK)w(1S^jY%!q#%&6<U=_UWo52ej-93<2
z0dZbP7lktz?ZgR-K*s+8{erWJG=cff1h;0Xx-8$Fe^OR#zvl@bB}Wq5FGzm7n0_ff
zWV4=LZ!6=~SNmrqyqI~U_|~X%8gF<V<1X$;l8N&B1xnowYwjd`1Pk6=23XYw|HY~X
zh`Eh#GJ%#sL`X~#s%D2t1SpMcBGlH<!an{~8p%4JB#9!H9{dvNPul3Y>C<!LnC=uR
z(Ro(~%hg#gh&|B4bbC?L_v8$IT$SVF^P!M)86Zulfm6kQfZvCwF*ZLWi1GCiO(7pZ
zk|$UMvO-!C6S%WWxq9tBVDA3(C$4}lbJHqY*2746iYLA#{<HB)K2zW~L%CRL@?I1c
z;&I4-KF*VQd4<k&fR10yc>1E0n?P8MrrO<7*2-tIPUj&G(aGE+#)OzqwtQ0Jq3|*1
z+EVc56Khy670?g+D~(a?e8NuW5A;XCnbUJXtCxII?%A8#X*<ts!>{UuT-a7LmSVn;
zgqpr~tKx1cj6XU#%WPR(l;Bw!vKT7t<neJH;J9A#=fFF}Xb_7&AjY7z{RgP8aW~Kc
zj&u4YhX>lI(E#4jc`BY_?X{NQvMz+rUPF3{vjWK}neH-k%K+K9XQSdtstYv<fei+{
zyR<hgKR2F*1ZLCL*q#63gF7me>{x`Mp^xo}NV3?@O!*94y(i1Ht3r1Z(bAMWuR{tx
zt={C|Ak&=U=77@Yi1lwg890~_Lfs`#YZg>o$?AGLq%1m8KOqt>*A!f*Q6X}d!aq#(
z+t5>BGS*ufdNvDOjhdO={Ez{cmiRWmEVjP@!)XJVr;}{WECnrWc*0eVyw~pg71dDA
zON~ucCtE!zbOx%@t<1OQ4?gh!)Cd*C$R^UxSo0Ef`?zxpHFp*q-q1ehs))42d%v74
zG22WfAXZX_dbi^J#=|zMIe_z+r9HO<r34%32!y&u1}arn0V5G`{bqB33oHY)C+wgZ
z5t#sODu5y4`#l^0WcWuzyYnGjLtDA%kA`-}qmxbYsLr1Iyd`zZQ^lDG`v@PhkonhS
z0}sH^9eX44zD}nBJQyI?lk7^#vGYsId+zs<zE{2nw>rKEtCM$7xSFLG-;A>O7Z3uB
zacC&Tg13_P{4w(Xv^uh)3kg$+7DR6<XYJ#&@f)Z<{<3cot}3beF=gJ>gYBI3cvG<a
z2y=n?HMlv1PemwFOAJ>hr)sy?I=%z1WC(tdm&t5y>a#4?Tu)8>)M3?3?FhHPlPwta
zdm0bJ0{|&=A^`0On(M`YOPLRAeb$YJ;qL4%L6`HLmD%7Ax(Ph!AoK5fR%Ts<Ir(`5
z;!NvTuLi807sKr$@yRdcBFl@e3Y<;aI+^KunZQQ`xfbFqZx&=FqNgIw*q(eGNp$_I
z3p2YE5ag+cw{lg?|Ayn~ruCA;Crx}HZ~Bk$^$<egnZ!LYdHI#Sa8uvj_;&fWy%8Ci
zWG%hov##-mDQCS{ynt<!PlfG(kb|CWDDT9cgutCN)+&-sA<5@Qj{bWj5AA~St*8w&
zUN1Lo&*a+6@R6q0s!B`^^1iAfz$Qah>rNmSZq`={ZR+Hr916u46jp~8{0qAsVBi=I
z*Y@62HJm;$dsX<dXO9hf1y&vQQMsiq;Ce&RQg(i=evFFTM&Aphz~AaI!p<c(LMQj6
znT9Iinp5mGS<t1>8a9XV;L)(W_R4(r`>m-5zE7|2YH=9vqd&rZ&Cw0Ys(P43<P=dn
zoXtfzt)Q$DRjKjVvE03j;Mvlx=b<P;rhRm0=6!Y`Z0yqHb>sMY8wWg*v2RvXuV)|j
z&5n$OHGaU@UAt{RosY+tI<eHRVUjGWp5lQvw@zNDIYbaTeYY)MZI`eo*eo%vL^EsU
zaq^aN*1V~eDF0#NE1QY)j=dsvhBJ2<TIr}{hlv`o53|=QH9#(=u}=MV-$`X!X!C56
z>j<2CN2zQthKcY}O@pYHtw@H+*!kLgyJvcK#FT;fTZ@gytgIp^xlDbl!4GY#+n%$2
z<7^>q?<bAsXJkO9tHi%N&1VbApb2=OIIjI*M~}j4=7g&`V^!ltmc51UM>!)b8Ehdf
zI%(}oG4f*S4^idh%*~;mrHPcC#XdE5bp`A0>4P8T)Q-DO(jtN_aJzbRCEAU?5}crM
z$c$;nyVN|q_ld(<4Xl5=PZgw4$?Y8V@r!QA`9T|@puI@E!g^(8`~V}7%K|tlB_o8>
z%bUltHL8k*YeF5j+;V2izUSI;_T~#19>`Q#C2+DI6XPbx&i0<$0yC$}^Y9s2u2_`P
z6(+xI4)<>dm&wg0wNktvH5oxSJ&F7@u+*C{<{YVS_choQP?1D6#U*LdZpcrXWHJsW
zCuj5-8$U{A$jth%HxtT5aX^F4_&Dc2Hdx55QpVU0yJOtOhw-9ci}t*%lAn=`edfc`
zvZ-gexpwO4<{|9UxBf{+nIs2nGm+X4-FQs1R&|_*P5>HsZfc3ItlpBcN%f7X(f~^Y
z+pHsCiCn-*3`_4Ix{-8EEDA?GZ`S5r%Z(;lDZZh>OT%m-a?60cNIG?T5iPI2dE-F;
znvwR|LpP|;)ni7ZqOfs1zoPyti8?F}r~18uME>B}=Ga}!D|6RR-QSUPMvE6arbX1~
z7Q<_4B&65Ws`?%=`@9_pU)Iw_3VrH11`Lz7E4h_Y4$>6CYnil4e-&{MMdZFFyAgXM
z=ni@>q?qCY=+t~|keEsRisyYObHj}-4N>KX$8sVLvtjvL*#u8XgM4wWWy~)GIZR|*
z?~F6@sdll9q=gfrh5@=D);1ETt}i|VUBX2=#wn564h8ToVMJe;a~z>{PyYb!sq7V2
z>CedJ9~x;f)^jEQ4{vW7)mGcCi-w{tT7e>g(gH<8i))~iVx?Gd0)-YQSa2^=pjd!V
zpagdf8eEFI2MzA-R-o;>^L^`EYrSjjeb(9M&-pXQOnzjH%<(+Wea-v6#PWxm1(0sf
z<3Jp1iIYLn;AD`v^y7b5bjw`pto^HAgR!7t8x9^Vbwz`{_;GQC?y0~J(|kX-dWo;h
zVq1t?f8uH?&iz~E#{SPe3ZauuHG^pZCg_Lf$x~@w|389?Qfl0DFij}^+jEdJ-hPgW
zs%=15tgaYQ6BteXM7%prw4`M!?4y%<J7oFqFaw|AZZ9-UB2ZFtGBUA4DAih%hWE{f
z=bv1V6Nmxw@GQl&pNoG-T>r```Um2w{U-nn{SivogKvp{8?XEy1y=p!2>#3qbH<6B
zhDYuEe?^)$c|QLm(&TkEh(kPYc>vo%yu^Z<tHPkg?2$b}TBk41pzEwp0=QH4S}Y8I
z{2QPeQ_9Nc$Jdv%GueFB$G$4Rgo0e1=tw9_?>H}dx4SD>3}GhPI&iQj0H(=3%%M;4
zE?hXIB10&{1<$LbaYQ@M?_kh%J4bi__ZzuYng4S&_&1dP5s7HnbDj`EIoK5x2pYUE
zrPnLW_M>}0^>9ZY*zy-3eL31`T*w}shY<%iz-b9xxfkx6n5Ezi#zcw&nL<Uow?S4_
ziI>sNwNs-?UgJV;dmx{Kkb7Gb6(b*E9b^@FyOv3PbA$WM+!Alf?5i5Bm35HFHOH*`
zVEB1n55xCM;`$M`mJEl7ub3*_yqHI0wa(qj#lO!NLP3?-(#xGU+TY$wN(X&?FfG&y
zSbimO?O~E`WK@)#TToz#<>ZD!cV`upRA(7zec;2QX>L%rt)M}>Wf~W4W!|i&$q(sv
z%{xg4(T9yQMW2$#trrCv-vwmwEh?me`-zyw%5)73l55h(Forzp;2}Fmu|8Q`2vBUS
z+dv7QnBgeW)``lRqted2v^1XPH%<V3zG=Xa+MWF1M)Q+PDX*j8Fs&qWY~X$j2@9b$
z+G%1yhM-!oJuUY{X#5rH+Wn@;gcB1>V%s&BM;`{~XLuVHV@Djk&%*O;@rTODS^ffO
zXY)LkQ(-kKv6&m%?NB55W`7=zOq>jDzz*-eKBQu}RDJ5N*i9T>{h9Ns$AGaQIdj)2
zpSW!21G0@Tw4`}T%rwtWbb%-%JffiSO*ls5V@Svx8)l=|81%%M1Df{gqe&ZWN8J@`
zB*3%SyfUk_Xif#}`y^AlkJbg<ydBrzu5&`38ch{cPvf1#=6$PuKqR7g#TT8iYz=!_
zA3WQ-U2>DIp<%58*7Yn~eTfO!mFM58i@{e&V)dJNXjK(}r9Pe2aPZ3?e}Dy5kJsGS
z!EUO|H}{Y~5Cj-d@;lf5c<R1TJ>=q5WCzYipC=aeD<*@W&7A0ce^GPPs-qZ;cFx}K
z7vb2Et?hqwe(y)yMnY$naf4P-V4$Q9l-TMU7J*~36k|>+N!gxrS=+F8<nx-Pz#8!<
z+DwyUj8eAxywXNZtH!LkeSfH`yllkIg4jTkYkc<^l%El{-T_F|#rlssdNPk|XuABV
zEUDX7IzKq<y;T|ewwS~~C~FDV^QiL(@~0J>BXHqb|4%88|JSP0u_d9)J=3vAuKcaH
z-}3Tm^i&xc1tGsgQ~fC;)U65%8NV-baihQ2&NCUgR1M$SeNbX;5C~~xPlI&)(2U2k
zJos>3urI%7Iyxy7+tJDOBfTQZG~iNC+4<?p(;jl#VG)_)XTyi!!qN9TD6n5n&4iBT
zq79g_g0EGXp_YJXIaDI7Nwjw){4!&@_PLE0gK##6U%%!3>N)3cP+avPJ{x=mKX^&?
zCzI8S0ltHf%yOThRf08jj8biob2=6+5$qy7V5jY?^z5FVvEUc7n18aFuYXjhS~^WU
zqPJK()wJRm*eK57Eqc(R6WBTpMgasC5blx{b)QwTau=&nhV;P+<Y05()pcfSfz8Zv
zIReYsRZrq639q_!r@ExFLuwtPH@*A3c@x5V9Yr9Fw#XNu);e${UMK~XQLhtz0f!*<
z25U)FlbW{yKars$zb99yMIxkY>kVYL>`}KE8PDOC>#O)lP|qCjrKl2^LR+NzKCIy~
zIJab6kEL!jPLoHgtn4sJZ-t6I!a*~LAkaA_wvs%F=CfuguUd<?p388eh!U!zTt{rO
zB#?s%lF&U(<pJ+>X?vpZZK0rtBCyeh#VR(w1{s3Ufv|lS8tXTMlB@yNy{?HFaCu)E
zI_SKt(utC^N+@vZ);XDB+va&{sjDVqTvw}zNzdJ-^v8(GjQ<>jJ$pvB`Q!KWTvuM^
zoPsA>S$+)e^yct5?z-;DZ=J}hv`Nao(09B30Gi|y-`kNznHPoZe*q9Qk^fp&^}9At
zbMg|3vgCWncw7+RdE_X+(iI>mlZGz;P?rm&U^P978J_dYFGYsG^)#xMRAqjDFmMZA
zSoWE`HGp<+-&VuFU@gmBCoz11cL5&WvZ4m`@{FBZ0fVM#+q?w@2~qA&aax)?zvc3B
zDkrBpcdXKPYzxfhS$J_LY={5VpTX{Nw<PbT2>%MJ`n@HG!UVdJd|_cPcq=)~q2yF#
z1^;8zuw#&l99~Yf5HAXYzVgzM;$wek7NTauN$<Fs4*RXAE`Ee&$<23d2wB`62+im-
zJmgG%_$;^{sLz}Tj6xFqc}g5@Mw_gHOWP8&YroLdVq7H+!qLm`jZSIK#_xheW~HgI
z3lLexBK-H)&!Z;`%<AJyqvnJ<PaKc8n3sX(Zqn%Fp_W<l)1z$mta3?oLt%9Z!s`24
zNb`wfpg_X9B@0;HTCoaJnm+-%thGmLKp4Qy6Atkix<tZmqE-B{?T-3^_+DFLbh?cw
z6?3*qukd@%r?mN+G%yVxsbYS@s9?1SikjY@<^w2FSrv#k|3qlJ96op?c%x8-Y}R+F
zS{o;g?k6jJpyn7ecp2jO#4Ko<U6c*i@A$?rSyMS9q#Em+7qTK?y;f-M&3>2*yMVCB
zDp0^uwjA>DvYri>f^!U?PPrR_tS}E2cm-dxm-C}4gyqEohMgmlLx>V9nueXn{)fzE
z(zL8BE(1?4E_1V&o#R)1EI|g{0SF}tfTZ?k9Vk>jHaM!pCr)?xRc>ZJ(0O>(5#K<J
z>_WnOxF5w7KjE99%=n?&vu0K{Xti8Z(dpon?3C<*r>*pgn9K+iCB9cJ?ki)S{kd1`
zk<;kp^t*ZfItkIJD9KjXuv!|d#<%#qYpH7Y`UuHOJZWGKL$tI49VN|z+UC4j=J{U|
zB`PZuQuAm{l=G83voeF>x+@jgF#y{;+cLy?7eZw^*iZFX8-j8P%kur7>62v+uca^O
zXt`jP;^}hJbBE(L3y(J6FDjsP<@y<doDtI$GF!ekX&Hz4Xuryg$#Y&Ga$g}|fyRb8
zpE+d}=9y6PN`49okyB=Wn&8ySIs%#~X_wnMyBkFA)`{#_>5||qE?p?iQM|;9AFqU6
zT>ivJ-&V3p7v>U9S{T&*Iy_+N%VBwXPP1=R8uW>hVoct5eLZMUlqq~kp`b8lObZLo
zU09GPV1RILwJ!or!MnAyMlE>|uzgYe%ZP-`^zr$-Bksf;-z9_Gncm>g$$jFp7ToyI
zY%>wyVbMGC7k~!+Vd|5qEe$VC$dyRH0F&^F<QuzVHi(~tzMuT{ll7t(h_iIrLxu&*
zh=`ePFzWYSUd@sMEG$;%y{rZUt8IyG2?e>gr>JGYwz>wWnriHFwqT_oP27{4gHz>Y
zjK6uefrs;f$$@{t@8mXPwOq^W&sI;EM`R=ii);JTRE<c3;D*Y-KT$@*7id;AENiB8
zWsEfKbJ9xF4;~JX8nHsQCSi2;e@GFHZ>{%oO-jltAVozXQbS;FrZc!ctJ&HRk&3Zp
z&8QW8q=19ltRBKPfj$h^FB~*lW7<N90`c&jj|dGV<eC?(91JW*Y*9HizX~;&5gVEe
z#@j0a`Q)pFO{#>gX7-N!Vi73q(!h#usKTuLcyy((4UE;~>xU)tp<fTg@AvTvN4Tyg
zkJ-CCnvAiGXe<b;6np}_KQcrlEo)5b?OFx1QF?Lz9%tc@Z7N33ydx|uPq;eA-#~GG
zqfPnJ-4{K>^Z3^Hv;m1+k#j0S)W<amjo;b73dsNN*h;%q8$LRmT1jtX^EnpvyNl)L
z&Z=O^O7PN`wn)M2;1m5k9uclf-D!Qh3n9B6vNKJ-BifC6y1D#7vfVS+njc!1=015r
z>$d_6kk%d3`}};YcFVmCA`woKa35VELjgnAC(zN+hpbg|oCL3>_4<&S<tM#!tJTop
ztOd6`J5YaMLS<?x#eJ>LSy~_w-ijlOC>tk8=jL8mku^u*GSaOA(ZUgAcv<dP{y;1w
zD%4*lai~~uY#+b=vADp~s(Zqit0Dfow;78ROr8`=iJ<Ej1Ln==*paGxHZu`6oFz_y
zJ!ht!Ac7}+2%7K(wtPCLYn2)X6V%!fnEAaxbhOy&us~N@)3i^`4JUVIDI($V<g00Z
z&iU34-Hlkh`Bt#{d)B$%nX5fUd_VpIe2LHE6|m11k#QEpaX2FCsDb!Rhi7RNygp(}
zOxzX!P-<BkWw$^Nrh2kCcFhB>I8{_^%TvU~t!jV5BmhrnN)HDesHw5<AcvH^4f<QY
zHD#;_Bf1WwxDn9GQei&@qm=-*%+l6v|A>2`-P7##{FA^j-LrvPCDc?yhl){2gN03a
zBM-H!&?CD-rm7DFmcbj1%S7pxPL5*cR=P|R+ng>_X+PdWY`8g(gqYwn-<R2<<^u5@
zWm7vBfo7InL|?;$WXkN{O`HqcDdd?|`Q&zOYu-TEq4Pw_jP1mvEvd(nlfx@U<dt*U
z#_tsa6CMve#b*`Dh`R~ACjvDdJI5*fO3saO7PUMA`Zjy1H<+B#@tv*rvpGL7TAKaX
zOv%%Lo_2}6+D|K;jzCp;anzmblHDCw7MF{_-rKIBaxb}8Lgay5ZorTe$)LT5(Yipm
zy5X4R;PlnKV%{t>x5t_`3_KqvX?BW|+v%4LnPveUp(MQPVt5nObF;ZqC!S+8H^p6i
za9L7``UQ11S7q2`4;jS+HQ8@8*KB5XtKQhL82+_@xIV8E%l`{BRHd~S5qA`?!zhqD
zG!C`3rG~pgnZt<_HY%z+nOG_qUn-2!-{IM{pD+!TF{-|gR_vcsk+m)cAqMHUH~59V
z!2F%SK0#5(+Cgt^xDMX-?LDs;a;O!nXbH)(#%^iz%}N^LyOBAjUY~d}S7tr?C;R08
z;qniLN4k)UQU4wt6QcJgXNW*j>TZ>N9qR*0JRKLA@78~YcqhcA7~UX@TGBX|rQ($t
zB`Ga|LHr_NgS;%Pk#X_zKh!jznChZfbheZn%jZ|K?R^WMx+Dev+$QP8Z_E7rhO4_C
z6Hi~P`YTyQ(y?#n<xtOaScs%(RC6zf_?oUkb#vuxo^6PJ>4o-a!&^;!?2S&vtf!ws
zaYs-(Ze#Td3H^9?xmIG?P(N|*ET=$M!dE{S_Ip6oU=?p=^`ch7tJtiSAcZW=TpKqw
z@ph}9n4Yx^f9u_7{RRf`NLo;6^=PmUY@8ijy)F?7Db5a;v99Y=p$3k>tZF&T26_8S
ztcflyO;F`Y$i=Dogb_*=)oM*(pQjK{w2wm+k10tP4Lq=7k^b^OC9fKAl5FDwz5{NE
zBz6k=Jar;|`Zt)30A7fw*wj$qoDHaqO?1W&lDMO~Zf7v=WDTWAc1_kYa;O<tz|S!|
zzppd#hIL>bvcQ)gJpT%A*f+uw|C?k=C~5`ziV4q;23;rWuec8DBa$fGF5sbOc%wD0
zt~0lPxwio_8!WbVL63<YI!F3HkU!k`@ltHRx`-a@9YscsMub@xvDj89iizP|ra!Yy
zeU(lp6B0^AL2o4qh(CZP1xN2VG76YRwLS@o9?w;<5|){z8{Zly%DjGwZBc$y>Avt6
zz;$6Qlu6<*z+NTVEkQ2tEJsLYw&wPGe(H6rnLus8q0~NQu9XjHb+vW1TOjH<h$Vau
zoUM1MY+w8*Rz*hlQMOn|@XOwj*jecISAGWjk_v14DWR3-`K;{o#L+9GW!T!vmlIRK
z>FSfWyVHp_<jxsIMS|$n!&`GhYW_A-qr{L#wmKHyO1EQ!Eaq;Z?uyFGu>3;7sqY1d
zh80+0a92sdGN$`UB6vMggm$TS3vp<76Y=`8qKJKh@c;xm6xZh{`trh?$@C*MDIw6K
z($h5Kgl;m(U|bRKa0DM&w8V3hr;M?8BmMQVylp{h$p{Z|XaCj&9V&<m(t|J$qN<&A
z<>siN+v~Xx$13IJSVW(+fBcTFZ@z0y!F<%R`(ZX@SE@%1Upd_(DJQn>PV5)c->zI&
z+2~HBTUvw7?$I~iTKXVOea(eqVhLJusFzUo$CHg-11ihO<<GpA&H-_z-z{;|H-meB
z-;TY4LzOF~LPAFdV@q5Ij(wc9qb($+pFLHW_*c3yRcQjXhA3Yua~ka1W^!z&hOW``
zvfN23nuaV3KKOZoZ;b3K01c45mc38coBQBSN3OTH9cWjH)BJ(5ki<I*sf6}@uP<bx
zC+0aWJt2FZ+D3SJ?BfRfAp_ci+7C6w73f%qznp-FX@`HM1U*X#tWvr3oUMXdZ3$5=
z%0YHy@5Y5jjRP1)B0`CQr;aFhUnS@?PI57}Qy=A6JBhrhPkxBSx)JRI6=_)yqJj9q
zu9NgmS+`D@N%aw+U5z1wF0-H0Wk_rQF4>6#U<n{QRCh9be(vr1u06q^<&a$z(>b~|
z5U}sBNRXz-_L+0H<6}X?08LCn={*fw!h~xER`|n~S8Nf%v&$XePx7-CJ&r$0b?k6X
z3eCo@dD-6hS#^fK6wll#Lx_&=NPd+r?j!PbKrB(@XSLWsgS*4$ysO5(L$`OIhw!QQ
z&N8ezCv8qM4iifio#mr08RD7pi!pqQTpP&PiNKah_dZ5_9?|=WjqG0z5P+pmx|XJ8
zd{zw+tc&O=NR$de(yqbj{$GHe=)f^`^+wia_4#w^1~~EqSF#UTesS0k$VH8gR_uy;
zrC53|x$3AF$D&vV-KR36NtLzVzlGTJgOvrgv+JhlZ^R2(yptqIoi;-O?hZU22MwqN
z-2c9`#tLVf3#?={>a+>bdXrfwn#QM_w{0&wZ^{^t@<I(?E|Z**?hv!J2rJm-!uf&S
z?cHej8^FtkF`O;)KQO?*T?n0x^i{J)r;{~JDHFUbX^~#NOZw?2Ld9FJKD0P)OMrTR
z!1XzieJNhOBRKbx6TxDxp+<>2Jw-xp2-u3bkV#p#!|%ZkQHMBH;--vojeq<qjW@R1
z_DsJ(uo`~=dO@yfg?-g$#vH_bvdrM`lcMwGEC210h5OqDMj-@9+gM2Qr4Sm8&}{97
z$>T-k4w*R8LFHw%Nn6UVKllw?kc}!!j!KnbOyT@n)ni}3l&&!B<N1lLk$%>O93l%E
z_P~7JaE~PNlu0^MH;<enJ$g|uyQtH^bhgW-(p#PJs+~SFR9=;WCfH7y#aW*=K{!N&
z7oRnDVDKkU&h0a5-#|6`y{u2_`D^7al{fsfA2x^irxMWqGL9^Xl2kr#=kQ+*1L(v=
zwVNO3<zsZPy9R}yk|rPDEy9`-1HiNRewhRcW-i)VSk6fy!Qp(7d$W6{!3QhOdRJcc
zjQm6jvG=m)Ql`R-lG(CW-rRUKBw?R5^e)e2_}ATar<jk{ecD0mCckH^pO6fi^36AL
zeR@Y(J2hn5f!(b|vuT_%KNKt*c&}4%I#q4<54wB~y6ZsWWzjw-XIs)47eaN_NrE2@
z#H-&`OIy^6M?Tofx3=0Un@A-6f`X?(d9)`f5}Pk%lUlckR`Mkf43&!jfXR#2QJ_&k
z++fDQ(S?hbZZ%FQ?dZL8FkG!H`{>kst%-s_sMBnVcBznCCH+S7N6hC>7jI~($s0-=
zf2X)ys62Y0)v{m+O;=;^h%7OG*Cfm6<_25Oy+|mpatpSrwm#q!DBiQ#%Zy(sm!#K2
z9_b&kdezN%M}LR#|0IVhF$2^jDXavV1=QN+Eb5bfQn-Ten)LQrf4$?EfMWdH%KXnY
zig#bb;dd?;RlSL^3h_QT-pA5YLcVN0G4tp(Ax`HPk7RC87IZmovCgrDRpgF%57Uo|
zA=H?wiVi-*CME^2-r$_`S%Y`ZAGnCg*~IqR)oNB!%SqN9ms=RJswvR%)%2Im<#T7<
z1JunM73V$P%wnFj>y+R&U_zLztg>A;93Fz?vat#!eHIpgvO2{hG=96y#VDb{He6(F
zpLjiN!|Mv^RTX>b(7O1YQF!=esUnVB=U?E}@n*!xU`Q!1pXNYKbs@*PgA2=dDW;(A
z2w)$O40-W2FgM#Zg+A{tXa1Mb#qAM7*A~st&Xo#g*N@vi)ApzqtjlF`aY?gsoBSnh
z1Yp%Cx7EKJo^!M@hybv?-UHuf+sz~W9Z~?P1~DCL1%wPrH^z14C%A7-*cOycy7P_+
zQKZ&(<mZ@ow>gJ<mkYe?x(^+A(oR~rZ_0cWRP(D>*18C1dO9X-M|djdqZK=i^p0v9
zlq3%kp(9gmy<oyKX**`(zG31>BC`z_CX(+Csm?F~hye=dU;M^kb!scpb;R<+cL2Y5
zFMgOw=lY|y{*!I-_dA&w>tyo|LmTK~b#@Cbln|lmkm*C!{pS=ZY2Fc)Zz*YMUvKpP
zUbAfW5Nk$i(3**Pu645fyr}WsvoRE%bOrI5h$%9!Eq9|~zN{KNSTQb)j13eK!w5Dt
zAJEdWf2~Sd_rc?GGq^V-GP`9lgvw5tkoBZ?$R&HO$|Rx)aFF5!0-gKXn=hZ3x#m~B
zReJul#^5?#Ka{*x6sp#RBJiF})Uxi6I2cgVmX(Cn%sSc`23!wd>E&^}=D>LOiG*g)
zQkN*E<nPm@zWQawNflsJzKMNXXF#Cp%t@=Lfp5EmLao*yr+M+=s&ka23WZM{Q!jzP
z(ng@J-ao6H?l|S9iZO3YP6edc#T?skuXisqsfIJpJBciawXXYDLX!mk)0z2z3Y`Tx
z6&dpbr<S!MZeHOzqea9Mg_7JtBuD2U`Ny!~=qG_jEgk9F)(3@6jEVC_rnE>p>&5AS
z-mvdPe({+f%j}oM@>lPX^{7GiMYzCfx_PEe+5<u?g@nFlM+ossJx7)oZfbYuSn*mq
z3sw7GXo-Lc?X&X|!}FH#Id@l`m5m;D%TxGv8EX)^|E+3qD63}Hy7{82&6#qO&Nb$t
z<i3nrvCV_2!S&9v{t~qbl5Pvoy^SGg2oR6yBk|eA6n#XQMQXN<u%;9}ceU+9jnMLL
zvk)=;OG73&v6LBg6J*WI4Xd~IbkLRus<{3NpA_}))#~qO!hiqnk!$}2wCW98{k%1Y
z-hN0!o<%ofG{rN4A;ppr4MWboMwP%hTa5bR3l|r&0ZqtzeHHm0rl-3r9gzohR&FHo
zk;^Y8rr+Lcz&BPlQUOyDc4u)KY_~GRbyB>%v*uQa8B9w{ot`s6=AwMagkUFcr@h&-
zC4w-(8=fjfB@J>l>&sc@?A&k?gTDZBnJ}08irZ$C%d8YWEE44Hzq7`51pbWh<4(?Z
zH?;=oI=lIum=_*X^+S?+!;8I33BAJfd%<iqu@~AGj_)y5*aS~}dhq&wkqfrP;19-n
z|D0MdUdOs5uRiXT?9ZHsG(bt<{eXck%^eRRsk%}1rDyO`%4EAz=yP&s)&g&Z`yeR*
z{$GGGr8yLurtC5hDd8$9crx@+U;wB>ZWS|#C(3X~)<7*<kX~qNL(K|3WmpvU=sc#y
znq>YM{Q$OAnXPWaJ9;Gi)uCpOJnEYeRoHSCvQqZ_WlHQGQHXg5?J!^JuhJ{egNdo4
zBwmbWmje$^>f{UZ=-|atpz4fRPnQOV3*(;J+>D@VMS_F}k)9RwqxriRs~7&ZL4+u=
zO@R>(Dc8tTs9#_1TIjmcZm&bu!uL;}vH75=oP@(Ip(geM$@<_Ixz!t4wQpv5-JxCN
zzzavB#&H|E$H2%7WB;|EuYNy$e`HXk@^KawzM(<NTw<Sri{da9SO}v(Lv+L?#K_E~
znVGG4Y&R06=N_c%&hA+=7sW?C)KJi%@-~h7(-dVTL0N<LuG$PTdfW)<(!YKi@yOOT
zUa!D%hJK}UTKcmVjsm`BHyu3;xnC9@x{>Uj_ZB}p|2z-YbU#McIWD&Dgp?kwp)r?r
zfDB)RY?o_>$WNV`+#lJce4bLv^!D{x?mkZOzkfn*t8?R~>yxSi+4&@VwXjzQH0p^w
zLWrHt5_Lj%2s<HBM$-ATjVmgP6laaYqCcI}fCnk2oTpJFC5Xr=%#D`D)wt|pZB*p1
zXY=bKBZv{}JeTH%xy^4kXV&s5Ye3bbK2Zf_U~2hpLdD8(v|2?O;Fg_r`4@@wqsMoJ
z5|V=Ik6ft>Q*S-icu|qCT2?cMx?UEkw=PujuRG6)zF}&4JB+j;4mk;4;a-U<T0c8-
zKAPr`Kkb3F16rRn8+(J&ywV0;e#KMpdgPK3{2^6>eqO;NZ2J!kiQAR3#;)MRcjMv7
zll}KNQWPycd@W-~g0tC{0Cgo^XYXtbs+6IPT|#=pxC2S<`TTDMe^qdQea_Bmvs-3y
z>14@~jUA>-?#-;PgM6gG6c6$2s>HfS`om<`X%%dlE~&4pod~sg%ZE#(o7kYYT8M!R
zXd}i=R7N=B1w310&(8dFPR<W4{gO*hh%$rq(~k(xa^;jQ2~j{mt-1oJKO#|gR~$@=
zD&Xe516fRqujnxb+L`7=9TG<K%;WnXg@~mf7@lpo8cFBXL{7ZnN~QZI(=9rH2WSjU
z!(+BgP}H}`KutE7z8%{WZ<ga3fi5FzX0RS}fN%v7zAEO%ua-c$S;@-};}EVQY3%*h
z571R8PgJ4RM+;FxS(#9`boJP{tJ&QkUAZtB6hlF&NKtaA6**>1MwboTfWV`@fRrbw
zGAsXV;wS1MPLSqml>IT~rb|A&q}Au}s5Wmd2T2sbs87rsuzXpc)GadnGU(m(<FP!n
z%Hly+2kWE5!>~Umi^bBbAVZ@x2<Q2qs2aV--Y#Du?&n28U+GwUa+*#kOkj@zYRlI=
zjYcgEagZIbi04GLh})D-8@N4bQ~}8Bo>@W;m47AXC&L~iMT_2n+L<<5O#X5&4w{wQ
z{(}B~B4AACX!_gOyh(w!?SzfEnz27l{<5$*yG~^uvS;<FiP$lbh{zW%i<@JJNl-*6
z<`#xjBIv&}_TaMGVjBs}am@x|KRGk-k5OecXzlJjN9D|iqpHMuo00x%F)TZd1|f-0
zarRjTGDIPFNd5wJ*ibh59xk~RmgZ*`9GPdNU?yq<h7Q;9Md!)RHu)cAb&-!3P3B9y
zubZ=ZC!}taVj5q^mOnw9w)oWBD1Vv;MMzOEo_ngz&tbD(L$B8*?Q%L&@rULWY@jNx
z*W@th9eqeJwi;{eo|cAvp(<5YxNvgpeA2g`r(-yPV^P(Y=HG~p{fVpjQ|8Bb`<Oa`
z+@Z)N=)%<1NQK-^nKcc*L@j7RG6OuM5v5YD3zBCXv@9a`r1|)~qRv=Cpu#w#dG7qW
zBpy{-T)+Z?8gBMJg$4z{oK^AG#V-tz()zH=AZmDo)<A)s(6?v=r)5}{;`5Jvgl(u*
z!up+>C90`!^65XuY#_${j~KULi!CoIMZTQyb>%yFXsJjG7fs)vcR*tklnw9eC=)io
zxpc(&yCs0{PwfBj>JgX{1ho(wf8uZP8`{~3A?m$p2o=SPeE5`=d2H-I05*+Xi6SO7
zXU9$*tjG=A6LM~n{cTmX4!q0WN|;krW~GB)=mMIWWl%19_uRn8`AC0HkdiDm8pZ)q
zEJm`Zi)d}{87+&_vHQEv&~~COK1eG*389YqXMrYoL|-(ZS-2}W?>Z#n<<W`2;2zRA
z{j%)W6$!C?K$@SN%ltod(<<a(R|Qv)&uUsy6NS6yQ@ZZfwL}5`O76V$;`+;^Qu`?<
zh;NmWeNiUMt=i@moMrto(ueq6Ve(;S&Lq$N;n5oyqufgHSh|f!NS#>dATW9=NKXzv
zfAO^enmpO^!$3sU-~et*B}a^Jk!E;jtA51#LZ-KM=3wjl(#C_`1vVr7({tAm%rp`v
zWF$e`2Fv!YXovKQ9t~vsZV;}aQ8KzRw)y4y5viY>>&C~0>Te&a)pD}LK$VvArGoX&
zy8`2scd*=Gs#`{$kGVhFa28}eg9x>*k5k17IdSM-*C<TL^ON^-nr{z=*n~9GdXwrd
z6gxh^B2SKjV#;)j|KuXhP!<)<r~Cslj~-35We)ku_IO+a+IXGmYAK(&wUf)}Y)%Q+
zReK9|+7%VlB@hqHzxvRNM@OXKWG^ojyIR;Fb;Pz<IteaDKc1d=K;Ay>1b+_h2%RP~
zH2_Wv{(K<3sUQUsb4XaicGs1rT{y-j%<NbsM>PI%#NfG;eRp^s5YPda6_csRYO``p
zxrzdVFN@LNQSM0+eVnL@8WsZPCpse4Lu{RE*x`92uK}aRcO_-x4Kl}uJ0)>T-W|G*
z-uOxHX58YwNU-p_4GqHv#1@EpBUmc-C}pOnia|8x^oVI^+mdJY_(H6a4pfr1_+KSp
zfx<nQ$^6YpuSM?QoAmd6&=9UZliD%4cRk&DJ*MFwKucYbCif#BQ2fO6#$4Til%dzJ
zgPIN{rn@fXkJFxuq7RPl8Cf!Z?Z3Vi$xnF2z_PmwTqb(??n?~X<?k;Z|Hv2qKut|G
zj%o1<OCsY#*PkjbPoXKy;>z!ZLa@2yDuxLMY<9&Hi9{(9V+<W?biX{|t)7uVt3k3_
z5nI+Z%0>=-E_b{a*4KqYu)`Ove<VVNdOl>g$w??eL59lJuD>9tBL=MPVj0yjLbLvu
z#nJ1dA<qAMD0jP=X23oWApn2YmMA?mEKzsce@`ECvjj26BGz3Fa{mI{@?wv778foN
z_OkQ*B%5~{W?Y7nl}B&b5|+q$EP;mjyfN@n*h0^uR{y_gZvV+qc(K*YoyQI3EIrlB
zy}x@P;TVsqm-p*%f~FYio%N=E?Ri%#c`Eo})Ro*LAzE>#PkL$EL?%&sjPq*kds@m@
zrnRV6qMlsz0#O|1yawvy^Rg9enQo(-Zhd&hzCA<kFN5eQJJ>%U>MP>L-nxV!AmGEh
zdd>>mY951;mK2VnQsmNsuV?LaBU}%It7{r&xH;!n$9P^)&;fg5Pqh}@bGUMfElM!&
zB8{!-!gdw~7~AoN+2L=NZGHT=$FW=H+UJR>uHN-K+iaPY19GHA1s*U4D9{}=hmTjv
z;5_Vehdk-;umablg6U3=8|)bC8tW2*1o(P{-b6)3^|cP9yrN?z#8$P;f8IqLT|0i>
z;v;Nflrt}^!#(yR88(+!SKkH;KgNFFN(hRDw~&s{`Jxvk#%vojbiTt`A7N@#@weJl
zY0S&c<-${M_!AIIgc3$>;cx{7T4-+Y5X{?9p0ut`RY}^%=WSeJ&FHLz6{dY!fsn!G
zpqfv0<{1<pJN#hYU);nOk8rq3bH;A6J-p`1KCc*tUxzG=^izAGm2%jyYyU{=Q_94Y
zW-FJO?MpgysP}Z^EY!)@lF8p*M}+#Fc#x`11S(De;wK+}HU#cJ(%MpfFRSDd38Y{a
zVW8l-BiuGD#;ftGYG%ulYD#e{tV|F+>?kVv#M}api5%cVW%o!taKyC;fn0LSDo%S*
zBd4a`Q{Qq-@jA<G$UWO4IR`U7|1=MI03mpA@^<Qb#@axRo9Ymd`GMPl&mJkLrlSPS
z=9(9n5b_Zw_yreM@iWVtgn8K^AjJdrgjzczyKwS%sg3eMUWcqxRu0h@CFj(3VnqNn
z1+04lBnAKgf`RT5Axi|`93k0058m{1tO6;ap>8v+GeH9Y!VcvkmkV1pB=WZ{QW#uO
ze=^y<3|tEdl-X46=*eo&DD_#|zr4|W;V#RzH}+wB81jfn{VdSS>`aPl37eK&f#npe
zmTOs3mXmlPI58x6LiD&(ImG}rXr6I2y%_W+ym{z{p=sK|E9;D4gcnCEGQ|XOP2py}
z$xqC7?y8z@CnrhSGDk28f-Xl+_H=O@H7d)y6K4V^9~A#7_m;!;TVbC!z_N4a!BOe^
zCql9Z6XV)SP(=0Qi?F;8$3nx_tKABem6FXHgiF;h`9Fh4u~TYfAYZY=+v$*#UQG8?
z<QWV!Lq3rZKcV#)LYUOvk~A6b!Z$J>hBT8ZppX<B9`2PQ_-G;IlCNisR%tl8^vD}O
zEHX8tgYFtr5zd@2F#dY<!tBmBXfeUJ3ce6u>8GhE+RmudlSI?buUIv>x;+xP!xsI{
z$UdffmMtp>;l?++0)r|6*7EvuZJI7)J<wzGJE)tF<=U7Y4O&E&<MK3G)Ql+gSUVI=
zdDAeF{;M+kF94`NGbi)lK32Hf3W}by`lFWrQrN~bqC=wQIFxGtVWcIa`UmU7tZ+C2
zEURyqUH`5R_{r?2X&v#y0nuYa`uPX2TI~%&toZE$U1sy#^9*GCDL+y~=yXuFVv(<H
zuG~qK*smxQg?j%%=!eDS?Qx(!({7KpaB7a+Qz#3}ilT2>Qk40OAearrC{$bH%?2Xp
z5j>Xrl%hbuLuTsNmjV!G$f(t|L4j>c1mmyf?AX-1Kc<xmOIjw#h|w8M3Y}|NP%4)M
zQYyyCQhIYZc%Aj3`WAXJ7)sQtklgWeawFPj@<Sf3{nn}ay84hdo{<+~6pV9quo{4r
z_k-pa4Q?$#Rlf=IUyRryqGSjKQXl1Bhjpt`F$VON0z6EZXY6i5hTKw*A*B=4&hq>}
zcXstzl8?yQ?>hdNJrL+3>^_iF68r&$=Viv$|5;Y-&$5Al8~U)kL21*nDsRrfast7E
zph$6n$1DML3^<Dt=WS9(oWY0VRP}U(FUZ&Qs9F&2`tJ4Xr<RnY#E+RJn~42o%*G6|
z^3IeBitG`XF6x>SP5D0Jf~gK#Yr@VHOJ_trs3D=tGieliBz!ZgCz{glm7usR=|}<F
ztY~J)m2!5|EaK7W?{1YcjvHIz9CRWgiIBZUkl^?DFkW-B5kfhtQv;*5t#-YQFfYOv
zoNHCVObU)(Lr<I7GNOWvx<(SU=o|jGRE)n<;O-PI39^xIUcR_L&+FEIxHYzcT#$CL
zh-N)*G+i4sIbHe~@rgMHb7^gwS%Sz~5^|*~$aNLcdO1kS6@=V8>Fd1f+(Rd+zcs>T
z0OpjXi4fPW(z>~u?fTfmaPi6?T`Sft5VR7_X7c9IK$#^?a&Bdx!jA4e{gUz;dahml
z4t7&nS$EO4UaR57eY3JTc1yQnrVRKkwNZE8I<pV|h^}Zn=7h>4O>tNrK-&s%(q)wy
z&{t4{Wu=9e(hR9dkU4dq#B9a}-pdiFY!Lk@_zjt^^&V1=Z<SfMDlBpgNk}BRwk#Ue
zAk@j0(Pzcf+)_)vA6Hk`R?sG8_WNZAbK7X^3{)C17D~G8BJR5>g5N4Z8#T3Br^KPD
zq$yKs6bC-$L${C)rH(MBQlEtVCd&}<uVx_@)hCMM(-j?0hgb;iF9&h&AH5wj;_=Eu
zebaW^lh5jWG}gRiE;tlft{m63C)zyRH|%*xp@OYa9M#zl*%5nQbWSv`pvVeMUOav&
zh@S?uoTQsuF2WL7?to>CXD@8ObWu{9rzxb@Xo_{#<K|1wM;8r*c^O4Zg5Z{)doGKK
zjv1(0fk0$Uh~J?O+MiUZjR0s*a&p3*5ce8;exAsU0#;*mCLjwc0=pJRMtpSc3}HaI
zt&bzL0GyxU*C4tvM&#(Cw?sAFp>Cr$*UFF`wU82=v)4Jaqz6AT5<k+6GJKlDYUcp`
z=v*+ihRe%i?vVyu1sAw`b7%L>-+`A*`hv@5R@L6URF$0H53)B%W(J~a3OD(<zmwQT
z`mL096Y;?<eGbmlluIwz4g<X#pJJxMmEIiXWf${LXw^BHE{=69{De2v&P3g%vN)Z+
z(D^o*n4FhZGrq9>g3@eUQ~5pTdj5B^$HY{!NN0rDIj}a`FW|>OX0@r!f{JkF#DlPO
z;EQJ*{w%=(!}H6QpF`iJex%ZH{gYg8eETx3$001b)SKDLG>x9Wr#y9d9;v&5?eob!
z5RcZxS~H{akqf7GT289ZUe-2K9^tjEUYX`2o3qH;7d}mjb8X<d#Iqa@!bLaJQ?HEm
zm=Q@MJr9jKF$s}&9Y4mKtL@URH8QMN8;4#&IiOi(C|}XTRXE4I;UVzQ19HBG7}qf`
z+qIZPhJ;q_`M}ANsoj%UBs$)WlUR6(^*lK~XCwSHo$El~4Y9BHmGI?iRM*sXcM=tB
zlfCO`MYpNAWN#u^Jjn*Xus(RZ=bo1rQiSmip;U~=5J@GSye$7%Cu!m@2`&R2I?7P9
zNopO-&#Z(6#8zbEq3{8e%#R!HT~?Qqt7Y5Q_~5g>Ban;pXLTrP|12tGzL2)dG`2N5
zfu1S`m)6i4SZ5Ta<u|$ji9<tlELj60O&Ls)^9k1ZB;(D+AI{HyzhzkS)6SrqYu*r0
zNa~>>evW32sI%%%eKC`kmxn5`(;hBYGKL5!6q&K*gzQtiT(m4?w^v@R>?wQEz!jk&
z4xgiLK5lzd8!}NBhwq_yd;j9g7ePxWiZ$DHn?z-E(B`zJ9V!x+JU|E6A*MMIJfmX>
z-cwRzWMmaA7p&pXo0%C`>Uh;Uf9OWSi5k~_(r=h3^18#^E%o{ZTgTVNX5!G$j?gkT
zJSf^NIL~DrDZgZ2qcdKvM9qeMoBf2qo)wNOZ-$}`wtP|7sn%3x(-cE{sG3w-kk-VN
zrFD<uHAfNKA>{qmO4kr86^Tdh@Y0Xm8+U!Jy*btLqWqdo8mR<jD3{S!6Gu^Z4@jsq
zFHF>m7OL=l;y#hCc@;F31w7toUJEG(xoSIUY3OQcC3tao_CaUBmTLnHTfWEaw=XcR
zShY88R`o)GS)3d01<T6@hKdp%!LI*xGa;?U&WzE%3ONhA<2tb(wY4!To-6U$^UE(K
z>EDh|!LZ-n8~Djhp(_%VKNS&Wh$Qcrb+9s7!lKC#XcBgK9?4eN%8BCWB{<(wFfvez
z1pLn?fadw{@RlVkQCZ`J{M6X|Z_=?ern~O0_o1g^Q6t*A4Q}4<`3E#huqu+M5al>t
zZAY<XT6RG7p$QmBp~$EZW6%z7G_tZy=#L2Q&J(vWa69Sa9&Ys;S7Rnx->0&?lJMPo
zZKM1ryJmEBzGRyBUU)%~O_#)unbp%_3P)!2mJ}E;=Rpb%zrvnBG^&0<NF5cGRMRi+
zsK@FZ0JVTg)Cn?%;j?GZ5!t}QH?Yk<x)M$AHMVDr7d7UVc3Ya@@0EY1zWNKW>q@(3
zhD)!Xq3!mcs?G-B^#X!;tF|HQzms?ANtc7C=aOZh$;>R_9N%a7SEj>X?w|L6#~?pz
zV$Z>zM?2ORD(yu!JL$|vPmc@_kg%&Ja;v!nuQj4yU-_{I(ghb5Ih7Ohf*XV}bKLrx
zZ2er_Lp%rezsSg~BzZ+go{X)D*<gfX_l7KCsIc_si_dc54}f<)%-Es{T;?xy&1B+d
zK;lP=SSdS=S(Gllhj*KtE26BC3}>n6-TPBHMaKR4vWY2JtF&l5vG|LZ+mQ^2toD|B
zV9-ghhwzp6tJn;CNQ&Kw?zxP5rE&@P;fa<JNO%C;Ae!<-weR;cPqW@O3Op3lGc7;g
zFnls$pwuO@R+$kQxS$U$EJ9?3H)Iu5jmZuxe`wp2ei9LN*7B1+i#gZLG;i-bFFa(-
z2}<}zv;Rn=HE{e?X0FpkSL;7lo?&%7I$>9LVoIw+1)s=>XPk(y<<yNtJl3*06{T;i
z%|?-$Q#PS}FxOc7+K53-m6M|FM<oAau^P9iVhVd*dS8&e=VHR5_iol==J=`gG3aET
zxn}9YHAuN@@q<13{7Ynwh(x$TbeG9MbSqc%h@E~BF$H`aH&WZ0Z1@ls{!IFAMYMh^
z{Eg)x=aBSlO(Lc$yp99RyR7!GxHxrbaLbQIbx6t%4>D>=<z}$gv|loHg&p{HAgPi&
z0#l|tjcOW6o86^84GBcdDfYjm*R!^st@;%5vb%PkXyCsMlyooL3bMv&?v}>Sx=|8P
zp>Ht#z6m0Oe=_cFHy%zKa5I)>ZNLi6!E6$u>+xGA(w^)lMC&nkM$VgSYK?Y9g@*pb
zk3x3Zt|^u{7NSPx7R6w|J5mHr)=#--ac!(jYOgqTz=4AMv$s(-dC^Bt9sKd>&HxS_
z@jh>4dSDrO4G<gDg~rvl3qEl={S@<3S{AS{_w}u^hM@~i&$Bz)qokR?XO`KbF7jvk
zEzq#9!%OszqYp!R`|6)4{VIRVLf!JR#%_ck$@cDdNuS0aIrW5_7?+%8gPlXchr%{*
z6Yf6q_6oWsSyy=dD6ro;Y(HQ39w!izeWV$udbU5et0w$#48F5+%(~nAw@{9+{+U9m
z$ehUrudD&b1dp8}Qqoj>oO13lG1&u>O=3CWuTPKY{SvOgl?F)`*0oc@mG>F^2@fa$
z63pvfJqeV^vl7fVS7h3fA3~|ih>TzMA^pli%pV_Fy5TvKV9~D}<!(miA(m(zBXZOk
z-B1QD2}|GwJ3CLevh!8WS|{}dv4xHYXhLVZ=ujm)vw?q0880cfym#>#?R+hGmX{Uo
zDLJ{~G(CmExleH0Y}g7;oHQtzxj#pfA%egMZaViQcpkwE{IYy4Z?i}Y$C6;}AASYx
z3QB-Qx>fmq@T5l1+0o2!%y~9-F|1kUW8P1GUoMIv6YDhnieJ~t!oqYnqoC+Q<t87^
zjaIeH5yW6Q)1=1UQr2FpEq%V@C2Fc7lV&7Hoi>zv0n`$1m<y)%V@C`Tw8fr;-Z3J<
z2f4MbvCjY~!Xr)@$q$QFM)g@HsVDh#I(W_&_1Vb@1t=fRkRqo-Edi!tE8U);3o2d4
z9IGcD&4!WHuc6H>);9FOMVbl}h%l{GrfpZP-nS>0<I|Ys+Zvm68A1E3BT^hpq)FHk
z?RNCxTQ4CA0!`B}7&T1h?&Q`ktp{QmRLG~Ma9OH?Do}&bEh6+fkSt~~6xb^Gr<3Om
zlp(4cnL1cAmjr%j5u00<p!=4jS5)F9Ss>9}2D7qlwp1%a^~<m_lnP#nof$QX>ABTF
zieHS>x5vs|l?;;!HIwQ)bcAM<feP}k9HB@V<`{YRWA00gefW??W_9b%6LLlg&NY`W
zk7+70GY|l}*5i9JR5J7E4MvRmtb_BAgpD1MscN@aCj7{N{*YOQ{bLQu&$3yU4OVPr
zx<=wKH*>BpH!V=2vPa@8f-hxjWI1n)klt?y)V>1Iv~T)wpgt|xr>!KbLq`T@=XE5^
zL8s;B*p;`(q|55()y$wq`EA}RgUqzQRkSYS`FJu*e0?Cp8rO?(j<<e8m1rcU<lczo
z)qXIHv-+2^VqoxxMkKd;RNiG_BH&<%w$N$VTd*4^jbEL=`Q>H%h}w5To7L5^+sSJg
z-oh^OO-3nuzeja+2Rrb{wouTOI<G}wapin`B{Pp5K<XhYFP7%X&b>I7u~Tp)m}s!q
zwRoWU2FR(>?$%s>Lh;}g6q0y<VgoYvKaH|+ZLhy~!QM-}#!%}P+dftnnYkd$U5t}q
z-aG{tM85_Sy>uHEe~^m~$<LX@dXeUG@OWNuJ!PK?(KvW{8$C_})($pD!o_aICgGFk
z8j04o5!itR0fw}V^_6OJ{K1<=)->~3yuz%lz%2THt0K+~v-1AdpX;WT)9A=Rl1&mL
zlK*lbeEkQn1$T)+mR8=or&P3?YbJPH-p3Oy3Z*AfVk3|$pEz$&P}4Hva=H?^k7>p1
zsc>HEfq(k|*yJuf^K43L>JQ!H7Hvq;X>rC+Z^wPV_xM|h_VC0-m1m$gKx$UVEU>wA
z*nWk&WCSBHh)4mySvC}|P<+TlCyu}|l6h{cZRo$3Oo(SK(D`<#X@z$O3?1*YIn>oU
zuaBdt*LdC`MY>q<*SwVt$N5Pl+ho@4%JLiLIPC?a*YXR)s^s@gL5{t@iz_TrQxt!T
zc{N+nC)P!H|K`PRo%ynciV~NR!tb8Ijtva{PxNOB?)U~$RAuRs)-ab>fe~30qrtMw
z&%;9BctbAJswrz|+|N=2FK78vx3$m|HT(?FjHe)o(88-O>IoK<s4MvO;EK$k^vnKO
z>T1mG*EZNXJ+T)3C)|rT&*>GGVV75}+^V0?tC><qU*-=~;pez?Y|nDgXyn!>8b*!c
z19AC9u2NUxrZ`Z3UL;Ie{iw~<>x|))j*ctWZags+=9K>f`u&aI%f_b6@)Pq&@Dq_0
zi6>q-`DhX3?KTmFSNg@$?t<q8LS(AsyI0H~9+mY`etB4$M=L9LKV>U`mh|GkF1q`V
z8SQYK$agmO)G_a0i491iOcgp)nD^z<b=(^Bec8?vMD6JVE1FiSG2*Wz2jE1K-MU}P
z4rJBsRG`&6NL^d=;>7VHzzGzxyVci56eKvN*}h{D8{6HM2tEYhttx3nL_-a1(sIVI
zsk(k;z`_G6x{)7Wy>h(64396>6pYoe%@D788*zV+FRl;17h-)N4^<cU*ZPc5Q^~$r
z-!&mt)&<K9S1u<)Q6q4`W?;k)IN#>u<vobsw=B1L=f?4(idA~B#-S+pVq7Iuu$ru7
z!nOJaUfmcv&kl>qFC#NqrtA_Uef<WAcF{`M)zQ?z$f~Heg>;d9jI=t%H))9d-xwyo
z{W}VlwOWSUyQcZM0Zs3fxy$LLJ-3PZ-Hab64-utTPZ*ZElI7<F;M9;m)bR`d0TW6N
zC#~x)a~*@!Z44|i)&<6k1_zWg6CNreUs>WjseJf9+@t6EGg*qBhBmW)L%xpxy+KV-
zPf_ZwWcDOrS$wO2HB}Elbmtms&>e!t5z6tiZgF!BLYadPvl>!ycAJZ1r%~aViCoUB
zv`)u9bxw+V?bO$vN)Oqh#(GC_RyFlGW>lVEsGMZ2ryGQ#(xh(Yobzn`EvKv;38=ip
z^0%Mr2!c0T`rQ2jC#tUE&j;6PrX)T>-ibNiUIqk8;%x;gS6)A{NW0ClVN%|&Ha|~M
zaDP9rSG6dw>Lco}>9wX<t7Aa7jiFa=et3K9YBD?8FK*_$(@MPT-YR1!_kPr%WViUf
zkjB;Ha5{2O`}auNJp0bI)-{$@acaAN3~2ttq#SpruY$Gq)|x=<?6NmEyq$e{ty&~<
zf2WGPlZPc)rj32=C+o%TZ#me6yON74{JU^@q!F*Io4ULkh~Tr8J1s-hH85d8@ONO)
zyID?@@JwTa2SdQ>+2k--N#fgsm+iezaj_^<3JkJ(-H}B8F9A%Xv;SK1mX4dDwf*1y
zSHjmm+2;It6g$u^6|!{!x^L;#gyfw(2emTMZVI_LHQN2mCJZ{SI%mdZ2>+KO`v3Oh
zW3UPjH7=WE;?1l{QZPdPB%waXBvA5Y!+jzR>*B=9#$R53J1h&iybsb5#b#oU5TfgC
zPbHHl9v=PTWi*oius=Z`GNuWwe>GdkMQd;wTX)QS&U{GunwnT`aqpaQH(h?$b3uq;
zF&DXe5H!~-`*eGyoOofC%7){g2ls!u{J0A+%Xk3j)0gvo(_FGkY+#jkxjpBzG*YCe
zEZ1&v`0V3utD_RrUw}65-3yn}1K|VVB#gFdkZP+3@3e>7T$9O{Q!(HO=$Eixgf)6h
z52ZCV;6omQNX4}qf?`gjSX28pmDq^2s1%e596K0H;ld$&QMAxkv;c|#?|&J|4tuNC
zYK`&-K@75;ONH4_a8|jNInuTtPx0A%VN5n>c6H+mDD?C_G0~l(Pqr1(U8QtPYwHcH
zVK_6qb?AqlJJUiP%t3=xRd#oIkRn>s+xO}zvzWN%Sfi!pd088HE<j>Z>{F8EL8||4
zsr~b#I<icyqsXPYdq|9&nvbTU=ZHzfw1ooj>k&4*+4#V~Eo`#Z`^zIovX${h!k)J5
z<mecJi~=i0ZwD0So6F-y6eH+Qf~<_Dil+M1+iSf;fUKbm%x%5_A<j*cKSg85@^<!c
z($1{XHxDWO!8$sKRz%_;HDryICttmb*y>UB<kXOWEn1(6EZ!htPnC`*iopCt5Qm*R
zQ?G&4Ci@QW)Rl6#UA29A;vZwnPj~x!#Fg-6Q>Kn#-Yj3pyVsdKWcK&`Dh_BZc6ZR-
z$^VP9?~Z4)ZU0WIXzkuDY6PuORg~HiRFxP-?Gak78N}YJEv;2sZDOz3#NM@Q6D#&6
z#2!VpZ+buLzMtRy{GRuH|GTd1;}f}Zp64;X-|ul8K5rAA?ykou<I4tIPmF$0Hc+{6
zT^N_@AFWn_ymNxN6wPeEwAP1z3YzWe+sRh@!~UfWIqXm-%|>X;GRPU6G13q3vTGEl
z6m0ZbXHdpw7UsK_krM!4tTO|2NgY=dN$a>5@ahn6MseF`ni_J8*zuPuR6<Q=ceg}6
zgT1=PX_tWc&XuxY2qvQ(vVmhV+&oT}SR^bzMsCwPJhnOYP?QN{>0xIyap&{sTA-Fc
z$+@WI9--IAd9f{4@|tIAF#l>%UHUGEyD?#tl(haUlpS12w<It|08W0%(kv>u{m>0S
zc8#vP(j_TRq~;~A&LyGE4L;<0cynRB*~kl{BTH$b|As4PZ1yAk1jW2bYZ>?4dj=#J
z?#A^aP|RW@AAW?(&CKynB)Z_2xnm5eA&*o4W0}Rju<@Ygd0e8|7|#Gs^Q(tNmq4xk
z#(0=XDj?(7rMeo1pK>F>R#1z^L2PmvH8epHEp#n|uQKnO61*N30rfBOC>PHHwOW&g
zp>&NBfc0Lx^@DluE`fJX?4jH`DkHXbSfGXyJ4b4cE3mx(k(jDN4s%)ViFvptewI)3
zKi9_$)Al3eBs%99>aB0NWPLoa8GztS_8uU<-<l5NYAkYE7J3;~qc<b-3he%|YnR=&
zu<iVbdGEvUihc!-oZ+KNAwBrl<V5|A8NM}@{*=g}l$3BmYMhmlaPSz_)`gR;GwU~4
z$>;6)uzOFeTYPT0FhlOPYlo_8kedqPyO&hyau`L4-Em;VM^p!QxgMk!=HQ1?bM#*8
z<L_bUlu4AkF8PdmSw>Si(^>YF`SF1Sy2jZs);!hbs)Caqb}jjm0z}3#`a9(GHzP^A
z$U^p+xj=lJzO%f1^-u}|YHn7>qQ^wsaKo2}b9NBgC*sUtf*$8F9dBocR8<R)_k?7S
z`jX}=?cLw?t`LvAh=;#t5HoP<{EXUUc!AG1)&vm`Ox>5F%#R&s(Ld5huS*HW#-@$X
zh~hqz^NKAaTrV8E-5a~wf26-Fy#DtPHt=0V@px-aHEg=d4QkV@KFHd@+CzLCfzndM
zy}{Uc$Gu9otprMCk-eR*k$<b9NQ&f~rfxAjI<8t1(;DfJ1dApDFVMe&(mxR=|F^gP
zXnL1fB=;d^=V-|i22oD#a&lCKP%_WRYjFDUps=7^^HW`?wbDFiS){og)V4fT^P4O`
zI9cR4Xmha!Eq%>|bE`7L_skkG>zEyu6J@s7BogAc0C~^Y%HY>y&Nn`L!Jfzk%Ea<|
z2<?#h)`UGMnz~OGK|V7eBO&f&N&cFa2WTqvC5o#~Y&kC{CVjt`!7p*o!<Sb5k8c!O
zKUXx)U^2mw0(}5`P3IKFoOY!zdWifhMeS-Bg0^2UBuo@zaN5`+RKyUautM|7(52QT
z-;gJ^l^f-uC_-ak)6e(_*(I7jIEN_iYKEtN`)V~|^|%W^P$6S1qpfB+tH)Hfn?l8%
zsn6R^>}X(s-Wf<OR2RjiDDJkonPE$2|7>U+<p!W~#7p}w2$7`l@|e%)2nrgx0R&rg
z?fnFN=da;^Mrmpn3Zs>AN!+v`VLhLU-c2V;TalYM$QmOtZx+DiYs0<kK=%9x&Mpa=
z4Qde#AfFy42jd9qHD>#BIZ7>Xc~A2Xdi*4?)`gMtC~Ku?Jl2}pv`6lC`Q7g+dg#yo
zU0aB^VKniDoxu*zQRcQ<+lj)QD$5-ax(yZLL{jmfM(jh$<gBBDj!qKMvTBc?0KFf|
zwj#_dH#8%iain@6nj|j|?eX0U(~gu?Xs3G>uktBqVfDW8_LnxxB3g#`h%;AFj;f6x
zXD#8auu0?G$KV&T<i^P31pbWzNE$Syx>rYgFM#q+#@a5G3gqe4$a0t0mYK!0p15b{
z{s*o?u9SL(;2&K~I16I?LEv>Aw6xa5`D;wItU(b~O}YCWwh#M8bo6eCl##5&^N80V
zDKx*OA)U1DWWu$5kzpika*k<D+oRZ)axUx{#k-G|ddcQ%I#v|#YRdbO6>P@QZ;EYE
z;F{LKAbY0kg6;SKPAjR)f?lz$lUL-NbH!{RSPaxdye7bVDbL+q5x)8qiNkIh0zK;1
zr}9#KV^iAN<+m@dT|0V--c7ZwnL3)GSi$Hj8{iIHY4i85u?#b=m1PgyEh1oxen+ji
zi*X4lLy**8KFlT#sLSDSHE;1J@Z0?o42+z%q4>?xvw!W!VQm<)sP6+aO<DZnxmNjT
zcA+rQdsu~<S`C?f2dPZ=p{u|?Cl>?-!cFdN7LmH<!$7L`JelFlA4DtKC4HMEAvnpC
zxA@UFV{hIahD|&-iwM8EDaI_Ex`1+$M#xP5NR2f^zp~t!IQLJkJQeQ(3!V`z+p@;k
zSLqfB>xO6-n6lrZ<X0ut>)36XU&@O7gJ=C?8vkn#xv7FROBKKe<($Sa$Cb#|B8y)K
zhsqO4lQ*G0YDknYf-b7Vib*dSNxjar)#=+wzD%8pAT!i1Xm)w8BUJH>R!!g7)m7td
zOaO65sYrrU=&=jOVzyIEiTt!T#q<pd`=z}6&-+UF(##t>Sa)2vxyelrDe3Z7!MIPA
z8pU<7d1g6HYTN6(tjr$6z1HU4Mx@9;y1u^CVZ)MR(^M^ix2<87sTCp2p2@rHIb2nZ
zqY$l4apWD~>_kU!@B_b^=Z+OF5gz6)(L<tXD5SZC$D7O-Q>^)wh@A_o=n-56;4z!c
z4YNx|B9Up)LH3DsXQ_e42g<KlJ?pxAe5-!rGfqhY-y8)|ff=dO32kMufzB?8xpkcb
zSmSuC(H2?%RG)<Vj=<1I6FtAO^m^!T=Jn;+60KPVYDag^n%2`ePz#U5-+yRrAu|+e
zlSFs^)x(v7_`Q+gC!*_l_M%scPLDxec2ufbW1~arN;*1VJB{{{Gj{y1Zp7HbZhELQ
z2hxvKghG*Uago4sk8L|ud%!{!pLZ<Nvs8QR*swxYN#aQkD5ticy(~*XIX69GFPvCq
z(Rbb5ryqmLyBn5BBSU5##)+Zt<j1$>vIY=DNcX@{FLZGc(4x;}qv}uRXyjVoffe?D
zSt|E@wm)P$ggtf{Vasr2dOQL3^G6>Sjw!A&W9o(pDa+1lxjY4{WL`kB)DmE(Hr`P^
zi~y;mFD0MEw%0Fb^N;&K9Qy8V7BP|MS=bTG(4$QLltTSgnEM}}y}Tt2eE!JSZHil6
zuyWf|+Uh;NfA*KtXLNAwB>Z$*9idUkW5tWx#gDah4HTSw9_4}$zcp9eFd!1fszMEI
zj;3W*J;oQ5ZZ+!NbzNv|Xq`M`v{p>jlu(`e3CJ}F#m^$tO5(_{kQ#Wy{3d^^O+ZYP
zneo;V#Z}TJ?w<hFlR)L3I!_&SQl6gxqn5+(b0uj`svsMmqf{1!Zu+Z#b3~6Guvx3s
z9*7kgOY=I00SNLRikD2p0aXo!;wrE%WAc6F8HXZA`nEk%7*HD>V;G~ryVNnv(nMAQ
zqk7Oo-bw~_C@kRisAw{Iz+FV{ARUP7vOw10m<PinTcX4sCD0*j8nUl3LP>k%`Q5|w
z<f@~B1;{5ZN`I3rcG)w3E@xG1OYsmbBH8N|@UBOcWbTjcqwt}GFSGh2=doOBVa0?9
zAG)+UkQ_gm%<hnwc%cB8VoB0-FK?v!^vzFzX}kJwj+=Z3CjA2|R8Q{Ds0e&~tM?ON
zp-nO&8LhLq_O`ij0RfQ8*4TM<g8<PUxhp#3OYlUNJg1V7Ca-j4j*~f_i!N%!+hX>#
z-!&fe;Pc-WU2}RJhEeIb>#LMx_0T~dqj+Wh>$(pGL#d?7U6~~O=j*50O`^Vw`vhHh
zz!%o6-KuVGr+&rjbIA=&g$UVVv|?^*NZ;vQO;`-I*k{|O{;i<W(_2ep!zrb_UR@it
zm-;NEoQSzArVZf!4w9(uqAIPUiJ8@NEJnu^fn`QkxZelt--ER<J&Rl^ar*3pz8yI-
zJldgr&6q5hhDa#0<w~hE;`<zqK+|Y`cYl%-SesGdT@z0H+&lVAjJQ=#aNKt^QD?iV
z*HMCdJ*?buPUXNo>ab?;1s^yjh3e*Q*=cn>?&nK&vw0iga)Sc;%RARrzEde>45VO=
z6U%l!sX%RM&!iWB7|Shmrgl1(y<hijChV$YSVNCP<x)P*%p1P2G$rUrM-+P{Q(5%h
z!#OB6%G#H2l0M8&vH#o;o!e(RNZG3hO2+qStl1a2-=p-FBTlJwAaDHi(<h&ElBXC^
z12E(Gx>UZd;ECTTz52`ZL74xI8YRyqL$-Ku*R3EH_iJ>Bs5&h6ArD^kW13%!4OVE|
zw9&5HY)wo|bGGX4rrTc`c`QO$H77Y{8(>kGXqhnYzpV3OP@<{xt@?TnGyjENY&?Qg
zIKQuqvN5=_Y3N`XUj+4j7}hNizEZHN3f06GtZqrpO1<4U+W86CneJWCitSH#YD(o6
zuBWC3hupEA9rE%!oQ?CTeDenb^B=5&?B2Ri2(LZ41sz*5fX3Mo_gnGtE1tL~!@`^T
zZEX^rPi29;-+El<Q|}Ju(p;CeK%dtQX7My7x#sU+wgc0RmSW9)NEy%v2Xr$ZmBLkC
zT__~PU>eIYN8j!qjdRXDi*}|+X(K*#VcnN!>)$LMd{9*VD9$#<;pOqIfFh{6gl<EI
zImeZw!_F&T8q(IXvvbq4gA=2!FXRTLM|Rwj(eDg<a;20s8}BOr8Q1-~B6_V!@d2kU
zJ_M>~%Cqyg_T-zOG@UarmOM}Z$07>qdX?J>P>pbewa`In-3`?f_0Y*(U^v*R8=H9{
zjvlq-5xiGp8kc14AG~-gypY{&269lAO19!8Jyq<~D`XZ~RJkIYR^6B#Ey~|FJLx#;
z9kj>pcH*6%H72f(KxXHFVnCrhUMhDS@0$&DZ>FS#C48yk?#xQLiJ8%oL04EN%RIQ4
zEP!sO^77fQDM(Pkx&z-en8rjrJ2UmvW4PjoSbm4EN%bJq7z3tb1Xm$F!@^c6JId)*
zY7}Ay_K_XoMxLjg3)F;6p=kXjGcBvHgR<4;!60(74+6bS5jM*!lr^DWDD^MB9nfQ=
zdi9byrY4cAF|<Klhl<AEaxWlm#;lQT{`QZuFQn2(kHhP=HI-b@w`_$5N?h0Pv=MWN
z<Pd$E7H!cECiMmuhlz`m=;r5V-Z6PmDpd51aQxql8va%wkKY=HE#?!w*Py4zFBKrD
zx_B-_6I@Z``N^eW$n}d|=Y*22dzS!66q?E+eXbq+KR@CxnS(z8Q2$KD0t4?J6D6Ur
zo>qChNA_b+U2Un_;@{pVW<Z^Nl%X8+j)y<UN7t$O;ojM64~q<5bY3~~;k+ZB!4gz%
zNvfSyU0ye6NNotJtrM{sU0CeT?S7|Op7shP8Z>d^QKEX4vXr+y`-nz(sV0+Ktdz-m
z7vq3DyP73PbIhjMYqkVgp?g0k5`C;AcF$|5>4hADW5r{U<Elf(2wSc)WMyTld`p{s
z${;fSy()yjZ9O^q9sS^2jrXHsTGt<fw2?+-!VJbQ?UwUp-iPiXR7{>2^$g~SSrai9
z*1f9O(oW73dBB#q?iuG^tW~@m({%?db^?i*XZY>K6A@*s&Cm*5uEY~ZLlyur&WQ-(
zpzGe9lVr-ncku~5Qp7J7GFY7J*J5SdF;No~Dq>ow|M#Qu`$-|v&_nb(7wquB=oQaI
z4om0FeDe;Xfp>PA&jo=B<z08%m?oSjSIrtru^?yRfLhG!l1%UM!pB5vwf$Zn#BdbH
z;*2J~?l&Xr(xyQYnH82KMLYttwrHGW-0P;t5Pvkvwq?zpCV-5}P9Ws4Wr=d5L$moL
zDBB6`&+rl7q=T3#l*lwrlCY?UnUV9#)J}TyBBo1MYw!kBWz)C>Jtf~d`JBW8wPoo>
zqgW2$?B1}F;vWB;zr7;ly=VFIQCfl5-uQV)>}CoJ{HSZHs2SWY_0_g$hb5x<ZM0J8
z{_I-Cm@8=}aKJy}oJUydT4jCxe3|~!<)T_O=!1UQFI9-JD+7u_P=;R=#bO!EiYCdg
zu0lWGqV*1MD55@KS@gVXNpmD^+@(2dF;6gd6T7R`h#&nmkT7rxO!Ogi{Jw!BIk7h#
zj+nmdTA}5E?3}X~7$@G8&g8s^!A_Y4G}RfvI5Rh}K}mNcw^PRMugR4+?B+SIYVy^)
zYUriIMQtPEFsyU5@cME?I@|a`_ADKA{dD3YE0T0D2(JbH#<G@LMJ~cNm{Ts}*gPg;
zOkEy&V2m&1?u!3<ATltrt4q_*Z&Uu%UDX-6YXFI6oz3n3n5Hq>szmxa*I)FFO}`18
z+~O3_IAl&-fm3juSGVfT>H{Tu8Z*cb_ORFTGVNvaNW^aR3iL(j=C3Cu#8wE@q%s>s
zP}UGSK4Y>Djg%Xg8|oA^63PS+Zu~lhT;6G$2|_B-dD%I<rkyEYkiOc<V$l^Y3r7RE
z!RM=<7Vzi&dRZ35@#J|tJIKsVGDi{f5T|)N@O5p|_)*IE%fjC0s)R|JYq|k*9s2VY
z?)HAEkDqM(HPHHp2-M)1nh!s1Nlio0u9ZP4D+)qXndZor@=kiFfIb(h=M=&%LJ}ZZ
z{Dx41k$f5PMg?FcabdFHG@$je06JG0`Yd)}F#mlnj2m&O{bll=#4}~q3D-6zT`>*J
zt0z#wm7Q8;w(5r~(}RwMV0F=DyO|5}1BT@{iX?|lJNY;YY01JUC7yQ?#^obDL1xUS
z2NbEnlKzn~=};a`ZOiL<a8#uF=rg{_B^$uup(NXmrte?kJKSxW1nHHROeKM_dOOL2
zB9YBxHmkS0X1fvZnD886!O43y%bX$Cgh%#uN^k9;tn`nU3}p1$7Iq%bFa;12CgUqF
z2QOZG1GdkR;!Q_mO5E1f*P#i@Dh>k_wUg@%_!dJ~)CB!&a744#-sH;V!Ns6!_9S)p
ztK?>YDr>7HHs5*M>_<Ulp$CN(<f<6uxgNcPN8O1&Q})3NJ-pY>l@(r3UhgWuem^yk
z1tHJMErG=56;aKVjO#w+Ax}WZs8$L6h*l7=lk8;(6Jc{`ISw!&5J~YaF)a0oC~YpO
zd<A-YIS#4u`zGxz=VRv5^et!sWm#okVJ$2^?#N_dwBBCZ)(Xpe=wbY95*0!L&j}HR
zNzQ8BT~0Jc*RK0`E*P0-l>appHdt>Gv|O=i^P*aarmoIo!z+0TFgUbSVyE&o(JeP{
zP3#WS=+gCWHIMQcn{&B+8yiuqMNUuxUE3!L%F&OsQ!(9!AfeIYyB#xvp&#21Ii$)`
z$47i;{=rQDC;#$aoKb;zCUo*Bghxa?bMvuxPT0*Za95fYanSUA0tqdRm05EPhmTH_
z;iKGne5#V`did3U`2upeAbDs18j}Uv?rfHZjJ<RC^AX9P0Phu}9H}>cIi}IkPrzL*
zi(Z=&<eJ^PF^N_BppS;f`*_^~qg4OW!Zkq=@WA!?ZpSq^4Nwd=O0zFxo*o=~rQVOY
z@Nj7zIOEl$ab19Tqevm+B{t>8OD>*;I0o|8)!}0{*}Gz}y=%*$DE9}U5*XRyeZvFg
z&Ig6nRS^@=tuBI~?+`{}zflH++n4%0piI_wA~H~YE{_#yMEri|j+c2y2}5<nitE<r
zTiq2`Y$n97@9QI(k=Eot0cGfV>Qa%`@Qd$m%ytBc6|hkEH)EkrnnH$SPVTo}psVW<
z_r!ch2Z8e4(y%|A=~onX#!AUg047l`*CmJ5OC<7P4BUwDgZPp{F)J7xcNE09c-mBg
zq>Q{P=e2<&cmbmKROqtIw#O7-+_ehCGfcLHqema;pXR>;$&cu}4}{g7s$l&Q%#d7(
zqvV%_g#(n$B)854Yv%@;O2<wgCfhJoQs2FeYWE>c#9N+it&G8}qw&uHVG~vv>0~x!
z-&w<%Ls`q0@u<&FfW+~~p8)uyOb%aShoZ*j8jHi7_e*w%gp#kZo`*G+FHr@2^^P*;
z7CC`#sAi0(_p+p=`W7bV6RNo`_JZ(P*Hmx_eZZ|n?A0r$5t-1EW7!4Dq&lLdjoGgm
zI93=v_?wDSKusE=)PnqBj?ycua`iR=m1n!Ks25&{?=_z9zm&N2Tzd>7fjxt)x=eiO
zHRy9CSV|eVb9e3zF>ALoprj<}GW%u4L2+SvMY|l35E0Q3`4bRyzi@Pi-Fe!Ra}@1*
zhgWNKW><vXoq=0RgsZE24c|E#(6T1(>+5II?DB!rs`%a+d*`MFvSUJ}UzXveaZgVW
zu7{=C{+$@3xzSecpfcQpu<q^Cex+Mga4oDoz&0V!qun$3ctZb8ZOqUXIqw`$`pJv}
z6;qKHv-hnojraJ0>SBA5#v_S{0PV>)bwi^5HG93JgC%5s7~=qZhs0K_Z?O}isc~gq
zr~tlKkI63Aurod|b1jzA-%Q^QkRMgyDu8kE9{Z)p4y2FP&h1yI4wdBjMTN~nY;xcd
zglxAXDAZaRbcgrw%^m(6&`_(QfC3!(BhI%`9ep*UHCiteM*|+a*vv2`%+_uu7rbF9
z-1uKyQ-ZqS24dVSYY^|60#qry<G1v1?-x5Mym|l*`j&qLxBqO|c}ZhN{QISO;9rXA
z^({`lDx^M8E_v0)Af(i=VMB*R5n)OaK`T{Cvzl&EYRODXl5dlJVk3Mzkd?;;%Fm}g
zp*&wtd555!U5taG-Ai5N;w!r$5frzt(Q{lBap~Dj97}(O+j-H@i(UVSAkv|P&n@qW
zg1LsXQ4*;N(s$E>4z&9e@{03a84rJRP)fP*C+>1Km+n_mQk7An=3%?ps(MStIGBT|
z@*RE#+SScJlIH(9hq7vDiOkJLkj93?IDKyrm?tgW)*F=a4a{nm`t`0fT|H!+#r39i
z7Ch|Y4Dwcg@eCxCuqVpeo>pxM)G!%AnIVtu{S&f&>%0}$voan!yT^3=q@G+0(@_Pr
z7GBOpweP^Zl|4m~NCE@KxjP4<a!)`hC#|557NsucxrJJ(oJ|jkUDe%E>}tBrKd0VI
zd4EVCX}RGifFp{9^E*{pZCR_>SHFqfyhU`VR`X6ppcdB3eAUHr_<?0wah88^qISP3
z7#{V2-hpX?%oiN^Ktq)f&W*0TiKn29GowUo7$?Z6yaFGBw|8>9MZ9WVyzL`*1jUe*
zO83R`8QsnEVWQ_xrt&!IA)}6#Ja+}1cpYs%tHR-Ap`wmv;r8K=A4{w-;U~IbIV;Vg
ztLNS<5@qnu@iD)Vu9)7l6FvA+$~~%JtmKlChpGkNcBOiBn`eVGoUDjBS(u4jIy>W!
zFzLU1+dw_r4^vo^Za9)hBr(wf^R}Ls0`_gSS5|KvA;obrTmawcrlnVeevnBc15OWi
zbPxsq|NE*YJT(6C@6h<wLHzWMrbQ@ws>}<odVAXfc6qR%(|X5&HE;(upFYsd8wYJ9
zjPh07%C;8#Ty~-Ud~Z1Q%90mg26<&nKi9CncKCD7gvEWzCIi;lWzZ=<v(=o-CN^fu
za(jBzYRY|lg5YhP;F_obzk>2g_ZhQ0!?u0OxbJvnD7gimpCo=pEx|K&oT}7^U7VYF
z^xLk`*Rt7_!TX3CClKZ8uE$!9e?Qh*mBJs&EHkFI9;B$+g%fd|>$qy&jO?Xk++T2@
z&ZaVZsxsuHGDb#UH!z613!HUQKD2!xNoOzdv;vmmntN=l#52}f2_N*7eF3UnW{u|t
z@1sM)h0L`KRnx5L3vNw}+}WD)qxODSj|}Wyk?8_EQFLGDk*{Eq9C8BrbW6HU>7Dj7
zQtyk*)<iSY-deb=RZ&T<P{bQ!EH|vDr}TUXs_c?nRh(&EQ&#9gFGhYKX4?mt95#Ve
z7fC5uf0$6yt~$68oZ&0_W0XadrLmpN#HnYWL}R304gJ<4s|scb@&3MZgp2?`VajcJ
z_rk(anHtO+3!`JSro*?q2Qab4DAk@+W?Nt-e)G?<>bF0E6{*n&fMyo4KPuI0Cy&^R
zHPnia3nwr&-HvJbh3ti{pNs<I1l?_J$CMbVL6kS@h@}lI7hQ0%;%39@&4UfBj=OZ6
zARj&4Bel0$x)y?$thJhk?2r4yZ!&mCuPmhYSlQ$@jf*F4d0(uLCP>i7v6i^BRe_~R
zw`y?e=RQ3;W}}(|^V|H1b^d2ek6v7K(r#?W`Y-JqYQC}+Id$aM)DjoHvTsEf#{6D-
z^DwhQnc!Ahb^&S_H08;u%N`Lq{2fp)^|>J&M*FE4^GfFBLyWtocI<FF<debnK4rRo
zAx24c^CUdV8m$>l09>&PdkmiQHs0s5C$c{<x1{agdNiIQb>qjt{BujTF2Cf<_lK}o
z_9xQD$Oz>;8(ME^(c||eh3>|xOO-V(2R-`tSb|ZT(?Y?Lq{_&!Kqj;6`d@b43GOdt
ztNp@<OwTi>wbG8S)y;KWiJF#_G_3A8?H@eyr!Y{SNe#j-RTA#4RpNN;uHE#d)MV72
zP5~}WE8C~%nH*J;QHE&)1EorjSn+TwVRU_XIge~)JMN}alKtRH55C3a&g^;Fk_22u
zj7|_9B@$59B32CRW;tL<JN}o&{reTQ<PhqpE?OQf4T+t}H{jY}gS91qJ*$b+LDfrj
zPI5Wn+MD7G6#(lJbHZoF7h=$g>9C|7aG<tO{LtH>uyHP)Vla)NT8D;ma{<uUXL6qR
zZgT^QLSAs?uMEBHO&_#&3croB^HQC-E>TOv>YyaK#cWsiwcoHoc^9(TRWp)LOGkRV
z(Yynk`C(AX=U;y)6XdNghpawxJ#R)e=F7^(jZ&@)bUw6VNNr@ELWMQ!{zg5a0)q-i
zSD#ZOf>8U(bj<w+skEXys#qYOZ@%^RLHVhD*kMUQl2gI!CEsZpS>S^M+xb+1{iVsG
zn<3WLR(J4Bt&t!Z08E?lXV3aKTj}3~wc<_8Ir`K;fC!Ce&w!i{b}gVh22KGlo|oKM
z4^E`*2Nwo&kk#(mS?PoEpq`8KP9}Q2epug3N25Mw92alYy0RvKaXVxPOZRS@3Ykbq
z&?&YZbDff2g5Nf;$qG5+uUTU4vOXpxE_!QObyfg`k9?-qk6oJmWRVoey7%bwd767j
zIA3kp=kY|;KDOW|phx%=-=3#{f6<<J*Cc+&>pC55^JCfzs6~-xNLE@Fo~lIjy^y;z
zyhmDgjR-M3PX3V6)vU5rQNAsU0AIP#>E0V&FRHQe3&zR=W=~np$|xWU@l7ASbzfQ<
z18fCFFSyOScm}r!5}Pxw*AuQqztGLwIeN5|QxGUWNb?PK<`?1Bs@a5Ij+&s3(;wv@
zKy>H=`D{frl>FuAeU@jV8U%a9Z@n6W(RnLL%rsREs8%qX^#b+?;+Y$JpVmRs>h+Ph
zF;+gUr{7GNgBPSP^CT7%VyGa3s+3`J0sL)|*G#Cl^MKJa=Ftk0JqFt|+(M742G{O*
zKLyv=5r>mBr~Q?7fqVDGPe8pVY(xt;Nd7enIsagTfY@z#-(LUTK)pdf5ZU2PK#rP&
zAx&NE1A}<%zD1$wx&Gx4{~xY6C1jA?7;V2%TcQ1tj%EVG`jy`|vQKhdTC(P)Duy~q
z8C^9qaI)$VZ2|wxv&&)M387-@?!4FyZQ*L(teZeFW7m|koi3Vjjv{9`CDjFy3qCJL
z#IsvH`bSN{WiS#~h-G&Bfp=Z8Mweh$zT+U`+a0<M-@IA&{Nw3MR(-sZG%I3Fw`jME
zY5?NRGCQ}p%gAm))2mDv>nqLxXVgRuU+_O|84tg;rmE4Gf9;=wMcG^KXl>}Vr%H_@
zv4K=d&kp=+=cB|@eQ%iP3C&kqv5_y74{6RAY@a&cszrU?VU4GZCT4B>sIh`$*0t;b
zk`o##y;<21T&+9=+kREZ>bmmX%!FmmMkmQRHg$wI<_KkXK$#a)=IceIvZ|hgvz&&4
zHk~Swn|VlmH-)Ts<uvvCD|W{a#C1)mtvNknS^Xi~XzVv6uwqMy$8qOYjoY3G`kPoY
zwM#$+L#Q>6S^9XKWnSWp2T!wqa4NH}Zhzo8)zg=iyhRC7!e@C$C!cb8#BxnS3yK!8
zqK<yMHY7;&2u!IsET;?xl<;UWfF-Vtyv)et^KWPz=v_H>A?&)+M$iQ+^6#Ij3M;cq
z<dKpyfpy2axDFDxi=DA96d3^k1OSKYe3M5)7YdsbP%hMQy~gBPNJ4@#>AjL1UZyfw
zSFyhP&A8u)%dcLJh<hqqp1T!Q)?qFjq7r;X^pIwP$>bJYq!}~yAB=vRVD^|9GuE(B
zmMWlUwofN7umK@4j<bVwjDc?JVeeMlS&k|!Bp&8|16r33wXsShgm^hn4!RhgkA<3n
zf$0|ZCjy5}eS?ke3nf8Km+kT2YEl7(iN>#Vg|v;*3iu}~?&*`{oZ{n>J{l%BEHr{j
zKl0C6iG$9N`pm}t^rDZ^8Y*9UjNQ5&Rb><Pwy+nxO)@zp8clG1-Ggb_uNs$hGZ#Us
z(hF~0+=NVNy~>9yK@!S2>wv_l^oB>aFWh}8pHf`sWWQ;quYdX~vt-yJMMEsI9Bx)8
zWrnVZ2<po6d%a%zory>2-w2Q^nxJQ+>R9gw+?u9+wZjeCP`uE>dV97;(lb0zg1V7P
zNAUmG%_yn-b6fx2-N+iE&%g9%!5Gw>k@p}tYC)MWyn2zY@8X1sUE_!RSW0GfLvx)s
zD3^JA`mPHX68aP1we6Aig90qg7)-I%Y%!v3U{YogeAlZEwb!ebtgh}OFyAw|N9=t%
z&^yvP)d#N?zASi{^0t|bribr>P-Llt`K}*2%$S8B29DB$*ZIr>33Gz!6}270?uMlP
z<{rJ~pcwt{-xBY9)h3|*RXy^SJ26K`PRkbxD`eNcksV6PI78mTVyaK;$VqdNI~RNB
z-tvM+A%{yYq-A6E%-84@Gv_YUMqLuqrIiFHKBbGo$%`d_JoUQ4l-H$}e8xGya)KY`
z8SY*z#9c93vw|sd_l<WKn;Y$Fek<fyw%Lmp_uL-0a+Y9(n%9{Z{sf4ClEM?%2_FTZ
zQlPj*Lsq!!94a`ti}G#x%y&jGx+uJYT*MS9G%C$AzP7}8zLj)wrm#;p$;>CPR^0t3
z;^e_>1}veHDUo9~_9c9Tq}M5vQ8^*${n<?QwCMdP+;CkY&@g+`X1MgR`PHw1jtv4L
z=B39Bc$tK6;U~V<A;W^JLwc{rR9hL72<<MD-xj74rJcl+KbkgCzYrA9h_3g!@X%y^
z<MsFpV4wG)f~Mpc&T-tLme&btz+Lfp{rN7z&EAUDws!latCdqW5p#to5q+<~0v3~P
z;&=+c!db}Twcx+9?|COla9WjqXF`6MD>-Y91!GV6w%;-8p~F6cNOQFJS|)$@mo7>w
zIg;y*4;)0iS<P$e8Jz{y6u&brcD#!`T2<!0DC@}rBHG}2V)>P0s<M0oc5B@#l2=+S
zIR6WB_dfu?1`Y(5#Vf&s$DElk$GOwr(Pf0Rj*v|q3dR8eYGmctsJ>UW&1Q7$Q)we-
z^!G^hSNU2&6onSwanZ2~BBw57;&i&?{vfy;VeW<xs@}HMNN;MC6rbl5<4rA^EZ^E@
zXT4F&7o)5CqP2hhCqTxRLNhjXd(L<I<s%(rLdnFEgO!!*&D~_Vf#-mOHOO-Z9TIVI
zs5hGvN^@Uhv|ZE~&y839;>Hc-|MqghWj;6pC0NFZ;UlNA=d&T?uI`+tWwmzSKF~Pn
ze(b6qHPo~a^iL|N8DrcNH;Ymc51fh<^^$(cUFy<SG)Rrvo|SmId=hUs+Z+I7pj(n$
zuVEQ~RM)1mnWnsSs35;L$Gdr8_7p5bWZ-kfT<EfXWNhGEf;HDh2N_vv7gAZXPj2BD
zcyJd9Q9Zep%_AE<(|B)RlW$!-dxk#_??_T>J9;7MX<1bxRf)b)B>FC%{L;UxW+UD>
zYPd`nDp<`ErDnPfFtGR?R|miF`8aI-6JVbAN(_mnk3u3{Yvgz3jErj<o`)~p-ypSp
zcDr8H)Pr~6#{mPi#Ir6(9y4=$Ny%CkW;>Gk+iG~7cu=S@Js<t>JK~6!dH*;aBxU(1
zj?}SG%9<hnv1;HLTx@4OB<va3vFnM$FRj4;V&$z~ZeG54ep}0o>jchDsNsnW9DJec
zzMOCKw32HeX9)9FyVNWHX`A}+iFi%;wS9bQ%77arX6+$NpfR3td7s`RSpFSXUU5Me
zPUxh3;QByHPXd4+#egC7(`-beD^+r9N@IJZb?2}yqK=IB5#WljJf6HiY)fAP%}r0A
z;xc8c60`RG4gpBXHNPoORXmE;y`p6$i~aPGdJOYOyPg*5vKCdi?!S0_fN8|N;Y!VV
z8J1+2`jy_sx#4R|YZcFY8^M8H3#$x_B8+IkSERM2`|`upt3$ybGn~Dhm8}zBX_bAh
zON=mwCqQWxj5pjF-!G^TEmoudO$k6vF)WC#OI1{&rgP+VvZanaqpL^)iP%sgmX|1H
zr!s^DJ*pLkX5$G=Jw>@#nWw(aB4(WC?N^?b6?Xdl_~25e2De`*$A)nw!Y_5V7*0CR
z?8z@z(;TF8{}4@b<rLss@ZFzn<BKidRJT{M$+Be}z191=+dTiU6F+4_8LT<f1Y0pt
zlN(uY+#$DmvZes`9Vl>Koz~P=vfMt2tOQeV=QV0wePASdG1%tX5(c3lemEd;H_v&d
zuV6wT5oF|gTbSg*br@Z@K(~nf0n>h4jlK|&ng=hw$E!#4H<uW>f8k}BEdbyA91y5l
zcZ+;(5nTQ0;xu+uZ%dT<I>zA+n7>JQK=_YU&%X;O@TJe6tIi=~+W69E)!)@IAr^=C
zjr{UyoHZ~-65cW!C}%{yx>n^3Zxqp~W}j5(Lx1AfNy&%pFmf0&oC%3e<ro&-wJtwT
zV4{pa?`jF{@~2X@WEyrFNc=o9rV|`|;0BeEpF4LIJ+QsLqPk3#_OTab2#v+y_BO4o
zYPAfAJ+&8?CTj)11$dF5HgUAMs6sCqsFs94cUw-^?c&qMDSIZpFQsXCvX-k%T9;R(
zmdlxXkO6JTwo4CAVlHPuJXr@)Z~i?m6a1Bz{bgEKV09_%{4%_-`iq;DE}<-=-<zI<
zdU*+fddG#OB2M3ejLO^kgR<%qD&q-RA+69GcNRZ;l)!)jeU!w6H>MbiGs|X<+IM*o
zZFY&D?LAcjYih$JA-r7?FKOBiMJnqG^m^eQDaD1^-)Xc;y<;*D0*X?FKW?2$O~+}E
zV4<#?nyueiFHMQU{u&Y!D7q?J|I(`W4!#Q2%aw@iaCfSG+x;r>2udquKvD^ZjeY9&
zra>>2iaCH=b?NfC{$E3Mf90|8&p4+Wmu5|>l<jKAAxcVAy{i%1-~e^iCn6G5@?x!N
zQBMdQ6#IAdv8(w7t7RM4GxK8w+O*t1zZJ^)9(}sA*9mDb38Rtq#+ezNzt=DuHd-z9
zYt^u4;{ASSaO-ew_TGeLM){D8G(0;vHukPRgsO$P{abXc^p$KuV1-iS@t{{6DSBB*
zM6pC)PhmY|{bQ3%8r^-8x!)}ZQa=}ED3B#H?NG~yM!^+SPZYw}!p-NFuJ*3spoUxS
zS=mE%?ng&wJVG``k^QHQlc51X3a?=Dx@DK@sZF4cLs4#4E(4u;1b^*b&(=!$tn@T4
zEKF5)6dgkwoJ%z>MZ_5df=9M5Bi?69kc3pb0G*q)NyBQ<G1MB&+eYq@EskAo`~Kk^
z)l7tz`kv1=8@XDzPl7#Qe9}pb4iWCYr>2t!15_p)Q<zhWmPBlL1U$-i)@0OI>}HDq
zYvUlxLka}m3E+fm$)olql*eC)z$DsVWsG(l)h|>YNi$oQPg|qr!mZMBG6E7z!OBMW
z+ZSxS(7u1Yf`wQ(dG4_l@z>AXLOjgI1%Z32bd06@O*4CV<DWofCV`h9Ge#>t8kl}4
zRTjUe^KAaUL-cX<5aH`li8NgyrCDVqO|0jq8`htxLw9nG1NgtVFZYUKi;&g%PI9SZ
zaAq#(vbW5W9c(7!El8NbBZh6)*6sso6WRDgrXfLT-fGS7xQdD&{klI$CcBn;dVT^J
z5$_14axP>_En%UI8VV4{*NaiJ26JmJh|CWcudaIS`Of`wPx}@X3VQPvrH4P33|p7q
zIq_Yj7}4k%S}#x`f^4%;Gh`lz8Y+KL=FiVCWy;C2k!OJDF)O^0a14puUG-(~)FOvx
z<U4yaI&=u+l?a+Qq}Rw+EV|8Hm0Qg^!bb>4n%=a9xwV=~xz1!h0r`1JK^dat`4&IM
zB|k8kP`q4q`%~CV_yTuJxhLPLuuLtgH=A`@&o;7Q8YE)DblKJQdlrFm$qdlmv}9;E
z5;}wgW&Upd=Yh!-;8KqQl0LY}24bv$hXPC!s@wsEq?(CWT~?+hi(FFCB>&A-Hz@#q
zQvs}L!q-l1Mo(&sbrh@AN1i=iZ#dioII<lPI8=0MV0p)$M3rhzq8zJDL8|0ht&OCE
zbERP^juYm9om#7U|BM=?H`_l%u~^n)OPd3-krB`E`}Hkk;cf#Qs93-1O?UR<C<Pml
zx)iL9)=N~0gpA{Mb+;Q?^t;?5VNdU<Y3ima2#|-{m^_$c!E-Q3LSg1u{m+5qr>}a(
z{`Zw0Vmbv)2kcu2`j9+bl~#NO&dn+sXe=mVmAp1tt-62Y;%<{M=Ob)wUS(6tNZ(I@
z=d6*h!BrOGFdg&QJ2UmmAzaPfjp^7vhJFl>fQ_s8!`I9Cj$S|!j#OdXO779RImSw<
zxjC&$=(u*t*;HZI+%a6BedpQnVvF=uA-S3{zkuhPi{=?_m{reX1IVYlbYj>Wy{b_s
zS=-1kWU=@q)T!u~)bfcI$QL2-EmFh?EX~GDm~oH7QeV-7URy(5qeJzV+LGgMYD+`T
z!2cL8b6)07A|KH|ABUFnjt4>QG92Yp89igqR?Ka(gmi=&cM!X2M_m@Tbvvr65alYj
zqQ=EqqdM@!QSO0uRareeCB)XkJH?-XAs)MBb$wD;dxa>RNa~&Ef!}Ki3JVtB>)ou#
z3oXh1ou#v>)nHUj<62Ca{BmEDlv?{muYz{_zl9;c-_i|QOjcXM$$bXMXx~1yALKv_
zqM~=m^&h9Zv_jZ*%v{Ct_cw3b1Q*};xnYb^U`}c;)})R!fTJphs5X$VP5M|146ZQe
zrEUEWNcOM(+plL@hQ@{Yf*-HhI6c;$K^o2uLl@`t1HJ*Su#kl$d$YZh$<(sk(vGMK
zt`7-wTmj!c+NXG6$^4Dm_NB3p3|FrCh=`%F!zZ<^?l#>o%+jw1-sAv*oEN951pD7<
zPBwX{wQY9B>Z;_%EfoSLm)6M}Q&>aXLUwiqLRM-qB>$+h#`oU!G#&NO8c}b3P-mbQ
zxp6eWNG3@c9dSw)iRO~(Ny$Aa6>x}K`;i)bAxSF`+8l`x6YfIEsPg$97l6!0>P&i6
z$)#&2Dr}ZQe8*FX6}Ce=DIP<7Gry-}N-P;(v>kf%-hbe*QG>BR{V{zqSWcj-l@62a
zajJ@5KyXPZ7u#MUD=6)xf@kci=ZL(%Hl=-a%6+YG`4y_+vfMCke7~8I&u^9a)xiB3
zn$&AIHJ)}G1w}q<^)Cx0w}QMQh&ui6I#aEFg$!%@azJn6HHWXmfml7PGIIcF=T88|
zOU2GWfm<>qN7DUOnd_zrsVA1zd)l4z9nsN0#3TSDZ<S91jL@U>qB&7vYi(`pb+wIs
zI0?v&lcsBDi_kGg^^GK=LO*<yPsVc88*zV+Xvo<khVNqTEM*yev+xNFTYx^-4`)5R
z1l_pU&C~?GXWfvxe@c{JB!m$PP}fYPIDk6O2KXz%TT}XQuJ4G=y+peBs0{uN_z-I7
zZFCDM3ktM?@*ZhIez&$uuJ89@SX!ds@k2vo?r8P51ljyN3B83CjDI-Jc>kJhIQT#(
zTV*_vOG1s28s+Fg_~ZTTDxoLQw%t5ld+_0lhi%A3D`_y7cF1^mlafU2F`(K~|4K0O
zsY}FLPv%9wZI5LM>1(qu@QlVkWv_%F6kJF+Yoy%c3U~dGJZ9R<4`V&N12_!{CyVfS
zK+ceVcPvrcf1i@n5X8@IbXly1r!iTU+l`L3sT1^@H>4~pUEYXtW8#9#!}p8}EG`}r
zuaYqjUm;2i3?wNisBElO(CA>?jxAnRcZ2a9wFSdwyNxJhBz!_r;)seTc&l^-R5#CG
zJE1GW%SI~avPHY9A8ZhVO>R|l`!*f<1i<|>p#4kv6Us{30&1@~7T;a2$n5HhIejAo
z+>G_UX^+<7tYm6*ypMdnl!@Y7OAPVhTRHs}9l1MAulO%7|LDsTI!-AywG!`qSg)2&
zn!2*k+J=iMb+G`bXOGPz6Da4nlKBawFqZpRGEN?9cv{$@Y#h)$W#d)4xaPa)Jw_uT
zpgKQS{Q1b5CAJFUvD+m{L#a0p&;qURWQ_p?o^94j(0wni4rwEjx)H)u(G|ane&9)K
zCT`QCwK+1{>sVV8AX&Ha<A?ep+T6&iWiYXhr9X4~i|0&X{)7m&ce-`ywpvZAeA_6Q
z&5d8|f=+>R&b)aRoV_X-5tULOm=?lcyWg_4RzLi&rTY(8_*4HAu<;WBOH@){sUoSa
z>(_*+aTwCJfY>f#qmaPt$$6h4T1#DmMlQ}qj^ql=E-Tnbq;DZS__|N;Prz&prs6qh
zOnACt?W13`QM|nz@sMhV#TLtmYYnzux$>p1{-m?=$C3!aZEOt%lax@=U8{}1@&>H7
z<BP7Nrwp%Gb(GlX_Lg9_yIKQ1#Zp`@uinI8sA-&w5$C!rwVo$ZkC_|BF-ym3>n7V-
zJaQE0@F9Ery6-ZKQ&97-c&Y#SOikqCm?E)UbGBH+)d`L3+5c5Oo0Z~w{nE5x<H$R`
z^0&${>KKY0i@eM^#RQesG{;W)p3OCRA_iFt4A$yHU4fP&rcp_I#>l%kSl}z?cd;Ev
z{5)HIs_Y~$ZGG*8ID(1v1FoYgXgZjak|%sV!WDc9u6UoBc5kJ)IIBvnN6%1$T1ZeP
zSi$rctJI_0xLe61U9|J4)Wu$w-}ZrxitP>ZeMYF<Y}n3m_!AOxVm+78+@t5bXHT<~
z4dmXWzY9>@y$YEN7g!HD(1R7=n5%BJsmw<>%>)omIYL<}y2htQ@D<$*Ro}E5fs--C
zqiP2^S)X4Pm$)+2&(zV>?5F_i2OR60LUt<c0C?71?AmQZhAEY#VO*HSW(T~dhNCJ!
zeE_y^>@HBk^Ibuw{l6R5e|b7BoI<9xczIG?!}L;0|DCYc*k0z91{;yh?qfn-H6kOp
z$EnQKE!o#&+Ge&JT7!#)p-p6X8!NdmW-@}==`A2w%8ofYy<X16$ra!Ve&*P#$_JK%
zgi(AQM|$K+>s4wbse#xs>ty{@9Wq_<f8cN&z`x?9!sjY&EgM&@X&DMwq$tmI#`KNQ
z_u?3RP{ttFeTr9~!HpSOKPFt#8;4{K;RXK1QEIWhw`$%W9I)nrKK#b{E5CVg-YZ+7
zF01-V22^x<PS7R&a==>Z-A}-m*Ym7C<_LN4ISAV8mLJ>ZlO;T>Brn<j+{L<|8S~5o
zb!N`QW>Z3vTO?>8j*OyPNI}ykvd+Dj=%~OO=`LYJI$;?#CB%v=vB2+WATQ{%eqv06
z|L}O%h;F#SG8?7TRR*s=#KW39!zeT+TCr#2TKTRts}=l!5>^4JA((p%ek{FF%ymm^
z)~sw(sc0O*%6;@XO0m<Jl?TR>dbjWFs$Uz#QeMa<F1-QrWnz$tBapcg50uOUQ<B|{
zj<sgB3azla6eHr|Qu2)rZ*od^$r}Tb5bm_b5&K;N<-Mr6pv-U$eW+W_xUe$hDQ3$X
z6Xtk3V$3*LzLkM7z>#(DNh`Ze9aK^O$UEx=^qy;>+ZsY9;r?44@Uc`L%iak6<JrtS
zW}rY;UU8nQyWT6YrNr#B9$rbh`vfOZ3KbcDr(k(4>%Ll&C~y^U-OKgmZ$C40Gscsv
zpliT~u~k*Ev-0OiOgt=qna-;M%wNQ0vYkf_%pRNPVoMv+c7G&LIYU{aLZ<m5RfLf?
za)CdxhTU7;#he{e3_{e^DR>vcmP}dtoa~s1I{7;mqx&2QiTh@=wdQl8qMuHhH`Ep{
zID4Jpd!V1GwAwQf5Vt*Caq;v<cQuTkCwc@L)>cm6@QtTzwLd{fe3P_#mYeGzn-ZbX
z#>m$>^s7mS{*X98_=;y*P&sT`G9~-SQ=$$L%o@hK`HptEAf+GQXg@phmjvLS4)Z@>
z`A}VNeU;~THsSri(>G$ZXp}yoaSEK7R!Dqe7yc>kNWBeYSxI6wS=@U2^pgQv;AXe-
zjazMJ1C9ic2q~bsq9M?8MEg@xm<cj7SZ6m`6lG7D%gOO?4AJjjg~r+P-qdt)dgeT>
zr=f(~ULT~c3n!&GtnFM-0mng~%@RR@s#()(uHm<?g!sg&w*FtLfh7MZ{ON^9f+~4*
zA2~~RDNL<%S3kjbU>KMU835{w;|JeLySjX|D`+yvLy;rQA0t=hPL@GZ+i0WnuDKnV
z4ap&$Pg><sgVx#AYELI&u*{ns403$LI0*%;tMptxW*)`B`=L7Fp~>U%?wMBEo4^%>
z`5qKuBk9&N_2lFeCR%W2sm&;4#+hw}Kcej8(p7i+D>%`0vvBumz@9}|kBMnJ*4zHk
zSJ&EbH<p;z{VzKoXBiiS38rkHFHljRlRqf%G%5-{EZ}0Vf}J45Eja^75#ltcgYJt{
zljLna7mT$F>C5D*E?d;FtitpDZ@MD(`}kgvXDMjpU#SZI>odv#p_12D?;Pb@ubEI)
z6r`Gu#p<8gCSEOy{W{?>3N@JvE9tJ@rF_reX15ZPb&o_c5l0cVWq0=5u@X<Tnuz&}
zF<{nV(02r-O2dA{;}VkQe5cSPogok4T!c~^0&8|&{>4jo$2d2#a{+0fb16H83dtTb
zv#LsFdrXS9=8a9h^=@jqFYINtl)LB^<h|95qU>6=4joxFpsZlgQkZTs;{+wuQ!L&l
zQNv$natejshR5t?*QnPwWS02BU@IHa*vCY29!@MbDYKlj&A$$e&{qi$V@2hRKf}qt
z@PCyb3<9h+;U}_KIZ^A6oy*M^;CQl;yuL_U*UvF!a2`Rw=tTF!PRJ`(->Y9gfkzUX
zR%Ko3RrUEJUOxF@t~*$1a7TCvw!*w5d`h7t^AFQVn6d>|Ff??aXI1j=^(Zhu?CEvO
zOv_~@+}UiGo^<~fiRgDNKyt4|wY>?g6i-~+A(2;E;y6zDL4F5(wr~h2zNF2}M}15m
z7M9Vn&v*5FWyo=$sp!fU-E`$X!D*EIlUElYYl(P`Dem&Vt&hpUy-qt~?kQQ#HhzI|
z05P&~LW|+^V4z+$&uL%_EYEyOSE?d{QKFfcAe@`pNH04rlopd>8ro7mn%7pa@s>zD
z=d#vsj&Ju0_MM;7@BZ<nt*5au0#E*AvbQf>S<1&mqoB^Qiw6=_H%fHY5j4=eMsvY$
z-MBX5FjoREV`oyPK(t3+dG1St5KVUqc-Y)QcZ2=I*52?M+|ZHqr~^)LVxq@#=w#iJ
z^plI%wktUslTCDVW6Q#k*p%0(i<O#Ze(-Wh@n8eGbRQyflYh9yE1vJAhsiSQ8<IvS
z&Pg~}bOU!3F)|9-?zlyu58e|$D_&tdLJz5pLX`2{ais4onyB&N%X<Li?+ma1=N$g8
z!a0F~DT`St^Mi@@fdfx1O`+j%;TnRyMaS?~uagJbn6QBd8@=t})tZCyr{-dJSKEHj
zespM_W^f;!cxW6(XebzA-WHT)eq88xnY?pt=oMVnpPwvZV7y+8y`S5?tBL<8ZRW2{
z-SjPQS_QS2oo<B_`uey4KIXRYZ(Tz)!37>C(+5rOo7IFq?t0(O5e_S{Qc9GPzed9%
z^NwW&_~l${megLvkoa|x<F|QsGQ;JDm-Gb9x?Ju5AbbAmEq{MT^7zs%d-Q~By3(o!
zwt4Syz4vUGGLy*y<>T9lea9{0)dqTkpc{hL%v^>~wr)|-(H%I}h6{fNdMD^1Kh~9K
zy=3@t-rS(s8+npvf5O@6L9}oQI8ZapI0@BJwKIztxmj1Crp1IC{6sulE;1iSBhoXK
z=}>>6JQ2NF=f*8e<9Z&p8n|g3LVQPGMRb38I1Lw}Fllt;Vl_3R&+Dt0I1yZrvsfxX
zx)wrHdg)cZ4Xj-5&l~~37vkFkaS)k<(AK5;7n)bi3+#CpcxNg<?C#pn>~>qD1pi;c
zzJCRPf7|Mh+knp=`CCl0*}|+Q_hW0AjQsi@nMlWt!yb0}6(SDP6D{E*poYTH1MnWG
zV~DxYH4fKeS-lB2v>Y3sSE}lBTLuf=9-*Lv&3=1is{-+XFgzqlw@kUgqt$H*=Xo)0
zmKA8;K(MV9`uzs9d)*c~yKtQp%ViTb!G{&QUpe!@q{@<B0*M>7mXo{;*o}7(IRswk
zSivvmLrk^8bmhn7A)Wt2+FM7pxi9PEuxX(!R*HLDpp@e7P>K~V4#C<&aSyHqiWDe8
ziUkPnR@_~Jy9RfH2e;5)y7xKfp1bcp_j}I${lm(7^S*15<TKCAJTvo5)gVxXT2#vT
ziNw?O^VEe&EvKo1S{-&y^L;ap)3u#BTeE#vOh+_GG_D_3;>ptn*>^(m3a~Sq3_Y7E
zykka>fk^91qi>Lo5fBnjriU@g)WcIl|Frmk`dQJsQ$(cw96Q@=?6+-b%wCV6t?O>x
zeb`4-tM{veACo-wG9A1_h0{J#P9r>j=(;XVxBjLvaYmq~-YYW3C-Bk2bMXYV+R`N2
z1C7KYJAVm=S0XgELKzshcp>>QH<C&uAXwwEM>O9F4ePxxL;hp2E(p~;XN)hfxE+ig
zeRuVWqz`7FDb1)~Z++H;6QHZzyd94vMY6$dW^Fd-=&Xtl&Ck9REq(EM*8^o)KGl|z
zFdCzXNY%0k#hySzS0&@(psniR^Yp>PTIA65`>;P5>EZy>yiplZ)mTWY6Ri57s*2P6
zC?2ONLG-~{^$^wrD6crX73TGno|6rvy!q<sa~;c74(J<+w!^P;#v{~MX2OpfcW~uU
zBPG+?3%hjLU#u5Vt8DME0jM(Bqj1J4?@TmQNEJ8k=xd3%z0QY7et#d)c#G|)M&VnL
zPCOWo)YaMD|B3c-x=*Z4X*%eIBblhfCYm7N(W5)?=(!S|^meu7i?&WIPtLRK@0WE@
z;IyrzFxo#U>->ZH{(l-YHrC!TSONd$^-iIjy)~CKPk1=)4>&oUSWsi}it)uu=^A8?
z^@&V7C9p=k(ZwDc+=~S@pS^B;Z2ealfxR+lHKVhPt<NE`LkfF3>`As7RuSrfMb#Ws
zkdruP?7$3S9|AlXx?#hF7#P1<mUYP6N$$SnoM))L<_7WpJ!t+fcH+;k@R=A)RO{ua
zD7t^!5=chF;wnQ5<}+DeTdBJwIoZv!6D!*g*$Q~Bf>?q$m*ubow&zc^7N^+8U^gPQ
z<p~a2+D9YmKY*UuBJ}uTG|xr*0_-X!i=CS=lT7KyuK6&fIc{JDkpge&O7zD^_NIL(
zu<<{EWvb<Jr-i<g+tnBuK1DQ%NZEXLf5O2znueFfs`+n)zyE85d|zDGy!MRpeQ8?q
z+}ZtyYw5KzqNY(7pxYPJ$NZaKs8oy{paLvNQrUS)DVc8$olO(wOK)NbKf`Ku)DF~`
z^5DW%SHd|`-oc(EIDBbKV11dg>;>@nLQ<*mjiAV^Q9<)V%Nv-eg6)~5#nr>4G4or1
z%SJz4`lAEX;doYsnNnjJCUV};Bmf4hj+=2VP>qjvKrfyUKkv%3t*6+<OPF%@MiN1T
zragQHQ8OcbDvWECsaYog|Ip@{VpzneXvwbfEZmfgRRrcCK=Z}vC4=fGm$`jc)P8Ai
z!Thc0j1J+O2F;D1XtQ{cLmtMNjUp8trV|Tka3sHV?a)mz&e?Z|m~GC99|K#*xGPw6
zj@;E9PLC-z3%m{T;GW{uircGh#H9Ia0-Wmp4?yByZb2xCC1$CttladBpy;?4T`Cy&
z98e-3-F~03+B7@`#+|kFSZXM1ioF{Z;PF^d4f^|Yw2>&0(>Ka|+P}6_>1$&LQs?+v
z!mdN$@DEgK3UoiFKxd;eJKoxsV|?-23on2YBAilfsANy3tO?bAYo9;0!0a~dJYvK<
zU`pv_A}9U+-cd!{_#I&j(XB(nJ55#(M{kv^D(Tfp1y$<zO=5>8rEy~9W-AND<brhQ
zt!CD>G+%JdWR~*IWD+x*$GRwKbz0#an5$Y5q&yI_d+!OyAG!ax4qg(gPe0MpMf0b0
zQg#5mq{QBh#*-0Q-qoCkl$Yr3zu^l0uP5qX=V70k(i=uR)%T8<F%R=0u|u~%y8V8l
zQO0Feh|SFR$ty7e?eBu~EDTiwyg&NnN#y)fKfym)BF>?7s_ec><txrT*GhGe=PLc(
zMh46I(0y?m7?=Z%R|}>)By_ZqbeTF|N&m0P0Dp71()fA2#1#s#6vu`MAqttMB6e$K
zpNAV265>SUX11`vsrm)sd%D2<RMrl1nxbO#9}QRu_zv`L_ucpU6>i5yCN$K3RF|v5
ziNBm28lpeFd)wj5YfKTZ3U9KRbB->X7Lbkx3xKb`!i>X@NP7U1txriGFF-Ys<aTxM
z7Az<=?TY+M5@&Ja9%8^8h8@cBCjKXf_J0Tsh?;<z8_ngAL(}+?GuE2v^a3m@$s!em
zaSi2h@Ag|!0G*CxVKIBuD1}}M-Az~^VYSzjZy{|<UzV4z2nL8PbxZ21wBQXr`@gl3
zc}w$n@mos#D9R!0Z(;pxCWhLX6ZAb)XxKTk8Ng&4clD*Risgw6V%dZCH@r@#r-9E=
zcFkl^;P1)N5`|&<JoQ-#2t@OvzbwEXQ`y5<_=BmC<Fv`BGs&7ywO$FpcKLFL6&6ry
zN6nLaPnJ9A@*YswZ9j4$RogJX@*t+(z%l`fGBJ<~BCcnxLdTb>6F;>0+&5!6eXkob
z?4C;)7Jw^lAQFIU5rg%a|IkeqpH2B*_|xX9K~G6AN+pe8(z^%}U9vLEVC}M7EL8;-
zay?Sh79kZ|T<a6$9E4z<I|9N9WmT~mgJgP%zTp|emI0elkrGtx_|95W6nz1*BQjTs
z3`*Vk3k$^eg!@$)pQ2F(z3n~Od5d+SvvX}jYi>RKZBp|L?;y|IxHmdSy*CXf*_O-K
z9j((mg<4NVk1c;vIigT)^3t}C>{^;uA|lH@Jf%ONUw#{WRnnokD@U&D>vQy)-+yuF
zLpW7!u(n;xb7g%el*Ft2K3@m#uAH2vL}!0-{%UiO3{I^a%_WT>IT-@#U!U>7hTS_@
z4IbvaNkgUCI$c*Rh~vx1FQ$CYi>Pm~5(`N_c^xLzyE9&{^1b*QeEXPIx0o7(+HX@K
zbnL%X8veDx{>jcwk#*x2O>x?T7Zc+W%-+Z~RNv<Y>oav>&8*YK{<C}fm#9!m_ne9r
zwOcE#T73WpHZP!Ci2fnkyvjvdUutggO~!A$y!LvidOT*+vwB14FaHfQHX6{~$TtTv
zLU{R9^7|*RxMUMsY2`=bT=VpqJgrB^!Z*t!%2Q@UDHb_XLr4D~91yX3rKfCvN{Z3T
zS_O!O0gH_t*Co=$?~oN^wb*K95YOV?Zx7nA3h<YA9=!@n=?449aWhCu6$ia=tAnC>
zGx*xTlW_SG#+^tk4OX*4xWmZST=@k+qyjMrofcyl#z@2K=J^6L0~M2kxS-ern)$k?
z4a>u{hv?faX@B|Yey554qd%m*XsFt%Nc*)E`KR>Uif`V>*uADn&5ixm^w*VD;@<d?
zE;3?h-UtA=*vf{Jq;%|zuY84AW^8P@r-R$os$#&dtoxF|;oLocW1{|3PE(L@7fwWG
zZMzHbg=yy+qVCd+E(06Y);Z{W;QXR$9KeGoWc;jNKXJS+eC3-fYN{vT2%t9DApF}+
zL6vE#3oW&hPR*$J-70}U!1q2BYjH9wZKEV3yLMzyTJIikTyd=Tc~qU1-}ak3r~KkZ
z9d>PO>GBJ=^pWb_#2jyfmrukZ-k`5A!VX}!{@niD$uTXbU!u8QF3`<Wbo=XXQK6zL
zEu%DxAk^Z4Lbb8+a#2pFJIfh*5NnC2sJ2o-Z|)RX_pPk3zrVVidH(ap+wEqfI|psC
zr+tqyDfOt{MO7q>Ms@C`K;L-Dk7y}wABaXyCmM5WZR@U|WiA}UlGg^Do!rGsp>q>V
zui(4z=Y?4iLHLHbmt*(xW+RQ%<ACg6rykP=rl;h;pL^E%+Rr+lXmTSHmi_%G+RIID
z#;wkL5NJ5E87V=2&-sxMN@OYcoyGNy;^o24vKRf@EWNe&^71V)u)MJHLKIs;NoTC@
zMt#Ay;KSy0*Uo3JOE=)wcT%VS3(#vK9mtbj?+CQ^I+tXjZ!HKvYR$BpSS?l2hlkKB
z$g!B<nXx>(hxMuIx7-R=v7^;JHB6H`CRS(%nKtq3Jwr)GlWInRbw6&OuUQypAB;x+
z>KK~27HOSt<m8{k*i~yxE;}8Hb)~{8rBhHnFDC@}KhaPsM?cZZwf?EU@h^h>uy%{g
z+`tq0^K!o5wgjPQ_(TzhFPxM_oQ|3;ATw+4*?`IRXb9bu8^bA$p=}!#p3^~rL(bja
zt(J0eqdk3(Ld|~9gmHCJF2CRpJ$+s(@u=E>Bp4)XSV%_0B%CnJsJJ{l;fhpH0YRam
zP41iG4UAE}y>T8KhemEdRL6aBwRW$HHsdTk*V}2x(+iqkk}p$9IcL10cX&_kX*wXw
zsZJ4gAxP9F1%7jdTHBA#EKsV<B;V;k0tV4xm1!t_RKJp1M<<kEc;21h`ui*=;)<XM
zNQor)IGBoafDp3v^C?(NoES06ccTs2S)(-x6Zwfo-fUE{{Q?>r<pGF;*TfC7>rEFl
z)4mO<bNTB)=3fsZqq@`nDd73zzJY_~?dHjCc9wotp%^0G7XQ8+(2tfy)Er?Hv!bTA
zZ*D~1s5YgE@zp4(DTnUk3$vmDnnXI9)pr15I|C!U<dNy5LZdboo}tGL?Xn)IO61o;
zBO$_fx4WY*{SC=D$DNe#IK$<aG;f^F{OEcDjrO&Xn@G+a8S3LI7`KSoA$;{L>zZrK
zzaz~$mEVa0Jhf@BK+J8x?M3feg1A<G)fdYA&M@C;KdAl?;Gm*F5Y-{TCQ2dF+e-84
zKD*JhrlrClyV=y&e)=MF$i9f}A|#S}?n-6GxHWulukftdA3SZBo1Pi?V_f}*EFooY
zF$TK2Cs+C8ILy+SdZDh#D2o`lB^b(mUK`|&S$PakcG8}pA^b&s_@k(gU-ET82`iKs
z?b8!%mb{GOy`XCO8{jKuCzHd~f=sMX1<$YNYY4NDYcH+J#>MU)DCa(&RS@>u9=bLx
zhUOJH*EIj;p!8Ux7#=Y}<9Pw!lH@jnU8Y*S5`#E>(<U9JtirLF#(w)MXhYtx?g!d{
z)kR4fGS*QWegN}iIrg{u>{y~I+_hg5g~(3Frw0$(B%X(aVDnY^<#<}u>)Gqc=E3z0
zus-L3p39)-kWY>P@<X1w7S(DxRn|%(F3jPM@_NIg>(8R`K?RS^dzvZEds@#UH)~A@
zCfF<gA2IA-Aj$n$m(jwr7ZDj%Q@RXazgOW$KMJ6KcIkp{%Dswl7g$h0YV9K7x!1Qd
z^+O227uxexY}mB{wCw;2#St$@S`@A~>zt+(tj`n=<(*|5&@q%D$QeYGEd-(Dn=OUf
zCoMOE7Hh2D<Eru<9T?J7_r8Ut1dH6X;?QixA|L++9E1c2SEJkSFJ7rf`zThlNy+*}
zEgbG43#D|YP1p5#N$Q%;AV=nH2y0wi3)HzZ&-<(7{*P<_6IqUr&7{VmD%d%R`zF@+
zhfo@UG|Y^X9t8^X-Qa|JAx!FEx@QP6LkuKl!K9<%2G2y-K-z~HM=n~zjb-tXqT&cz
z{M?hJe$vE&-P`X+G2@dQYDRfGuk@fqcJ$$9lvK2SZI{fksIFbl0&gYic8c1E{l<qJ
z#>0w^v{mmc#ItJFZiwR96gGT`9P8Z)f=26i7>AnG>{*L|Pg26<7O~4em<Zfl$n%}d
z#Lneoe;mCFR#$`d<p`D@q7P#guT6h^vz`u2k)+XAh9;gc2dFiT!gq2jmm_G4NK~>N
z3zapQLthBx&@~=zxblAFfcZ*uPFsdP>e)z7996=u{qhZQbVBpY+Cx%%Y{&BH^y;h2
z;Mw$H@$TQzO@L{$-n`I~buvnGtnVX)|5K@*%Bn~_{I-M`I9_7`deXXjViR<88GpKZ
zt7-785MIU0h}{#~{OsHuIE+YI6*n7E$~$PbdLe9FIW?LeJhs-W9~-9SsQ@P+W%|#L
z<^Om>BFWtE7|R?`p|BS8Fw17~Yi+mgi+c%2=<`oKLr-g0x8|BM5*I62`P>UBBxc04
zFQjM(+pi{<bsIEBYo@NFrpRr0*>2f5y9j+1qnj&hi0!N?R*SEm#|a6&O&P%;2L{7&
zZr_;~a-%lkoYolVoT_6{6ESWG=TU`Q3q<g{3(iB6<j3@X>CHYx<C5DZah<g`MZ8Fx
zie67z00wf3GNm&_-9&WK_CDbG-DA^!`He$M7g(<E$y2XkDav^-R>;TIHC}<och+qX
z4IWW^bPUDJ3wgd*)9;c|B?+vW<jRTuu+!9p|4x=e_MJvX-(j_7^Uy*0P7|l%)@+uD
zc9Nn`kDYFY-BXz>47(tQbQoKu_M9f~*n+TWR^EFrJ3G~7**AEd)NS{kMyXPON9N8G
z>HtO^w+G<2V3oyMltd%yd@?ynDDGA7?GBrs>#h%b<A{a5M2){oRrqpI;CJay0cRIk
zJu39!o8erLP1rW{H7v;Cy*nPkX)*b~9sB<y6~J2k(!6NHcWpL4ziySpjg5omKw242
z;5Tx>uMf`DkTlLc$XJQ4mN@4ltdLz1?msUA=VVyce`SQo%JBrV0qdem5N_)6Cwi6K
zSNbzuR~Cy}2Sc`Ttjsz2)~4F!T1|&>uF#;K3xVY5hwB1*G2g(IQ*UQ=Xxe`XkPF`T
z6))6^nT*!WCW=)CZX0@UKJfst6Ch}S#{vYzJJ6qKV>IGorVD};V@N|z`Q8kZGQm>g
zR-pcPB#IL(@3(9X2|4{|2K_!1SQ<KQSyZd&K+J-lxP<_WtzG-?X^2f1Ze;Eq)W;<*
z4YR34_@|^8!l}^BFDgY*v%);wYA#k*aas6sMO<3)D;Jxx@mRE6i^QJ#F7*$JwZOto
zl+p?qPtDe=(lgK5I{(MH|685SkWh(QgdJ>F74?Hua7X~nEz8xNJHsL~$8Y?<LMP&w
zohEID9b+X$18NMsj;QaKsqE-?!3PDCYKxoyK(o}}(F~C@TEoONr>b@N^0~-2$xFFQ
zr^^+~_Z_GV{J=c~IV%E@K2cojq6Edd6Q^xohWsXcRyQo}VbVI>BxB&T-#xT=objUm
ziMMWsD<M8K7y9U&&5o93mwNS6s*e~zW>Z+;Z-5v5HB^%5n;SV)8fKMdg$=nw6I^Ex
zzg30LC(nnjcj;DI88o15VXQJCacocmiOCMyXAaOn4r$(*O<SI1Pw?fLuUW^2<Du<Q
zs2Dv>ufog8Ey?gErlZ<yj1Z*Z{2@5w+1`H&lHV9+ivuf4DJmZDu4)U4By;*37dE!%
zg~7ma9({4@<8Q8V+&heo9aY-&KJIO<&wy_Ny_-Kb#4seWA@#iP`{bs^2H*32GKvrB
zg7(H=(ODJ~+bGqSzp9r@Awo2;dV2U0tk+Qg4t!6IFF%%sc!Q}<ZcQ&iv!{e9y|WYL
z;{KsG)+tCbqjr_i*!!x|9%HWNCUJsHuM*rcP*b9Z4wMAV4^G;2uX4W)mmU=pnj5rv
z-O4Rw9^bZPTt9tPn8h2&my@;PPN3Z>Hi+kb$L%G%cm1%cNF-rDVq8xqhgJf_;Hbr_
zyN8sL?vwb3k^SdpiF(54IWb@YmV-_78z1JN79vg>BH6WQROKuWIENRxI>azIOuNK#
z*H{+Z_{3IDqbgjF6tdK#H=}jVgGmG)%V0X<Z{R6#j!_p|KJu0T^yz(S&S^&KLut5<
zFcyM%GacPzA@*rE@&)x8OVsL`da5kMz9s~T_%72pzhSuJ1+O;U&^hDcl}DU88aLrB
zQ9=}CNwNFi;;pnXVub8BzlQqnI2f|>PP@kT>Sh^vr;du|EUcHi*tzAIDoOqD;Q5gB
z<m#=d-lo9UOQt4Ha}sJ+tIBXw6n~a1tBn~!hY%Dej^DL$&30DOip|VuR%?zE?&Ng_
zeNTY(%slJ}XcgX~G0-ZtZqPgAImoZp9-C^PCJ~aiNTQScf%ov<@^S!(BlB(4-)#SP
zAXjzF$=?HCF&xYhu8*FLA@uVyZIy_EKd=~Q%5}?j961!Rd4xPK%#DVi_8s69vqbY(
zk~E>#wcvBS!SAz7V9tM5kP{mt!F?~Prz5TjwPy#VpD*9X3Y42Q%?WJ-Tr|kdZ;HRr
zXpDZD<Io!j&6Jx*t#NtI>qI_|>gMxqmI8L*uJ-AII>3xuXB<9N8AT_0HKPrv1F{lH
z0V^mlhUDmcru~6r{zqN@UjfOVIYQc3RRz3Ke6M^C*vOepXpKR_JU)btEtZzwRB<Cx
z>%)TNXR&717)?R#s9K;duae@V^Ain?w{V8YjUiVq%>&vejw%MXzJ<bx1K|#%Dr~S<
z9^WLrBgh$Fc*I9v8MQo%_VN31$xM&1m}8a8iI}>c%@AStI)2P0g2g^j-~!LeEe+Ly
z=+fZ<RtAV|uX>5!{zP*JzzeckskhIld<4YnOs`QBwnm_64&xeGo3s_RxFXo1>+!Mk
z)G)K;r}6K#Gp77UR9?SrHR-(cks?h}jf!+Q>b)1t(6DAa?d5i&t`R-k5I0Djk|;`_
z(1@SQ9IT<g#2RGU$n}yAcO`-|2&BWZq;RG`IV^9|J3Yxsf!weXd!)>)*y-}cC1J{!
zf3Z*gqHf}eFh+g|B(uNMOV)4d8CWPpmqo>D4aFR8CI@5m__rkHq>R5cMAS$u6SqiN
zePto!^RF9<p1H7gPk6W^PKtW$olk!f{00Q1O-(R6szY+`uOkqwZ9b(BOd~R0C=kLf
z7e_Yha-RnD_&3E-x-i;JNXcgWS9UkBlX<l=$IQgwN?oe(rZ2c_bTZnu-AfX{C4#N;
zRck>n4}O{xU)ng_ekdD$;ZQeoNH5IWLI?_y582yNp47DlP8(z$vTM74vjK)cv6H#z
zXwWlrQI&>v?0+G@_xw3Ne^ZeKFa!-J+JhxYYbSoul3Gr274~4ETD*!b|M-ZO*7+xz
zb}v0ZYk50J-xybH^|g3jY&fg9a)+KB{Vi9MEN@|fY=6!Yf2MxE*)smYhSjBt{$u-6
zQnGF5dz<Bu?VfB_v^F)j*U;C#L7JGfHP9;w1@_ci&ED;PeV1=jA83Dr6}5ZUtEGM3
z(ta0Y=E%T!!PYl54mho{X^O=x9^<J^{!qNpzpYx`vYnc&z0iMMo%<6Fr!-~x*a{>n
zTEAmzypinzt>M0Al7CTM*zAj~lD9OaUFEICjg7xSJD+*QK8?^mJ}_d6{)zVZR!W-d
ze&*}>k5xP3a$qrmn_!-0lNx$kRKo7?YD?2Br!>#$R6ErDUIg3o^bHVgBNE*V;Ct=)
z6YU7J|EQ;h`&PAon#%#ePZ2zF?cCy*e^bN>mkaO%ugFrFcq+L&T;kv$nS(1I=HFS3
zs!3faZJ+S(4O6B>bo5`|Ur<7l(Du-lNmz;R$oQ_+oD(aIT&Ws<VveYvN1oU87s+5-
z?PaTKY3LQAh^W|6CCXax`RN^9uPs<uqbq-ZVZ}V6oQlsp_^ApbK3z+L!=^oFnbzGP
zV;rsp1|7M{=-XZqFcyhVT;R2M9%46!XlawIIi;tHOInPf;ra8cn(>hTovHa>-xX8!
zDHzI|<e167$*VOfj`WC%`6Hw&$yYF3;5`PtkY6j+%tdMBqOitx=by2rvA(GLk#Ndg
zwRRU#EO#T~?cL|pCob60{|E(H{s;xDDe67Gy<+__^@yT`>-a+Wi$b)^DtyFCs2ER1
z{@Mkv$#$$aY?zxZ$N6!V6=bNy5iVa}M=ejE@gbk!BGKJSVigVjQc&djK4to;%@ivs
z?%;RjIEr?-<2)&5Ks(o>+Zhl6pa;wB?D<it^UlxDVm=Uc-Ol1UfTSu3VX&GwRsP`M
zc|D6A2E#<7D{XQ7!RfK6XS&-9GJ<Cxeq^Mrp$ze5)Mrwn9?JNRk+1>8`r0<@`_aWU
zH)EWFV%F9SJ-(h$`8-lG+qY;R%EA5F3r$C+vPy#AYBF{pgfF%&_EV#u3);0pFagac
z11H;hNWbQGJXXDeSH#vptBUGnGu<lxkTU{dmqfG)U0c~y{=~UnBCKF*RM<|QnfEoi
z^SqhA@^8XJrJpn%{|iALe3N*eJ~1Vqq}0uJ3_;1Z0`X;eP`kj0RbCsh5oteaBFNiZ
zYnTI2E4^C*DP`YGgGljYFCtefc_sJhRHmlp;8nP>wJkb}mKGsc+_K0lS*nhtl=|a2
z1}uI{WzGrn0>8K;OMpx~o|}j+&FXKXS}FylmEh`y*-2;Y&!N>wCDqooy(0$)l#ET(
zA)x&~VzcmL0h1INl+@y`q&TtV_+`)(u=qn%tir3D7X(#VknUix4%l;mDA9g7WQUbo
zf)fjN==1WT#uT3QCm)y;&MPz4T^+6=b?1l7YOa{p^Yg(a8FD-HPSHJ%Tf&LVy#%&e
z&*|QEr3|}!j`_;jLC={O$lt!sH}yibHN+St`>+)uKbieRn-X8hZoiXL9`Th3Tf328
zo)ibh`X-*i8n(sLx)8{0*`1oIdY7~(=nn5~Js?kg-!n6gS#b|^l_E#)3U9yO-ET3q
z4+%Su?<uLL)t7spSV?@~6bEfE{`*fW6i_9}<IGWR4w>#g59S>dyhkHNeA`|Erqk>H
zb@%X}?*2Bs+*K1pnwnsJ<UX!s+`G0?TiUgTGddyF`_a>g5=J%6v;Nrqv37a8oz!8+
z83Doe@2wV%j9?)*qhGx&za$T~(56r;aOKuX_sYx3Qdvr^=umv?ygdaLm&)t%{uHN$
zVuQ7En4U1tH~M*P;V^w2W~%vBvX+N+-72;FK?tmc0t{GOk@tD=5GqVm*0s)MeHI&o
zzN@(GofGimn(xeSGM*Ken72HL;?+y?`#d-}5ih$bMuhH9{1x-_`?UaY3HTLE&LZ26
zNbN^iM^9kr5=#|{Z~#2lf-_oC&Der+?GS<O*!Qhr7H+4(o|A7Xu~0%YPQ6MDVSiyi
z*YZ_;1Chz==^pe9e{StIEjvDNaaj99tt&BZ&oGgr-%gK+>>)L22XlgK(HMU8z^y{-
z@IV#Ua;b*ZN(!{`;{rQOOW5dCWr+FsXtkf$*l+&Ls#qYUicfla<_-4}gzkr}hV+sa
zUv;!R;4M{mkAVIaXR;d_31hAYJKro^l#qasa_Q6je4}cpaba_;qobqphR-LD@o^<>
zb!riUdbw<SE3(l#2L0LDU5kvt#WNMT7w88%9dton_Od&DNJ(*SERr(8;>TBe`d*1G
z(R^9x-`7herDk&MO(?#X&D>2T_?<>`q?KMPue>(_4t&hZid>0(-0(H)k{08-al*?^
zef5}iJOaUW$cWD;uv6&*g#Sc?AENr@#VeVg=c;NphvqgJOIEj8>=3QHUTgC>l*<U0
z%wn&$5MIl&i!(2F85Ru41}>7)Q8SHOjP3u~DG}M0RCOqKZ<^H=p#@cxh#VD8FG%e+
zP~LNJeaAbmms|%O?f_?RLqG$iY>9Sqp;Mj%=lUCt2xamjJ>W|*&)AZ4t89iEncXfR
zHe*UMN4L!WhxwRIdoh}`-gHm#<pbO41Q2c2edgeb<t-2``grN*377U8@poI&84kvX
zlb2260lW$QF*lNM0uo{Ke@@T;-H7-1`)HYZu^4^_7GiPd-+@Jq%f<Yb(cNcqlF4c=
zr&-^mSKm1a;7O7DJ5Q1Mi>KJ({yjKGIjleP6tTR7niHs9JwkF>g20r4*!7yrdCQg3
zovQ<t7qi9JkCfxDxy8h*WSE4Ewg)cnCQn+zP(KUvPqcnyw0#Rijc-iaisS9p4G}D$
z##h-41wvg{8#Y2Vt4Bk;>S0yXZw1aI(Jt%*ZYH=ACdHkcQOHA)KD}=kOS@j?ivXQ^
z<uYGSAvat`DHfH)h0U4g;jADRXyRu`Cc;a$(;3S=$ZhANNttNrHx!o*c6=Zb!h97*
zwpjwE)$2u}3-6z?NH4W@XHn5%X_JDA2Gv`#4q0+p4f`uM^JVGl+#lfbh*WctHutn@
z=#c8U?o0R*v#~>~1BUe#Q+9__T6P_5XWI%uE2oZ~k>EhG5kV##q30|SbPmi;m4Hz<
zGoP6pM9Xu!S9d8NJbHhH$zX@c*~ulEY`t*aYBYj<1y$)cP|?k1$1Mhz3@hX<SyYHQ
zoSUImtvzJh8U2jbJ!8M|Sv)iHuc}mkeGO~1XeZ^LGMw4py^5iMM%7}Y9xJbAVEV#1
zc7WWb2Y&WPUQMp4Nd<M`{;b%pAqRxEo4%ckNAW6=U}LGJkkzK)=*6^W<;M(1(}Kie
zr_yaX4DtI8r6l{j{OMzW4{=(RgsNJLB3FL59C;(&&EkEJ7BI6*K8ZWLn<-fB#;_#s
zy1u@3%=3A^HB4g_R1H25Y0rJc%*j`i+OWN2Vc0s$I<@t~rv3dKtvs@{a_*qsF=Jmz
zcANJxRb7#|aimQ${>rq?v^Vt_#QaNf<w)7ee5d564bNH)P1p`49fAy1nI*&c6bQe|
zkEgLbq@M#8vu||hLWK`!UmH4W3tH&5LpQeKTw9G|hGw3#i(KPBNjKbjdwf9^-68{d
zK_lf$QD%<(a1z&V>B|CVTTpS1cmbu_v(kg82Ha?PD>*9xJ9f;xvK&{1@$I+k%3E9v
zKAhgMVLN|>5{Q=zZ}qxO7IXbD-^HN_d&d`=p-#mb-gieBEP#XJ6p?6!Syk1$io@A8
z7S{q_Y+2dz!XhLO8GW;2CCAm}?oW=jU&zuKGn81gQ3iTn4XQE&`ugPMTNjnVoT)3<
z@lYSSGnRxanl3xuakKG!6)TU!3okJwwL%MIwm9a;2__o;m}A;mPGWjmwdx}4QLkcO
zu)P>qmayIaE$h(b43aLoetbR?)&7m`OvObK&^gmB<MpV>sxN<MAIIyMlz`h|nNP$&
zf4ez9t`WSJ9OIKe2Iaobc)yr)k>L6dH_kisC&ygb@ym_t{5Ln=i7%afuIrni*=wBA
zHBy(O!{zNSnggO6UiQ+Sz6L$w70gFYGzlkhns@oq;#v^%tDUE2otC;&JC6xkCYEJq
z->}pjJ+&Ucl45aH`-xU5x>^xIEh<UeOc(izv9mmC#BZ-=Ub1NyxAE?~v_$^CuheLe
zl--+x^g&wVtia=F?|m|)Rmwuf;=y`XjuY!@_HFp|Q<y+-0vlu4LYYM7tCF1QDcqMh
znpOUmCw|oT`Db6zJDk6MzmZD#xo}H<cTn-|ga<@eiLh=|2MpN47fjj3SmnR3%d`1q
z+(Uc1a_(6~+Knccsa%Bn^+7NB5gE<fR{_eFLn8_dlVjDxAAkW}aZ%8w1mJHLLQXxj
zl5hJ)x6LhVDjn2RQS}%lY&Vo%anLXQmHMdvozA-VX>nM|Bh8sr!4YrYeiP~z7_r21
z#`mbEO-od1fhx_T6jjVvu{C+wun`)8lJbrYElV`6u?nt)I@yc8nkI}Du*tvEWHTb+
z)^@lZ-m(M-s4|ki0GY7Ugc_kL^9zCw&J22v9Wgkq9_9R<?w1j%67P0*IAJwKfM#0G
z=<4De)(zflD+Ak!N@vCQ?%}mZkhIExgPGz-1<cg2^huUlIXRw^RnHgUwI-LoXS%WR
z*Hi2c$UwmKR%)0#x3Yl)jNd@k?vOQAvARsrr;v_k0o~lQR8{Z`N&$mJj#hqavSMu9
z9Gv9*IBGPQBawCh!r9}5R5%Z~#xbIWX=CQ!Bp2QemrQ<xi{zEEQyCX&11V1~Kn=1Y
zvSk*a$_ghbqaR|gH>+&0(rzF-hi+ke4MLE_wV5MeFz7RUIQ2!qi1)CwTch;3L5hkZ
zV$V&m1KR4eH5`}H!$RXL?%5UU>uzT+Kry9X_J@nL{=d7}FB!!8lR{C|6a;O-lS)y9
z_|Gn(Jw8>FO#GEv&H9E2`N859#4qwm=pPAT<{xE%vA89t3Fon1N?MU25w*UP&!StA
z$JjxC$_R@AhFdcItOn)9hkjM~Y=qD{O56zk?xmt)s`JuZ#1<oRsgQR5x~PdSMY7X;
zW{sgr8}=ZJ3O4QV*jMe!=W9W1gmZI!Xl>2m$9TMJL7%Ecr;*sp?E1M)i**CWhu8cD
z--SFVm{#)(>)Xc(I|AN|NUaV3M3X+Lyp=>%0M8;)7fG6fseYo({X~n!bYsX#92uru
ziw(vz4tl`62+1$&COfhhe4Nc2sPO9WFfn|^D%1Q#V2*K6%d+6Uh^OtzUf}7Kz>K%{
zH=RZo$X+49?dk=y7-40+$0LuaL`#Z+-;^be45}!qC$YWdjJO-g+QoI-haa*z(66WT
zDi+=P23%^U4CWZ`&mLap=zNosEZG3;e)F2NGyf0?(x6&K_q+CwF1MhpI%m6sypUEx
z-a`FS@p6}m2sW$2Y(6y~X4_1`cf2umo|`_T$wV5O4KGa;v#V`Fa}c}ws+0&yB$fRU
zl#zZ&4ylQl-FucLt~M8N(TYU}?^`JuA@#6y)j+AttzpQ>WxEmvZ=PL#(xc2_h!Gv^
zTcVRy<=i-Wq%~=mU8Vw8o4<Er9~bgrp6U|PlJB*M-<dpAd-3skOM|jEKXGPvOMO%Z
zZ)5etIZ4AUvHwPyx#Z<UWRU!W9DCM!{IqlndlnOE4+M}+YlsBZMD|Ct>7I&JM|ZsI
z_XhUwM+>7t?4P)Ux)8Jk6SSEd4s?71>mNa!P0UAEkjbXxn7LIw5B8v1!8HE|bWZ~}
zG&NPEl^B%t5fb-|zaIA;p>~KyyI_;oZ%YGy?0Vwm)oH!c-R;t-{7@3R_W?(c-lK#L
zZ)3oww(XS`+_gs6eDKpy{UafllW2Dg*;=#2W6HEh-Rj0BO{2oQ_we2d`y#uWzAT*T
z(1aU(qwr;WEI)XpHu12L!I}P(j?DBcu?cQCMfCdO&V$*BPU;A{O?PLEgz)mE;y4Nm
zYtiI){dtGukXLhsZ3hh<spSex=RtDM($*kXLvQ4-BxIa}f=13mT63%9*?>XG3A&GO
z$X%0?mA!gIwMq(vxMit%`s!~2^-B16!@k5$mXNKAlC_NnMAH6vkL~y$B;lx)KJ0ZC
zFqrvV7hUG6v8*;vF#2g==wra!r~Z6TOSgGbtyrI$I@KruAI88SB*=@fq^(t<o2zYm
zL4pVm)>Yl+bZBxEX(@{LME(kZbfr39Cw@r@@Q>T7HR8Q&t~eO`C~Tn@cw6x>$?RA1
zwX?n4Z=n9Ql|Udh-D^%f!^go;`)V}^s=X+}AHmh_?;g#E?zNS>R#iu~O1DX&`+^Q<
z0GZe%b&wYyvWGcHgYI@BeNCZnkIvZZGmB#Sqf-XL5FT<WJbJx2;kP-Fjnif3srWA{
z9@>Z_-~U9rrMr1k{%SB(M%Mn>0q*Jt^I`R<@(T8TagwnmBkmGd&{pn%rvfhjsgCbc
zpRW6;hM0WvpJ)+FGaCDUyJk2Q)5#ho(JeeJPeq<`gubA9O65``PLsLenaD}yX(O$T
zH_W2gwDS;GQ`}P;2meXHUi1-w!h5-4`&}F*u1k7tb@aC+Ym-Qj7T;y+%A_41Ht`Ec
zHCJeC1HSH|$l^g(>3EZDJV4C>nrPzTN;2I`&e-{qKcdyiyMrzLwBI^uS%ROEdy_Wi
z^l`-;^hRihLa})qm{H4tZ~FRuWa?A5q|;h<_!lFgYuWqt(~?#>CK?(V6PaIrn|W@9
z+0nyx`scd9UuRPigkEK;M*F21MW%rL8N@!S2_HYS?F<i6JRVOdr?vQkD!~+EGOC$w
zxYOzS(OvjVASvpBrTx;(VpD*tG4u~Ve2AT7O)_y&lm`@W9yWklNnTy|Bdtj5mVOih
zJ~!#IQK%g~OLk-!8Ne!J_G)p1pAuitWRP`MZi%tD9x$^b7_*MuXRUhHpqkD(W~8k4
zQfs|1Z7}{er<bpVK1J?<W9f-lgN6o0U&JFV8Kzud>oG=Zlhh(Fs}hV>)><j(Hwjj(
zklL%*c({+>Q0c2gcIAYk&Vk|WhMvvUWNw|5fp&cGq!UfRK|^8FDtr0fj)yDAxNV3=
z3?o;}tNE18-{xiLzIzxirO+c+P!-CB9yMaA__DHpI!BR4?{*eN)NlG|@G$_rapLCQ
z&!0nW{(mv64!tHq$8xj<IabIxnQrKn!0<kURbOoJ=|sFhl6~d}Zw=NJFXQC!t(pX+
z@0+TQUVV4hPhz&hMkIwt0~&$&F#L^|XU`<h1Fq!7yNph07s*9bcIcVJbEK~%RPr9F
zz@vQLsqdZu6ybGY?b-R+*1Yq!!VjQOaGnBlPGr;k@Q(WRVCQ1Oz;(uBhpp(sU@$Ul
zq_6~25J}5DRDA-tC#CmDWifO^8u?oiYL#ruk5_imjv04;N+>y#r5VzWJKnnp@r8VN
z%P^Ck_Gzw<1TtOmrRU#Yu@5^8yN;+|={m3bHt)6|7H+ihrI+0A8cKemL0$I^C|p&h
zEEQsym;h2XPX{?EWtIrHmW7ZEKC@j-7M<C}LLo)InH%g1Mm$qxOIDs|G)-9}C`r~N
z@JFH68384|Eqr@ihRnz70?FtBF$X$qMGZUsDL%X!(=@j<FWR)AQsm>TAT<8v-|hy}
zGJ_WE{3Fmq(%ydy=)qx!)eBh#3g_=KrRV#tO+}b@z`U3Dnk~=605-JjMO}mdX|n;z
zE9P>TsJ3IHKI^so{{7|xdD~;x0efmneN1#*2P`(KvO|Cdb)b<|p{|kdWN}`Bc^eQu
zs7u$umF(H1SpeYCO8#NUSP!$|P@Nnkb-a*>tNamZPYEHYrTV;Hr0^yDAgK%~2B!mG
zXgjwk&<KdB76KCnoUHUdV@367gDD;<*w8VVGriBwHLD;Z2;yyC<})z=m+acVc!PVv
zIJ05sc*`2JmsD>~AzDhx<8~R*eCK{*;wc&*b-;X$g)KC7Eh8(<J2pyU+J+jB^E6~L
zM<A%ZZ%+kg;W3xGt1ra(`Zf@z{4t~#X0h6ReJ&S|HJX~_sEHIS2HzcB<wR?{HFZJH
zN}s!ZrC*P|tUfxrylfbYBD|Kwyt1>M`re&TJ#J9NfQzdU7%6|!Ezu@$Z*5gZj9IQ$
zd&1%>Ro1#j(k=%pu$=F);%7$@eb6p5Tlr5kfb@au9`oy*iFklk5MNf$Xpj8J;q;)F
z>niA7wFn}hz=~pVr4(MK1LZzxVK=Wb*lI)@nysk8$gss9LDz?McggX6CxyN%U$Qrb
zO>^-beU)$#g#>$TK^9!pPwRu~Eww~0Sb*hnCO(!JIvRuOxjRcd5uQ!TX7MG93Us5$
zHz?)BBEzYj1XQ+Bba&j+3)StgfFKhgq>av#syvt)Zz%-vSmTA*#~l%fPv1<6R1Wdu
zii?e&L^>aDZ(@2lwWXm6sNgN#AOHA6+tRZ%bKHSO8JvFg9OVWGe?R9I`{KI!Y|o>k
z8d+>{#tC*h|7HNT=fc!9sWn`op&V1V^C$bF3;JuT<yV3Nw{PKXI$=JM<12`AN5(?>
zVMX8dvYG8Yl1<f7X!~db#5=d4Fxg9^;9h%YRnB<b@ioO1GXdZdg;a=<e}5kDxm}zP
ztAwpHwJ}#m1C3~oa3<JGi#X3|utRBztdNe)Z|M1}Ads5G4G6WPXwp}zRPbYjc|X0e
z;rM`n39Wxk*X9yPC<1Y=x?!IW;a~MR+~kwFqPKP^8}^K#m<o^fLIX4hj=TumYcN=)
z`HuJAZ!V;T?2i94{BXl7yK*j1-$+hE2_vPBQ)(*a^!_~2ZK`TB;8ctEf!kt|zSd6T
zfl*#a1;GEmDyaXrSC8<1jJ6jx*6A7Fh*$Bj(pn>cvMX*V<8XTLN|D^cRtC69a-Qb_
zmA%$>cdUk<`&ya<L|aICd`Lrf54S8U!lFR%E6)0U?$|Eya6?#Ml8U{*P>|^SYo7JJ
z`d7}e_ZS8vn6llD(ae@o=L^mz4aPmIY4uNzA2CK>kgkZ~sAwD-*;Lr<2o_#_SOC^4
zIF~qU6kExm7n`q-2r&ucMV2(T?o{^@vtr{>s|vO<mS7qB9P%1%SEg_}rN_&U!%D29
zepC&40i_3XLr$pOQ)#RuC+aj$hggkCGFSQ6+Qn!D)<2~>>eF)V5k$}OQbpJcFnlk8
z?lW&H59?_XILDo+=)Syn@r0xM1cVcFeMB6}%utY_DB%slvY&33K$@`aP&yY(zUzz8
zWz|3&beARL4nurHuSCQ{>JZV4^wYT)K`oa)lrAVDx}OpPu>^c&+WHV-o~(0DV?&pq
z_MLxdl|)kH)8P9RJTno`_>!`eNkDb|M>IAT0cug1yk~>n5Zf2{8f$7mnbnVsKhdhG
zVDnzpp(=sxOZhfOid#LO&}wM9Jp%VNi}S(lOiUY|*W?^icbU=ojNtfjm`9E3yq?_K
zMG_oxQ@Y7-&5XmX&e!sNr7OP59k&X0su!_f;1%iZ_Y?L)*60?^MI$0Q*M>&OM^T+N
zk>LYspXeGZ>d??On@_}4UaXW&TQJZ1+Ek*lnY<#BDOFY3zZ=w7gqr6EVDE+}I9pgt
zL{jf-XE^7i?Rh-x`Kz$i|I5*1l#(L%X&mvs@N}){IyYEQRc_nAtjmOUI&Td_)O&r^
zfY_YVVEpDo+jF<({)PgkgkQ%Fh1-o+Co{{yvm#xy^EgIvzov~Y+D7g$_Ol|xEuZ#c
z%S>yqkY~8sTl=<1l^_}7suC+ytq6<f_~|-()U9#QNq_OGu+{KIJWYyuIFPo$<Il{)
z(jPrqujsU<)uCqK?|qARYKtToF%^EjN0clovK`U40{~FMPc*Ig7o%jXsF{%~bqY@v
zElY*StSmch$^f2DkFuK1t4q8VIiq@4rD;p~pJ*~!b~rX|U^9Fz&YR)SyQi@Yvn)<7
z*j6v|)>f=sfy0#-&JJSCXNGn{oU%&3Nl3CrHk?gJp-bs?oG>-DKdetk0Hy!o`RhI)
zDD=COk)V}QE^y;Cwn*!F*~)2181&7*@f!^88|3I8awzFaWR&n~U7C8agCRML0(H4w
z9Fg*4BsMdkc}=^YXuSEz^!rIlR?LQZ)`+odX<i%7mHdn%P<`H)J8pax&d4+yWQIY>
zP*HS%jP~T{*o1<jSx^bB?w){vRhayGsfjT%ZC^Q)p(2SVs3G{h@#?cggow^H<$5{~
zH*ZHVe`->U#ksmysivP1Rkt#m=!HeM2%kiTg_5php}FO&m#g`?ap3fcNuo(5oH%mI
z!4kC8Ge}x#u~~lR=(S<N6)X1+xv~z9qP>NP3ht&alcp!9Yufx7b=*4in>;LC*D?NE
z2}(b|-+%z^aVzIeRHVUh$5IXLbymZjKJC?jL<T$b@o4nxi_*y;%@AG{3!(UpCSli>
zaXp$ofV{jJkF@fGvt-FEi&Y15tPU|9+(91`GxB+sRAo8soKr}F|2f-~s3?YC&7dls
zk?K7)yeHj{jT#I-FM8I#a`xOm7ZyvMpa3c@+LS-)^SvlG8T?ReT=QI}`i)UH{{{%>
zw}5N<NKCo*61_8)*!opO?x3(9^}WZ6vjJb(xiBJS6+dX$lKe_JtIkn-O(EmfH61K2
zcUOZEx~LTz5$1GZXluR<7*^ri3)--^)k<_I@z^egmk?Qb<4);)3%2>7m><I|_b6Q-
zudehAaR;8ZKwk2!^WzfScNUA9sG^9=NY<40B*s~FmQ3oL4tA|u9um6{I9brCV#Rey
zn?Qo+4!JbcCbd*2s#j-HTek=Zsp+`Je>hlRVMR%lm$tv&DqpSEW3oPnc{<~WPBQR(
z6iDneXdmq{iB{?Qr2Qd>m!__%<Cx)4bNV$UPO<S!pT`rfv7ULuA<`#!%3DvDPbA7p
z2g29r#IUapa^RW{KhaFXQnTf+XytU6X0D97kGm&0YS?yUNkm(jX-dX;0D{%n$ZGkx
zMIWu4h?26&CxVko?j0S+dyn5z8prkUJwXl3^BJhH&god{QRXLf>ke|5q<1C?PmxkZ
zB(&#Y^S)@<m(+Y`Nyz%Cd6b&P>AQ?s`HMt42Vg%y#vu7{Qv_2?m^t01)W~WFQ$s<-
z=|mMux#8{^fbnU?!eRa>oZt5zMc=<+T>t78oMA(A6{SNvl8~0<8};!@?~1NL+Q47*
z!TO>s_%3ss#Hy5sHv1ypQ_5(_)#-GP*5>an*y9$@SGnvHWa&xQ){$#t?OMwKm!@^a
zPc%)51M$j&T-MMkl(b_(+6664%WjSR`jroAhfgMaX)<+|)AlZT7__Gzino9iOr@R4
zCEct#x)$*vZ_dBTL@}&+lLQ0#-s%^!+E=Nng}cfYeS-=PL=zoBFO~-dX^L!+>!;M-
zv&`op<z9U+9GA+S=Vf=Gxc-RgVaqAu10%4fveu45aHbl65Z`h?cW@yYa_g7dStxQ5
z624#eUBh7|(^cd~#Z{YdwRx}FQW&>h=+(<hI@|SBi-Vn2kLawj@}5l~Yfp7%mENrw
zwY@fQaX3p#W4iM%MmYXDRsXv{&)?rw4hi8xx~JVN9wW?AtZ;osO28cIiv)%24yTF~
zgFGK{HVxj!1R|y0r0>`c<{c8N6sLVx)o6@=yGR9nhJZ?LiiICk2_(b1yc-d<H)U6l
zRK8RoX==q&-l`Ha^upu{vXw(TqKKq%=lZx+ru^W0N^M|AzHpyo54`5RSeuN!h`Mo*
zO6}_&$(jRnV94cX^lPm|vx<?KZCzQ32N8S+9`Q6;kZhHt!~k4pXvq9s=&hYfzo#90
zh}UdUWgN4UlZNV%%tEi&_`+o88H4<D7CnHCa4PH06f*?~e?rPo=&wtCf37H)@<E1p
zrTrrSlroJ(-=j6e(#ons7WZlo1d>l~NRmTdfz_o{;qHaZzoeG;0TKnJ1ullSj^<S0
zrDq$<oLCZRRZ8GjGc2%0At8@~I?Dju^k~5d&vIG9tfh|V#wmlBtV8chN^-K-hOvCP
zb-N<mdY2LmId-sl6$gT_tL~LI9#w_s8z-+VqY0;lj=>~Q6}|cuRr|a;gA(b8qT-Zd
z3tzMjNx*1OC0^3aIrg+3+!rFGTn>eQ1dZXCwH!1I(U4Xx4#@yJA}o7qZTW>LrP;IQ
zUuEP3d@DMncflfzK)d`-oUli+QC`_wVgYGg)?bPu;}QzLNMa9*_*!b3mp?&a`xEV0
zNeKvmZJT7-NNL{B#Bq6OVSxsb_08o=2c}2E8Oo|uDYjP$QS+iMKa#NsR$^iP@v3Qq
z!!q;M{Dlk7eR=^mvjrOh%WlsG4`v}GJR~3un?Wgq2A=vIJ%zl|>vGH7b~5u6T*?n7
zPk4}3gLwV(GBWFER1VFL#zyaBZl&81lNL}*SWjg5Ur|5JD#{~b_0m+t66B2c$Q3io
zWnpg;ogJxMVCSt7ZmbD5WJ<dKKJN>E<I~4$Wvv!i=xNrNT$=lj&4@%(Eh%k^r-Z2O
zRB^w1lyRtXk9`0!PFT0i0nck4g+8cg!=LFEoG!p)$2fH9Ae=<sxP%<&y~x?wdgvf;
z1+~7v)<92VbK)1y+^f&gv#Ew_SngQN%0T<*U27J4R0_MU7^#Vo(!D;F9Uei04BfFc
zf?xw`rthv1WQ-yrSHJn(zyEL{nyfPAL_uvyQ7bG^(vm5|nVmBKfv3J+S2uPWE=o2E
za#QG2G|s3ow++WN%edxs;`K6^rX_U&c7%tULC=_<Jk2oV;T=-a7E2!of19$buhk>A
zqJ9etQflXbzK;q<KU^0%+0S&MtBjqxFubXpe#kZycr0Wdpik3!!1x3YpAe$V!NIp+
zp!(<I{vS4qn|ho`T${%onulEt9Y9h7_M6$vZ`lc^mxlS$8<eDmwtvWx3G*ZqAdJRz
z=D>qzi~hVN(fej09;#=#xwZ?3Yy5~tStDQJnZw{HmD~-PUBoq)pqH?g_q=HCCQ-ep
z$~|J-XnA)I?uxgfq?$6dXAg2R&gz9^_rx$R3&O*_)Pw}dHbrw$6L$~9?lCn9X4?wI
z<?%tdshJJFTI!2xx%pkn_PCo-O&eXijvf6(dtwC>*L|1E9OK(-^eckjC}Ow65q?6g
z`cAfx>`wSSK08iqoo-R37PIvq_|Xsg6-<iCDX@Ygy6ip?6L}HTII8@9O+Ff3vS<AU
zoK2?zdOW*|FeY-=YswvHjv~-B`1i2o&tLXOgT(DQ)12|icp-QRYc2K{1Xl*6UT41b
zK{uKU->^S!6^YgRk_NcXh;F8>Hbq!*b9vOH%XMF7*Sq%dU6~8-^VZ}wVNjrg{J42R
z9=j$W^cE(Z+83)D!Q25~q{Bb6Z$;E}WZ*84c+P5Sw&zT`9PTn(6+6tEd@3lf3F+q*
z=*Ck%unVX^>?fmbs#2mC{l1VDD%*Xu&9N!qFE%igj_DtgH*H|&Ae2$kmQ%S~%B#Uy
zbynV-Ux|35k8ULpBBD%}vqVL8e}h;CTD;nzQ{o&0*tOWTv2)U_KCfwtE$1-{Ocq=8
zpf1m(gx#M)$zT+2#(?LnYlo=_Ca#U?z1U)A4vkw`h7E><4$E=xyL~lwDhYWzPWPJ4
zobD-&?xTF~saPVRP*&kj6$&m5_2}w!!kZmLs-*S^(JcYNZS+lIJ=vu|R215`<&+5?
z+W|cCRR~HSbOp9flhVA{)BDy&)xFJ|rJJ_Tc6lQ>p)^V?tBm&PGzQQnZZBSS;LuOG
z78ZBay(6pY@|74;(1v@z+$yd4&DG0+Cz$b%$#ghmI1V`Dp9s8WbRx~t=j#itFSOw~
zJM{_FrvETDc9EeBU(oC1a}jw{qF*I_X~=BO;-T#E|Fw6XQBCdLx(De(KzbJxu+XFh
zLJ5lW-a$f9H=WQT9Rw+xB0>-l(9k=C-U5W)o3w;t2$3e8fFMOd-6!uI<BT)Lxp$xY
zzW3ZQ?w9*5A6CZtvetji`OIhjo^w-Rnay@3TlL#E*SOnTd9oi_>nZ)zV47+*M9IvX
zA6Ke(D}+BZv}s)`iZFMj9BFvF3-aAC3h|bn5F0&z11qURp?6D>Zl0}5Wo8(wZluD)
z*T4H-ss~<E*n*`*0|3D&w-uoc&m=z_{7(Ee+dLb7cGaVrs#|jz902e$#2Kt4Ic<Kc
z@ZIraK02sAA*U_rnPZ)5aO44I$NN{o{?Z~wUt4J9G4B4>2%E9z3*aQ^)7qr+8E?V7
z>Hi)C<ji04Gv#Ngn@`p+rZ3&s5C0;=28Y$PD8#>c;{%Q7-j4-({ML`KEc<bHt7n{l
z_4Jk2Vc3*v4roPnbEB&IWckWyR;GLDvg75o4vfQ|pRnoHt$|_RM-y?l{W04$?74^g
z2RRM|ZRzuMD9&KGy?pS7yqbQD1r%T!(3vd8o=G3jSbF-{HX-$>BKQ6J2swH6vQPWw
zMl)$Glf|QZT%-b7>IDoJ`OG8wiCm=mLt3kf@Tp+TW{%T_7;3_|Jutxb70SxJYO+5M
zxd99Z7^1R!p!hpdBaS%Vk*BKfKU!QmTnV^v-WRQDdRZFSBfoWd?}^h(asO(NisBa@
z-LF&M`_vr6`{}JcmC`oN>~~HP0qNrqnPABJM%3c7w&Hn0k%hbKJ}q&917gcv<wZ}p
zUlAZhHFz8|Fw`$2|J@(F2nO2(6X`7;J<k)>kIQ9)&7<!Ig>SrxqiAQ5&2fIL{;CHP
z81hZ=Qt8qssYrf7XZ+coV<v~Z(S?eN;Iq6BmnOE=p-W-iRfUC8gLvnuj}sYuIl{Ul
zgA^OEDLS&4dir!N=w6Lxc$fL&kUkZI1ds#gIO;z)nW>X=;gmWV^Oo<|IIH>Y)k4-R
z!VER33GP4pBX+LVS()!dqh1m2>&ER1{Z5N7+M2&~IeU%`eL)ZC)*FxVK#W;^67ox6
zmF{s;5nL-I!i0%v#><G=Gpg_`qsBDC;|Gvvn-v3GTQ(I?&ink!S>rlHwt@SXmNypZ
z^G<0h+t9-b@1j5}00h`~f(s9yO>Bhm88OPJ(Qr|WxJd*Q4e>1*b@Q?wWmX9@mLOY)
zdw&QpKZDvW<hw=7Ms>rm!a=*&dBragO4-`3Cy>g@b-&p0MkcNF<bn7&(5Ognb54h#
z-^pm`uHjQ85ZoW~LERfZt7c<rXnjZcs8oD?m03af#o>wWa(bjxo2Sx%tw$K`97nL+
zF9YxzHRk5A$wK_I7EBg(%lDPQsA#qxm(w8Lz`RZw$o*TD;Y+no94nzkOjJ1cG43^0
zL4m~LJv~wAyl|7rjxw<rvVCAaGr02}=hyL(cnj{nvY?!Ex)tM-JpIzp@BJ1iQlCF5
zW)+rtD*j6EP3~Qf(9gsm1m-9mXDH(TvGmmqSKoEzG>2e$xAkcb7>c9y@lvLVISQqv
zYjxZ0!*LRDx_4dBpL=|oco|XF^Ca+tp}C>Cv2I{=W*$%c;OZE8)B(&9KGhfa{Yy+7
zz<!B+M1P{HQexpA@j1LQG1};Co++wbQsvp#;~Vn$SB&w<t0lwPVy%Zp_+4Z-Y~;Zw
zBz+U_fX%?Z+yT#ao&;RoNP1EO-@;hf92nuBwDkD$>OiixAWp}<Z8!HVWaOfKZH*%S
z;V+%NGE6JI$hXF&hnff%{H<y)&za%v5&9L@@N)7<`bKil)D8E*R~f3hF`IRoKeYe6
z_#Hn)fH_^M*luubmHg*VB8iysPn9SZE%1hjj6AF%71B1taw<rT!F2r7^bLwC)XF`H
ziVCy9w_cJ79?1&+jp{-%V2Pis*!ny>pXVxy->z$0?h9nsLvl5}!xwBzA4MZTu270G
zpBuMEJlQw~Ed(|hkpx>c>N3m)uZrb7pe(KwGbHy|JM7jWw9D=YTOJ3Cc%*6H>=9_+
zV)%P_+;#X$I#ShaRikU4K90uV`IEQIFKK{-k*hje<X_-^kma^W8Z(m@7WjKmzQuV{
z?8mK~<}p?~wUbeM1IH&b3vzOdj~J-V3xIJ25g#x?yn`l<MS7rtt8!&>oS?V1Boy}{
zZ|aW**0v|iewewSQxgjibx>-{7uV;h83(k!qk=JW5BOD6naMeO{p@pY`1<;WuwUx9
zjR}&^6<lgqCI=t|O60-=PIz1_#te4w1jV0%$Kaafl<{$TrN8UC|7Q9xuH0la(~Qc*
zvcIzqtB9^%-s8LNDWkJa$8`<~S@XUZBZYNowK-4vWiQf=Oq}p3mdpH$OwW~K@8&kk
zuDa2xqYoJU<$8De95~<BYY}O0<^@OoaHyPeHWY|hpL%G0#HjU{FiZU$m*ZluUMc2z
zI?skMDx6UwFf=I1EB<`w^wJ;@^u#EHfiH!Dv3vQ|UfR(Q-&fnxZVAy@0v<~@ZFu=Y
z<33D>#Xvw$+f};HOg!9cI2bW!yaD!8`_S_C34X(FWFFG(_Iuwv`7Buq2@u7@PS+Pt
zCEa`nB85H*j*=%5aEGM!hY@kS+rsFmY47fzQpw;;{bXPaMqV31M@F1*Hk^OZWaW0L
zSlwznRa8~@lHHmISDvS{mU8qOnnDYM`5<K;jj6nTih+J5Q>5gkMC8quD_iE9EPGIh
zXW^Y3;vGIM?@S;bNsRJ(wST|2Z;`TqC~pqJ-wNXnXx12)RdJCOl;!{q^7q2HDNp<H
z%QI{7WZLha>O9Q%%s|{n$nb`*Z&VB|(Nc+6W@H51))gM1OHOr?i&-0`h>7)XGa2wE
z3N-PEx{1Wm-mh|mb0_$1xRrB36NFh5{Z!g(v|~H%p71>xhM}(>J%QGqV)g;rH(R<s
z-$sZI7<)CD>dQTTA`{Fv%gpCIK%r{;!&`rwLa}#rFXl&yg?v_huH_$9&&$y!%ZNRM
zHXmAQx43WWr@CO$_RE)6HA|l;jBt@$*Dkc9ehj(k#E9_3;R~*w%**a6@@wmdBqBVN
zvNX1(*Y8a@EI0F?goJf!y$Tbr<FpU2J7g$NqumoJPLm(+AK~B_>tAQwc-<B><S|qe
zC_~;iI{L+W>2Ds(|BN`fH!-;tW4yH8Znu|hs7n!?FEl+vwx#=pZ229FTLlx*C^}Eb
z+@?H0LZpMwAs^h95c7(5HH&;zhhSfcd{$c$heTKzQhsF7CaoQwlMr5ev}zdA<g3_+
zGm#h2zDS=$n3UxkR$Pn4xA)a>k>z<`*Zs$trETZk99TY!YV_V&us~&!_ZsuTDdUI}
zF1b_q`)vO%wEXLaIh$7Zhk;$B5Ug+35yLei<^iar>Um3!P$ci-m}Ou)LB;IyUcRKD
z<Gdt=XTUg}gy+4f_-^`0>Z}<TnXopd2PzvkgKgwe3AP2w5?;!M&V!3u?gSIQEi%aZ
zl%T>06O)Kve$$(p18v6I1z;=UjtY40EoMZUuWgy;tM^*|!(v3{0z|dg)O<;^b_cI<
zj!rc-7INp6atBC|NxhX)RsF)&<zrmszI#s+-F3c41bbD%%gPXQ0&KB;z0y-mjO%Wa
zgaUYk4bM-r#^4X)Moj;(naAH|T&@0H+%z$NLOttI<8B+!dK^EdPsL}EoKAV;rfr&*
z7VK~{sfMlw%EL25iU4LzkR_0OHMZf!5%xWQk%{atqUeX5vzyTE_sTNqkarSuCYcA`
zFDfqxesL6J&VQKry=F!!3eouOWdrm<n&I4_OU#$i?JHZ5?LK(rT_8n%8c|7<6klO2
zcC%(qvTMY8fG|FOZ#S2QakVvGFlY5>4X#Obt<_iwM}@A^c2nML{N|GZcUE7y!8%O4
z;Z&j*+!miT!**UBk=Jn^e-fZsyI<*T(Hyq4A)N>@@eN*ffPhAQSML6yv}R=DM%3G_
z$PQctw!D)|Lum~d8!Wj_4vgvw+1ahlBsVQaJPqP!g()FWKc3AQH&48PgZ4k{B;}_>
zKCgWaJF`zlC!fSTZ1A|gFBwU^p7%O^wsGEM%XC0|`Gx86WoguE>K-$SjsPr+X|lQE
zM_lObc3aEMs1|i#oM2Tls#0Hn=73mUkn`S9ng1Nq#AEBf_`VozIpNu5{(ir5%Ps87
zyJ&`f<1Uz_U&63VDA~0)l?P>KFf1H<0SK@JH{PK(>%aH@Gb0N~xu5?71+0E_nF33D
zJ3wPaY#$GRch5f!YB96<V1E+8yQGZMZwoGA^ixO7P*eM*uj-hg<?*&23qb<uBrd>2
z8M4A4rMxOkpVvx&C|wg4qxSrl1DP1$N?mos8j6M-o<Qm{cc@eXs-qfFI_QSu^tLUn
zE2nSv3t(kf>w@K?1CYuR(^w{b!-vVwm|n}cl2+LD7;dyYZ1gzm6Z}KLk9_D{Q&5w=
zFiGssIO(|2FX9)5YE=PE=uXLIvAYpP*F0Kx(1js&btR=0Vb3S2m4Da;9pX}x2aH0z
za_8W$u}|gXk^%8pu<UHubkjxn3MU)<Ra1Hr%rRf{N7ZR(Xze_ebX6K0nO2(NpJ7_B
zG9)Y8f5_Stx9!CJ%#$bR=`LOMrB#!W44SloFjndcu+uCE{RmxF&mPJhei8Jg)C+Bf
zM=IMc8gxpZS-hJn@-2}8X<eX6uJ>y)5Q@m@HFgDiT+8s0gvjtV66xA)YJ{uU%QhHR
zH%^|=5L}JFv7Dx>B9!@~{>f?6!DX?D1Hn#IxHD9N?eR^<oxy%=5A!sK->BmxwJmU}
zLod*)Zl@-|T%8|9+?kU+;<GnqC2*}mUkg7kS>0At+{#7n&~s!TZ0X@`oy(Cdn*17{
z-(K+a+NXbZS{r%8I3+*)nf?(t7c=cWFUNl7T~XdM&yz(x(!0aB3{q6l;E2g#w0j4@
zH@^8?P%l3lx(EdN_Ve!aeB_!Lp&;tUyQmLjCbc;#E*H#`N|b-G+A}?isOW~Ai9`?m
zQBr_F9xO%kLoQls4iWs59fz{mzA$_lk#3QeYCOeACZRKEs=VU;DDUE*9IN@Eb%D{6
zDa42B@{=OMLD$9)cjvwQiUj`PUIz$XDURf^#}Sy^4BH-gTOwemY8%~NV3q#IpF4#+
z$gXA#>{`HalO{`HxqAdn<w#$6QE6&h%p&DBFaMls$K1R;|Lut`q>hMx#trEdp=7w@
zXL2E$aQKi_hf<U6gOfdc^45yJ?Nf=9GK957KaOv7iF<%+eHy9KNfTY(mT)CHC;#2S
zUQ?|K02G}1n4r%MxM>4>$i_1-Sx}SRy!T7>@Mz{4YQ*BB!s3SC*B39PN}g899gyCi
z{8ufg=7$|}TeVWZRW{<|6{kY|Y<?G3RTL5_AoCdT>|9?dLn^p)X>CyL=Ci}jd(H3<
z;AnK=`K5xsNbY<}mH#aa-Br<{q+|&6HQ&#-9+Pz?X=ptT%ihaTgn%&MEjJf-G;>=}
zfc=}kUqMYpWpo-E5mIU2XUb>Rau|z0_{s<gR2HC0w}Gy>*3MiOtzKLx&{Mv%Y*IN;
zE(<#FYx?+h(Yww6%o8mLP`BE89l)MgwkxK4<!pX)7oqS|H}dBkFMZuYpzUUx(*EOn
zMIms#bdxC}oQA3t*Q<!XDRzzvZ~naQN3_;c+8TZoQkL83n?3=$E5M#G?TBoh#?|JB
zqj}@m!J3}UKtHYxL`iFBQ1BtAQ|n!B8kKf-Ka_jdV`ZJzJ%P8xK#%9f;_SrYsw059
zez*agIw_v|Xf1`3v+Swox48jh_N7GKaz7lKXT@`WxJz)%BSn!m#SwAuPNOPp|K^E%
zkF919Cr$CCt@6}^zO^a8%}J9hv3gtAvM&4Wa=3nE$NUgLe~IDU!5CNa2#zqV9Kmd2
z)M(*mD0pR6I(uqOR5rQ*Ux<Yb+=bFN@@?@cCy)~S;%Mv`-YzeAxi4Zp7_s}}r<}I;
znlQkqNIe0dUoJQ7Fd>kMj(3%hya!y@EYoMIW(XATBC4bUk97y_2m8rs?)s%BFW5W+
zbXW&ASo)MFw^+P;hrxWU53OUvFb}My|H;F*)MRA74CuD~)u^=45jCS)EA{oLPcUbD
z0zpKgZHXsC>|XtdJYB?v)>s*oet?E`LQOd?c}kHH`k>w&41D;U<l2%;@jo9EEwA=B
zl#w?XVflSqHZx~qxgZ>XF6>Id5c*Qn1}vPRtw+4PLK2MAQmeg82_n?n+P3<z5_m1V
zNE8u5Z6p4G$#EF=R%<9g67uh<)iYT0VQD^-dg)|RK0)+9!YclWvWO~s|D1$C1dyv)
z&FsI-$Y51b#>tFuNxQBa5v<-;g?8wh?d_Z2cg}-AkRjQox;9L$#<JmAOajtZjI?yP
zRXCFF7D9fEFIhZ{PiFC&lp6ozDPWF~7hY#4Tcx&n>Ch(^%X96PFG))KS`Swn%=u1S
zw>C7&BXX?id1XLQ1S+xYJ_%<DIxqbtEhgE1Oc0?>=)Ju{#MHC!q9Nn*y~##&|N4Ho
z`o@uV4Kcp?+xnJq%1ku(`C37THdYRmxP<lW3e{kjvjiGtB>VC3E!Kn5n3$K3)=(rI
z3D$W241%=nT0h)_gl$@|&CM*R$`7tWg3n2A@=n3aVj8dcB78|*3mP47vX@=TZ?LfQ
z#hG1#ff0Uh`MCcgZQV|nA{9TtWrkKa&@ZzI@oW*#-=wd;p#Iw28mT)Fm(KzUDHxON
zw^#cVi*7tNH@CLcB%OK6<-sy?bJS_aIiRnR<cdPvQ@ZBpg@$IO{;^^N{xnnPp1my?
zTs<M7srJARve<T0l?<Y*xPLhK<6y}(5T=@?a0gX5?~RPBYzVCm3j3@eaThl0Z+{wa
zvS#VtV@{~3Y|*3;e*LZS{Uun#NH|V0cBq#uB<5rKT4e0Zw*?Gz>|PCupl@7OUbudE
zBzF>rode>j6@Luqhq~ssQPCAP4;hslR5(al?|1C~>4%_^L21dqZ<rpa$AEH&26Y3C
zq^PAhvY(?obPm}$>3?m}5yTA>Nn=t5|Kn$A_WLZ`ppz-B&&rM?+V0%`-G9C@(tR@a
zB{^N88%nRX;g>rB2EBF3qQxT*!0(qOUs!aPkv#G4%S&0!opK<~(30naNymVTE!4Q4
z+fJom$(s~(oc!>VLRJTWiyJm}*W2j}Qs@d)?eYeTLfBTr><%m?D$9}5oLUz&ptoDw
zpj)58?1xE~GHK+H?_ZD%Bn3yV1s<UwL77G!>hv$fO#aVrh}w4@3K7khTlKGwCP;ph
z*pZ(WNq>>eZvKq9;t;^)pFn@+Ep<Qr(Q;Cb3p+AA3|m3<kfhmHuJPQvfAZRk1W3FD
zpNSX%nYZKN+!XkHhS<5L4ivI!H(X5nn@r}S#eQ;MvmDG!v54{4FZ;f=s2rcRFP-_7
zEfMc~Yy{^Gn&)k6v8W_NAE%^nuzJ_q;Ma^k1_vRz4bhy|d-MigZQzURfhc^6fd~m`
zIyzmmhT2EbZB#}pt_Qy~lLM!?<0gd!Q=*3tpU#B+aX}i#ix}x5AD9B9OZ_LotcMvK
z6;*fgI^Lk8$!2DJ3Cp@PwV!x>-tvTs_wEC%p|xG^`z0K>x_9TT%S0@u;n%!6kIq^c
z-Drq}3S2cQvx3O7sb1*G`9=aPe!*MfkhUX2+0r1xsV~hXxY<U50D#%$_p4mI3oxe~
z0~EWpsS`HlvP<>^tc=vE7HuEQm+Y{LjR$YNM^YK#SjoK7qV<rHf|>`i6TG^VU2Chr
z!In>4BM(9W&K%BuM9D@&VCe&SQQETblk(YQl_}NgKNUM~;h)h_(>IK=#$LRfN8}CN
z$!=O0`=bm^D0y!PIiJ``^?eH&j#iWO_2o_N>3N39l5q9{qSGMgaT3VA$cHU$eDxoD
zCKmF!+2-gnRKAIt#tyE353<Ap8AE8THcUxE<5Pt4Ma+n^trWN}+sdtSXI6WGQt9Kg
zi(eTze2g>{G<j;%X@Ki^|H950?WbPIL}cb;b&=ONXuS?d_3Pt9o0j2Ul@jck_WZ8V
z)1*p;`);Q9?y(uRcku>o5(^1>tLixI-N8}bgWY%C1sn2HX0Tv*(0WT8UC9|y%ObVV
zruYM+5pt>@9PYT<+WAXNX5PN7F0`zf@#MbU@aP@HBO`t;;by68GcR-}?7w3EmxS2=
zTIy4?lbh$CFk5<nH8feO(s}=A7(}hy<wM^V#jX6JPk>!1Av*cR0ft~3Slu>5sIv-z
zwpKf%s?bg(hXe*2FTf1%775VD5fgT~<OUfk$_f%)^cWuSZ{#h)oTq#h$F@%yJZpBM
z=@5S;Bg(2wU?2C82(8&M);9+BpA<Kfwl`8ltb?57y@_+49Zwyb&_-XEY#^EnDw!L6
zc6Y<uy2Ug#*ptnRym(rT1{|wd&1ZYhRRuI8o~QiD5xE>K-LEsO_yBBNaIl1mThVm5
z0~dQ4^))dF*iPn~$rrPiniLgNPk_u)`B}J&c~_T}$Ms-tA@Yn)5VdJWhi?3H4FuUO
z+RZttX~$W)z_6y;Z`RATS*qJ@UWUUkp<<U8kX|ytbjL$ot7bKFN6Z`tua_4kKT#9x
ztkJ@PDv!m<gc<gd`Tk%h3lnWYC*T2FS10!$&PQaQGq~PrU)xwaS-1Y8w#jD@eMg%Y
zGAu{kLQ*mqA5j6kv2s@UUwhveG8ij5xeV2XCB%IKF$<(`1UKcj@K3fA!6^ccJ-Z_f
zPG575m=(|QX;HUNbnMoL!6jMKQ-`juHCVXwI$hX5^mPp*uW!^c?W1!`i9KMr)f=rt
zUd$!5Uaj*tM)SXib^e!dnSbhUG2_n+SjgKYKmt^Gf!3w>ZyhYn@~`(%29d7>)l?T>
zGd*|RNC3IwhGntzIvU)+JF%A3IJasn>XW^xOZ$*7n{P|Q#iS2v;dEU{Ky5#k8CH!B
zd>w{;SHIgaR2xlz!8fc;U&OS3mhv6G_TnHt32p;H3yykoyvg3VGKYH2!-1uFiIj|Y
ziVvQg$)C02J?kKe^xYqNb_q6A2=s=LI1DdV>F&5*@n;eUBy~tU7b@duOpt|AS{s@!
z>7Q9@mZ5MSrL8<X!O&vn3EAb}x7Vkhw;i8+Gv(nluq&Jo$ehSP2Ope^h9Z^d?mD)4
z@R~{ovD#@d3Xzv{4_oyn$f!=9{`%~3^``DLfNh=N<CU1EE96Hx3p|nxQ*V!^3_E0G
zj~FO-^WQ97(7$lWXtnK<En&7YH+}uQifXX=gI`?I4TWX$jm8yb>gPcX^V%FyiSWUD
zA9Vda=h@ypn&6jIf77^1Mv;({XCvxoYs9nXCaI*kxGx?>_*Rf$3{=UbO-M?O4tL2(
zKHtnn2!2$SZ?>=v0PH~ny0<+rCnKCiCd;6<4#LFpa9i5&w^8LZ?KsMOPmarpd{PF7
z-gQVKI_rJ#t@30H_*2H8Yc-TPWP07V8TPHs2;zwI#p;@KbVsT3y?mdVvJ!GEFh`T<
z$9sWKf2(rsq;bT5KD>0Oa=Y0YQX_wP7i%ult-9x48rJ3N>jzjn{we^tf5YTTpmo7k
zS+)gZjhQpEsGl4GXm}?RKh_CJ_>wZ;ERX-?{`G$xaO{rFqR2$m>ADuVrU}Yp)2`VG
z)(O4=__O3bs{jk4?C<I`&cDbg?jESwH3tTW^iQbSO13Z5q!l3)?H266lKZKFCPKVR
zYcCt)AIVQRS9vXLOW2vo(8=e8<n=DoypRlg6G=0Y$0-rhga>Hlv`pSY!^U)32?PF>
zZe!2xl0BqY=9DKbucWj%Ox?fDB(2UK#{F5P>ysymYTBra|DdQQq~_PMaGtK?+BA<@
z*{Xk?ls49E!kzLdX9hMj)D1g!plLqR^>TJDHn8{3MBL}+n?K!>TI9IWlFxE^r1E&X
zCK(%eMUWn<jmYp*kALjJk1ld6v#CMo&M6RrLh9`#rV&b2P%*~@sra_bB!8zK!R>j;
zvAeWD`VqHtTf@wWAcl&n!VW#5*tz3l5DVSSI++*JQQg+WCVNz!2?pmKD3)7<L@7*Y
zdBo7WLbdE<7H@Krx4Uo7n~M@TI=sr8^muKm!rL5p<y3Q)_2XeWpg3v;Mc!aB4pMnh
z(>?V{a_uj&v_bv=`y$Pg8ZU{mzM#$l?+`euEKxpl_;@mjQE+r^PT>sM9W%eMPve>;
zHdhpyAo?I3g}BH4;jTZN4*)e%Q29+ICtuyLbBrVgUHxfwx$^+XF6q>_Y_9eDCa096
z<Xyh(^dvs-qGnjV?x#(sP(<PruK>>YMm1hLF!Rvl8cZmVI)~vWlZqgwW~sZZ=m&e*
zcDZ+8d%0stv`t6*AFmi?FyEI~7kx&5W3HjZ;bUQysQoG+e4;wS9|9G6H#O!A52>W!
zefv#}`Ui+BXcoQr&rZw!?_Njc^8|Vw!0F~Z+%5VV@k2v;z+h(g<~rRc7J2fL{1=%m
z%kGB@Nd087H<f#Zp0nxGvAxXs;041<ASx#Xb<ZZEO+Ihsd1-KR*?nOaOFgo{kM6i?
z&`PTPuarIBaKoara^hKDx}is9>YVWa!e0NDq{|dJjwXRGx$y?{y8K3PQH#FDIPR+4
zYEC{ghdK*3x~jtqK)Ej;R6wX3%OZMlHb4uEMJPWsY5Hx}7hOpv<`qw-Ldz-%|BEmt
z=d*yrN<?VoYP368)GA9hc4}uW-YNe{=w~;e8&Kg@?Y`V};a7ym9m`AIbQL?JwY9b3
z&p&^%zjk8XZ95EavRF#CwBr~RH=%QkE1i5f3H`dDWN@7NF?}dKDy__)w-g2SdRpd4
zB1z%B0)%#Orn05}w{_ZbX0};^{gNp8!F3L`O0Sxhs$y#^Pg@KScTiSjI#j(kJpz`n
z2J*xc^SXsK`w_y$&9|Qge{RI*x8ycVS}F&VoT})RpTQArc1t9Ly?dhM*da3pfB$v>
z`@?W5{XecfK2CYk^Ffki==pIWIGgR?ir%}jg}M_QMz0pl>1cwv>(?c=lZSu1Tl*Ij
zRFp<HqOOM^^9k4y@u=Did}s~LhvgT?HWCX(Me{VST}2bO*5#T{twR{Y-CUljcn^Pq
zzDen9?K2)8Kq`Bsxkl~*9_VmQo&(Jp(o}pWQ=;6|N{|nnA;`_@W}opaqisz19i8s}
zDUMb0<i?klyUxF2l;qE0JAIw9SZhNzB1xfn_1uHbD+E~!3A`$)*a^!!-1T#oFb<v)
z>b2_)4*Ik<^yG*qbE5pasudbD8<f|ZXM#EM-LhnA(WOMRHZ93(37G6-?{M+PNq=1b
z?#<Nq(!&rO(R`k&T3668P*JgW-^S=tR|M)zLfAX5a}DG0!dc2$ay$~X$KG9LmzIs)
zh{pUk@tx)Gzy;q~6#0k8W$NtRA-quqRde#A9`E&^^6o)Ev|D_Barw6^&WY;fQ&|g(
zU|FxKCWqZ!hrK<UsN`9_1rV@bRgyfKag_qK_IM{W1dsbAAsqhUWx1gZX9&=IZ}*#-
z@k;1Of@8U93L7stU}43x;B;wkFVw@Zds?ordL^qmknqyfp(aao9IYo73pCUeYV&Z6
zGr7<>NR4+)ozUs~DhBAm`&jv$2j(qCkPxDw9t$!Yx<U?NMPIiLG1_J-4QsJY?lnLt
zHgjja6*I(FmmFPGB1PxHN7EwI-u5NE=e3&3Kfk&4ALSJN<Z<JZ<uRU{BMcmEPB*%k
zX$Bw*a=-#IYBCZet1$UQ##(Dc=i}G5W|rk|eLG#LG$edw_)3uH5hytLyEcc4>}sb7
zYR19>h4kQY7v((||Bi3~4<^;lseSqG__n@V9#p?sI!W{A_Y|t{JB}}tQfC{cU4rc(
zblxGWrw*erY5L*png#*prhOtBub>&na$R}rT8~fJzP6+!X>vJ^NxHcWyxvZo4=Z96
zRdxonshG@~o4w{A{JnmsDdBq#V4V1W?1%oRl&QZFubwiluc?66hjE)3=Lw=qLi)O;
z;%7JJEw4|+dfByPWZde!t$Q;h3j0j{cslWCEtX}hj(Ax_N+AyNZ#1>)-%8(QW*zKR
zy2jrfdca<J!-b8Iv$9hS427hdsWIlf*W;SiM#RZHUjJiVQey24Zl81ri(N4<5G9nz
z5m0H{Y}U#QvxZdqMUu&f&jjNY6#HmK#2#s|D|^4ME?+R)QyTx|lo{q}k=A&J1AbgC
z={p8;SM1$Vv92jL(Dz(eg8$yj)a73`r`F(6OF^eZemR>4x@xdH%*f>+u)5POi8b%)
zGIdrycg6PlcBn*Mukk<lW<{vrF84T#d0MU>8FBv+^5r8q*Ya9J@6AQ?k2m$rHP{?x
z2<0`o*>*JwboY06!zqXKjqE^g5URsmm=`*}-r$Lg#+rwwf6UAcuYKmt2ut>|EfwzU
z`We&It*)*{Q)}@n;(dc%?F>PTXwd?kX{k<hFJ=-4z<h@Txg<pl1;rP<r;kwfYEJ`Z
zgLWz$+jLhfOsv#CKX#hZM`#hJjBjn`IP#bYPK(>;Ten(iBY~Ftn_<<=7yi}oTWoTx
z(R6^lAkgN=+$m|iKNgV(P&W_6B3?H%mL{{{Yo)v0DB`qPX#;IqA4%s&ayqH$V3+vk
zGJ^1#1yzZ=ur4Wei!C*R)+cokY1AaV3U{rgi8C;)Qs0-5)fPdFRNc3AJ&RSWDm=Pd
z$|!tUa)a-MF}RcLOY@wXTF-g7Y0$wE_}&9cRwH`8%S+7eQ=yo)*NTcGk7Vn62@b_R
glwK}={bUaR{T}H5LEH8JZ}}g`>3{pz!@qF<2264-TmS$7

literal 40884
zcmeFZ1yo#LvoF}V1VYf@5;V9wG=yLwxVvlP?(V@oxCXbNjT79x2{aJg-JQq(yYGKz
zzPaD5HFjs-eQQpyI(x0%r+1&KEmifa+WY1A%PQdA7YS(z01PYu0Q33*yg&hB0Axf&
zBt!&cBqSsh6l7F19CWldZ_o&^urY8*2+2rE2#JZwshDZWKQK}f6Vvg0WMpOI<m4oy
z<rCs%7i8w(WdExX7!(u~v^Qw@=;-+D6vPzl|EI5)E&wJn>?B+l9Lxs*EG7&bCd^AO
zfb8`>5n%pt0si|10}BU_fQW>Qg8Jt5frfVgSQt1sSa>)D1bFz@r+r?(2f$+@U{SD%
zB4R5VB7JbcVGoGUL#F&x+l{L<bxOry<QRy8iuWF$fRLJomhK}xCl@ylFCV|yXK@Kh
zDd{iDDynMg8k$<hCZ=ZQ7M4~{&MvNQ?jD{&!6Bhx;SrGuiAl*RscGNS^9u@#eiWCK
zmi?@&Z)j|42Dkj`>Fw(u7#td&o|&D4%>Q0kTwCAR+}hsR-P=Dqzqq`*zPY`-|BEje
z0NlT^^?Ls|#{M^aVZQPO3l9$mkMtK`FtBc~1cwQaK*5HHC8~&I=z#r!JpdW!Q+!@+
zHwq<((kZTy;}j|$73UiD*<Y;vgR}o*j0OH*;_TlU`(OB41fapeymlTOCIASyxu?tb
zNB#fl{~;L^Z~_#?asH<#1t}5>S`tuN^IUbqNU60mYy|vQB_G*&M@qQi-gc5OryJ2L
zK?TJAqKdu6&mXiO25shI-g`OjOi3#FgqUGq{#m&wy!AbI7NTkWuz<1p2ly<YR^N$k
zd2jM#Q{ska6zJjMykau(0)Q1ldY}Zj;#L7j=-_hRtUttjZD9%*3RYT*zdeoxCX+4b
zQF*^Vqx#~vmy((5w=p_!RTUZu*zx-*_!*h9ci|d@e0Gm1b8Uy$laT%+(Ov+B^X}cV
zk@91CUcNuyn%8;>aNgqHW%wSd_p|l|;NJrC0*F=OiHxp!0Ys!klxuo6Ej(U5uCv_F
zi;HgivtPadFn8|@4(n!*%;H=kOkf7)<SEZ91!J`e{POoa%Z_F_A3(YM9#ae(7r1FF
zxDOQQ`TI@x4rJ#eqZezyQxqNpzZNxretL$i2fK*+liP<Gn+D!6P3N2Q!WTfN60xtG
zZ?aKOAHVG5`uqe4)bj#hZgQw+&&jVLxQ~hiEau0t3hh|{@+0Z~C!)afeFlb)$Hn$>
zJw(!!WNQlS@|$#UaN5~B>T^h8)<qU^xhc=?<Aih(UE)IDPdyHEvzsd)1O&W@G%Ans
zGz_C*sVrD=-gc=;1|M#JlX~!3x9OP8T+xA>lX;qb?N#Qv*Bj&tfTJk>9|%|J1@N_Y
z_DHtjs*r~@XEhlP15!C9LOlOSxfqisW1&?a-_Ni42ipN-63eal=~CpfNFJ9fD7;O~
zm?mXmAg6V#(XKETz4Mf{VOm)iv-@pc06uw4zCRY9@ps&H7iYs{Q$Bbf%d4@GHT~MJ
z^Q5G$HuOr4hN^$8cb-b>0<M&P#0$!Df2RxTP02AlWHB<PF3)l6V#_fHxWZ2&$%u1N
zN#knbv)2rgZ(_>j!bZ~l*QP{H>^{d1iZhJVmhrJ?-vlX)<!jQbiSXV}!F-!Eht4Ao
z*nHygGBIVyV}`dwZAb7L7tc9P2nAjRgLwl_XD#3e&UT4mh>#>&<_`Je$gZr8kF{0P
z3UO2Fw~$#k-oq}@j}tqQ+dallg-=;h=S@xD>D67$T|1qXrr~7tA`HcG6kz`MNY;J&
zvx&2s8a_p+D9%0|-1pQTr@hxMBWl6(;NxcBs?6DKH@>eX&7F%D=&hA?Zt*RGPj@Yp
z#JhO+x%q@BhS-OXq^okjxYW|svmrxk1u8B`wF8O?t3|3MEl3A|#T_daJ3|JSY`JX6
z9pY14nn<6v6kh;7vDf8!HM2}yGQ7u!#W7wUh-#m$gPwipV8?J2MG*cg5{(5d?(l6;
zFO3jHP4;1?XRx#9Q0M?n;sXxF1O<-?>4!6n<k$Xx0eDPHBb`2Acy8A}G*=u4pF<;t
z&vP3A!u6?**uN`;-51ZRPTRXCJaq-+5*5A&{v5zUpO#w2Q6HJB46hE?0!`s_Lj}Ga
zeHG0e@SbFdz?F{57Ph+h22C3~pRgfIF!niH-Rxf(IOAH-UD=y&(eeDEcV`QmFE!|z
zz!2W?Ge^G73l!2D?gw|wP|mLr&dXiVdKamzbgQ|mM|4JLRU1z8OE-7Zc|}OvnS8q~
z0n&eQ$W*$R(u)zwFy~49#NZ_IAW`vy_DrG{VfbRJw23_S+6faF3aVxvC7v$UmbmsA
zGZfgJ5XlFxtsP00oSD`5qzf1UFJ*am`Af)XBO8cc01XJ>7r>%Xdx4m5<jxD=r=S@A
z)1Qc-oO?Ti=odh4a^VBZw|Cwxjfo#$0Cw{6en~(4`3V`aFCI0KR%)i1MUGP)Kg+Kg
z+wF+VH-!6b9Q?WoBhi{(|0uZzPI^v)nVix&J4?xU|LEIYqVf7~PNwuF_svS3l@@#V
z+sWnT4?v~*7Rr)9Q%B)kQaZR#|7wK+Ltg+GG6>LpEt~^$-yP?v8k#qWF92B_XS?eG
zVKA|}xH!Pbl9WQ`Akomn_L@JRd8Z+1$MFT=%e{MW%<l#`({{<KuxLylYbhFZagVt*
zi)b8r^V<DHCBTWi!HRMcqZ{egFq!$`rc5Z43oen8(*m)xG*IFws1M*gs|1&>1)$51
z{4Yh7-qhU6;XufpP2E8ZL(u8tb;^ASPx*y8^4OI2O8a}<k=wAI{7tUqbl(R8XR?7~
zp@Y$Z$qa`|bRADj&KvPDqaCSG_x?P>*5u)YjOGgHPzAHIOkNSWLXnoL%A(X&m7Z6`
z4~=OvrY-dH>|9S3Rx39`pUH%UF2f#Jc6?7vJ!cO0nck1h<(^i?N;*RWU?R5od+clg
z?!tsqzP2RjZ7rd+YYn;MR0?Ix&P7qDJEI^FuhP!cI#uZdw|56l%???Xz0(BK=mh7u
zo+O`{(81KWQ+N@+1drFg(`4@HQR9izjPpo4@!o}u5oP28{#}^a)XYlrrx9TIT)q3K
zN0Nug<wTVLhTWG^JL=_LhGJ20f;5i@=u!4WFKq1(hInE3wiMiQ^IgtE$FH_U<<c}>
z3AQc8xz2O`8K+vzmNVVlKQuW%^mF$cF9ca`5#h0~47K<r8f+>=DSN3RHS|Z)S4^Q)
zEKx^>m*j!G<bf!-`G^cz+0^xCN13(WowhaKY2j|8<U&yHQHXuHF2jHC?&e1t{AC4D
z5a4rVmALy!&Pnmyn-=xFji#d4^y%&wy;n=dff;WKNuSxC=E{=mjft=SWAW|zF4Yz3
zXY!A4o!EN?PqcCkb4Da4KmBOF`pxt3z5oVZ0H}L(xo9@P-bL2}r)%-}$`gk~OXtv!
z4*R$*u@3Rt1f=<;`~2de)pncui{cKXj_{FhF-n9)Z-^nZzq#50Co?pODmBCz3}7dA
zjC=Es4}T;l9)9`rM>23o%~v#p#C<v<>6OIR{#ryG{sO2k&Kbx%l(n4vCsn3ucgW<z
zAZ=quE`7A6TTK)difa`K*vxBhJuTd`EdO#tsLZPE^GQw%%N>R73GQasWAn-innWBm
zV;;zmW)kWSkt$TGih)7HP!Qc`NRHk-HC@ymouCcdGKl+n)V#p9N{RgfV4N`W-CI42
z1RRtUD#xKS{Re~UUm02d!_=j%r$hp_yrtJR>|@=GaysFdgKnP&+8xrxE8INC8XCG8
zh=lP;ffxftp4*5F31=*!(cL`vo=464->3Xym%Ls8{HJwjU_ScGxuce2Q(hNIQ8z=7
z%a8WL62YuAfI|}r+g{|kd*x>KmO;SRn6VI4en=jKYvhX1FM~4W4wW7-@H@L<;nuBZ
zYL7L-6y`Y7du%~6w}QUgO!Y$^5#8~hP1=WkmN0K2yhP*#1=78N(WlhkYS(NMbk)Am
z_=<tSc;Ryl7P#XHw$J2%wyK;TS-<yMJP?8J$bmO=&Qu`;w6Nem$S;5&+WMfcd~?iN
z786fw3Y6bY=>s}f%^C=%rv9UQ3iGYf0(0LEcdRYiyj1i#|C}vF|60Qji*(;lERb@V
zYpAHzhD9yFhD$2dL7Xqfnb;$~cAwvbR3($N_e4#uJ^x3wMG+ON9<=E@$gv<TXMTw^
z*bUL2D`0Ri|ED*wJWH)BV&k0U2s+f-^a99Mf=P^3B@e`~7YF^bEvBf`jXPH#CyynA
z6REi2kZj;i9<yHb>Zj=nd$h6n;l+AUN*8~Hay}IE(RqpN%=*1?BPNxQSK)&#v+{K5
zC@&r}b$ORSAc2n^n}<}36z7GhN%*$F#m0?0s9a`SPn-GH7I|PXZ<p+8?MC|#lK<=c
zqW>?1d@$(i^%XB>MAU7CstQQRX$Hp5Mp`cxMZI@e9CJf+!$K>xUghvXTJ@v<rdcoZ
z#4Y1NdybQA#}S)Uj);`wpyP5h9`EAndf-MFJ%iu2TR$iWF~&}frG`NX^cVuHDj+F3
ztY_ho2+K?y5xGT(85Bm!ylbuD+uX?MRn>Lt=hqLz;+~BfB96bym=i?>!~JlSlUjuZ
z1?2SHT)QTYIQcw9g9Oc1q_5sf7ss*FvuY$#Iw8n!&{7ujmNTsqwCUT^&eC><4)$!J
z*nP_Q9=hsS8r^s>Ai_hs>IRrObqhbbl8M&VZ>Au<-e>UgQgyMU3}%fc@E2PCom1`0
zP)$lbh0vV2-)O`b-!__S&+ajihqO0lOzWQ;^SD%%=ZHg=08B;B{~SlhI}Rg)l)JH#
z(9^}L$&otC%>3q;kukYWg7Nu?Il=gnFHlQO#7?-gP?Bn@qrkcvQE-ku>W8O^vU~)m
z>bQ%xFl_D9`K9SnakazXbp^PM00;5{Fn@6Vg_Aacilc-%f@kDD0xP{C^qdBA|M1&#
zT1(9F%+A^8fH1Jg2y@FGaV8)$${<JXV*scxRqp<iCFCcjQ<)SKrKw<94fT@GJHAH*
z8z{67WP{s=j71msfo>Oo4+|dSrz~}ETwksAviU$^j?E*mZ9u5@_<ls^J{5QNpQp;-
zE{rGvKBuAx@pwhC#2LwtIx@T)Q${-#ubgG+E3_|9WQ#4Te2SX)*Xb>dAznuAmiZL;
zF6#RgLfwF89E<lms;AdkzDrzvEmA#Gkx{V|oG=A{H~e?0u|htTq0|@&lEy>-GWQ78
z99-q*Q@c_l#@stbu$~ejNXM&a=}&JW)eJQ;#yMph5u?v!f7MRM$U^9r^DLzd?p}Jb
zhP*YMCV`I_tA4G-oh1_2i+-Uk{{tFxg=WY_Y5qt`Ai|x#6_PqXW*<9wO~0MEW~H6o
z+|5bEIowx7>X)G*IhjfQoE^txPw`0o6G0Nof%Fr&Vxq4)<XC-jMOXaYt3e=>GyRv5
zo`uxcMAlQFiQ$^E`T{si>inI)x$0BgdqG=LS0BUniZz7+D*?`2T008$KVyBCM_Fla
zisHy0$4vZwQJAwl`dSgTFPv;!VU+++ap-|)Dv%DW)2qyE6GE==)Mrml)YljCc_)7$
z@-BzS-Mv=ZN8C=s4?Wn<*^e$r$?un}6A(|Bc<$Ayu$7udc=Ya9d!m2NtFk1d``p>t
z&`5hMaSj+eET4Ubt(%Bou9o1;LVR8&P1LDgFn;CX*>4CPKxTEOJCC{7Vj2hR6M_!+
z?3elbZOjhUkLmQzSowbRa`zv3!%G<;a$~;YrznRfOw$S6)2eLDA~+xk7B-H3u%sos
z-I9JER3FP`)*dM<=fa0&g+*}c^QmdL^Yk4ZTo&*&LZ0QAsoGoKu{erjMFQjD*gN^L
z&qfR>ygDEAQ;HUP8vYx6?6Fu|Sc(@w$H5O36@{`q6*K@M0H+=%y4c-Ve&)F2_vcjg
z-`%aPe(d_Wv>~L!fa}Uk)c+2Z)Lpg9a@r6cD7dg}=Ftb0H;F4AO9OmBpTLy{B=WtB
zwn==U&}W+Wlut9^Nl*GrF97RZII*4<<2`=r_WE(s)gY$cpxbRnP3V~sNG;}H%|u*;
zxmj1&b9uI23wBvp+u_6P$gQwwCPIa8Hb7cHrs|V+FY6wMBu>rX*1SEvxaDE7bA?eY
zXS!oY_)L3(hIMfQa@$_~8!E5H69Zm?qx1{?pbqwyGx3gMt3`|Y`r713wxrt81cBgP
z;oXh%s`Yuj&<pA24h<bDsx4^(Ucd`LYg>?r`Fp|2AE*XYs#v)*;V{u3r-qDW(%{*-
zJ@abD@X07U{iJpmM_s7o_QxN&j)b|REwiuQ!xC>Lta@7>*(|2^B?!=L9qKXT$ALwp
z<DLSxq$^pA9ncI;b)ez;h`>Q%)A?rf(wdAh{Jq+35#1N&Y4Mp-!pJi>yhyrI#=qUO
z@{-?TWtQ`JJa1YEHY}FBFeArL8!m6Ol(qG^4<1m^i>83R2T{OBlrNoA<+k9~x#yv?
zkmU7D(K40=TDanL|9aUwJLQA(dj%xvzZaqZPf8lek_sQOK0>n`XX{4@xE&5?QZL5Y
z8Cm5T>l7eD#Hr3}*Ct<rajDBZFB^WD@GQ?R|8PS_cKh^ZZ3NokBLB{c0}jIQiHY)Y
z=5+!N?84a|Uqkw_xn3u^1b^F41hVfH#v8Jj<BU5gk1v3k=(be2=X-I6``POi%t<C1
zY{|mKwvA`)(QNC^8|YT2)`BW3D<T5G=>>3_pfCFZAoV4fGbKs4qsM$*MubnMgPhh|
zW3N2TQq6$vT+m_3M+5~7NDCnyTsEP3ge`FX;Cd26MgV}ZL&<ZV>#j2F<WUV$7cMx`
z6L|p)iZc9#ho7zHyv0JhS9x#!R!q-q_1O`Rs}^JoGRk0L$_oItVj+;lmH&mG;o|m<
za@VxYe2MQPOmTDVQs7T`MXR(%=UkpRB+en%dsv#lxnH?$34Sf#QtZ0aMB3)s<Zv&y
zeK@|@wYn-09KVNf83rpaq+xl%bXWRt^xWGfOi))gUu?brv>hl|7>l2Zt!p1;0p=vi
z`mX@)CQ%_%l4Rk1;#x;O_0IFXDQ7_sk9vV?b=9AxAPAA!1Ec=!&cq$KDkc&zHp7X|
zAj#<bB)qtsank1CfAW0c0*to&7tk*SFYfrQ!BfkD8YCm$&3W>d-(D0|fAcjXmEA3_
zg?pF+zj{~$(bm>#lbh&%7fHbxZ}G0D;~qb5Xm&BstVt^3ib90;OmGr0<X>TQrXa}q
z^6vaQk&sP$?vj%W)VYdE*L9E(;krASNhBhqi}x<9QiWx-!dz`B=0RhpULK8uv$9m=
zEScW;ZlJ@{7q_-V%c3Q7gnDk&bkYVt3AJdgQtm>rspCPV|5GG)R<1GmJ?a)Ud&9^F
zHUNg!ZbB)2%<&kpf^(iYZ~tD_SbO6)n^%*VWYmbDu9-l>1K{#V|3;TZqz)Xj&X9yf
zF-T)QPXRAC10&Qe^^i;eOlBITHU*l2Eh!ImY&ab`k0!u6XFq)>jH}yboQVz^o3pn$
z7=z&={Eq^(uq;v>Eh7wuS3VI3wB}5lRr9ls_S)L}t*Y+wyMoPq=o-U2(@Qhiulh`d
zEf(~)XOn0$w(88;-UfKtR7+B+ja_RT!>BO|@7lKeFtll{6KTy#M)(dg%g0~mW^h+8
zFGraZRIOPZfLr-oDUox*V1aMqIO=@A|8^vCgEo*&{Lq&sP*bu;D>p@4n6QxsHtJ*h
zn@X$7c2&FRC6I-7VN&KXm$k(mun}Wa-bM)ovZKrByZ{2zVo?^l#!?#ofaY_S1teb)
zw|UY3_hD8V$x5}^VvsKXx-)^rh8dXx!+3rt#E#mIX8l-V|FgCGBLYb7TS-QHg_C-3
znXJUT_2p3yBtE=*8|;UPE`JCC8a>E86_1`rjN7wi`f{eDTG<ruzj3#1`;`_oD0dw8
z!w*$&VtKpysq=)7(c=XW_9(yZM|69jGNT~p&4jxYIRmW;Nq+C&VL(8>!K*}+o$H|2
z{$nqNQ1xfGAqc(R_|{l~-ABIkhO28=%dDtKD7mPzVXi&Nk>z-nRe@vNuhPan-o@^S
z>j7i&v6|6*h$(7wr+7_e_hDFYFeI`~2do!n7=IukS?M?#E&q&35cE`hl+mHH<F`T<
z`(>xHL04@=G1|Pjc?lmWMva#IfzUp8%S$Lk&?t;){Yr>A5=m6t!1dqYZ&e!!*M=Ee
zbH$VxZo@0sboEKu1)bV|H0}|lzBqRny}6`2{3I0}OXgpd+AF5a{qN$b%MPjn5-z&C
zq0lutis2W(r+%L|yXiR}?X5C-rH}I{dU_mRBuhoE-PXkMQNTFX^Sq~%p-V{CEgdlX
z+~;#WQGb`==eC`g{g*)dYQwY%3$cb%o0$U^njCX4g_m;16AE1CAVKcsbRFuYD~saS
zUK)9pddh?d?9$O=0a2L_iORO54Fk7vRy!(Wh7bD5TTyq^wV63zvN22jeo=Fu)IT-3
zjbxrY^qlR<EIgE{FI87~jSE(bl@4ANRdY7ZHE1(QaAmKr{;a_uu8=1aJJL%kW)Rns
z%c`DrW<zZ_tTeR9j~v|n_aOe)SS{u0W(-WL`9Dx4Xtx8EB>`$VkujCOmk;QR^Rl!i
z{(MEr!1scV!K(uMt14|t!tav}81=8cL!>=?!O<$<-tTk3@|E!9x~M7V`h<3r=q9CK
zXumz?z7lPPLF%DenQ|jL#I3>|B$q1x)^@#9DvqN2gM2F44P^0>2~I{9TeNm2c!EQ_
ztG50p8{;7oqx2OY*Vt_gla{V#-_K=Ez(<Ae(D*+G=`B6VFMwcCz=J&0&1v43=h^3@
z7ZY~J#{EP)-Ff@lVoFF<tk#A%FPB4EY~xei&~HCTO27M6#j@UpdP8Tk6W5XgL7Idc
ztB%PAS%^~Z(w*{W8G@0wZg`$_eEGGHTwYwyF$v?)LN$8rhu<gKxJmizOPX^irG3&a
zuhJ^a{X2?UMp&OxyEomw|Go)-CD&!sPpeb2rLQnOG?lADTx`hyjq^S_FZ8=kWa^eH
z-R=#c&gt?Cz)U;MU$K*tV0EJt(p>NYAmi`@>!t+c>+C5m7fxUkh(K$y7p_RJMwTt-
z)vV7a-sIOn6L=@)Ppg90iy4I8>S+!q*;b5}Ocli|!Y~d1P!BmL-tKW|v`X`(fAv0m
z`-kyKz?W-SW4K0Nlp*s2FV#jPsAx92z1Q{PvtrLs!*{PJ?4Uc;gWiwa39f=mEc9}+
zIy+ZH8aB+DHaiz<6C>pK6HV<_?!afUZ!Z9y#kwoLg1G+p8Uc<>XI#HuWamWs_uF&4
zv8(%_;3kMOx7Nw0XXtr!xli3VwA1cvr&?cYUk!|Sy1X{u@n^ed>#1O@U(O-(-leJ?
z6j{xjS+!FTwsQkcZg@5SDq`aPlI39Gk`PEhrzK%Ts<}CQU0gru9?KyI(yT4eZgy^9
zlzpy%Z~J>xWazrGbjs;l@-<(%k?Kb}t)uMJ_yYw!ZE-J4uKJ=t86pX&+*{-UBnY?~
z8(sOx-p7C0`uy3BD$`u(OnwHj_yvHxe3NsX(_q@xe)s1_g6(!Y_2-RB6`97(5}#(@
zBhG2xN(4^??JTKemR)oLXK;d=U_y^jTFqnmyrU2(Xvzp;JePX`IWx56pgDrdlgRHW
zg9@~se`hZG)D7Ob-kCN&O=V|a=?$!Gwa^~u?Eo1BtYfv<g+M7_!kotsDbM<gz6;H^
z{ccylXd_Gh#v;Tzc#fs7YlWC?j<rH^0+*Z;K?ycOf$q(}q@`^=nQ-Qg<SO3Q{5{<M
zlS|mD+?w{N5&J$vwi-tPX1)p^)IXA;+sZ$dI1_MsV5PezrW+bG^ftbNL#dZ3dxr~V
z<NKUe@TOUu4~ACuF_^Rj;hKpv9|$3M*N(GWrG7SKuFpQ9OYSXF%p`*0UGM>!iIK6-
z*sqE+o6T2N<Gn?7X|rMcm>9{Z{U8YiOwuOy#6@L+1hWA5sFjg9fsm5=1;5w^AIv~J
z{v%=f3TKiJ)IH)6MAg1hGx`EB@d_0kp(7i8YZc)>6<H6@Dj4X2Gl$#&61dOzZJ?TQ
zRJ$}U)f#2CUd<u${ylfL7oWc4!k~+A<w3f?m2lv=B`Rdk2A#ppS$nd&)>T@Z9D0tC
z=n8%dP>$V_hj0pg+Udnw>alCVGoffI*#!taMVrbob6Cms&+UJlQ3~8v7ciVun&d}i
zfUEh-g`scEt?9_IZ$fXxCU`4pI>2RCW);_VuR6=dyhlo-O3*Kj1KFHdGm{9iDd=<h
zIAcpFjq2T%V9#+`rcTP7fU*Ll5rh>Pm+k}pYLPw8@e)i`@UWU%lUwzesI4+P!oA`_
zV`ulva^~%ub#s#>wvyvij;sT>zW`7&b1wQ>hDwAv;)sdd1MUg83&2t)SXAWfm$W%M
z>TY@<#_2bb%_hV@OP&o>TTle*kM^TdXdI`c^{3L0HZ&d1p}q3OToA3X>kMA={y*GY
z-kv6AZOv^KeOj>i_M(E3yMn;Vm61}Y76EYTtcC*4|9$M1CM18o8aJ;U?Mud%4bP^9
z6?e;<{b`}O5o*ZR(rcCl{?TPsp74=_R!3OLGU)s-L1GPx*(pw<-CS2Kc&ey0F}i@A
zS;iRp7oXOr#Bt-N|F+O5c0nl}4U_unZeXx!3v*!!ZS`M`6<%`nTBVZ~III&e=Qk~*
z#7o)i^8&mevo@p0hmPyj!<9t)HXu)^r92^{Rd=cb(^W<Ftt{EId*2-wZ8UIR{B<cC
zxZoNCCgaVq*;2t}&P^8)NE{!<>$R;hFi>wh5A-`43xC#6RF;o^{gwDVgwZqU;!~qy
zUk685go?{!%PfxqSK?uFoyG5{=z&VDJfel-n*!R%tg6C}Z8t5%`o&(S?;kMJ!uw~s
zk$`LR^LaBx_0cW_Umfg*;~d5@UI2Q{+Ok^fy{vV{Zy#;@-#T2~&#P8I^+3X8HSWe(
zU!f)j$RsNF59uQd%_`Enwg(bLcpIhVd6K4hIZg6$Lx>j_WO`S{8Y=`pvwNh^ZH*Ub
z(*_8TVt+M)_;au!+n0W!^)-s(xQGFNyS*CERA%2q!R`ym{yMn4l-szqDqNs$;~yiA
zQz)N|>Et*DaTRalv-AU&e|Md#oR3|1a;tme^l!grXn}NQOlJ=vbl=4oZ0}<Ake?fr
zKS9=KNBeA2pd-+!faS~wj4w;<`I#IrS7l{?1g85nY*nQhmez>6)BS00QZ}HkmLuwR
zHM8-|2~Axx)LTxq@tmDu`s8wfrPxwgr8$rt@R7*7bG#NKz<Gf<(OENXGa)y@kKcE(
z*x^Yp?7V<h?sOSaYKXgu_31;BsTdnll@NoU=;;<D)z{WM;X@v(e{h2I<Hze2B0OY@
zrnzH^XgSx9U5|CT1o5!28pgA;!-bm_3kn5a-kwPl!!7Ih{nFmLJ3o9dAactzcKfQH
zhq~prM)~c*{P0sZ%0;lR?b$)p<#WRvYRmle{vv^)(oH49J`;|jM%G`s9|$D6OeQmC
zG6NrN9ooZeC9f)u-ZIgz2&Bx=TDl{CO&rj1y`O9MTm+4gt|Mc6#~{uP5^Q=x<U{L6
z#`sqrj_mJDXKn5R#$hh+A!RE=2j_eyf1318Mgty=KkzBTi#*e0yiVm;n!xX*sj^Ad
z+L!GiXLk7f{+kV50$pJ9t~>AJfy*amewu~gT8^j&ONK0hvqJyX?)T3^Qr?zylz3B3
zg6HDK$*ps6OHUEo(3>pvM<g!Ev2e00e9DzrL%fQ_&a(HA&2*b`PmZ~y<0zhzF(+A@
z+!uh&UG!_f-TI;%ns{?DQ(UQby3*j~ReFal(?Ut`D~`AC^F3+4x9oLio$toc2ib@D
z<KuCM^x;eoousVj1KBTZN$Tv@M@g5(%IcN;HT=K+RUW{9LLI7BeKlgT3!}B_G>s``
z?Q8T3)he~=rjB~_=tG4EAfS89xh1HFBx-`+F2dO8V4rR9RiE8_0fUpB55(XD*n3L|
z2(Gy*{KA;tYDGL)JV4Hm9eK#kas2vAKId(V3laENjc83V9ocNQM(6mRw8qECPd86w
z^B}>q@)4`+5nBF;VRWHMKX82kh=F6CbxD7JK4q*yqvv#2L#m-H-nds6sFI<EzWJWQ
z<!FzKBzo+bu0F4|Jt;1z&)?FxbrQ6vdE=I#ON_hdzlmC=pqRX}?NY|qlT2%L66&{U
zQ2zpOe*x^$)HhTbD>R;=K~9(1dr1HaNCba@c4Ma#q~r}7ulXO7vd&s5dHLeyL%4H^
z(vAdfydsYFY~#MkQR&yy(>tGyo-1+3hF#!tiwa2)m>jax{z@}d6;hK7lWtAnrr*P6
zuQ?PcPu6={kNM@6#q+B~rivpzMw|=GajQA%F0b6)(UE0aMX0KA4g*&O%5HuE#1%XP
z$6JnIFQi*uW%(cxD)QZo9#O(4S`Bi^0Fp6pi!S`rdYr&Ev8Fw4DZ6K!lFUOd&8IiI
zzOHcbfi$X%Y`iu6WNWH2*ba6KaHlX3V&DbK?@M`JMYJ8=y~)alTXlb+qlH`?dlR`2
zP0j1RtQxLWZZaP08CE$ys?G%^47sXpn?~zo<taFm?zHpt0ME%9?sJ~t=NMXtn41|I
zU<PsBdh}l_U-LvdFR_)ihNG)2!?xW+Xrf8XHD{UHM48%n7~?`kaA20uuB+Dg6m>cZ
zN-W~7CUEDzy^7Fr4Q8lofbU*iA;-0OUps|g<C2c1SYY`6si!1AvUmR<4%7H-!x4*=
z3eQdauW7&XsLa+EKuf{4T^C_N)qbizsA;PHhw7}Y%HRy|F!a+~v|u;BHFfYcVx=W1
zS?$!#5Sp2Gso%WrsN2|Ua*kyz?=|t;E(HYn+b>an&bD$vZZZoUqc!HwF93GJohon9
zGT|!q_jpz&3N}A}Yx3KFNg;j2hO`3$g8Cfi7egcPs!o?Q>XyP3bjbMxjWeGZthifS
zz$1~eeOhX><r~1OTEBU=$1$h(Kp)^T?(SktEaDHvALeR`{wmjxpa~b`w$>C?__8c8
zPz(Bo%LUIc=EsswYJBV3T>9dqF0{gSRLaC5DqwfH%tuDWM-4H;P-At6y335p)0IrC
zcZTb`HO}Xu4&ogW<a-rID@MwXSeOaY#>cWYgPBls`jQQ4Q5ppjQ2iW>t+h8((GZ9&
zVmLnmuxVYz=(4AKc*BjiLNt@1;6Fy%iwYYQ)Km?OmY}Exk^X4bX!ry&%8p%U`l{)@
zNLpG-GH`Q!Wcz;aVz@ZA$bt+<D(9e0pmN}K`JzmG0f@Mkx8Pj6@%ujDe`P(Pv;;V<
z)Yk|x#1!{l*6t}j6GFCO&Qg+c4%X(F&SuAomgr+|@y0qUHR{jw!%m9MD;qKhX!f>H
zW_g7(q$l>Y@kx`lF64jCeqhtn(q8I!hjNMzY>JEK@i*Hh?eEA3UY5ih0gw2Nueo_J
zuwrik0vPKb(PJa(ub4pP+E$9Occy+ADLc=Lk^|4Y7H|dm;M(<WBiDl#o0ab|b@4me
zPu{)bQ^#u{Pss7gH9|JTVmqW?O=^j~=9)4{1Y4Cvsdt~y`MNtWRSzSNIFc(`nlp=L
z|8A=A+?cU8cSOJsHDD>xAE~rT7&^eCs1e-KfVI+1(zA?+VRPPBv!yuiz!-y!M0|51
zD<F{fh5pNEgdlC%0DmI!X9l>q^+rM2{FQw-dui*);fVUJ+HorzvfcsZ7I&>VBi*{6
z>|>oDK7KWKgR_-_cl5ef)4n}}aH0PoYrr-0a-dAeQ^k+Eb01n^_1zm-sm%Uh`$gW_
zv4Vu_J%Sg9r0i5RQyZU`DLq}f5)@#|rvNN6bhnew)^$}ADYU#17Vkzn?&!0|&?5oq
z$$BZLioA~(vrTOLVZ%xsNBJI6@bcj|+593H80O2AsyN#a%OKyI9$H09vAOsm;;0*m
zm(N;kW-g42zP{n&<C@{|9SJjd?da2kM)o@LWdDP`Ou!_J+6iZQ_3dY)y5Akn=1%BK
z23QvSeY5Ee_Zbf|QjAqbL4(Qc=b<XrJNDhw;W}`GCzIy7?u%+Qyfca3jejf@uXB=(
zEehjo1>CJai{cAOa(Y>6GIw8T(9%{F>Jd%avJeiaP^-<&F~8f{HV`o!*wVeN<~e-<
ze6y_|d-HYX#|%U>ze$Bux#_-MV;<-n-P`#|WTTp^)@~g-Qhq?>QWMG5{9QuNQ9k8s
znf#j`GggruzN0Ti(kgE8&K430^>Y2MzVTS#tJ*}Xey1a2S)d~imlW^N5N0cG;%=<i
z+8Ow8q+Fk&Vlzl=LbyCv)EFe2F4G)UgJ$>DTyPE@_26rpc0loBnn;&-2~k~+*i~hs
z-q79!pGi*Bx9vM((O2aEyWdiY^}6PXVZ=||CAi3au4TMG@{QP^rtw^%q1_}Xm)BKF
zJP9Z%pNCtBV+7{)NG*#eSNoM5l01*y$QBd#;uzVXg$2i-r`BMEqXc|$M-IMT$TeXF
zV@YR*&jb8oAwM#7cvwGCheuHQ^j1r(#vW)ksVnKSG6EDQQOj5rlZUF6lw;{zB|3wF
zo7|mOV`U>Ce*ZI`g^&>spcP6T9R6~YbJ@ykP&97x1yE(9%~WDxtbLCD&8K<-x@}G7
zC*+i)wPWKYEuga}{eTKeA5f^@x5`f1-xMPMPj;05&Y*{_DuC0qynyDx6h+5jPhzoY
zbdXLmbABr|P1jiBw}Ejw&}tbnELct+KcPO0EwcAyZn@X(O&F}^HC=@9&72pflT+Cm
zwqK`L4zU0iOce$4t+NdWOkTmOAr@wn&d_KaTlZh<_E;qj+~Jz5o}un3K&2r4@`Bj@
zzX#;)JUKhxRTbMfu{N@WBid{8t>(yEjVz3$X5`Hr?OizPD~~mJ(B>$o%kopAmr@!L
zd%9GfVCY)1S>_Ar{cf0alsOutZ2Gd)c$TlDD~9~j^nyfL*!*jzr)s5s?_QDK8`lO)
z6cK39MwL%{S$opSh>es+x=xk)6d|6cSq|PvhPK7jcgG4OUapYRTeIyO&4e?Wa7y+}
z;vIja%SyV(Pt|$SrB7-8VWfJ;Z2|M7SAEO-j{E%G%~3;yg9qU^i7|oo1#<Z|m5hdw
zmD2qm51eKOM8(N>KZ4Ru{-I$jOS<N@T>4t#2sIX9gb*d@$CMyEe#Uw>uhOiIY5zFj
zXnxxIU6^FjmNNrvnlAM!aUzZb?F&(oUI{)0e$w3e%-xoQJ#{P@`nI)H3xu=CgDd@a
zRjKIp(bgu|f%ZiBdq*d_xTPvP^V*s2R+q_4oVD7D@)(wN$j233u7AlreU;0Drg@Gg
zQ7*j4O6qqQY4RSSez>}F6F5y9|1lu*{kS{r%wmbQ`xG;Cey}F{T@3a=M5y*9>1xK<
zExa(n=Ge&H^+5WY?D>_K(Y)xyL=$<;GDCgcjPq`z&LUJIB$d9)DM-b|54$SSlWB3T
za2RokjKt~aNM8OOit|S<U|rn1jgjT~IR1^5)Vi$1#*ORC<GCvd*P^wIjAb*K*>q|N
zQvo@rF1UMjjdq67sw+MhbmNJClW`9zKk8-gLtsNSL7%u(4+^iGvc0b4tBW}9`d8$M
z_#{;Q$gO3(VuQ)S9deeqNGBbI@nenBud6)2%CGy?{0uguT$-@gKG^B-)7qtj!4T8Q
z&RfeUZ?`;AvIyiTx8a)r_=UKH<yG^|+nNRSI>jC1>T27r!{Fm~kg_{kvE&UzB~ij}
zSC{VktC<xT7Iwp@rn;7>dKkeRJItJwIKKeiF&%$*ac3HSV=p(oupE%{rPy=>r>!k?
zNt69MKJx~R!@UZ<^1N)cZ|#>6-D|#1EL{zG8yruj(iq)454M0P=j}RY6g0y0j!Mjw
z*;07GTMT2}?eg`)8J6_fMa~crfuN1*HRYUlWxEVzK50j^q<SaUwevV$d<z1$Ks&i3
zeHHOyEerm90jOpkvc20!;@OtxSehbZ^!8RsvXr$@cl>VrCo3k}zBgqnPv336`hB$N
zyO=qx0Ad|%AEgiTuFwP;y$O5xJy>4+CBM`Z9BnO5E8RZB9}Op$C^O?b!BEb9zMz*0
zDKc;u&8n9jf6Z+&s2#I|xUh^L+kILY=YAdPxwC%(NDQz$zqru_mMu@1Q{8uHK$JCX
zSI!TyuUnZAn|5>G3ZLk7OlskKi(92OR{f#g%KRLsf;ZALg#RY9)HVx2S34Hn>ZWmi
z&%xM<CGLdCPHh+#Y}ZwGu~^}rDE7SEAcdCCg~Fa$br=@0@x-%pTBWagYmUBM>QJJg
zTN!-8z5XFQ#M{GE)t{0af9TNnHQ|k%L^o4QIF%^Ftub8sd-kV;6tuo3>?P9}0Vi3o
zEbOn@@9Q&pfgIOS?BuF^aK6IL+s)r}83q#{SQOYS(=(5-`Y0Ks(FdhTKT*at9?R_5
zilI5gtJ@0F;zh6Br7Fx?cTAA9<h7*Fuv4gDmMFLKQmAhcC&=+nBF=}~t$mZx*5w(J
zS(aGsgF}D=U3A#_lvONT!9hxHZG~t>!1L<?Mlv$es|E_T&@{?eLAN_Od2odfOIMRt
z<<k91{vLcP^AWr}3On?diQAj3-%5Q$w(Llx4W*X375wAi{Qjvv-2NQX4>+*^T;}M3
zr#ks@e}0WB&TkK$4alpYG@=o#A^f+6RgbU|zIzk6@$1cpNFlV5!vY2_AMqAxBh<G&
z(j+u6|DbtX;z~Z_K6p5l%w}*%7#SE3htTIZn+GKkbZ<$M2CKDB+Uh-sPgXJ;Nn0Ol
zYi7$<4aMDlCa(punG1R5al$~PpQ2K~!KYl0(8IB^yd!c&Ao?i*1CyF_TK<-^hG-No
zEh35gsFTv19wTpP@TTI;1j^E%eb{Hvtah*;C%uIC&z_MkQ`+RGd3hz|ZrC!()%TGr
zCNj+{N~;4L6&YQm=2R#Be(s)Vq>jS20D)XLv`DSMalFR5NIah-LIkFI=5<7lfUbL$
z%fEIX!sJwFcI5q#2NBV?rFGk8zOxDo<J7DVu%}7jx!~R~bMN=-uW(Ol+2#2f910)~
z8r)Q;%sn{z(e{nX4w$Y2tABj;0wCNCrlprp-nEC6%HeK|HypcNK*e0hQaP>mGFKya
zswcuYAA%72(k=kwxYFZRkh*oQX_`pxM)nik1@tK2qyyl)Z|xtpAGLAcVR74z+ru2h
zdX6lNFF_`EuP^U1S;_?apQ>p(vt>TBY1btZ5_^{~wp6}7`K-%~f5o6=+b>qDbG%cH
zTW7cd-_a5JTk|KuTOPY{;1}QG^}ZPw6eigMzOUZhXPHs=s$PVtTaEemW6XM>U69sZ
zikh`aV^a(_B>`Oe4z!1dR`0<*orUFy)ON)wY6rK7Cmh}r$1`;y0*lysc_!0kpuypK
zen!tdhCnq-O*;<Cg9TXDQVhNViREBxrM6@j7gp=cl$Og?nYjJSSpUC@|Nq~q6K5KI
z#|h$`>NoXcW<5r{?&c-fw?`RhkkP4*@D?aJaGM%K*mT_k;T;$l|M`A{xa7lDD?*v`
zy#%hrpo-OA@)HBaBU?c$9(OMG?jh19y2Dr==%)lTAs$h6#^|>rEHhIcs~$Hp`Z5NX
zs6gVg$i<G+>r!CoVMT!pXpkfmFYS;34OdPjRdor;xL*`rSqWtJIgh~m%l6Z8a<QJ|
zyH=5r_ru>E*)q}WeUnKlLsQKeA!<<EWjN{gX)-o^fYr<Z2-y78x14MAd})lN{~&FL
zX#0-pjeUX*Lmj2nM+F(uj<9d{#i7TxT;QuW?nj%N-npl3m1JqSRAd|gd4$=3=ZO-W
zyR1t4Yy0-2k`Y}F*~T-oBH}!w#`=aPa8!LTJay4hZ{p0RUYmn1!gg4({=|;1ScgcS
zQ(FuWPKW>2^Lbu**7@!@_$D0^%?N8rP%}aJ0d8V>C_V-W(saedpgDVD2xjZH9mZ98
zQ*1{SrnUl5Y>q=+-8cxe*hxNd@S@X#NVHnEIOB=Q)8V0L!?N#e3wd50rOVi1SgQT3
zn9`<;_kgeEeH?RmcWbBH!GlTlv&%TZ(9$GD^`Z!czdnfEAYr#RMhK<P*^M7BH=Q}p
z+-!=Bf6p|6$|-<U;pb*hp#765@i_*k(@67E66cI@$skFeB+l9Jc|L#LXQ&R`jT}t(
zBQh}BKIIu>9x)wD`!sbBk9S9Uxsm(=QKXAt@c?@36XGn4H(hnve1*}_heor$W+Juz
zy%05@Zl)Y&Hcv=kHpT9*ly4O_9c|s-F|;XJ()Hj1L;@suhoyI-IM6GwjqsXv<eLH_
z<gYo-!o0LluC5&9{T7oHSGD6Nhz<8Od_AwB-3O8f(bae&^H%c?bbw3cS~S5@Z37^C
z_^-jG**eY0l0XHH_3UL0^1y$LZEzAMoV)_*${w>&yJ8BKOt(d8t-ka3E;L|P%^<(I
z;nLdpmA=_&p|KSuazkpDU@L6NPBqB174NT$Je+ubwPpq0TAEl8)5R-R#f?cWTwJO*
z<24|^8=bZXkPHdhgW$f*)bE^Sms*sk9UdK-1=|4`*y0j1FK*Ow$bxsC`{p?B)IOpw
z_d4DsaBq;m!MAw<(CyH94DcQ4m<8o6clPRjmKT1|{{Dw{%zBt<!Clbx!XauSkRL`;
zur=&wn2D!cIVg9?>-}{mWY38Xg>Xo?-`5i+K3i5>m$Z-bx>n=NdVrcIN9SrBM1LVY
z`(CTHrKzbF9D0tw?$^ME$Q06wAdqxC&dzs#mhnEMfxA;8-IRNMwe5G-h)&hDfrbH0
z2!+ESWsJY#7*iF{{LRXMm`$!F-b{o+fMBnXOv<7kw$^KE#<l^X!%(%59RdjU&xqy*
zbs)i)an&M2<S48@qT~2Dhis>AI3C*5kjDVcBAL(&J!w1-jR>S1;&2Rnd{x7))!Hl0
z3_FK@%-CNQZaB&chJgN$vyp$<<b1CY)U0%$tJ1Z~2BIX&NdnFJ7XXR9AK@;C&T)$G
zzy`YG=xNhO^mDI-AKU{oBd<|<*qibWiudOhGd(}@c${FcxE;2R$=^@d<R;!KApQ_V
zir2hJXU-~-q5=o#4iE*s^ZT-nbDJvP8YUSoOBRolW3Hh|LX1L5r<rNHSk{Ljc7DI!
z;LYSvxw0@OG~2|^p#2#8K{8grDNq5;#Mpf0Rry#pl+h?EsU?7?pu5+vdQMx6^tUNI
z|1m8e{z1-{P>i>G+!s`n(4+XbTXt+Q7&|)oe!t8PEHaK&;gT)CI;1!~wBhM-SKp6D
zWk2SmRJ{O9_h)wTSb>X#$8UDxM@NyZ2~e^3!M`mpM!>?ugqF4Def%!v@;?T#pFZqA
z;}bNIedja7e*w72z78J~4eo44G{4=h9kY#tZ19BE+T~e=l^(}Th26?!PjSDUiREX}
z;HW^>w^KLL>>ImYMpgU#dhLkC4no0>Be-+-QiIbDq+QJp6U)5xl0VNNF_vy*bs;Cl
zrFE0_2PlsR7T#c13Ae<7b*qowJcVNdBh(#xB;VLBh!Xq=w?4%7zW|JtcjV0C8(9<R
z!jfFe@osd=S>|q6(cY^))3-Hd6NvB0v}&S+e6}DrQ#Z({aWhDk%RS4CPv_h6TGAWN
zsx)zHJQcG+?L#e-XhYBoEF2tXXP8)I!T)8u5j3Vz;1i$UM+&d!ctqzkKa3t9Q#^~B
zumbH(*w>Qo)E;`>ELlWrA{CiI%;xRXhJ^?-AjdzOt~KEGcZljAB?Y<52k^rLR(+F_
z<sx;>EXzy;GH)o{>pnrU*S+;7rtPhh2sxNzg_4C|xr!oXXn)}^yAj}DswxgyU&3Wx
zR=p9QX1+weeA4eN_wld`U>Fe^O(6Qn=5G>Jt6Lz*O7JyvC#C9-%;|cMGZ&MRYv&vv
ztOp_%x!32ccV6cMV6J8bc3evGD;&UYYH34hN*5Cc@R!U$3<nK2VDs5?_7lQ*mIDFs
z=r!aGr131Gu77^}y~^6iqn?KPN4+Arl4EY2WM)plMgL2x4mecu^t!>0T^dy{|1Q2!
zwcz_#<LnJ5ibp!Qq7?B^n)u)Jbku2=aFAE%9)(i3&#h{>f_irAf^vyfZQ1byX^-95
zm6O7O-2HQjARh|QROIKr<HtRMhngpSB;iPmn-J&SvhcE81USIkK!1|IrKl+F1g|WP
zme`*#lEXyMW!^Q^brPU7|FP2DO?lSkYL22clEZ@Xfl-_zlej~>?3j#&;C0)E{0B)!
z>jWDU!$6Er3=Geh(ZswC)-dA|RCZ@o{PR8OlR;lSjLg+cG%HuOMW}k6ObdDMe9xKr
z9ttMaj;@2shD-}2iPu5pRN^U?rWCrNOSQU%39gB8Dp6P6oU`c*@$?R<y;YdM7p*#&
zAb5{<GR{q*xXdC1YDVsYiLIBowIIWy!uMJ(VA=0akDoq$Ng=r#9PIPB2^M54k$2#(
zbK-47FS{F|O312XG+e*Hb$u+(BhK7tg1;n;4XMt4Py*Lk;H-Q(1Sc2#?#GWe<watQ
zCW-?>4<tDnsz}G*w>L1l`+cc<UY-ZKy{5hL43U7Be8ss>!6Y7cS+T+m4KBHssZAI{
zy+m8yCMSlOXs%pC7K`XTO_9zE=1hz&y>4GujGc&(Gi*I$lcfgMrVDd^@mIKpu0Sjz
zrMjekejT7ERcdCe;8l-u#CQ|a6*j@JvVN^{WUJy*U8pf+)W}3?Gr38#F|d(2!{jW)
z{!3nXWm!#h>Kop`3~l7*%&(UFy`qkJY^$$DBrBGvKcBLUDU027mxb=i%thxbshS#7
zy<3kdS?iU+@5r06c$P)l3T((%4G}pq;nLL_1`gM}eqXwq##ki0g2t?a<X5;fq9=O3
zE7%aG%b)8<(bJ`Ghd6^<d@?CS|D@`iP58E{i>)zug*z{#uYaVtur*EKU1}N(=}_PS
zh;*&K6Amn_^Zic<)WQCXHsSt?_M0C>v+t&^e4Z9%iCd$N;h>ao=s_UPbm^)h6|z&U
zOU7G48U3QG<v|Dv?_#m#VLqzpLW*1aDXJV46?qwDmY)rIlcq<oCT-*pDoFtE6$v<R
zSMI%EXo}U#Ugq9Y2U5h$4Ww05owD)S;?NghLLrUJkLDE_K_o>jRW_R`6x2zD!w1A)
z-=W1+9fFT$DqW}d8XYaGi!<Dx2hZ@M$PHaF1KIY1G_vt2;xCUxP+Ww_Gwiqq#?M$0
zsF0o--sD^-#mvG?mktMd#>+^4`R9W*D#m=DbveYduSr_-=|?q85SDnbFLiQ$)$dhB
z?yJtSXXjpW!t`5p@bTLmoqtYgdM8o^UG!r_k4M2bfoop9tWuVQR59Ar%S3;oD@dQd
zTe+4<1o;(?F`BA645}|m4?Yyc%GK#jJ3q;5PdoE6<*S55FAw+U(tpB#SNN9wxJ)?m
zs=Z>DJH0>I$!tm@mQyZ*RkVfM@Fw8UX<|);I4TEo6Fgn52Z10Te`xYZUU7U!7c5n1
zD<aLe`i>)L%<a0$q#^Q?<EVd56$3_3?Qg4RvWDgi*?MW$!)#2{b-uV{m%W81zeHUC
zj0nKs?JS`Ff0Zfi)UwSeD3-S$6zoCz%NS~%i$nXoC=m(#!!@O*9)7vNWrKJ;jR)nE
zJ>|JERU#ldHTdyk%7uFF5+o}sG39^-R-Th4F1<mbJk5R62SXk|c=D-4{8tpJ79F50
zJ*B{|$Z}?7Sqcju+lkoZ32-bgBJi5G;ecDu!Z=;1n4e<q<e%#(%{97Em`y*sK3hd;
zGF6%3lgZ3#t6x6~Yyk$7-L%ue-h^7)8U=1B&A$7QS2DCSM!<KTiZ9i<%HZ#}$mj(*
zBKfByGiYB==TSXAsbsWSSwG%pa92K&W(ZNdO@BRUB{+RUQNS6U*=y2MS3bkb;g}$F
zo9wt8!xOMO0<%(c(xz&PKJ~L!noHo+9s)676MKeY;R07btNPtavRrYr>d%q7PdtJb
z%#eknL|;vqZw4;_*Cxix2O;4Fn~EdDrT|Y#ECj_{RKPDAN{xAB8^?pg#?DKOnz-nm
zX=!(}d*-QwmZpkBCg%r}#=54M736*_-X!|!Nz~eZJGX?A&M;`YEp;8CVLP5N-7KD}
zX0Iu3$cIyrjtMOumm>dpKh?w>U=KrCu3iArTH^mqm(SDOp4F(WHE^?Kw~M4S;7{Ke
zoj(RYW2KcD;Z&x}OcgIVgykB^>Pi0ido#NWpmzFs(WJ%XkAYWe+R(NxQHL3G7b~Mz
zV4*<_D<Z$Tyq@`*s~@s^m|9I{kfB3K(uEY<;o&N$SPZ;%#XDEDLcjN<Y5f1ZRZU}s
zW_D|){=c>NmQita+qP)o1Sd#vf(3%RJHdkncY;$C?(XgccXxMphv4q+8Z20DW!wGs
zd+naH-+5=>`{RB;s;yP4s#RMx*O+sT*+=hv#x^7YpAxa>OWcN5Aw9ksMb)G%8Y?M|
z2|^XKjhS&?VYfW)5H5RE9NKS1l2hXE6J@>3@q1@(XTcuhX%D349%{%YkehBf_;fWn
zbCC9dYr>Onxd2ZoBb{^Z;)QL#G$hO`t4aC+pK9L1WG1O+z8~W4ZH(sja>Ka@^_!3T
z3f7Y(9Hndo>tC^#(vP}8$7smZgEp8M(k3&S1~4(w&<9+Vv$u88-ke+BrJq;<_dm_s
z28aom(g(lk<s^aN0)!(SV9m;w!bP1%GSb&AMQ1wihWq@K*oe2se>d%o50(60Tu<oz
zTlm2vMMVId)c+a70-Cfd<oxmYReqA0Z8Lg0rTj5?<^}A7Sit#+r_r<cm8!T9;5G~4
zPPO4NAdLgOik<xIGc9`9b&af6A-gHLh5xgXRLlcmZ!D21Yq&Q0HeUSs2W0|O_RkjM
zmZW^i97!_k!x3C{Ss}P4R=_`5hh>+UH$3vE((QGFioJ{c=*TbvL<tvT0Yn95Iy#z1
zceZP5Bhf28`MWXSA$?|34(vzWqR`A^P7<$p*(Z08=3|kV{koF}O~|rd(L5x(U@lOO
z?3RW2&T}x2olZYAzu%=Krqz3-+F9MbFK>a90=u)+Qi@$U%!Ro(v}AEuyT17bLH$Yw
z`~}!>m{DN}sav{5X5@>UD$?L=2Cp88zJl|#JN<b6G4uVX;@&bdmHWG=w&p}0HT{?t
z=9ooac(PeMK>OblvEN6nb?=R(mif{gfj9de4GZgBlC*HsV6BWFoqhaw=M*lB^P4rx
z<u?>=ACa8U`<hJ};~*}1&h(;gL<9*573Lh==!hm)b-t5+4p8t_Uj%2lqZo@wDcyek
zXWKaP4=PLNy_XA4@KZu>&QUx~^k3$P6=_6dF1Iyxkj3SjK;mDziA|IA#88zZxZgk8
zy2S}%=FC{R%kVn6&Wdfw2ooW*1+S411ZEPr`Qt)$$Uzk$z%p_x`b2*F-TVBvy|F_l
zX4%FWq~w<aUh1m^?4{o;u6GehKC0+nvGrfzv4?m$^2l(%BoKf9%tUlt4!&m*zFF+5
zx&;hzB<W!n9O|gPd7PPN880xiIi<b>Ea=0|#J&f6RK+5BN_@O~MV;D7x1<Lxzizo;
z=nl<P@#i`UzXIf;i2LuHkiLjFw#@C`)<!X*mX&?-dbr}B^+m-zHegxPFhe8WtS2^2
zCBA4vD13$7&^Yv^_Qn!~%7RSrW-NQA%wN%>o4w+@T}}%NTSEGd`oz<u`v8yC1OU@s
z{%)+stezWyyQ^1}OOdn*acl~)yJ=ii?}Zj79aDHTnR=!ox|%R#O-8&C(?a@m%jZ*~
zXucd2LVnGP&HiY!b*uXM;ua0;uyB!?IO7B=rxdN3D*w!0?LM}$7e8zg|5RJO7d7ww
z@vsF$ed0rIkt_q7`oh~)bnnt%0Nx$lEuo{?Tk@1uC~)p0NRZHM0_{oRQ<3vl4ai8y
zeWY1%yLv@ziBy`YSPvBLXsT}afKrOzZ3;kK*5Y_>>p@}mTG8@eZ{zT!e@K*#Q<}5{
zZIW0jy#X!$0w5KM{8l)6mpy&c#e6UyRhU^6@=Ub^C-$!;dhk^1gZpAc{*!PrqQ-|B
zH9&52ZE99U!@SArpV=|8xTsC<UtH(o|LVrz@6BvZlUhW(8S9p;h-08VK^~5!<QnU$
z%J@Uqxhtu>?TPSB$MY$YopxmoN>R|$AatZRiYcHu{@K9s4!f*ZC?s@E3o5F<ij#?i
zxC?dN@)y9~X;2wc5(!9PS`?bCtfU9vf%sfs@B4k3#?3UA>Z^Qka1#QYAdJjkgfs-N
zolog*y@|Rv_Y|$fcRKF`9^aPRV@)`Z-n-JOdhidsfw=fXYbq|D?d!q5I{!`Hd;c{b
zL%b1OiJg=^!`jx%u;jYMyyhwOFli$k+PjW&v}4sd9xv2<hi~#QK*T3)sqZ|cT+?nY
z?`$Q4NCMO=z|A7uT+^DUc=;RxGgjW=CO+i5dryuECRd$B_2D(<J4dc4q@RM9x_nY3
z$rcri1gIAbCc1ZtWQWdK$SG7=m*6x=Bcs?PZ;5a2w1+AYiccD2N(n`h4?vKTU-A%&
z|M9ik3{lrSvNd*^Y$P%@9URY@y_BIrpC>7Ri?<+i!`4|P;*Uz`$VGg)aGj+Ya#h>j
z)XPT;9i%Nm^7A>2>V4bNGHj6&`qPr_np3U}I&!jkNDwE|e@!P~oApqGconMBTP&;T
z_ijQ@2%_}g<AMomL}%JE3UfC@Y!S?E_z^u^s`%fwq9a8<o(ci{j;SDTu>!WnRouR%
z%FH@OsPy?a4MHlD?Z%7Wt06t1_10TXf)#=>#m=dc)93u-e9QGqdmuen_0%Ig-;GEr
zD4pC4=kjc`f*7(0SoJk;1U^Z&3H%H6<H8r%9y;pPUw~1!ANx|`brRMBn=%hd(GOzN
zlCe7~O-*x!Uz%lhpzw&5gZ1GSaPPC=SNiFS2{Q<*5*2U<mluDk<Zg_SG5i7mkZ&<F
zFT=)*(HVj(BYqy!p}V&#gB{=u6Mq4G;%=}y?HoV`5DELHSplwX;aI9yyecGD8S$Jn
z1?BT4YaQKCQbDiF)_zy!fS|6!1Xtc=1Js*Vnqq?{fel-5A-&4T$N~k{X1OKw2TiFL
zdSPhJJWO8-uZDk!X*73USUf~73k)SsR8l4lBy-w=8ZTeb+K=Lg&^tlbe#4w40VeQW
z3>HD@JbkI2Az{&7*Ie%7Zo4jF*q1TL#8F?h$zL+(PClKV?-TQk?U)ttQ!XV&G)-~e
z-bQAJvK83dR@ff}i@qB)Z_C5w;W$5BX<xmpRb=K5xUyce^=00Voc*>G!_$2bqo)Te
zCuu6pRrPKoabfDbzByZsN7yUL!y2b=t&vIEQ6!{-kP6F6an?6fcr*LvGvM-ni#z}L
zlAmKsMaEl|@v^R_AuMW3i0N!8;W9XdU<)@~sQ>Yl@9|E~YR4MySm?B^%qvoJ5f9K=
z{17`K8xK-2YMs@#BaE*?r9u7j9m{L^D_pyLm`MAAw#gN~_?^T1f<z4LV4|#{RhOU@
z2=VL_O+1w_{aoRzB|)?yCuy>`(^4Djj=a_PAL^(eu#}Ym04Q(3k@VlpOB^apWXVLY
zMAws6HIDHsL44S<yt~gsHm^TiRb{{lCz$liT6O17pACH9RA(?L(H>O`sr1B@h48Lq
zo%o8D+m}GiJeIC~IuhD$2YncfZf>)je_3w{?H8-P3JMsa9<_3Lqw?iG*V5mOx#}6d
z!b|WWpm0==&Prz=BnAs~V$^60vmqtGz?ByoqF(QA=gLAkOoIfzQ@Wza_un4D*=wIo
zGon57He-6(=R^Pf=NIzj5i3s)P;@_4@hPk891Gpzs{H~W53Z_wPs~|7oMdH}r`2Dv
zj~L~Rc-c1?CAO6T7_OMU(<r;za1NE&H`Kda6qEFY<i^OnjTC4TgVW<)kb;G4|HqVw
z36Z*uh*A9Drcgud>Sji!Tl^(zK0SK_Sx&gBgZTQ&il8$@9w>MNCIoc0OlI_5T38;`
z59X9b)cyhx&<GO#RcH5q&~DDe{E;HE9#Y%|mjS~n&~z~`2F%F}qV|l>k|30*aJ0f`
zKb<h!I#DRnBEyW`tkyJ@ds6g5CtlOa)B;CzVI`0ssZp*`aCxq*2EKeh*dmDu+K1Fz
z2nTLoA%p)+(x~KwpT04otgW2BFTG|>lv|E0W>z#3?rDr!pjAV|E6}@DMqIVoLtIh#
zvn}^oD5TfHH;;Fb90b+pX3If=bo<S2FWfHnYoD$cupjz5Z>La4DYuz<&;{S!l;e$x
zH8L*sH`-anicw^!oPQro;NP!YU`%<r3+L@bTe1lD8WWyU-{e2<bQKt+d7ZOoUjWOU
z25qcZZTsJk@LJ%ix%zTXLeKtX<sGB;7!-07!ERv1cFec%{3M7}llcH?)F}m6%xP|z
zcNm=$SbBV4ANK0W#`VdWD2Hv7IGaYz>0JWL*w;CCRfnQ66udz(6+zT&wDY(h?(#65
z_!||;F8Ut%ZOjio1R}_ZDNx#CyOv^vj#2FyeQqgn(pSX64&&@x7Im7R7&32)Eq|bH
zW;?}l!Kl&0ld-OGS<;~=_P(NOvU%3(v<P*sH3T^dTmXQu7d;E$x|YM!%2V*`91Gvg
zqst<lBqdU|4=gWXWy}I<_c*}8Dobm%ZwB~y)>j>=foO0i0l24jin(=nQ^LkO2(bSK
z)JEV08#zvyu@6`@K8Z1kc`VKi@e*fqNuHOlC?;OerudKBMLD2I{7wSf37C39V{%H0
zx|DGM@~}|m8KmtvHIs@{Jd#DL0Rs1ZZnY0F609=j_mm1(m{Y|k*y)g6oigKKkQPnU
z-d-LStJANJ#$|r1OmTnDRnB=}Tj<8@4cTRRzkDuKJ{=}RdW9LV%ydCTOay-@IZ|kz
z3t}~ruNUBj5Y^j~YQ9X^K3hcAw9f;!;5tYvacp@-LN?D3wNu%7!XNmeaZ^7xyDEN2
zDG2TN3f-#t3JC_4ewW_B<@o>kl5xRiH8F-zGK_VGY;FcSe-@2fZH)@K+tpVZQh;&=
zE*zqt=skwAke^0ZfQah!6$hd4WVkNm)+M>C;8M2gT>VV#r}`(l>|cPSh*LvLqU!!`
zt5Q7=b2kPgu?6%E;5&xm4U*MB<vvE@M-yVv$F#<Fdw`xiEPe7;DINdjdaJZc5ofQC
zHsSToq$5~OV<d=G|BoBQ1)GbOdKE1lC6wEFI3U;2%uA+GJ&%9QL|;D^u?)zQu?@;!
zTL*1EhDV$|(DNNa<qehbY+#u+B+3~fN_x1rgDhsoW4zV}-`swMQPD+SKUU|yE9X6Q
zT~^;;C(iC(-w4xtR9Op5H!098Z;vQrpJb5O3MY-~l7~xMGEK>^4B<U_dJ&P<Hg?J2
zJUfSw$fR}8X`;f-?X`sBiRrKuwg1qw(W9}RN|BOub5bY6??5ZN1pAp@@*uAH&AB=s
zjh)VPqWW}x-4DEvvP8IvWs1drd4NFXjnOMF|8qL4cSEft<>%;fjIu#RkBmr#GqB#=
z<}{SO8sAb10<3s9>8AJbzY$_9QD}K^Ks~6`|C7BL)_2pv)7Otz$eDuILaw<>JJ%Dh
ze2Bz-3*uV03y&O8W#osA4R3n}Uy9an;dZYl;Y9vvHvQww`tLr+68|!HY9A(I=VlvS
zV9nuRut;@0xM(N%E@V(+V9s6Aq(HVIl)Sam23$c6Ji>9!80kD?f?6-aWxGIUIRBJF
zpSE#5^$ovS{E6C@6mE8}{oDLNVvgA(FDws_4X#~_<Qv*+j{D?D>EAPzK}AT>N#WQP
zbPtW#QGrJDqWBA2obNAyP{1v+Heq`mdo(%w6}iHDgzB6CWvD8s{ND-a7mZJ%v}0I;
z!{nO?yY*2ap4ijIPXc!->)JQi^VBA`9{f6R+oAx6F(^ndVeNJzVAI#6b&5VyvelsZ
zIUX6Q@TDng#4{J@w!rJIzC&oYH~CCQkw!PYqwrH!V3oG%(RV{i?m^gHyfpk|d7GI-
zO_jOm4)I#dYg3_dVHT24d|T!&f_#1f4-`M6KDe)~y`ohsn46w;CPsAt7uZGMzB;q8
z{i!9HX=$ama2Hm@lSnd8ks0@W7{$Vd^`Qri<7iikOr1^MnS*n6v<g@L3flW!&m+je
zg_o3sgPxdfo^?}Ix_s^G(cnqex0!d_yq?s`?T1jAPweGoNE5(vb164%sTNS>%VlO8
z*;21cc~B5rFv+!k%S@f7-Efdpt>VW0^=H4^B^7}!ik4}Ks6NLJbKHn0?!y-Ar=B-n
zmn2bl5%!F$A~tWOk&4MJIcRbX8E>KGVR0^vV?H7mg{3Pz9>_PDCBDAIRe2)NSgud6
zPg8_0<7`E^lAB|qb}7xuL&(HntEF(rkMzPw43SNzivnz2-5LYfsOmyi(@D1)z*OUj
z=)qStrkmF-Z~}dYdjcm_SbWsblJ7sCXdR*-?^qKT)koCl0Bv6eB35jfae$d*3uzm6
zj5Bgx^(cljJ|$O}bs}aw2Y{W72~GcMU0n72#lXfX@8`U9%j@v``K*`gr&rWm<ROow
z`8|?d0(lq^`zx}XOhZQlXmVAohUCJRWujf90x0x7zQP<2|G65Qqru=cx%ua;SIbZS
z?)jF#L2X&l-1B0k+dOp4h7B)!b2onACrAHNbAz}?;CJ>30KSD&gwfl0$e?I(L#BqC
zV^|0bg=GKab(ELsz@L^WXx==-mhK)nZ_JJ@{;Ea0%d_e#O?B`JnFPif1FY1|?ou4e
z92-=wR=SDTA}J8yHmRUscscA!IaB)*N%vUdXEsMxD4%-E3STY~Ut+Y$ZOEyL@d89~
zl%W6!9)FtxBqRuBjLdb&r|X(OVXT#EWwwG4l8vo$sOTQ$Ve3hZ<R$e0yRpEu*QqO_
z!hy^J(L!NYEptk{mrqn)Hy^&7Np+z6o(3&2(AS&5@oSx8L)?Tg=6SU@JxxL<5;4rQ
z?KjROfK>KmksROb!|;bclfKeYW4sGxQ%I(0n9>vIg@5-B2mE(BL<KJ2RrunYf^yWd
zLP#T=l|%ukSy*&{uWAopq-&crhe>0vAM9J&qsQNa*Zz(0eBU6>H1+hp{>^s0!a!aj
z%Q==%#<qbwL|St~V($nu=;R)Cj*q6Wq$MHKs^kdl0A$wjW{0W8FA}vd`#uYahrrB}
zxvl01HXo-gXl6`{Joox~<;wi1bmE}BB}znkv|+9I!Ti*txO%K=2jv$)EZ~0Ush6;{
zLu@tcfd2+?{70+4gEm>u35V>Bn<w^MJaBQ@SlQGoE$pYNh?)+w&;DgX-c<M~m<%Iu
zzeBQct00J9r=&7nb~iN^^pP}3HygM3f4_rzRx~w!X%X$&ZpOA!DAjE3&;df019?XL
z7*x?i=Qp#P7w8-Pq=Po1wVm)+q>a<aEbK~m5gR9$59wPEZ?E@ImMX}}HCKr5l05c*
z0rXvNY32*2pV^S}7gjFvJw(2c!5&-l3mxIzh~5!A#?9ATl!5A=B+AS6B5}UrE0AeX
zN9BtapWr!$nJ#FgpJGQdsDH4|J(~C;_zqn4u`j4CfmHVfBk?^Pk!(?DOi|q}n2Bg{
zKE>vOD=VlD#2$l_2ynemYZf8y`ju<ug4Y)1k`47l{i+F%af0vIbVED|!6sb&W~`53
zvDWkBQ4H?J71<tfNXc-~!!Lj?Sf)TnKiGR$_^PSfxlGS=Or}M}KL#wDVFhuB)oX&-
zd)BAXpV0;|J=4wam;?#FKJztn=u-yY@`-506-$SNTSJ|_)%W6EkSsKHRf&2RUvM<v
z5OM@9l{uvRNCn=@BH^!b34x2{gT#z#en5Fy)R25`kKZ_5XwaM+;j}X3wHzERfJN<b
zk_V>0#B2l8>HKxbYS@93I$fU=#?Lizqh6tzUZ*NTKW=BR#eT&8^cUZDS3g-p6=*DI
zqJicmcbYpcjf38MQ2v<get@b+UC>KW4dAi(%Y`5z1=d($NZ|~D$Tp8aRrsb(-+;8r
zV*^CgD=gsVLknj?r0Kjwx;Bmx7&s@^0C<?3;E6WW>fJR$_zaouiUfrWt~u}}5#45s
z0_+|?RN6LL<($B%D*AAcd+XEhe1{IXm}LHqU%$`rt*IY>OZRmSQ)2#JzBAd%fp{a}
zMZD-#To?seb&9RolAdDvmUA9iV@W8M?fY<CRsyqY@i}+#<{ded<KGInC|3P3?I{`$
zzGzNIwzwYvw)3Y<RL`))$G$C8YlacpYGAW@vTRI=Fj^3Pk&(V{o+0{?)_nlE8>gi`
z?qV`)F|<Ogt<GwAAGpNDFd|oi2RJ;=$S+YhV~?<NvyT2$h--OJ1yxL0MUe7+&Ryir
zt@3n@d3D1)5B6H=Oyb)w0A}U){yT8BX~up6#i9)_qmr?6_Ud|QG<b8uG%n}G#b9+3
zM%lxuPwyM^;j-DGR8;*4e^9W`{is(9&_sHQ^@RvKa%5FZ>pWIinm6M3)CDY2(*+YL
z62L%Wfh4VUwhN&GreQ4s*hU=i_@-;zuEx3JyOU|1DZPV>IPsw=lHk)wALZs7{@IP{
zhg2ovBd5DZCAe30wJ3Jo0aYAgUr$zuYOj)`NA2c}*K0)6pev~@@tG8`Jk3AyNrA$i
zj>yfQkG_%x1pjCWvvT>_ZLXcC7f&UVu}Ra4`=WhrG&x`3lASy%tE=2Q%N}eeObDek
z8|hGPtP*}(Khxb1b*P5%7o?XzzP!+M*)k42O0LFtNsex>0FhYHHSXLT%wh3{nEqQ-
z|6Qi?`v~=Ip**{Kp}f*aYw=j}CDonBed!uJL3M@5J(==R-}}>(C-yo{t}+2rndj{=
zX6rtG5r~}h!s{$Et2TcWUGrZ;<o%o)q{Nrx=I6`TZ@UgXYt-C2OO^&ou@5{Ky-9?{
z72hI<`;mpR{>O5EGMJ3|_R|j4v2ut1mm^dWK^#w{7%+>%-qMbu&3Ne-U_Cf#;<&z5
z3#@syajRIgM>D4*jk+@uO%%AF>D&e8{B`F4<4^uO&r3ISR*vTFwAV(ey5GKY!MV&*
z+6};E8__7fvdn3`4nIt=HJ)afK2{bukt_N5l-vBXvsDl#Jzye~o^-a}S%Z$79o4LG
zgi&)^GO_s_?Pa|%BONxkM9p;GR{Qv!g2sv%^Ylo!lBdT@Y5Ib@F<m`W&LO*r@&f#*
z5dK#lJ+Dxc!`zkPXLDqZuE6t0I^F)p%oV&?!l}Mq?1sT<&PU?=)D%FOyTUdDHv0s;
z8lnte)9b=)E_E5-*RTtY*-hm&hOPBvnB!xO*%@F<*1;Laf%BKwJ}(EjNl&&#>HzRo
zL`2`}06t(BL_q$3V2cjSX^A(2M)!rUu+&9fHDl&m2t1JfoIasXFH;xP0oZ5uP>qrY
z7UXy{-gLedak05WTqLiW6QrGwLr)-Hk7(h3icIg~RaxZ1E#WSRGAh#uW_XW+)hM<Z
z@4Qk=gQD~l+J_ha3lK<tU0;lMAw}>Z4-+<MQZ~2og_Xe7XV%+6Ij+Jqq_i7f{9{8$
zqZRY=5!^V&FMzx&)}g4mIO!<fP&h6QBs>@Nmm(-skp-e_b^9}6CaY4-A{JrPk&|VK
z;p3nmaDL;KDzeQv$SRx#zE(BI?0xm+)8R>rx6od1GXmUR1WD;oH8}>PX%;&sN>=o=
zG!Mw&@`AlWP*6}eT`(aU!PT%$V{b@7Tt1pHwxjclXVb^{z+xMdLd_)mqjM0JP4m)Y
z0yO&qReRUEn=eg4drR{b+jEOfDobxc&j8QK&<fHicQ5X#SKC?(id}@u4G-MqO$t?`
zM41K#Tq4dgmc$@Y(8jzsao!QOD_@fDG&2Ox+G>J}+O4s{D8?~RxZ0heNX9L<Of?+&
zCAGeMopUUt+bS1{^G;vYfly^ovYvzEo@u2Ag+pR-_!LZn(Boo-a4b6J9>~no{P`HL
zs&W+<z|4+FEXW;q%2lS|Q3(vfvxk$c5xBl}PEH>z5q%a=J$OlJFL*E>lx^Y&Cpv!)
zXWN@`iGA{xL-?Jz31Wh6{~gA)b|hwA2Q6K7%%zlKj;o@64;v$%Y_vM)^(msM>KUM~
z)^@42N#Fsx7Oe+$DAV=Onkox6&kPUxld>`ngczXk56qCi+kE`-NLV`Yo_H}6D`EAy
zTK5f-!D~y!wE&#22-ur|X7XgB<3rTx5i2no<%mUPu4L-;2R%tJ63zrhUs)jzSrr*%
z&HgDXgUSecc{g}3!Kr!1%>@?An^PJY{FEl%(?+&i-gx8)dFF9jDo7ch$Qj190Vf#3
zepgtN;L5|ldtv>L-w*E=lam7MKTGqb1k5!C(WS>+U=BNx65y2k^y=Lia|+!WJhO$l
z6tAD$gSI-~NYI{^!v{VoiT>0B7>oo}#}Sz1ya3sGMmNxOS2fHO+c;cDT^8Pj%umQE
zD!%WCq8uANYL7C%k)f2VonjqgJ>$m;T!vW=7D&FOEap3e?C{xI<LK3}u9?w;_dkyn
z<H=CrQ(wI9drX=84@QLF3Z=ilKGukl3x`8M>-lnrI$%N!OB&g2ebhLRiIk4Oj5Vne
zYA%1#L4R4_7kE0DylME&7$|dMuPJM|E^^)#iSD|`(hFZ8bHjg-ebkm+Lo}`JI5}}3
zzB(T)I}~VrxdK1d+aWk@wa5LCmpsyz`qa~w^a`2!A>5UWlHP~tO+yd(ZoqsE_b^@y
zBiJzoyh#pt5O^mHHd?Mz)C3lFj2EwLYAq*xU%fFB=nJZT=Jus7XauWsj%l*Y;#gTE
zd@ks}l-E)62^{6>1>Ef3;Z8h+06FWbJ7x;mU89?&m0H4$dZZlV2d^OeZMn$sgGei!
z+0J5@_tz4fZ<UievJ&ZubQy0bydmNMFz*eZz~%o#T3WigQFx28ZME_(?V?al$g;P9
z;UndXTSRT<0nO3jX?*8E?Zr!hiF~_KV3BkA^SIE5nHyVvY2NshUDpwD>cS_#xM%SP
zQ>e7KFLRVvb87=3Ze~`6+9M5~z#gMepnsI3E&KsYqTl>`RE<;n4WyOjHTrBfmSgS=
zft}+`$S-`k3O%UzuJ<4E7Fd;AFIQ7MV)Nd9D!FsRqze7SllvaU8;$d(RD-@CWgx<&
zNGxBpk9rSPiQKkumB8;N3-RVZ>7jq`tyrV(;?v+k;gtxO(Cx%oZx(G(D*nUgX9Z1h
zfehX_V&5??p;Q%LcNWqw0E%w<mtJn2tU)?EGt5E$GVja-4Tmvz-jN453IA#XXtC9}
z6MRg8M`Zh({|R$~6-X1#Ll%<(i%;`TD);Xnq2r~!c3OjWv;jwI>x^L&m&T36<>8Bu
z{vYaT_kNsaC3%g0Lj4*3cM$yly-(BMZ~edPh&Ar~q=LucQxDu=%%z28({oX=MMHn6
zsz_-2vNLzyZf-BF&8>LHF=OGT`%#T|=y*6S{95kwPAK4p0m3vQ&)I{bNv3fj+c=GQ
z6JJo`H8@+z1GU_NO<GcV@upO1)=1szlk`Cg{TxG7D%1>{<NvoJH!x=?K+Q-Fn&<|+
z4^hI@QX5|xG3t=qVu4DkjPWZLu_y5Zif!j<nisMITf{bq9V9OKVJ7TJ^&LCth}srz
zDiB=lDhAb$0;5pq8)QcfEG+T)<Y9*4R`sHKyjfIVDLq+ed)Zy7AjFNE9d=(7nc-gQ
z_~Ug471$!vUpn=MQA&*!NRvBu$c9Q(1i1`<*7^*Qk)=#ursp+u5co<5^smjIwEBRV
z-Q+w&&n%6HF!J>x+vyhOZzGmP{R8MQ9!!#Dkp^c!4(YmQo=?IMBX#q)JKR;Gt<m+r
zW_0uS=v^nwfA+X;4R#dhd10D_lyQQ}*9U5l&uI0RnAy^Glv?JIHLfOeC*=()^F=B1
zMs6-m-Zs^zs_Nql*&(_(u}^zE=uSR4L0gNHdb7a~RXFwTJPByb*V*-%F}61n#f(Yn
zKS<ONKcH2F6D)9*p;kQ<iq49^;gQs5y0dA2^T_H<d@%_p{;y6KLPw$`M}h<!zAKiQ
zMa#Rywa1MiJ}WFNK0i4t5}KnB_1Q8pyK*5M!2F>5S+uyv{TA1MjI+PT+tT7sl+)*1
zydfkG&)rzkJu~=GZ%lu1th-UEy*MJx=Z(F6gL8u*S*8n9EC+q)owh&nfmk>z>Hv&f
z{EJ=s|6jk5U)2%?A&%09#$=7MSOc=~8@6ohz&uRW8fq~=+A(WDCH)m@*ybD?4=#pW
zsG9vrWnI_w0qvH$&`#FR+FQUZ(Z?&Ll(mVaP1*$bRR$4~TY*XChyJ{2=&INe`0CdZ
zP3<wbW@@{ibK5iuU1H3AG|d(bzW`+4<6RcwBHkHBt_WTsH?*1@eCjsTArH<_`UOz9
z&}7?QJ}=?rDA!y)(lkiwLk!R&OG|rh_ZgJBsYG(lnCNqL&cI$`-jsgBoBf)*UKdYq
zu23nr8B>oW^)3Blrwjhg@129XPX3}p|08_#AD#ag-2|Q1cOskYHP616NPJDwmgq3q
zM9q9axUj6qu5ENVCr9t|qaB|__}Mww!9MGt8^X?H8arMHViG-I$JIsZH(ZHi+7}?0
zQ2=R^y2PK^tvxF^aW4twFAf>B&F($1%C>)1d=oR+lJ%AEF7me0$OJai06D$xD<_E%
zfhjk&k2g&$c<&ho&8rU3t)^yY)nb`EX0qDQH4`%$Tvi0P{cy#6jG&kpP3HWK`fiJi
zri5XTvXA5QAo?nJiORcscVk)Naun@~06z{eHcc7h9?wo-bvB9!w_6!uyd2^#MLn7H
zh2NZGz{@7WY-<*J8l`J2z76ru9F}-Cr?c!ik?R1jbp514GWOZtI9X&~-@>25J>Td^
zWjsedo8y8U&R|lOl~b0lR|9M&OX<M|_PS!Icr9sx06*C>t2bKp2Yz*$f#k^+`UaVb
zz77AB)ctWS`%mY2e8_Yv9qqn7^U`6-*qqUZwF(`<GI<pfG?(wfZ$X;dQNi{htVy69
z4Aw-&H@KlVb6;_G9vb{~T6J`{UhD*C+H}j!%`m6f%V~}Bjc~L}8`HqjbuYY|#a(qw
z<|;igAwp!WBiYQpGEwfy;!B>WoKR}yzf;-~H2O!DOcU?r?)4jEMQ#veM7BnaYc2=k
z%@631(-bm`1gWDU@V$a4s)=1+)yleV-*T6FN~yhKO;Yvv2qONggUEmVdqMdCQJcT;
zqHExHgqo8h0a$zdlvi{U!IVHC*v*d08KIDw_{$57<c=4*oJX-tp;$j1XaflFd_u{4
zLZG$UNtvGB7;CPl_VJn;S{{7rvza*1_{xMfT0GD$>O_|?n5vlDCo>&ZBmU91G7uVl
z7Vq$;Hnl^b#f(>#T-wYm_Iyawembocg_Cl+iR*$QR(R+<Y!YD8kCWDJa$~mO-wg5+
zxIVRhQuZy{zGZ(lJzj1jQF~kEEy#x=V{&-^m=WSely69(SQuA#s(<JqDxNb^ec~89
z`gW|8>TA@Hh3i7TrZ&ZD`TO=+w2yG3>+p{zzX0W$UuzN6+3=h{(tGf|$(GzcpdMaY
zJ#lB*c9VN+w(X2>G1^xZH$r@QU%oZn2B$E0&MJqux?z?LTIA%{c$tTW6e0?2Zxx=M
zQJ<o7fbUjL=KxW1^1(l&n5kst;>-p0(kUEoG4W5e*goW#g6#{({$i-`pK>8Y92}6-
zTPJMZN0Q?j^8s>>kMVh&nwp};-y+pwbYbm!e!Tj;eAXRGI{Y<gSN7bi&8w${@xetU
zK4FlZ5(AIv2i<W82@%zNc5Q-j!*nl!Bb~RkT!E{bagl%@?S;b=pU5dBYh%QYiDo_5
zS~$VY&i*FKZG;(^iAe*7Q>l+xGjDA@L|wS<_$v_65isi_Du1+cF<LFJe_2a&@)1kl
zj0#@vy9e$I|KMw5*-4s=Ua3BGCibb!CP}7@Fbe4%=%pU9g|AGlpZJNQ^9!(`Qc>8o
z&gFrkG;<4QGL!UNKHKB<kZJyitEY8&S&qCclRP!%<-YYrbY|#ogqqV>a!1lYZ>nje
zCe4@6T<Qm^K2NY98Ems!lCw#lq9)Ty{;|b%?-6nrOuC1kx0YMrZAC@fkL?-mL+qtk
zAwYV@r+{iQOfiQ+cO#cU&Sz7o{7c~)XMAB5e2J={D7k1G%{k;eCe5X8B=F`aJIbQO
zJz07PDgQzORkE;9rKZt7KIY3AZIm<_=SspJ+lqLyNK0q<*Qb-fws-%yd8N`2tu;3P
z=xUf_31tHnp5dLTvsA+W;fnR~b{+!k^8eKI;xW-~2*$MryB_h*i^bHm=%m2@ULO`>
zc2)YHG(yoItnSl4X&~2~qu*>{s`tt^dPnnlpl*J2=i8CEA(W{D9)%|WNhA&gu1C|r
zIdqMelnmu7-^R<uk&Z)2=0n==RtJljCL>(ZctVSlTE3k$OslFQY0cw`<+B-kFc5^1
z!m1#Fk=MzYlL6j0I}Ow7tmCr67Lt9o8C6fjcV6*s<hHcIW#PCIzc&WeP73EeluHoL
z4(uCf<BA3ov#YovBYi{r7jA0{`mx&cgb%*7e&Eprby;!lrA}em%H6(~hmlUi8;k&f
zlp8g{Jf#9XZroL@2)QYwh^V{hN0a=rc0>tn(yoE))UaZ$aXafZqi?tTz21OR09Nt8
z-!7d5%=H4e6h`tg&^o<6zBAXM{8=b8CwJeGQUCpD<`cOeGt~e~T)1j|OQ0e=G~RV4
zk+Ya4j^V6*Q%D0Pi&$II%V6X6s~mbjpb`AmiFCq*_^U~(PFyynMoOo>-8$1OT?J`l
z;QAJY(N`@pLzJXl6<&V4d6Ni38GcY1bE~&v?;;V{N35?j>H_sZCmnefFJcPV%IczK
zl&+mfd8GNZIxOh&=JMv{WJ49qIQ((+MeR5??Pl@E;@3Etxm@X?47i96qZkRY%Zdf*
z&RWsr^>Y|4l+WI-^OTW!8>JfFB_#<XC8dk7<`b72K@7Z-MPWdj28#EiOvKcvS2tK{
zV>N+xVj0|dKUqJ-t8bNZGpf!`g?(zeatb|=;oaY`{h0{uUc?CNF+qTGdkzMlQQ`}P
z3@lOO5dySs`EOA|a@7wtY}M5Vu-+vY+^5}>KhDR?NHzMKiEoA0`~tAMaau6vyL5(}
zgY!l`hk*agtbkb(Oj|JsP>A(_;m>Xfu%ycmcs&i3e}V6ZbTf4k2!57-JkN<nJ}Joa
z+l7M}aLqhYja{ENLs;@MhUXz~*li-(^_6@Erq9{CrDJ?~V(WQsttCiLx0_X|02{s$
zqrM*8Vh#3j7H_qGV?3WSe<aeuPq9m^*H|6CLeN+=w*+-a_|n)!vqait*rasfz2>FP
z)A->r9Rel}RNZx%K!yW2ASErI6Rp>tcaAerS~j{0-r3?90r{#JSRYv%#p8pEspet}
zPAex5dFcov=JR=ur6~B-4VisMJINBDV!0QLh@uL$`#cwj((d*oh>iVo{Z^nMB0Yfq
zmsiB*-%MiDJRR267&QTE-msFCjcnI0clsgO$!^p#dF4Q@8*4QG!>7^as7(QU$=o&3
z0^L?V|A=~=41EJ|=LZkjH&JL0JG~v){vDOYB2YUt0G@oS92762_#GYW%e9H%Tcc1m
z(j^?+z0=Y|zHwKv=1ZsU<>x5g22`K}$*2tIqoQ0f9NA5!7h?n)>rSgi>RwziwN<KR
zz_`eEP=G}_NsI$$1wEyx^O=5(hOC&NrFBrueQ+7jjZSsIY5V+jS%QuLWE`W8&1w54
zltK?T`4UP(5Z_trwqi!`av*VQjeCB6<olWiyb2j-0JbC}fVK}J)+QEcfYs$H46dyF
zt?mo1K>SnI_J{Y7T>H|_I_mi5qzMLxFfQ1Q+hPm1&MJB*h2**DANLY@<1V5`+Kpf5
ztjbL4?E+HRg~ctxRYQ*Pl)p!nglXn?BOx@JXx(Bh1n$YFy-v$+*c=$_v5h45&K{99
zHl{CuQl-%xmhTR%iGC`2Y3w^(fp<HId-;YLV69}*OxTIHGVL`#e1kRQT=Dhsv<L@F
zzMapSW^k)a+g*oR>4c}h&~5G280TDVN)hb0tOk6HEhTrN!>j&|iF%;Hj}<1@+|uG9
zgtZHgBtu2(6S7-HkU8JnQ-=Ar5H7pC5+!E;JIk=b3-E}=^h@_9wNg*N=uaAlYu;7X
zJ?<%Gwp$+YsWSSqd|=Vdog7^#zM2%L1%aM7&*OfvGt@xMq8xUV=iZs2UUV~WpPbN*
zK)$J9x4rF{AOt>nX1T2=(&gOu&N8u)e2dK(4Ks-yzx3SIg^=Edkgrv9o;BwQ3m27k
z(|td_l*=uatDh3RziJF}r^7xoQ1)HBia|M>=9q$&+X+`%;HR6UgAAz$ipG1>AdKLt
z+`%*Vy};Pv9du{H0&66B7KhDjNLHtpN0j1@g+^ZEmyaHmBNHKejm)6o0XU&-pLY&v
zL>8Gc)#ur);>4%->O-2IEOQDN`Q{lq2A3L8UEA|a(adZ|9muD(k1+rrS~Fo5Q9_w|
zicYg29)4)t{6E;k|A0#W`>)Hyh>$=-q8i8!-R2G5VnXZ^abJF%Nx$`=CIzvym|}XB
z+!LRI%ai%WX3MXc1W$WOS<AKvnMXRC#})aS&|p(BsN!eZ83qT~riPZ-X%3zYOu;U%
z)}zO{uT=V1SK&6Gr&hMd4A5sbsV@h;`4xvdUbRM76Tu3sn<pSledF{62r<d$pPQ;x
zhbe3s0fiLt-`o^jj0Id)nkk#}r|R735apzKaC*eJ$Zrjf<?J-Li0UoPS$Bjpy9qlt
zQ@1WhkY^KW+yXF@iE<LTj?@YD|HZ`ttZ{v=CQwBNWZQALb3t;8wXO4^Zq}X8-6GEn
zje~|X7CP+g1$c-sxNw6gfOd3Y;+S#to|qMMOjC%g!@3(U>YS!F#?TP4lNSYdd0H*L
zjc8^`f{{f#7V%wn#&5#f<(X!hjvjj}MWkqhS8prZ0bk<gB-|6LTidjeALj~Bb0ebo
z2hQH$$cZlm@j>V@>*%PVuZml6ye$_!ppq=)WZ`j6K;H@93{>f8vv(v+kHyj4dm==(
zVD$+-I2VJxPd1cgQY9*|j!>?jBWLczHw}`p>DsqNe1LP0l7aNCl_>0ogp*VM^31f)
zi8xzAeC?8zz-iVn8SEY&9!`H7%Kbrb3s>fshJ{lJvAHJb(jhT6aVZz=-$cA#PTi!+
z;PueZQ2qUT<#<$;6b)-j7X#GPLtq?6<X=JpMi%OLv>p4ptr>eiZ~^vE8y{54F=uR?
zK8;XI$7k|Agl;HIUZnIGkh>dlgWLO<ucR~ZLm;8!M-%VQC1uvu);8U^J7nc<i6OjP
zCfhPx<(8@_uwTESrm)`<t>?5U%6vHJ)gfhX3BJBWSwda2S@b*7iT^B>fKZZG&coM|
zf$UCOv=H7H@%{0;ebdX%@w?hS6udV|So(*yVEMX^dhuD9S{qtrLKu&~vVgrMCuHjx
z`}I7HstY}-^4e?@VJV!*W&2<luaE;dMQoSs8TrGhBqvc`)JU5wcDVv~MN1uMp}B#Z
ze@>Y7)(|}Z?B{NmW}~MVRR_O5ijn)AHXj35?Z?>{B&$Nde<vYe3Wp&cdrV<nV_uM~
z4xRqX6#&mu=9dfAAgLQBte3KKEYmxlsw8DG?&BwLDxr0t_fMSHf6z<+z=Qp7x~51J
zpImW5lf9TfGeE#Q)dR&Th*$-77XsjxfVM|Dv&P0coD$p0$cJ&hpJfffPHLL<0}R(Z
z>VT?{v&Y64PeSawBcT3{zK!me4VlG3o=!Xy-x*~|`i>QflYu*H^aGbJ@?6KOr)f!p
znDkBts3>g-cY{J+&BC{RPgTkWW{?s6nAK2FHqc1-SR_}0p(SHh%uvwV>|7Meft<U9
zBg{N$4p}G)AFf2}8`92*a!F>gtsh__rku$gR#DffJ^?3G3{=kQGttK`#c5S(p6>k5
z>h-?oCt4&k1$3!!J*9IKiCRYC9+tg%_cj_!k`(Tz6IX=NRWG&*&PjK1y}(<IBU`l)
zMLFstB9V_`edZ;oWVplR0PY`x1hL1j3{i6W1k7zyYOy&$V>+5JkEQn?I9xX95s`c*
zckx!QRC3FY*c-wMMeJMzzMY>(?@Ej|A_x}`Y-&P92E~LE0_D&ab#=<~TR)pnX~$$a
zEJ9E_8M+s~zcg>-|M0f!etJn7I{^x-mA23kg{6vMGqW{3?vR-Z3gbz&FJ>4+qShn9
z#4+JhEk%}Sa=djDd2Fhy-|BXYE}};v*rtN#%vZ>6w=#(Wn*IDIT(o)BmCiR4HTNZd
z|B{+i7YN~rD%hPpil&2ErH?!5m>PquaieI?yw{b8kfl`}s04&1vOKS(zuCKZ6Mc?O
z%PDGIjmR`_5U~TkeHi!mi)M;G7Owyr{|n2;0;zsdV?x1k0DtI@gDbIO!iX&C!;0OO
z`cM}<&Pl#j*6I&4ag9ji9<9|8L2=7Bc(1h#{vVpZyqVo;!yb)?ku^rhI-`(W?xm1r
z$&>=DEVK!jY!h;oU7$VYdAm<F7FDtaZLya)pwa_dZA|f#Re6H%v>cv+IbOjS;to#M
z)jfBLv;z8(pL3aLnB1dLoi&S~BI|jaulKEJSC*G^MnLN<w7cgK>sSWY6|fr|%|l(B
z?-xV~lr<y=X!pzg^OcKb%pEjj<IHl^M2$?~BdNd%KHo6kxTz|J!A@$q@bxsj{i1hE
zlUhuMEqk$~Rsz0V6TBSZ8w(RZ*@ZS&RvD@NNlkICKwNwxvoGy>X1-|^jKVwbGjc-@
zK#h*}V&K8^j9WpAK7U7gart^kb7e(abBxT1WtTXG)&j=UAVf?Yr(%nLGs~dp5A{Xx
zc>7Nn_&>cbVlXzPwWRoLDY2BupJm+S7KLGMEg0SJMYzJNGF?}dr@zHOS}YP*8!gKc
z4&pO~>MYZJ>ufpEmtv=>RY8E%PaXA_;dCxMgJf=_Tj3a<)I-wJU)Bc#HKZYaGbT0{
z7dkvGl7`zV*iIw$sXThZypJ#Tt$dphIjt?kvBA)HSR79_T+R;D^Uqtj73y?I_`3cr
zF|&}`+JX(<KgeBZdl%8W!EowAsaXrCBHjoqKaG^i00#kFe`OmLh@^}?`s%wrr(76J
z*4E$H^Swk11eTf*SPt<OvqllDp1jj=S1^moS!do#**X6hk;esYa+sr;m<f&f2GV?>
zT`eAthP~BL<g%~eiIz&`&Qt-A1J72YpQZns?grKe!O$mJRj9z@H(;lx^EMO5A8aW?
zR#v<mHX<~vKi5)yaN!Z2H|Qmg!XxW_CY@O2xe@-CiTVF3VgIjQhb+i0>@F6^bV5)k
zOa1`G`7_23bygW4EM_u$446tW-TfIaA{L7!MiZOovx?36%m>SEnuP?hMaO0+rt}Rk
zGM1wVovPImNZ9pN;xWa?9XY2=SfI9J>fN{I=rmN8ah!W(zXyYS`&oI|w+|ZqpnRXt
zn^Gb8jmfdX31sgtT^xr7_?n81FXvO)BFb|=?c<w%Mvr3L{RnV4$^2%gi75}OlAg6}
z*7#OSnA~hnyGD{Mf#C=C@cl5GnzNi7BCAnF%DT+1W@_N|4y~<J_@&*@%~|L=m;<wQ
z*^r4i{9!3WQiDBaUATXV{0D@<CBsZ)yee3dPG%9dH{KwD2S;SJE*t<Wr-Qla0cTAE
zCeN^tPJy!Lyy`H<Fk)ANJyG^Vxrpz^1*m8Kqxk>ZXEZ!d#sf0KZUAF5JsW~P!9Da)
zxNdh4G0n%5^*UgBW{=}N^NH;+Yw9frCG}|z$u7Ctfc1tQ7g-07JoL1#sr65lp@wm+
zrJtW9aEVb$zjHo)Z#UoNaFy_;<-qpE;)QWohJWwD9rF;Q_STuALVLHVUHiJ)44TP8
z$33%!gRo7QCqpgMJm4AXz}uulyU)S~2_GvLK3k00+DRNABXes224HV1ms|VOR@$Ul
z2oydVjh2??M)1Ow1Cc97Mh-b5Ziw#-A}_@G&SPJp-9Z@igX0+H`B2@EHX@UCU`PwF
zCCHN;{Qj2rho*`SK9JDm7QO<V#Pkl|KHPf{9zuYL0Gbe!SkXohW6|6dYY9U`#$0_b
z&TNyV<!zam3+JwJx`$hi=FznI0-fbu7GTEz2g~<KPUs9-rVBOjPMH2*RX#fVkjEIt
zG49pWw3XI3y5}<Zbq^8Ns_tL**&Vg$q?tIMSvaOg?;!=KnqQ*=4AWe9roHLc<Z|=m
zY;5mZNncKQq8*=`Cl*X6CY2KK+5>aR2F>gU0(d^|hC{_1a}g}C@`Cq{d%~GRU2;5I
zp4_`6b&j^ATf%iSjGu5<X-M9x)_22Nk-;A;5VMT|t!gXC+4)?f>P~xe{41j&b;Mmc
zuy7oS#bunfJKPM3frP{+E&vW-Nt~`zRxU0Q^kuf}ywGXIBDUz0vEs_zk9hF%udp2;
z=}>lbcj&$}89kLN#%09Js0`y8o<L~cp8q|-#^`PT9TU<KLFpTWX4DA(%4Ra6+js_F
z|3qKqR^<>%7SiAji@K|^?o<KBF+CJmh>OrlV(-r?#gOIz_(@hpcz%bZPelajtKRaA
zx>|Pq0Q(KgX}w0R)n##n9jgmWs$HM6S@c`jqy-HciR!vL(WxF7`er0<B-h*RX2%EH
z96*dYG$v;_cf%B}FamgIoxSuGu2)(#^OFY>70!hDz4wMqu~v+qq_>hKwE}UUvfNjE
zcEHkLg-TXL;LlU-a?)f{Nn<2P@8llCn`2I5sj3B6(KIJjh_i1R*%@{?FwvmluW)<<
z+_}ZhHWv<Tvt$|M=}1P{YHfWmpGt>@zJDrg>V_;;b7tog=v^*|BOJDB{6z92g{fJv
zQ9{gS;oS0U-kU+P*mN8-@k>tMAl+*mM97Be1Vk5|x0~x+V5ZpmfTYFqkQ(;tXwu^2
zBSzG8EyFV*&<Q<~3s2xiI?P(DE)Q2()q2%=U_Ikj5fxG#>t~Z&HFa2K-Ft_xV#Ytz
zWwk1`^a2QZCgFtmn+sNkt#I4?>%05(wFn~e{k&QOcyCIhwL~1y64sRxSf-}@pdLbZ
zI=3Lm48PvNdNakupV_Ln6@=lg^?)oh)?6y0gs1nW?ZM0}8N0i{_3=(<J&ZJ4NzQxn
zN!axN47>aD^M5~F{bw8h*~Wjyz@IVjXAJxq1AoTApE2-f4Ez}bf5yQ76)`~kYw3Rg
DGoGRm

diff --git a/systems_design/images/sharding-1.jpg b/systems_design/images/sharding-1.jpg
index da3f64db0258cc9f99b8631a40606e0ff03ba0c8..b96767028c278b85fa88ac14d1135bd0d913b5fe 100644
GIT binary patch
literal 94944
zcmdqIWmuG5yFWaDAX17-4k03q(hMQ3lrW5d3erk<BRztEK}iWxqaY>SHKcS&2$Cb+
zAe{sMHQe{J_p?8}-(QY{FDuULjNe&nt$BxlE0L4XlRzL4auwwVnh*#fC-_$*CITb(
zcin$LAV`SH13B$iV{4PXk+zEl9Q&6Awd2&3v$V}=<Z}j)=&q+`)*ho@vxXwWisxmb
zxUy8s|BjWuqz)7?6}m_5NZ0kD?OFV%_U+rPf|V}{-S&pdd6!q}4ppDgqo2pw(y`Fe
z>G8#xc2U#U=N0mD#G83Y9wdw_?YQ<W9}G?|?jHH%z?WC15>irJj*p~#>#((N0Biq$
z`BTbGlA%w2i9PLC3xC?zpVHXhDPA767%5dD@(E`YNDc?-Em(6<gM*|#G2TIwEq<FP
zgZDIl_Zqn%9+*ZFzDpy6HBB$IVfp<IE1=s-f})ZUlbnB-7>h<Fon2sRGJ-<h-Fv-#
z`dj~OSk4P3{h~)ksg&S{#vD~ABYGZ(eDB!lQ4BP%KdF>6cfU7t;BbkR4@ccNOH4wL
z$VI@IK~zwX6f-jdllN65Hy<1=`Is<E6hAt&<ys2h0)Y%^l8wJmrXC4pxT&1Mif4C6
z=rl>RDd>+VDW6gT5i>z=vLo#wK3LeG`F=3|<xkq?LO-o&LbDR_%`KmdMB=dGRx>j3
z5lPHd9JSb(u$VO()z*G*fk<Hq=d*!7&cBC_dGGfQ?_UDbNKNQX)eYCP$?(B>q27fD
zHPepA=*MxmoxJ*F*)NP^Vb?V{bq&HCD_{2;($-$-bHAp8`#8TvSftF@y|ZM5^HHco
zrywb>`t)TmZp{AT@VDgGd*Laejj@!jdjrHY!<h^>butofUE#&)AzrzBS>1uZYW&Fi
zE&Viq;abH}c*Autfh_uQD;s9}9#6YD+vIJTV`ca}szDHb#mJ)?%tDk!n))fD1(XF>
z!c@Yp>x}7K0fVT88Hp&g4avr()km7OyoD3w*yc|40x29hueYqjGsmydl7g@#`h{D;
zk)unUwS~?wVjdhDaZmNn`I4QX=e5hFg||jC)UZvRv`K9Svv*-&7J_gRAbu~WL4RgT
zxO)Eho`7t`YU)CsUP4eTdFI83pU*6nxZX&bG=4xo|0yUI4Hcu)#Z4es&^GGyA}UmQ
zZiY2Ys$c~9{w<4X^~+*)M;+>a2BJPpt5pXZO(1_{sl@G--OI&Ug7ae~t1~@(>`P+x
zwWl}@^Xiasl*qCN$B<{f`F#Cis9Sep{r9~|NA0vh>4A?eR(kK!LZ2nG<37@{7aTpD
z_{L}Ti@(k&35_BP0T|^E7ETKFr-nCK9tXv4ozLEMOykB0AG}1)@w(&3$LPFBnH=ZI
zW!#vUs@Rp54{7YPOC3{>W1U_moAc-3%<>26c-@@mUhFlcCmX?OY1|$Gk7L2GY*<Ub
zL6b^+YFT9c({KL_t^c4jSRQ-Ta7qS!GV1sqtU{U%6Ni{6lPRwalYbDh)Sl1S$0><7
zQ7lN9RDQ-kh#5gqbhlO3nU8_-2^~SVNG36u)*%{=8K8xe+(#wRfAJ>x?kY}{xB|u@
zv9b2=OQv0Am-nDgsxrxOB0jmHWH4F;&Eav-N*22=v2kXXjSIJ^p%<?{=1E#<F=Ul1
zRu&F=Oi9FkhvPf~p=cFvGO40NArRWFmnm3&5Il&Z6Z24_tY+D@VL*4ebRGMXQM<K&
zU^p9R7;0`Jn$ZRN8u(>ibXa8lmtOP2QrwP0$a4N<hP#6AkB@_Sj;;#HIyZ8)aME=@
zBx5Nye$lmzeEyzUZ7xr%iqXdsr{ZoMQ7`WB&w^z)R_^*47g2@hYtgMfXueSYd!Q)1
z9~pyquDPz(@|zN|0XXcS5Kan7wk~AI`<~DhVw~-e*)2a=NTKxb%lz^^?WEiQ+hCpX
zb={voow<<$KV$`=zR8T<atItJp^Zx_#?On~O9N0iQ^q6vqh%k{|2y}EGBo9qxt87~
zoH-j1l8wES4Qs;xtXz62!azjSgl`=8@9JI4U{aRGv!j<S%a8>W<#u4Fx*N_^D;(nt
z7US8Fg<MLCPx0;HhbAh6**G@6EH5R_LO#%Z`uv+B!w=|7cHQ<e7@6<q%d!;{0b2``
z_9gKeGPLkwlvx=J(u%1r7%9{qj)tB;$t2+Xq9~@%0h28M#S0eeP>c$98f4;gR#j4)
zIUuU2)(*+RaICo(3?b5!?*2{Ej})gK)C>B?U3=8$7qp{f?xz3=NL3r68V`bB!wzkm
zZkae}bn=ZedH|NW?eG5Hf`S2VGq$RCFt+PD)M1V$g9XA_6IbGjz&LV1SHphFju($N
zv6ivE;+G^C<BZ7bB|pj6!s9LKF>Z6fjeN5unTrDhRkm%LQ>cM$YA{$RJE~rtZ2!8t
zeSAyOKD}gN2n;s(h(sm2K$ReF(G{~5Rv0kEuar3L_?}hP!0ye46~;-6F|88_VN6j>
z?))51h;ZRiQCG|Kg&I(RwL&rKcBOI@4TKrKK%ET?W?J;?#-u;(gyQ#cst_uRns^0E
zqCieaBvg$5Lmq)tbZ)j=x!v%`s|u=if>VdQ-5uB%gzOV+y=J-;Y%A2B^6QE?qxm$6
z#maabN%5UDC!ZLeE!D{EdyH?r^$+)_IbZ)h+In#FZ`$WZiYdr!XW~Bk#sx9d%GmmT
z1$IhGW_L&TmiXGM5h<C&1^?4v|5HY-)AsebR(j-?u>3*krdV<DGVW^#l}}S=5od`W
zm;(i7s7R8U(v!N`edbq3Z)D1;C`KL=7z<uVhp_uJc@lW;I$>OV@HRrAF@hR_f0Gq{
zGId2M(|7y<NHj=ip4&-Dx6`}rzm6DOLCOm^1yRN<mpX_5^&_3R1(TBa!5j*jPbB;0
z^A~U7`KSD!fe#=B6CR3*%PDiAF2yI8{Y1YDFXI9l=M2#ej(+(j#->Ak=ks@bej&Z-
zB}<$G>V$f}iDnIs37a#gLyo=|ff*zUhUe~1UjuVHB7Kg|Zz78+FU3H1ZjPWPC??am
z65*s^%0)n3?5IxTbgA*Nqw***zAEzJ+ZwM;4v|W?Gaa|*U`2d_RdWZ;`7zIBrA8Jr
zR$@*(YPRr<36&K`GG16R4nri*9*8AyiKW|K!eeXr3INg{BT%aEgxk#d;N$chnS5uM
zqnPz&WXrq38a<qd)q@~!G-#Vs!l@ZFMVqI`EFip7=1WtuZ5Ohz3w1dbXGLz;pL3j#
zIuPNp$&ThG%eXh2C|A+k<Lv-yfTSfTiRnI2J{layL{FZkIR1jDazN)(81))2C<G^1
zh>6=NClJP9upUo0T<0OGT;Um^tehp0&J{ZzfPmxB?WPVZ`A%Nc>GU(7XD4=xXT#@9
zB=|9!3?g(&8X5mlkO4Iv98RxkjyJDSyCpg9P%l-AaX)FypMu0_vFiVxlqBVvJ#PGd
zq0Dc@92{4;_{M#8PeuyP>-NX($uHx5i@c87ow4k!Eb*Y$Y;Dk-1mMmp5e$lseiQR)
z&9CjzbUIie_#zpuq}BR!fJg!`=cd)_=$sU}U9oYR&-%~&%<hI*k0hh|s3T6V)?d4)
z=QvsB>#Gjx*P(C{E<A2F`}k;k)D75>01iIJ2~Sv(7^pRwYOpeN^a$L7m+PlRPzr_4
z$zBZ5V4-c!P53@3*Jbr}YE69Yr~gOlhU*FJNuh1o8ufL)8%0KR%e23;B53^gv$Sf0
zVj!`@#FNmaA8y>waOOw8PZUjJIH3Ji86mkcWY5AT`>mxv#>rySm4H!%0R+071x9!;
zH;Tc-x&jEg{i5f;1btHc*3p?7Z$AAW!Zev4ZB|pumYu;kfFSTbkZ@Q~BH%)0ddgP{
zZ_WgZFB3^PDKMttJfYM2<Fsi%-n_$9(Q`{NuJlV;xn(<T_F`mQ9+LjR?_?8rC6agr
zQMGF+o5?EwED*C63{NS24T6*`T`WryFE{EGed34mUE6m^wUWJ{vG)`Gx;IV>e7?}w
z><Y&R5>5+|i_Z(s5J{l5>hd0ed{sznM#AxdnA1Y)pQ#tOsu<U{L2xS+Gb825B<EcG
zXOH#^EZpO0$`$9J3#icPxl+9O`<d>fTzGM+6aC(N48bvyjWHlNBS*Px#KhHQtKMc$
zdbUNJI!vG6_kW+b7?HYm3S$Zrh<H+<iLCnY+LXt&;8E2AE<)YR1rSKbo4=jue!%2#
z>}ctKqIy`dsIf=z#k=!QZp3iBlD<ct_#ew%28dff+2pDwJtHV95HZCe(a}UPo0YSY
zk0{|8Ec5<*zSGB!EW~Oa?+h~1V1Fk_Ch-=%mMFy3V=v|087{=8FW8B*fiG(1$cu@q
z$R739oV#Z?bp#BjhiZ{PUovbdR*NrCjyzk1RSOz~*gb7CT$1_f!b)3ph1XEuo)sI(
zbv7Du7Z8Zfk{9!A!TQ%<fJz({YE-jR^r-^lcTy26iqiiY<}yR>$+~;>!EF22smPKg
zSr?e=<%Gn>B{gH|JqJlwjU#(89G#c(pjv!AU3T^Susg6rrt+M*ROYN3e$rBZrs}Pa
zIUM#o$>*q8EcQNNma6Qp+uabU@z%)icOj$iPk?_<GSyyyi&e*EgoPljY<Gte)iXi$
zWPEAxO?2OV|MN!977$_&?t7}#a9S`=ezubJoMr6^l+{)ie<q-9`(}eOQ8!Y2S$G%w
zQ|h{q9?uQq__CC-8>=5FCje_$H7MMCFv~(D`J{+1)rw~Q<Kpx6NAAzesS)OBqCqj=
zqTn)p^4+x3@M5{g)Q0BJGhvC>mt>#244Co0NEVO>X&&{Aa(XTozw^L%Mrqv0bF2R&
zew+WvIksj$vwpv4U%|+0>rdbLnapY17fi`{82TN-kH`3`EM{gR5=u#N31L4NI2yV$
zA~IKvNZ3$ypTC?mlQWwG)=b}DcvEYtfMs3>t$d32@zK8bxothR%R?sFTYtMjXnofI
zY<~aQ8O9&xXxI5wNizdPFXv@bt&Wnv&J$d70!!V)XxmGTY(o#L?}4}mf!xC7uZOau
z4$nOp=#KjN{Ll`Z35@lwBZKRy$L+IxjEm9-J{VA?S0C^a03PjrG<>0~_TXV=tL@JC
z0Fz`1{(~Q<#mZp6W)=e605$cVg5v`P=j_WpsK`;ThM$wA7+u83)b@jCvUCwJ%t=*U
z8rRD#u`Z;hGFLot2=p*i!tB1@tg}`m-Xm5&NKtC3OBo}Guc^9kq8}2)I8Ao=fjHS{
zdf#tj!Xn~L^m0F6I<K`<ryme3iXqIA1=+2rA1?WjA&ZFxKpbHd9UPrz`&3I?_Grt(
z-8s`OLc)1F%tKm)KdD<$b3y%}Zna}Q;c|?;sv;TRj9c$;rCMO9AM4%OkygsjJaA@h
zd3}FTMwLmN$0NUatl7?bvy*dNwtK2&DodwiwIIIrV?>cj>c~II*T)iwROty%xh>jF
zM~#3(HS6Y|vMyTFn+rEh-`tY3(QEzr67>J#c1;BHW!I|}I_+>c)v>Pkz;taUJ`vN^
zmi1g2ERfl*^xv8>q7f~tIe4`Y<iL33IU-#v{t4-v6S-Yp=+Q60Ixj}d43qfMiW0f|
zGM-MMM=W-N=sx0}JYW*Vbg$;*#NR${+VrN!WH`&bu+o(9_QBbxpNUqDcLe762TjCj
zE!JU;@lxm@gVVFWkJafl>((b4KL`DUx|%|_$e#BJ!s#Mj&nxn?F?7C=v`Uj4V+Vmy
zd&*~J(|07dxkH!R%i3e}F;R4I3=QUmFoS|f({$-yKO5Z*_qx{AE7UeMnFb&~L6Gx*
z^K1P6q&^WzVsKmBaLRO#C{FXBlJBfYF3HA!`GLhWX=T#k&AcDSouX+9-e4U5bfiCF
zPKwWK-cOtEE*JQ^uxr%}&Q9~y>wLy|tO4-@A3O19+p4}IdvI)5eIu}&)^g1D@`44c
zYXOUms}L}_U7CHkR=MN0@oaKtYU=3F##-gpRzd8F2NO?v?fRcqs`u9wBE`5XFu{@;
z0nMlBEc12lAh~FdWu<Wx_#U>6o4L%qD<CK1F!ETvp%oOpC3d!GbZ>GKt8~>q^d{nL
z;Fm8<u0ye|C2h2--_DXe)P#*;<626EyBS$q#T#~hEvU-L__H=3eJ8yIw&Ut1x>{Rq
z68LzLgV>S(<kry8wCR26{Wa29G7cqT&dY?KoI3N3-#M9THJ${;j#kIY77criO$Or<
zmUeHJR&5upCdJsDOkG(q-3)c-R&tKntyPO=)<wRpE(s-8@fmVk25~y2$};)$$;6k1
zH=9)x`T4^Y7t3NR?9IwM;LTP6O}oJ{iExnR5L~miQCj7Z+nDo^bFq@_$x%vwMXKhG
zE216m5|ehJgf!<eM4tmx*{{Gs*PiiO!RZCL#z@GdI}ZGvuSN`H{`R$!b9UX-tlNn;
zO6nNecvX8e)%OIJbl<;reL^lvEL(Arr~-x%RR3g!A7j46{8Th>vcZIYOCfzKa^UhK
zkfx8&M?;vCd=>moCxuRz2&}62Kx#B2v%mRb`>fyY2cuLR)ufY&9VI_QABs=@r2@a4
zMxw`su5!#eZQTtDRnsF^3hcalH-w9vUYCx5`VncvT)FpHbUARP7>t>R|9M}JL^|(n
zln;i(PuSzLhv@s__UuWgUDK)E4O)IUJ*|0LScI?z6TEI+f12e5t80jg;sRpM<~wEp
ze`_-==grn$aLgDb(3an<eVmZJvhD-m*A^-DG9D#KxZFI>u-H+s4rhdi(<9(F;B{D>
zPZlM-3E`1~p#ft7c_C@6?z5C5T6SVm{BdDF84vX~sX*ym@zMf{5mI*)<4p&J%G!a;
zjO&^%d_6@%n1L0Qw7*z8Kb&w`+zM%04J(Pvdp0VW<6Ll~8j`k5&IP?NpY=bj$x{}y
z$9QJ-k7Jx9+$mYid_rrpCm)8TFyLYikZQjw2$naOF+$E)Qao@)$7>{~wB&xM{ax1(
zth^rx5EJH9n$&cNvqtPW3Oi%u&vvkQf2XNptiJMO?suc<Y04qmvu-O7yAKL6i5+CI
zJcuNLUwDPb2A$&r6_+Sl2lo(p1(ySXnl2J8XPNGs7!aGcD)*<EHzi2~!jboZ&oGH6
zg&HNotOa*YuIAEEgVL0fhZ=59-_f&?5!akFx6bR3tV(;&udoza-Ruhhw#^OfCV>iV
zyL`Up&s;sKHnFw<JpXqc@ZU23)f-0le<w>4MKOEt2L<{=Z>lK@sPPIWbpx{WaC7&7
z$1%M3Y&*cY3K4%sq5Qc!h)$A?ngI2(2~>2N)Qkv2_r3$BH!cDbAG8WTP&1cgsXGx7
z#!y}5NK<r9tI7XWc*}EDyF7q0_NRsfi8xW*MKrB_Pr~(qjMIO!j@gpA20Ly<vV0Hi
zy>5IX@#~Ma_YvYB90kcaKix{|HcfL<qcQD&p*&Rs|0crCf_ZvP6S(k`#}AZsO=S}*
zOnTUAcrG_$gwwcY4_e#aMu>cO6eQ*R#F-Qd`la4Z1d%}28slTD5r-wC`jX`-kl*J;
z?36F6tDo7Ef#I}gQrr4AbH;*x>$w>&i;ROrC^k}#w6ZxO4|SU_54=XQLjB97*<2rG
zdPA>(x-e$El*O!Ht0sgo?ejB!-5-ye90j8%CrJD`6Js4+M;unQ<Y5;nlJNr>7sjd0
zBb;jCuAZ#!jH6)ZFxJMJEoSI>yHV;usY9i#GEk#-+im$yk11?L8^vxM7mC+YjIL~A
zNRtx1s?}<R32>`4=CFb$!a*!WSnrT=%?@o;V9xBy$T@kg!4-QP#oVYn?b#R%QU!zK
z$TNxTW{s5`y4-=3zxWFxw_)z*gYN>+X2hI4*WrrzsyUV-t`W3dhRxsM<Ra|pz_)YE
zhFRwCXw`gTL**jG=&o>P7XvJs7Vl~2X{Z=n!KEAPgeS`4%R?JDD%3bCadP@De98Na
z=d~N92rYqhwGkTw7hEjUOni8;GUsv(6&VLB9$VM#V8M$<7WC>-Uhlt{Qjcw3zR-^Q
z!{C@fwe@^wS>1j|!Rv@(+ZWfO;Z9}mDBSExFCZfEo|r2$dCcG!vbbs5^bX2Y*Q{XO
zRhVrk442Td;;a-ptuo!837~Rc0hI;(4W9o+JZZDlGE&2Z8R~gHK;&Kqx*yaoJ2{vC
zV*cj6JAWllmWJE$%ub(A&kYqLi<f`(MZGuac3+~f485IZFB)(`Hwwg040g#Mwl}l^
z>d`R}LNlfEYf>ht;c$+`<BH|jzNm4s$r>M0uIxnN^a&@>hav}{9O<>D2a*{Sr!Rhr
zWqXFiJh}-Fo-;3-exgDCqr4`yb_14l-I{%J*>8Lq7)RA1CbAf`Frbu9fHGT=aI}5O
ze^kCgrJ<gl7)&dr#`x_Kla4<v2yXRqEM}BiHGJomX$CQv+Luqn#8dX>*r`_T5N+2q
zg0u7QRH1i3r<{{+q^$d6XhSK*hKd@|+IAft{*8{pLo~ShUE&*%jp2n(#CyJ2&{2Vi
zuu9JLA$|;(dP_f0E18mTD8+@L1iV5eRwt+RlvNCVj2s&lI^6`2W7EB$`YOrS_4{9B
z@lqM*C$S_laB39Up?HJTIxEpt{b>P+GAR0c=-HFA#oHO~G*W2E9Z(d$iB7}Bn7<B%
zYF6^Mh>&xsdw#n&5Gfd*CH($EFxm+!N=R?h8EhY{RB5LDgD>f$^=vuADh}7#=X`k^
zxedjP@!d!HY}?c{b@ZFAZj9c#T-_2mK!F*0eBAgee-PMLy9u~sQn*3sg@wY|$7#PT
z$C4@i=zlrNuBjX8@PN)OGQW*G3HVQr$>&HxdrPg-N})<e=d53IM5WVD$b3hq6RYbt
zeBTlRV$DEP^UQWPnGl9v2cI3C#a1<%mP7+1qmEUSu8s4P0Ne$u$aex<Pz;Cis!mYp
zi-|`i8)H>ymFQOz_f;8x+>$o<;MN1Q4B<A30@A+Xm7j22gl+0j!2xsMep9sYSG$g_
z#tq7m=dxp4{1(q~ExJP#fI}H)f$u9VG4aoPj<m&<qi?p>E)5!He-d*RB;~s61azX^
zb_dj*l3p6cE*|R59hTo+(yA6?NnWld?~ggEX1#WONAM^R=lTLF%10nOFsuDyvUu)s
z$}~Nvvmd~f!yiVgnK5XX*Q3Okp7>BV1SHR_a1~hZJJ#DFgwb0zGa~?q#nhpv0bj>7
z!5Pd?OzE?gTLvM&=vzU!cT>BrnE_oo?GJ=rw$V=UbzL<sox1~_Cgw1T3PX+_biT>{
zwp#T(F``=elUN}I4?qv&Ajn{hO&tWIyY_=SDB9&QpD`+6k7nz4;J_30oSIIPgyU-Z
zV9iJ}1*e+C`meG4p>HxOBPJqV03uo858uQzb$qfV9IP>U>K?FXko{>_fltyK?ENL!
z7pW;W+OjdpFUg|<y)lfSS?-+@?E%WnF=Jx+=2-klVxYy#gde)>6|-{Ht$&~%C?-~<
z3+(cIAd2?x%SI+xv)T1j`wYqXByW080-~`ZAHZ}1PmQNA8fyNXl0qqZU5s()ubTtR
z8?fv3o{TFfx@tIZ*@It051ecbow(I+xZ>z)Jy7OKTC<UipCaFh+gQmHeN0o6JmSMp
zR=;vF@3M8*WPQCNXtJoeW4vif&t59tu=Vlsn6bM~&`~*>H}_pgVX%bGqhp4eQJi#p
z<t|^ux3fB2Ojf_Xq@H8GHTgtG7Jr9oT%USa=Tn5lzNC64SeKOxo1}hvHK2363C_TB
zRPBFbY^(Cn^icb>=Fq|E$2TDnZP9=(bH+m29!J_?;Uo&{7j3Idpc@e7=?LqM5NBky
zxdf$_rCS*><e!f{uG=_}IL94*SjkXR1eTvqEYl|RIH4E@xC+QK13z2dDez7^#8u$l
z2F}sVmIIG7McZDtbSXx!OHd6dYZ-xb!u!ES5(e|1*ABH6s^StZqo6MMSlR)0(_0a;
zz6E>V>#5t@Za7IO#)S<RyYR;-Q4i_3zm`xLNt?JTEevGh=1gYVe*|w+rf;;Q;`AOD
zejg>F`^fM_^aDuy+-%_~r_O~p_9|_|3Fggivbn|HlNxZvh2Wgu>h|Wj-^Az>XJxCt
zv39%>9_oSfH!%Y(Mdtlvgg<}eBn;Ty?ot%ji-@RRHi&Tkg>%zRYf!32D?ShHT@XX~
zEiV`;KGuXe-Q4n9+^b*38E@9w)jq?bs!D+#?#C5c_f)UMC3pDrnAr6TedyQp-hn#5
zE)dd@E!J+~W$*7}Y?aoB<LiywZ9|%G3BVt2klz?w?qDXJU3ce+FA=BEe)l+LXtKNx
zoL_W)v3BTgBj+4vWytFd^YTh_UObxp$Un7PP>q>OHwgi%|K|&Poa%c-;4(Ysk!;oI
z5o5{Av>n>fdYRZ$@u~D$_W&2I1EgS$XaGf4_>-~^pKUHN=i@;dn$%rhRu3H2Ic0<t
zgddeWRX7k{Qz7W|li5K}FTp1<(D3|6Wr9sRO!NApO@}tx`EN$m8y(aRe|y#|h?2}-
z?;+tfgT*hXqt`Dn7Xo_n>emsXP175nmMI;acLKiK9`71%mz^Zn>oNZoa*ryAz|>H_
zC*^#ma6sJo>h#s(W(nr5eWZ&@-;TXU%1A4%j1B9eMT<*WtPAUqT0p?w9kKRaxstw~
zLDfai^@IC;wFL%Up3=+O2epfXE1uFlDK?1*&viy>QP<1ca=#ba4t)GEj;n&YF_n1p
zUSjmtdqfdvmS+-zCL9dprCti9c`0p=0y`)9ePu_<ln913+)|Y2iO*j2?!fCE+}@;?
zQHKXdEg!8+iVKroI*3Xw6PoiL_Db<M-aC=%%lvqM!%uADJ}0)OENQW1e21YJDR@$4
zw0e3_l(JZy@lI~pjx4JULDOSg1u&`;?}Q1pV0rR=(OWdi|B({2@bPJ=FxkY~(TT8S
zmwdx7aN7vKj>r$$h+Ky*Ml4GD``Il~3>#8zd;B$2NogA<UM&8#cx3*%;S32)pP~%I
zy0=el?(9j5%cN0l2e$v3JHTx0`0Pt8@}t?&tQ;jSu|eIUjL7YhMylWZKnc{=NyuV>
zxz#~_9`u&oZq;&+e6FzLc(-Th?t;kxvKT|@zuzVAAvVgeU0bqPDbrLH>L31PY7Dtp
z-oMC@PcC+@s~jKxQ@`U1<MZU5+OZq*bL#bmeV(W0ViMMZbEj*yWi?Ml__9L%n31x{
zxd+RMz;)@M9H?&6TPNtEzC`x;AiuEQmu1dOe3MrsG$aCC;uXc{mHp06w=DZGXj-BI
zsb43x6(>m{CX0gJp<zE|4x#%e2WO#SEJm13pWKiQgC3~VNWn*!o*n$QUHU0nwdLR(
z)zv`bV2MW-^g7$X@fJ*@fFwhiWzrE9blb3BDiLa;ImIG#ttJTBD#~i52d%UHNr@Zh
zg8Dk%f+wG4R*nw#1X4WeT@otjG&VodAj%bM4fRZR8{CD+m>)}UqPlnL=X^H(#2Cu1
zXe&Mae&M~NM0yvfYRe_)6#g@|d3vt6h}luRO);)sZUl~^#BGDqB<&AQuwJkq%f8(`
zczrcSmLn%6Pn-G;%D`3MkC|G6&ajkJ@g<!e@vEN2Zuic`7$zT1C=wv<S{Vq^f0nSZ
z2KPt&MzfbxnwxTJxuyc$U73ViYB0npt_tx#J-eqS%Ldhbj@NUO{jhA}eUg)rnI3cV
zPigO>^siz^y49K|tnfQcMoh>4ei8Vy_3R`mO|Bk>u-COK)unJVZw5C9@g=$rQ9_m$
zziYDx((I#LG{hwE1@#o1?HV>mBzrtr=Nu>mEY&;F{Lf_*g7eU;I^X(UentwCOL%8$
zTMTyTB^T(CHhZivmI`PT@Md8(dpAFY50?hhXe;eccZX}q_2h+|CH?@hk`U^_ZC|a@
zW8DWmTEmpP)JYq(S%HoMp{9`QsyzkY7Mk%dAjNvj*ax4ATrDZ^)LmjKqEou!>##&Y
z0&}q+sPInlC|R_)N}_OLM_)==t<bw`5eh|6RI_^y&X>3pCc5-gH1+r226#bri_&;;
zE@FbQOtRwS&=v}};^<n7!hAsx0ua>FEr=YEKkeyX^r-W{ndogM9tuMyz*QnVQ!A_3
zs>v$y5ZrNa$ouhEO?pbFo%;DFpB_D8k(pCV^^m|Xq^ch2QuDZ_k?LXisxtNd+0(ww
znuMg1^`DH$@EeGI!|3D`n<zg!R#y!N2e*`G_1TAEk<1ADxup8_-W|-9Vbq%()$v-{
z;A(Ja@+l4|#@u+wAXy9RUSS_}YSoIid64nN(BT>_Hf^Vk)i*_{e04uWv9^eI-y0k!
zMGBGM9E>bFV6Xe-at|uCnB&3iMfSItG8Qd2a|h4No$0{EuUE16Wp2>v@|Ne~*ZxJ3
zNWxMM`LlcTqghW;)!3$LEj$C}QtKNaQ_BlLY~S=Nb%@BHy-kYkO+2gZv7d2rSR^t@
z>c8LP=$if~UD8RkX_xig(`FyV8|E?=F>cJyT5J85``W=hf1V3tSapDPmvqB#XYN0;
z`*IV07aHb`rG3%zv&iFa=T!gu*<kQk$hEU-((*%Da+03$k?Csx=K&I$^u%sENpOga
zz`_pEtBe^+<@aXqurih~em_zFmO;DaW6r9jJ{>$Ca}SNDA88*o;t29IO5&*`tQwnP
zpSgM`AHF42-rV2+$)3ramHeLCeDHkUWB~0_`E?2l%ir^$P*FWwkjj@6vy3q<AK&r9
zllktE+;O-_{>dbxc(r;~yFs(d`a7H89|Y@MK_eNcK7JR<3hK4-2EVf*JgxO>G!=^P
zm9kl;*LN2Tnvc7iV1kxvcYxNwL8;FRXVoVr@E-AAGk64A=ZC>M-{ttLEJwAyw8o8(
zL;|l7ZRcKobPL?RPPD)<PVX^UuTA?+Oc=^WYFg8cozI>|?KrqF==fO?6S#H_e-&;5
z1*`e3;MY#--)KcCNbZ!l-N_uCFppR4b-AW?uh-m}G09)YZ#m>Tc_u;iZ+>vIMsgj4
zXrmMybzS$Xv9)OYlS|OCtA1`MM*o(Cou<o@GRvW+;xUD*p2`%=P8_J2{}{TgSb1%G
z{Y|5ZX?eD~sF^ntD?zc<1iFuBiea41WsAO1nL8^j`A^`LB?}$~zqhLd+7L*4KQWDB
z?T<uY$+w=XO6F;-BMXNN&m?4o91b?0UV9V!4%8VbwlM_QJoZh!P(dOHYJb3ub*HIr
zit?RgGHf7>P#RO)A9a$9X?za1Z$LU*UV_dy+>&k}fS}^MM#30wDz-K_WbTx0vAcX6
zj35e&n^-=D$7l(~Hxap+r7_Uvek`SYGysmeU1vC(dEbWOO%;CpI9j@79*?R1m^Sg-
z{!Oz;_qHfn;Cb;WDC_npZJg7zY7&!YU+=WdE=Jr)_G8C7s@)<8vHLm?1VTKCzVva_
z%UI9kY*mp$h%-j`d9l}Uv`xhVc<VDxTXeOPf>}_`!)O!-H_j5PfOgx@`(B(D%EGFg
zRg`L1^S>q=2a;taVg-&l{sh>TzkVD8PIcs28Q@_yLDQ0!&$!;Ml`*}E>f)VbXcLBK
zMXXbv<lW6AF^meA7M%r^UX|6Gj)3;3iwk_?l^LoIF9ttGd9vEN2O^vkYzaa2$(R@M
zJ5@KIpjx+t4uVXudh;TnJtu#VieRYcr@!j4{URn$q1>nV+88HSR_fzp3DmfGp)_ch
zwBDvQ(<j5?1VZ0U&t%y+-hFf};rV7#2pX@x1mRp|SJ@Hpe4PHvCP8>zYWI{3{lhDe
zh6Y%87{A}OD$LPXUN1QR(#iPAes(WVv}$y-wqMk@M*6uNF`iqwXu8pa>-$^JgseEG
zgzz9k`XA-yitDQMS8Lxf3A=go=q#bbf$ARwW_YebQRm)2*Q6{4K~<X-LYpou;Q*N>
zu765v_uM@>pnaEo$7}KaUd{5vl?;2A%D~M!ExfXFanw~p#Z{%Sua_V?x1G`zSwop0
zY`E2l`e78alz<rP6UG~4VlrDk`Q8NTAs?A#$3o`z7>9=g`^UrUZbDE24h!I6*z^4?
zN%KX*k8Wkd;{Jgd_OQTZ&pA*uM|Q40;>ALm>43<H7o%g5TMO*LrjlR$BZv9)Z#-a<
z%7iAvny|y86U#nf4ew0cqesXZ6yd2~`Cd<l0+u*mD^~K`y_(<}UAAlodV)=mF;XhY
z*i(oVcqi{vY-kHCta5vkd#*$JRmG0wSorDFIPoA0w+v{&ZQkf8yU2L*rqNYJ1&SIu
zhVn-BTB`}N40|DL*iecV-kkxr(267qT3w0v0|Vdzl~#L(Y1<zjqIUw?3?8cc@T^UC
zkwIEfRl(re@#LMAB+UnUFe>u)X!wq3HGS)BvkU|&0AAEoM@Fl4gkx&x)H+gzveNF@
zIX3g!vKI)whW+Hxo28{amnugxLvDS9ck~VityN@q7IKY--MYiG@|l)Rh0gTLVYwFG
zT>BIZGFyVj2ti0X&Ak8t4&7=%Q#^TeY^z%C#`3`;=8oBrvZ4Rj{YVS+&J;eaQMFpY
z)g(ORw~u+G3Gfak4}<n8uF)ypp76&}G0A&Hs9Od1kCu+V!)5BQTFjn42dDi^2e0;e
zB1DO#&hA9$4$aoD3}y0QPcJjnY<+IAS)}SF!_-)8o?OC0Waodtrnh>w?`Rd5xUp0O
zaE*R=b;CO5j{Rqp;ynrXgU;`L_sg{gAic8@$A^mrCbe;f{oM`j+f3IWDA!`HQGwjg
zuBz_k_tL?}moayqn2ph?E#FEyZGU+(82l3dM~lo^W1pD+-JqE62Co6kF_Ipl^VU|?
zoviRhB&|ZOQ>LlKs=WOrt>P|c^{^;Yy0uHB2hG~=X~nr@c{OAc!qRs;&54Q+LiIp4
z;D5BG?jp)2Sy!|U`)vO^X3f^1{Yhr2c4(C8C^($}Z?I^M^eYOp5Nb%B6r>>2aJnf`
zdDKBDu=YEaCq6FsJE|j3zIdy;v(g$o+yC3jsS=m4Jjws9H&_h6lZ}jXwrr0i)A+ke
z{Wyq8$j4Lnf56C>W7eETg4U9w)J1>=lT9C~$9EFn`0QF?kN4t;p!1a-x+&rHTFTdD
z5b_?E-<wkuONx@(sE!2iHP<R8eEQ3WF;q}h5Z)o68f6w0KEscOvTHluVwdH8COcZL
zOCc1wzA)*`4M7>sKu3W*Kp~l{@}Hy7_Z8{bss^vvfr7VqOwDl9zQIHuzjK~~GX#4-
z9y$L6V*JibtN7(x+U6fB88{{8U)C!A)FYO5$H05#HdMeqOe8)4sVRHqMlD~@l>gY<
zD-iCngf`f_<?6^;c*lkT%|K>cmkp5WO5j*XA}c5IVsZP1NqG_pgtGuA2qQtdAKoB<
z@Mv{pQ|7VGroMOD9g{*=FBm@|-Z$iR_QKd&7$Jn3Garu@^H;t2-kjf3O4KCra8T}d
z+n6~xzv}f?6EE0J(}{-F)YPMHb29WXW3#9k-7Y$f!Oh<XkBzN}DOceN#3lN_ksTQn
zh0QpC0><*dnbH@2e7+G<_Q-sNs%ck<tU$6&+F%jTZ5!~JUq@5GXEZ1~yp!#AJ?-e&
zuFQ^-WOyi;Tr$k3QRCEW?X)F=&?@-2#O0BSZ^W#*8YpWO(><Y9-A}AT-v~VmPyt6l
zgx6nH8S;NIcP_XDxdR|wR1#`3^N&A_1ag&!I>aEHS!vBk2ZuZXH?kMp#N4ZT@s|iv
z7Oma^9|=nO#{~-CTD71aa9$~?NGQFFg5VZrMD{3;yK+Nxo^JJM1LzXn&*S$Z22KpZ
zLuonlL%sD{=^e#o5;hZ2_b5@Ko3elAz2xw)&Ry9MROgH~@-TxdIZA2;;C6Z`##W0o
zKEyALZFWij%bo6UMg<e13pq_#<3}N~ExB$Ig|rXCh1ev6BL&D*GfkUo^V|(<(0E>_
z=j*o^LOgXe#!{~0qizW_&@Wal{hl04T_s%hHnmY8K&*swC#Fbs4*jDcu4u*7k;48c
ze*bZm69UzZ-$gHZIN(WM^VwRNes%CRa@fS~@oZZJbY4B#G*ANv7;3KZQg%Ha=ifKi
zdEW}NB?^9kQKM}h(ciuD!HmT(>uofLhLQV1x6+uKq`icb%gN!BXUq)GnCh+1J9!H1
zy+jZMdee^J6evDXadE+s1N1@zlAXNnIs$8yD+qT1+rIH#b3UC-iq4-0rgobC_-yWj
z>M(43Q*%?vNJZb&&Z-MGVZ{G1_)}BI?qS1aX_R@<+5nqQcL0Ggd$AkqY*vxUsv<~r
z_Y%L7Klw-)jZX8|GwedpD_Y1tobXxcKA~Ymq@d4@%KNZKS1bA^yn6Kg3|9l0JIOh&
zhR;58@P2|I7(KBlVSvOxFSj=>PuwqLEG-GMp>LG%(blRr9uT(YWM0*idl>VwdM|rF
z!DTbGtFL;$`sul2vCAv4Su)wrt1TO1tS=DRt*Aut942_CS8bnea-wZu$PWqw$pQyX
zi^MVoPVEPVZ#|k5^v0R*yV&QqUGAOeubb&c3rV`eF_UM>S0@L~)~}}cE?1sb-@sR0
zu@>^wAcqiqdp(CLV|__$HK`mYGPgvdMo&mKADeIYEl<8<o-oEid<SuoDZPC-z+CS$
zhz0w63KI5yfhrd{q$-wFEM<vpr&WFqi!!4j@MyfFtyO+D2OitDKw)pZK_a2>>ElEt
z*~#ke?gii{tV0?eDU#nQDPuJmZ5i?0d^;`n{<pS$76mwlC%eK)7=v*1p9G*^vB(?5
zBO4nsuW->?jOJar6CMhhzh+NBzu+$PBc4!cF5Z0K#PNd@@(LL))J=q-%&1g$@+zLS
zb6PnQk%MhCQB+2Orc$ERI%_y;cYz_N<2aiCWfwJ~ZeeY9orlRUKe_6BlxBfin}jpF
z%3O@$CZyr|^VLiDu!<_Jf7yuQoWi8inzOw1RK``xd+#6&hEw0r>180d*AHX{&${Z5
z6WvpwOy?_dueeZe5{jZ>4c9w|qt+_M_w6}e6?KWa*0TsEL*pLpe+k^<Fj0(SLHW!k
zYm_k`t-!{cfBfAZxSUFbXtEWKI+%fI|9-wm#Otu)ep+K2lg?%DXvxOFC}Nc?p~Iv*
zKIO=5ESkfBXmw+sZEtsy0vFB{^6GeOH?2jME6^JdZk-<|VKLpqQQ8wMMr3<~vNA-m
z_&z#JVd=h5N^+s%C1kPZLeYM`G}ibec(9^$r_LiGV)Z$*EwhZ@lhwnmS?GsqLj*r`
z98X)B3^C(6G#Oc+GWV3<4H`VUWF-lnKkz1-55Vw+irbOfWfsy}H3&hbOn9=rk+;Ej
z@AUbt@B7qFXq542H~VS>L5xoMiF^I>xV#E2UupYTL^(m1Rpwx?M-oYVGVT@9+}u~-
zb_ZDNlQ@~Pjvaq#kqXD{obLr4$t2R9%Bpy5$Mz8RqOmJl+Zm2+h=HFTv>No=ZI9bC
zT${H$;~e?r>CG)a;?0+3_T9aYI&C+om#RQ+XWW1-UXFel`t>G4(|J@j0KDu*P}s2e
zm(JNQDn81>pS=N>_tmjvUNHTLXO^7d27DcQIV76ZK8qEVJ~v<%579v#65X17{QIUo
zZJ&8NhD<^13dnDn>adAF4L&h<Q9dIHClqyl3E{Bh(;tl#m}RGqy^1TGy2B^ax##<S
zjK+8~91qchl?MSJ^5y4Zf4JEcvt1hy;RuQ@^chw-2=UqqtQ%a62<c_M>S`^U=JLA-
zO7gTE>HISs)8+ajQd73$y3YD;A2j)_dUUylS;jwUX?J-Ul0u$IW-PiL&|wfn!#-TY
z+mzYMY;?6rMaP^++|K`}i2)C1Brf-AO<j!`3^_qjqKrW!&+WmZ!$F!+Br!+cL)F--
zS(v-uT3NNla_gqDEI=#Qdc<%4O^GLvG`;1Uy=8cKo$zaFO}xU2J}x&fm+S~r8=3@1
znToKR;!hB{w8mjB`mSpmuS@81{^L9{d-MC`5&mUZp$h58$KcLzmC$9axgv=h+5c_T
zSj77*FTo|+RG8*wCZ!^?9F>A9RHJeGHv=fWlDRo6xCvuENgvvt@SU$XjAa8)+_+WB
zYa@Gwtv-awwbFx#w)v@;1R1*j$bml8R^kbwQjx#q#)`Gwk8+1Q*JAXk@H=5sN7^R|
zG<Cl=IL^k$H~kf5ucSfEvZ)~?yt(7{;l}2Q*xg^m+&b{)v9ofmOY_ebkb>~(y1nJa
z@w95-^b}2Mcx+^4RJM+n5%DHa*Hb6{Z#T`exlqXGHiVM?^7F9*s8Fr)*`alno)^9V
zl#k4Rs}T!b!)rCh^62E6;F;-LHxip?S&;K@<8yzt#WPFFnXKuZyEF6hN2HeQ6<_kt
zVV0<?4Yck}ORJa`)DLBfcq6f*f}X|!XlZv~(B7BZo!1eq*`pCYdx`5`TlTmxKAVe|
zVjPDSkOy0kP!pL@Cd6lRk``#GdzglS$x+^})wwsETw93_zmxV>?^tZ=aWV3GbzZdx
zQM@7RZz)>pyl*{n>+3|TPaE~apt<Pd1tn-8Qvok4C!g=%QTYt;_U69Dm<SgKIp>Eu
zL;euI32#rNKxnbJ5`&4=O`2}Fq3rUFXIY=tlj=ssO86DJ=n>|Lvp>k~-zQBO4CPOO
z7Xd?xg&m9y+S}60MdFvcpE<}{X^}a;ESZmKumz7FJl8Gi2F`wYSC72)X<pZ03iV1d
z4@?rfE#%w1a5Os;;a7(}9+&1py;0y1Kj??3={yMg6VRee(24$|fR~k4W;{gL{i~QT
z=Bn><OCT#zY`x=2w9;@!Xxgnd0~^8cA8O2tMw5H4CsO{$`X^VJj|Li331fb;P5KO9
z4uiaGhX&iD$>QsCCw;ke;CL&%<E8d(*~n47VWgns6qci}%>Ou!qdLRaXzQ<w!boN)
z>pjfR8;-60QJ-XXX)ZUKx)XDn{K4*3590AxPwnLwixjvn@Ec9FLmrEMelA1iQn-d^
zc7FpqGcsPk)j(5SchBBAx<cBF!Guof`F_6HQFw&^7oPZ=h$h+5kT76CJ_ZAh<`}{F
z`rl`t;RHj5C4(>m7eol)rdJAk`cd6}=3Hj`mjhF1Rwyfv_eg@zpj2uXIXhttKZ4<s
zsT8oyZoV58X|~&@v6F)-WTvN-?Wr+*<t8FyRqJf6s*j0|E#d5Zm{9{=+MABN-b!up
zz)pg^VWM_>E^W0y0(-cB)a&3874E4MBHoi2{g~<8-|OVWkc4A4_51!QhtI_1tDc#%
z9g^Xx&Rs9xU)dTq4k#wFJi-+`Vova8yJU7iL)x2PRS<hNGI{)?5p$Ik@V3;qw`kai
zz^7rX@t*%>!8Fcg)ku4^b-tldTaK-$JE^xn|8cTu%lGn+(C${BQS+<2=&xlJs<nn?
zFvQg%f@=tBT7>zkRz@1T5>C{mKB>AhhE9Z<%=YiI(y%Hr!sX4==JPMuPUv}QIpN+P
zi=_Iv_c{9u<iY#FUMO_VWn#`%T0|@B$rP<931@$*w+~ia`vGO@Zp^n^VS;NuqomgR
z9TCsU_ZPOxU_%7!Po!i)xVwq?Dsymn?81qz?3I5UrqjryAr}@RB3ufKC_sN<vMgA^
z!&k+1B-pC9kyM3cH|oDn5T6QBtv0Jv`Djm{b@Dw~?<ZHUAxJ=V@-NS4MCQ-r40;3T
z3-X>-{`co}U1g763we|lh`DTjQ~+NeN?mo>TWrvuYT$eo%bjKS;l$d3$;ewl>Zjo^
zf}u}e2|8<M6-NAZa7(9lD~?@c<@OGz8Y~^g0{<0y$iN31=0aA3C*ym(+ZG%YJz_W_
zK|Biziizsk>?)#|hemw6i%drT6eKwTnW(R5D`3j3%PV+~=I1)13qU!SBH>o;yC*VI
zceAzUHtIBJJk>T8ym$t0cQ=m)7ulJlz-#+=XZrr%WiH>;CZt;LnYD4qy3AxGg~SVI
zlq`2%8A@pL4s1(=PfXOUtk_gHRq9@f8QmH_k;c>=fOm%~vYuN?G8lXK(dng_V;5}I
z83O_#RTq$hwz@h7U3tBq!_+`F`D!+dul{H#;UM+C=ke~l8yp&ppaA)P5N`$^3DVv+
zJnpa{CFR6yZSj@j9*_pzhv9t#Oy$d5UeH0DA0_nJ!b{jYD{XRLoo*<|{hBJh{I6wD
zx#o-r^R~W}6Wf!qJ|D9g5bPJvS|&M2ec|}3fE#^(itZwmH7cJbKXrB9YkF_qtI9Ca
z!VsLq*KYM@I*)+gx*}TZZF>Jy5p(WcJ-$3b`cu|`Z=`Fld9P`ebcB@Jb_%RLZ6z>T
zdY&rChYB66GIDWu?~{|w_WvnUX^13R0TlC@^Jxr?Dh&&b!7n9dw+1Wj_xk~1J?@}t
zPruZ2+9s=j>gIyB6Ix$JpRcyg5sms$FapY=Wkm^3|9dvF*>#o<|B#zLo(7Bttp<(Q
z$aP*r+*`SZuyz3K6I!D3KdsLHJ4+}BaP#0Cxk^aSc_AI4p%IvVsBTn%!}R{bag|}i
zgBO9&i=K_A_w#Dd>LOtEl`mkI#=gNDl=rZtsxoY&&|-D?DtvOlZ?kNq0^{8i61VUQ
z^Xo1!f!z5YFFZ4swckatH#p$v?V)Tf8KcbEV5q$pc5Ai`R*V00s`Ot6XOg;T&~Wt}
zcqOr3xqbNL1YdP`@z}*!4xVz~ca+ls9=HD1p?m<w`pnSNZSXtZy1F;Po~#tI`ch2u
z%Fi%Za@Irs1V-k{m7KdkT`pMhLI`ZqbufarwlW!A=ewU`l)Bnid)5q_tLHjuxIA3T
z{h!ZgDS)3Rgu&{3Cibhl+sr;0lyjpV;P6BJXF<zis(vZJYyZrDRQh01W<uI!RmA1U
zGw-Tj);To#qDMph>o~Y5UCsYwr+e1Q8x5K;bW_Ldv$Fi!?an=Jec)+87OvQruMYpy
zsL{{&#62S%OWY?~dF=&pyTU2Np^@VAkc_9G{_NPFGSiycvvw!>lN92|R!zP4(bm`0
zan7`VqiF*^iS<;kZ;7<D<3jj8mBmK#XpzhD#{Q<yQry0S|KGJoZSy0^2t@z?Xt?)x
z3yo3j!Ei-gnbi7LTt%%}*Pc91NNY_5#(Ck(ekG#=RfJL9vLA5de^d*3J+em7nS2|+
z)99qkNY4ZP6KL=?n-4)6s<#~FMUVyr$GNE&ib;0TsKCK@RWI@3r5G9m*Z%jbK{yvg
zzYfSjac2P;GeE?|#g<p-dv{Q-7nDG7M_72BcIRo7VnEUcK?wN$e+Z)Lc>7mH!o7H{
z$va`_W%cj*G`Ik<Pefup-DcA(Jyka|y*QR|lIm+>AM`}-q4(faZRcZ<EcO7`wk=_H
z?}>4*ms@BYY7BAdXAH`j6~yFFf1a>!boL8Vx-;?j@Y&V(c>(VMYgQm?0Wlf`KNQqE
zg?|X2L~F)k)@MHOO>uH3smXVWjFA2l4M<jo+Mt_0IoS4R^`lJe)Z>qseV$%?ycFaO
z92!Ypb?HqFy!~RzAfh`|x*^SC#*=SD=Wj?S+A9aNJ(3z2@cc^v{YcB()Va`AP>Q-C
z-cV_m!hp&Zq;SbjCkb;Nc;F{3ng6P9^L)Oh;FU&=t&)%7@{Z3)&D5SkKEnmJO$p2X
zKbkX=od1;!{0NmsF$VhzN8#na6dn-nT{LC4=_9l<;S~kw{9jn}#lt7w|7RnJ1~_K|
zk@@D3IQ7t>O5fKH<D(~jWxid^=W|Cgsh{-(&>*&NWB!Kz?TGkq6XMSHaM=N1jIaz9
z;I+Q&LduuLT(w%U_!QwF;k5GycAwQ}B@Jcm0006KH2_E<??4&jcW0eIkW|kYbczF>
zXPPWA*G;#6l>YbxQTD%Tg5dlKE6$lk%A2(*;eu%#;Tzn_h)xyz{gGGdUe%c>;S&If
z|5#;UgytU)M7a~X{iHAhozvHx|Nic+zs_iVz7dTJW}nDCxo{j@ngBLI7&-nAUa7SI
zn=a%vh^Su60A9x~S;@cuw2EJxUJFtUjU@Tj`p#$8P1H?q6_oog40EU&AwU5Q((`{r
zC00xNA6z~9rb@U68hg9*c_Xa4q+3gKALGr@VruRGgs5xav=9g5V;9s6;U4%g%`ZRj
zGnKNFcjx>2C#jGB*Uw)~dwl^YBOtMMQetrSTOI7HP;xsj;bXXI^k05WbKy<mC=|Tx
zo+5*_bhd78=9mAe01&|qHe<5gvwizpg#V^xoqz!Pkhp{V4+8HFX^S{{vVb5^oIewD
z62AQ>P|M0OS{Z~Y)gAY^_s@9IJJcPxkZ}Jex&at{#T81p1iurZ^VfX6Q^QyH!gFvc
zmX%!wpTY^)P>X3GTfNq`{jTrZRcXC;#ID~5EW9STHJ$Jmlooi&;1teF_8^yH_Q*N;
zz-7VvXShUt0kYeKB6{7hd+mC2j=NvoS+xEeF!7IlN2w6^>}0Dzbp|xF+9xNMCo6~E
z7c#OsUy+)$d0soc&v8}yTY|Y9=J1N<aeU8CTMIMR=VY(K_y71fO4!itc*_oN-Wfc=
zAM*-Yy|4=c!Gl0B9}j%Eti+pJ?^qYPpZ|?gri{+RF7&YD@v+$XN`B@zu523fKWzU*
zah7|b?tjB4f*N<3QjK&L|L1fcXJ{O_skpO7w>D%v^Rc+1Ktv7uJ|q=douYX9W{F&i
zP~5ND<w(Kb387q~@ZUiQWoziWP{arrB#hbm>}B>p3_eH9I&IR_Po0HbuKT&?=Ja@~
zc29VQLw+mz%TyU`3RF<8RGJqs`B%%x;`h+(+GEy;by7}?^TS2v+e~4)K<ejX3`+lr
zW?KQD85dLh&f34$Zk^*!sjf=ny-&Tgm;Yfa!&~~3p7Q?*Z>r3i)cjGJvQ@v4f`$sy
z>HnI}?H!4AbxJEJ#nwJ*xDA|RK!y5gxaFS&wjL%89tM2t=`C_Qvt(1M!ED{wtk;s#
znepOZ8aoho_coNw>s{sYwzG3Lv>9c|H8ypcZ0c<lufgx^yc7d&pLAUYPQ0;I2L~wB
zJtw)I@JBL7YmJ!_%Lnxv!yFW6emX4wI((k{a4$1>m9-9!A4*xsdMT@$>BYak`m+0_
z%oUM}XoL`{(1@^+W>HG03mFs*+nA-=J3L=KcUin@zHYqEeD<4X5qmnAD#MBTe{{Wf
zJX~EDHat4fNt9?25kx1tQG<{ui6nZ9nv4>4Fh+@%L`{&WgNPu}dnba?M~l%%w83C7
zm@vvWx$ozBzTfw~zxVvV_gQ=Gb*{Cpwbxl&>@;NQyzOG105LK7RGR04dGRIpAl~x7
z%J{BxgHx|;$B#5mlVr@6g-I^O5$Kl`Jec^Yjd*JID^jqW3e_=lCbX}NZ@OrM2O}`I
zRmR6sAr#RWn;?Ht8W}UWpgYAGt@UAUB<daS&qDH-Lr&Mmp-ao>ZFqe6Ys>qZ33|tE
zRf>21eyLf<&j?w$Wh4%xp)6YE#=Zq#h)_#GE-+J-!TQojc>t^sl;CwmQl#ndXMxV)
z4@^ITPiOWS=Yqk8t$g9yzsq1s7cTzid;Z!czLH>EV=T<+6$(~XNCOc)r^#4wWhSeO
z3#KqpR>rqsg17q7C*Alew;c+q)M07TnqMrcsA{*w6M_QdbWI$KJwh*{B0KN>7iT?Y
zUiU9<&Ovgra^;ASTl@%UP8-Xm=KOoDvXH*|_-5^wa+0-U4wAKJ2;4&XrrhA`S#RC<
z^#dUzf4zVPahhvS{(%Nzne=%EU+XyoBBtEAbs;gMoT1|Ir+9F2l;xvbo_hjwy)$%#
zn6jlYhiim6z6-BTHC_1!RJACM$Xs{b?7Y_(1!9RY%ReruH~WY(<!=?^)4zygzn#}1
zt?QQIF;K%BU+ok`I?#5@k6SQx4s+6;pk|kw@O*KjHp8!`{@Dn=Ec)k>tC=#YgR5Cx
zilb<uN6lNsuflom`X0nZJxtxN0@(^<y}KK|OW#r-lihIWjca!mFQPnx%(vp26?Q;>
zKQ5{}evzr*kd0GD(c=HO<e@=J#pV}%0p?5Ve1El$8}%`>?`I)TEx6crC%0$I^tioa
zKZ?X2Mul!-vnXFBtYX1h_}Eu3vbYKnR<wHR*3%fA@5G)QkLCgvL!|3qNV{tr8azK(
zA}b0l*LL6%`|Hd!H2)j;lcDax)S#!1Ki_TEA?q04!DX&amZ`upL7L*H!TEoqH7okN
z5Kr>}Et&wqXN;4PndUoDbXE>~Bg>E+MtXVjk75=Y8I++Q{g#dMmez0?5EqyJjZZPJ
zM3qRKPf6wth)q9yCq>5Rpj{KXBiNR4R^IYkVY%f^O_>uy#xgxEcvb9LcEK+gN{Pp#
zd4koJtvaBb2pJ5ill>_|c4HOE|D&i+R9zmKgb^WpjtEAf>l8=CgwK3;k6-5NEB+o{
zDWT2Z+J4O%APg5n&6kh%i2IqRwc`Vg>XhMfn0Yl&9H=oPxi?31t`Pd-hz1}0b2uS;
zPs;1wve5?Yxtak-<AjjA$1TJQ*`WC}lB7CdWVjFXeqT!tPDO!0{^`^gKhY_p9I!n-
zP-5!Jixp2*$Z2eX{`!UVyOv~eb#glp1I_h95qc^RU-E3v#t;ozrfTZ{0IlOX|NZNs
z@hul0iSdtANB!&uIaL`+#F~*1orV8Ev57`TqSQ8hcXhb9S55Y_1Fy(XPg!EArInBj
z{d$akkvpT+6=#S>dd9{46dkb?u)}n*Lm@WX?4RgKS79-5Wzb8_fBl@uEYzUO-TkKU
zB)eZ*Ko<*>73R3b!rYMh%GalVb5MUB%%eVEQ(`0$)6jri_|_)<p4c&?e)6we#Z+lm
z#A=v7o=;T{eT}s0cw8n4A(jh5F*y|vl0pkkER}xPE_R?PQiBlA(D-nf)!Mc;qb%zk
zoN5eDi!8NpL)VhO>V$8#@(rn9xh=VreRhDxKBC)DhwRqufYfnmZ)vyI7|(SG?BHCn
zLnRR+W*OsicJtdF*()~vP9??}nuX3F^WCTd;{PfIqGdJ~>Q>jNg~3A9d*d3OuCK#=
zobQ_}d@EfzQbU$yqu+Z3%5DfN=go7n$bap?SzaSEz)uj_7Y*&p|M2z+jwdE7C^^?X
z>#Kib?}V-+BMh6-H>#~42QU1zVirg=lS-D3D$NeUWq5uo2{#T}=~Z2$Ok$X)T}jBB
z&%TlOunb?@^b3YoGFmb_yox<1Apv!W5R;wfN}bP%Z~2$;8w*tAd7>^K669Q6@!Z5W
zH59dcg}8ZL)le)U>h!3Z<uvJl<(Wi7T{gz1K3v8t<)bDP8DMk+$$Q|d;7dBN9&Yj~
zvyR>D=WpS4VhJ-(Q4HHPldmLBi^XF^f=zf4KF&TF*j*?2H&MwWQtbUF=n=;Hul8oS
zd}{==pAccop|G-AetfSYo@C8{qxFU1OIhv(u_Cz}uO8}Ym#-7OBd`MZYgN@Fi9@T`
zQ5+4PC6;J1dL7f);e$`tTsTyf{U*bG1cjt{j#X%diO`UdU`1^U#T7*RU&M(OZ+3P3
zO+RSbtR89o4YwOUY%O>{`G?0itOXbGZsTc0%PcHBUP#pyhx_<<B8;@V)0k~5+W0C9
zTLN7*w_P@1BFQoCFH9P94`YX=E`%rUo-J&J5L<C!k7yX@^f{Vla4MyTLFHBsweM5Q
z)DU5!Xjd=%*~s@A2BJ8B!N2S<|6jP)bx?Ri(BG*1Ow{cb36S_ZEfKrHW#5G8=l`lr
zy#-k;zy{I&u>jL3=R5!pEb=g&mc^bu>Mj_OFsC^OqZcu%p;)9B{h!l1k`8R~#7`@-
z@_j{hD~*!Byp8J?#lJi={cX-IH}ijdLOB1aAsIrqID=Foj~iV#>16}gMROb-)n<km
zduebgYg)<6czZ-u-sRGn-#!C>V8o8YH}Jlupnjwm-N}O42NXCJQ$KamoJN9{gqEMT
z%c~$jI_*sVKex6e-o_6iS|^dBay(Pf?6oyAZ(=QVwsH{_q!D&)f;oVO+RGIF$yxj*
zn93fSZNG=ghzGVxNPlba*2iN=MO*v%B1o<FE}T&ADe^BNm(Fn)F9-fZaniL~pPhdV
z_o67cGkDtu9OxfG;w*0%q^Ge-bpAxR6?4$s`F}Gs;%b8d)<I|Ap#R}Qz3rMFM3qMb
zYmijubb^15JxVLHf8uPheMlY|w?*4a&rFfJi256aYFKb>^rsX_ay@zI)w+34{K|`f
zkfm?m>#zRnzB&3m(-$U{{}Jhp0B#x6RXlJI-Pe}YPW*Xy$d)UM)ZlOI@GlAK<?;#%
z>UbV}9_v;7R660Gyv=_dw+Sd8((w4-r4<s}czv&Wlor>-HgjTU@k+yD^U>MAT*|}*
zlCA8&g*MJn#sykFBvRm~70-juzD=c>**4h{b7=oCXu;$%LS4~6M&;}DWNrD#2y6Sq
zBt6ume!V&{tl}@*dSGJmZ}LX09BCJJ-qCn4@I6b17aM|hX1wZswu`k5ZQVf24-~2X
z$CLZ@cSU^t2U*4LcRWg)`+ez(g=!VPs8(sKDUQx(Bh}`trFC@Z?W#*pqmwgl+tZTx
z61_kDk+ybE%uq}6mPrGf+{99X=8b{Ok5bd|?k3}Xkshm6%vXT|k(Kl-(KQhMeh$^U
z>8IU|dI?b+nYyi^6LvAXCB<*f%-&}(XCTOQ!k{R~_i7mdqikFpD?0g+LacD0rFq`n
zuJ<qPfv!NRaR2L*A}6QF4%_pAinD<tu$>)Y7I_86zIT@HHPoP^G~kPWwoP&zj;46P
zGVo1|B40+n{`eKN0=$JzduT>0({1rAxu3C=u@qg325?NC&~J&yXr8axU91TpXahrs
z6xQcHPp>S1|DA)zK_%R(DqcCwyXk)8@m}geZA*F4>KFi{gi!)WX+m%_9JbFnCM!bL
zL{<JLLq;{|&I&Cg92m~=Cu+ce=?=X56I$R<;sJFkF}(%20RCrmkzBE=<kE>WD%~sY
zxsxEgrHX2rY?{1XIqg~Tyf-A+G09Y&6z`!Q;j`h&n~C)WT^#qBcXqe}(Lp4gy0_ih
z9<Y9Q>6JVmm)r@m?Zi2@OQYCUZi;?8i3WD^cDhI%+<BtrM3J#1>i{y2slN7!Nmv^`
zto>&zwYlr)@j|C@we^IOK!!rA<6p%BZo7GHX|+nnzc@d2Pp|l&U=ER^q{O8x1!=}i
zIxgSgKIaWaG<SDut(Q?Xr8wmLJd&-b*uTlwWxW|6Em$q$q4Zi1=|AN=<qKm6yqRS6
z?8AtLq4}JB>3-LcsP@Qw9Vq4v{I9SMaz{e{tobfPvv~Wbky>|6{m@Ah*A&OmeDit}
zbR_8`8e)Q(Yg++=1+b2D=C!CoL}OZC?q%{d>ePRB5Fi<{1G1B?V=e;+Jul3sihpT=
z{9UXr8Lia;7*d$Nuc3a+k)o0cP+~e)ZIWQ{r!RiHn&3;Ds<$b$#d!p=LDXL0ElXPl
zzB8G74J_n%`>==UmXuF~JPO0R?G~}c%vYfaMtTTrwDQEKEsLfwus`g#;NDCrmS{bI
zpuJ(#pW(3Qb{!Ysj+3IxnTpE=<C3;5%sBGod&lYbummA0qCs)pqgf@m1Obi#5J1yR
z!?=KkhehdF)?*uI;5wTyAr$7Zi!)kS&2qI4dD*03d5`Wq;acPsG|B+2@`AbQ<%J=*
z2%NOFHL{+Ms3+YN*_)vnBKgOJoPKznn_V6i&D-YEZ=sg@NpJ}#lw+h_@2n#JT7ZG{
zGUAymS1Y?sPRl22zES`fa{@ss^hUCg;Um01%Ss$gHx-9X!266N5TkAp)4+gGnvnYT
zuf%_b+d`<bbdnI1e>W1)nfKg;B;6}n%-6M#xCncZcvaVL7IO`#QDEZ(b>>$z`QN>e
zdj^XbiBOC=UM*<RF791Erv0c9Y<aj)*NXgwtBFP9X@jo4M~8ZL1~UM{HP`+pt7yYt
z^9oOR^}#H^I@wtnh<H1)h%rs_^(4;vQ$9CbF$w~2MicP$j{EHi?W1iNOJ68<ja5Uu
zy*bBMUBRAcx^H63b>0ugWpZ|gIJRqEJ#{JlN7ta0(tFZb`2n{3_+J@;(C+D`=<;@Y
zn_aJRt7Bg+#4InrB*b=(BcdAf^w_!xnk$R<B_l4E_=GoXW>t{_Ds^AxkL-k4yPENu
z9RrPJ#30qZeIZ((E=tP<@M<L9)HeA1<V^~LIqssJwF`PuVxO7#74<W!u(KC^81!X}
z`rUcCzo-yst6GskoU!W<DU7`|!}6-Hib_Qx!TWrHSH^l$r4RIJqh#;bV><7T7tg;!
zy~K3`epQM&2S@ny`A(N=^q+R(NCCHn5pn1q92pE5ppoYkvfm0&D~2O&V9^E(n@S1+
zBY4hJ;JT&2wj3L<BjuWPOXm5;wt3dIIYE|sxqfN!+%dg8F{j4BH~+_UTbln)XY0+i
zxoVy}eoe?&U~y%?7j>+ofZc@D+PXgacwlK-6KX7OWSi{@%H8b8%|kKEDx_;_d$<Qn
zK}|@xCwZ!+&K|DNr63XjYbsI9<r5MFNaco!Onaa$Ak-aduy7wP6jM0xbdgm^XZ^*O
zuR1@fP!*vIS-B@N_BMCW8MdnGn3iX@q+zB?*beY+32;2rN9}SqzAB%z@FEL>16#}*
zPEiptMM^WsR#g(lx7S)vMk=@xho%@c5*K^%sDw?-)a!GBP6vhyYpNTVB;me;kT&#6
zJP^AP<^wYoA2}gk%ZXBX$qwt_6fl8h<9~%&k*g6TD&Tu?>QpK;R8q-E_5b#Uq*L=M
zwx2H@#CzNaPBZ<E7gelpwi$CB!(gbhk*`gQrZ^N7W++a{yCyIwb*S)l4TT@>;IX_I
z!8e>{CW+@l-9o)k2W^IfsOXE2M<hg@JTxJ0DAC^#mtrRKA3dFyMDs$U6noqaY#{qg
zn{B(SHkj<3u89B7fKHsjRdRz~b_A`xq9yr5k*vqGp*m4`Ss4#KHwd3-%+*S@y;fq`
zHO=WR`TBVgG>q;J5fwT^tVFWdg)=Iq$-))7HF69s#N8iYwv8ax%@-(+*ClMiMNIZP
z=PfeX;YZm=+yJTKR$|@NNpFaKJHN?I6B)ZID!|IC8WGwI^(-Iso5I*PSe0MO`6xo4
z6zP93;^2bg$vPJ<;v`1ntww)H4=*6zb<=$y>vY@nHYRG<r_GW2U(~WU3Hq;4+Igza
z8Pop?)ljTcPjnv@EDgI~;;z|Bvf6<AM@jxSwSb-7iOS`h9NTp+EF#2;Z0%lz&~Z2(
z&fEFSyGEpF>#)sKK4d^S(X@=U-gZ5MpX?v!AXTQ>=4fIDGQq~b`e&eaUN^7Q-?fN8
zoY|Z!Q&MtH$q<p@@o(5C)21*-SRhF3wJsu2=PRO={yCI&q4ob6XGNo6VL|nj7!v?)
z@PF<5nr)grsReo%QJtJ*nFILuU4oa3VVALbbX&^wFVEdMe-9}v=AP8Ee5F>cqH0w?
z26TFXP{UvSdis^BQN{+=3DM^a6xxml-ew)g#0eUR{)7vSzKm6Gb}&IYn_yfA`dr%g
zFNPGz4Yo;e*B}5XCOi4H<dxxa#h}d1=7iHBj_tK`N)HQKFIkzVQ~^`Ii@8VKHx#zI
zD%39-FE%1HZDKXcas_)rGQ5VU*5?Kkbs7F6NuHJU#7wGdQn;Bb+s9$-F56Y1vdZf<
zwyPpt&8!asYZ79NGLlNPalm=BDP`zL@GhsRI^Hfc>#t?llYQ2Y%HgA1?8082a6W(d
z@8nmcL05(Udh&2O^1@hE<oh!vy{O5IkH55*o!m7md#BXe1z!OJ=!e=K&Fjb@QXkp_
z_41s6RMQOpIniH7u{@EVh6yN)t8N0_KPFWF{J8qHfc-StHi<^e^mdyu$)j<+7dpDU
z?%m-@%Y7|OvOi{2d%ESYaW~!K4dg9E_58S3Ig}$vyvEhps1+t)QVk<>|3qvu8sxtt
zPY3Nt$9m;Ng`I?)DEPKsNMosn8U%YW9p|}W1iLESj@=pZG9fJYgz~+4okkM{WUt~v
zB@E+b&j_e4Gzs_<n`?JjF5qOdDlq3GqGDr^{ZJd)O5lkYY4F_49EjDet-+UlKxU??
zIW+p+>(_$G+8hx;@whgF6Q+#1Ja8J?eHwz}B(U-0ZX=!_DeX0#`fr+}7?;^Qy<njI
z1*Gv-JIvYoXHn`D&L;QBFEKEa_yyjueMMlMzY?xLmbhWJ5}<MGjs={#L41zvH6T31
z8}yj?D<5)s@v)&p`N2h%d)s0wLCu47%|<P8!0bSbdJ9o^^YeMz;{|*U4qS*M99{B~
z9XDR>Sh6VTXzRy$huRe=H_(L>+U38SUY<!H<m90EenrROHa$kyY@10ea1z}pc*SQu
zy))QAl^(z}lXu;dqSO5~IgbAMqw-sw)73ygxN1rC4bj81qJuk@h1Dl{H5-rj9A?Q4
zMDt#d>~mLs${#X0w-rJMElj%pY0nz=IkcJk8T7T8WQ^!GzMm?HXD<eKKX1>S!&)n$
zcD^hUW_|3AAlJ6qe7^3fnl8Tpgg^X|M>-^VUkY_2U?~Xw%n8H@xMA#P*z1V9tT@OX
z{-{N@&XLnF_y%P7Nh4^t5wR=RL|S+)0h&?T9Dw`bm;{~4k6o7y@&B_6LsaAEgwArZ
zFuVdLyrlRaU`D9AN^rZ`5Cissw^z_&_XGft5ur(uZkKG|t|^xIdNi$txWbUC<u@ai
z6P#fW{C5*ycpbm*cz_&pMm-9&Q%XtJ*mTiqu876i9J=yB=4sDuk54e$lUgy(rN`HV
zlX&obXxEn!J`LlFmDm~q7$u;uuh`LqWSy2N-HR!%&Pl_aUesQ-@fyIQ0Cd(=Z-G3q
zsy5oYFuYv3K4V))lbVm%d;7jU_l4bejQ{@GaQTW-tgU5yD`Utylw#lk95~x>X4tf>
zC>4zj4`U>TR1|$zeuhN8-TCv@>U~b}BOg&fwXW-f=B#^l(}kGFw$3NFd9}|Op{=Jf
zzw6xi`r#ZA<MKH)ZAN73bM0sywZssDjBpW~@ONIsz@asWN%(CM3E;!sEj{ACf8ki?
zdKg6yyW*)Mf5U`yHK}}u<J+)#oUQ^I|B*=~_MJ<4*}ED3AcKg<aeh#Romn-j4%AOy
zMqXYk&s_XY0^v6y$gJU|0ClQWJFzXmQ;K?a;;dr-Sd(n+;x(}(di%|GhGZd6+3baI
zRE6x)x<tQpfB;51qAc@q-XxZ<*#&P=2d%$Qz-Mf-h!(<8-$}7%${i@Pyu0HPQN*_Q
z0w$j5>j1zr5>mlV)f*;VPr5fouavd{MiU_Jko&q{>VMVkxw^FON^@D92IHA41V3s7
z(S`_#QkuaaAx|#rvHLU4<tt++O<9~6LROrt+BSZ4`Ne(m<AovvD7ww}G6X)%EZpEr
z>;(G#%7^wb#hV;clI&-+5d!yaQ$&m>dax=@hdbv#G76mzKg{m5j0FNVyg>ddS<)8K
zy+KJ$FR85fR@IigYB|_a%>RZorznqrjgcm}GY;GkzOzG^d5YsazEodT0#%uyN|Mp>
zGg=GAW_!Pey$<nv3qsJLxx^piCmH*#3Z!ez6%j<J*Bm)`FJl}&mHWLl;B(g8jHqB)
z!CT!vU4yio>ykRXz8-HKb6oeq6;b|`J-SLtbCHFSoZBRw5Z`qkD=R|#uOYP`-g#c2
z+qI@u<OA1pdWs$2wzXaXTZ(Zn<B^x4;6=0qA7@%axcE_zxxzk@zd{uy;CG4X2n$>!
z?7ofgWfn$RAQ~k8LhY@A7L`m;ezL=JltOn0L6P0Y=m*Oe;mp@z%p)&8RnjSrVdKa6
zNyfF6&<gxk!5;2akBrKXZv^y;66u7pbv}mq#bUEwkC%)Gj(f)of5J`3!Lr)Kd6zpD
zh4NPW_Bx`$JSccOw!}GM<J29<mPm%Yety!Dh~M?iorm~*I4*61;;^wKh?@;ZA%>)a
z7^O}FMJ3%b<EpK?=Lt{j+Gox#awYuQW*ta3K0o$VZLrbedDALt0@Do%Q+`vCB`!bE
z|BJV~obw$JkRDUh%6l!5({2)5ShM|gcW(i_h%roM{Rv>PLm+ScU2Z9P%OLm}rDxyk
zm*9pNMGC67HIXkVFFfa5clF4Dc9;_dmoH-rM}a6Xsa%U}Bi}1vRkeFSm&C7Zj<wcl
ziq`9Yc(u_x9CM>`3N5{acDSo8m9mt|=BFw-Kef${Naq>Lg6!;_ACd-P(ws!cuijqT
zFM{bA5q!J|nSF=3pLInFA6&lD$1iR1@bY35cikL8BL7<cO1*~r+<S7HxRo0faylU`
z1+yF0Ye5RXu1{1MA%xJuA*c$LFnU%yv&QzDZ)naggwQqE<qDJ!b*mke2To#?%*pwr
zrDgUs@KS=Q6}47JnSjMX)qUX!m_{~^{r)Cp#I)MwXktFBA=-5jX5}8a`GTvNyx<#L
zwdQI>Q^1zA*W9|r%!-#p1WH7C_q&85;~>?f)z-}>O32>j{Xh5Bh<nW`0c%o=4MPX~
zfqjNuJZ)CcJJu3c>2n2M8U_J%n!bd25!cdry)MhuVWB~hH!U*|EM#87tz8I~^Zz6V
z93y;rip|D1%U9glYtln!8lZhek9cT<fLgQb;pXpm7=NM85>L5SnuI)1GsTE9N<{_T
z7~0hG{0=4L*1HKkgx29J*bBRe$4S@lEsN=iDOI@m77!eIxf;}q=Zy<oQ*{Kp?@%U=
zodVmpycrG&f7U(Myl*j#$jt-=Z8fr?2)U{ZBignK4g;Ogwtk=Cx=v%kxnk{%7U0Ge
z4Pu%Bx8ga#XsGe#$K=g5i#9Oz!lPh#W%$D>99Fy*W|!@c`~ElUB&RZVNbU(@d&PXY
z+cP4qEQE;impzPEjf;cwBn>!{V-IGRimq@N?%cCcj;fP5JePt&Hs*deLFlr)cR{F|
z<JuKLSk<_;;LuN<fsNk@Zls8o3XRS7B#g=Okm1iBS;YMIW-{4I;x%B*cLfjaPbPl*
z@gjs%eZ(K7x*=n`UO&`!%&4ktqHKfjdJ00mQKd5GcLrVbL*yg?!UX5tP{NzSK)t*G
zF;~;|m*x{OyQ62xjs9y7V{<0Gf2BE)aF(L&6fv0ji#BZLU*j9nKWhm&MSB>%@fwp{
z^GB|mJ{T>k!8HdcAC0X2Sh>1QsmR=JGn)K<3zM4jtFBQUb2_3sJJB0^eM$`}Dvm(B
zD<ULD7k&6my4H`|7B*28=a0>MY0;;yABgJ=?0xmgqw&GzLkr{&BttrZ(^*eyZ*Qo_
zoMFgtR>AxZq7M3DmyXU{qH>|jMStYDlfL&jLXM93;Q-q$Q$+rFQw5Fqz02sIaX}i%
zl*h?*vS3cYt54ms<~qO?{guQ(kqcz<?xQ}c-tjl<)tx8_AnWn01II)7(N>N=#P8NB
zAUg-|Z|AxxRO+9P)f>a9?5MCs@f!_~g6a`Msr*kADVs1Y^G=N#O?;J|TGnIEeCa|@
z<H&qz6)$%iIUKo8hrXX;+wUOYl85GFMz6if3E64p3=e01r>2qZ@QV$y$v^OEph98N
z)rkT0iF?2Hcwc5}xJ{<k7k3rsXVSU+1xIHMYyPGIo|lV?NWZ^vvjmmv7=z(ybx&n2
zC#=P_D<-}txtHA1e3FyL6)t_{THR3_1CQ>vihOY(ZH!+C8po9jT*o#C6wDjd+h9><
z8*<|k@eDR5dFqy_0qBzwo#agwFJrIi82S7@GYvx6+1V*1abgq<`^2g!m6V9*bYyg}
zn3dnHq<S$E`5o@n$qRTmXas9<F<!_gEP&ed*cjevg!rX;$XQ07A#q-mQ@;g?Mjtq(
zHRT(g;LRhokB8AH>E@||$>pK!hc-A{&#DmU6C3uDcE8qRqNMZ<60w*s_u*h$gFHG4
zlqqfMQ@Fpw<VrQ46vFF0`CC1>wFs5<Wq#Guu*K!%#-4iZ3RVU>I%+lSbmZ#x4}<|2
zZb)=)e%##Nza=L81{3w&-yhuC;WQKcNiJi7xMY8!?g@+y!@f&H{ng)X71w+Q!$3Q|
ziSmMGGtQ3(+Ybc!PHjeb3-ZFI@O}Dy_v?PUyxjdlFt5d`B%N$ahauBq)PFH!%Q5%z
zvSZY=&gG<v<`Vr*2d?_f#PI8BXf4C}`aq6frS-l&RwVU#9(cPy6JxUO$>>+#XZw~R
z*q4Q9k7ef^rjo$uM)Ym(dj>l{`Bc>%CA1|lO<qGIJE%EC?Qn1?F+Emkc=`_9t}BDR
z+b^O*r){>=lM|)$5EKRNnw8$OCBSrFzWM30dVX6;o8uI$owdrXyz7X%t)$B&{3&mX
z^ZuWJD|4AvoSe4zT0m7`GJu_n?>XvnvWl~?))mcr+t0rFWpn+tF?l+K6WL6iat1Ll
z;KP-EZ|<F+39=*dEpB3V?}nNTZ-r%LklvTGP#o`NV^xt&0M(72qj@tkAEQfK94dG!
zkhrn**XzoAX4s3H<k;)pE5&s*8M%F0&&!4p!ZGc&9ACbp@eh)uTZ7|E-v3T`xqbcz
z=Idb=R8G6>dpN*L=~L=JpAYW66120p3ke0+X>iEN&&!Z_ASeBEs8jbj#|^9Z6iIfO
z2Xd}!s}<!B${%{D`8?JfT|BwewN)TDN`%fR$*=SO9tmH|!VQt{j*T?&QBvI&jZvJN
zjttuVfd?Y7Ry9Pf@4a^tR3g{K`BUX);angbn!_odJQI8oNpTJtMmhfdm|T{~eJ1K9
z2VMauNwHI3m=RHBlb6j##<__lRA||E>%qGu+R#*Frhl|5AFVIgu9m~h0PMj7Q4d9U
z2gI**Z|weTC-BK6Yr|Y;4(_PNrL|F+p)D8C=tX!7Zkt(ng3aRe%_Rh3J&CYNN*itE
zapY>=Hab`9kmRGN-GM-V$FnQ66u2#}FjH$K^0r9zMlieD64p&Q|3JCZ{q}QsJ9)*t
z7`Kp@{Cs*yt*kO4OyDV!V^=yVUc@)wTq{Qdy(#*!-;~ahkJ2b2{43D8Y{yuym%vNd
z!4Wa1As+*|+Dr=^!yi~v<8M{;csxLmmL)6<J6?_DE>KbGHQ>@k5xBci;$pYduG7T5
zQQJP>^Vd=#FRwcY3CN1r2ALBA6ema;33o^tK0;7C=W4;EK`8L%X()B7_ZWjd>cly>
zVvc9-FuTFgUHeVWN_ZnfmscMs#)>%|qytaK)J)9Eh0<<%F8(k__+D^VQN<B$j&?{A
z#CQxu-#P~5%{@zH8A-QwRCR*R+Qb?km;|7Ufb#Z;y@;VH-yHjz+OW&W^{}v5A}@|v
z#!S|IN}7#R)8dT823*J*?oGpmXHU~yJ`={L%r(OTUK%YrEY(aap&TBf<@+M@aRKoj
z96mhin3K|P&JVG&>Bh+tQ~4b}qHGOR&77S{a+n>5rR;8Az+slF4c7_ibH)7<g(Lj3
z*DccIx!_%SP|jQj>ibcvv1&gtciomSncnH*u@RgDPlGm?u5@1$*HmrMnPa;3d@e>J
z{?DMoMlRXIhzd{EV|z}B)YlXtz@eS1zwYE{ieb})-j~+kZHwqj+KdXcHdm=pM!Z%R
zEnw)SMt$|5TTk=zLc~1fo3BBe%_`g;n#t*1O_dh3<@ak@tJ&=>{e~R_hCbC$3BkxZ
zo#aP=BMS|@E3+FcBGBWZkIjwJsW&E$&KTJav2#<wL_T=KBu2!ktwp_@m1}E=ftp1c
z9%cow#~?@LSig3;^j)2Q*R!oD;`9{I{bkW4fa`f_8O;dC>^%dU-u~)dmzR}gM`vD=
z8>kiz%{=n(_t{_U%)}Hrr?teh>aZ8-F7NM5a@_FsX`{>eyXWj4H*d|*N||*Aqo0XA
zXY}jr(&gxcY_Hb+*6x`P*2?AhwsVoBfa$cE%~D^c)iw&~Oq|QL9qsV4!jb@Puz)aU
zS1NDW=(*2bUjuY6-3K%a3;J>|c?1jxm$a;_Ikhb`p>%|}LhNjf={b*D-19U>R#XH#
zdZ~#S_s(0Tbqs=?^BW^=HY0S)%nvCF$v-kaqrM>N_5R@MFfQ+}nZDibbqc#SjF=xD
zXUXN0`T4P2f9LSMEw0KK0AS9?iE40{PNSxp*h$E~_I_kpO2@Y*18JmSDXQT0dXPv~
z(BJqAxsIz*(~t-twh3pt+d&RU2PBe{wkDOopSZ2|aa{a4X}8Zt)g}(*E6)cwbzH40
zad^9PJs$XDKe{$9wS8R)Q1T&oLTTU&3E-i-JxwW~H=p92P123mVxsBqg3r8%Ahvh%
zeHA*H;{QbJ|19H-UObyzXsdu7MU+bRMQBs*m*jxidD#K(5f5;g!R$@)ryW9m?397A
z?F%UhCN-4foJmZsWw)28He%nKIaIU#>DRcPgeBL@y8lAq3DeUX&WF8WL-^Kv*56G_
zH?I>^dhI3onkfNJL(}2tV(yg3Z6iFr*T%^0RiUy|r@RzYfm8<IAtAcyCIls)28TeX
z!v}vUqrJ<1$5^eKYuB<UIP)B5%)3VdTU&z?sDz$*L9Wq4;pWG=<17GC`(lk3t97`1
zLh~R<uVYr}j6(A+$(yP@UP?vA$^0mh-|6_ntFM{pM(fmWJ~T=iS)H0G1}BAud0t#b
z&Qa1h!aX16iw6Y!)>%|3d#=13&_LeHf|3r%CI@iJKFMpn6T4FUx)ADE%F7dxYC}E!
zD7tELd7e%76)op8GoMZ6)L^)L9l@NXQ8&_Y5vMd?C3{WcWg;v+H<@23hz-tky9iyr
zTXWPCaB%1G)@&$uS?tvrXBpi(zP(*kRw9yr1%0v$B?T}NTzq!)9`^kVNBzR8-^-hS
z0H*vBa6cr&Dxc@q`Tc@MP&xF|l5a#H!#$v<=Yd$b*)WI7pgj2lD?|x)pBBi@D6{?M
zetZE}iSm`JTuFnEVw{iHyM&CHc2^b(%%Er}(w|PpRjcqWUwZCnY)U4VGLDMhJ=l{Z
z3(G2k9Y8n0^%|CIm=Q71iT3s`%^25>9m;O^V4iK2+m5}FP;8HJA4G8c`RPh*1j1qC
z{5lH~n}gapg+crcr*DKOz751FTH?baJ#)YlVu$7Sz6>ETn4zZ$?@PXP5N{XYd~+%@
zzwLi14iECKk>DG~A8>LOWRFI+?q=Enk-u(to{~N|m&MN>LL*Ps;R~!$s!sFoqo%E$
zc}aGcG9aILea-kfbn@;2GOnnMyt@V!^00fyOEPj*-ff^)kuhl3t<^PDi!v&TXv-PV
zHML$Z8`b6z0}%LqerWtk?&)(`)O=f<`pg>B9?lDfLgsp`yuf=UMj-xtbhVBNMd25Z
zPbFa|CiQ2f;-RP@HKe%BKGhcQk&P()bmjEk>Ow|KJ^}^l4Nt%tE;aK;bhJ>o6Kr81
z)E5066#i}msF`(wtd{CVlFLoDL=tt%Y;c=skU!nRn6xLOtIU?;tTws9qmD}s#gaPy
zn#=P!m`<rrd#-U_Y4*}LzxG^2V<s$OO>mDh&CzKlD1&!r;~C5~@D=GF!I$FCWRd{j
zG~~)`1FtXsYp)ckAZcIriY(Y#?|8H-2F}pfVkFRg8tS?(<OJwiJ>dS5+u7**JT<JW
zN;Z0B&Xf<r<7S5#d8DwvKFd<GO9l!D3KoW;5<22pFJ~_Od+xEDm7W@BBisn*2CyD!
zJNiNSi0UoQ4njFDMJO~^J5LPgi^B8ZN1&~8m%QV0A&3e;ST4ql*Qz!$77f{5lRNp&
z6jpKtkbEpKk-rOeeqiq)Wc6FoKVTe|jhKq5s7L|(#K(vy&&f5_@vG<uQaK7$5Q%Zj
zHj|V&G^w(ICiPhM;Zk$4*Il4xsVA46&Y<t2oa4%8wgJ<n^KGLI+k}$OK|8>>HeN<{
zwATV^BDc-!#C_##;VF#E)Mm2d=}T{hYv0tAkbe?2f_&Bqk8D;%_7>*2KRY5ID{6zE
zPlg<gxiE`-<jF6{kagR-Er~(Jy)MXBANa`_tG!M3QAp7`9=|$B>D$uj+7f{N5*oTc
zl#<fwx&3Eb59v=>pS2i9_$F1ovJcgY9R^2QMfI=2bOg^8HW?F5y!W~lhH(B%y)Fce
zA<J)J6E}~QmTGo$_QCjWyVIHlx;7K2eip@<KoHx&5r;a(SytS2f@i&(UBr0rrV66N
zh77-4s)qT#>}Bu^&zZ0vxec5LhrmJhBiQba_a5AaKMwaqu_Qc8S4SD%g)<hxuLe+e
zW^mtLa*HN!c-)n7r~NC3^MgIV58iP2eC^9Nspyx3sfpf~w|1i6ioReMMu^88uAXFU
za+=#Jm&e^!$I<dad%sF@925H^sJt}!hUQhiQi+RCF@}MTcm_9cGoL<o)YRWNocR>)
zW`B7OI)D-X(PL9?_ulx;w4(wWta2_tK3}~3im!tDMv8Q;?#rzWCFE3z>MfJ{1Yesw
z_vV^y2CqZ5sTCP``SlRr+l1~P3>QFSca+Juz1%|ChKxC?E(q&HJN22@?IuPVO|)<1
zxT}V;>ZeP~9=?@iCN}<5t?h<6cf#B1yWP!PtuKZ<|Fi^^Z;s#G<>ZtwQL{XI6N|Q-
zkMHTS@J%AieZLua@*!jwxDq8l=7()UfBpFh46T5|@e)A9)}0ljP*M%q7w)}XJ>Dbn
zt_LS{RTaltGc330u0`CfFE5;Hyj6R@DP|j~tVX!KL%J54S9KRiHuwPUIv;ha<ooIa
zUWLr;z%py~&hLWL*`P|_p^M?47Jm4|NPG6<9M|`%3YP(X<u6bNGsnT0AOia^;sOkh
z@I|SoLfv?3J0!iy2Vz+)5=X3|wba6DRG*&&Ncye9{WW&l#K;h1;-E*09meaucj<Oy
za+QO(x0W1Gjy&EwNjU{Y8l4v=3=NBlX96^|P<El@W@X&LQas^t8NuVYfX=$%Ld`>O
zyHvcDV*NUfRqIc$W^udX5d0(|DCp|tZLI!AeG6NBRL{EOpzp3S)E>#p#U9JzIZOWi
zvm^9kfj4)I4ZlOo9|U0<WAjl+R1aNtif&id8;`6DkJkkR9y~AV2Nam?`b$0_B-cTC
z`BZB*DNy|jYLfv#Z2Q`Y*PkVx2pE$gpSs?8Msg9!+8x!+2U$=TIPd;x3?xsghu{)5
zM8v~<T{n#Wp1{AJtB&;7eX{W<x+U-=;HmaXRheI;+G7*qaX3d{#U*HUzRvNOibXH)
zaE5QCDRe?QHVFnPNGfYVVp-cm;NDt#QH%7oc@TPYQ{8x#0PPuEyZ`E>1KGScXlDVL
z=5bnI%O@?FQ+Gag5Y(_P+dPn)4yzw@We+J-964zA_I3$<En7Zvka-SzK>dhIjHiY7
zCtnMgS}&Q;qblP?&<KCT!8kMPC$bO+l<QfPUz}f|YXa@Bhh<Lb8Z!!^U=%Vz9eyR%
z8U7tB(k;JVSwXFQw;X$V?z@DNT=ojahz?U!2F(Z42%StjD?YG}keT$542U%mI1flU
z#M)S~r4^D7=*3P)n#zfLWOP6q^&#?RGs{u)5Q*Tg&iw9#?V6|u(v8@seHdn}nxo29
z`)(Ftu=s1EEP=5)l2>UCT!8kR9eHm;I6y`ut+ePw)6RRL;kF+IYL}y~y_5ar`H4u7
zIH3|}ott$s-S9RG5$fmBdD3o{#dC1N;V~l|bJE1=4qb|Mg?{b@E6)oW`QC5X6|X~0
zX<NCw5ZAaVpQ|(gdUnx5y2jTKqHE<|SxY=>DoDI04F99~RWEy~_vq8dPn?`c@Oh|J
ze7<pLb0G+D!~Tu2c*;<#!_sUNufR`o11niyBn|=$zRqcPTL;OEZU1awwbfzVxAX>l
zy_P5X%|5>Ub3YVqfDD|}vw_m$o;D}>n9nZ_ANp}?F+8D*sD5xLZn<lWJfl%!mmmC^
zjLup7)|1iduV_uKyWe#0ii>F;$P;TxdV^>6k9#;5`N@_H`^!+f?%bRZ#%X~$U`^S6
zDk5}V+5J<?et~)o^;rVs%XiUf$Ix=SA!?o#`FYqEVJGvP7Jg~tA$;^2+D|Ovac-Bd
z@$>mLXvAZ$$6=@%wP!q-CP@k2;BJT;F%NMzVthZC)Ol{RstPH0_y+IaiT|=Mt`Y0@
z$|EDSirgUA0m#UtbXYYlAEC`>*HUNQkoC*|1+z=<bs1>V+&e78iw_gmtTnCSfu&6I
zbt++=8KO}1GdI<Gxh8Krk6h@7V;@FhSis|USi(FVK;FKc9_Gvlc|!N<S^S@@FjeL3
z{s*xOI)Jwb4l22)T3RPRIe&VPIwLW^Ex_$t(^5dmd4!m1z%Vi$y-ssHdluJTKiIb?
zU^9f+aga5;gZP7fV{`i1R4lBaUem4^f9@3}a0cQM%@4x}m;|KhU6FI=ylHY_`5?YX
zy~As>qTr#BNi)~!Desxy2O{V@#)1a@>6*&rnQP15?+C$nqn2-dNCc?<NtE4PJ2FS_
z(~}Y1db)&(4gFo>^~qO~Oq){n62D`c>-bMXad=3OVFxd$uU4u6<G7PeAymt>u+}8%
z`zerSU$MXPVQJeR5G;nRzdjL<y^`8&5xp6Bl)={_isjj_r>%vVddQI`kqA}oP`6@X
zgk9rLeVeR_bK8^YD~e8ThJ%JvkBS<MHGGnH=>{aYUZtAxdr4jtOoGwphJzvMgCOm1
z<(&noNEZc<`Ui;pnnMiTY@Pm(Gi%1FTz_NI`RMqx)UmgeY2D1sHY$4S<H2rm!}0Nh
zd98}r-=46Y;M1;C*<%*Z^(_Kj?q!H6$ij-7M>}s)8vhhVF>q-%epUELB-6CB1L?hx
z-gvRwZ5~k86b#E<e4^Gct+dUg(Yf(-Wc3br{)+N=XA_UCD14tIvux>l__wCp3ZQ~*
z2Pf;;H9nPI#TbpvE3(a)z&U2D0Zdj*lm@%_<8Fi@ss~&ILyj@)pSlndh{6AU;QM3C
z1ZZ!0C^nZSWMuTTDol96ux4H<bkEw+?E?5EjDEmmn7x7Za51BWA6<g==6-2ngm^SH
zCRT*7^kpQsw~>2w6j+N}5BrF|9+JQ0BJ^|X_O%G~*t5uLECdUgy}GHSPLK1Id);Gr
zmeCqBm!fL+)-Kl;eiIe&oU-@c1rGR8WAk=WBmFJWpmLs>HCha!^77m@(Qw@VS;F<A
zQ`vbAeECH~S<pPOMr-6`{<Qg`^#qGGz`uxUM-(UVIR*F5s|eYaU*}tuxFFA!_CA;1
z6Pv$0hUyj`rnMZZKc%cx8iDl}nr7HMvM-LP(M(1(@={(`1cexppiN!l52a<sTR(}L
zpB1b_lLi1!y{^j;I13%~Mk1nd%OOcE@E_~<2UKf!x=&yPZM6V-|JyKZ(8+*ktANQa
zsXBf*+7!nb`w=m9#H+m$>L!mh%TcOi3_<8=d~w70l!F6|#qp(OKkF~zv#M?K5vm3d
zwpvNT@f&~)Ey(TTME%sp2ch=iWM8;q#pO9V^M*EZ&PM?e?`q9{aA!Je9i3l#&o0(0
zH$hpyr7`4X`T0`NR6}@&$z9yYNY7{IP$ChWVcF_EXS#gLb)U6Om+d`@c->J>Y!rrG
zORcuYrCo85-K&Y1yizzX?ky6fK4uo~DD0h6Se2`>3hT8v`&>ZmoThm7U4bKY>T&4&
zBzl&G#_lPxIjvfOTIgtUW2n$Ya803*ZIDoTm?CDVZtXnrAd?>i^5^<0rIG%Vj=>sr
zTR|IzUFi2vUGCLc1btw+a;Ih2+wDhpxH#+H21TDdRPk<H!W_vV)1Ntm1X29`-V1uP
zW>}1P?h>Z>`vXz#p0Ih1uzD3fE!uKXx^1c<S)_wv|96fsI>jr*3lZMhO>Q@P;(=QJ
zV9{%0Gmz4nL7VsHuKrJl@q0X%8i0&MtpltMgTPH<og+a1p5~Lp>9rxdTOltyfj5IZ
zLtS*TO$w+N>~~G!XFw%TR=ubSqNX^QlJ{xc&H?mT|BTZ|`PGErGln6=ueYr2_LJo;
z?i=fo^#Z0jSI03YKTcG8uQb*RPNfTzhK9vY@ABi)E~-&0Rv+N{Y3JShxX^CAg4RPu
zfVlai&&fzfJ1}Q}yBM2V1k1;tySxE%_Iu9eFQqFHsQ8(MR`S<dk*aa7yZ+WzYI8du
zc~0GBZ{}4vnQPMyKeZjaRl6`T>d&VP8!TMm4f7$rZbzR78br-gkT@|E-Nj#bgjUnn
z7TX1{qaE{hl<Qh^6~h|v(<){+Ue<v5BdS56Y~uC&lhkfV93Crk_Jm5TMk1FCL$lC`
zgMP(x-eUy+TovBW+6P31tVvt^2p}t?EB&PXK>27bPYu8H=jY}3)eaguK=Liiz&~G4
zvFgc4ffipoR#IonX~(g8-eP(uNgksgnzj^sH<v=@P%0FQMRf6TRybdLaX9_*q1@a`
zqQo)&;;WvC8(|x?RMXOn&+Yr9cW<6B6L1y#If@KohduC~TvJ?v?M$AB-o2b-o1TrI
zF;J6v;s1UoF2pIf8GraYKJCGvZ%m+{+`WO{r!D0R#VFC>L|liYgLG)oB6jk5!K|{=
zmLUVk_u(L(n9?OIXQ+E{-V8{5nf2;rl~DePg_L><!=d)f2UmVF3D<HN#MciMy59VE
zha+CR`L(B?E2b!4zbA$$wEfz69E)pG7s$R#Y)vTs=BVxCMrwivjmS`J$vgRul$n4Z
z{I5y;esL`{Q)|>St+Fhoh&OqT$j%AcWpFJNM+K)c(Taz5IDThfQH!|i97NhM^*Iz8
z2d4!{@f>}A6vvA)iNRM$ay*Hxb^v^ZQTaMC#}B(}=S5XT2p?bdW;w7*>ianV5#^n`
zDO&+U_+sp2+Lvq&_c7*beHLm)+kQEB-t-tjcO~z0{~%ryLn-A?$=NvtznC7X7rAcs
zquD~cCOe%(Y5CR{x|t7iT5+%2Evrnu>Hgf9EQm^<Upp^Y5YbX1Cw4!U=CHG$H%{DD
zTVx;L>r4j(Vvf1JS$xdHh_7e!mFw9&(45yzCywIS;H7eLMkVO_006YtQFS}PBvF-|
zqP~1p*FTgsd2s``w103w+T|QtY+F2EE7EKx8dnQ83|bp{Yt36uQEWZxQrRe20IBZ#
zvKkRv91kTjE2sVl7^T=kU%A4l#lw{zD=t6iU6aBj#4mXH&RstwvCt#MmVI7Y4`>ib
zCH|_yd;3);4Zxni{AENwnOJFBj!!pwk-jX-#+*1*ZcsBjYO)wATrHTdOB;!&sBje8
z;mjt=ElqqYoPNlGxQ#RUp-b7F17jItzO?&RL++8z(*`x!ZK`o8uDn38?((YrVAT)e
zO&-Lf>68cRm*oZDh~ulgS3Cr899#?lDcNA5c;&m5@`utGK?BZ>Z9@Z*&dG?Mvt+}O
zna1RkmE_M-C+m!NzVl`|J@A}EnSXW!b9um9#fh`Dr&cGVfRzax5C%YHICH(;hvGUC
z&`;&X2lA2Qg;xRV)Vxz}g9$f`x_qMU>1XNtvB-GT$B&3T(BHt+c<TTSHb7(zem=h=
zDu`Eod?sUJwfPd-udHO%=N@_JeiB-UiWB2Yj|*OC9H@~>6sD2zG@PH@PPsOP<#Egj
zP90r`TdFjsIkC0;9^4cHgh$g$)BD<cj7*B>pXhv)c{n_qxwav5>rIN3oX2M;@jVkW
zmb=8lO9Q`$cxGdNpuvZ0H}3W}R8!hT-~I#u#8vk!NSjNR(CiB3Pl*midVWl)Nv=*o
zQ<`xDqe>L-;(C!0bMHR5&%b8$D0s|vv^~8$+ju8>7Q)24Vx>&s$A6m=U=Dkd*iG8{
zQ+h1?2PHLkF0uXag9{6(I{PoO@>>8BZ<gmtRms8@az8{q-->#rVDi`wdDQz9i8m-4
zV-$;3`(fg~-GVVECEm30rCT~;D3a1<8>pj~)I?$GNQS;Mk+)R!JCFKn0UI}hg-sAs
zr5mGixG#H1IUtu(g;Jp1y@BBDt~9LGXy_5sDri?%Qvr0oc7sPXb0u?G+8c|HPLh!7
zG&o4Wm5T%{Jlpg$4K(Rmtl~acnv6TrJz|MTE>PS&)q{55w)q%i_}QcPwO>HdJPANU
zW}{&7>HuZ0hibVNo8TAr_^(Wdm|0h_=H1u$-U<D#&rTk(B93H^y=lCrO*CLjzircY
z`|ovBoM^t45KO`*Z+sXa{P49^bFenU>iFu5K55Z#^B=|ff0Pqc`8L~WmVxoK-;9U<
zXr@L@Pu?`Fdwn!FJNp@(tyMhBI~(J<;4*8TZc5DZ(`cA^^^Lvl(=<UesohwOrY|-X
zN9HH_rBpFGQosEWFps=UT%yP3CAF-#H<{BNs{4t(a+N6Kg|fUYIOn@i7DNC5EIwx?
z8B|S*^G(#;x_zIcPCNn)x}Z?;)B9jSC$vUbqTy1pj=(+r^w)B4Q;rFA!-*<a>NXp~
zj}7%7o_wIilL2l3{ajxE4$ye+Msgee{K)B1SL#Ojamf&4!vh7q=6r;rn!b5zscg$g
zyuh3IM=Lv3H~IcZ{Or-q*)i(sIvv#ti57<*m~A&w0m7q5BMscPNnWTtY2pFO5Oq8B
zQ;?Zp6IMSGP+k!$u)x$6fSSsvS9|o~`ivBX5d0a>v(tr`AwD2`f1q8F<Zul=VXIUQ
z0C+2I`{i8Qpfo=aQbOtxUNV}H@o^xeBqwCS{<Xvc({-U}*=K4>7gV2bJsi&L(Z{G;
zXl|+QVeg!M{B=6+o=*6El^>w-IXilVCz%1XA>;Nc#QyfjmqV*AhO=D+r{zc<K98eY
zd|HP3>7VN2Qn2MTG3NG9kJ-Jev!tJ^5iiCdKN9Arn0i9n?;?<#L1*e?euG;2Ae+Xl
z$}>EKdx61!u^g^1{+zGrsg$f0vrrk77xD#vo11Ecr@Q|m_4N%#K=R@1ub4+ZLs!;a
zJQi;GYd8hAN=2ps{n-R9QkHz&dWmOF82y_88dpI3jslKjr#Nk{;!S~N?xPXekJ{PW
zNyGBD-xF^;{;eT^>?PK<K2W;fc@iNaEz`!~8C9ykv?0IR!`9P(eL=%RIJhQ#sJeA@
zIFU(+fMD$oBvz<qH*qzPxm*eSo<_-}m#vfjwxoM6IMg<}v|qf&YujvYZ0GwcKd$j3
z*M?h0vr2?S?2kv-vr)|5u7g*6#2XS=TnzmI{LsThtalHpV)@a}hd=(PEkm}%l&Wtx
z{LHtwoJ;hyBi|<-Z-`AwNHoPj;`Qa1iov#S-UkCa8wnYmUZjBVx1%jZPN6@zjec3S
zY;dl#40Q`U4);k$Cy=#R=uE9PSLro~?#F#N-jI*r{zA9Bih)ii)l%IOT|LTHI+5po
z*+T|!dM#1g>P*G>Roiu|918y=W{?gsN?>M%8on~nOtuu|UWloSP&{!*?0o$-O}~^y
ztR4EaZ-fo^ZdK7EUa-Bsv=&i7#j5hu%I$`u(|N|{<YyYncURVg5%4Cy*HU%5r`!t?
z=2(91E1KDURYgyFJrlR&qFur^PsiS*tcXO5IRL`9Uvr8-t_F0qa4T#*SxDEDa@5#L
ztTCx<|Abtbzx%@?cepI~1yP?h$@~;S)xPc=&xfgW7rg=sqNU``CjioF?T9D<(Hxk!
z$2G-jmux)T#Wu?`w<o)}SB9WD*?AW?E8tBueh02Xe0mLhFz>zOq=LCpbaIPveoaJ0
z{3iRIppH}{5$+?So_f@q{?9(lnVKX3Cz_jr-PE`0ZDnqxE>JS1m>6nik@$Z6E7Ge0
zR68uXV6Kwq{~_rr1M*mU_2TYc+}(@2J4K2W_u>x4y-?iUol~6RF2$`taevX`?(}ZI
z`+sLPlSwj}%#$R>e0b^M+U?tx*J08Ji!4@a2o?lV{J{gXe^xV$=o>Co71oNNhVo6t
zTq7gtzzTRHXoDPOb;bX)7k4S7ns_Ea{OQ^ZmNQ_?_gS?C?A)fC@!h`snrm=-i(i|5
zA9D(G;w&goDevd^O_LYP2$6RG)VtzUdI|Th4poJz33$T0d0I~0@uGiXV>1z2xJ7oH
z{Z3vji(vp0xG731+8@FEM+8JCB9u5pWrK^ra5riTeYW)%NAI|%Ewu|_Q);{NDcJHg
zwLoPWG5h$xJ-VGT+&M>ep5YT8fuK~DEPh5zWI85^oSVYzWC|8>`@6W<X32#_mvlHo
zxfZ+nB#;NR=u>{Z=Ol6KyI)#}5Z}gMT=30agzvM!=guHJ);#{`0vB#lOnT$Wu&H3o
zz>T)twsmS#*t8?ltONY9q}@Ya`^;kD{6T&<CE3+X!aHLpQJuAg(bofF&p=nU7;7Nt
zwg84nTJb_aCo*}vAletUet%8INXX4Nr+1$TF@@1Y$T0#|VcjD;OE<{*!gQ`q|J*eE
zr<afmaiQrr$s4!JZ{fpBu-^)^zB1Sy;i7EcB9MU}<9x+fCj-@EpAO=$*P&Y*%Xi7w
zQlCl8s{}47$l=+w`*UC3lka&kaZLu_=5g5zfxWihU!rX<Bj162R-ktbRfvj~LKWRQ
zo*S9k!BIYA%?q}aw#6yUdws!SRis(P8RJ4Ykbg&zG<9&fVixVMuFgfi+kpfs3Q*S_
zlxdE{ufwl1z&P(ORT0D{BqW{j!+^*<xd?7l%{==lb3JP-LYV^)8>)ALYoQT5h&&Ds
zU>{SDfzYII$_FPs-~lGNecV)gcQZS?p<BN5os=k0?L#Akrn8b|jxPtMLJpg>26D5W
zt3!0q?hr7%<gR+|Hh3||sKuSvPjp>{H}2AhfdJ^%Lfmkq$Ex9R`E?*OdWc_Fp~mvM
zsg-SOU=y8w=_GV=L_op2{Y=lmTlYI$zuls+=<FtDUe`-cj<N<-e{YHo<@|}j4La(+
zUQUYH5w0(K5QmP{LLGhJ{rxx9RbXzVUFdCx>i!kWMPw#3=<Dig8@{GFkI0W1Rbd#Q
zP6Ly1F?z#aE+-}w>zxYL`ym24f8I<M#Xx6`>5lFYntP0`SAly>)isvW;$dBkKRvZ6
zxnTk3c`<W83i6nMUU&xBMAvFn*6H`6d=la-RL?`&s<g^~rYWPZsMUn|+}P%AI<N&D
zV3hk5K3AoK`7LgmHw^X-p0SS~VjfEvFXI8AxrHIwA)Wn9y-EY~R~agy<67Kr^Ig4*
ze8r4;d!A?wuN8EpBn*iJ*o=2AoRQmUEME;V%u>@#lYe8BgI9Zu_hV4N5>O+r@Z@Ji
zvI}`Ym#g1*vp@pnSKTNcTP(|3%tNhQ=7PuC`LjerQXPdJ!o2$md<L1ZIVLZ3+Wo1S
zmB<;bW5fkdl@zVHDDl)7A9yiGGYO*>5#~D#b<B{$@AnD0PVS7d)PmqnKjxTQPnNg_
zK6|dnf+VGf&JfaQnOTecQCVP(c99$QvYI%+Iv@PwhyegZ0+kj!doY=`<3b9!>eJb3
zkn9c?`ny`%=!RMfZ>)wysI;AvC9yvpr7|ZggY8le`2H`s!s(9Qh&%#rKAt%y(7@6m
zbOFrR_d3l~D#u&~uDG<0ziZFJp`ynAqxw{FPH}oEWk>}eE$~5>{$1I1qnR-Eb~sKv
z(X*4d-H;y32$dpJYB<0oG>&<_V9uYHcAD<n!G+p1aMc^x)4iJ#>ok-gg<pF5V_hd<
zP!+0#+w0aQQ=_6Qoy$VKdwN+foBuV5o^Lyh9Oy0kMP*5Q^1clJW5Rkni`=%Z0o%hL
zrK#T!`-aciiuk2?G)~xOKMav_o1rv@@N9KEuEg_KB2D#Ml4On?|0FZ!@OiE!fjy7v
zE_;pGPu`pAoe6wa56Tj-DL`4G9w{Nnn4hYuy;MQ>v_E1|T(=RTkzYB{gjEQ-IW6=p
zS#{QL@Co2-Bx^~KIpXbS3|D#O5!QSbh5}3=C?Q6>0`EB4;Ur`lPJXX3w2_Vq<K$Op
zTk(5U6{t<RZ&pzpMYXTI%`ZxqI|TV%kRHiajK(kN#Xr3+SWJ7xZBCTEwZ8~~&=;WB
zSfJI5WNkT@rDcOgPw}WQej?GdljK%*OvOm1$!_R+sN($6Nv63?=xEc1SOS~k16zOM
z8P8*wC*&0WNQ7B$5&nCkHD{hI|1nG;*sw7#hnf{oOLrAqi;2jlKrD~JOClF8*Q*R4
zmNaUlb?_g3jT%~r-_?6x<<LL#>61U)Xmmm@kkHYyzp!DhdJw;X8G9-Gp&>5jz43xY
zuvoKgVD_9J09@!8gtez=?kr@}Kq&puuX5@U=BBZX?+<;io$Qbm-<rdI4%QURzP~GW
zDt7=z$RQ7y_RclY;F8;{)!%t<%+!Ks-6XE09+)tDA#ONkLtxa7wjY6i<`M_djPC7T
zNs71HsH%Sn&OUkw97~6;a(pXp^mHgc1r0(GT(8d}rR{lj^1tb<)RTDHPA~s%X@fd5
zZd9Q}gwirZ@8Nbe7$uA6M)?VF#r~VPtFe&VRo&<ssA6=?b`)4kvu4xr#s?aOs!i=Q
zNu<2$$9MXZMeijScC|UNTl8=NplXJ(dxxeo+_&VJDN^6gIcJ24>;r>-L(;94QgbY=
z`cCNCp+A0LxdSL44%I>=M;rKZ-&R>@K*y<pP9kg$Y%M(l!>3l}XeK6iOh<BLM7-j?
z?~R^~(L`FgtL5I|aACAkoRx}A=?7)=YmFQv#oo7TTmHWJ!r@bw)E~VR*^#U;_BI?l
zXrPzypwLKsWb4vx%gCYMyXd=@ScePV-(S1qL;Er!+V<rR#&v{36mUVpE=niPCBE5q
z))Op>xv4hT#K(M;cG#kIknN#rkUOGKyn4Z>tuiOePzL1fq7>*UVp}t@MmNVyt7B1h
zAtkj_W%^7MprZ^tK4YeYFSGf~F%1#c9jj%|=q~P|jAX$&z${n60YMvTI+v+ko%r>`
zzgA>1zh&IeHW40JNiMZHZ$!p&OfC_w+GMjR2085T&Y8my-dKH(nLPVw`)}WS!L0Jf
z3t>_BSVxc`^{Jb*cnZ>RsyqFXk5jkW@fQ&dv<}<^jaTP^3HPw0yu&2h#3ru~??Shv
zg7%nPl*U-}qG!Ewp6OD=Lv*s`i@`>Mgt5oEPBsMdXe_n}NmO^MrtIYX?rrtw0oXkZ
zUQTZg)qS^xnGinjQ^^`WyN#nCD)_X$yc}06grINl{2Ie!q3)VP{MBR_nG=i|#dtO}
zLDUhJI?(*ATd>e&PFjZbnyIH2gRixW!UeKf+lDU1A}Ed;!P5=8Dm}N87o(UHF>FRJ
zg>xZ8ppn7QI1{oq6QN;r><)I^MD=WKnGqlMB8l!bTRn8?;Y~c7iE+y3*AYsv!<o68
z^lFdl8I5mpxaAi6@X$G01glH$s6fayS`fc!Gd#i5|2&x}GwR~_B_i7X+8rAJlza6S
z^y7bx9J{bUqs;UT_`_`uM<s~{*VvK_H^CBBA|{FIOM$ENaV9=;sHQ>hjBuPFFelC8
zicW&8U9f$UMgV{>*-akBG<MkS{DS7x!&}RXCqwWA;Z@W^?u)|T`|H)aPiDsZCGhl8
zfaBiv)>0bO7`+a&h0Z*x=vl<!HcBIswuNK`(1KDBjP`Js9y{0Lpi<T(=^XU=<M2O+
zwKqj32_Pkju7YHUZ%8yxWtAk7bxPT**K2fpPq<9EI7SAOD!oUC0fG+Eed3l=EL8e4
zIL%4ln10pI(kZT3@wEwsdTe=O1*W^?_I<RtFa)_Wg5wq1j0;QrC7)?0s{n4A)7*`{
zb~0~iFhW;XES1Fo3}XG%`yh}#i>Q~(5pc5P;-<2j<*7okgI{GF&0u4ZLD4quE}STX
zlrWs*!DpG-k?<!=E%rjk&+w3WNI-fhj`M$Z*P<j(MPY$vP&~d65@Ieuqqu?=Vm{=#
zyXF@mxAm+Q>*o8Z?}auRo5J7kZ6GTPR?^3=pSu5Hb`)k)>s)`#?%O|c=&kplBRas$
z=I#d1-ih#R6>pW^Hcm-!S_m0u5MjUiip(epTt{KZ?n<2cJ4$f2TY;#*fLnd~m)xzt
z?O`9t4rxLftzTs_!rJ`Ehls#Qs07z=oDYv>&cDvV;lwx@`r0f00d|-IF4^SNT{jJ`
zwO$N=I&8Vyg_N<*dr*Tjiuk?3l(U(j*VwYI^>79l_H5H<-`;OO95`w~-F`Ghf6mf`
zfLo}Gln$5sTnq{O9dZ;b2c5_-1QEPjLi?8FHLBD~%p~vV68Ap>X~F3v-cN+%6AUkO
zEO=!99rUgZwH7Jk=9`Em4gKf&1nFJ=F3aIU+>92p!=~VEPk5<EGP$+mbI!xvA-HtK
zruCZaVi??1F|f`v3R8jM%b<zIHW9eHT1i0p3za7Bbb(<=AN#c0cx~j{q`jGa>Dann
zSFq`}2O9L=*{L)<2D4}!M^e%TI#b1}P~-R}F@he<#r-c$-;%Vrt?!7|LMcONg4Mjl
z6+qd4X?+{O6-Dk%XlhDwDYdxqG20xEI}OoC`Svs1%MlLjp%~6CL<u_7)U|q979zbQ
zFAoQc#`3xuZZc#3+`Ljn7KsvS_F3m@&3*^I*M@PZi5m$rNE~7a!)d?Y1~ONnk(`rU
zJf32NQBtVL&1TjnUja!H5eRr-nAFQuCf%8D4i6Q!S8nyKKUU|m_)nw>3Ubg3hR#;Y
z9mP$meKkcdDoHdAq3N4`cvc3<^?OkD+!7O4T-)=2jLCPH9N`3*c_JW029qUQe1`#g
zcTR-+f?1`F<vTDn*lo{Ts!9dJ2Ru1#UtXoWYvgQ(TR)^!4WDYwPO=HVzdojWlNIso
z{=G@r!nRZS&k_hXuZnm`H1n05S-YnuERP?Tb>RoNdpQT;nrPw!K+=HMiGFlqle`%>
zqm=5W*Yil4I*YA>pCb{S_(dP|Qb?HOlT6=FXY`vQL@GJNucOTnzroNbuYT>qWAyLe
z9e@y@>lssUO49Fw1vBu=@g2L1bIQpB0$y{jh3LIm&Ej>Tl}vXZ34cq(PIn-qY7iGc
zTd^6^vdD{O^}bG!=ueo^gYsI_wNPrw?*S$7@bhftMe8!1&lZP{hi`#EK2masCj^XV
zW`r9P1mc&XQ=!L({&Zo{6?DE3cxtbB<w>;r9b!Sd9zxR;l=c%*j}53_8a+meA)I^!
z%4D6s1V|Zu_-s(x!!h~<&FG3h1~#x1@7J|H_S(H&x=#&)#z%Mkup<U<2tRbG0VVEV
zJxqs)fs}ODjzu#U1|DDcE*}hAiSq!)VxceR^STS!`L}{%KPJ>G_hEXI2zjOiszD<^
z>f(|^XWVkm-GXE#8J$%4uCkDNrk!lh^y~4DkX^$SxKR`+A5T>wkhp=1-_2!ioV#D~
z8Jgl>92X(Q2VGDaL<b=AMhkN3l=NGif*7G!8-MUQ{?SaYfAjJeJ~sY5RF8+aiN~sP
zZR8MQ@#+NUMyo$k1WPz2Q=x@++>7Vvc~x)o*Kx92_Z;SeZ6V$g2MOHR{t>t45@NLn
zE-FV@GE69D#jk_iJ~_D-U%o-Hwgysequ=-+49oQQSK`yeOA3TFElD>pKs~uQ+w;@2
zQ5@7)E&3F{ozl2)P2D`J?Zc(*miak=$Mw%kyt*C*T@#mhf6aXCA$Y(+t_VDV*m{mS
zYisFBkPJ5U`iI9)eGTCxTqi-bnK_lhh4DiS`nWu9=XIuN#J6*vxDc*5YkP>WI>>qs
zYGWN?6L9TJ!pVK*^z6wIc4{W0kT3s`fKkuB|FDpM`C*S*)3g>$%8l`5mKQBCOb|xO
z9MJDW1dk_&>w#)b|J`PBs|V@3|9*nOd;<4J8b4(DzG<+xt*$+%YrI)(rO3|r4|-T5
zp+)H0wOsiOmGw}=UVD(pdqYv_o6xXE>eJh0Wz~>~Q!skkd%SXPm4(+2PrJ((x1Lq$
z&$p^{``p1Ny17V1VxoE{`On#qXQ+r&mz(us`6?^8`ZFr2TY2z5B#VQJHVc@@XyL`;
zc@NL2D<=88@GP~9U@VZQKm5skub?ULR6*2}ptQwe(Uj1n4BJ)r3=+6mWtx2dI<P`=
zA#46FDAB9v;gKT8R*U@4g+8%vQAtl(OvBr=%iY%WYNj!g#9*v=;gV;p_?UV3@cYA`
ziumP<MdIsczJ0uFB#lcK<bT#pIW}=omL{D@lsgRu(MITrQoVu9?SLrX+h0WPl5c~P
zjQ%89jT!Ch^7{q`)9<asIrhSmswc#oy&}Ia&-mj!q*sx1G05;(24yBeF$z++AU$BS
zG)lanc|WU{ootNoU*Xhh=>)T4mX&aL%`kGQueH(I?=LhXU%SEW)(5jrZ~qg3Mr<<?
z4ya?jHly<YDw@f8_b(DlY*GhHU#JdhpmO9n|GmbtSs~Rf7zUf6Ra~Lta*LcQBT_2;
zfs!P{z2U_waW6HA2J3bx^oB@f%G`=}vA?keOE^9XX%v39NpVNGuxGI`D#{#=%BzdM
z{vKNhJZsfqKHq=#U?Pg{j+vqj*Zl1D5gEyABTp%%susesZNBS?x~#g@5$q-todrmR
z$b+kA4j2sec*oV-LgeUhJO36nB`PHQ1p}5!7kZ2w4BNf8wI0HAF>^o2`}4^^)*Ut8
zMZH~m^cYn&8lT3Ww6}@EJBp**L)_UCQ5+)%T>P=cVilC*>1VD9N)He(64R059iG<F
z+2d{bN|v?Pi@in^2mqMW1<vuND!+1l{}b=QeRsq%THkgc%Bf~erz-PW^?`M9%gSDr
zlh@ruY8mPfM()xi)~=6QN({OgT)UJg{tdMXtnm($#o>Uf!6m4WTZRV{B40g>`tB=?
zJ@66qi09ynz_%*@^Kx5~VmJlkvNC*{X)a?JVnN@5CGmM@AqsQ9a`w*_2$c<XexYNK
zjuH+>rM=;pwltV-M3xa5%n|T1TLJ?a7oHF)xZs)H&X6F9c%#`CjBBo(FfE!E<vrhA
zu<5YRyEX0em9};w#EDF@0op(>zr*~QLj7)MQ<s&tT7$Tq_+IyK6ZY6tFBc(Cz;X!~
zp;q-%u^LN-!|i^jo2qu~5R<${tC(k*<(MV~tB^b+QryTF<FSj@0>h<GenUr}9h}gR
z%PJx|$YZ*x^L%9PSJg;?-RH_l7yu^U-+1b-J*nB@pWf}9Kg6mn2TcEQ!N!JH%9Krc
zui~t)sGIOZFRPMVk4w_p=@3INC4rb=x?OzTS{}*w&w$8~L->t9{G!wA?eR!YITkTX
zc&^vH1?U;G4?#*CDn(Ngb+%CouV7Yh1wj{ZpQ~eJ+9Hx7b5*yrkq<Q!#e!Iz&0MP%
z2V+59KE@xyCoKFX?Pz{`wZGzw!>edYr1)YC0Ehy%XP0Z)_Iz`Fh?1pyGyIp`bllCM
zmdfh0Q3ZTRUMn?p4{NlA;DjFgqeWr3m#HdkNOE$Ntbfm#-q5s@FFU_)=n}{M5mh6=
z-ye)Rjs!dSUg)UC`oez4ZgBfS?R&kJe?11nM!jBSQ3aX1tN3Cp;aXiJklR&=Aqc@2
zLSuAsUqJOklArY45P4Is$L`s=DZ?;5aO_hH&Rj$jas(};^(kXU1u0KM%gcl9$CW2(
zJ1nO7o%2sNFq67Gqz+QK-yh)Ae4U)QRM5sh{-YF)2Bh>O2<1!E0sZWRp{33*FYkP*
ztQ^dLeB5+m2)_~o_ID^O&cTvdgd@k7d(3^(><cs>SJ0OXi*_md4^XjaFo^TB-S57#
zfe&XXLq$enXE6%$7Oc0V5H`zodfb>8c7jF%P*u1%&H#XSYzk7B+8_6u&=rrVTK7w`
zb7SUsws}8tet1~+(Net^WrhP9N5v=%B{*B@qPSP_b-zP!xWKob!VRrvw|9^-zuCgK
zirZyJRN9QhBpz76#5ZS8U_5wg{xampe7K@-NxMpl-#r6Qh{X#<^wh?TR}4qFiRv14
zW2t>hAsNeb&86uY&b!pA@2Jz5`A#Qg!A3e6a~uTWb=$~59Z}4%&1%sAZ-i7vl9~<i
zbQtV_*RfF6en%=cKF#@+dP~wJFNvV96ai?ob4YS{!rOl*glz7mRaBmCFYs-l5YfLs
zn}4-%95BcUe<}xnZ0EJLn6~UXYQgjY;g1z-<IhwZg^xMB>aO<c4^j|u3i&A%aCgx_
zyM^v~#qwq87FGyDX}N2L)A3|$ILCjaRg-WbqPjJf14njb4Gz$4(sWH+G-u;?xaN|s
zc)v3ZF!=aQ6+Vg>UuVj>p_xl7Fw1WYZi)}bF+acY<IYW5gT($jVdjI)_o|rf(|WN*
zfB%FW>-Hd%@8Xf7WCXkA)r@iQ**8N2RSC)T30sjvSE?S_YTilCvSt+l3Dx&Ybc$qh
z2IbY7MA$S<TM8T;<p1`%Bi<aN{*vc6bDbCmx9rPpqrlL5d_A%5-FZbYnp?cqzpGbO
zP-rKaR~xoGP56h37jExKMb62;V1h>ZzIFE}CG8(f@KHG037t{Khd&lA?6ex9yZsW%
z;%B*AC}lB`w;&9)Dz~UDa8^|FH$#p|JMlMiP9|u}t=)(`P^LyFvaqDPPym<Lj=`_*
zgWgK-^3@&(rfZE8tbZwxpWb$LGaE-GML?PVjLOjhnJ&MN^?9pT;<G)WBSL4rXj^u!
zMPsi4iSSz@-pKI6^w)R+L$n`oKFK5|wp9!P2jC55SAmsEL>Qf9x37ohEk?$$_zDDX
zzG?I?$2v^4<I$kl5D1R%bEC!6ptxTQ{bHU0j|xtIWL_atbo)x;{Cvr|Y<@zI4-qN;
z4bx$0>KVQ{(BP91{MuyD@gGby8}>oRp<aS~<DSyDzhciXPd|qg=9gK$rhS_|E}H{G
zDKhzdI&s&~KT||w4>>z8pxWvTkep=Sj<f1(ZqKRqt2{Y4Ml9gwAxxO!T!3f~F77qQ
z!i(&gDw@S0wP@wL$EP^n-*Rn%oj+~dWt8&4xHOa;$%Iy6zCh-j33xmG>YTV3<Ku^%
zk)+vc-G;QjT^>jIHO*mZv~@x$s9yNO4hopHK0u;k(9I`rVj%j{c`BIrH~a_rYt7}i
zOi%kIwhhFj<7N~`YFeOyp%7z8FWNqtH;8eGPc)|XNQE+T$4$M$ck@0^-#EEFhy%g%
zI%G})e5psscEs#svl3l;mmsP>>sfsB4N*JcEiNovky%Yo;wmh;N5CL4$;X8PblZNc
z#z-0+ztm^KX{tT*fkjHXtu!4nAO9wp@>IoxrS)J5m4g350||5p-XhRan289@ns-t!
z%dz2M+}U?m1}qz7+g^>d{zR#DhWeLk5a>i~(4fq$?D8&{`-$7z_Uy8}*^e^Y&F>h<
zR$(kSCj5qXdtwKGgh=y)D0TN)<-eJ~QU0i`$S7=bgZ{qOi(VSRffp82Uj(y8(jH);
z9%3ZqC}}Q|5kT4w?^l2WVLiSrRGY>&u@#aWVgtmfa`t#Sf~h%die$hypRC5tsHEG?
zCer7Hq8oua{?$*aHH1EvoSW~5hyr0lSHH3-UOeJ?nGWFWJWG1Tle_)Av#1xnsTA=g
ze0T=Vdv##|d2wCmpG*zJv*w$yzJ+ni+9_*7Qyq9T=d*0`M(~2y&ED9Ov=1TZ(ux$(
zuB*qXM&B!p(dvhFwlBq)UKZ^cEOoUlXa{U{pkwyf2HGdVJE$~NSd9SUk#KQi*w3F&
z-feQ}%8eCY!<3oHntm6NKugkoR-Jl)9fH<NS>2(kB{r#o!yGS5fijM?FYn~oVW-F4
zVIj{ZMV#TF)$!8>g1nc#p%J5gmxJllrL2%&c(k!M1T^tDf}V(}TY_E|LI5}qHpxx<
zE#}x@@AFavS9cj7+?&k8T1n4gtIjl82ehUumTew1FfpW%2S*cUSQ?B+>+eD7a4=f@
zwB8t&y|W~9%QTMrRjvXy(K<0{Dtpz)ZKTM6Pw4TpSs~x-h--)!$4+gdAu{yuPfHj#
zIEs{wX#4ddo(2tZU}olL`*qX~=C5Arag*E^-(o(c{21<hMoy}X3_?sTa6pIJ^Q4S+
zT|d^P%^3>%5-_0mvYga(E*@HXTgb=P?l+J;V@kANFJ)f^4NhfId)59NliXs!L4Zxm
z{8)kFZ5zN2zDB)0XFmvel=H)5F}2tQ-XwmI9&?by-xEA&&R*9>%+BLLhg@n^8@rns
zRBxo|{=MMc@)CH3)9mMm0dr1uaR0+Z#CPdb-4QDTyA=oAULTiRiiB9Kc8OQ4?UT$<
z(PmSxhOvy@I(wcx<a(nyJ;-(YtTq{&w8~^h={!9l>J*AnD1Ts_R|l(ReoeG4JpRS<
zb|OA~>>eRK>J%98It-c{hHY7X-h`g283nnDH8O<TPV$h9dYO@;iTtk4w5T>`eUm}{
zt6ZAO3oSks+E>`Z;<|05IX5g`EhvBviOezNkbAMKwoy?s1ac0B1NILV#ZvB6SM6|V
zq$oZ*qUe<D5;^e!Kewm3b?2JfEzk$VRmsSIKUK;(PVWmS{e4Oz=?Sm=CCLxQPzRAk
zYL+Zpd6LaKY(N4xlkZSRpEjecu+}&Ou$cIQT!zFlxmIx)K-!#g=Z=?P)B*T9jH>fH
z3k*Bq&&C&&uMG^fWAQ+S?J2b;0bpX$dr$Et!=vv%85!g1k-)phTkuAk@FTamg-yO$
zpd2xEwN5WGWi^~-%<sg7vNqFkLg#Qm{l(Hzu@GM{tgS-VYH=>Um#**Q%oY}40>~Q0
zkIhK9wfmA{)BfGLKAtW$OsFE@g>5zs=9JuP|JC<1cC~)l+NqUvw8lHNG0g>*;Hhfe
zI==SC<n=3*dBq2R{a4>eIS#y1H9I1pU~$Jkb&=F&b{gV}8;EuPbUR(zHOCub(ODm-
z1~xdG;toF*$G2?fU7YkWhv2kxkoC-4jpP%Gam?}^jurjb!OG6zxYZrhfdUY>qIfKL
z2GJ%~q(^xr8m0)vDe~@?DL&S$J~m1s+QT$3%s~z>*}w44G_x&UFX>o6k1YlBEq$+_
z*KYVz<>wN_Xc7Yjz+T{0_8@l5)|1#9=a$TTw?7jJ+2xu>DRlKe)W9S8y@GC`UPcYy
zx@X2e1@8d)*^;Qw(<dCjIJouSkQP|17ZPuQmH|yYF9-*G={ueB#~IA<$~|tpA)u|M
zuxa%e4N`0CKB(j~!DMWK(n}e4^E_eLGb?cDP9r0)yeq|wpx`Yl|6sz`&L0e=8JrId
z%xsNk4I+_5fEq8C=*N?cTsY^6u3I?EIx>CPAe>*Cmmf*98pJZ@{u0gI0w>&^?8H5j
zw__@WSvH8g<Di!!6Tb-+xn1tu0D73D70(THSmR$2ObCwH74ux08~15yB`r_a-Z`ph
zyWJH+n}BLLq2GX$cF(T+EbfN;moZsm#5v-TLu3KrRcMJbBP4q!1_|KpCbUZor@9@e
zfQywh3TN6JUr_2V)FVJleVjH0r;xzk<9dTD=MrzU^P}>5tr|w!(==f`11CA=PJlz#
zG~v5FTSEqxvdne)RZS@^RPMGJ2Bb%yys$(TFeELz3F-N*x@!V!l4JyG16_Xh0G3X*
zJ7RjSW;x>U#{*hRyCF6ZWg&PdfEPlN#3SHWf8mjM(?u4-(B^S~U&wV{06veuCdde^
ze|qfg0U`{|&HZVeE4EQ9YcLkc-k?JS2W7pYhk2oU|By;I&_xK$@qz3x3WwNTob*zC
z+`pf=$=Q$G=FQ`A<5CshTfpqxGUi|#>}j)8+TakSxV<$ckHmU%e}N|)550r~?1sVX
zf#GNME6r(wBAOc)cPyrBROK_+neSg&#`tsg^n(67KqDGi`ZWvTUcbnsNdB@#d8!Ad
za`nJ;hLRe?wLk+4ts_Z1L{^)yI-+udH|<CsNhSupU)3_F8zoED7Tm1J;;z|mzHUf;
zepl}i_=l=?IVpbsz@kJ-)u7~+@Ln(0DQF3|AD#(xR0X%F>}JoU7vsWf@iktbP^PC9
zL6{&v#mD{Y91wK?UJhMeqBSrJniX@gyzMTt0as~qNH?q*5^t-CEjca}3839rk;HSv
zcUP#akk6nOjcpymmf<W6vSpisO2ZLC#C`wdlDPOOxlTmv`b2NQUc~W*P8UYUhTt31
zHX)mGXyTn<1pq8NCmc-lR$Hr(y&LWmalNt5H#Q#m&R~Pm(n#2AK=HBcuOCQGY;GW*
zqYSgJ_r@;d;}CD?{`UtycL7UiyC2>Tlg`MNC{SkR!(<-5P!#%WlDGPkSwAKn{p4Ez
zetZG%{Iv{!FqA^nGVdBCO4f$1E#1bZe_gUWPQdsvJ!({0#D?%_D(Z#_H+c4j>1K~J
z!T}?*-tH*Bom^VL`{}r2^Dc&ns>iEPWKseZV(O77f%Mp|*#QZup7Cq6<ma$PnLDWb
zvAp+v@csB4vw5QnX{JaQ=)C&5bEH7RdVkxV<gJ6yv!kJcKJmAY-Xl<9WAF2ksP>-n
zSu;6|chX|oP_ljWGf}#I*7;uOml(W|_%s{c!Y5fHW2^6#k)VK)DQAazHGc;Et9;1E
z0pw7bu(2O`2vmE5AczA-amYT}A0pK*`n&j1ph%?dEbvhf){Ik{CNfqXf(}r4%gs83
zHHKHguky^Mvnn(aFNK80sAU?}g~+!}9kl;$3Qgi%-8mF?>S}hjz}pI)flpJvhBpSx
zYKJ}Tw~t}OXTkad$iIm%y<%@Hl{D%|7tkdw1*f4BU4<kL@j2oG)wybPh;NL9k0V(_
z2Zq>snXQqWOnx~KmG#$*&IiB;(U6XPhsft?zxhv-A+)pVCy66B!%FU5ea?=NZ_D#;
z`pGiJnjW)^Ec=q(b#Jw1-UF;au$l4krh3+4#1Os^*yccsC)ro3`HuwC>0|d!s~Zu&
z``CZk*(P3M;Dp&89%S;J*1Y+Bo`1I9gBmcvxJ#{Iaq#$<s}Gx4pB+I9s*FaT$ZXfp
zdYhp5pKR7qRk0v)YQ$8fU~v6GCZKldvk*1nNyfqoxIkYRb($T_j@Fm{E5k5TE(ivT
zk&_m_ln8yyd6nC#jh5C%5a*M{WJ(v0P9ga@n%!ir?pSRxu@JI63(;8*vsVZrTobVi
zb+nQsRg4^!=>K=SvO*(sY?z|fk+M}vVnyO01OM$7D&I!7kR@|Oc4Xu>no+GLHuvNn
z%dUS#^}Y)#@|#22wR3>uDbuYlC2!;=knr)ME{!dV65%Q0DvMPQlLJb608w%;heD$!
zl*dZ_oi&=3-@eKruHrX;gpBujmq@ZYh1wL#p|{&uJy0f>TZOu#UROL_eTDEDfoxPC
zr(i(I(bdG?)8n7*g7=(kb^lPfG-=pC3sqKrRdqg(99HSCIOqgWeE9-nOj<&|tp>vq
zhZQy^K&mJ`=BEduQS_aX*w!Cc95$`kOPzuJa<#kpB5r217DT!kL^9A=Q+y$OGxWQq
zH8f2EIr1LbC~V9|qGTdJr;)+V*en*@tzGiGLF2~kp<rNqMcWvHEu<q5g;M|O(LM;%
zYd>}HE+hg>L(i9T_;Lb_3Wy@6&IQY7{uRtM$KO+5(BZOTCdsPbxASqM6Ni%z88g=h
z2Wvi3S{y+4vY>xH>kCah1DzxY{D`$E^+#10D$9-CG#PKKKPvl?weMA5+p$uhX*z0j
zrbzY~*p#7`+W-zmM=L4EKB@etq>~$%-EZJ(8AFMr$6iK2Bv7~N`tLT;!amNeA4s|4
zm098`lZHX=<^o<2CiffSEknnLcz^@1eSB5wY8kJ*o2Iv!BSeje803|LNc3zqpEnLK
zqUJusv>BHuu6V#wY`EL-G+_2f@$bP+882sl7S(!@Q09*kv^@?e8k*HGktvS}uK0VS
zdc^|JY0YALjyD>}2o&eH2GO#fAXectIPx&Y5C~#Wtwg^#PYSRaFsfij0>}v^Dq_N?
z+@(q;B5)fSP^?u%uQHN;<cbFV*;x9(We9b(yQ_yY1qx;c9a}jVYnC=m*W>tuLstn7
z7F?38SX*cZ$fsFTSrq@Ml!<Apg0f~aj6RKQLVCS+N-qwMi!$)l0mLO+bK5mVJ%7t(
zl<;B$x-k?VyNQ=5H1_3?^-{X)2fmsL25f4*s5mVx!ReBBQ?DZ`aKJ4buz`hKITjQq
z3pKrrO=mCUp?X6>F4wn8;@q>uTQ^(ammce5R+RLOnj=(y4*m;Uch=@~(6JuG5FRTR
z`Jr&f6|6ZA9f=#Nn$Pi=&c6U~U{lu`+Kj&Y1E0txmNr%-tVl+juWz~u8`Et+8m*R3
zY{G2UYM0DDh7Sz(M{UpZ!39Zxs9?&Y-{eQs%0@0#P!vV6-tW<cBrW-SLE$|1p3Id2
z%P}NxbF#>?;&x<nru0EAvGJPEl3nv&Wodyg5<Ui4<uJV!02QqZwkbA{)+~USYKqBt
zZ8insp(;DD-?6jsh_PR--0c4nCikNcI^FR+ThL3DbHtDibAbc86tr@rGhl<}?J*@w
z$)(3S^M23kr3hJ{tz~jInhW2Ji$>#2!vOEZhVkM~KB?xKM1CXH0qej5KN5@h+i=1Z
z0QvD?xr!6(4lKrNlQ9-WK@WBzgk$dmE2WhKad>8+b#2dkAnGd}2V8f}B>;T*?7|g(
z0`H5eK;R$;{`aFeICdBu`$bjLLVW>Rcdu%hLnLC~=s9a+<^%;;agO&se!!%_e{TXE
zq^*HN|AB1y9k@;n*un-<klc`PT@ZJ3INud^{?W&;4D{|0fhU)Q1M`iiB|cABGgH`Y
zV&D_Wr>>4}3vqwkzv?vqNG1&%<A_Z07A^({JGK!<ZGEuwLcX+CGP=kFOkjEOnREVr
z=n{`Sa-;Br5x2&y|0q(l!tv<&dis6v3zWEQ2$W>$CXq~uayFq}N+s`#KJjqS=0~m;
zU`xe*UBUMy%_o=x&eQyKq8bSL7!uj_>Bg_t$Mn506EK1qHl|~ch+Y1^>)=`yG+J!%
zE?nIzZ6n7D$#T>T39Lu}=ge>?#?_~EYzlbK<XH4e;NmYkFNU6K&W*?ZTO!0h8H@zm
zVd42n?rHxNFxIh_kEqv62`|wa_fa8?N2|Yo9PEM*LINi-?8Bxg>ye1~5)|9`ga3%P
z_fd(m0})t=|4>l{2jAG|3!1OHMxrbkZ@j@#Mvg0=nCD+>PSVgoM$-3&BdQeZV4L?)
zV6YGK%ggV$rL~=1iIrnzBP3hE1m;Afxo)Z8RjNceol-9)GWn8|j9C5I(fW)Xm>B$}
zhoHD%n;}k2!A)Q?(Au}<GBnLv(glU?kqnqbPxaK$w)~vMcWlFe&Uep?o+_&P+q1o_
z5{K2pp)iCEumn4rxh5VA2>_fK`srZG#Ej~>!PJ?0|8Sd45DcJiO+USC>p5p-Cp3y^
zcvLvNmp|gho#x}0^!g5i8ZjA2I9stF|E2pZO~*IbU*ivoYOiN#j{s`WIbyNCH3-S+
z=XJ9i?!FcDpawprJZ=0#aEP|<>6yHA_8|4s043jQuv&2%)=dOA<7EW^;vHdgitTau
zr(M`wk^^|)0%Dcxbh^ZMi#ms*czR5~r}WDpemX>-2ibUl<)3Jwu`1^6QoE6@V$}1a
zl)?bK1SfyYLp68E9(VZpfZo=i-s;tk(obEHDdXmgS5E!`{*<-EIrNmFR;d4|C*~c0
zF7pHbPk}GXKng~!ZTl_?Nwyg2{Tb{)NDu%(99n%(o*S?b&=XykUCQGx(T)z$0{r@E
z-mrk(-eo<UlR%h3aqFXZjtIT&^v{L@eVRN5&W&^eQ(!^x^kiZ3@6{H>%XUv0oK$;$
z278aKsjI(;pXTV4x$>YW2!yOo7e64GVGovLgF9bEX6Ww!pEz#{4~S_3f?Dlwm-wjm
zUY43(3(xrUQU+jrz!mGF@DlAYkrQjDlm+Rg^wTl)(uG7<dQz=`$q)-3_<)IO%<vnS
zo}d?<lB(=Q1$0YWkLP6PC(11U-Jn#4?p@($_SHs?b){g_?r3#m1{NY}&|I@;f)aR;
zfI9oSf_VQ$)%C1!Ayy4h@K$8IX1;Ou^Z|d58{}4<mAk`EEy};K^Sp4nmphjUHgWx@
zdrf*UddUDVuD-gSZBL(#o#-lh)5>MrnJDuph_D{3|Bq_wg}1*+4IV(fJAB92omHr+
z5rw?}7^l?pxIIA793YRdC|fI#t-*&XS&{>vi*$&bXrUhPU_fB~KcchhiFJC01OXhA
zVcaGaC~ZQu!K@`AZ;=M+1sXuy#~y6(kdH53k~5Xw3O}^G0J<3D-?72pF5!EIDz1tR
zI0Vb9t>T)<fR`)&7(77xib+{iHwJX<ESZ;6B2(s`uouZB{wy?D#|*Q#BNIsjb)>|f
z9X7ozh*h3UM3D=d8GD(QzEiL+go%O(o`!%xE?5AV9ZFYe8>;eR)o^7w6mj>Tu6ehh
zKVBp}VuyC7f%y~4#8;R2VU^2JN_&Z}T~ipaP_CrA?&x@MkZYe_vju{xIIeOon}*u^
zB2&(}rE`89vWzu38a#m=k;64<fI36_p3qGVUMz~VX+;Okpow3Zap%a9zD<X%vCbo)
zVvQt!5@xbk|3|;enIVsf0XTjf`C#HF1ckE(tYN1cxD%*xhed(^Z?6>8F3)~BQopgS
z^KHw6dhxE}^d+m2@t8;5sezIX?V5UM{<5>8$1u9q8DG#11_<N#-jTu9qrhK?FK%WO
zAHsQ9@1^+Yl(dBom>51ZFtRg02Sld4&fI<<<|X>1iC?;!>09lg4+U%(3Plo`GTFbn
z+h#*sfKBh>ojT)dH)z(?pn!!~5O!OZay$R*BBS_+-fNTkddL?nO9a+IgPKyQ2!sPL
z`yG{EyAw{~UFt<;epUk`5rl>v>sw)L>j1FYe|lqB%RG$d&(}3%=)Lygv&0$hw$VX`
zOdCO<wd24A0DS)Wgbo(4QH+JsjRE(YVpYb}e$lZ-HC=QJ+^^OC>b90N^XkZyfSb{8
zx*=w&ps&J(;88Y|SO^7hjO_p29J>RRIUSQ@4L#^a04&6{u%=q>sb1)b2=sco@YS3(
z#A%R6rcCG1wG#-97MC3<7!hx&f$$p>LRljmL;hfd`nu!y$K2xZ!P=!E!(Pxhe^kJi
z-HsvL2GPs1HzPqi=kHW|5_xckOMSZ_B&n#Xr^7cVd+MK^aWPjMU=5aEy3Lx)1-`kd
zNB63!|Dsn_#VP<HIUDntPlDqo%}GsW<6wQxdSAX@)+K2&M?zDE$i$5RaBlX2-tWWb
z6d0E_L{L8(5ZQ*{wXMDJ=ohh_L3HeUySOR-?~V79$lZ$`p~nTH`=Ym%-%=VF{D<2Z
ztziJn#f`r>g<;5p#yvJEFbVuEiK;#5Llu1>Ttcdq|9JRaoZqpB3kp4wd-+`@Ts!Xn
z2BMgP04WMOZRw|AaKkPaT{;5J+em>UQ(5>3QI{k$kSq>&wAswhw<}2<OO1Gm8YmM#
zC+<DZSjKWYk^lU&?ipW0>8D^L;XsnHhsY-XlZ7{Svs48!ZGx3Q$#YY+Yn9s0ZEFon
z-e39U__L*r6bX;X;Yh@R@;MPoY}Y^uTR*&zs1KEZ-wq#2gyl}D3cd`ntg&sj3B~!u
z8YauPCC67S+6JHV=zvE*bLu~Pe!ab7{69X!vSzVE(R`gmJk(zt02zfT4h|M<os?r^
zeh{_8Vf2`3m6jbR0U=%>p}J|3m<*<$#NdOmDSj1H#`oQSOXfcY(F)l<4sGK;f@a6J
zU`yN6`Tq4JkMi=dBKP49sft=Opbl29a1ly*KxLm@9R?sp9nF&l3-kpEERVWH9Il0T
z%^@$SQIF5(-f+s`muB;1c5t8r3EaNJbjhdipeTu~Z$n|Drc8)Okh*{xzwb%4IFmzT
zo#=Yho-Ar+ss7YJ$7l@ZhX~s-JwhKnrh&H!@pm_qdGmd^J2W7WukRO<hO6j)sh$1)
zk1{qxuUWa6f7oj%;7Zqb#4|J_pp;YxNDz0Pr}v$$ewJu)1YtqQeB-BCk6xn+CBjPW
zI~Pm;KVVkQiHcH9k|hT0Y(OKGe=@q_@>dd*9txl!wS}@}opf`>V!ZVzBP59%EdsH#
z00oA7KPoh>^0v@R;7J$S4+E{-t&U%_JgSy?b5BuUjiSAWd7hq{zTjkI;ntd$JLH<O
zRUbFyPiGBx{wnlm)hvKYscl9b5eJdPl2p7XczN#MqF8z)zp`CQ(iux)YhaDS7SXNb
zYV;>?&iYjzcfLfg+@G!7`vrc?)x3SKZXzgg{QbD3<uSF<^K||<|92q(*ES-AMIST*
z;yM|yt+t!vvQQQD=6$QlFmB*so~Q!Jb_qXxoR;%$76uWopw^~DNAb|ZjYL)4@&god
zD@?+a_DbrUAh;qb)=;>-swap*Pb16Uz#{Qpqv<_uY$kF+Q6zYfF)$-4j$FI_#7G6q
zi{6<+f4nDL0x@v7SRG8BdI*^^DJgO9(!6Dc-b}SL=G{|U>S%1SfdT`2-kR-~I#|6z
zm=?q#XhIw`bLX>gL)-{qasW_sC((MboK>$&Cy&1twt%jHGj7?!k(6UiP4H=um<JEQ
zM^0vMA$J6emo`Z?=op)ZLV9Pk_#P$qJ@%OBzapqRP(T4q<Qg~i{umSEDai~(FkV)H
zF0@QOHQ@TcLsm$38dW+kAg;$aE`l@`PR5Oy0>=SAVd<<D5A`N8v>8}fVFg-(y&?uz
z_T%de;>$Nu^Uc_h``<Y{HYyswzzm8g6}>A;DFHDZM8zP^0;!CyEBVYGMVD<b1-HR$
zylW^dXPDtyBHhxaWvil8tlLLM9n>{%&f43T2UtCIz9AuiLoy@^l0opo^<f{x`h~fS
zbv5Ki5S8wvl;od~>wGH$ONp{fJpMsALLb?7g9E6gKk)mICFhe@Y<Gg52VjYyK$QPU
z;aRB`lQYnSHVPXsX_&b$_i%@^2rI@+0n7`Jxwk+62Y#&8jtl^FuvnU`S^)|+o3+=1
z7_3iYG`ACx({Y#l>L~z_9KP5@MuE1k+gB(A$bxpo6u;YL{$ln_;D19C)JOi&re|M<
z>RsXRxOSOgfGL9na0u9w8qBrK;w4amOu#Be*>bNA?rQtdA;Slz-otW#OKPZYz;bGc
z&13pNtMpjkWFBkU`4r5c2n3C8XNMj?)*d2{V8YV&M*bS_m|RodPpTM*8u^Fp^rKVP
z@Z@TZ$X;dk`H$e+*-7Q$PU8Q@ZBa-01t*ADeiDIJ^O@LNpW5Q&F6#aMA0HrIDBykj
zN}uDies*7@d%Z>QcCoVl{Px?!P-n$%@ob~>B`eo1-MHg;oj#wtCngUXBO&Dt5>_Nf
zlqFVkN2N*^`H$nMq6L^K2_g<dh(NKqDr@z|D-mQTK*$glu<Y|#hiDr#9-Fb!gsw2=
zZ}{s<({{m=DMyvqSKK6NU`%xU*NXMk=#kD2X~U_A0SXu!|DNh)2p9C8f&ofaemE;g
zz?R=9>A!VA4cTh(<f&_}=GZZsihk1bPq|m%r4;$fC6x~*3!RL{)PK84uCjQ6JTmis
z$rArqtrjp5`8QC;OI-HfT+%<ycU<U0-2nz-ZXL0Ug;ulKxUv+>?Hd|h<&Khhf&ZdE
z5z5gOyIiTrde{CFBnI}UfD5{IXs#k2D2RB_tcotvLeF0W7;pv{n?0H&Y)KB<y|u8l
zYnlFV)<EuS0YO^+{2y3((xA|$<QrquKnTEH#_|!KFJlH|xsU#!zIExS6CwbL(%P=r
z3P_ahbh~eaS{mB(W)@~x)bRTsg_qxX8A#*O0^$M!9IbJ+<;)b+piojveh~e$P-4k$
z2m{E_+X;Lt2?M0HGm~7)1`o`X#&CW+2NM}$mRGb@oc`I>BP0JOoO}DdTkir8455gE
z3t$PMtguZV|GxgWq|^qYi$|1HsTe7N#FS5KmPAc_X|)NTUJ|eLcv$Es7Z`N^w#1s-
zefKLO`F|d?pw?_7fFg%@9bpKJd=oGS&Ipa$oqq8EY8F>%$?}Sby)0uIo(hbK$z?eP
z+=LkN$)AI1e%D?1$C*sJEergQ7|Yi!u%aBu%6@fF=+}OYx9#?9YDj;87DpmX&5_oS
z1j<TcG_g89XDF3UlCwmwZ5Ahe{U0Bb;~6ZlEusgkktqUixSG7)8Mh)F;sXp!#sB|r
zgR?oNBZ0%c+4KriDBTh&@g`2vY$6$f;bBss;C+s%LC<3_QbX@HHylTM@ckwOlNXG5
zA5r@M{^_ALVGyhSD@0?;+<=NB(uF)ZuIS_ne9L7(tNmDo8g>GXN}#sd9j=A{`^vZu
z4am^M<p?_%F8Xg)Kd+7RlDIpq&ARcO`4?@Xi#_H%kC=a8ees<X3ET{f6DCkVV&q6y
zNI#Vm)l@^4NdnDzV9kdJBqTumh@*DBwnT`6nh*onl{deD>ll7$@K11r3M#_VQVqDc
zlUrv$7d)Yp*exBIU}ykE1>f^BjSFw`SEbQ}aF*7w-w-9^B)R&qVWj-MdUCuVAZ~Lu
z{zP_#)egfY8CYg@h#YkCOC1N}opCeMKeDN!a&o!?;yYe@f6>lf^7XtnJr8P%xdaBd
z$FGXqv`DFtrSFH!tA6VTcLH_y%|`Y)l~yc~5juNe*U=!ULEcp(LvuG58q^%{%zEeh
z8ws$8YztFbSv<rB&q(#%-TaLgXR)VWDM?fmPV1N2_sN0fR86&~-aWn-Bm0yJj7ohn
zeqR;FHoKh1FFQ3k3ar*NS7`+u-M;xGl#u)kT1!bL)r$H2ksCY0OaPQ!aS#Mv^#8Ii
zV2VHT>ooq~mLsdDdnmCf#L5pf-REKIDX*M1>Zf;1zwM8PpDM(S75Ml3`Oomo<-qB*
z(v9!;mtm72A_tu^s46n|`>J6Fh0FskYkgIG#!rd=`-j=_R(n@!O;F6RVu>Hr2%#L>
z_-J5>5>UV(oto^_{?=DmG5p?Dqow06ucfYw{_T=+)1TeAW3}3#^|#i+J#iAY@~8g{
zzRk<P-a*5!7bm31q$S_Aj&4(<18QGx{Eq|w>Ar_nw-y&r`s8}#$!!R31chqT8Q7Ap
z*!L!LBSbBwbj1d)lm%mvM6ltP*CzYpgC{F}Vu}g1s|tZO)}_wP%hY~G!8>PFZ-ud<
zy_}oS{}H~eKhy<BF@A|1f=yxm&Q@3LjS`$1LKl~FBBvIx&*n9-F$B)Nw|xD~{(**$
z_Q`eAocJphSIgf+n7n8IWy|~3f7XZhN?=C)TW$!s9m(Z>dMy{DWnwb)PgejK8!#qZ
zv>&oc*y9g!X9pM`VR$-eDyzT3(ZV<Ygv>5`CHN`nUQB1rq1BZ23`H7DUQS{UnE@Y5
zb^1uW4YFzu9p+w_OV0xR4^wELg^!|01OE5BGCyWp(XmWeoYpFuQbw0(Hu}^eU35S^
zlS2oAA9P8AiX+G1<YQT>1AVJR{HsK`9|ALRI}dby_qLQGs=%7*Nz$se5|!bQr)qA;
z^UsSa<B*<}vyH}kR(}B-lrahQ91e+ZC9pW$<d#@sI6g6$d}DJdDW|aJ5e=gX&z;}$
zKzEMUYQ96tOB|jbSpq5HozSL*?(<&#ont#1AS<B(&Z4-!FtPYF-hD5&@r{<&i-dpi
z^yMNJ#cUQoMO&SOhF1C~i};+@&nK)p+qGwFoX(Au6c^;xB>}<l8xfa`3uwT(>ucp-
zWvqF)ggydB+wZduKmwo5Zb^Q@kJZ%8>h@z^f!Dj#_4C7n)K0I>%vaBQsd6@~q<|3D
z<)5pN5d|9BhxG_zI6=1D`1W)&Vi(#{LwoD8uygwV?Tg2`$07R212-JN7)eckUeEzh
zIL(fYR)oyj>#Sezs8Jr#GQ>M=<V%Cry>F03RR@=`oLY#OC@(uL<w~kNExlpFFl}Y@
zzE@d@TYvUG>7O+HEVnZFE++3Kjz32bUI04+LLn{Hd>Pl_fVPcw?u6uG?3CJ8SL=7+
znFAY3B(S6jA<(yi%C{X_eU=ETmo45sr~OA;RD8E~U|3BM>P+RepgWv6uQ6Q_J(Nk6
z1ueZCNR$#gDAom>#R5aDhc_7Mr>HFgcCm~BqWmAe6`WMsGX)Za<0s<+LH(fxVZu3z
z*)@QCL~&#uY!GL1X%0zh!N+AJMH*Vfeb>*{%EJlG{HpWyUlA3ruSLtpNCgDk1vG!w
zOo4EC&^Y10LTCgkptw54pPNqI!N?nL_Oz~Q+DA2zB~>OOHHSjEQk=)7`+^N7J)F%9
z`l)C9YAgsq0m=2|ckqw{x}Hi@b$}A<WMur5+OlZydUBPJOpBi)ugFn+KEydPsZ`Yz
zdzv-gMX#l?pylEk1zwspJW*@r^pB87oL|B~76NX1nd@XlzW>H1CDRgsV`s+0q#d>7
zT8+6e%91aePy0E!Z8`6EX%xpg)5c%`ab9~ZkoJHa$P6Ap^aWbxh6aeaDoO_1Rso<)
z=Qz^rsE&6mAl|Q%oHS++Gz*cf)>MwBrQnW30Ss*5NNiYI@u6f&c7aE3unK(xos)n7
zWeB!{!20|!$I|Zxj`%%=xKHn77?+Y<li=_6HSU<m!G?g6!3AL~5^B&E6M;Ja$J%?x
zHNCXkqd`GMY;;i&!~_zgD1v}=r6u&xrAiS2X`y#EHky<WdKE%PP^5>VC<38LQKU<W
zbdVb9zlnRl?|IL?=iGb$xc;|4TQl>W^2~bHTF;Cs4Jj4G*fy+oTRSZSPK7xC5J%(I
z8PDX?F5)&{mz>y(!^KrW?`ICObAtOL?z(pT*!8DOxE$r*i`pA%9Ht3U1@p7Tr~TQ7
zX;Wp9m(nZxYYPYxD>*s)usJ*m)$lmOW*n@!scWC5PjU$WB*4ylw{KiI5!f_Yljw=<
zv`mzi6%CrY370COzCE6)2zYlfGt)m!0cjWY`uE{62-8Vwm^CdW@^wn#n(`zeT<_R+
zLrF7FPotnDcT4>zrLz_1-}!o7$rNh+9(b#HCnYu^jtf!g?)b~~1O$HOpTRmOb@R7n
z0In1g%zyDkTABrAlr=VmC+oA}8z$qX+7Z3UW1+1=J;_j{L^x>!<nPg5*FnoCLCYr_
z{YnlJ0PV_uF)=O8h4N2jpha5BlcH|l12Z}ZmuXKfSK&(%e;;&6-UW5AQyXP9x9>d%
z5ES#{Na9;*?qvv<z%(vShYKEy>sK}<>DUlbrn81So01d)hq2{GQ{*y9Dp1LE11WyG
zkb3BYEiIP-Z&~BfQ=PJrgK=huEBnoyW(2<phog>!!%v5m4qnb?fnD8|9c5!%D{(!^
z=1Q92-I>n<y!i@X+2_;6diW@4cNeyhrhPb^c}bo;^61-`1zS*o^E@X86?0%)i1LDb
z`t%P_pMuBj>&P_hy$MD6o`qy<QA;3}JqDNEg@%8vk5ZFZtC{aoel<cW8}1SROaF80
zu<npRdMY*2PH-b*GUp8B24>v7<h9r^YgDB<hl3`EgRJDYbB4<w-Psh<58>;{$Dmf8
zU8NI}%XKSNHE{<zvJHC?oV#D5SbLv9e)xF_hNcZHFK0I05tH8`7R#73Q3m)*c~o{u
zf&b}ValXva*t|{t9Q+bI!RI(6GD7yo%2n-Q&M!6>=nsx#K<K#mN-E|N%7{e+pv&RK
zj?B^DF?)^1<l00>@$b%JPV=>w$uhmpyKgsE_TTR1i^-<>7Lp~r8f9+D`+N*=c1biX
zzxh_J#H@bIL#DF-b<lilpo9NGtCQdCWMJIUV04GuOsxv)7aO&zs&TI$&qqhQrJ^w-
zorlQeL5wd168hO$Pefuz#FU2iGmk*sF)m)8U_5njNtqD$<-ySn^2)VnY0_s>2jLun
zv;IJvT;b7PYI=QeVzO~DAtJ!WCMJss;q%SWmcT30l%j(ACga*9>DB+y$#x?4`>a4&
z>>%-W3@+<=&Xs;8-UTWT-jCC&_bVmaT^AocLm|f{-*NTwbJ{?HW8WDoGU68J`9kH5
zZJO+<A%A)yRVu{ItaxL04WK`xzKnyexQrg@{Ta7|wvLJ&1gw1BWAS#)(NuU(ZJ7~a
zSejJVw4|zHSMG0IUC~hnyVMuWn;G!9-KWDUu&oO8f`uksVJbJ)Z7lNSKwhvzWWo6g
z3xNpyKu3L8IVdKV=G5<{Cat+Mf0E0em~2%J=AWU$GC<br8r#rLvEeBb``d#njjgw9
zyq2YVO#N1AU#XT+(4*JhhaP@<uX3nVm+0f2;V~yt^Zxo>;`(DrOEfh;Eh0_lyHAkk
zBE~E5h_v$IT56(#u9D&IOMKen^3YGWs$;*}Dk@*VGv{j~a`4v4fW!VRZuYFB{YYL+
zUajE7`IvYqIrK5Pj6v3RMB&a(uXMl~OQp-pF@^78KL+sanzj69fvw-w*OB(nOPdaU
z<C(wf6(6O9=vS#jNdx`p`2^dZqQ}=Y?$}FpBzC2x*~H-TF6O0xX6AM{`3$uJv4SB_
zr!!BFQN^IIa3QF;$`(78w)~!R^X4e1J+EAO)uhg$=rhI33D^P8)x;h_c5u4dp-?Zu
z=WX(0F(FOQ`An(tQ8JxHQ+PAMakhKrN#&JiuvmK#I;W={!bxK>2N$2l(?je?e}=QZ
zv3~0_!HpSrp1mHiy|ticuuL@7KuPYZ34txt>Goo5qG^{-mwZBiCKX|ps(6Uhxp2oS
zgX<B}NZ{9A9v!X6&MB~w(!>x6UiUob;@KU+s?Gh^7$Fqi&1y+j!^W36f><P1XI!tv
z#PzLw*Wtvz!@Av?_lfu+lIZOf<Y_m0Oh$#+eub&EYv+;REl>27Crj1FF&}CXh+NI^
z-Q=>urHvp!=C}tI*VB+*%wGx(1D2hv>ku^YI1~n%@d==puYK6~b34lO#p#C7f=D#K
z61Sk@5>lIkP(=Rt;*i*2*D?P#ink|Q+>=nR!-joVXJ4%ltQ1y&n{9Jjo|1bJ_1Jwi
zaBcv~{5cjEr`%^L@pJuGMUn(p#IGH`2>g;T;O;M8Cd5}~?en^yh1O^G^fE(eNgwPM
z>sI!h#%9f`CM{%Nq%ysY;feR;^jRu=7F1R{ySmpCJIjrr%1fj~R-TDvXb9RmwXN=~
z-({x@+*5dBrN}K*-_N=J=o<2hWdA|g`E&+Vt)He$txoqv#;Y6zf7L72FKkr7O1h$s
z&u;e^-#;clU!-SDuqR2;*7MSt^7CqJW}8{2-8RSjC-@e5?=W?6AyV!AB_ydJdFh%(
zxfqPt*fH9y5V2r&U5T9!Bb**h^^0#(sbdqlZ{@TBT=d@ht>tp5Gc2s=TL`-PdXw=o
z9pNC_%hEJR0VT5=ae1sOy3tGiOA9?N2Od7n3$M&-*x7qW!SCM($B#!>k1fmY%E{XI
zNs$#o%7qZs6~7fUnerkdQoL>!lT@~-_pUGtYkyg<2nB@0`+$>>8}saChT~_4B1H>+
zoV_8^{E~||7rU~39GKbtVJKv_r*&;EKTISwYHsZ=G+*HXW%Pbra_j0o4^!W>phFoC
zzaE*XS*-5f+z>?(ypCFTcbId-aB(W_e%p;UDxEFNI5g924SfgFSZi3l+c-tW*{<B$
zG?S249mTNa5JqETjvg2L$m^H=g<G)5MXj8FG_RmHjz?7QF|siFr41;~$eFckS$9%t
zP0I$ucJ&;0Tf1z-&Sc<b4g#hq_nZ{?&g~V4RJo4|nuvCx&wPMg_YxY#NUbu-NyO%k
z*{%1TphcB!Cm(G~{)HAS&BA4i3)NU`VuaPSd@IFg)9-7cWQgxpc<dc8Upk)U=sxQ%
zl2eV%;a%Pkh1tZ;_+v>spsL}lxeov8^T(gfM_Z|~1s4-cu$N*Z(eB)KFr&goho35O
z?D6#6iSSN{7CM1Ku-UNSgbu$~y=`k}IE69@aPQ~O{1tXJ%3UP!Y5uFZ-Z;;rP2JnE
zIYyR^to&z>LoN!e3YUIZ&6eb%x?`h}UK(7;Q<Uc4zjgkcqI6ztTpd!;w2SfRx30wu
zR{JI(Bed=&n7?y#G@>D?3LPANpRq<zlZv|3WhNOF2a3Mb$!VmR@5RkDu!{lanR(h<
zg#ZAE@67I=aUB)fKd|P-M|Z~j`()0sH@(ukYR>X-B6_(Z1fB50;T*@%9AP!l-+!+U
z_Dls8j9weAB#0$yYh}2%M7<@pV@?rY>z>cxukb!&{4-tgFLr@@9r`YXq1f`Aa)cp}
z+t$FCPvl(YnoQ!3z)3(zu&A^FjK%+w#pZ@S8w@n}96C7k>50KXa<9HjV^7RtH_%S&
zqea=>czN7LU=B-^c(+@j(;SE`Xo=#B!Vg#`bAsE-lzMoXI|x_VjB-1v;JhG@O*oE5
zc#VAc7Gubyjff{ybMC9j7WEZdL`ey%8*Em^qTUH3H7?XX#Z$v+Z5VO-_O#SChQ<<_
z<AnCR9m-86Dthr|f(xfQh3P7}ktm(t>jBh|w&Xa2iJ<1f!R5f!aMAOD4_fp_u6(sp
zF%pFqzJwmtF@@ptxu{Riyx#=*>@ddS;2T@DSH)r;Y0ccxYjtQZ;TaOs+y;Zf<Y?g|
z49?L5U@;uQ#!bOINg8g)y@*1Q9hwm09cI=b0eE@y%1Mb52n6%<yU2D8^WajQIPv!u
zPIFa;KO1ZI1hRQC<e0<_Q)ql#AjYE0|8>)n-_dlsAsPdo@fhnqKT%_iP2<MUg2mxN
z)P?eLRZ@ra>1a9Gt<h%IUwv{q>T{}2@4D`8uiDOT_5)R-D{~b0c|cA^b(Rio`Q@7q
zj<I;L`~4>mEA^vQF{wFO>9ho!-Z_(<u_A&~T)(sV&_Pt7S-T%OeaP8M*4=&%YP9Mw
z)Dp&>2xgE*DNtJQNtS<0yd)irR~6loYVOY){pL}99jclg@tD@fXz%eTR@nZpYXDNL
z`QOh**cgdR)1HXB=~U3i@xDcbSHk71v`~~ZGU0%ILXG*)biuJt^5;U<zdBsuSD>s6
zVsy8pe={$Gz(~D<amwlOcZ^aO%Pt1oI)`irH@ReGZP-C!-dRDvNG}wBSl$<rPu8Ac
zz%pbN4CXj^1{M^AtUKS%G)u}B&t<^zuV#FccQb%R2R|-sFT4FZ@lEtSv<Ava6I>mc
zqInJR;YrmcXZwr67&A5HtMFTqCU?=tm~hMvUIE3SA((?aF($MIi;32D!MJp<I8pYJ
zkR8n`k%?AB2OTBMYi%6+0;oJLfA>dcyt9}2eM^N!i10L08uTZ)4eiW^V^-H1ci{{X
z4&0mxfNo^?*IQe5c}uMXd@~uBK8qo|RuZ!IxI(<mX$}dV>dXgxQtU%1nj2%R{R|*U
zg2~D6%(6QAY^+xj=y4$C6yIh{7v=C)oR;_;d`HmNhg^X_@rG_T@-DhN&l}WP%aQ&h
z?-|i4I6sf*Qixz)|5cE<Kxkm4cm*vM6|K@?wT!fRdF5#jDQd$}sx1+L)vBHm98RNq
z?;7`UNLDcAV+_?sqO0DwP{2GjT+kH?3n}LcVUUpUxJOqha!Hf5CyemadpN->Rpp#!
zx-IH3m7MhSF5o9<Qo)e^<tOTLQxRkxRHxN+kzrZ<!C49#8rL2U<lOS+FU(5YR-s~h
z5{W{i;b1N;D9v3Qh!47Y7xeW{k_Gx2j+bf>%`DEU-(5Ydc@wf8;@rd!&{5Y|#~7=b
zcy!uRt~&dgW^440VlHu#G+4eQS*C(M4GJn}L^5Umzcaokn61=4tve-+M<77{O{=Aw
ztwMa)<g4Tqvi|g^0o`@D`8!V!@E;{3-AWpFle7qKH$uN<9v6Tw-mIF2uXEdX=C1f4
zQIv+Qr7{nHEJxRwk9&Mq4{1}4P1d%CVKGy7@NC`(DMERtD09hnDh^jhaLV7??lDg<
z%);f4g%ufIe!U&GXF97Rx%c`oSD9saRQ<e=lv#tfUr|7sd&?}hGFs_nnu*WH1vsX>
zo7b(#?(&mIgk_HXvB$S$MtW6~>)h=)jnNO!J_E##aEfM+SySs+;Ey?m`QND%hr<C=
zg_$+7vURP?S9V8U@kFa`{By|XV~bpac+S$P4gNFDm$kVOn#R>#0fPdpgxS%ZU4@YK
z>yr94iGj17k3zchyG-7VI6CbYj_i@%#Rf^Q9)65-nqHJ$q3eL|Nv(vauUs#y`zAe|
zM}{)sxM4PkJxM1sW=A8kvRG`z<)65wtWEpCSV&#CXm3qK(oX*R9BaceTiqoH*O33N
zrgLBo=fNWsl0K$-#oJ-VXKir1enQ&YdgDuyRzgU`?=x|@CcnvqX`g(aa67?^r~3W>
zUSUL3+QK-4UM=Q;<Dd;SW{vo*I1w1(*PqZora7wT)pPXu#n_SiUMBh3Ou6dqygDZp
zU2Ap(8}xcyIBLwycW7|0qsfEOb*I~S{9E*CW~%EQ)wy9Ykqu8dBxrlAl%}4EHc6o#
zzT%KE_$Z<mh()VD$j+jIFm&g`67fpV>0v+3P}6#?>K-T46`8$MUe+pJ3BD)W2Svr6
zwXHYJ(?#+cEV$Gb{~6(1u2368$+fui_(pwQ!O?}P+Z>m$k(x4lNrct6XID)9dKS;$
zIVgRxetmEMuw(DI@eXNBft!ymk<1`L`_WxbM1G!Jo2;!sN8PKtbIPQ_l(O)kNt#Xb
zyC+|KehipPC*g+!QftwgJ1fSY-wSVBH{Q|y^+Z5z_U{fPQJ2Tyo|tFqnDZ(??Pms^
z>7$S*@`P*RbLI02(i#p=wjtpWavKf}!Gnv|zc}jpyqf#8hh`(8tGp1o@SV+np@|3e
zJgSxbr%`Oj?f;D?Bsadce>53acV$n?_<J|qK;UC>-^zLlvw6F0#$4CWDY9jGZga?M
z-0eN_WlP?nkQlL|GZ`ZM$frEP8Ty2*47Je|Add6%2u5XNfz&y*Q_&eDw&ZBNeY~=y
z?&i>8&Ux<@vQ6SxkH3d75L0(Pu;eXThG!|DkEt;rVY#hkJz>LP#Z9q`44JkWl96do
zo3#!m%-mju8(ie&Ux>C8=#7zCVv9?x=$PbC#Gm-51)){lQOA?UpwgT^9$o7PlG)81
zzJ|b>gx1{o@Nrd4?9o!+;r`(GEYe`fqVZ00QU_sn?p#t)gxwYO)7mB#lcZW&qL7nh
zE?kwpcJ4S+Obu4}$Kb3&%cE^}``HAj>50NN<VCUT2HghwB|g9C${Ku)O(cdCu{O_Z
z_pe7#@A?{_GX<}p=Et3!E19@64KgYnR;2&F!N?c|Uq3jPc0+)E<Li3wLn&$<znfjf
zNRQEaYSQ(xUH{l{1()8Fa4v0_%~SJCD>|a+M&&Ch1?)X^!h%AVGW4!aHjkoH3VXmV
zef7piF>c-mC24`nQAg7i9%BK!lJ5IWrOE)sn(6y_DNLT|eRMG(q3W1eZ!zS(|DBJ_
zPld1GY$o<NS3hB~lIPM!I9G?<elXdEC6y(-kN}*g+DOZ$rjvi$ztpv*>dV!eqc8n3
z=fn=a`*<CGKj=^8)MyykOOrIuOwOvGY!s{M5FASK#+WvE6BhmL^No-Ct{w0^;~$nh
zPfp!$3N*>M)<eoZujSMXB^3`!B_XxhjkSm#>IpkZu{fS`e`PVF?rZDlBjcg~zqMcB
z5nD?BxRzTZr_p?Kd}oKV(W;$1*DT3RN9->h+xZ=|KV`<NP^FE$b44ItJy(<Ct#-aD
zRq&4cHln+9-|4Gqb^CmE*;1ggY}ri1UiXri^k+JIU-J&ZaSg35YqaRfY~(YGa-qEc
zVuF|@>-YbY3KIPOzfnPt(58Ez4pu-cC)25ZQZ&0(7Vk)zE8ak?aB;SHU`U_I&y9wI
zu2-SN0+mnrP^6nrk0CV-!+@(!GijUjohrUdnmOA2Oy11g+ie=3=0#L;<;ZDBbrQ$1
ziNf=S)bg}o$<UcRdDUe9%18G45l^DTw3*o}Negb!VG3#VKxuvM;ZMn168|QQNXHKA
zJT8xdLb}<}!4lKu49uAMHViLf)cD$X7+I-s58Ro9+V<H~6r?Q|5Zr~3KB=O4_O~Re
zvMLgHN8jd;J97)bn%7^AFR#41c6m?T8b6bS%ayLev8RFqKIC*lT%Xz6YS}qv9D`jg
zmq-xV{P4a2i?`kR;a#icldZ#|3p-Mw8mEVDJ0>Z*)zR|aR*yH8Q3W_GS(8;!t8t2$
zj^|B%T=!(pC9X6$tUifIp`ARhh_pMh<UV?$%N7@I1sF)!q@CaoA4S1r)!OAya9&^p
z&Eos(!_l3qP5#J3v7v`gb0<tTsZNI?5ITpuX@*)4MdcJVn&Gr@aed9<r1~E%LTtW=
zVMp5^T_YA_pfb&0v~sVf=os){KMwiX|BM;es(tSP_NE&O7;n^OT68fe`@leVP4jx#
zYv}c64eERz^*~}hccOcoKlW1CiI?}2nl<|<d{dVqXI5G$zOxSA{pmDn23qh4BOLB7
zb=Y-8{^AyNG-^E6hJ0$|-<|}ml?h>hBx$l5YN6*mEN@0omxojFY*^m$JIHv|)()qS
zd!QaJfq$7T1&)dtnYSwk>qF0`)vocXBMW04l_L*lz#dUhs0X+%?gEM(5Wb>8K8a=4
z{#`a+E#Wm4moi(uEA-0YXKo#1gjg)h_A?5?lgn71q`0oeSBTAIJZ-N}YWxol>e(LP
zpe`Y2qKzWC9sY}g0)t3Yi^7&~0^mo>*O+#OFTqM^HA=@&SvoVCc1l}2!lz^kI_$;t
z=VLVEvcPF$*16xiZr(Tae#T6V#Eqc2xPE_XY<$i3?S{q`vFv&~bZ|57KZqz*s)!^S
z{~8cAW7D8Eg*0IO>tew7#M@51Q4l`tMu6J^pI&|$-q+46?V8vo33NcP>hsmLgv~k5
zuTMW{jfvZoRoiaS6~v-%R(VxO>dq-D*x)R0GPoivHNzLa>ow%|EvXx8M0-g2u(Z4#
zA*B;z(!S~uV8=vI3b|6s84j!`v3vwdmV-S#4Zb)}0iB?)#m##)Hx1`W98On-P9Gg+
z%5oY#<O`p+ZchtOjAr<|6FQVmtV;VnUkUDWS(n)8(Ae2r`G^$4axdOqa;%XL4UOX)
z?CXRhQ*$(Br^X4Zorg5SQCXb?c+}YDv!g0gx4&iurt~ta1s*thvWt67{)~~+s<Z$4
zt@OTxrUq>=Z6Yq03D<@UMexFUw*JJ^_0o?AA^s1w8#{!W{8fYxx4eR8{@4%tzZqS>
zUYc}1E)E*5so62t^Cm2x%_HpM3CPThJJ8}tb2oI}ip-ybGhhF<va8R++Wv3aX;eHE
z=fBA+R+q{du=<5YxG0NVQJY;>zK~|QYa-L5n&WY;tHdwwkuh-mZszcGxoJY-dsqxz
zoWP$RGE#a7=T*EBjvEd9@#sgx2CwW+dx*73qyNsA2?gu$5)(tywH~vT>u^n(=_k%p
z>Fw4G_zh!4WMd}2<{ad`ZpYsOR_|z{<f!wjG}Zx-!oi~>@G1n4RCcd}Z^?m;N_OOx
zBSYDyY>`+D1Hz|gy!y8pSI#LEBHV2>l!O<6FZ0X_sApD-7?qdyn06a0hwWB=qHtrY
z*PdRs2!YuYQX(riv0b)y?J7C8HDlc*%mp|d0`D`uYgjn1v2ecrsAE`F$^af(fP;5V
zA9;-FXrQRl2amQgT92k#$-*u@7UFiBj>o~&w;`!v*zyY)OqAeXeO#&pWuMsn&Y-<?
zL)Nw%@(4v&GnWr@B<m!Ac3qv%6;kJ#{OYMo&DDW0@*z~OfgS4-NjaRHKYnIhC3s9Q
zAP~<sLQb!KE%Oijb-)_5vEM|h<reG`5q^>B-+l1p$g3eg3%8FecaFtTL?!C+!T}N8
zirn#2D2SW}H^}UEI*<vT_i7CTmrK18jkFqnTaA3?=2hi_(;tU0@*`BQ!fQ{+N4BRX
zo1;(9D(;vBSx#>pciAa34c1(jaVXvCJ}*U+%QVt^{bmx>=Jw6LozgopJ+6`D;Itt~
za9Wy^eEWfzaZH>RM&1XARyNEyp@z*ptGKw_3m_MD(>|7@g*5V(4@-M`F|ImjqxR(U
zY_J-X4ju>nxU<^2I_x*zydAi+d1S)PtGQpzX=WJa${vSToA6|=FX?0g&L_%vk|!P~
ziLR7+)E!5)Q*3M|O7cE^%#xq^css7bt37`|J+79A=dS>#%-zoR)JRyAOuzAkaPyIk
z!|!B60+K23=a<-*E35mHZ1+OYMSf(uIg>Uh;^gp?z=UQAW@;FOi<cfql_rISEtVck
zozK>V7b2`#LNF$Zt|(r3F4cPl6tS5Sv!O}#?S^;5+wGt)@H5y*Mr2{?%qv{T9Uibd
z%J#y8g0@1^_HE021A>|WOz4IpIE#ouVMAv?2#kq4g<5H<Z9{swoIfF_6?IpOh~|%e
zbdoyP9B@#9yuq|M+%w9CRuT8<x1!ZS+d~uaZK$xK0rlDBfujV{D8tR2nRn4=8@7{Y
z&k-ny>qx5Ur_k#C3%I7B6@itoO#fgcx^W=h>jV3NcdFnq$P6?DyXVZ;X*1UFp^1v9
zI+WnuG&4Oyca>MQ{1c&rm)$}bW;01y`)IZC&bOcH)T0PTYf-5Q6c(AnC;jqCIB0`3
zuJ@Q-v4x$81Lrx7+wh;2mFG;!Q~i3MC(hnJ+?%S>2^Svxd3af43>&w}ipvycZubGs
z6jmjTgnL>}SC6RQKSdGm(t;7hr-3)oVH9}P;5e8@Shl#1jln%a#$rc;HmS%fFEmWo
zL8B^Hh!cCVLKt%wsyICT10_%KC#@-e8s>3!KHC3U`|?QG=)((q=j9!$H#Vc@lJ<6u
zw!zrbL<g@1!kLhDW`h-eTpB-;*}2GzO059DpU>*prl%F?M#juQBOkA`c<^8CLv!;F
zI{U=?tv24;>rz$ntqlCDL6-16pjWxE6>3+Jq>YRJpb&mK2XZ5pT>U3B1XQoM35~eC
znQ;1-QEby{c5KIr4DwU)E%d6}ihsbv>88soeoqKX*q33m>0cwN3Elagbz4Hxea<h-
zj=nptN{u?NAMLvOXlzX_j|Ro*+*--0<2r|7;CVrjB=p_ocNRp?vt+|H=BY`_vm7#$
zkhtrJo|<`SkVm|8l9cp+ADTuTuWsEA$Jn<A9wySQ!mw7G`>{7;g)f73#xr%uQ|<~}
zYpXKr-*w*h$NKvWJ|I7-mR-oG5*#{kBkf9#dW~V;mX(~TGY`k%*2ZbO%6RI8{wHa&
z=1A#CrD)Ppd{p_tUD^4;rF|`J8q&mLnT8u+XTab_<7aQIVb^QuZYw6>T%Sgr(Kq*=
zlsc|>F^ppKpqPdD#V$)f{DdEBi>HC)HZ_ImGJTkP!Q}I9<Xw|b-$pG6Vx^ou$+u;5
zM>Wl>ou2FomHtlKOQ|d#(<$BSIIPh~=@jr#^^?UtQjx`5qz8<9(n~T9v5+U^*thoi
zs5h?M`B=@wlkz{&ac6IEV9~QVOxivls?8G&=lpG2Pm}vr)7Wf$&WD^3j;DBGT4Na<
z*ej%FX2RU*Ah?4=9@Sb!KKsCp5p%-cm60Fgm1HTe<p$oT<E>8rUC2Ce2SR4;33A*2
zi;5}jNS-Ky@pv>MKXcvKX+y74q<EKJ>fEOp*WlAin&YiPd=MQTMAs;;tbXA>xofe<
zbHb-%WOun_dvW)!@;ZtrswcK18bCT*JUzpHw^QyX2BRB-{d926R^zPDz5ZHws{7eL
zU6+7~0vab@Xnd;stOw%*-VmKQ9$8Yk_YQ}ZSUYcF?4vKhz!x;N!Sc%P^!=gR<Ov$+
zOKfc#LDKt-h3{_)hxl%PAta0cZI(%8?FU{qi#ixAp6QhurW_xFT~!c2TX}K$)d?(G
zNZl&_Bm}p8c>BNL=xe_@XB}njjNk1iF`VZ?JYQ;d1)@bBexR-Dno^L)`oUo77Xfmo
zL}Pj|U>OrMDJ-MzF$k7{{&+4h)v)0F#X@@TmP`Nk`kLfIPjd{C+tAeT9}qNPlLA58
zlYY(JY5=Z<TRj|}K}QQhYKsTecWRtdwBwdPOhZ(N1y}}oqYL1$p_W5)TVy@Ol+S>^
ztGLS}<_a#H-l3ASTXn|t47(Mik1(umN6AK{d#%^dzoc9Jp9D}yI<n^I&ce<BuV>>!
zKKJ9$SllV%u~Q(1fqt(YgT==&a=~{>y>AsK=r3i6@|g2)oCrpbPt0Ug{{JI<BD#s*
zNAY`^{39#((dA+>@t`~b8js7b{t47!gQGD{R(-7#dY$Um;kijIbV6y$8pqz(Kw-@^
zO5D7>3R>&wMyRe7_pUQMHoG@Z?^3-tL>fc&t;e1>oE1Ao?}{efPho@ExoyrXk5Z`o
zCUc-D`mnaF(S50P95ngi6XE@J)=||kmE&Z$y3vyd4hFB&dUln|iin3VM3jA$RXtBO
zV>wqKfHJZT+KL3T0^$gZzE<PI<%Ln|T-`xM(48bGESpA&hnH7HYkh3(_o>23|NFvJ
zi|~XpDmf~{x1NL5<u$gZJ7f0d-<N~xr$5W%XL6cqddK$X{9ddWfLH?$pQ3)v#U$^y
zLAD(OG>ntUIjM0^iuduLpnX8ma&Kcwz$o`ztjf{$4;hj*^v-2_y9&HyO#HbCh2TgS
zX|Z%<zVTqgz?KhgW9KzRH<0xeSTF#&VB7SyX|wHaDq()|S!*#O$m7m@c#mQfKJt=8
z?fUbt+B4AOevr0%Xl_FbJO<ND4V!qCJHU_JVN<+<f?Om^ucV}N5~nj@eNJOMt)@*L
zd6{L}!wq|~-+Id6>i9GT6vfKeNG^tlpu?xw4c;)>V#fP6eN^LMi@T$wdJo*Ahl-Xj
zezuZfFFVW5LM?k3LXk7C6y&?l%;Y5Ep!XRpn6T(!yTz*7)jE<TnZl8%Xa)W&hN*wq
zsYrJ4By_!$_3&%*zr8LbJ{IKN=LnoF0S}U`Gh0pH%ztm$yibly9gkDd0%1OPX|={j
zufk@G8x#nYC*nexFV?1|$;r2S*&%$fJd9O!H<3Vvlqj$8!;wpBuAllyo!i+C&R<1K
z>D30?F%Hq7oKts`b-bjYmL~Fr)nC_#qPhjzYakW_*uKajliI_mK<iwma;E)k=ce4C
z-h)r39^`#z|L+Hy)ki+&DuM)StD=Zp1;x*?Sow0{!h(V2+{A!}rhQ{E`oz_GlH);v
z7X2IGO-VV`{$2HZEU3|q#w!%OH=LoE!5VcUlAgKRKcUS$1kQ{$qyGT2aE4U>Qj^PV
z&1S(#n~dPdwpzcJs$f!eysDo~s%P@@Nv#XO^i|J>t}LmX|AMvtgl1MR$_W65lL@*!
zUBlFgpjwKn8HS92WtY472!WO_JZ+27GnNcn-?q*)VULOH7X&!ECntw@<VnyqIF&_x
z$T}#a=-`8!`_7YF?{Es#XKj}DW)(m5;#NVv3$Wl~GbZ}gR*lX0ybC9dKuB>oBU0Ce
z*hl(wjFT71%?L+urqqnx3zCHL*_ItqVHhC9)}pSLZR<1pU2g6dBXu-1YO>Nik#<U&
zcdmqBk?g?EF<3g*P#YPtj=%018K80BU%s}|s{Sjc$?h`_tDVwD+?F%zKD+(#;7nEt
z7H!5G8*QYZnbJ`Q;}#A}6G>G;soPG_gUE$rr03@5gx$e>{kHPuy?UT&LX%=o|M5Rb
zi!iO{CP<d3AWGc@t42nrfI!%Sm}GGF;yRn7AoaZR<C8rDRRO_4C52;ZDR}?()@obK
zUsA4HV$Tz7RGF;r%Og6PMSG;YE=tfs;;2+>US(l0C~A@jideVaJuUhqiyA_0<1U}9
z=hCxzin!nqAH=*Y-ZeRL?8YQ^9q_i9Lp12{-X)0vvkT!^RpFO-oPT_|n*S?{?jAu9
zOn@#bJj?TJOYo0#EtjeAx(YGDE*2+h6*9O<pUBbp7v#n{V$~<f;vX3Zqp7jVaVH}I
zk>YID&%hL^7J=`)<NW*-pg={*;1HoHgiAnk<+_24Ad6W+hNUpo+F>Z65WrpluYgcA
zb848l<u$_%Z>sh4*`+;?6+XvYX&9Q7pCI_c0ptmwKiBfr6fxyzR+7)j*TR;@xyciN
zV*{SiBqbyT!#&Ipy9e^S--4^U&$$um8Qu%Lbn5G>;q?H`+fSHD`OlS&5;*U8_^UR@
zfMO;sE{UCg8`~%{(O3;R>{Z^;HpL@iTQ(8r-RI@&FfP4UY-`N}7dq%pUI9U0(_gkU
zU@EX0NJG2o;p>%NSFYHvCmj+%!NO20zsim2t3q27@GmrwX?on?imw+NpoU9Fjo=bS
zSibSCB+iquG3zO}Ll`VjP#ZI!TNPOYjzGgE`|YLPqmS2)1q@moc`2a7+fDx}sQSx-
zV9?gnFO7XyCV4X>0yKe;RNyzBE~~+RT~YUtkm}@e^f7TUL$&FEnq=TvGN;-eFIM77
z@!<6aeBT-9ZuDLPve4Te<3EI_S|L8|7LVu4m?j-O9prO!`)sGs^}4LiYc;laFk0RD
zvEl32hC6>8ex*!c0p7&ZRmSJmV|lyVM!Ny68NN+n6}VF!FMO*Bz$>&Q78{GTqA1~s
zD(!D6nFe^W#7H9?0M3gxdLek_-lN-Y;tmQ<;RR}h{k;m0k<mf3Jq~gvCt;OyVjt^A
z^az@7oc^hI5EkiVxB6lIp1s?&rgV?7zRBDMF8-pnzExWl_rAC!5{vm36YZEeI~PL3
zzj`8gZTx)M(9Wyu)5NABf8Ph;Q#h2?b0P3Q>=JRUVjCT)^ia5}!4@Of6cDR~xN_V`
zWKv}6piy{N*J@L}(2ANhoA)L8WG|Zjg_e;-1+{Shc=oT_;j8oh-}($Z6>LQJm4}hQ
zl$M4ohzoCZyA*EY29}C`$=KFw?$gAr)Nw5p2_qNzA)V{9*ZqsA-W#AFnljm1Qn)e*
z<TF2SZgOlK_gr?HL=z8MhdN(r#uiO!P3IN{&CRV?!6WVL^BVEUW`wbEbOaZNW@=rO
zdWZ|sbA|-J<x*|Xq>xs?dMGyfA}f+p+GpZS<|D`{rB5K!pnTA?#5m`Mw*;=Q*0r9O
zBnn5ipJW<+|2ar#Pw<V-4w>(XmT7QF)6P-+2+jTZ*8Cu6Zz_61vJe~?;Y+{U+K1&#
zPAD22gG4@ibGPgik>M0kFZHrNmdax3A65|v#xZd{bVS071W((maF}N9&%d6CwIsy(
zlzsa0+RI(Lo5-+LF)M)W=Wk}UYSv>xBCv0Bn-e{HE@AqF>VWjFOF@KO^0oH2w09s{
zpz_n6f)0bHt`6qbrF8GReEm>6n6Is|KsyNhQ?GKnkvX(L5y7B;A2lAWTDG@q>)(hE
z@y$z9zlI=HKK#IiXk&G2)^kVBU+mLn{j`RS^I&e=ybQ^5|2Ogs=0+0xC|rTuH<1%@
z*6%7U+p3JB2M1p!K+Dv-zUv!3I&Xb9;I!<$sH-}88kCk(c2Ypv-Hko{jr+2q{s~3B
z@w(~P2e2^!=WXF+{F~|bwJU(56jIY>Czy^Go@qB~=rmn-33oX|L?VLvX)sHupC_+4
z|IJdu9Dw0RPn2DB-s^SDDq8uhvVnfBI@No;3X0l>ijwO?!g&y?2*5N!e8MZUzOjX>
z2rbZ?O++A8i17LgH~?xj%>s^S?TWD}^v?pnGxSBY233wV*sdDylKaK~)HbvVPu_3x
z_zavwLR+=68>0`rHgZ<gQ#WN7!|~m6H$E#yy_$EGeyw;RNkFk12}!zv^zn6&F_8D!
znmBNMKtrOL2s8q+c`6~1AXM*i1*{|zKqwThFu1<uzU>X#LC5ZUX5BQWP<vZ_&^zxO
z>SgSq7eW~1C0NV|p5&jvsg$C?JidQ06lnc`$<7vqH2PN3f_DOdajk2w^$I<A_Bthk
z)gnH|n8ZaNPJO<5Gr5j$e#f{^$s&S1t+MoibM)`wq8CY<yRRO8zNhA?SKj6Z2}b`v
z$ot3SeEuN{Eto7{bKF3R@eZqV%Cl|y9t;=6AL~C|Mzpx>nxI5<o93r`Z8Q?i4R_!(
ziXzr%>$>)|ERj*4rVG_mvP@jNN+aR`i?904dWT%6uF-^iN*X&l=-K1O>_yA`pb)`<
zaiq>bazFfU9%B?+3D{Uu@zoK}t}P0EneciMn4N#U95R5JK1!Ws@MkJ|;_y{ypzqPI
z=%@9bJaTIKk&ANo&dz45G1!6fB@}X}Zqc)j!kZ+YMi~vKuLQpR`WhS>gCHUY76VK4
zv)jOvOc!mSQ;HV<zrtWLD+FGO=YI*vwPTUSTK1jDYQ}q7DSM%H3c`iIQnr#e#g09F
z0B*(caw)A0wsJ7;$vk@jr$=gt9Ct|0x7y6jVR7qKWYay79x?qcGvoe!?HX2>!}t$x
zllC5+#j6$4*!1O&<q!**dEm-MO!>d`kjuH_0B`bQ_TKS{o3<$XH~M*2)F9Z8!mbJu
zh_cU4bktH=*h6zG`oB54O?Y&)tWfOUy$Aoh86oG8aP$j5@_RRWuUWWVCYoT;|JHA$
za)nK-fw%VnjmPub1hsY*XA3MolsOAg1jPCUoQWD$I27Kc(w2uy2m#O|8mS<!`|yms
z(aop&1FP;Js#Je6F%}TG{h+^6!K`EWxw&~Vch7#c0AumzY3WMC->v?gYvQY=FyZV|
zMDf`v!-MS1ep>IYNSI#d#vIO6OR&jvkkG;Z=cBDdg!#kKLet}A&2IB3f<G5@Rx0qq
z7su7No|8XnIY^m_)vpS`#WFgAh^_)+{Nn1Ivi<^(>Ib3SZLlfd|Bp@vvHx%~xS0w5
zFE)ns9T5ml9?fE=g}F%sPs!5#Y)#<chHo)A+$z^nUL;+GUr*pKHni+gjrkT3)qx9-
z>bWTzIryC(o2T~p(q4hl-me9(R)&kW_=bhIYMEv&X9>3y@q-N8QEy*|-@gwn#FbFW
zkcoV7WmBen_mDox*#!S8A&GB+%-U)T+qj--<*3Rat;v?p3w%Z?pl&=Y5%*yElcr3}
zZU#(tuJZrpfN+x~c+{>QEPmr~_LwD`uUrAXPvi%&umXOQan+yw5G@v@(Iffx7N)F%
zkn+L=rE5xsQykTo98KgUSh?j>?dKWX($8afvNY?t6$w{c!GnAUNrN)>SGd0<WNC-_
z2|n2CMZ0xhh?Sr16C`Bqe{}F#y`GcRX<2@ICj?XM)8Gp#%({}$eUFcBO>MX{c?JAR
zf3R~K!iCTowKeznTB?Rl4pkYD0$z{3=9?=4YQw++;zD?F=&7RHZFY1Vz!EtIq><sD
z9=3&)({sVQV4Y?XtWVbO<T2xZx=IiUDK(iU6*T6iKFZ-Iwscy+W}CgS=w{-np}FxE
zuPU397BSe^Aj7y7+T#q?QQpgii!ZWp?f2<<<e#zPILDxw9Y-!D(iwNvh6~vr(<26}
zC72t&Fo8>Nge~I+ZDNTERS$rFHM9+i>3htL5KRwIroc}m)aEJ;j8!K%n+{cGDfU1D
z&N1yVmPTzO`P@S5O6$sCJz%P>t;FOOo>eA4olV~~Y2Idp!W)wAX+`O45v`YNLKN(n
z%(ODd4OW>Qtc~RFBmOUZ0}-B=<ahc%kY5qOlRy?C*mW3Z4^MnM@L}An;5W|Z0yYsN
zmQtUewI9I^4Z%=sxl0H(0wKpnojWM}6RuZZ%;z2Eq90N&DV~v)cQc}GZq(&gg4WAx
za6c+^89hc#10~N!Ho1UfDKjPbxg}GRB4n#x-{@#Vz4<h9_&^~$a-wXX?mKnm@lj!5
z8RbP#yr#)xW!8s;SuH<#I7+Zx1dCqRBMPrQ3z3i|FoCluMgh%&`m-ONWTokicla;T
zo0nZXlPYnF_y#s=mZW;SSf(}QE5mAXXe&-v>$7yCNJ!tBci_9F5X_FK<X{32t2g^r
zS@~##)@Vox`fVdZ6Ft%F4kO&Bi21cP0GBGEDP~%=RRiH8(_7|l(Lk<<2?w@}(=+~#
zJ$u(?GjIjS*i;_n%)n2Sip9T2W<Ara;;O+PlUr@lF}0{H5fc8OzJ?yB-MHbZn9laW
zV2eJKIdi#(n!VUZL!Mzk`-388KU>g&?GzC@%V41OT=9KEqe}Ps-yC`QDL~;Gwh*pN
z=V)=5<S5u5-hGxI241#d|Jz*Q!^g;x<>r$w%!IUCrxchx!kVLJau2I@_qL}d?*);@
z555%6hkxP*g@MB`5+#<3$x}*QUYM%+f#`W!2(G9k`nugmG%w42V2Z)IiEqS?#zs*<
z@U7GRR(Q~&VRKicciNVOen9<0^CX6H%lf?OYw*<P1MVeO-_VtDXe}Oz#F`NB3e@+T
z-MQHbKO6aBlv@jyD27-QYmi6M^cOPXW}S+1e?J;Hk?DGnUK3#qY&(sAEEEr}pBi*d
zcWtU}l3>ziV-8DVx=B$6@j?s{Aisl>^vVCw*3`Le?Z7n1$<N!bei6duCtq0XvPZJn
zz&_5)swnm*OI6W}V%wP>EeC)5C4TOmy|<2lpzBJ(1BqdgD1zPA6T~&+&puxKleUd{
zi>^_6#hiB%mfl=rh@*@;Rza)V=wL*+`*jWvR~^4Plg;=a^XW?CkC3VM_GUVOcvIN|
z75HQZ<$%<sg%%`u`w5bZvzTnlH}|5Xw*ndM5cCP>x17Ara}0fV=Dr4NodJahf*{wS
zz$HkM2(nP<8#kZO@9ho-I%3(9;iTDa`mHgW#K&i%)4-9<q^-4!Y~PmC*in>ut{1&>
zR>3l@s5&ZK|4nn$aN631oQA*D-jU69RCDf0KEEMy^iavnQ>v;g@u@HJdyyum*FYa>
z1xaHw>W1WoH$Za(&ttE6O&Y%a`9TQ$a_Pk8^Si|MyL2c-)H_ULGwcc^OA5RG`{zOJ
zSlMX<C=1w4D#Ty^Be~7`sQo&nLd)<G1L6<khKB-ds)Y35>dH28cGuN~<u9j-({3}r
zKy{B)_gGCC)?ym5)`ec<A?TIbQ^cCMYM&RXSHay17m&#w+G%0Tl<|N|--Oy|oc)uV
z%+7ozXI?NsbHnL);K}visweYw1t3?Rh1ASl1Ies~Z|HRdJ&uL}rv_?qlFBr)vt|xY
zKuk6PG=|&=_(b7*Lr$T1oWWCr2E5u@n4sej!ClY@B*`or^*5Z31J4ovERKW2Yn!Mb
ztO1m)Q;rGgGhF9bdzz@)<o592Xcry6(eSI;=kH(3*ZGfMgQznhcY*@uKLUXV%o~46
zmOn{v@Fx#^!gYi1fBO5WaP0cTnEMlo{ASAoFFPd2YQT7}vpRXCYc4NU?<QU`>ig;B
z>pi(@w{p-b)--e2GI(V3@Q+<n!Faf9<}4(5X90Q|wc-qUugFOmtRKpt4*(@@E0ThK
zW5x{hPy8{hwK$HhjsN~yeDbyLny1(HE@#ba^%tY!n}IteBcs3j4;>UA^9+%Z2L9av
z8@un0gL*d#(|Fz4kkST3II}E4>7NfR6#9GQyr*=@37)<Vjphoope)e$Rr*2v(Nf0I
z%kx4NVpZR^o>}AlBdFA~xu1A%i)q$rN^Qjj?sYi_alo(JmJX#a7@BRq_1le;k4*qI
zZFLhG2a6kf>s!Epy8;LR%=p_Jh5t6w7Qv@J11j&W5WcvoVt}}Fn&T9NZIaz#%gXWg
z%*|gb)wNbH9WYU!;&JkSP>1i`YxL3JM0^g-QE6K~DLYNc#r|S^1Fk6eTMh!n_q)gX
z6|!%{De3(DmIPLnnh*kNGf4v@gQaj@-_c1SDn%-2gPr5V4N(=GyQHN9{(H2_ZLc@!
zS*;eapR<D8-R7|V?RU|Q;Ch2(6-lF%*FNh*t)momrUaQZ^pk8Z!(@t3ZKSM1t&0pm
zH>IOY6og7eB)3gDEXt&^l5kO=wlW8_wSDCIZA|aZX^SG4fj882_I3)~A;MSmawa4f
ze2m(+e5irNvSV<?GrB`=82L1Zzx|uP=i>S&3|cI#e!%@`5=mLGOcB)B@;5*#z6_C5
zGi*K!`54kiYiEb)<A(P)2;I1gMG;F9G%{;;FW>7Zw`unTM4vV;1-Mp1D0f;-(d(dD
z(0^tbl%PJ%VNo<h7ujoD?jHP#RnXGcy^Rr>ul*EY3bQc&nl_$@Ke$I#abXHYOf=g)
z=$uJct7!xg8s{gh&IGPb5OdS^4Dv)!sEcqU$kxUGY*z?`>t+;65N;b)nQ_04$s_?f
za*RJJtK?kO180M6n{)g3pR}f4Y0WdA*!rE?z5G4gMG*6tIn%B1d`e)t)u!D@zWGD$
z&Eg3LzlMWw*A-6(>c?ddH|eyC=|lMt@8IE9nl<2}fYI^Z6)h+UR3Prf#%NpTGWEp*
zwp>j8%F$O(iZD%~Amv=c;0QX{pWP0D;G4DEsYxZ5Sgg2d9TB!DVnGOc29G#Rc;c8k
z^4hrd%iE~emeLbZW&>CaR_fG^@0mtfdHK&_He=$pd;VPki=(k;tum#Vuc#YUSG`s&
z2s9nMGyeRmt$>5yPq%k%ym$1TA}J;olg|vAnl*q%90g@+rJUTH%RDq5`!Q|pYDHLZ
z{DOM}xK)TjzP-;)Xh>pSLbD)<fdIzM9<QclKLislv3Jz$5WiJ^vnXr8vO6lFq^PAp
zUf@jEUEw^rfhja+PA!KH*MiN^{S}Xr<$*}Y0qH2?%%<sg&XViG@Tpr1d%_Nz@?&?(
z>eds=^Aytcm`1{0X5#-;QE~aj+A2Q<3p11mO4LScC^uh>x&APr*hwGi#8c1|B!@c$
zF9mGhGd%E~y5*%ed&bdVrGYqkTbwU2mVHn3b{_m4CmkbBUNzp~^TZZ<K5ENZUR6V2
zL+z?~&hs2WTU_-_MfBT6x4`Y4#YdePsKnV`?eUQE*CE%qmf<=ZZv{EYGu}udYtUn3
zL1Cds?Zf|E&alGaw{XBSMR6ns(C+|4=z=m5RH%WQ8gfUI^<k6=eP2Kuivwy2q8uN2
z4X&us_^WxxLc(W-2jdHF?}C6^r1sse_>!!cI$^yJMh1F)wW)L2#^!iM9#iEfTBhFB
zQ801-btEmy|8r?J^;qB9BeU5Bm_WSixjWqN#JmFpNPCujI)}#$3KjnvTAzC-A+s`n
z17?!|pqKXFqchEY7n(aNsi<rAYdI0tX#OvWXPzRMc+XJIM6mpI*hTrdo}?rWY&4tr
zE*qACn*N_}f1llT|71PptKK?X&EoEB<nh(FK}PV_ptYe6)vP5qctoeB|MF6C%8!7X
zw2U?CB+mGSU#^<bDnv#ZpCh4loG&BAZv;x)m~R&OsX7r2%sgK2{oJx8{E=fk_4hmu
z_Ht+9DaKrWkucn!5(D%f+7A+QEh;?o2`HdTQGLs?C~8E9dS%PrWcJOG^?hus$J2*B
z(-++}TC-S~&MrJ#dY79(B-)3QY2=Nltu473nf|a)5GCa^$Yh;+6k;DT^E79Q4)rdi
z+F)GiR+&{AY#h~MJ|!>*N4EYBk~DwVFJ79^dh>UB1gkbpu6gEHoqD0VN6`}u&Sl3G
zPZ6csw9yG>z?BEKg3xDPaCH%&S|57eNY3~i=BOv2q(P;|w>}ni9p1nVRqtbJrzO6f
z`@Lk)(X{(xOM21c&ajTq>}^uJT3f9yAW^!x<c;WR%u;$&kQ0dsC^Km5<aEYO2_z9s
z_lH%U>6(L4Xf$-Mmg+`+rLOzX?Zq`;x55dv5UV1#5k5LcX6dPuuE%dkXS#8;59+Jh
zyh@0C$Yic7Z-=TkS`^>fYBRfUCTeD-tireGVWwKLHO&#dcaL|fmRfp3ChB20xrM0+
z!_J&@K85JVCJ`d6iHX7G{y{g8i_AH36quu;Zv2c@Y7Ty6^K|P}*`P$nIt!KJoHB4S
zWxB<&RaP{64c5u%OP3Zt2r0L8%wKesChz{$=HF%Veyg5w&7^ZQ)>O29Us6R&|Mj5g
z$=5mM?ec{s;H^hX-CQTnO+<*Wvv2|q#)OluTxevIIR&B#dOeZSaNE<WOHrY{j@?$}
zlCx{Obv=veA7;ufyOk#^Q8T^bq{l)0yB+QA4HM>hnoFkK)Xy^F?0*gCwR#eW=H<y>
zYaFO%zlXXCj(w>8WHj}f%p0`mv)S=jX;t-}kHKm3uuKSs$r_GO{Tr{n|J|mE2B<5z
z^U(`6u4P)6TR*8Q7#=jI=AQbphjY}ms?RIhFP_|0?<>A?V0hl=W!x`+-Kbg1Z9mx5
z+JLZs6C{t8canUIDB8~Uu~t_Vv;Xztpm<wqB-AF18b*O`7iEW3DTiwe;z0=73WaiG
zV9P}nk1JpQj28?0CG1w094jmzD<`lh>Rb3g;K%pjZyUDpO<5&;t2Ub)B+drB+gA_W
z&4SJ>H&_4d{>y6LjP-+d(t{KQSO#xgOMghQzCxyA{=)NzWm&I-sN8Z@5=jA|!n{RU
zBG<0wu*iQY>%V)w80Ke|RNL<^c-xIF+d!tW^b(7YfWzg$0Gn{BjfpBX5w{XBH<O$j
zH(RIc3HIK0{!H?0vnK4t=9_MJsLIxe(u41+z{OzT?QlE}2fOeG&}Mn#6LF&x5H8m2
z)2LTD*{sek11{FDqP|6h<V?{D>4bQe9CX5+<?oXv1a<iC$g~b<ePn*1?rKN;l=n6|
zrSg1PpcuLLGP@s+6z7KM&MkgUXP3m?=Riv^YN*amU_pY73+&oRAU?EH&|Y}Jk!fWm
z<KAJFy{hW#G+vu?keR#e;EJDAwwD)k!>bLhhH|kpYkKd{-r1|^g8jTRF{CD!>8%*<
zc`s^^2`3-#?qFYdN~F3!wAb9V2liO@zWqYBN_>o)9k{9k9Ja|&SPYJag|Z4E@RP;2
z#keO%x+kQRUr@<qe4@wI?G`6yi6q|eBbl5bE<Tzr@NVvq5>)mvU?j&ypw7}Y)~!c@
zaKx+g<EwP{gKx7nOKBNDt&qI8wYys!Cd@L!d_T>K{h6@77&$ZxxMGH)cReNl=yE%l
zYXcSD5xrPrN&BxqA09c|j+y4>fMa*+)PGPVp{+BNHdRA+MM<tpfnBOvyNb6L*kjDl
zLM2^Lsa5<eLscf1{CrCqxU3N($HR!9!<GmCt)q}$z(yfAcqqST)2UtLZJ_sy;lX8P
z7$a`%!y2{dOCyE6TfavlFR>K4Qs<gNTcutowcP|2NRsolPnS;u*C}NB>T^7Q5{0A%
z;S_@BD*A8K1$|Vzc6)-imsMJ|QDokNTZxgtT1J?+n(N=cz`Me*n)jzy`U*HoLPQy3
zKn36w=z;K5k;y6+g1Oy%Q-aSZmYuL(k(d2EVm4_clU7`RBP|44P%B-=EfJ`lSc&_a
z76O$fZ%!G8&ww+&N+AX(wEJBeWJAs?W>FMn73?~Cc~EtaW8;{GL2_oY22^7XiXQtl
z@I?J8DrkXyQ(wGDa<0=-8}sf|O-gAkiXL2|)48i3Ip~h7&Kd|9)Kk57zEXD?FaGzC
zR<+i;54c?AZg7?)gPR9hOD<{9#hysF40$@MWdeYaSedLOs11xtHJ~V%;E&SN1ns)h
z)rgVKZ(GSsdwOdtK96&*tR=CFvhU0eUb@oyK>w_BQ46daW0uG6c&T-)V)p|sR$#im
zt8w0_Y~DA`>g&SEbk4p=@w7FGRq;>KiEj?PX^9fWLB^kJJ-`ymi>`AOxD=oDsI@-f
z1U;_m>Z)4|3yZq>tqi(;wNU(@Vz|PffWW*EG&e86M2{&b9Nc~z${P_FpGkPq6p>a$
zt=9LXNIBvYL+nLfRI7Gxk@*PYAX}wwB(cf(%3dP!83)I(c0}`+{Zuxep|$UaCHEus
zD_Z2g=0{6jVRYZ9pT0l_1l=^R{7?V!C-~O0TKatU^XIvZvPq+lKdnAw_zZ*R99pz^
z(6EHnj2dSnj;0omgx_ZE11smQ<@z($Zc2s>{&0zY{V;QzIP*%_+X-akBaACGd*SzB
zv&$p1R5xBfGMdm?>oZVLoIR+7T>)R7c=2n4qCQ}^{*;i6IsbtY`c2E4qren-ugUbl
zD`+$^whwsW>)`)j2}&!^<o^$4-x=1_6158|qEz*OAVN4+f(VGxArui&kS-m9NbkLb
zKtK^tK|tvpq}R}UJ0L`AkQRD}2%!fEq2=!2Ip4j%?sIQ`<=L}mW=&o1ylc(cIc{;4
zr!yfXoPz9?2W{_9zsf2=M2axpmlcUeuim?sP?@_sF&ye1hpEephJ%j)rzhJEsf?fB
zSJP50&ZQV{k3zM+=9G*6h=>vs`qQ02v7sEv7%i5R0c$?MXPJ@buEpo43RF4ekEqP$
zc$GU%u5Zz_^#tIepNujU>$e{Anj>!@3*;vqHDvWPr>&oOOHCAVZ%%fJD<Cma657o}
z#8H-y+b_>R09j}XrgO=T+TC^e`cY8mR}be4=I&d^#oKJe>X<<N9_zXLXj>qNp~%f`
z$ye$*)#li;;d5xifem>%DkXj7$$jQ1BcX?8xDNPRem!J<*15s8nY5?o%dX1@qb#An
zl+LPYc~ovw+VoF_x==?nxkl3)p<bUJ@iN>5AwS&#udfrA(smCMV?Gpp#J*)Y9EiIb
zd>GgJT?Tqi&@R3ng8(?F1m~VAx)l6xZ1%Q~CZASlv%By9nC9X*ukarv;otdPfR#V4
zDC>Loe`d-(6|$M~=VKA?u`RY7@_rIZ$9uCLbY83ZQX9Ym?}!EEp1*fu$e%8TEiKAM
z<CU#-Kb6i1zJFXyx0e8pE2~{DMPKA3T#IPVB=1MBK+wFmYa^FgZHMkOH08{Hl2C|N
z^|}QHzybg)?z?5CVZIqRzV;rmypoueW@r9Ljpkb5a#cPkJpQ(Zf`hQ>hKSu*#SAen
zl4gt$x^q3Fs>e-IAH529O?{D97Lod=lKU22?5>87a$>raklTt=*uB0tb^}`ftoY4`
z!n^vz0q0?0L%aGoBdA?>%En^)1ya^7=KbSW51!w$aZ868Lf=<mw;RAm$sxaH?jz(K
z^}D1~&2$T%j6M_tAObL>S{4TwZY0L%y=g#vC{pn9on*dYjryCpG7c^IK#O^kdMu&x
z1pK}%`&(8|-VYzdq^rPD<F#!sn;T8QXOAf;@~F$z^@TeAuKM`CY}wV&d!?E$DC6E+
zk>}DjwX88b<u_cUgeog!B4AQsLZ!LXg2DeRUx-Nl(==2Z-@_TxK}*Tk;ai7QpJQ)I
zuCPAS{<I5lb4y?Rw>7)Hzwkxr(u!79?H!N#J6jK1PEKx*1_QP?(@@;^XXa<7H_qg5
zx#oMZGen(>sJ9y#S;u}afKNM9{A7Oe{m~1Ll}l~Uf5;Z5USiKmqnprfXUmMgrp-9H
z@VeGPUb3(FGxSD-1s(eYXj5;fYxyM?wHniaVi%wk0Y%~e2>>&N;7xEBFrtlDLuGpm
z;{dG{Cq3zLu0uzEv9i$qU@w|`r^j!?v@?I(OO^NfsQ{;|WM6$jP;7_7)hOq__R>Rn
z>72i|*fgKkjlkSkpPYNe*f;xK@a7Jy7hxjlGv{?iic`TTzpLz#V&PaSW~2ahOc?5o
z6Vv-L4i`gV?>FO*E?PSmi!4`J-liMq{TVPmD+KM1?UBtqg{x9wQ2?W?`dG~WyE8zR
zxSz&&_=wfkrfc`PZUVt>eaPr&VcU>jHZN8;@oS(u?WOxS0^+V!n66tshtUqyp`GJ3
zer=0o2W_)SJT2Q0P+7~H`}iYYwK?(VH&rP9eaECTI?MKpY-2~nGB(rHuHXzC`3tCP
zhBUwbP$|f)hP&!`q2zU%S0@9-3k6mA?mK3u15!7);xv?E7vpBeV$gehi~#Elm~9sZ
znqR;_L5?ts+C5E$y4Wf0Hl;#?k$qbbrZx=a-+a|+<~My`cR@|KSjm@(U^O!U0I>)p
zl;uc?qana$F7J;3gKlFj_%`anG%qkICu>ZvNXuGsR-ecrGaCH<cHkks_~r0(dj!%E
zYr_4Z;q#-8ZR#_y<!vX96+keKQ=2~b7nsleEjBvv@!17)$)2px<bUL=6{{)CS_?nx
zeEOxtH{Pw#^IjbKzRbc%>E_5Au#)VUz{Q$n=kaErL^mxjCbKI~u5R9eUd3}1I3|pk
zT1aabny%AN1L*Zyit6KQ%EVvF<p88=&+USeNILe#1zLpOE5KJM9=QWBZaF+-zhTI*
zbuHRe0E{#pcTR#ChV2yJ2SssBGWobKad5K@sb;s}9|(&AHnDxL-t8Na?YFvWMIVSp
z<Zw9gsmPF?SX^Mev(F-wo7Fk@A?+2Ri9*Js;w=>35cBEvuv3^~avO@tYTpynvpu+f
zLo(~eXadUWJ}c%EI)m<WJ@=s&wq%WaGdIBIC$0{JjK|-Q5h*;eQWuLXV+1r}nhzi(
zwB4a~IV)_tF4r`x#xz2-{bu9xnELzBU8&>SH-VE5*+fRy0d?*JP^|3xfe^8dP>Kbv
zkWK?FUd0~8pY8Vn@+#ME(Q3f;(@~vbOI5yDBmc{z;P;diW9o_irXiXp0yNCgYpCcN
zWPuX|AR^+t|AmI<EPI$8)U^|TBwHq)s{joMTCgSe%{o4@(ar6+8s+ho9na2o3$>WJ
zOM5n|Kuo@C^O*;?6FR+(aPQx$vMyZe%4dU4TR#8U<8AmOfilt_X<Xx$sm9Y<TQRJ$
ztt-Ok;a(|djf7pTJi6D_+q21X2Nf4l?UOQiX%wmq3r3x9ar?`&Qv%pIWWIiU0Je-K
zJgCg&IePEnos(?IrPuqmFY;gOST48!x5L01GU}~SYDfg`<~{QG29@avsc(8Qp;3I@
z<rl%br*I&PzhBw5-W|s(PRXK!yj&gQ=DjkTggRv#kuRHfo>UG89QKM_6@-VJRB9ek
zs*#B@tKm8s+(Konc$E*|{xS{-sXVA`?zH{{IpGTU@l#MlMSuak`i76`4{U8uwnXR6
za)$DZBn?fTzG^8=z%t#H<zP0vi{f7`i+N}K!UZt<mQtDPUU(?)LP6snxfPOY9-FN5
zsw&6a@X6x$&Aqtmt{xSceR&o%a`@Yt+ciWth{NB^xK>B))XIXNBSQm{?90wLyr<8;
zy#n;2yw7uAV~b&@Xehp6RZ2vtUWV$b1_e0;`eQPtiu(GutXM|O#h6iiI#>+6UTZai
zw{wM#SA>;*kI7!h13Q}7fC{9b<@~QM>utxiO}Nfv3pBeInx<$foe%nU5C~ZFsyLC7
zn;b%hAAj0{zNB3M|GYb_{_FGNC{kUD#Y==NvTi@Wpat{f4czS~3(i-Q_u{<Jx-9DW
z+eVi~V~f#5qETi*{!)jp@%L$;XqwaEf^Hzf^2OKG7#@Y~3@WmeiB)XHt?SWzJ*s8#
zc!_%807p}jORVc98cL)I`7FnKgKV!~t2l4dGn<k<%(yIxq01LI%C>Cm;1NYZ=W_9K
zRneZ$zRySshmz+2C%>#%PRw;P!GLIByi7aPfAP3hLYhWRCJOagCV*oRq5IP(U(<e*
z)#bp(g6n=pzgYB_@W*xT<z<POTJM)i=1Fqsnz$~UE%yvdWC{&KDIs4GwWAD33M`M;
z?;pJJr1neIoTD;2(RX}A`i#$T7=l%Cc+G3wOwWlaHhdib%jV#)8G%@N_oVh(y{aFP
zQ-Udt=I<a&AKi2Y-F!ajdU-;10&Dm$UZ%J)pKH~;7T3IS;j*|dW%(UC;6fo@_c$|!
zV|*ib?&FI_M<DpAe3eZjlv77eo~7c!tl=vQUxx?I4mJqjs^7bb*Qe@v44j^40{XXV
zYPA)x2ISJE7<5`6?Mn)6G|j7Z!jAS~6f*B3_<<`-G_4o1YMCZVp^=qoOx_*aIP)nF
z$|Su?*7PyF=*8qgfm|y20Pl3az%p}lq4uNqz-j-_&;L`a`ZiUT9%U~smi~#tv;P<J
zOq~DYzvLMi7M=aT55qq5|KAxh?Ek@#X`bHh4;^`R*i`X)=eF2cJL8^O48Lv4x6a7F
zuJit^Os4BM3b|fhEVx4)x5;}r^zB#Ze8>Z^@+T2njvN)Yi9J@I`VNG_$V@K=##<^}
z@O>;YR^^B5W$z|m_FksV5boDYq7R;P#(fItb$zCGPA1-pt~j>bt^KL7*V2a+tvPNv
z3oR$;O4@r$1VCFyQ8hm!hT_jER+MrQl8=vZHxe>r>PQlmX9gnnNElUCyd4ciZO0)?
z3$zliCMN@+c^UZH+FvyQ<5vmAunU%J=nE|!4X7*e)WxG56;f}5DbrrPDu1<u3rV|A
zV3UqF(E0VbMd<k>huJ4u#m*pdT{6}ei?7N5+K&7E@lnCSt8c(CvNcq#Jh|-Z6V_hX
zVMHs6dLHV!!q9iG@0w$yG|>Q^VQlfl+nBAZUZV!H4}jn+0PjT;uem*j7UV}&{(7sd
zaDWq*s8LNIP$GXH0~A|UuO6W>S4(m*^k&D@A0$iR&&^7KaT#^6r;B_&W?Xp}Wz1pM
z+^TSe;_=fT!(g+pjE_-tav_yzOGC?y-uw7ggjys#SVunwylJ2@m$ez9(t}o<#9|~5
zOF=IDU*II<T~_`d5ElGFz5p;qf1jMu2moTH`}LQnrs2<K>}{1}+W>4In8ZnC_f_qN
z<P1(|CrOW)kLN*$^K%&DO4u(OsiR-kcM`ftC@$YMS=bdG5E6OAcW8G^Rhc(hKqwWF
ztTiXy@3rU3KKDfB`z6J!pnF;I7qdWfd)}Nytf}dDTWwWf{QQo@hTtb%@K10hSdO=P
z0AWl;<VnFXRo0ARL<)+~BXH>QocHq-_&ubrR<uLFi^I4Z%k~EQT{xVX%!81BYFA$A
zJ;B|fZMc65<!0W+pJ>Pk4mqt}uCIya<q_{PsOvdgs|U^@ienxaO9^qI4;c+q8WOD@
z4PnNPNZUP6h?z9>ai>oY57kFWi|&rk`VTyJiNac9-$gQL6wQ748l~{i*P$5m==aZv
zKEXYNF$AXs2xWe~WDqUlDmf9i>5dt1ihWh6@8?K&>VTNB@R35x!jM`&YXzT@v2J_M
zm-WL2i;jh({>na%|B;$vb>xGQ(q-5A8JY;H$15UBF_<!4IOo(qQgtIz6>e5wKXnsD
z2(R_(NLA7$tWo7YM8t|$$Z!a-?-+;N<t^@6YFYnBcvai)a4(r#$wH3oo>Sl9hqKY$
z9smAwjjJBH@T~bur0DxHz^DO%FQp|_9zL<jzk>JG5|H*&4!2)1joTxF;!);^i^?!7
z8gYZCRX(R9uiL(UUY1G#`C9v>BwxTJgR$2tILrBML7Tn`^da6y)Ig|aR*o>CrfoP~
z!;!tp*A5^!8^wL5CoX8Hws=9qy~G%<D&4#r6Zr>gZ863c9|l9i-EzIx>N8?Ke~J0r
z^iYStXz#Q5;8$(Lug~|t_^&^^%IonVV+Qg5f_cAlyt-F*NkZkJxRrtYov<`J?_D_n
z+ZM&4%$ktSO`eSr3l0V|{0gufmM#5npxrSypJ_+r=64LCez`PRR13Y367ts$v0}+v
zXwh(-93S9~aqPrZgFEerd8SW+b4OzGP(UZY`JTr^`rJP3|4+p61dhcJ`4i&G$;_#K
z<?g|<<lVs7(T|ZjeW5=>cS3yCWUnU64QvV_zGq!El?M3rYyB+Dw*EI2beX>vUNA?S
z4w&<O8mXnpm?g7;Oh3aEXs^XtoN95%t_^dUoR~GwgzY77iSr$KzmbZ$>uEjYdiiLh
z`g~ve<@hy93V%Pv#1cV~m#E}RT~=|X&dJxZ0O$>HLwB!T?_3h;BwV9i9$2nJNr_Xw
zO}`;4KB}a>KBBgbFcOZH5P9vCo?7x5Ro1MB^J;yjB-BCfLLRg4Cekyu=hW0Axxo?-
z5DZ-j`k@``_v1#}#e%`TKH&)h_rI8=jur33dYjk_&%wCJeAb1_iu@ML0DaxEDYg8e
zLjU4|$_4W>0vQ;*d3*ULlQ;e6MN<7OmvoRbr|h-%Q-i3iTIY+-2<)$2uf`eY@$QWB
z>%6kz)O*Po1h4>OEZm0|uXpC54tj6|A*)YLQKw-p4C2u;YURcm;ZsQuy_d%6;LYot
zfAzRpePEA_+-itSQJUOT9>wFxgBGzYwd}b$gxOIHb+(L}clWNZyt)?*<8wCFxjd>Z
zltZ{@O&U7*4IpJ1^^ZJ&+onY0@i_aHC2lbGwbO;Hv3WX*rBV5xqr*i7SHlK<ln2>*
zs$L6FnGagdL}~*t&{uZo#TS(qep&IOD^@emAK1hh3FJHk!tD6TQ;Uj!yU*4dP6q3Z
z&abz^nU#Ui>J%^F5KK?*+`Q@Xw?+LA&N(x_wW|WcPeN!P*ftE))x>(9-)JwogdNzg
zF&-`wuvX<&4j9;9i3JnJN;v0wk8x*K=<EhRI<g)I;_y>t)e4r~cvRCXrxx@wxRCmH
zZ^S~OZa}Z(Go}88msDApBQ?#)${!QQNmXwV%X^t%m9T-Dzv{)9lQc_hAi&H=a&KBq
z3Cg>$QDWmgo+d6D&LbRKr<;L`=I1Cf8&f6-1`v<3EW^?8572O};S%s#epVjv?K^?d
zybo)f!v#`=_hRAj^6Augsob1~5E)@e9|m+scxWqp4#IqDdPtg?ZbWrebL^TJJ7m9b
zd-&@by-;+n$6d9oh*}knza#QAV#TkqeS4w&;`Z|$&X?R8zuvudY8f^6x-eFX6cG2n
zRr%r^P12V3wYQ;9oRRBL<C!>IHwUKFe1U>5kE`-)QB85cKUUs^&AvLzUUA#aF*pdj
zedH@OFtF)qv2VIAbd>Z255Wm^hb5D)BI1V$4{giwL4@6IrzGMtN{X<2M;S5O%a8<Z
zoRqdqd=SH6>wZ9Q;*cy#WWGGeUJ0X{Z^@h>m%ZAOwp1u5u}2S{xPCGILp`S&g9yes
z#W#+1zX8iNM*UIKr{v~c&f9(EN0wK*+SV8Lt!IV%q%IY+tqQ7c?7iHdy9+@{M!|D3
z3Fy^JoK}prG5y=v7vr`TNt1Vo)GsOaNwB6@h*<jah3MzE-RQxI2u}LQ8N9%wS2LUp
zG@JG@fiq&({-QkyeypDxNaz@<GDAoSUYD-R!uHMBR_z_E9oD`2Cj67+B}KcWCY-7?
z{#JsbrD#AT?bQtU%QumbZDf`8?|~(D-*a8N^tiGsX@(z`+r1LPjP&1FsEaxde&;4C
zE(qK;x{uzwtiPOotaE63Aquux@c?!w@wEM<_(D{@qP3OY>AUYmg-^vU&FoQr$N6MN
zwz{(DohT8WH#o+=gcOuanR+HobvxIa&ymX40*t5cn5IC4#apSzn=oZK$*j#l=Q#xU
zgwy{7Sk+IDe#Q*=G#j1ossf#?9K|0KrfRn8@1Hg$vmg{6(lkG*JKgpkaXA@WB#i%l
zfmB){OcxV2v(&FCRZCDf-CQq!p&})CmxOZ$UEz3=)^k2et7aURuf*83%fDnTT45vF
z2aXEJhIuruoUUwTvgU5k=<j#~F^RrA%EV(t7#%%|4t)$NsG?XBZIe7|u!;N4qifQ?
z)pH)~GJ+QnA+5Foj7u-~(Pi+5>%L;j8*_Rt(#b4g#`nU}G=w*Z)E};2B&IFvcN=4j
zu-0{+Tw{d62ZnvjJZTqxli&|ejD)AQ%LO6JB}=}Rr@G_y&SeWH*2lG+aAK<Yrp^NA
zrv=XCr)~Sz6ne~xEBX`9nd!@BoCiyc)y8&@Y?#M$%(zc(HQ6&=lUYdI&&N{V@%LT-
zOD(L-$>eHPuo5~l4LeF{&X)GDZJ6kL*g(8#9~OD>nKMIbetOZod-6T^`1|g97JG5`
zkK8VU@xFZe<8M>_A43pyfp1wob<TAi5!>d{P*pjSh{F^!H+qaO$7WICYnuMka#510
zktTPbx3V-mF`LGQ7Ccxdc(T@~Q2*MbUcpS#lkWFC=TgwvX(@C?P_$kVL+B@RcD~hx
zU9V$AI(SQ0^Ry%b-v`c%p5PeW3*aJ^B=3J`opG9SSXDmxNli1GK=;1ZtHGJdpPGQT
znn_uzKi8#R)8t=PrMSu&?2e_K{ZZS6=k~HNfvcdZ21agH-0cfb4vua+4`rde=X8z8
z{@OXt==8ju%X#;k9}<nGY;P1kyy)~WW09bADq+q}2Lnphsze?6@4DLM1tSipzoV~g
zUO8mkE^dc@)7l~VH1)tVkOMv|${39Sp)@<2@-a%J(%R^d;E(zWnXmrWejlIDw>~%P
zwvmh5P}U7hqy-1hS+uG9AN{(0)cEA`L|XzKa7&9?mHCi5Dhu>2PwslBb)sphjp*iG
z82?`^4zIE_w-@KIUZ_esn$-3Qpm|md=LV+}j+*$eCM0>62h|c0N`9BBlwV7{kW%Bj
ziLmMwmd@l8Ch?zSS=YcE5{~;r@e#^x!+gum#g$&u1I`Nq*v?uMuk=UDPQ;*cvXZOQ
ztJZzR#wVN!lwog~5?JE5sc%tuJ<>91{>s$72zeImn-X$sLGtL;=)JU8at$xF(IG+T
zjyAK@hG4Uw`#kieVd4C(!&e-CZR?L$p>YDzv+gg;Ke&MoOh%!<`5K>7-s`sljbqn-
zN&_(xn~iwBGO!_Pl-c&hc#bJ-54ZFac11X{Q#`+@!ryI(dkh9!QiKs?&8`*q<y@eU
zjN7E$C-w;O`D80$v~<lk1?nzF1+0m7w_5%fz%IC@T6bGw<x#dTv0;W5sm?(6m{iS3
z8XCnpd(Gm?evT6xmdbq(VGS<z=ar?^vf&%jorpK6VUt15Nqi8e!-~{`U8>s=Z1j|8
z08D&W-<MJ#j487@kWEg7*NJ%^vZQz&tItg$B7k!UyD{_rCeve@2@}1C?r&l|^;g)`
zf_j_qt<JH$sr2Zl_+6_Np_ILvn5AX?L%MB-PD{L2y3u_FZ==4au&k|tZK^1l3^_lU
zhjO(z?@JSNOC?)vMZ0ayyRo_1oORY-qTpjSN1R5JU2TkYIOhSNjweA{qP=yOGn`KT
z(Ps`5X<Z!J<8%m<cA`CZbX+1Km}ZyQ{CIs%lrO1#mnHfj_Pbj#Dm%jI#yE>67&5bu
z$sf4eeD3UEE&5eZrf`3>d9}o^$wjA5b%kG+B^@pk&#>79j?(&FZKIo7d<s-Z(Q>t7
z&tfu*rXG8#^E}GvXzeexjR*KvDXqClprnm58$8^$Y(bz(FBdrDIOx({z;aY`T5@_b
ztjLaOr%F+pr!pD=FBVULqu__JU1OBkZFpg`&s=~a;0x2Tml(Kz3zJv#TNzSqnsl%q
zAqG}Dyb$GliO_)BqXARaIIL_o87)Q3h#<oEp7f0SUVpX5NI@a;9dQT55}Ai}vD06F
zXv8c*e<3zq>@IuozE%S{e<`M|Y)*F%Ke*P`(L}j4P;{;(C4Y^eY9MAdtWLRPf&|Do
zr+|UKOE;o*8Tk|KrVBBYGq(i^YjI}i;iDlFGjTJU=`EAAOeVE#EGrl1?ST}=ZYQxJ
zI8#+yx7@j|il*{jjJFO&J;Fgq%tBX?E;e18Q%h-1(Boud!aU+wC8eT4`{+VcM(^f`
zb=zi*`c6GWP*TLER$766U0^E7vu5EGWN}2VzkyXpW6ao!FQNj1_Twun<iI|R^lc_4
zPberPBUVLzb(g?L^|+HHY{x9Wu9xHF^arU=<UJ;HPt&SwL<#v@b7_t;dQYU8`?FWD
z+9&02N4K#(QWhr7{kE7Z3tEqc_D1td{A9%J4<OYKj-^)rQmZ<dPGv?=$2?d3aT3eB
zN#9p)YweAEWK$EPw+|PE;%m}R3;OLHR<n<!L4I*Qj<MHgZdNoj>rypp1AfVl0Zz5w
z%%x2HDotm$E$VAj*`didgSw+1E6o!NTB-B&+L|&7`|!QaLG+xz6SY?gfoVQy;^DyK
zbFTh}wSYxns%-VWG{c|*+KS9~sw?4=YdPciN=4%Z*3in6Uxl_ZVsttr3fT3kfPTFl
zcrDY@Wz<hUkq+sHDl{0ECZae5`#|Ek{^o89hy65i(N#f31jWlykY|q_+v}Lw4k+Y}
zNyNsa!=AmYv$wuLK6AHJeopVRX8=!}sxisMJmFtbe+_TYwtk^a?Pxu#9qbm;&l~y>
z5~C8JVU7)jaOxx?2Ol}<)}R&|A9sdDZbU+rK;!h0w(&xfGgw}1UvHZ^|E#ZZte(}z
zmv}~6bTe`!-GCAJJ}iYl{MOSov5{Rv?icJ9==SLafv6Yo+kEA&nQhvpn`<?`O}QAp
z92)R~P`iInn^rpMwir>$2udoZG@pP(?1!>Df(*=zF>im~XloVp3UxK$FGD773|r43
zl#q_E4^AbYv+4>B;ci!uZlw<)aBB%<zSblEsjHO>D4{K#HSEXVw^IYktQlsm@X5uN
zJGnbdHQ^^y9;X$)hk2^HBiA2nL*qBRd<RX#%HZF5(_X<v!X&2etoYs>PWPr`(lMzQ
zS<tKU9lztO4aWDgSMl9kjbq4?nlS91eIb2bTcSx}o^T9H@6C1~^M+~Rtj}K4hsQqs
z%nI$;%BpywGT16+og25Gz|M8#mR!9NMY+_3$}Xgtpfoe+lxxfe!K_tL4<>Seig5#i
zC@Ta>ThC~oy#PB#c*Y*o_%kdOoj9g_kr(sLM*prQs4jR_tIfBGrv*aW+o-`)Ezxow
zCw$5$y1e_8f+Fb!o%TRUF-<I`*$TZ89lz;8nWM~@pj{=dWL1+YYHtrUi=E_kVHyS@
zhl@cUGMv0*#&#+51-Z-`HgOaJ`x~K+R126$r!l#5LBskyYIEybb;X>y`Mm@ikTwIO
zmyriOr!?a^MgMv}<B!EfJ>nounadO{(EI6P{V(A{&jpwi+hPHXt8qzemDsW0@Bg?M
zkrd<BzNlrjA^Th!s8&lH{nq;Tj;I^XeN>ow$qWVgHr<TvB*-6=!1bQkbV;ryJ5(h*
z?!4A`AO1Wv)+po|FAesJ+PO*IoJ-&W<r|Z&I40n5H2HSr(HJ<$ZRK;v@N(^_rX6&&
zNmZuScKb^{_9o7XsjDrBE6{Z<f!g`^zGwm&RC-d4WR=w0%8Xra(W1vH>tq`T7Tkg-
z1wRJ95bM_C+*TO|_d&i+hpFcoK~(D-_^=$!syT4P<~b)kC~8&(Xs46HB7P}an=?$-
zl#Xv;Ye|?YN^A5amXr;Oiu~J9Ec(G3W<qFMp?fjq=7;WxM}GG87o&&~IM!X|GS}>&
zPN}Rp61EeOmGZ575zcdRdgFsj_>Zd1=#YL%s()^~ZLSaO)@6pH+st*1?_r_l7;xH!
z8iW1I8$q4$?0=RmPaoQ;R(?~_`9^Yxw?}v;JDy70j5%nGI$j%xTQZ0=SI>V8nhV1v
zeORZ$-T#L(my*Ka)!IEhLeS@TW@~!FKc|PX@LTfL+-aeXG5E(1lT4ShnuWDS`P0|~
z*QpX?0+G}b8^{4uYcOkDmH8;7L3)bIxJcZ{-RD>TMc5R7neRo8W}S;;rF|k3ymDfa
zlUVmomVG@lV^zk3X{y;}j>pkIAHz9?ZHY#YF0F^OS2pTAT-PCmb>~>!sIoIi(DY^P
zqU|LbT?Dktd}1$tQQ45KFB9@mX|CIz23&tdZF&+?h0gz-(c2gw47Z%Kxr7k{Zm-Af
zw3}-ux(XF-_+C$7f#r)&8nm@mJ`_fA>>opK*h_`-mV3kpZ@A`ccpGKU**t>%+B#X0
z<7k<3`E7{W4u@kq(We8O?{`neB@Iuv4<w_oA5xeRo1r2T4?P=Ll+gnG>|7*Y5b1BR
zpQ{yg)wUpI3V-V7Nt*mYR|8rTYX&~gtR%K-$cSwcEp%mGCTh~xvwgsE4hTuk2d5s2
zW=M?hQ%r`+o$rzlCOBJ%lLqGPv!=h4#}I5*hzpzjZhfm7=q?SJ8v%XR=_>dVh#d!o
zzpdN!PS6u0-r6D8LO_Y~JPMB#@dt2#e_||OzVL+lK<&rG)|P>z8n>eX&ZYcTc&%PH
zyiazHJ(6RSS|^Z@QtG+%AnBCRhk{}^qN!HG7WSm(!P<mik_3lCdEc}ffDI@dRHUNn
zihdBxwX7J~@#}-ccz!m;CRMg14;WI^78ah+#Mz5Y>k0M~;T=Cu(IWJ@fL*vzEHP-E
znOW1B>c<1PPZYarQbVb|xXPvV0_o*^v!f=*pY&6d6d*H!QG*XV=K`#6+}&&(KNX#1
z0_|UxJvtSDWA-iS(U_xDmetZN&{beBq)^%H2T;qnw;HGb>I*l7u8Bf9nnwIYk-@%5
z4|cNIk3#et4p`Uyj)y6Hd#g9!7ke98iZA{8!F$GK=eTlEnu}vhtrb(e#nbAr^EC>M
zJFb}pUg5MTw9a-IR?<=Q^tK>!3vguwFlVRxg{T$S>SM-OSN#!E@i$ccNP%0J`6zTv
zASi<PRMf<EL*8XteaEYAwy)*C8jL8-Id-G3XXuF}`K9`ofx;Reu-7B(prX^cCP!7%
zDddt{u4>K2|6PnW3~B3?Ql^CZIOuxu@jY`b<=*qyi&&FIdkZCJFmRyD78pgsW5aZ$
zrKX1RHr~~a+KIT>0{N@A+Y(cN+ni*rtAy>Xqjz5!95lc7p@96zDQ7C%zs$P0_&!T@
z?#9`ZJM#~cwQ8D%9}(hr{V=5$$WAvDPSnGZ!>9;5#QTNt*5S@IswgzDF9Hc$Ee3(z
z5rwCuQn-4|xq8iuQSK+GL=<kTG6h>&@!6`9+dhb+S_!!qM``YRYF(3*<HA-~WT+q5
zt);p^Q`iQ=uo5^A_sMn4My+lYGoY@k#x5<BBJY5jX)rg{M&^vzYO?>a^)|vU)>d6{
zC>^sHE9FDcfT<I44~&!wRr99XGW)U~Py9l(*&TIN1Fpvu6gf<7g)7-VO3E@BkmK4(
zVLTcDg20hdgS%yTr$p$1yuR2(WKOy<f1ltRgL|aDwqbw%eW}84sBB)$#PzjkcAm7P
z`{DfGsw7m4SH7#wXlVzJh6wr|7iOI-)31|BO$r5_U{z~$t*jMec7DGUyI7FDK#%Qe
zJ4>sFj2L4*T(YY3e3xDgohbF#_Mj8rKCAsIhZy~ow_bL_(-uB=#=yGh)_LbL)$!-{
zuAfHMou-{2<%R3$_ixDV`~J390_rQcpme2*Axp2*jb&~;#j9;dG8Le8f-M#@8A8G^
zUqJ=jtf3HjolaA03Nf28Y=c7L{<`xRu&5iklp0?u%-L9t50yV=6RyzI56*HtoA1SP
z9Nz6RJnMlhaBTGT?z~p(b6wWmu)1BtSK(Ugxf9~H0okBn>&*cvSC@TyFq&=LEoImq
z6G2c%x$@H@QFh^HmmFGT=jTNWT3xed%d`UrF95gS%h0!Z%Q^PCs$asD`fiTT6=wO4
z@6sP8ET{Fb6uiWKpA<Sql!`gzMS1J>y_a_;_g{^L^MQ-?3pYCK&aDwGQ3L=LG7q9C
z&4-<o7Z$h8e~ZMLK{w@CIzPGd^rCMVCpx$7xpNmV*pqKrP;jXSZpe=0nlyg{6n^&K
zjx+u)6)0hW&`?+9<q+z<s{u2`u438mOe5W*@#bJOOMH{CWg^luT4UmM6NFrVXk|7O
zmi4W#S2u9q|8bD3$PG2&UKZH22EnZ~Nu17ZRd!r{P;u;@mQ~96^4{-GjYl9J$L6kT
zvIi7JP81*AVAX+=xPrN1S{6<3oPqabA{}rO)y(+Ave-SmuwKw<$U@X=84tMOQm?Ca
z*i%=>ez$iSAx{%4_oms`b6uAV$Ruu!d($p_X0L(YZ%Whegor%-;<shoyr0K-9FO6}
zxDy8%rT2czAz_3z#>V|l<k5hm_hPO7s>)9|t*|xCW79{%eO0L+0Qon+c;)-M=#6qU
zE@$^YGJ2R}&5Y*@>J&)0-hJc4I<$~j>p>Ny%oB>1gC9sTED-_l094<yUI9g>;*T+s
z#4^?wRnaWRvznX*0g6Q)xc2FHMnROQ79M(*g)7U4qV8KF3_8J~Iq8PXRdVGv_=7y)
zuw^-S*N!pRAu*$jrdMv_C;>P=j3+s+!md_fzdj6Xyk$o?NOG*o6GmAjU>_S3C49g1
zeXG)|s4)Jw_00E?h@Iwx&lujBv3p6cx?@SRnxw6p&D)<yy0p`ZTEAJIWlf;oAQ|ch
zK<};7SlYT9Fte~K`%5{rU{pFxs@F)aD%Qj^VvJ}2Hl)9eFSDy{l9iL#q!Ct-=&PsG
zfd`Sb5rzMR`EkCnpZd(3$D7J}jI@|<)hf&>moqFN`=2Is#unTubg0AK(GAWX$37D#
zE=hV->t-leFr?VFj_6%M^fPJ>2@;R~0S)QCQ%QKE89wT|bK7t~GileScfRt+{<M&!
zU)h*&iYwbVJbd38xOYe4KPV=c#H8V(pfy*<GWXgQctkPjZyFf+RB<ECtq=8%{ONjN
z0iYPT0;47=o#VX4F$>Si$qx<7HOa3z)cR1~kgF#jCW<HW+FsteSFLL(lf!VIr<eT9
zskfL1sNhUZ85B$W_m?pFT9iAJJhS|%4O5+Vco0^#r#Ged-tF;BAI$BAH=9->29Kl>
zNS`%Lzmn5g1?iJD3=+}Z+*qyLSQJ6tc__fEY$~TksVBXA(uf^XobS+_IfsSEWuCw@
zHL&IX`<jXh;sAm}`C%h<o}$pFzc`DfPgiE3q<YmR%f{oMXuIgc?YgL;Tb5I_nlH`_
ztc)dmbBo5up9oX9lenO7?i55#)ds5*2<f)lgXXOiq_N+@U*QgcQG04z;s=w=8mCx(
zUlfa1)+{(kHFhkUPKdnfoHFVdaK+efp{o(wbJbEv*GKWOoba{uJxi&hJj-w$wECFG
z20v^m5{LDfFfG{Xb>xJ#&%PNRG;idNKI?FYR~V<AX5!q;=<1%=3(*_hK=@;W6v#A+
z)T}C!a+DsNs?P{L92NJOXuO@d$d}*RyQ^&{?s!t;Pwtr-Jzs6ysiWVnGEVjMbahOo
z6qN64C8Nj47%sK*Nkk~+$hCQ4n^lE|ySAXOt@pz_5qBt%&ELbfwG$2j`z`8V9DPV*
z<?r4?B#*u_`p!WAF`GKtInU|4pdH?WBK6KZOd;Tnw~HmoQ-`Ifwf92czeQO1wso?q
zA!go|Ah5yc>i6y9xrI6#h~qYC7o?84^*>2KhyP%1bnTw;B_3j?kKXfOkH2sFedh*B
z@({U<rrRzOHf9tK?`?b1h+D;aRL(sb!@ey?XPQs=Y)9MR_k7BYr6#?O-NYs&n{6-c
zz9~Pk(<FJPS_j**+EpdqGjD+Ta2kcPOh_~2q*PbTJhBcM?Hh~{?<>PpjoV4DI8A5E
zyWAi12*^~yju8{a@A)<k3g>xDlAXR<0^X!LJ-!$v;N){+y0Etz*}a#J*d+P-oWv0P
z_8OfYGlE4z=GSPzfl>9tvKVjt=3T>!+SYmSu`jeo46Wvj4H|kuQ?57p*!n~!qXxG5
zpNi!Ie)s(JbBY!c#TkxoMzCHi^b>|=D7*S%EiiS-Hc`(bC4>RnYn(H1^4O-fFWcY!
zSJ{bPTP0a@Fn$L5QZg-cX*fJ|gZ}8Wf0Nfc@SEy!p9qqLbclxBe6>tzUIh+|*m)%2
zl;8G)Rd_f&*&Y-^IRG=6DKFtTZJ%~uL4??)K7jM3)K|>hCi+2B%hzgPaW~-jB~))4
z(%GYLbWi|dO!umuHE`Wucpsbuh`TRokCPSa1@;u~?lnW0YS(T8MsH$W-0@Ici(?~J
zZ<K+PC9vwHajI4gTM}Qu*^C1j27icDrZk5lW{nvz(!2YsP-1P)=}sf;-pt`UWTVdX
z@ic$)wHLr{j`kf}@NIp0%e-Fj?|iwe2XHC+QVr`XA~VjDf|CWU9=gKa`x3P4knMr~
zvb+?S@5M2EMk}JgNoZCH{xQYV4qeWHGPu5)TJ>^RBRC`mAHClTf4+>aPOe_5l~gO#
zUyWp>SCtz%PO+l>O5ReBrqbukF#eBukv`qnHM+Y>luIl<GnJ~q_G1@wQ6<Zy)_Swi
zEzUEEQ6M$rks?+EfL4HsD5QAZheaYR@uGiyYmqFNIu4ue8@KytH!;{HbwMi~l2-T>
zZ<uDy*e|(eB+}qv)Hks^Dc?=pImr(6&=Z;DAN)HF*xmf82L)O?aWr7k55|V02q%pf
zdLu)F0{Ktje-C@v22N2f5kc5QrZ9<BUDW8&&i6T=0;dC;kt22_O|R@6pFL*!`h`t#
z$3fSX6OBVDHo+mTDMuZnGn~7XCaNt8GooB_WncvMW}Ws~t6y6_%;Rm%qTz2QzCY3`
z^JROZ?3sjIJ@6TJ+0f7vtdM2<Jv_Iv*dn~{-C%@a7d{$68C4nTXv)A!QLx0631-2d
zphLIIoM$R`>u)g&a{1<>P#NybhN$8$LybU}*`bQJ`)^$fcWWO=Sj<qkVDQQX;nmTv
zr(6Y%-R>LrWQ8}OZ0nb0!N{6MIvt&bCLHCG{2Bai378w5TjZbzRu6hqB&|nhYvT#>
z?L<<n{gDtPRZ19A0(m~Sx;miT7GDo?)E9*gZztfH8}KFv%5wQ~qmZ@6^#*11%9%$A
z`!W+y6a!Gy5p`6l=WN-EHf{a+E~Ajb*Bq&;SQAO<w-cGPJ3Zk}4cUQj#*4*_3@!Q>
z_Qr<$>Va`G)K9&ih39)p5CgLyG=Qbn;=B49D31}$xf|gE;4>Yk*!_xbod_up8NCqK
zH^utJm547&5D1DFFjOt>EGT<}kn0Jadk>O=ar9tIlV%`Ge?m~Tt#lDE<7TDYx}0{T
zE`d20$)!Es|JV&z8<C3`>@VcA91{lU8Ot$e{FR66ziyoWp{~Tyw#+JUur?6z7&6^3
z=hfYc*Xl-C8!(i4q?oV!OlKr}CRZy-h;S#1By;WFwquM>{je?{6N7krCiwEu+@kL_
zHL2WNOHGvKQb4Fu@%4Kms$q?jYd0tMnE>nC{p^rmKfH_Bip$+Nv}(i|mr6|G%cw+m
zQK)#hnO*Ftuyu)kaBE}<hkjoqQU@{)!@v^9VSwCzzHg@n^UhuWhn=iXok+D|K&xoL
zoIl8|Dq~1eEbz){+|G9rqM)4<q%^l5)yQGpiVk8)4c=#NJ}RDXL~k#r!?LzRI51Bp
z&zg~!OrQtb?h&-C&GAdiVg+90CY&tSwRRpoO!Mh~+Eu48{ZJ5{$QpbNmExa;#m)V~
z_X_N!1Zio^yVi%Xq;hU-`$$@z9K)0v6;T|H#Y=DTn+N_L9D?kQ{bguD7;pa5ledoj
z)^py^Arof}sim2K@G5yEixk_XH1i2GND>Cg_p>+7V{WKS2UBJZH_i#J%9Jq;WViL^
zB#<G%Mh%XEYjY5Ymv$MY8Mxf;W3$q~oxThJ7=MYi`+%sTX-pce+nM-)kz3{*iX&~)
zgJQziKUqr>X}C7=XIXz$yyz>I4+RSJub;i&)=B;MS+*a6@vGC{+&4SxM3!{PFsg;a
zV{mTq{53TiZZcf@+w*2?XPwU&Zo2WbPvmqvk}8U{m0W!r$V`S%GHwQ~ow}z3Gk(LJ
z=eqb2OEb;9lv#h^&|y#{=_I__^F#!(dLF0Ku-!)J`rkO}2dZf)*3TCB%)-1cHRIlC
zw()7X0xj5Y*WS1mvEkWhz4^%bpbUi>o`Dg(_rs;UkVz*4jz#>_C#CSLQ$L@E>FjCk
zKNv~Ejh+ivvOVlbti~}Sb_a1yfSjBLq%$a{bKH-RU7|H6h2WYGBl&IVcmVU6c$Ck!
zs$bh744*o~6UFXJs2>>=X>e>jXyNiU_H0ybbo8aW1>A!KE~VFfh;+}@r4Ch=0+3ph
zh7^8GmAU$4H0N{{itd)f<`lxU5o3&v&L_qQ(u@HqFBoX>d&~)v@bqWhP+PUBnA?H-
z)XlQa94Y)S9*mLnNTyWGpZ*aBir!P(5Puyib)?`|bK0UXQ*$~@@asMVFq$K_AD8Mq
zFONe>AK%e=U+?|m;MT1rIY#M9P{Xbp{^>|tIUW@0PN8S4<f~j?48-AsTb=w2ZgM=C
zQ<e12QZNrrpLyCfk>g$0BWzxSk|MVy^9%(>g`Q4v&A9S=;p&`}p{p&$45Arw%Q-#{
z%|s4(thZEW?gsrK?I!WC5n0b5IOty`Rh1IuslxHNSR`xQG!>US)1Lh*+^xr}q5Lm<
zz;Hz&nOheW8Oe!2Yoj~)Aoo3^mlP1ov(PBx14uJsC%RIHbovB6f{$=|OwXNhILZO{
zqv3W8e_2B}`#cb<*mxJolg2J-q}^E?qaf}eIo<xLii}x7&j8Gb_!Ztv%%ogG`W?_W
zwsn#rDi<RcZl`m`IQe1P@rm@o=wY+>uyjcs;UojNVo~hxQYNOrrV$qIMYhlZd!Ohb
zFn)O~-(hG4J{92~NAsUZ>4b(zbZwAR8DH~3%9ysO0lKyp@FJwN6#oGy*7I-H`-eyD
z?B^TDCNh9y6J2{ENvWK3HGhip0w%RUn$O;y3^E)m3WTnvm36-ra1ZYmA1z=R?$p^s
z%qX009MW$d<U{wwmcEO^h)wNpc#^&pcwith^}D%+)p^yuEYycTxuz=+cp#p1Dsx9*
z)X5JMj51yzOz!BrNZT4Qzr^>1Bz`IMA48ue#T3=^U31w`Y@$mjG)!xBLr6@y2?X-8
zqa;sICwAjQ<#0&?mGr?7YX34AS5m})n?5)#cTW`mSfEo|tTe9ln9xbu`e)BTdaDv=
z4Bw>nri#jeGI8+>SRJo$<rHCzsFB-s_$$JMADce-MqF_>h;m81VX@TQYwpf@PdBc;
zr@R7>cq+#p!w?!?h=g@xz@9OsHt!R)BIRDw@W8I#PSj5a?<CeBVYixqF*W|T=Tk^q
zktDm+cB{8CH@X>*yXP8PHsqSCbqVUh-<pY}<AcLrGsigeMK^$l!09sO01P+fy6SO3
z=V3CZlrdpXqS><)aXfR}3*1&6w4LEeYhcl6TA1XRddZxiGX)A-k8pyHl5X1t+h_Tg
z0j3iZp9WxaeYoH%kW^^gJQ}joFK>U59^(WGE7uJ>LxrM~2SS^t9l)tVLnc1h1Av7#
zCx@sG!m@2)w}JF-^=2<pH&#5V0It}ybYk4d+yi(n;pClDTzlutKx)fbO&fJTaK%ax
zGYAy!J5?HMr8y>XCYAkK-^Sgb_b}Dgn%q}(x0Ga|bQAMewt-rtQ<PE*&;oY33Tq}~
zm<kh;vuNL2v2E56ryEUG%x6PbQUn@rbQG=SNqZR0Nt8Y<A5kj?OrZRq@tnR#d%=-_
zvxmlt>l8J0)SgciKLX#+(WJTdGLG7!6l2P9r6YaX8m>KOv*l?e1Jm}BGJ0c~IyYLn
z5z^{v9p39(M0ogTIBuNrAobmpOW5Oe&*>MUFzRz%?gt~)s*`gPSr8^oYjAu}v^w4O
z*gzD(Uljz2Z`@qfO7~^xbz|uBZTok&#RWt08^N14GDH|ZNk`<m%Je7yoqOSZQ$QK6
z%G!yjx5#!@sSc9?YdDk%M7G|SIp(s!gGV6us3nRU1%I4;PiNN<`P1%oRq5lQ3{QbH
z@`-Eyd0S`wRW+$9r(jQwYE8C*rFUi^-5|A;=4}9^6K_k`ca>#9VPcsMXYF}2acgc-
znJP-865N+e3&uTVan5y33K7_sd=)H@BC_FTku*ys8$ecjN>k03Z6h|Wp&I`?vk{O*
z-uWVbBhhK6??M#6kJ&8WOdd_FT)NyS!<`JliqJXZrkb9-^IcMM`wQ#|-Tl7i>%P~!
zubvUN!L_z>4blV&P%|?C({9W+x&?b)m+P#tQknKxDcKYyEecL74^f(9v>H$lLVWNE
z%l~9l3R(0y<(YQ3Z6&vsJe{ZY>e622RlgNyG}ny7+)GQUSR2fAl!1W`sltXq*q^xj
zWZ+J*kMFllJ+1=`E~lS3y$D5sV*mMI`iZBPWhvH7GeXxOa9Q5m1~~GJXOv1k=jcmj
z-nSm$l6=L2TKP+j-=LVsEjRIO5sac^5rcQojq8+4sXlv-lb_|CHw<NnMd7bEw)%Fo
zkV+87!IV#yfk23rE^ko3yvK1!tCTX}fnb^5@Vl395JLFtPbb`LUY?rqGC1EwTK|Qt
z6AGE1%<~`E+VFk-lKaMeG^3|vD!+>0&oJo+Yvlz{qafRGadxCxKVA|x^_*)Q1T@J@
zO_DUnMH;iG0~?d}kqyyvi@c0r9qmnWNS#@gykPI<S?bioQTsDkaIWjLk!wcSLxFr2
zb;5=k@8S5bsZDQ_=U+-~BpIyKlph8~o$E4SQfpfLRV%>?Jo1-7s=nY(Yq&?5<#a|5
zAHBpxXvn~5&neE`1=1-98GN^vbdsfA2K;xlNb}A0m6S`>q%LeKpkH!SAr+^l{Jzgb
z&kXMYMM^J-^wK0DE?RJ^2#IKLQ|%Pc_XIP_r4YZvn;#;{<*7|DYaq_xl9C@uO99wG
z(x>1>Z<C{bc{bY`og{nC@Ra-Q{$ts_OTP)<-=6CRN&jXy-aYX{x~g^+L%56&GG-?3
zB_-89A-BlujoZpgBD3^v-=6VFXKYdPN-Sv&O1XrFY#;A+lZY4(+TUzl2STbvSjWTW
zkpe$byt_^}=|~e-ZhTk-f43xs_35i__C0Aw`m7(?PH$oMX}~zOGEmoPtl#{-sUUYh
z+yvLg3$o-OQD1FBF<h%@Yp>Z0X=(lt;FLCxqmj_&IS%8>(+%U~qUQC~V>FJmZAr?3
zzgu)|#wk<pnH9q2_b=a@XzlV1=+c$iWNvnIJn($z?nKl<?C?+GnDwbk_O{mRhTfTN
z-dbyYc~+H~`wL=!n`%-0#c2B_+GZ?<F@@S?YXCKZbtL`N{&|px_HjFT7vAK2Qm{#i
z*$ap4tC@y(oB<*Qsa;<jqu>0mJxkJW#_BM2LT-aQ9!hg|h5qjkq+N-bZ7d@_ck^Pj
zYH_OThyG%QYZ+*teNDnSloT!I$Ig~PYBdzGXj%2XtCNwG`bVOgFASHtaVM)O;i%t`
zcz`W~Kil|AB|D3OJENUi>eg8-1^)?~nTQ=SRh4nU)A*o~WM-@DF-5!64_KeBgHBF4
zeO{eS6pCs+;5{-Ql@aK<_f~L|__LkNUBxcmx@8VAHix`A9;0$a5SIR}dc7_v3YY<^
z>_ROC=eu;IAM5+=5OmN%pZD0m?VS@N(|ntf1hXmIG6oUN)MG|YL;lmf)W6Q6PqY}7
z@MIoG0{nNz!_Se_QSLtvd_(@xR_z)>NuNxhW4sZa;tiq3m;&F}hRr*Eo+rx$#2L|b
z?$7j}WLCblRC>MLng(nNBeP7T({!SCcvtZ%fG!^q&xocskFWpx@~y0homzhQ@m&)r
zNG&@Hba)c789&A2Zly;k@!4Fp#BdUSByL2DhZbVveC9oyh>BpC>Ax$Ff*}@Y<|98$
z=efoz|FYLmVhq}v?zW?38q=SaY!3mFu(a1Yp8t1gCdqI#Tm}c8Eh{He6;_RDqQAzU
z9>&Z*yS0=I9Jv1^eo?uiF+KKQqR8w|Ad&9B#DFj$XYGH9)h%D2c1bX+{h2Sb*TtT`
zfLZ>x8B9K<4vO*w4mW=!;`NYu0mJ<#&Lkx~D5_fgzeJ8Qg%>c}|4EdE$aNXq_^((7
z+*OU~y8r4VybHUvR0QyJf28GHxuS8(HAC!(yck8=%>$S!@|xIcS-qlx=)HM54xFS|
zNV_6yG+a7!_Z)A+)5*!Rh{`*e<h9)B`eKYLt+1_AdVfG+ysgs_arBdxtRW}}^$ZYh
z91)C5+nMlN!V?(4ejA^#NaIs<v&YHgruX1RO5~p@=jFevJ5`^OxD#Sb9N$azI}s@)
zb*Y{P!k5}vj6L|%3bE10zp8zg%Ck1OiLIO`(|qZfXWJ(Q$O`hb>o4X%^FgxTfiLq<
zUs256fBNsRMbtD!{5wocNmBo%^Qy3D{ONOlhA__m{({2(=P868^xxC-LzD|jAcI{7
zF5{gr{8p>NMYb#C28vE9fgrd^+notevdts%li8Zp=_vODT|$^or)hWh^tW){RwYpK
z41A;A5o7~Cdu5kyj;v7rKYtrKkvZLKD;f}gjMSvzQI9=2zl^b^YHUbhQt*b!L}m%;
zA@>4gRZua^U1!MMD46<5Cg4}uw7*Us3>jkqU0a@ztyfp{9^*<#4|Zuc@|_6h_$jl_
zl(0YK$D1OCTLqb~+J?7W^hf<hO8ksgr{lZLNG2$8Em;{@>|{HJY<ToHxP8%9xh;=c
zH5OJwm$p2HFK0MH`J%-~@@RsopaH!CL6H5tYL2~8L=;D}l8hM5QLnn#?^@p(+m{o*
z{iRYFcbdp#I)!A52UV0hn}&Ah0=Wd&B+o)k=6%|RRg>QZPVQbX%}3(nL)=rAwY4Ma
zN>hAg>s;w#Y3xBej}GPM*tG^?hAk3{8y`;;XW59VHm<)ZHy(#7W28ri?m-k9H$^Xz
z%|#TWngFr6emQ>sJDESas2>^Tp8u58!jnwvTAPQyZAbmS)_jy<r?1>puu_X{G0PZh
zGXDtX!_3EW`jWGN2GdA4A-7O}A<DNnt84t8L%G!$7yT{FnES)`|Mr?Yz}JMdR%Q7=
zW++vGU+<XqHUezCv(Z6mA#0KgY78$d>Gu@n+Vj&@EIXxOjGcn7lDM#}=2&ng+&gSI
zd&4LwPnEGI25>E~hS1+uk{e~|EWJ3ldizW(^(z71-WMIL9e?l@cwriehdmj(frxhi
z9~q00;CKtd2C!FGyv)n_?V{j2=>J$sTO0)#&&~}lB<)!t&s_BdhC)Mb(|Z_p|DhNu
zN^+zqm-MU{z=OAXvcy;>mfd@_$l{I^&@2uANNjDtQgyyb4@_XPx6Ki3Nn|cI8Bjy|
zsGxUCf2ANTV{N&U>)lj)#2x&u|8XT)%Ttxn(_gc|ut#Z?&6JrY=lAn(J)ruoe2-~$
z`n4jZxhA?pl-i7YXhN$44ket)WKU_{Dfr*;0FDxZp|#x)rrY|Zo{8!No}BAi%9gUf
zr^xbE&o1R=@VZQ;s!Tlpw@7H)SeUrhe`TCOZi?dnRo&IcGr9kL<&NJ^=$uj>vX#ye
zDNB-uP2%(`Nt`5P9@ntL7-P(+ou7k>GY@$vX5$Ejglt$NnJi@TbT;O(VX@7_!5ldq
z_qEmQb^mw2?%$vH_17Lh-|PB(zu(W}`+Z%`JW|x&ZgxU2Xd?rzE&?rFPyU<|can&R
zW$N_Smeg?cKEM|}D_VIiOLU2~%cQ}?s-o(w<nQ9Mv)h95u2C#ViW(@n>dueIq9n}D
zhkV1(?sLpI7ydLf-Wg*M63-eqV&&Wdxv2W}<Oz1oRjSnhQCz;byuIzbQh!7*HC<EU
zqcppr|J97nl@8b@?tFf}Nk0(Yx8QkBTl@Ya!wldF0Sz^Et!VGZ1~Z38g1_zFfeL$x
zY8qWNOQ}p#t|3l_j>J&Y060>+%>IX!vCXl3x%~G|>ZKn{#?bt{ylZc7gx-8Zbcc3U
z13Io9Uw!_RvVS3~M$dLnz5_)pzRd0?Tw5aiu8GzmP!X}CmQ`Ui)U;lzmrci}!5}zQ
zm?B;*Rp{VYF(pV!q#}U(QGeYb0yTb5?`jNmcxW|}x6mJR*Io4<8w~7|#^L9yzJ)^U
z8J%aZY)?{NfqjcMG<|;QX){ZNND0lx`git1h{xv)B(){KYELg<H`bV2ABm<fxww9;
z>0k=afAR~$An~c@E?`HKIoYp+1h4OrX_Ydl$DyQsht9nM*n|J+ao8R16XcTLMdlbc
z3fAV$-|NdIj79tlFofh;32Al6KoF0kFgQ)o3^dKt#93YzZ2MfUCNS{yw)*~(maFXa
zmC?j+ssB8lS|CS%khYxnGl(DQx&1pt-@1ZjOu4+aL?HP(&u>kcHtz^4Fp8v+qP`*T
zBQFw76E_Yv=!eGr#zRfYbeq=|VZMd}0eqWT-9B70wVpWxQxfk3s70K&8Q!$xKCYsK
z)jwITjZNG2%Ls~Kg~g^1#T>Li^n|&6xa~eruB{<8UwmKV>>v@YsCLmsv(>Y4rH_5q
zZpzPY>c*4y+dF2z4^u_PTzZ%ape#nt$epc)F(RB?1dh!c4#*nDWMXI=zUc<z(W~nX
z*w*Nu3*7md$AY`gh<Jrm8!m{DN5SpKZ<JF|9P;^)v52n(DoNZtgY(cuOMb!Ra<#2p
zIj1C*?Aic4OQ*98eh@$%o_g3rbkby_p1;=7Dc{}oct@Z*1PK}x0x$IQK<t(ac*>7a
z>0TuhE1#-Ta3c6gL3{!}(dVe+!FToIg5)RwNAcu=e;r6ZLU@+Rn&0<ElScU}s7)kL
zL|~M3m(FZLug7O4`lJ~ItFI2&Vf7hAAF_kh%sX*YSX1j?pO6vn+@WDqj!BMkciQ_2
zW%DIefh{BYr6T7N04Pf?dmtg59(`%81}Qhb0F)tC_;{L6P|{8ftoS(y)bY%6+b>z_
z51F*pI9z3a%qR3%gL>DQ4)CL@-oHzg{ql!QEL58e5GoHv$(Dso0GI}(ZJ5ehkR2oU
z+7pj#&6b+_#8E&j#JL23e_8baP(=}WhmZaZ_&Zs~`ejkUn7e%s{qX|!j2||bZpFi9
z@C@nyL!SY}kp$&xpGC!E`(4W&>VS=jRL!BgU)zRO+xRI}+=j{CBla(RBZ>|?j%hjX
zw1A_gRt3y1lXw^G6iHrUnc8RN?&w`h1FT=?S>(i&xYYM|?#7zRva7SVMXM<8gZLut
zh4;~>h5!Yt+_Dg~%<Q;8EJ%sVKVZC9kr-n`-AnG+c`X<`vc8o?VOSlgN?Gk(j$n-3
z$(3poiJjA9=s&F{B2AO9^s~X<fWz)R??38|o8-;HB(E-AoyE(`pHqyd_S>ZT1H?ak
zeyIuwP}d#wO#lY8=qS9kp1!+n#-S%w;ovf*9(sYGLw>(h8BF{pq&Hw_Jml>*akffj
z3|s|R77hfR<}bd}yGp*|(5?sAOu+qV9o6XiN;1LfO5T`5fKHwqH!AIK{upOEKbF-~
z3;*k-X|aCLR_|HVx8&2RsJCRgT7HWOvWrMlfJ2m;=#{m8c3xGfrz^g&MfybiGsWrv
zKrC4ZalpOJtLcRQ)ZF<3%&Q+mIMECyRua~6RrW8hkk^=$<UcM?mkD<(jAGN0dkJAy
z>d??TAJ-kKJCXHi&sol)rd{&I@t+-21<q8+iwdWhUy!|)s3%@>2~&$t*)3_#x;}$e
zV%)Q{BHN*Ox607)Mt;x(kl@#BjQlsGj>8C*gqTN%Hvc?D>2Y9f85AR8St%wX2jt^l
zy23vFdc<Ti7TY0ovA62@QUFm3(53#9dvs*mX~7Cy^&Y0q8qIlKJ|u_AQ6J5>0!7K&
zw^^JsGdpInIE^}pbBsEurnHB!N5lAHm(@%4x<lck=&}0G#aLE=nTwHpoW@Ha>>J>o
z6eDxu3vAiSW_h#LU~#RQz=6XXX+_%+@-Q#PU=wts;IRmO2=U+Lh8hUuKLi#zi8+$9
z3vm;P%H2N>XrjH&=;Im)n9G8UgWTq~qo_GWJ$;G+-6IGXH$$ZOmQnGEJG-ZYwovsh
zpJUW_Bh9px8{=OBE&4WRYu}4{LvN71Z2VnqWmfbhVi)iXCA5=h{4Bt6klNw%SVuQA
z*8`gL{L7_<zR26$=)$K0c`=71IIO{{oLSM)r|y>lC8s$~XhBl_8bTeoaiXu2-dI^l
z(5TStcPk&QCt9RMy*Xd&B_K93eu@LDxa^j~To^7yyk@p2PeX)A7Sm|^<odYzrZ(~s
z9IQ?EqDycRlDWlDiTF43NWryYD^vZ@iP}UxJ<WK^Mkc8~Lg!{d>1mC^i^(`@^H-x1
z=<<3Xa}s*pdJp&Nx2}2iZ%icGu3Wr+sAt>>jU&juUP9mMqMqe=G#q`&n?}^{ejNf1
zx{+MpJ!%UVy_L#+WgBL%Hs{`J{)yxBtgNSQ0GreP4TLF!ToJpgg?J=OnUvVk(iS)8
zv<XV;+~)VOxg%7J0!7IyZ-|O^a}-@<rR|t~QsNu=F&3e2lybKREY)GZ@xh_Eu?QC*
zPQuT{Yw-iJhpAORN8PN13lv#S&4tm@T2sk=xccDcZlGCJet6j$=p}P5r@B<6&8o9e
zclp7&;#Kl`I%WigT4sVgylg6-d+~C6w-^R;wIR}=eII_};0N3Bm^9wI_FmN-ZJUMM
zw2~PBRJltPK57n^H3bx|-5j9imG;`Q+imAFm;X$to@C9!l9Wfko`gCR|4c%WnNb>G
z2jn(A%1)Q4J2yRjY-jiITwKy)-@1*!V|=HiHi!e=36tZyae)sGOr(O&`BWcOd6R}c
zqXj?SFmj@~)6w|k;)5F7iAD{@Zk!naXR<W~`R#9_sU3hNa;*SxmkzJQm_W1m`y}(<
zF}cGypuk`6n=;;VSTJJ{>~>6}*Y_6YbRXDB5Scj~LnkB-aQ>y*ptx2F!Y!inXjw_;
z`m1^U+!)szs-bAo4HU;w``$f~?FBolF$7XF?8yt}QGN|B+5P}+hNhxM3(cjuR%3OO
z^|dZ&$h-4=Fqx{7D^&iX|3ylFqH7}`8Hs<q`ny43jK-EmIAKff0hMglKz}G=C~PKE
z6aY`KE;@~?^pbx=61yf#0qjJ9A`@?d0F6B+=hl98@&BHBk_rJV@^{X1#V8>f*UPUL
zD1d2TSn%{C((+JHiT)2<OVr0Q#Sp4}M-VPRVR$V^KFAaq0H?IMZ!il}!b?0_q;W42
z-6C25xH&MTWmbE|LTAe@x-N!MgdxK}#ud5q&%Hkw#L=;Y(KPGAE4}IHq!n`LmA-v~
zKUOWbA!kL8f<(uPHZpn5qpYLs_7#=ZWci@bAJhjIiqVe}S|$?U$0ct28PA-?aoC%D
zOIttH@Tzv(^=6|HArOr0VWalEVNuQut^Zbw8C-E%_|$ult1CX#KAS0KUGJ)!(}=O!
z<DuN=x#We{*zO^(=5Sy3iDAbm$Y!e)0z|F>=zWWjs_kb<wbmb<9I9FQW9B1x<}qi1
zM}W=PO$?c)627v%(riJh&PHmqquO+pJDI??%Z$oJ__bg_%wC6ABuv5ZN!i#Hfq`#m
zyd(kg))7zXA~XGNN%sks`+kv{MN^9a!j9yVb;WamHL>@A>4su{*0N<E4qC#_I)V!g
z1)}Ne>NNwt07pcVGk~KQ_7w$l(gOHi?B><!X>`P^IC7+uPjDee1R4$TYO47LqC9w^
zNnLqRY>GLU)N}o2pKC~xj=iRyFRhX-#5`ZET(+j2Wd#A9yIl$-v8tnTEkgY*_XS7X
zR%vnPmINM`1-oG=daK-u{sUpFEv&{?UkiEEoz$^5_CR^mSZc*b)$}lyYfSW!I^89K
zdajz@zApjUiGHF6?T|&-m&^j1T~4aKq4v+x=&S-yh&@1jOf8tlC25MT61}-<hAKJe
zCwUw8@3e{YN1g>!p4TnZVjK}4g9?UQOp6hcIBBJ3M&m9z1~ZQL`zp{=fJiT!s?_8U
zfTPO>v|Q&#siC`j@wp8~{-FC1y#;=S2WmX@wBM9bN-mqsvw-NAV$K&`n-a{@Lw6g$
zWO0Yd(pb2>MXXc=bkYW~=G+#~{OB^V8(@%1#*)nQt}R2yVEL)J?iq~xRlo9h&1#=_
zj{Jz9m=6;C$cJ}qF_pXf$x_bwFQHl1nuamb%wq!_<~?px*}k%~J8p6FXC4eFz(lr1
z4(xw<(Wd5DQN(Fl8gB2XayOxmw+Jwq##^;y)Ln{>lhVcdh(2aQczc7kzjbinezLY}
z=R{#oN~mtClmHP6T^tD9F2|3S86U7OFlb2U`6lZnRJ?PN{kYSrBY@3bKVot6`k-tS
z^d0crZpzlzln$ER`r2K6W&qGjm#_@G=(z*MOav`xys(~W(M2wM+)N~TEOi)5F;?iO
zcdDKAhOQo5ID3gv6fDhSgsPtb+AQwI&wsj|PKu%qqidfoUEtrj3zI7i(SNq-a;nKm
zHp<K^6;(PT{xs=`CnNTM+Lc3xy?^-+!Rq;PgFsMa8SW}XO%UtVPt5jN1*nv;8CcH(
zR4`;nYc%)sfzbw|4vabsp{HTa&(V`S!o%U%+~G#_dW?LGk0_cuOYDC_B|666L-j@-
z?*m{*n3rXzl)G!K!u6JiW1xFxH}{I;i;|^wr+y~@z?t$w+>C+H0--Sv1elMdfZf}L
z|L}J|p}w!i(pY*LO>o|7<<?2(3K>p<YH5tZaNbNOW7C<j(@A4EGnov*ERv5+a(hB_
z?<|oJbPkF-DWON@pG|31*1}_hL7rsxtm`IJq$uIFIS#EN%W>i5yXUT0DAp79r}gDU
z6WG2Rzqc40z3v{D|MmZTj2S_w5OGCMHJkCGm!WM`+4FJUe1a0p+Whp5dxkmoxLi`(
zdZ?OlRYi{(Q39ZrK<eDH9E=G7tx}2{FTEZvPZgD#Knwo$S~tNq#nn_u6;^jIAXZek
zN{MJC_nA6ugLAcQF2^rs<$p=XQXQd*c3vBIfjrVfHCdP<EuS{OgaEJTU7R+jP~yAf
z7O<FR{X=z9J7KyxvPok2aL=#cqkY3%%WYa%Yt8ndB=+o__(d-cZRd3;wjk`>?$0R!
z9Au2HuMZ&ZUJM-hk+66}?mtL>4}eJovp6a&f8$De%Xi3#js(r_fxpsEy-P3o0ARLW
z`8HCXJ5G|8k63M#K(Z}sp$e}iIhK+jOyLN3o_<P@#i6q(<;l1K-wgEgE|Zap&?$aw
zWC6Oq&w%@Hf}+_nWgN(VsB*6^7?l87iquJs;JD%doYtNToardrE}zQx=YShR>MoA>
z3TJfoH7e#!|EMPKs`j&ca1Eh;?)*2)P1dn`M;7-1(b?NLNh|I$-aYy6lAxcoAjCZG
zxV2o#*e2_^cS)_#?OPz7PP<bweEQEp*6Ku{kcHmA1cb4bLVEdDdUpKWY;{S|2g;)~
z{|QAg4_ctZatFAtyRg85n!KeiE7FW;y+^8FVi*8qU2*%V%ey~4{t&~18~57C6F;Sk
zS`O?_lO_mIJB90@E23QyVOdXs-($tmv(hIfIWW?dq~1D#V&=)mA@|)><4)O~SkD9q
z!Tpp%HRHiuv3S#XH$wqe7E(Cy)0|vpTUNEDp-LKhDnI3ZS#gbN@w=qANPyap9Z8EC
zu6M}|Yn1dK1>PZ}rw_>IpEP(6cOuUoz*O}0d!qXCcXmhCCypP)F$sSG93WU9@cAJt
z0R@*ggrRMI*Y^OR;t1)v_XLWVQ}%%S!n0uTl*VS1GrM^ZYX-Rj1kLr9Cn(2H#_;*E
zvr-?9q`pZp)9=rNCf-m<?$ev-kVQi%njev)e;NXDOO{QfL~cz}d9E}gsYd*PPpS_#
zV`5C>6^X6VM#n_P99a?J)c7zz;o&SB8CE|;PkyOW)*YJ=!GS*&p$zm9(`a_2Tw>E`
iDF5#N^FiTm?=cDcE86g$HC=ukju)=}P-E}^@BaotaX*^?

literal 46583
zcmeFZ1yEekyC>La;}YCS8Un%HH3Sdtp5PLi;7;QNw*U$5F2OyxyEVaG8+T{O|Gj;)
z@4bI*?QYG?&P?s?`nu}gzJ2R{-#O>^`FZ~Hyb8dPlaiGJz`+9ma4#Rg^8!EufP#z+
zL`FgZ0)eQgC}<e?m>B5j7$mRou<<EKsVFH($;qi{Sm>zVFoDR)>3QEVv9WV;aZ%Cn
z3-fUZv2b#6{Cx-<Dk>@lItDQ&CNalr^4A>ykB{ee04@srI6^xD+#3KqE*t_b+;ca8
z>g7F=;Qny{{`G)^M?geE2BM&%p}*Wvivxg%LqLE>L_k79M0~m1`{j24A}-Ra*X-iR
zcq*TPZ|w0o{9?0EK<_I%2vjFdXgG}>{87;eiHJ!^Y2VV(zhmIy=Hcbz7m)ZMDJ3l<
zE2pNep{b><qibSnW^Q3=W$ozX?BeR??hz0e6ddv`G%POudqQH;kDtleIk|cH1%*Y$
zRn;}Mb@dI6O`TocJ-vPX1A~)O(=*W7KXdbI>l>R}+dI2^`=@8;7nfJpH@A0x`GNx=
z{0mzz-~Yncf8Y!Eg)ewSL<B_OU%uerU0(<R7ZK?-JMt@W72s!kyf++vDERMVvno4K
zL7b{51jY^%XoNIeYqY0-S^EcP|MwX4|9{2VzcKb-`I-k{Ai%v09s({v6mWe<pY4nG
z|I>dX8RT#QRHQ63;lt?v_a=Wam^ig_xv{P8Gr+JhaY)=OYX0pzk$hOAhF^#F_mcy`
z__Kh02YLh}HR#0>C2ic(6){5Un`*C7Zvts1Z(r_YA&DZx^E@}7BX!}ot)IVyobW>)
zT*~$g$);+GNY~z29qSv*4<(+zjo<Ifd<K|)!fMz21#rs5@}dhb=eLQZ?5A4OrfC43
zGW~ogd>S~#TWt${pK)jM$rrNG)0XDMr3@5)j9v$bQ_?v;T}Eg>vP;hiX<^A(-<fXw
zN>XwbO&)q=%*yuVUvpn?5QXmPnoZs<EDL>stTO$02J{t?^>FA$-~6=HEz3ND0UC@(
z-}IdmOsI&F2tY!e3>1|ZrqpWVz$dqUrc~;pY!4+`AZXFb?j5*@DydLg&!E68o!0&?
zY)}MW{v%Ih(aK&fWQZ$iH00@VpaJgbXdbXzSnjlRlcV?yh)zK_(0mP*r#mx!2DE{{
zLVynpo>T-@T1n_OG-DQSeem;FoEVW$yI;W10N-t2p50swY!6)keRkOYMwHpw6xQ48
z*|=iLCN(M3S5-J58k32EX>Ai}q45j|bQ#qQ!|^wG@3w#uOVv!8K71o|iH5o_UhWT_
zL}#>ItqXb`#)T4_*;z;dAc$QP<j<VwIb2_V2B<i?I;IzoO^AGJR)#d|)c{l^@&6NP
z=p70Ssn*)qEXaUAfh&jork{|@RK&=~Pqwa-<t+tD>vjcn4e{)O<EF<-9lwO%Y4yC?
z8wQ;c1ne#So(>tQ6M6bXVst~SyZ4Sn!w&-v7-b0;Ge*!Y%f!JH+pt(3LLIGaEw}Ub
zBwJ7MS{G@`iWftk;{&f=KV;$C=}kHGI-fO^#p$O|#VcKO^<CCg+QXE`jflQy06g(C
zz;Ya@Aj$DA=O@9sv(x8B9Yt}<%&A>Kb{PHt(v&-bxT;0BPKC2tn-Krd7fM6X8sxan
z&X$E`h1yIZu+)C`BT=0LtC-l-hahz0?RgDt<qpxTvhJ@-saV(O`&Dj7j@`SUgjA0Z
z2FE!3hk;!M9b3D5)n`Cg;*|Z@<f!e7uhc0SV+121eFE`U&Y;2NWz!;qxwQSq33(YT
zE1L<X|EmS`j)b5CBQu}_(K+u0BZ^wM-==^TZyaFvB2t3M6Mi;2*i8^Pk)r6Y)_T}@
zubbpCb(b!dBpYP%Y$t{xd#Pz;dtDxW21x4DTnh@S6Nh%T>*>Jzfj65}PptsG>_&41
zz0OT{DQ`U)s<Yv^S<Q_<8JESv*u%nld3ILw3HfE_^)70;<MmQ%<JX8Tpa!8ZK)ocs
zGTi@)B%^@1-pGpM<{Jm)VNMcd>~HJW5&_|&;cUmGRAJ+~g@9p#ythrV)WX6+j>+EZ
z+KZvfOXg<xSy2Fyn)-RCdAC5NuEFNIJICcD#VNxlsiALK5#Tt@-R$4SW%`m{a#PE@
z&BQ!MF0=DFdb{i^w+!2o?@j2UlUug0_9!nD?1<u2>hq`4A`d*ZKD!p~B_*4BC^xzN
zB6wx4h)Tg2G0kK#RY5twiV0hE`urzse>CS?2q>=VQIa9d2wiXm(=C>pi|`sr^H6%6
z?~?LqW)dO!Oiw}J@Zx&9Ox|bhWWmjB*MZTbYrm=R%zU=?8#v^(=C1AM!vxU;=dC~2
zw4}}#b{30JyxlR0?8eizpH0!PY}~JtIUgp!-+<4l=)$-YuAc$Yc00Hgmg6hgjn9As
zVRQETHi8xYXF&c{-QhDJv$rN=Zkb;Ez71#Y@5Q^%pPvCygEesD6Z%(P2EY@`B)4aP
zwVu~goXKUT4JCERlZY3aS)ZDTH+jY#=TIhAaM(_Cc-h*EwmIa~th!DdSb`iEUc=qa
z3}L_8ZAwiyNH4Nt$~Ye}BkOwrmI16M{+SWe_$b{~%Cew3QH~UqyV&otO_u7CAovVu
zVe6VD*AkZme6})tO~ebCYl^J=H3L}M6a?!?yF|7{Lf#1a>D6YGSYCOI6vVrd*cNz!
zLu|UcazI!bA%&%$3cA<t8^aZ6b6+hCE-*U_H%r7%&>{pu-iv5n2`K|rB&n&d@&7q=
z|1&uMpX3^x?yZ^UJ1Es<9x>gEe1Mty^K;gXtr16~GcHfa*95x_<#yealtf|RG9n^?
zS<?M8;L+pUewu-obo$bM_e1;=A$RyA!?I=2!5dAp!8E^y(uL*}#zVqAr~bMx43pFf
zxzR=*TlvWrsN_A--+6qO#4ZYrr@>6%L_Hlefy)b#-j@Cy%F(8ju=@ObZrb5g&q&(5
zcsN<(uK@B{GoGxRKYg~g#huj#((u5yY@7Du$u2npb8cW})#c?SmQ9%fd*an!J5*_3
zIpt~2YN{GtO%hF}lP?@ow`hsq3mg}Xy$_jLaBa58-)l;YyK|Z){Ps&vYDGkuepHw-
znEC1$x5Nt9T`&(>D8koU=HfVFM$oR#AlvHd{-?n;%538$_wF*)`0I(ovv%R3=yWBe
z&xeN2@6?CMK{iqX^*fu+C8IqK%PciWS9_!}6ef{0wZ_7sR>(dLcVXibwGG_gw&D4i
zk8D?l8tQ()(J)7>uEvOy`=cT{apxj4rZ+_Bxt(=tH}JaPNwZP)Y_*u7-q}I!_kSml
zQ4rv(h#|cYij>EU;2}tHddloEvUc!J;Z@r?flC-*N3W9yy229+DYS~5v)x&tdc2Q!
zz-~tqrwgl@IPWkkeJ}7swl0P0sFJ?#3DLhvfF1#BsE3D0OWr~><+IlkbA{TV%QL`L
zNb~_Qd0`RTUZbK0CagGDc3fuM5Y*JifDAn04tR_$v6LR3pyPE3h%Yc4R1}4!7SQ@c
z#y%YaobfdkW7p9YG;#x8=^6G6*SVrsX+QQKiOwSiz;xTU|Gl?T;cj8)ZOhy`{f_HZ
zkyd1{Mo1QcaTs7zbsN@khGMrFw<AHr#2e)*obN$X(BvTsj)WN)^EqLl@RO{^$xLd`
z^WzJ!bunW23u8LCK@b=H&Ur&<KM{nEU3pUWJ^iG5`1%Z}9!IFiPA(-8M<kCpRs3Je
zxrxWGQ3i6Zi()@k@itW{vxp5C9X|suVc#a1vorMS>YI_22SPMAG9+$J4IBN!wp!%Z
zD(VqDO|w|OoBH)WKy*(zF&gFMTDe{74Tg8H3YVH{Y8$3r><J^9d^R@#MDEOu*{rEq
z&(n!Rker_45hi13Q@?Z1Ht=;P$g;l!VezsL+8m9&i)(pxpMveMu@irXZM{>3eaH}7
zqp$92cSc+8LivxC(D8|Kt8a|1;MY}I6Mcn80==q#AVD0r+&q$_Z%P|grJ<J6R9*an
z)0qX8@@uN=*;c2IgJC+~(2!+?OVUq#c{O=Gh636&8g0J!?+gNHjBeK7-Bp%JIjO5i
z0`UI>ncC=L2vqgFX<jgFchy_!@}p5W+{bnnA}!0a(PH#|j4hLjv6jo5*mwqLI0cmS
zrH8~O2t`~IbB}8pHs?r`{<;0qOZM%DtlifP9}=JxRex0AD{NiBG$L-Sq{)q^X1r>(
z8+Zd}Uo&!Z`Mm(+hG5c+HctB;m9mZTzn{LQ6Ex#3s&AV37zVqj1Ez76UMwy_ewven
z3th9J>fKrFszFzNo?(yoJNIpiq9=F@!rGf?6%Z4<BJB|i=T}3BgDMkExZ24Sm!lcp
zbRn0r$vRmISFWtkZQMT5!vd+xwdNDJ$^S`|!hiBT{>gj6X{r2<R;=dbDB(bsd=2C`
zM-x?387tM+Go;O(MT>7hd<Sf#HoYLB_DgSA&z@BswPn$+s34qtr4cc_-z@j*lf$Aj
zLYV{SqLsk+=7XbJTd?NY!`QFR-}?EytRx&k+8vt0KP(XVGqK`!dhWOg@eI5RzD8;v
z{E?t2YB`ZcKqOD+CqGwjk={t->>L7K1!`fujUG0l?@I+E!0Gszj7cJ1mcQNTa@ZT^
zSlUOB4Bo<^RK;&<X;Aee(ZB^PYG~0)WPGR6-<3Q$e|p6~zoE_xO>~gl!cVuSo#{LR
zUPli0ws?0x*iZU0-3WHuc)u+uU(O2KP-zSk^aSsL$v=b$lWjY67lF1ZXP}Tyt!x@f
zo8{udF^mXo^oCRuzIj)ReEvOkqIM4lqt^LF{b2K@8iIC8<9=k9BWex|(-XejsRyJ2
ztDcAE@FZ;1(E9HrgI}0Cqf@~A#}St!0PFftr|<42yw--GU=7vo)D86L7RO#>_k3)E
z-GU<{#*>0;%aOF97ALBufjhJ!(SR>U%p=W<i^PceZtI^SV*6!{+X<*Q<FBiyH}GXw
zn}Jigl{%(T{3H}%x!#)WRDg0If)HH56h7dXP@n70R6wISR-}Z!R@1PA1hId`ANfJ1
z?B;V6iYk2!jb)aG`X_(@+ICH0TaA~7yL%jTUf;NLv2t_|i&S&WC$`*MqonYk18!8!
zi<3H9S0FQcP}|=SW-d=QLotzZt#qmN#hb=XZclwnQU!XkIa4FQ0HlJgnF1U5Rv*PX
z9vDQiR_cn@S_Lkj0Z;{SB=v=tSJw%DCZ@oD3<M6$UVJW|D~P9?J1$!pt!+Sf%MYw5
zP8X->;4YH{m|2om&eWWp^=%q-ZljlY?F=S(L|jv#2zLNmt!G(FL6)S$9v5CZi}>}^
z>P`rJQFb?|f=c&vqFo068IS%WKK+k9m$C$8ml*65YT_O@H`muI9m~^;-$BJs+d{P0
zSJa|TLr(sb=w}SFO~Z|==syD<XkRHrSKdH$8^>Jgaj+jE`XO>khg5j_kiv0W=DxC}
zX8`C4{#)1OKTL1Qg0ON?sCBYgrf_DpJIXV_kJInPfS-H@baK10QGGdODWgBCBwhnP
z-H5G}0i0-7&8v>Rq_g)*HSaYm>psuh1ghQQsXqhO(8pI&3h7!zFK(Tgy3Slc7iDA=
zL~>KeOk6N|Wzn5LhKzn?WV?sAy7~o#_SQswm9@WqPCo<MuMQtApBABDzM7NP$*3_;
zM|`nozzWlWDAT=0_zM1R9TD=p{LN+))!88!V+yiTgVZKh>Re`hW1?_!QJJ;JlgH-g
zlSSnCgvbmaKDC`iy6^;eBPKD4UT8l#8{U7sXKrkmZP9ayc?J;9nbbu1Fd#rSX80y*
zn_tui9<%$J1eAgY7v;{*cI3vt)_kZlnK@#8iz&_~>lwhxOEbdyc(oaOLkieleF^q_
z9j@A4rf7neOD{FWy>+HscOQL`nN#w-9_uUX03xk%E1qY-`Czwu)yC9_z26Pph5;=;
zTtdE^tHPwIRaxf9&?)WkuxY|m`5cX>1wqNbMtn5Et;G-%%X;1pp#hM-B-O)3OzN8_
zCb0(_xyG`O6ly)mKFR$413oKXh4pBSfv3wW>iBSZnO2ZLcg(dZqCXkR_i~>B>2Z}z
zhc}gUr)2{FEXK=Fd${PrQ>8DT_N|c*CUu8elQ3r<wn^06e-=o{Jkb8u=&9BcX84Bm
z!)do|%Mz^l^=Xt(LP2GbQ(2>bkE*@H?{BlMR&j$ab&~F#c%<y@=6!&SGWVp83PS62
znsCkfrpjRGWUtE~B7562nIpCIp{asAmn)B(mWgt^r?FpRN&{{D?Z9$jSlUU#R$>ao
z-PX+5<Z1GE+>u1vQ8ip_gww6%mD;RA$YrvJ&F?;lq@zGa*sQ`dP0ju5cyp1@Z#iSI
z3tDwjy5X78n3WE0vBb`<FE+3HYAFX@6c<9E@0Lmq8=GJL<r==$+7h)aZ~m>{r3BnR
zwq-zHlu8S<db2kZB<Us?E{U(6{MX3-O9aQIYtu{x)eT}N!;xe~N4cM%T0!9LB!#%n
z(;*|PD(^%WVIu%O<mMHDT@k1jJj+|edZiW4btvu@qD=L<@nR9q?IkR`0ec1@P=5da
zSeeT<dP{y<ys7H}8%`-kd21eGk&@vr<J@t^;fe(LU1eh4aR}R_ik>9wgJM7Dc6)wW
z9EpB#ep$UM?-RV}FvkSS^NOtLn&iKlMDJAz7fVl*0>-DEA3?Gk$}>!dKQ43%G)yiK
zH)pVK<jc&T0Wm%q#YWG7TFm%js+@sZrBxegrSY0H#wYPR+q@#-k8H(wm(-5B0ApYN
z<HKkirDp);GO=arv7JfuGeGh<vmhKSaxpI)bD_Q2Ao`PDRBqQY6U)s~pye5Gdb#d7
zv0s;X(k-fCa`zXGDDnqJW_t77_gPrC7<`I}S@#T(@Zq9u)|9a4MDD#wJ9(dO>J9q#
z{|uBlODe<r0(Oy@|Hf0*e@`FO?3yMY?bDk?VniAEc19KKi4mRw)wJ(2LTg^UNnNfo
zVHiePUKNSC$h{T~wxi#%PBC{hK7B&EH=P_<1#hb<&0G5!FhuPQ964%bbXA;W;`$+!
zLZ-d?-eEzS#asK*<jBDifqHB`QcXlMuRIo&TzKMq`x)>XKM44QxFV;rhVEIBqSZFd
z&2tn#QpI|IO*sSF$8>U1M$)6;8T#leZeoR03d;T3iwk+JS@@sRUO1^}J6;S5Fl&z~
z$E*8#T&g=0+_NdlJ{!>otTMM8Ed{Es+1WSR&@J1=_K0>OFRx4=z7h}a2wlT)lh3$F
z%w>}}-tP;kCVg4|iBSj8G;g$FK8h7?0dPejk1GlW=sL%*qvqC4u+Rq0(I~SGO?!0~
z6K!j9mVl)li9VdPeK!+GMU!DLd41<RCh-FFQ<+AC70xsc0+E?p!N4_jAy!XEPdmuf
z&t-#Ro+JJ~<VLFx(GG*<>Tv0`6SVy5){0QRHHNR*sU}XN+eG8c2U|5!>e{rUmqU)R
z(R<1ZU2DxclWw})u~-`Qyaat6<UU{TC5KS%Z*2!2_Q1x0g9>F`x88vf9HI=u>2=$S
zJ~KKZ3awb3dqTXf4i*h=^ExO<;cR1{b?tKJg#C4D`0EYdgN1y!w|~phm^+DTmfy>t
zBGqN_)kKoZ6s4wqTCXb1qrhvdWszNKn5#w;#a!+vr#XF}J;Q>)IyNCbc2>S*6X>mY
z<5qC6zOO`g_}K-#LDr<@R;zLQILp%gnP2!waeYFP!0*rhVHyyGtlzuSoy;t>H<vT}
zHU(lG<DugF(AwWXx45qk1uLU&Gf_&9a$2kX_X#oaCrZCbf0dF{(x3Hb`TU}0z{}lA
zWb)>wb@ar9=;V>a{de@`iT~a;`H$w%e}{8;`@eXiF+=BR%du_wboXIcBvUJ8fhDi#
z<2o=|2ROX)vQY8#RC7jCT1y>fyYJu8&mX4ewR&5TBmtARg(N-~>Mv-QWy_3)d5u&=
zb*=oFv=s2kLe40ZbSL-A{YY&wAVe7=q<+smG~&=&(|F78W087eq<ktJ)nZdj5>a)-
zXVA~n63q2gL_>pdC<=}-ttEA~Mpth^M^D<$7UQcV@qA@(mWFgDf}cKNLZ)>cFQI*(
z^~rqaUZ6CbhWG_?t&nVib&_uKfCYIOQ6k*@D#qshOq2Xi=^sI%@!?4zLChhT)EZ2`
zg-0OlM$X1uRs^c&*Om&VIN#In<|Vo_FASxLqbY<nqHp4OQgwb)-f2zmEDHa+)nZss
zs3NvYUy9ZKH`|euN1&$mv#h4MDE_z)kL}J+fw392nK7{*TbCDG_iVv*`tn_>*tr5V
zS;}?lQ+`thuJ%5!CX~@Kj`K|{wN~Hf<IA!gi8whHX>xY3y@QGeh2k2_Q211^vwoTD
zCUk8{WKx#ee}1W;p-C;8RzBj>Gr;X|<NVN|*UzL-PsfOMQl?5^U3e_LZ@Kco$=h1^
z{j%)mAJnn(@zlH6!uuLD3;GNAryO#uv9KG8rP6mcw&Z9>L!^k9AVL$rh&Xq;#p#74
zXu~t$mDPM6w2-DcN;7;2f#HT^;JO6o&p!IvyRx4&_d0gp?RLmQyzW%5Y!U>IwCa<%
zat1F1B8On|hDMmZS^3uA;$#`*qMBoVJ7DpN26=d-mJwJ9xInKdsc=e+<h6C_v#SLD
zEdd?>^)gSGar8mf)0w5237s+Meet(4zkaF>UDf=3x&AI(1C?k_En#ejyNO0`o5YC&
zXA~#q_l$utN^j~D(KpW;i1{x|M>u7n#xu;h$?pQ?shK|dM))`z4%i%jk?5A2@TxFs
zAG%pu`}rWdmL~iq-g{9u&@w|-MB>J@NL22)hT`pP*Bxe5f=xHiuTnYBIv~w`eEiL<
z;5r4TM$^o)y!Mu5SUFEWU~ezE;Yz^oBuqCj{?M<H?DqZ^mLX?2q9b_3{Vj<riE--m
zuMniRE(!YF92I74omFTz9ZL03hWJ3DX{IojyM(;Up6>K7Ut2~hTSl>DL2Y^JmUJQ-
zZ)n55Tb(y>PIMqAR(dfzGcSila}qflH-~Qe!Spn~XK&CEjqeqRxD~Nvz1S>?{{}7+
znhn7V3W+v9ymr+w2Yem-FH0^nis#a#6_RK4U&kZZlk}p9PNv!pS5y+P4jwk9<*fW!
zk#PA^+Ve}2>{lkZUnHR?<K{Nyaq!Sd0rR5pNO`pCr!OF=mp$XO-1uIm`PT~9>7gc>
zV*_r+8KX0OFL;5xr8<HBoLO^Qh`nYqSB7KwE0T*YI3WxD9pXrnSX(QnS42jLU6})q
zBXjE}r-)omFkgAJazkx%@Vw<5)vMJweyVpucUtDJWor_@oqsLIRa6}Lp_|a!LIgaB
zItKf|1U5uBbbYX2tcsW1=qyj^q1-nA93f{j*uhgXBv5pdr|oj2*q-Q0AbIuhG7U3v
zrlzv&@yA}*A*Ih4ukqu-20zR|ZkA!0BnD<QPi6Db{Ruqs`?lB7Ky{YD(12e_8hh;6
zu{`?)rDG@m3i7R3j>jDo+-6UkAMVJdP$!m&uonlsEXP&~QJa3dgrLCEi!}E0_{hfE
zNq>FIQ+ul{^vY3L?l3*A!DE`p<?0$5ue(U^W+oLmeZe4wQf|`?C5@a}#59fLU~;pq
zh;qCv*sBwWFeLr$ZyKZDXhO^y=c5wk2$P>H*I<lZ7)tB=zA1v?CZL4g7D~Bg&$=*@
z`$c*=N<;$NeC1B76iiv$xqGKriCkt!+s#obezw_<vUgd;y~L^2Ftd{g<^RZBZ>0mE
za&j3FHEnEk54{_1<ZmQd08`e0NqTJ(8!M;vI%D+S$X?Zc(gyAn9VhQxlr+PbT~G{l
z5Ztr*aZ^C?0g7Dw@m2@#)^BOP=QQr=WG6QsEB-5_{SQdu!k1@lhLeo+zr|*5X%}sd
zvY`^U#Vt2`8j{lC@!CAv%kY?;UiC~9SVuYiE%Q@Lm_zc@jg3U}WchaD&d~f`jqR87
zWGK&O!g2w(qMZ#HWBC?i1;J8>!(JU593Pou-;N5T)5JxFOfBO|^zJg=DXW$jgM)uP
zQ@%G??37xXg2WAUR<<F<BEVRkUjD{Dz9mlUz)p63VK>7xmVq}%O8m*G_cZeOgh}UG
z>8Vvcm_kikg4(Y@om{9a_5u;=RXQ$bk~j^j&@k)3XJGfBtteu}qqX9<+V${GU9qaF
zPfJ3Und!giA90-jo=!>H;(x@;`#H&;tZCIGt1r*Y%~h=>UZ>7?j4saMw~nzopn%+m
zz*FPo@N&D6cF|Dl`*5yV<0`<@Q&TyFY0>n+PPagqo1Sss1tBvp(+OV_`01}Lr(rAB
z$#oy#zzIzBY8Nc$FX7fw^*eGJ`T^>_1)1qz4B$gI$JWe6eCHYU2f1p@k}O8jmN<`f
zTt%3g{ns|oi2<ozjT@r6t!rtoj^&$^<)c|`@+WGmM{N?DG;CD@FrwTZY;qE@a+;ee
z`$(oE3Ct`UwcUD8(%~JSUdjLr)9AwO)*RwK6m}I_o<PzZPnWqkfT8ewyF(oWIf$hB
zRr%rwip6|ZdZ1m@k^}-GR|?^eCZVY{s<Y#DUM3#WgOwIbFQYRzHwb3>lopIpSrWS!
zn|w~9lNr;;Tqtc=Jmmk9!JN<AOzx>cb{C3II2(GEiNx3bz`&@or9Yudwsy*37u(z>
zp{D}D#?%#eCrfD^YKUC=%09j^*%WwR+qa)i{<{Ub*&IH2_Vas09X0@4$@)Mm&q8&v
zvbr%33v6Y`GyM<E^!{H<qYz(`4YOlwYo!89QrqVqn~_UyeG<`f`$`h}E_rK1urlXk
z&{<2q^XJ4J0JfbqG@6xj+l9YUXt5;0NKL{BYB9MPX{^!3vaW5>YVtA#UH7OSPhT*t
z=)vNtj`eO^^k+F(TBfcr6nhX$ri^|vBB!{SqgykT)^t+p_SEbdkg$C#F*M41D@}4S
zYL#*F<0WL{B6|N4uBgySylx8mLl}c<rpgAwkm;Msf5%#SRI?4gJ)%w-fvo<-Z5^Rj
z9ldUP%DJ^2QF9?kg$cvkpI9Ud5;I}+&mkv&1_UWp@Fds8LaeeZ>mM4%mOCyUZ2Ur0
z8|o4DWX8e0UUeYR1Q*h@$mRMq7&cRh+<Td=D9*FLNeMcI&TQ53-K)Ve!nLA;EbaiS
z+o|uRWMe>K&&x7_fs@0)d2rH|`_=KX-WESGcbU%U;%M)M-NDR^e;9os*T0qW^`0_R
zj<fg|(FCnRS{Ti%FT-c2E(XeDHRgpr@k+!Ysk083T4*jt?TD^^ce?-NWH#{8)C5|8
z8OgSvSc2A%Qvx0!Igq|AZN=*j_nCYw?Eq_mJDSO=Gjx}d@1RTmV?rvgI1n00N=il!
zDQ12ql60ub3g*PxA&$g9CE>hODkX0mmuFSBrB825;C*NL(b40faFkJC9ZkDnB){cX
z8=;07fY53#y_SJFL@jf4-Rz{1fGV2DYNgi9IHz(D(Ms2)RATjOxzFKSmH+z$nh0`;
z+%A_9rbvPt*t9`MM76lM0j3;@E?Mb_Gi~PQH=rb}b<yL*?D?e*#;HUcctZYb9zv>`
zx>-7>5=7tJL-W-RKjS3n=+C{+A1s$t6K4<Va!D^WPS~4~*FjlU-Jd(?Kzt+4oi!CB
zM@xDV7<8<ygU5w6Dw3aE{zfqHogFQkzVzPU+4i1r!VZsh=E;+#lN{!CISv5>spqp4
z5Ypx{U3u?3C0i_^zFuB(EEMjfwMR;rTzxB%pr~687&;~f>8;hgvNP}`pWMD0oS16-
zNf&+$a>z4zz<Zf>GQU|{j0rSQg#aMf9h3wOoXeEC<`|$5cDw3*Qjz!!Se6L5(>%>0
zVJ2898WH-q!E9#cI=&1cT9MkK<kBR^G3lTxW4r0S23ddbc4&L_D5A(OD*gcW8Jwag
z=L(^T{&HD58`HZ*xug+-i0e<UZhRCsJ8h(ss{1{!AZx$a^#fTWNx4<-$ur<;85;St
zwBwhNa=ZhJs+I1%OWPVP+mg2j^_qx+*r`pXxH;V%Zf-&jSDMaz#%b;sH(b0K=_RF9
zRb2!aMn>7c6HEyr3BQ}3fxT$DU;hKN+}~0t_^4lpl(8<mJvyHqNEA`{$}KvsleDzX
zORqTwvxR(*^vLgLH3~l_UU7ar4J81X(|h^~Xz~P=>RD@X^dZG9ROQQKIB*^?T0*dN
z$rDtsPQ9RKM-Ez4XZVhnPtNaYu?61k4#Pdb8fKls<vsaXvLixyvDf)F&wIZ181f#W
zT$Gn`f0$B|h$oX=;;JYS4Dfc&T?jI$$1!C9@|n>UfC?XN(xF?)TbiDs2(rxp`p&`&
z0upFBZ7t4dR=?S&M{HoLYGYIK=EDR1Zcd&CeJ{&lj=*H<#$bFUq)YUSO&8Jvxxmxn
z9)k6^$aAR}jK+p2#hOw(<kYI4^ouTBwYb_nBF>5z+0?l-wIohj4KalcVuX-yBJ3UO
z@Eg`7Yw@boQ8FkcsTENmF;nlpv-x(>`4^3gtdAykucIO~5(!^_UkwOr)~MLl^A>SW
zL&&w%&U&I2RMU$W4N9#DIA$rg+re8LV)%B381*7fC_&#t5cwk{&3PWV!luYTo}7>o
ztiel2ylGJYpEFzIDep<w6vp%Fh=O<{y+!jpE&rl&Kq`Zq=6i+t*He0{3B9aO*gFQ5
ztxc26?Jt7bWB>~4$gVmFL_-_=OQRQYY-C_sujap5sJzA~rOH~pE*~uBtSda<b)5Pg
z^%R)ASiM+0X8(3)6rkdpGY+}j`%OZ1Dq4G&@rXEs9$r+gG}ajvCV<wqmI<jpbURwP
zLoF;`FFeb)3Q=<ldi&E(zpW*tJ6@7vdXL!Ymhe4riK5!z%zHxrcTV}-{Qj8j+tj%J
z(wt$w9cn5ikA1wOSz4oD0X>N}thm%i80;D=JB$&p@NXFzBbD+gPfEd}cS3HQ=di^=
zU1d#`-@b<UyznTJ#w;uNn48#%nM2dx9dER$Ng1_1<i&F8y`l~p`^dgSERd`jZIYw=
znBI#Nin`cWBIs&vGK9D9o{2GbxMU8wxjN|?tT1nG3}c;;r<!a`X;o4enA2I-)8e4F
z1U0afO!>NvZ7sJFUvLi@y$t<)^ZY;oO&m~Vo7_Q>e@{=@qm?ylC|tJ3P;<IugZ=(b
z8|=rEd1H9R@3y0`i{>SkS!IS<6nXk~>KJ=N=fZB2rmrPIs_H(@<%HR)vOhM8c!_As
zdyhln+?XVLO8rdDU&r=pRNh6GiQKC-POq7MdL0m>;?5kcws%p=EUMY~>sAY!&_SiG
zAdf@gy&7fz>?fKy&of6ohrYDBiNQQ>1@X6P6gHJmFkRhA{`V6Fnvd_{Rl-ugh$Qp@
z#P<vid$X`o)<*b`m_O{R;J@nw+8O#J5NxJt*B0fIVsX9A%aV|o;eH1Eg5>OlLMYGg
z_bTdmr;wD+%R~=HY(=4Nx@)a#EkSJ;Z*`lq40|92x8n=n@Z8Ce1@53}4(d1QiNd6!
zUAl`qFWD5jWD&5CU}-l{Q#(%OB_Sh7HR-oufU3v>&aD!?xVNKicvup9w8_jh!$6_N
z@gxmUMVE)^-2~Ppu`Nn@2&n>rrv%28EG?kS<&PHLJj6%X5B2rPB#`5p*KNAxP86CQ
z@>V{t8yN(|3wv4Ap6+f<AO4I3r6nCr3}<RKB27NT^a?Cl4O=J`eFReZ+Lc-FC68v5
zewh4YDDgGC>&uq}kqCi+155Zv_31BK%9Y7;3zo6=84}a#y3p)-!)QlWaw)4=c6^D_
zI7(ayA+-;8cR>WVt;ifx1rGNEs$f5OT<ZLQ-UO}a?C9&g+mV1vep=di?)QYBwn8M{
z<b$2-@Wt)dRFkz{5}Awpvup#1vGgD2UE^UFg*8;K^sSTPyJ%eQaTFm=ipK22CUECV
zzWse!Fzu0zGKquJgxWgyAvOn+50d^_xFIY4is$~QLf*?WB^A81bWQw;uj0ZZYb+!R
zcC`qbFt-8*NaBnaWatp6vG??!0l`jlbh9jTH1D~Fs%?3Vezw$_MBAlew?hN=lUw^j
z9;O>ZS$a!tf8+|4zF*B>#G5YXzu><vS6ZtNbrx2<S2wE(5?Lt;-E>S;m#$x`w4d>f
zlv28`K9to=|7|A3EG!h&rE}7=oKrmFjQ^`xgpD}$1aNUx!kf(X3^)nPi@JH}|82au
z>KCtJI%7sj-QvHa88;~d2Fcsthhooz7z$h&bgFuS)qNXwvPR9uB5FyvW*L#v6&e#3
z2^q1E%pA!)ntrqkMYr(bds@x0bX@9M4O}z1S#%w{5@wXN6jLX1HADiJH<1BP#?6`R
zh9=oJNg9(*X}llV#X0*(dr`Yh&?=Fllc?A+6x|Qc(id>tk~EU<I{7uB%Ov^lM=GOm
zYKm&&q)_R9h?GTn4)4o>&sY+ORW(BwUVLlhmq3LwveLJ$I83Z<nY7q;eU4PzbF9no
zHNlebAFL1ep=O=sLVe6p*kw)vt-~%JPP4B%-+t&-zTPgh6iBPfuZKtHu1Ae*H`yNb
zMzSTk&o4XYf16YvzP(r3jr$bOdY?cLVZ(ia``e}3_p43mDRR7xg?Y7J@8H3L(y&Y~
zrv0F4u-KqnQ>wop>3-L=g5a*b3H^W^kJjSh)^vr_pG3~8HT{Fgl`RJQbo<$YT1VX}
zd9F~QGrNQ{)LsCkugcq6u9FY(QY0JR3n3({Q4oPF;qH3OpV$bQ6i9y+-}MKr?>m(0
zX^|NykbYYTEJbbk>BOyKfXMOI$OgT7SkS&XpK~&04FIVNp#a(K>0y@7McN%e=K9Uf
zyM62^93w7D$sRZ7wFKNDjtabk&ghEyMSF_n5|jUCApduW<^G?a&9IMyo<g$9f+I`z
z+GGJlQtAzSac>$EKeXr!<u4-j^4}#-Lp3sFnl(sF(0zeEjALApx(09DX~Vc<nhsw_
zI;j@Cn~DqPvnTkhSgM~ie6c~=MBt23Pza)i^5ik61(py`q;EJJEn&d<-c9SyetSE)
zS`)`-;wTX3ir0tmVC4kCQ7Y0k7@=X$@-;=GOGkZ5NUBO=<(0^R;p}YwE<i8Yo3DK;
z;2vrH4jpeKGuHS7K%fW$-*`w*)lAqGTGkW23ZWapIijJ`pD9ryS<*KYN3H#aN~2DL
z*Q>~I)VOYSQF3ZW(E`pxFbh3Wy3r88+uo|nWzt~LV%&{f@U(H3Ok^|-`YFB!0R5R2
zEpl^VY&Ddx_K8h26GV$*16*E}u;2K*o@^%n3>Ia_f;ZhLB<LA)ep^%;9zd)^>wK#<
z>-Wg0%T?e4O=Rz$&7an&aGdTFmzNPh)7=vMhv8CU)XCy>{|!Cxm6USjVQj=qa$YG&
zHplRdzjkLk+(mx<TL?PG1tu<6bCIcDPim9xJQ4BEzK!>U>HG4m@0W<Cr01AaTJh59
zve}_DEX^{;KDB>fhSVAI{*xbqc{z({c-&SYkxrU9BHqr8J;B{->NS(yO@VbTcubH#
zV<KClyPq&bNmseOMK!0nWy@_#3+jUU7haWM0NDR%Ip?_fdn-bZEP}b%Fnn{*JDve(
z!?mXgGd-I)WZGhJlJCWZOxLT`&5z0|n|st`1&=gOE+Px8+RUf9Y{Ek&;%NUN`&kn^
zJ8)sO<d>LgdOj5VXcO(^ozQZw7txdBHhsrTq!ZeCV9>t2%{$p_`Wei&`xOT-Difk>
zIOw9(@KmYvv-d9hcg|XW1-BI|=_AP8OhiZ7-WOO=>x@3xQs-I3tzfE;4=-z~QVW55
zWSmwzLYr)%B_Mcf5?Dmi$XDW%Q<xpLBl!NsOvG~S>^j6Q*^eGtT9FC!27SAg6UhKk
z-Qbpoz0@otJp=lyi7GPen_)Y@A^Nl8VkjP@TNN#W1khjC!H+oACGKWYQh@8L^4tsV
z?d8|3*r9YW6|WO|Jx>_Dg!FT#4WfihbBO6^y_IC(i;Q|~kXn*hjjOB9G>kF&l1HYv
zZ!5UMhkAnu%DQkeQ^{G}iwP;&8e7`@m&&p=Vmsqd`wP`ADq;(uMY**rCY;^D8|rmo
z6oS&}(<Mh%7?QFZ1%tvcLGh~Tnk5A=>leDF04voX;tk;wDaI10mzsV4KC5-&sX%c+
zW9ZnM()w?2jWAh?Hv6^-dxulK4^$2cOb`D>ocDxIYZir|wkxf<D{^B?`1p(5*_xW^
zvNu8Hgn){MSDfi6eJU_@E+xE0>!y&oO@A(fpsL)Ru<p~h^~?`dIzlofh<!Hj4)(FS
zYB{1-;C${%t~3_gDS=0{4yPs20~p^AJLU!q=Q4rz69*1Uv0uG=#L@P8mkILc&1v|g
zP8(*QvcniK|BeWJ6*m>8RdR0Ux+R9IHCvL)f$>j~s0O|(Ay3U#e7Iht{rUR92qQbY
zLvP`0pKI$L`&Y$Dv`rx2VnwN`J_$`*FP*hW#WVi3Hs8fQ1gZ>%)7NH*Y@$x_^#KEi
zy2(eOSdH)!oK3~0;b(sRZu6Y8bCI85R9F{FCd!GA+v&@De;N{TGJ_wN7f;UtCgkK%
zN|gXI92-*1R6~8Dy22E%2gaQc$8#ShrHy1(A%(0z-G;VOf3WEl3G~@bg^A$?V9A@J
z)uL4(0iSx1PU#rsh~g4~?biI!sto&m)yK$~IaSEF_^?*j%)KYdlZU!9>sj-O4Q;PH
znPpjhYMD;oM&?@ePtJ@Px`6t1BV1is3#@n>Zw%h1h)5I>>)<e2=55)&kBFZ{=i4s}
zy+jN5lD{m!i5tlABy+c&^YSN#+ms5R@((M@bwetr+)<w~PhdIDwW35q`S7ka4YU+-
zqMg`>xbbWILV(MpJGuA!WJ54avD%p$BY;dM<U;*n7XiG|oov<~JMXrBHb4?P3q&E0
z5#NO);r_Ya`W|}U8BC@#DLK6p)j@(KW%@PpqJ8OBU80>3&K!PyPuKKp)9my4TOtJF
zK8&!ryMP#bb+DHZ%Vi|%`}!tRQk!RhjRJ>M=51bGHwpqVXaqJkD3ET6P?VxuS=Y)_
zEzmod7ygPT;>+rJ48*O0Vz19&QoSE5%l5|~5avd}7}X67vO+fwH5&^AwY2Ijgb&Q0
z@t%Vc#0)9|;VQ>ZiC0e?tef1>CK;_hg>8$G_({3NRKYbz{#nXMUERd>dxDAy>~8Ad
z2*eCZi36#_oF#04b7eUpo^6R)u8l)H$Q(*#3jZkXz~{D+{5_RlXZ1n+^gK58Q-Hdc
zXik2@PGGan!$@QMOS;1mrskGFa)JIUGu{{S2GibyvYI6URH_2H9nL%w79F+8PUBaM
z--3XGYjvGq(m%b%Wa4NNT>6WLcDvqGvX(O)lw*KCxc38s!xjl1_L)7q9j%DiCCS+b
zT6rnDHyxEKPZ6&@D3<OeNL!G6l@+l7qR{Fq)vfJayUQ@IBcd5{q^G3PrIj&zg3=Rd
zP@?vX5gIl)VS3jU-6F5c);n8?X)neM2fQ?<s>E%gaOymAm4j5R_n`#zDMnFJRO?h@
zG_7dpFFxe+8$0#`@20N)q3a&4lURi>1o+A_0||riBhs7I(RNb0Dk<y^SL_s)AwRcl
zNk$!`YK=FH(nYZ(i%?8fK%epz1u{;`r3S57TVxUM+0OKVuRR^(byW)lc|D2O8K=Mu
zv%=ioR?{;DS`2@+T>gLerXLNKOGZId=E?oFH#R>%umwNyQpbqO)$1>}t+~$H`Has8
zLZ8%;1)T%26NZpk=0@FRPLSDa&PM>?+L_9wpBuM6*TZ~wGyGq;j1eb0tU`nY8P=+g
z_3cj#^JuI%!<G1qxYCW{*am0i-&x%L{(?wMj@tko*$K>VIJwMEPQodzJ36W+j>7r%
z`K<8ECp+qQi)`%23OseRJ@QUp4AaOniOQ@$e5~|)NA=DaKFY&%Roz}bN6%1S`@^TO
z50dT^T9#<tK?8fE*aW^psBadB1PwnNSm;cozh#aU7}f}W%=Jo<0>CbjukzLcyh}u~
z@S&Yj@9rB{&v6cAaW=su&j6j+i|g#;Pg{}4#x1gWb8Zzn?oh<qn#%e{DwYr09Eo4B
zLeNBC8xYK-|Ku8+RbFT*JFEBsNB76P!G298-+F4##xW6kQB<b8H5GT7{U&iIzNYa3
z=Ba$LbXDX`F)}if8N-l+Ur$qrRgU&*h0)YR=;~r~+q)}HP<zIC>P?_dV91~gb#F-m
zFn(0PdkUI{nI8|%-=;4!K~L?^5~FOH#l!YJW)+#hI7pnJLH`nEtUpZfR^hOARQ6Rs
zy#H4>f{Dc&bG1Apoq7E};5;~SO*%e7na7L`1@`NVP3mC6g*^7a4!y)d<HKoO7XvSr
zwBftN`d<buFpTimL7gJYz6qE&C!GzuB9v8D!BD+TE4P<kHo2xuj!*E~vE4sl^Yst>
z*&{j9o;w5JV@H9Za5t}9<u@|zy-L@dH<R=W*)QpNIs|U1S?#Hc!(>m-{@g&BiKJ2F
zEk00k@)Jop*Znu<d>kd3FR_DKE}c>cCcha&Q`+kZ>v>fEEHYh%)4Rz3fr^t5o=G<Q
zH}<nfK&sO(;Gi$+JJ}q0ekO0f%X&M_o-#oQvPWee`&!V)0Yzf(Q2#hYh}J%DAJd*I
z^jmI>l#9=q#-}j!2Cx(!U!PH)xTqhCxs{Hc?Zn4r2Z_zfkFnJJx7Uy%#gt!cU-{S0
zMK;f*E62H^LHTpbqg8s6h(Ozc2<-2xU&W65H<o{0ROj(VUY2<OLOCoeqrhK9nQQ5k
zxuDy62r>xhd{6QAUh!4mmc9acu~(JLp>{8pEOT1gn9rk4@VF3Hz&gS7<Pdpck`^bv
z8r5AFc<;Kg<8|8YOCNLk4bmS6>B`;tG^iiueqW(Gv;8l;rZ@NasqozhH5NjtShZgz
z^73jD+x1GRA5KqeC|jbTh5DA)u#!c?KStv4OH!d6LvXRd!>d_~>>VIP-0{1BBy4|s
z2>zrJf&|94m_G&yTx`a5VC7<a9b8}0amUNxFZUicS=uXr^d3WLz6Cini@%o=6Zwf;
zt^hInl9%5U%#8@I)4rLOb1tMs{0zXR;TeEm?o=VrvgusV!$pa5X%GUik2wf#>e(Uq
zRj#MMW*DLgN@rfURv^#h<>xy)oo&Ue<HoNO#Bt!D&(C}<Mva{(5c2|FnOKlc>7m-`
zGVJBL>2fVfztsM=8(7#14ORic=-$qOA@|H-G^#ryZ_!aZamE=s)sEJKxRoa)XUxJF
zMqUs2Fv)uY!l7u2h-vHtr79zbDd5MJ<dlFgf`Qc0*8b}+4rzcrqH1hAOXhk5XSSRF
zlybO2n9`y&e(<~ut($Q)ht!~)zhga1mMlNOWv^&W57X#CP2S}iAZxo7z&yms<(IJo
zS6%I&bF$a>#syDycQl=mjQ(>Rac1Nj$nUTQAWRt@^UZYbvSjH8HnjWq58bN(Z^s@7
z^tEGrj(L#5@UPxYlSAp@XF#HxtKc`j`3Ed4pWT7p2p`f`0fL02yT-!`njbP|%+CN}
zv^GO`Gd`}Po&n0941C@BmU+2v@uQ8?#*rE1Re;g<4243;FOL}tJiW7~$ON|eB0Ryc
z2#@o-S<KwM<jB6rL)!`=Xx-#05ew<z7NcOHn5?j4om5{IkbJ#{n+kouKsEVT(K7y!
zw}`1@A%fZ<4(@SP9MKgK;-vC-{X2iPf)Y-;$LLAoZIHzRxbf$~2}#K|dR}KoM**ia
z$s6k@V_`_i1y>P!jCBL@28r`LB}9e~O(wu<_6-`<v9$^u14%AN!GWt1E5!Y4+pV0c
z#(7`di62<vWMb3-J>+8z4pPv{rOwZ1@dNL+V$crvqOG-(=?8(a>dm(LsbG<S=@Xlv
zq^|V0=d41_bMQa0+F2B5!$&pIfEu5P8UHwV?7Wdz!nUd07tl{)rR@~wa!5)%sZY$(
z=Q!LQNu=T}@Zp!FnEBU|(tjx}9iWkkX^9{Z8=%W17-{>)%AI5b!R(Ifo49-zawp(%
z(8p0fg}%R32!GXDvUf$;Nmg?&zlcEYV(GWpKvx`eBrLn?+FlNNf0Fuy89bzwq7Zda
z>fVgvcf|Z7f>4Ue+kVC!l-A-^yJ-1DSvxr|AI$0uVZDP5jP99UjY%3wDg!Rcyf92^
z0b0LW>)NV<x1ny^!5WLvB>kUth%EX~kCNyl8-6tg-dELpY|Fo^@XTLw^Eorn`Vcr^
z3$kmOO3F>I`XDH~FTh*5ojr3&CcmHnG_3w1kH~wv)km!3hz>9Ksh<P;qo*=Z$<>h{
zEw`Stzq0F9lB<btF|ur_5$eJqlykpch09epHGeDN>Fo77m&gyX7LRzChBLgEe0ds$
zh%HA)qWt;G1T@``c?4ptoZv3bsv-mM0WZm|e{=;AsCp}oLa*irJp<)a%3ea5C5I$@
z4-89=y7fVM)0e^1Z8hd$+TBLxk_g6MY**O!9b`vQHsF1Eb@!)p2-BH!f@y;VEN(Tl
zrkvcC<QH@q`EO-4NJM6O=Wj^wh-(^AYR-*KvGLl`=(V@EdXH0&VlW~+pff8$w26H(
z^}%}t7rT?}_B3W`z6<e@fA|;rsqapsbZx)LM;PvgE$$^zvO#^8p~p1~y6sglQil=u
z()UK}B5es@7UXjXn}7MXXVc-15fd8>X9fv}c945B2AwDc^oQ2wHOeB+hs=MDllfCq
zN$ob1vfV3}>JMy$`Hk=UVDr|y&f@BKM!HQ}3<vo1xMjceb=>wP#6ae`3__UfJh8_=
zO-<>Zl2x_8npOS~6vd8n&xPo>ch2cU105c>oW;1tW6lkUoaC9BwvWFk*OEM0l!D;x
zvFxua=rV3I{lsjLx&gH<zA4CPFWYn{Op0kQos0E~qHrB-|Jokm-hu-O8J`%w523NO
zp^y;ICzi}%ZVZ(=rr!Wy-MsXind0nec9_@6tFwq`MqvN&^q6I)@&$t?AA+Xe5dG-V
ze@vz5I)GuJF!$d|I6nhO3zt!+ZS%tj+>UY**ZE16=#7!|{MZ3CDSrH)+rO+iM&&kR
zX<rHUv)blIl9(y$@E)23BP>!%tEfpcIYjjCZ_Fs#gg^i_y0T&X6Gud8Lnz2%%-!Nx
zdRYuusC{-G%O`bd_62)W-o*sLI!9)yy_tZllqfiA`y(rS@WemaRN<f1!2UP52A5I(
z{+g8bfc-JYDMkRhn(fsY`&pdWSiVi5NtsncBAH#)+y{N`&hAQzpu-M^IL<GEUK0_%
zayukF9tN*9K8Y)f@1ta5(@a-9e4J-LMX2rWQcM}E|5WK~!l6Xg*uI1FUC4eMTDx7n
z?p{GijI@c#U0S7=8TH0cGK$=S|JJMb%cD2rc&`6DYD-;i%Q=?>kiRgy{&CR4fs*~&
zeYWm~LTCH&K-^s0Or7T{X2=rfvaf*pfU=Ul>cqcqdLc+!Cksz8z*=7)Z%AaWIAhtU
zVPp1N*&4A{i5Lf_!zlS0s*;bkN4F7-5q{()6FRv>(b^XIb0*q0?xYKxxZk5cN=Q^r
zq^L4fSzVXW^yC<y|IAP1cS$`V`fAcKMip&a+J)7)9*)VbVkijD%CbVi|2Pdfd27%&
z&ki#{E+~*F-qX_c+PLOrt5J%|Wb2h~<AU3Xb34~;nK<St)tp3kb=zTM8(;^kYhbPL
z+jj8_6_Gi<r147#Yl2b)!`|^<_L#dFKN-ls_d7bh`XgK4L>VvT(zYtofAyyBrJv@%
z?ofe{c1p<PY>TH!&g6<bYVr*DxYHT^5LW3^JE7^)oR4Ypq2<?7WqxP^Rg<X3=OYy0
zN&XE))mHC)O{?<)Q>-5Y#6i5PVzoWG)0gWT@^=6-(#vKDI(MUG$kF*jt~?v{Xt9|?
za+_-^(hjl!Z);l#mD(w$t)`ZrpZ(brU3Nvg?_EoUIYwc+Ga%@tj4rY9*dL}`@?MmV
zMDZ6~L|MgN15(IlqNkHh?)<8Z^IR`0GVBMl%qfaF08p^6HN;f*iG*R+|COH?-cZ|L
zda_2Qy~OkO`1BU~H)4Npg0^Fy0ZZbEcI}#WSLv-K<W?S*zx<jEtRbG1C1`0ct-=Er
znOOch>;61(TI!M{<|e+t#&RDe0`Jy`3T&O<xpN&2%v<vXP*tqsY~+V`6E||p?wa1#
z`?iM8g1$|CaUqXCg7Lj&=$4z1Bqh;`0SEv%G4lNzb6Z)c9quy3l7L@NW_GAn=>}QW
z@o4iN&ft|)Y@xbxG4jiuXwLt#?@1s$o6Vre>pd-1>&ZDQO4kH;E9R}swC2^p(*)e#
zKx%&n54*Xjob-FWS<*rEshS%}Xa(P}vIQJbOB~gjIBfcYgzJ##1F5k**MH&dEu-RU
zx2(|u0)$|}-3buf2@WB6aCg@V?ry=M2<{Tx-6goYySuwX<<@(o&wILiobLO5_nsdN
zsy2I2ReRSnpS9*%bFLbKlILvVqr*OYu@e9oiwOGeDMkX$%=eav^IF`M{aLK;O3Se-
znQtVK;2wT(HSM08=q+w}dF#0N`o=oiF|aY6Rr)u8_1uMu<P#jo^EbeOH^)ZC_cy@3
zjh?WObVnZg&$yzB8fLQ>AS+EkwOnY4?v=0tIiK{*=iyzDO$W+tjh!8GUTY!_I=yXQ
zUi!iY4Uwck{P=-_Kvl8K7G0cEXk2fBC~2pJEW!`a$c|ZtbKv19fT|*^YPwd3O-`b>
zuJ-5Kc*LwoLt8EylW|^;+g>BRrHAa<ooAE}SLN@t#Hz^qqQeDSTdKuODee0!4^z%7
z`DvE;VF7Ns>AwL8e8e;}$=2n>k_@M2>T8sW8?uv?)@(icH=TXFvz4BzR87qYg$(nH
zr_qBTKB?_f*vYr>mO;j3^%)(PIx-XQU7uw=ksEkCFEPMVd|z{}%*q4IZ!iG^cuQ|s
zp-Es!?>Ii-_WoDrn*R>~^?y{Ps=|lVE+?9Ecrn8iX&C3aEm22odw#hagMzPtTIOgM
z1t?C{@mlH0g<Z{ti;{xLf>a5y3>N(cNN>o?=a~wZbj&s5md271$E{da3pK<Cty%W^
z1b@LRya>7br9UGcTS*PkwQ$D(-IQ4+g2@5_8h-)~Kxvzcx(s>u2wLsE;-|2sRn$@T
zg6yb0Iei3vS}!%_y2%sD*4Ef>Kwki!nNf!dOoE{+z#d2;HeG)1gi#Jedvy60Xk}&p
zwl?B!V57yZF-iy?h7$Tb_$G1cM15tTMo+sb<4j-RCAeI05dcfv0U=K1;hD1zez6$y
zX&lov*-ct2xRG4YbO_#!Jk85#=#ovPs!bU;1PLQgp)u6<_>?5eD*Q?&1Z_miPH?Eq
zu_u+c)?hZVj3W{o#>*0+P6XU;-2W$G<z8(Nc=(dDAh-Stm)<3F-OVFtQQ3<G`8U9d
zF0b6I5B`Kj{n)PcBV#(})rWW^4RW7^FDol3Zw=1Eg@`yzfIPSPKhUYKsajG)81xD9
z;+~lbiax<KVFem&F(~!kg;Ir^Kbcg0_|Vb@Xs-NZ0%Dex;IlS_uTedV&C)nTrmT95
z)fomiA33knx2xVjjJYba-eL1FtmU|&lvKo781bH#%AbWTJjK4)`_xT16OBv$K{khd
zEI-D_wuc7grWyJYiRzDT6QOf|WnO))x9g8JjI`Z&dhfe^+52TFF{BRl;c_y&GU6sx
zF$w!ABxlSATS<tB$n;2nbjmRe@%e$&`MIhl^7KYw@CDW^3VBV}q2zcz5pWwc{ff=>
z;<Ep;G8dGZWuYld)z!5IXVZER;NhiJ^dbW=;|g&?ylxPkI5Sq7+IvY=Zzo3z20!$-
z!HCS>qP3{ae^4LSvf}n0%l!Pv=$%zD^@leD*VhThQ4+hV>L6^Jc2eyYh+|2A>_f^_
z@82DDuv8&NQMFU2#7B3o8-8$_k^}&G*ce-ca{J$a9*k98$$VFD_NF$GdSEc*L`$D#
zigT`Km`uf-6hBbORw99DUwjTEDo#|RIGp<+c)$1?VAd{bP_T5Eps={uNyse5To~>v
z_;dp$EjqC=Wf=X^-_(-cu(B#M63bO|15*tG9BQsY>XF=5_Lw!7M1e0MWfq<VUt3l2
zkO-*AeKxdW!AnyI(}P(@(pfq!gFsS-{IS!t!kw=E=OJ$5Vt(bh`u2PXUwq)=Ojgeq
z`rH8C1}U^dYR^~+(5~HGw!EfG7Y6bDYxPYL8(`XwfFo8Oe86F0X%x!Qc<};DV}yv8
z^&VoQ@N-OswokRIzK1`Z?q7v4-(u($YC)X}Vj7_xFf+3<(keAm4ETFbPC=wXZ?4oc
z!m{jp?qDeAP#2s~u?9#~{7z~;&t&+c&KdcU7B-k(*&yti`ELL+fRz-?-Xggw<?2p_
ziq56A4<Aecc7qup>9KW(%BV$phxM681pr_M<o!kIjN;QH*fht-?J{k3{ki`&ncObw
z`PgPx2i9SY{dGM!a{c9TWqB3j0A1Ns@P2?}0wx6jX)gV@Yj^%$??nsR4BNAD3?Icm
zlaUjS8qv`5T1)>?!g6*Q+co&a<w*=I$o6HsNjDtVsAF5=?jnj2+bHSTE^f|%Sap=W
z>zZxlV=Qm4bvztRD8_-_#GxZ4!WKO^eggF<J9|^Qo^4M%wHOqvH!Wjeufh&O41jEo
z!Gql%Xrll}c7-1nkWd7+w9QDnZi-x(#?6|Fm$d%7b%N=Q3fTC9Ck9rb^%AK;jrFkk
z4T76%@VA<J@9}Rw%LezUuYvpX=6j_FPj56G$Gz;>)-3JI7p-?;K7o%wA(<yp{nROd
zqWptIwZzGzr%Umcuc<)gJvt#T!PbY3_6=s98-0DqH~OzB<gjkkgSe+eiZ7)_b84=d
zceGqrKXs+Scj|ewHYW~UaNoLORmRv63nd1bB&0j^J-<10FV@(D^V8m%TP?EG=ll9F
z{Ew+%UHyY<pH_imkBA!s9V`H*5@o`t9J81&Uld|SYynSmh!0(TZuktu1d)dNc3}V1
z9QZZGFGk>}@j8Gbhq%%l`ztXN$Lk6+*(aUTVG>ay^=A|y=@O*3V(;vVh#V3!3==S|
zjfl5Ka7J}PIyMVjfl|}dT+GYoEfmO3yve457o3Cr4N`z?CmkF0j;Y%9%4JAzCP_-n
zj~@423M8Km6M>*oO;^<^y1=&f6f3D$H?8n&)C8Zy6x4V@s7ysmFOi-n#$=kHeZ_i>
zaS5#ZA@7hTqlb4zkPw0BcB3zG^Z2pzkYfS63QYDJ;0EbAl7FL%yli0R^s}<($*Y@!
z<(QUxEe2zy(pt_LS%;exDYn-wqiFL~ir;%)Z<Z;yHet`P*2sX@s!l12=A{Gvbx-+B
z+xxx%YqlcbW^wFP%41ZaC44x@7_wg(2wpA$GR}Kbh|=~}>)z%yl3blzCGSEMlkc%#
zX`ANjfMe|IDB7p|R5Ks6j9-Ed1=+FcEDS6R-Uf}$5x53_31as3hAx$d|HOWduA6x?
zYKllHcr`9p4;%bi8|&-?i+Out`s0N7k$NVV@T@&KAF|kO({nDMo8Qqu(=cq-g^0e9
z!~}MHk<apm&V#hc{ljq$;vXpl3+aha>PgTvJ_d#|R;-xv@|vvEp=vuSfT!Q{AM+h*
z_O)CCF;eN+eghb>?TJPN4|8+gJb&-Fw}gDCo-OHQdUh?PqV=E4q+-iR@Zc252pI6d
zu!l=_cXze4a|)=*o~a^-I~3Z=A9CNP+4nQ=La7g@>c5?oIX)ZL*Z6-T6%GV(yvu=j
zvi<`(_6%)Kn6QTtaI5DK5-1iKRlFg|wO<wz|7065zqI}Rp_$qgWqss`%eyc2SAO7P
z6>hPYw|KXBm{5sj)OW-URuvRzR=f=5S-h~+Xv4RvyprH!bnk=m?8=+tVH-?Wub8V3
zO7u21F5l#6w&}=8evS(yag4ZX^(Drt6Y;a_h$|#4BpEeD>0=Z=gO-!NAtiD1OMJ6u
z5hDIB3&k<6<C=Mj!>Vqs+P<U~;ykcfzue(-n45MD9@=dSh6t}x^6QuDj(@^dyuzI5
z_(va7wz9nf6pm94tmscqta2Laf<75U7*IrhE{@Wtfg$;Nv7hMJoKRwS_bT@W0gto)
zEq}JGbCkFGJx41X+(+}jfH5>=_kYJT8ZvVueGFL)Oc0j-H^A#77HTjPC~vck^XB#N
zGzTKT!g~eE-<116`W%|3&PwI9=$=D_ZuFR&eYQamr?P)Xr24O3Lk0MZC?ora72kHF
zUmrd<4(arn4MXYaPGeIB<eFH!QR)}x%*1w-y8`jc+po;!y;4Rloah<{koXNFHX5Es
z18-J^@bE|1sy5DRv<`6)iWpATWZELP&r&G-CB^6w3t@5yuLSfzKAH6X280g_7g@?{
zi9#*gnV41}UHQyI{1*5ueVW^Reu+A!$OV6^ZSaVYwDY3rX-Gu=rFJ)N03PTdj(b(>
ze)29y+YiYb(YUfUFe0q-Y2J>$Iq(PrG?|$J4S+;-X)N7uj4Z|ReTxO+4VwZpd+^^b
zJ0Su&>3#zkHdM6YNKVB&e2O7H3e`Y8>A9OzQy7NGDVf?+M?6%#8z;V^J5q?=Jlofv
zh8mJiD9Aa$mNIbkOm?G3)C_bgquK)zS`AF>r4H`y-CJ%}O|T6irle&dzX4QKzC5%*
ziIBYXS!JXcSwOkC{Oql3&NT<WlK91Gi{m<JiqQ>2o$w2O4LT9kV|RIS*+YuHYs}@l
z&P@3ai`e|LG60#abX6jQQ?;&n1gG+4S-#{Au>@S<%^pxzp(0Na_aR6WpRuOm*fyMV
z_9j(2o}Q9eflEqw_p50APo?OzN>b=g92JBDG#Si4I`b^v`vodA@6LF^^^%l1JQetp
zP7TZvf2<Q@#dBhGmL{dlWZ~2g5|UUFxUw6A1z4<EfN`dYOfIpD8yYl*BBgc&<euMO
zH2nrRIjH4aQhY5=5eO*Kp}|#i^&WmtqTw7PxT>U9%g-fJUkln7uc-ljoZuO@!6nw`
zN7)>F0jdLd<l*@YFHP>(GrvwvPhkR+1<&&ra=?%5sBf27u8Y@?c%u1LJ^Z6HpUwWN
zLsyoEr6Zz{ohH9Jp)WgCYVOAU`f8^p1c^dn`PF2DRj0~J8QFHVzf8uUyxVai{thv|
zD00=4Pl2fTqfU*znpc;WPEa3@f|0y~gNR4yOq+@Xw`8_It$5a_bbYfCcEI29Sy%8E
zJWYa_jwJjgV*ev*|J#qh-5lgCak^WjLAG-it&RW&$_Px<u}YuX+cr<DDXXz`<Mpd&
zH*89~V?y!F-b?Ud7ILJLR^=3#B;y&Drbs=_3{H&FK?v)Jmv5;*pKwKHs&i;TMmMqx
z>C;t}&-N(zund{5yPiio(jM!KX$LpqYO`Soym%tGh)X<M4hIV`J9MYY%>6vMs1<Ub
zKE?eZL+sX+uj-zv_CEr*TzYsVAw+Sh!I>AyJPXCQ)Xm7w-5-I_$)-NJmWW2{xW!cG
zJ<XNB0V37mlJyYV;GS5tQ}i^{2Mn_%UmgT&vWC#S6lD-Qo|*F!;FfY;z*C)Rp+8Gq
zrZ^+hTyJ$5)rX_e0K8#zDi_ej$v`_^JSb3Riz2dCX{>Zq<%{N>Wd<QuR1^YniD+O(
z<i3+ldy1gslov}awVownXbl|he(gz`b|s7WRxnI@Ayq&)FJ82~?CPL0&A}@XgGfk~
z=^VmYEY^Q76LqJ3dWVj&)KKTeiEQ*WqiX{Lb3i%%6Rig`f5<1&r?7#k71!YI`4q8A
z7~L=UW4Gc2pig!OcoGJOnU;V<VfZ|(&`qtw3ieOiEmrgOpt%O>xi7rZJ{>^>2VM0C
ze`eMI<qlG#4G~VqN*(D|=gK~<WoW+vlN8tY<)EhH^BWr?3pPis7U^))dy|jk-u`-H
zzC8H<al!xH5i>P()vXPhh6Sj8y|uCZhbbMe(>h(0wlm2oC*U><+1{4B-2J=<>@<_W
zgH<(CfmS~-w5;#@#FrKUL9-?sgSnsJf!Vqn<Z^AVgwZB^r`&=);+P?3t=HL(TLvBE
zvh=$6Qs=n|Q6!e~84&xsVtxSRPNL6uQ*CWB)g4Ej64deLM3gVP$~~i9k3Y*mSo`k~
z=Os-VKz5;}`&wf5^5aw9Yh9X7iW{`qVMcqPJ==>+!!H57Aa)rwZKIBqxA-({=M=tz
zQh;+5mT{^57vTc)ubE3+_XzppxLrpG%>G~Q)>nM07l~)b9`(>}&u^<CTlMJ+T0=4o
z@eVZVhH9yXC%c~+jwYzg#mQk!lvmx0k~fz`XhR;3IB(kq&7zX8Ua7m#;s+_6_qQ;<
zGf71J5>^Br`^o)tBqq&_{yt)|OGIgW5j$XI)XHJPF?$*)l0Hw76P~n$#vsa0r#C9F
zRz|?i4lWf6f^3<g;>i$Wokg3uNVRTfp4?%lP=<;h222ck!|~!jDb7*vv?!K*xs&*q
zidLm!hw~Tdvv#dHJc8Tf<q9JVAW?cV(A-sbZy)^G{Vc~8B3xIo-kM{%xw=?*s>&xA
ze{b%JGq<l+L+F(~`gttpwXm6M7R6_=ERsuO`qmX`4(B6J(bA@?vCUa^hVnBZJ|JA~
zVlOhUDQ5U<eVEdm0xm1p?D&WehNg#j9>hdM5iL4QlLjW*kdL4UhlJ73g-RPGL5byg
zZL*3Fg3=&&3{Wkhuc)|#4bcd?2)zZR{YN!%JV-+<c~dIh?nT*)rp!qcRV>@L$|i@*
z4^a|?nJ-RJdd+TqLOjhh@D%KSb<foxrkwsT>uB+_K|j$hK4ng1l1iir;cfu$j;ikP
z?Etwi4a5%By)O#rgCB=MN*_5(kn{2W&3mt2y>j4Jc!^7$vxI)^`^}0|as3s9IPVX7
zU^w7kb5`iE&$evZuk&Hpz~GvR)3E~Q$Z8P+D}PAHB=ceCFQKVC+{v`~8!O84!Y~8~
z`3pD$ru(4j9K#P?%vO)1Z5(j{${<(Sp|$;jB=NP_(Hk#OA)b*>+_5>J#9B*Kr@ks<
zo%%A<WxNt=^1BKE7J%Z55(gDvu<1(PBK<0BHd6=7tx*nGh9E$`#l6xI_bpX}zu$!7
z<X_sfU@-?jNJM9dy$fSiPXqAF=u2)r(*>E=nlo~^33qZ@A_+YYNyv3mKFh<4sxaM3
zBQvh7=&cC@--5Z*NMC^jC%>p>xto49Oz8_=4UM=>8?A{Gh;I}etKR$uARcOZbu?o`
za{V@vt9!>ii*`6e3F2;OU)oG`UA^>X>?k|?g1pfM&IvEE&9-(}(x)jRc-5I8r*u=H
z;IjHOB!nBLShAOQuXH&bL`CM%L8;k?&0iRZ0^_hZLE3$df4IL;ugrqu{%R)#>%en?
zPgQ2K^#-?|%*qLE;fvfL(+gCT;7JYf?6k5P=f&!>^qb4lXo)}~Tw~T~e`J8eq|w*Q
zmaMIHwSW;lVLo-_hguV#^TqO%)+^`6+6n72oh2QSZj8JcdN+%*4oVXHNjwVb=Z^U-
z5%SS@5)pWWaH>R|2j);We{xa88h0&ygpp{6tTY)ZZ0bql5$c<SX8hhutCBTWIb{&j
zZT8|CpVL~7Jvd7qZh||zWI;P`H?VES7&C(-TH@^OK*_(K(N+2oPZpUQJ&Pu6YWfL)
zlABUgd^DHBAFHD)UCnY;4n=?BPFuK}bO#fwE`NxV@gds!_F#mQ^ek9vO!&rPU^D8O
z#L*+e7sX0V@si-t9m6Y8j*qi|)_6ehFpQ)P{P^evqgo&RQ^S0+u|6W%gf~A!jER2q
z=){fshNw!D#t)O`R2}~}AhMPTd8qz=-s4>FRVTeU+3d$%7n5KHEF_JWR+z1QC7&&K
zA{b!M*R7Tz6@Hp0wBd8u^7rnw!U_6DkUK9V<JdhTey;?6BUzH-(yfDnnAbkb_iCd+
za&=qOo+kcW?5#o~+zU{S-C|!VdGtoRcm-D@bhOyrdDwKWS8RMd{OP)`{aBZYCYsyf
zzI1T;@^GJg<!}St60f52E(`Dp@J<u3SKAKd>LQ(aN>`9KyZJotlDqP?f8JpysvBzx
z7N8FWK`TJ--?|atpib47GK0Qx@cOv~*R?AIw$|A&%JU--GXDmc_z}<6hyoy7qSgG3
zNcgiuiAL0;TdhtF&8_R-AhYZb$P7VR@|tnT;?=U)C729W5$K1jFsyPCL|U-KA+ge9
zotFQP|9a59=tn#QRVV5I{j57NfFId@SC;e}kXXXrGbFei{_v~N0X%AD(Od_ruw?wk
zi0&FnE0v)P$^vCYiHrhtis$dJm(nBVTx@eIzvdC)+KOsGxW`CF@V@Ab(L|lal8R@f
zz~$3ePA0?n%MC;r<pq_IH7}=Jr$alhF}+jWA~VSiPr4Z&Ocn<cf$@KPsQ#o{;$%>W
zjG^f@|AwSm_dS;NjI%%t)U3xXp)ue;f>9Ko-h@~p0e;m<#5D_h#Kw5{fh;s~)cYTm
z#1A)RC0a=p3}j9I!jx>JF<eA=5(5+$MG^zO4&M0G(ycRmeCzh3J#(42=VTusxs+2t
z#RLPuu`agc!GB!hYAe=r-T|Go*4H{g>Eu^N?gq+^3Syi6xpGsi+{G0|tyQ(xXITT^
zdwKY$e&PVXmAjHB0Y6|a9+j#`_+ZEN**-6XM$hPQR`BJ02N;ndQJU}ca(DKhxnf_o
zc&qI$O}hKq(RKIOJTGo#VPj@P)K-fog7ilg2CG8sixSWA$2yjuxozVTSF!qhMd0;9
z-txz&3-_u!XkVr&48N4UW$oEIibxW%XbOJDI&yuv!YJ7BEu3RW0qpJQTozl|F&CGV
z`?3~>75qdX?}ATjkB2;L%Q@yDCl}nz*gQ@EScgG=l;){;r($M9g~egZN<FhivolvK
z^U=cD^RVg^pD5?j=%%bp@N4x{nd(yC6rwr2#AXCJ_;c9=JWmE{b%to7T85Xd3O9+B
z)nvfw`!3Y-mFIb(=v?!{km6!y04_kO@E`fY-}45@Zxo}R!W8EMgR(d{)Q78IxEtMM
zT~&}faQ6zsFSoI8Jb@$kBbG6pZjsYH8n26_my@Kgp6O&`#_>3nE)Es8M+P&@qXY@<
zX&!5Xcd)&-!iq7K3l+)cqhK$)XxXk{R3d>-M=!wT@7*Yve<19<{AG3J&<|na+9Q!E
zUuIA29th{Q`s+41X0irSJx<U04Oj$vH?5=m2IL$QlU5y|-)NKm2AHbPhC=AAp7_as
zuUEb@hnMEESfxivdapeig>Yj0_`5LPDn2OH{S01nVvBU6Fb?{&ekdV4%9OoYb3LtA
zJv6-{31yO#WtZ)t2#|@v>mAAcP?{5!?}sUNkJOTxxw;O4m8NHoO5T`JIr(4Z;%hb?
zc60q9ty;MchLk*k{pWdG1m;1H`2ryUu`eai*S(sVp^UrJd<2BnRaKyU^<;-P)Qu57
z!{Wp%D7R&s>#!Ehn4_M1(x<w5w@Z<W>uk?3FLWo&G%%Q=+a!3*7P+xqPtuMca^gFc
zd+TU#Jo08H)Ca*Y7eiIk-=e8~ZW~xVucbT^90tKEE&trc@R$4br(F>~T3s_SD66U2
zO03U<{Z$U&mA`_z1~nnkMoFS8Zb%35*WN2@6}8JB$BGKclD5#P@AV+|9_8kTlUp%*
zoqIu4lRy!(<V`iVVc2PC3jGiyx^y}4Gd}nye3=8)y23>X9{u;Fpon(&$xye`;8NqO
zBf&;DqR>rqn37_i`dDC@I)D07eU}K`&+fkNA449@d;y9UPm%dWCRnTKJr2U8L)Doh
z9%vH*10~8(V;1;jvw05_w=u|PQ*-m`km40j^uhK+;w7Qu!BJ2}t`<<0YHr`PbDc0c
zy#fOS3a&xvtAQxBj@E9>-TNjBi_d~=IrDamN|<s`xR}1}*a<=0#g%lrJ{k&j3=U?!
ziTM&n6}>=9GmLHvsGy&>GQ5N<_0(Y1<_!I2=+Dj97v=b-GC_Gs_#J}SYA2aiJ;D)|
zR^L3d_|Sth=c5wXXTe4AW`H>0;pwK&-6LGxn%=lJf%!rrh${kwC(%g~5BLzD*A|(p
zI`^X=xz!T;)3$tZmNP&lZ2#q>1MT6Ig_=E1%hV2MHScXS0FF!WoJ`T{`cRca4sFrG
zp{!`#&Wm)!*?IVv8gb)^;L<1J8>lMv=BUsUdPeWQUnZ-Mc-YRNd(xmDzpf}}Qjb}*
z0$}qZL(xiovZ=eqqU7@&aTN36%~zjRAn*^nzHpnG1<igNJl+t|PSZ2VBgtF72{^&U
z7tvA&zQgRL%ttf04~-P70}GiDv8(x^H_<eEu!WVCUz5*mB5N$=lusLlN!0YGvOhAi
ze`>b)ug@#^(|im))oc05W<;>~s}CWCx&Ey1%h<KHcdgG`)vw{w(;T<BR*X-0lr~Ss
zI+7&ewDRy-lM?NYiW7hCsE6l=_$98tx0}#AOnyqDgwXW;yQezH4r>rJ5ufMd_2gmL
z*5ZaBi$oggi<eP(&_Af+|KHQ-!o7Hd&|G^gOl(6BNTbJC8|j==NG<sg{ZC<+B9>2Z
z%(4Rzw6lnd1rMRUs6_OgZ?X3gxFk$>Db&v=u+_^*6RF6lgwKGq3ZzD-e>Psm_sjvB
zHFO4;ZbOB;Sw9hr7V@_{zyHN+_o8ydER0o(fP_|RM;`b^!8gkh;EV}H6d75bYKD~_
zht_F@ehQ+Qp)I_FF8$L||IbSwQ$a$O2Fkpc^%&og>+_QI0lLF)0R6D9<x!<|P*BQ>
zl;jBmBw*@_j$`ipW3Eb>h*<M<MeghkCbSE8b2arh7o+*tWR}U6n{O9l<<TX}K<v+Z
zt0CGat}9lqD^99JAvb03_Bc`z(-~i1g!8^kN%}ICVSsgWNO}Yhvq8a)k8*|p9{2G%
zb`LAdf#oqBA_-U1h%E_YA|g3ML0#biN|kVeWh=2Ef?-Kjbt<8Q<B0%O8kmg9I*+6?
zP<Sb<jKce7sT>3s+--Mv;?%?{f$#VwMc9`DrBC!<#geVX@8Ux2_Rv{L;aBt<s$d>K
zbe`hVIkS#!JpI(;8Q@P_${o>u175i|T?s}RZxvBBYc?&mr<TEJ%O&RY=UK?4>T2Iy
zXysV*y~gQg<?0atM@Et4kw%f9vm<EzeBtv%om^~8tUmOPOm-tlH|<1M7V}FMr}Q-d
zb2LM#)+whr2N<?=roO($i#t4_<oanOxD&0FxDe-U@q-RrmKVrIIQy#vuczehqF^3`
zj)b^*3oGhKFr(gkH7HFx4ll-Z;gR)-CR!W)$btExJ&;ui=AghGb$OBvHpmegG((yH
zah9NFcqO&I=E6<you6K25q<Q;Fqd&6FN3FIH%m}ldH)7lARZ@}gKM^yPP!@XL#Iq^
z78pT3KH3LP6%z_#wEMr?cD3(8wd1EzFhEsd7m2$VcB9uif<(wVgl@(cgZdFL5g`vJ
z_`O0);lex8eV>Uxj<NqWJ3z1;Xxfw+Jh<yhAY0!Fw>(l$dUv%0nVGc+%>Spj1;wW?
zz$VD7>D+>zOX$hXzGVMON$Ys3nokXNiI1$bJL0@5$p{Rv1ZQ$Bu^(Hs@8?SW1|*IC
zbKlATgg^f`e=nEbQq6Z94}Pj0z{`zcu`X_tjP}>}c!A6!4D)oJbkc%M0zs;eXFvWh
zI#^2+^S<Q@pL4shn-G$j=R@{naOcGhcD4Sh;CXqP4`JCbNfsZfKCF!j1J&ToDdXIj
zbf~p1Zalt)cFlm$ZYaNGN$tOA@ge(!3BU;3eo@-WuZwqVV+lAy|B)IjF}UH)K92Ly
zVNp1T&4_;y!3O#w@&X*$b_V7}CnYi>7`jpO1M5NfGpiP5=xr?-)^xbpuW4LIz~P@+
z@pIcM!KVbE%c=$I^Mqa}9{5m`$@2Lxb9?e|lgORixD>u}1wTty*%Vq5RMEfcSzf3^
zi*LD=Gxf1aQnfxWGz=6_AL=?QB#*OK&|*2)&86b0N+Y6L$$4acrm)7tJi4-ha=qy>
zoZ_&EO1#%^G@71Ne{#pab<!V>o@y?cNXNSxxM6+>Q43}lR}jStZB%@ZstIA1626ll
zyZ+EZO_ZL^HT~`!v=5sso@I-OdKcj1s-~pT432-T$<fvbzS=eTh3C;rn?A68&_U8w
zq~#i^)foe9K&Z>AkCEIW>7>*Tmg|fQ0|dyyt6y53<!(FGry$2y6eQW2+PuOFZZI6n
zdkRMq2#H|SYKAlhe#;GiwQsUTO*~rWvUR24-sULVJjR~l;{YOeL-F+Qt#EI%HjMtE
zq@}8<rP0%w5#0RHjQ71LN+vRR<@;?S$(r}CVZW6LIG^tf6g9J^^|QN;sd{1j+0w}o
zew*WK-!neP-Urj8zWIUOVi#dIRb5wxPNa!D5Pe#H3Rxx1;pbi8oEhRkxi_|!zXHpK
z9q3c6i}1CM=C)bI+U->iD5Ln5!IrK98w5S3O`{a}E@8KkT)Apw9B<)UJY)PIQ^-_o
zO5-O3qEq(ygxU?~YWd}Dv3E;%1y8;*3to};Lppo@sVDz$9L;}s3_cGtI1k{Ui=<z_
z)K*FTN}}4VO}v~5kxwih=a(CG!&|p)6;}CjVA(-lwITS0uHc_m_PhH@w>ca%wDe0>
zuwhN>hmWb9OY{-;eM5wqUI82>ypPUTg7?aqQ&p|leta0&P-{a}FEb>^LInSmTl~un
z>|e*W|8>Lr^ZCk7GK$Mm)gGw@i}>JgUhr)QoG0IRvdg=bXBlcssGFN(je(C<H^jHQ
zPf?*xZMt`Kjbu(iOLDBR>MkM67TWtnwmse)ndQg#Ja<3$rLVdQ?&bFbiNW~|+rPpU
zng}wkR;%vG<G$gZ<Pf5cmEeUHB#1GVy5%u-U-PX4>A$9YFHPKXT*JQ9b{{cCOcVDE
z*pv0^FNEmMk6>MWBAg@{oPZiuh`l^Lxza6+wsMsB9P6%heU%UX>nHQPMl<rB!)XZc
z_lZwoi&J;C6k)k-i{5axEYeFnY~EKdvSVSQhtk^nw*Os~_4`&M1TGpaivI!^QR)2>
z!4LDM>&~rgI(1DobLHF3@FT2j5U_qvO**fO5@#uM?f9u`wm_EnTuGx<@crAX@Z*Mf
zkz{>^${4o!G;n-!$)V38o6yk7my%Y>@Zhh+5p0_H+Mou7KxaTehrn#=wscVF>8wN3
zY|{<a&MtSar!Lom@*LyQ5@Avb`=-d!hhp09t-z}Ej{0lYK9>!%t72O*Fx@3SWp)2I
zlk<oTnlbpIPj{uXlaqow)FczX0kluF$<8=*Kb0_o0&`=*b$kO`)Vg+o;!Y05dT*Ab
zw%*7na-$L(_2h{+5kee>$G`KLKAAkbdT2DFR1O#f?ep16bl%;tuQG}QU0@d?R}t<i
z1ZTEleBQ5$ptB9!qZAjjO0EEV2Ws9mr4~uQKR0o_nYgJ!FmN*y)o8fSlq_1wdYYPL
zAjUhr(W0?Vb?UJtA8?rU#Ve`HQFZ43epU|o@{t9)?d1!M`xG6JT#Z3m(W)CoPj`p5
zM@gb$A?+l7Y8EAybIly#Iy#(~w#7VEH(1w9pgOJJ0IV0uO09V83j<Zoh5;W+bS-MW
z%EzXyGNoAUL35EJSVq-bfxt^?{>!Qfa>Mo|do)|&PV56Vrq|nexn~O<O!KO~!Z0kz
zoC;<@1?NR@<P8b>!<p+h%Cte)Fku^vu8!;=s?T!5;|bh+8)|to*tp}G1M}>kAoXF#
z__7MC)RDSo;e=3dI>f}&mEyY0odyO&c+TXPMXAk}mX+!>v@7PWI&loyS>zZ$H+;0r
zWgHXJcPFX{Q*|;f7Nhcq@uc?RFh1d28HZg<O$U1Sviz?|{fOk5Z5Wwn^@1<~OQjZ1
zf$brVO5}8;@tPmAV}nEchYq@D2*UuA4atlQ*(t2=B>ZMT8xb?{!5f1q+nqd^<M)|z
zzM18nT5<nkcl-xEt4JJ_P{RS4YVoBS7@n}7O?tFHp(HuD_)bwl%`D-Cf2LK<?b4>F
zo+t1ql}-|O#SfY(Wrb4PFZv4U!b7ckKGwpURhr2CS)RvHf@w#rktMc$S3W1>0p@YO
zP(xSP%ZjMC)n6hPPnGCcvzAuzVKS0ll&2kr9^&>A+W5B>2bI2s*naXGfMV&A=Djs1
z3Fq}WR(1k%pyq~%XE^i5!+dN1H6G?k)ht3TJ-4#}wXIO6(<(}t5nt}bPPZBBPzdpV
z8=?K5pBMZy>z!tPfmNP{q=Vz8k=|%j)_n!T?A{!oj4k6522q8;XWsAH?h(<k=L!$Q
z%1!O_XJqjqVT&Vn1qPts03{{$wXz=PAFEoTpOhhNj){I-kT70JpJ9TA7)NPZUfrFZ
z-R@YyoF$K1wO(j|gNcI?d3cg0|4Pvjt_NCYnKa_DgtdsY9ie{F^9ii<R@1hB*DN+W
zh-NV?`zg(R9*Vt;J#e|`l}_9@uLsxN>4=L!&*niO81v{=Dks8;i%-r0yP))Q{Z}(`
z7LozBguxB>+wA4;4APnu-Xw;#kCOpZi}Dhv&rPFd2eE@zWtwtm%j6Pxa&7KJ5%u$O
z6oUqE7s3OkfXsY5Y37kRX?#~6%R|QY3m9Zk!(G~HXO{y<-S?O7#}eO|Vo#n*`6LOD
zTP{~%o<Oq;Oj3{gJ!%bTuJv1IA2qpWXXEGnQ6_aaH@(DUw7Q+urWqGaq8M2~;%~s8
zMlE#1?rbYigQUR0c>z65L&|xrGVV0lO|lpNIWpx4+!9350?wJ}A=qXf<@Hl6JcX_1
z@_+1;WxS-aRZ@-K<O!U;4`y5<2$|6q|M4>ze#JekC+5its9cY8ZGbn&s^Gm9I|$v@
z-m8mMcgYZ(NQ$;fN`=?4EBEu3cy<fp(8XP#jVOIbj5{aZo)<0SEq|}Ox`Y84!dw9?
zeki9a?vRSbplD0iZ@}!>q$gWG8)n0F8TEI&J&tV~ikX*gl6ZT~+fsL&5Mnw6^*&$L
z*fCaaync!@rzg25$Yey9r+J1gSL3EjmLS|ENgV|hOyd|)S8d+p`94E42##W>PtOu;
z7ky@r%PKwN9PiOAL9?=quC1=eq<1s)3Up5l@WgBu0z*_<oF$AJp*x}(SsqWBL#Z1+
zF#TB_4GqQBma+obq#md~N?<u_y6KWzcbRTPSj>B1#S2Uhd{BDaam%mp$^b}>QjO&h
z*6ir1t~}CkUQH&DkQP+x1&jZy0+^#-H#_W`6R0p7l~qAD=OiPd*8*%ZiXGB^G%uFQ
zf@n;R3y_2F%Fn;p8&=WARL>@u&O@X*xaAyQn9Ore{oHB#Np$TpHQR~fjl7DM*9RE_
z%Bou}!-2J@p2kMz`ydq8y(XX{?9e`_eW*DSQbozV8K}SssZyzYNK(qXSRVJNNrYu|
zT)F?Y{UYdv<Jam|s;i|HT;J4WLgQu<&fOu<BnYBgs~we^SFHkFO{v7-!6`@Wcp-Zp
zmog`6wX&pd=6}Q5=cw8AK|2z_XhrA4;E2d|t783u+PvR>T~Uw#D~F8Gzg7L1q%iUU
ze@aDwWZ?dYHX*r4^QfLhS5vB5gmftSCF*BM-A?Uv4S(&lny@ygh}Bg~m#2hThD%;R
zXM-A%u*3UI&Z^^^K!J(V?7kqjXA^siL>%RHpGle)*XI(v*Ug)yUb`Rm5=7TRV<nwc
ze8lf2$$xkr8=;(+cc!f5e_=sK{^_mIaVqyuVIlON$m)MQreo8ZD|3{_Zfg9N5#oFG
z54iS#YbaehNRY9!U)g>eP?9OEtIm;mn)#k#uDE3rs$Ps+c^kya3f1RjnO{+8iN8Co
zt1V6@8-^u2L+oFq`JNF@_EY)Oj4lDZVy-u@VDz?1Pjj8&uTk)Ib-h2LKT@o^v?VG_
zSw3!*@D;=;-7oK9u$8Ss&I-Ra#U^c-^2<)er=e%R$GP%2p$2;i7#F>+)?)<$>oRAf
z$8OnO=j+U*`RJ}&OT$$OwU)@{b)RJQqm04NjyGmgoH%z&k!fnGF{PCfE%7tAB`O=g
zFfRpuZt`X|ydPQeEVz$mjgGoYgiu=P9$ta3^?7Dkv$-Yo=!_~ew-w@8LGcJ$PAjKf
zTRFP?nTD&F3fcwgiWt5!3=Zyd6?P6Tuc6sI>7xDT`+Yk#5mCR^Pf0d)bFU}x0mdjC
z?f7*a1ZC`w=JK(fO}1RoXGMYIuj~fLI{b=LwaZo%GC_Tl?|N~MWFaf8hIl6}#v@kE
z{C{Ne{xeqnzkLpYF~~3z>ONgGo)9asPQj@-?<>K_19*sEXXlb`w-u$g_s$iFfFhr6
z1yV_}72v&4I&wbu$*0l!ITDS+w|NSlzb-EN4B}+@8EQRvFfS5-CMIuP#_*Ig_99)T
zbp-yx8MZ@#t`WqRDJ;cD<bb#6;A3LL<(k%lCGfrY2VLg7$uX?BB4q!!o$wroDc(Qr
z=r=!nq(SVA;V=|LXH!Yu_NgpX?A~;CnLU2W8SPdAG3MrJd7+?e^=%8ylHpjEGE<60
zR+ks>1w77+6g(u#G-%+9|3HVsBpY|n+fF9dF@$rb_w*IWWK#wsUMPbpns9JvCl4nZ
zMqZJEpG#h49Mw7v*t9wLtZ5II3vLGTk0#3xCe>z|em>~x;T^|XDpLNi@aWqUbh`j7
z2{OuA-f3yMmNDcs_(6-}2a3Y@!b?d@tA8ttSzG%MhTAtIiVIM_4U}pfVg^NnLW$Q%
zQ1K<(Ywrz2F;&GS{!8F5;cllrIvx)0M~YpsxMKMA9I_Q{jNG<~A{9MrPw~x(xG@VQ
zDI#pYRb^944_)2Ony)2y53+HfLN<<>Rl(jWJq!1`17EcKAXeNwbjqX%!GZ1ycp`ZA
z*~|DGJz;BuBm{c!%t=XO|26Fisqxvc11PCDB8`OIh1@n`dzc}LI#%-1I@9x8%-YS6
z?8Ib|iNO)UR2y68FC=_guXcGGL6yV=XWrJT1JsJ5lIn+XacK=}iUf=A&ZqXnm?#pW
zt7(_M4g^T(+*p)rtdnJHUlO)N9Xsgm+z=?M%O?Q4eok*t?7bp^JcE4`{*m|9bz_>J
zXr>d{tnS)HvM}qCJ<2r>ueC(&&k3~S)dxeXVuS!``sfmbbGDcDpt}r5HfcI`X?nYG
zHyEDkni8l6UJ0@N0=P<E*_fY==~f#FX3tecMmNx@Mh<twh#qAvo(FR>O=GNVVKM4+
z>WjE0>hHx1v*fH$v1Xl?(}8NzCB8`J+r!^qXSHu$Jmy8Qc3kd1%<Vlvb6-sf*Lt8N
zkpvpM#&#>2<8+C_o}_~%1zW&__h3hh2IotubIQx?lcN!M_pL2%W$)pm!N%nRhv9Aq
zF?$u4CXwDm7V%=f5?t-<%T*9hro&njd}I6|m1^e^tDP1xS-O*qi&Zo*qBuLGliS8d
zGvYx_>z&-4=Xbw!-y)mm9YS#YZL;T2!VlCT)v?lE<J9j9c&Z)e5)U*loR&0>Fj{)l
zlj?(&f}^5`GHih@wJ~_)7R11oq!ldYv5udo1N$6%OYD<Ns{@P#!ylYqR`mCOmQT&A
zPM_XfOzD1RiS^xx9nbUhc`uFgTJT(Znpf)X=DAV0B-b?hAkwQQfIl<8$7DnY#V(#N
z*vj93tWyy7i}S&zJL*GOWvo*BXW=l^c+BUf?W<7-Z}<!2r&Gv<lTeb4ytn6$3z+b5
zPq|%{>uwfkz)38&NN4~?ct3qG6!?BccfbZOGirZsC1c;Kpyc`N`04f`)~!T+*{4fz
zGg9?x%Qb#vN{ik3G6qVJ&B#Sh-%DIGRq`Ug#0%oj{hpa%)i{BnGdHPdh|XwNV&;lM
zagi^9Z{Eht%%)&b*bImZT3h1?qv_mK5d*vcijIA6IvoEO2ngMFJGH1G<GB41ovof9
zFzPzG*I-wCY^S>l`-9%Ml=>`ie6|0&!lKciH;EWe&Cxnf-912;e+v~wZu3-F8hXz9
z5v1)Myw-d%MvKwVYi84UU3KJrtcR*(idcAVjW6s}C<=0>4}e)90oU38qHO{(Xu4r@
z$SicB?89Up0o7z$>jQJ$%p!4M67=cf=P7v_LI~A^8rK6O#Bvip?L)U(<39CNDc%hh
zF0LJq?DxwG^lEt|%h<8)J4Og|Q}C&YZyXPtGBPf1Q?^=`kiRDua4+J>Si_#1MD#Hm
zSiqyr(+GZfLpWvbf~F<II<m#u0o4MEzgg^=sl*Z}DY=4}i@PnDd{PZBEIV??$2FeL
zH%mF%r3?*D<b`f~J4m?Kg!<;8cw2a8yTOdXh|kYBA_Fsn3sufXb6H2T3z_0R(ay}s
zKm=M&x2yO8zSH3-(e|hz#HcE?yAM?(iJ0Xy<-*lj@u^I&G(RDs-OHJuPmaAr>5lg|
zKr3~P=3#x)2c<P(Zj`aWH4XQ)Zw7vKoFoBQ7}eW#MrkD|Hd{gDOJP+M$Oe9Cfg*-j
zbI2hdr0jTb$k0xmpv{@bhddEy*G6MQga_~705@1w$7$P|u2Je+cdm}9s+&J+j3`g|
zcS+wsK4g(Vq!zw)yh*NRI1m>b_ey;`X2d;#I!3N&ul(;lUH^h?`|k+2|C3`BNMXKu
zi*>_V3^P=Yc;*5A!?#2h40VXSv!->;K~73REE2e=<uousm-BvbxfR8S(Sg78QY3<*
zzq$Mdcs$O-T5K7ZakFXsx`mYr>KBZXy7#Hq5{$uiO&!AvM?txaxIFGPv=l&@;NV@a
zTV0^|DytD6b|$bvY`KrbNkxm>*hF($Ubs;fn90QtZ+g%7{N>`dA5<qgW1YphWK2p8
zznAzX4d&qrIB&&ZP+c$W;hI2W1f_tf4<%_u)K=CkVuLS^4#1MvhdNcV(bN3EF;vv4
z$+GCo^)pzxe68A}YDP(<2roCt{ES?~Alf)GNF{Cu?Zgtr@8&--g;<*R3N_OP=xf@P
zXbEre#-NNQyevnJj-U8adQ|Ol`^b=|WJgL>Dw{UYCa#5Wg7Qq~s4mTvtlu}q)=$oW
z<3ou9vyVPfW?P(*nKix(Qe7nAHu+I_;%$a^8XJ~V^dPo(b)*`0%6u4@@vXL)ul}<y
zWa?qU;EO9C+WQNRZiz3k%dPg(O=$tYIIc537ag|g0UfvJE8$+;iQ=5+CnYJT2^L<8
zb`m~o#J(}&uf)B%Elw0bpS1qIyrpj%oo850(mDo`d%eX^b38r*Vu0VvC~O!A<i|*K
z8hba!$Q)^Lk74GT=LCRU`H{LirWwNX4=B@0g%P<QInM^(6yXjdLFekDz`+3+xxT;f
zBQC2CU89kv4*KmG{pf6nUO|#ry&SkJk=$e;{W?X$ogyx&#hRHsJ9|%JKadL+$j_SP
zqZ7zMNpIHj;h9_L8Bu~7J4lLfR@$wOKA2?;-7I1sKCGZ(W{<=kh=w12%PO&p6V-AJ
zp)Y-J2;Tv8#J^0miWJwLv&5W@8(Whn1rR_}e)XH!hhJYS8Q&a*GVz}orBp+FqZ<9_
z@B^$#|5Kc}c<OqcIJ;PMV^wN3r!ibn!<sO+fsW=~6z#}|N2!R@VF~Ur7*r_<J}jo?
z@Asn?ws;LAoFqwG-rT3pvqwI`heAX;t@X~Imt`fP8^0(0$dIC%klSqX;b|n&`dQAU
zauL7w(<YDcS<OQlk3my10KL46Wv_q)LX4RaxreoHrZaAh?LB$;k&2LoO;Yx$z8`rF
z?bBF5y;GrqvA!B3I5ul&jF7~LV9mJQ^8R!&x)xwx>X#|!{788txN76GuY0V*^o?|e
z!MLtD)WlynNc8|%fEemX?KL?V-qqL2F!Ola-N32|oV)IiJZ>o*;8sMvt`MHysf~|V
z*N-$7d-MKG%sUw}G)DkCwF|$;MOasdW8wP`do|LRvh$ZC4^(uEgo^>=<SU7;kTJQN
z3c8R(!z%S8<!;d-&VvdwmwQ6okMul_M+aj@dd{&uIA`l_1%}>D<>8&gZxi*>ZJ4lP
zWyGHFqO$I81$Q(r#=n#FYSuQ_t=M2EOeLuBv9H_^uN7PnuXWp45!HS~Vks8$g;l`?
zc&JS(_YGwbV;Ws*=na3iZ6vYaQuWZ2V{T{wEzxX-ae&wfAVYDX4rtwJDk$%!Dj|U<
z(m%9gf7X%x^JCh&*9iQ`oMr7k%Fw=dDK(-v^<5Smrmjqpo?ISTx-|N_y<>)P?oV7l
z!A{AWsZ9(Vxe5HaC;B2tkN_U*20N!f%d%c^NvEs2n|w3wH-P0__hY%Mr4QV(G=13B
z;gzu{Yt#g!ILC8SY`Cuns~GlhatiSge{*q(%k{asge2%Uz;4E(T9cCzy^lSCb13~p
zNT89bbz05T%kni!$&O6$ezLs2zh}v$uEr*Q7<)hgZ~Q?e3c;13RkU!p)Do@M-D7A<
z9K+UhkQ)35cG|X`vBMQt%%@_cU9tdHUs@O{lS!_|zaVdz&E?97%Zo|F3eplILEb_r
z*y-f*b7fCeUsy=iAJ^C&;+>8pO=ymWX#j~Xh~sGvbsi$V9FM1n=LB_&edku)6vb5I
z{>zM}e_ho0bAjXk;xTc2=vJiEvDCCd%Jl2EMEOo|=`WZ@rNDu~&fC(Gb}a3~OFqR8
zo$W8{^Z~<GS2zeEj{}cx+$7@wl-7xgvpT%b%UYDw^3uI6tlpO@Dp2w*?&*1Q{0PTW
z$(wR0>lPT=GENPw8r{~Cal9DBCr0nGm`2=puH}~>hRz2KKBRm-7$RyNXF4A;63T(M
z8`#f>B63%P@A-t!e7PXCTwe`%T!~QSUyzqWulfw2-lbmh{TKyzEU%?WkG_mEz2#V=
z8tp5`iU70Ymw6lEYm}uuGxv+=61^3X{bw|_HS#tV8XMhvA;1}oEn)ORgv!ii<V-kS
zdBo0_=$Zfu>*0aJu9FoZv>L}TmaE&I=7uop+Hk3sy0DK{j0SGI-Dy9toC7}{Cg4%y
zLi@7dbm@N3f@=u7=o&WE4<2qcQC~g*tK%-maJ@X@Qbc_vYR58f9vv;q#V3sJtL)ie
zPeduLxH{q9rwAIecO%X(v&bONRG7`J<dnwqL&y*o*i}VRhJ6$}*{;AXW`0OGb=;dR
zXQW@lW-V4PK8?dNWLB>l#C>es&Xg6R%|tmaqEsyFmdIO^PQt(KPkr7qmS5O_wO%-Y
zmpbC(HWEnPTqdAP|K-SBEHFpU%8#(~3Pkoa;MHwwxU)R-+XihW?2}247!r8vCBXzN
zLng+v$8NnTGTIx=s~IFJSfaX0AA-C3ngzEQp$|1UK>f4N9HuS1X;e_Jwe=D(om&%z
zC7L)Y;ARw$#(MhbHV|hv5jCFk&xB9F07Ol?&15<=b+9Ocb&&1^pC+@*Cc1NCC}7hp
zCZUr&=3$hQgI%#TC@|p9J?j#0k+ItDy7<+^GfPE+X%J!h+?MU&6LDM;vA-|3`OYPb
zxvK0udiY}b#MiHMN!bkkfWA+JJCJcaC2-d|mvIU_!e)-sWi^F1)w`N<ABR3c3GQbJ
zN3M<!gMbrE)>+dhyUmS{2BFeTFucl6f`JYx1t7=px0+v=Sj3Wbuy6_c%11#gnLoBa
zy)h0rf|7bV?@eIf>7;B3qcm0pI=!JX<OQqj_)cvHr04hxkA{c8y77Iqvak5qcCFqh
zZMrtOTkp?TtsLDzZKgY%!Ok9qp?Ty|qmlH%f73W#!B`|1?FVi^gxQ`pXt9v-MGf{>
z<lV&&x1jC8tNcc^z}L%g2Tl|m3hrKjzP2U!W3?M!6354tv1=@#XQA9`G%oFTlDPKI
z+;5CC-d;VFj0L&nw#E&jSB7XIhjdxnL+`v#m7`9}l;!0|RgTh__MVG=Lu}N4Rq14v
z8&QJVT0n?D)p3IfweJq9+mhkzk`r*l3apVPY&TWZ)cc@LwPIv_`f}ItW<IMs_8l8)
zQsF3N{e&#043a&p{&1UcC(+w+ca3T?t0s6tLto15*2S!uv1IG|@Zww`@NGL6v@-)&
zD$c5+OBzk8^9c0Y<7KJ2aka$G7>)4o-X`D#d0H~sOASw&Z%=cfq8M(h-zdPTA>q9x
zc8uogmzYlSQ%CEq#t?4|3x)N^aVNVEmES@TNTRJ93r$)twO!QIx|W`}nXqBil^`Qe
zvTbcSD|brWK7m<c;K@Y_A5!)$d`{o`VPAg=TegYg8}RJu6lvTTay9B8_3Lvg(9C0>
zAu2ag4CIOAE?GD?XpnY|p@~*x2hbLF0Gx|T0;bPBHJp5aM1u)$Gfq`E-a70Sf=u;s
zvk0W=MJQbK+Qt#Lh_rg{p2}7<b;_o{R1Q>ChPx+T;Y9}zLpWp3axO0+!a1=b^|R29
zQNWIABeJRwI-Yf@-f6WEHNu-JEq_zI&|ii*yYfiB!~*Av?)QWDurNgb>*9^tuWRJM
zj&PSGL#r0|eL}-lu&WbJwSr-Dwq{6K>$PnI(${R!6%|%W3hUE_4sIg1EL4f&6i~WV
zv4*sT%e!Hu0HiXoE5~53MVa)5tCb=UQu;f<-E+3>{j#V^n%-#_6(7p$%Dq>^$i%0G
z(ALsW*RD|!Hi#*XMA{`;$E@NzMlmiNW8alx#ru;zrG`QCg=Q*i=FQd0INv*a(r*B-
zP$E&6s-7ybzjP==M*!%)^F)PMTic6e{cyV&@oe!*rC@A|@K5GLmqoNialR=yNX(#b
zZJnO`4H)(3ik6wU^4>(NVfB|sZt?dO^Vp067HK*;r8cG0Vjg<F>vxfmfJxbON>}Se
z12(8WdDYD?`myv=#}El$%?3mzW~RD6_ZN`bC7qpliZYBZ>^%cNCq}<D2CaBM!gkQ>
z_&y2=@k8yGnOeHsD5CiP`)0>dB;f8X?~ymEBEcYS1pM&M&Q6u9ZEVyEwfgB6FI5_a
zOAmDfbyLDF56hOfh-dg?Nh>iVA+j}Z2xBGyL<1hGT2MMkc-D}@x=MtV9E1lYQ*O_d
zLuOpHSF>MRTaCsS`4$&N4eB%!!LdXjr74e_SzqQ_y%9x|qK(6SC-#<j;Z$i-2&?Rb
z!3vY1u9Z3P|7q_!qnb+FZIBX>Ce_eOf-nS-CW3%~)ZkF01c6Yb1VWV_njlCu5{lG;
z07H`!y0n0Tw9u<`qy+&{6p-S8cr&-Gb=O_@yK8>jZ`Pf4=hyjh&N}b=W1sTuXYc*k
zMCyW!uPXKP)f;Wyt4=E`={ccy_PCZ8I3k!3q^AnnfP}k!Vy7^XlpSR^OPpEeP^W+k
z0swmgDO<Z_dx66aA^LmN)I+#>SPT(9x;9lfKs>4ZYE13p>><S&A$<J?Oz4=gGnry*
z8}J(i{2%Bph1!~u4rZ)Tnf@k)x~9v&i(~EcDYubwT+M;h=1fkG$#wFYWG9)=oPden
zOq;9^A}BG;Y+PR+FOyzV@__3h8iSKLx-j?OX-nNq$g`>|<41Ag*S{R6m-m$Ja~{h{
zsSF$}7K_^j8kv}f%%r+<d#7>J(y%^|ZQl1fR2l8?Y1!g~4v9<%!EB^%XkVp>_s|-a
zTM_*Mz}wu8Ue_J3p4FLoZzth-1;M#`NtQyidA7vr8FwZ*O4{AuPm@FW;#k4Rar{MT
zr59HjToe^kiB6FpvE@_2|Jqoa9kjF@ufY?w8dfHnLoOB92WKWqnqy&EUiQ@t58j%O
zZbE$JxCCnM$W7e9NJbnl38)PoG`pPo<vt2X7maR2nRj=AfmHT`TW-mn6^94dycYgf
z-2g^@=}FBhUzG#`+QM}X>Y;20<c*v&3D-M%0omV+X4RTR+@fPw8-C)6fU?f-MDC=_
z<~thYcUw_S=p&6Ml;!Q@KfR>as~T)SFD6##@#%3WeZi%?uc~D07fc~7^HvpS+7HtK
z3&q<*9U|!?I8n_O$qPNAvcse0S@Fv+n^NVbUBKWeRi%mp^qa{=vuTMv$t?|JC#ROw
zeJYE<PG0d?+wc!NUuJR)n&5XbCWGtx-#0C<4MpkrB=_WBycAi9l_$(si{vQXTvFJv
zyyhhN+zcE&Uhx9FsOm~FahmwXK;g{TWPOH6grp=#2D$_;9r5zJm6SdGSUROW(qrT;
z+$*1^c{2RSl-eg{HUo4-Q_~bv_9}NFREx3l?iQ$_%k%6@c>OK^em?Qs3+4&YVCMPZ
zI|f~oT--P8yEH&1K;^3k1+<=FHts&*qz-(Kn0^JJRA&R)BbNk_$c^YQFWq<U&5ysq
zW7)V<`Z5-6pL9PEBcD=kF4zQ<@JW`Ig*vD)qbB5I?qRcqiN2(RdM+KMosNY54sE}+
zyxTUgBh^%%Qvc`Ca^F0*0Xkw#Ofu@M+ZTc_XXd`AKxCex%cQyi!I8;v-wObcKqB6a
z_+>9Xhwn*>w{FgQu#}6xL50nzA&nu~-r-WfQS<Lk!2f|Ya@c(&Xu!WWx*YT3CKL>8
zYrP^k-;7E2HQdAXHC41{7!QRqE><IBY*-q`736*Z3K9Wt+V*3fhnjGpoaG>zQD6t8
zUcUPV5S1Jrp(2v`%zyEzwIzhL$WWM9r<W?}%Ex64FOcfYWqkc3?&{=b+f8P+OxfVb
z;AbzbLx_5aRp%7gQGe?T-RQ;#^mha!#CkV94((j2shl3;cwEWtvYANez{WC-vVZRA
znN5(`!KmI)^bf$VbKhl>ie&pYRIgbUC8?=m(&S~DpQ{I&P%MNV@u?Mdk45`?R<Y6v
zJFIp0LZLs+u|+Xcx^Aob&F0`D7<Oi*zsX9JUY8#xir826MES~%35JVZ;(5)c?Oc63
zPcoN8J6_aRf=OB=8W#lKpCjR>pRO<84!>^ly57<y@eQ-m;sfo7Wjb}LB!Z<;liR0v
zF)pEM3nHv^7eB*zF&IJ+MHDlyGPbWMx;w|YIy<OL1DJ^lB#2;S&R$vdM*8&=E7UFn
zh9bDFbdi$-$H9<;&2;VD_iLB>3bP2*JRwPa<b0<mE81j>LHz(^M>M?-EMeLF&57dU
z(j%pv5jWfInUJXT);p_RBCp?pNy&h2EaEc$YOFjFDXYsHEk_p>jIXov35yw}xu2%a
zb;7SWWo+GkSGng?g4013ZQS!o`~8zhJHlt{g}@@Fa%407tiANCB+jnPLA4jjOpAhw
z>m}S`SAH(i{bISX`Xl8@QytfDA@HQ^QfrjL2z9M})h95gM}~thOr9d}zwO8Vr!ay)
z`+RclWs`@{g#9>-T0{5FF%#niC>VH7HWKZ=ohlRmx3_%>KMIIZv6tZZdIqG~#;8Q+
zUndV`v_<jAA&MGUd%GYwznmRlTp?}Jgq>|;B4~(4frP>Jle_A2_b2<(R9kf;-bsB=
z1@O_TGC}KO!Ssq_j5-#1`I`Mb736>BP@V;35&EDuG%mdIAVUe9Z?%5@KptE3>b)q*
zbl|vreP4I3G(2P76yx#;cu<i+d?&uoE!i{R`93-o2oT$r4ap5TsktsRxSz$KRk{B5
z*R)+9hkfZ91C!Fd#ak<6LF__SW1cOd`@}vEyYv-)8yEL7WT6(Co4Ehvi*|9fAX#U1
zO_bj~MqHKH2|9N-eZw#72{w*k{&1Ke6syT_)pFH-1Nc2(b8%;CBKON&zj&5zs2BdU
zsEpC7gsRZ4dicmnyrY-cRF|=tp6769^Ii}uV2rZ$xY}){pT%at$-X|NpyjYx?^;3>
z?YN8@lqLTc&<9$jYPsp3#!!`tnL0M&zSt`IuHaUce9<vB*5GAA#Ri|xLW98Fed$=V
zgMmij;aV^x19@n3^Y$j-ZZxJ)<g$}bl8g;wS<=Uv_Tr|OIMikvXC=E4+j$>YDhQh1
z_g3{VC9%e3qsWI5gDpdFc{@h-dV=m~B>$`-ai76~Z3o*Q2|RUyy%l~N_DSD;D-jBs
zWRWjsd=Gm{WBiex`k)UcTBbDOg4n?cJ@)d#J9gx}xAdOwoAqGtgB?7)`5@FDBj95-
zv{9)<WyF`h(f2bH8iP<jc%4zv9q8BMhk0y4*4HnfLZapokXMed%a_<4Pk#Bb9KtMl
z5dMNPC0b{nueW2QgE(E3z&O+i-zk#JN*m&0m19u!rEtWSvG3vqdVJdNX)Q$0dndxW
z@|Nc@5&{D4@Xqk!$WEs%juJI2SNlqxWqU=~2wAeIUfcK>J90>~h?D6$!gtX304;Qq
z?pk{8ImZ6v1Ose3QB^XqbuBFMqYD@ql?`V-13oFhk_vsJ#3t9a(%fFKT(PDXG6}Nh
z5H}2FOx%kzbWfWI^Ync2;T9&y)UwN+R(5e{i#bQck4KKQ8rBV-pDCDD3Fauann+OD
zYH&W2)1^w)7H`yB%``Ui-D=rjr&zeBS0>IV`L7vZe+rNEUnu$i?KQy+H5_YgM|mT$
zF9SHny`_o6<UIV}HLI;NH{;t?-D@mCBpy*)hb$(uAAq=*{%h_PCPDMLS;NYBYR`%H
z3yv%SASz5WF1+$)UnV1)weXiw{8+(ycKKMu8lfpF;NHVru?NZB(;<o7?(+e7lW8}$
zn;A}KBJ7NbdZW}2ow@kI^iO|#3vcCkx0M~=t7F!Y_*y30>K0kunNS>|b78(z7AN2A
z$k&u#HblGq+5e1qq$b^U4o%*tuDT@<4|!^s{=|*rd0MWMuiTQ$jZYCM;}MkkoAF5l
zWyEF%C)&%ZeqqbAL=MF3l+07|kQ*brbei}9<cJbUT}!{G15>Wp%y?Z%9CCN9m>ldf
zgOC+em2XveR;MS-K3qL>d3$Y085h=mM7c6OoA%uK=pexm9s5gaJuL6gowo?&(d+^%
zvn1wF<I@)#^d)DMED`0SORTgc0UyhnRXo30gsPWFs*a;Xjm(Om>v?@u=(7TbP|BG$
zmdOk}fq;7hhf7zTgG=UCbVIK$aHC1AUa5f|wa+%FqA$8rPMP%s@?+!)T=uE#nf^Rs
z_(`_L>)DOrfb9Ow9czCRuHNNS4#=w}cUag{vkWez!RKrS-)}|Wz^Q?LF!qs5M>*Qh
z;BB=*?~>u<FDS|SY75e%4&|hWA((vfJjF<9fvyGR0uA;TG~){Ty7Vkh1q|W@@V0SU
z4bASc@p@R*_Q27u(Lh1_mal3uWEW=vLuCZxjsn){cqW0~vd<yDPv+nXh3N-HAa2#P
zbX-ETdD<SmI5f=@(8-`<*lVb&c+bk;7(hewN0{ut%r(2(>=cjJ^XV;5GmQ?MDWuqb
z7X~sP@&DScumx+M2-yDk+2LRlW`P@)>jJja6uVRQ-oDzfFO^Rkqza--V_5Z#`wi>1
zTbS_hN%`G1w|AK;=SVv9@1#c}r@5SI7q5&?BJjQ!*P1hSd*0K6We3+d$S74TCylq;
zJP4bCQST}#YxZWq`3pPL#J`RK(KqB3FBU`Igqz$u8vt$DUu>%l&*rCZVt=aGZA-K;
zfFuQ$JhdH4uT<4LXIsr`R|60T=4tnQh5}fa_iB!AEQo=2)F~%3+QiM$VM=%Xrc3nY
ze=XuDAp1yY9{*up<qz7R{?FWx!{i6R<mHr*rPn4)k)pODBtsQISzbUNFl>Wvty)c8
z-!K$j3GaDGOrz{rV`T-|dlD0BgYn%j7Wq`(eangj>%pk5R8FrR-mi5H;V(`dtdW=?
zAjB;4j=?g{&nwa*$t_MwOm08{b?v@?P#YW{eEcBq#{HHgo84>Rm4hbWRLV@2io45k
zi+w0cJro=OW(xb2%VG$8Ht!WKW5u$4D@@^}P7WqWzz($pBaujT+CJDSz{to7@3$s-
zd20kE1Q-&^svqorkJN$qecvAc?GZ9kD6OAcc40t82X#(Bwn2HF@}9m{tMa&Av}F2z
z|5buFv=>rOXB;CY4B3;YY@{Hkk$_H)Z`j&hJ`JS9SBV_{GIEGf`0N8_&bpZuEXu1#
zP7!QWtyo8!>RCuo;X6`IO4o=;3kzn<Y96r|cm7*$q}8i^>ZCkBcj_q>Z{IG*!Ca^0
z0=7Lpj(oDMv?)z8KaZj%2n~1LIN+5lg330@<Q0ScKB8uG;4$mu_MwxX$a1z`F^eJ5
zIF?mVNRPy?ZPD_D{F%`n=JW>lD@H-@_XIIjgS9f<Nc=Q2nQ60M*eNFF5aBgOO|6T~
zqX|xnxf@``N)G*>@Dff<Q<P64#J=hI4PF}$K3*!?uYCM?Tcd#b4+u>D>9W0l#vZD|
zBVe8mP{k*B?r#6I2C!@$J&pnduCbb{2x(+PY@gIx=NdtnQgSyK%pQ+<xl(3Lp9@GX
z591jpsr)-LJSTsCO>mmy&2I~Gy13nX1xrQHe}h^@lb$QrVX|4Y#)Qn2HXerKKjB)}
zq@<2ogO=v4K5)K6T+w=?XK2~wyUK{aAim>>Q;WwS&~Mg1I4}CRfyB(Ei$0n-@;qLA
z)_pytC8?c(Qk{WZ$1xqP340nirO|^onIM_Na0g!_YR6}~rF2^*hOdD0&cc*lhbf$W
zN<0d&t86&grAxG(eYYGfOby(WPha(_^wF-z*Rlv5T8~hi@U@3!?_jOEn#nczM=Tru
zQ%-}oB?C)?=zx^zHEC&(_T150lAk&ccUcT++I}j1D{{o$!vT3vThBLfQ)9v?LxcZW
zVy4!YMO09Ot^Rm>4cGk{`Gq=4NRoN@tB0z`7nIz==k~atQCsPb`8SCsn$P271ckm)
za_OK|!q==8Jo{R<ED~1{Y#>KZs5)TadW?DJD9y^cJ(}b+P7ONe3#CXzA8AT<vuCX8
zM}h|%=zIz4f?l#rFhS|BCDC0T-tf@brWS^GP6fRu*w3frxdk135d^cG-JTt8MAnfK
zug*lw{aMB{A~`M<3l;oyJ<?Q#*QMN_aeZhJEhR;I-F!fbv87#8w>wGV!w#j=(oIoP
z<%R%k--e0YF7zzb5@|v<)}>D1T!*fVg83anr00B&DlfPuk#&UExPSni<bF5ovjJN2
zG~kpW!p8UHY!V!dK<D)9UzLRki^o_zD}1H}+w8eZiEU@jCXd<%t+%ONULFfCzR^33
zhkh?zV_7!8t5aWJdT0Mcy?}A>AJCKkkrn(`KZ?1vbu?iwjrd#MYhJC`8!&SL@5U%r
z!P<S0Qmjzd;?|W$s9@(N*WsAQbvwj<ulLGMQ%><c?cl3fDf(%GOFDdp8XMn&c;UWi
zP3<JbNoBZ(z|tZ#O380l?dwGU_(lmpgZZf^X<RBmlZwo8Rt``g6f8BxxIQqgjod}8
z)2TH=YTw#N^{ooS_!lF01bx*3$*&d6Fpk>>2pgb*wKX|~fF^eRMxq%KB3to^vZkP-
z%`VPi%B3}>Bz1dmsBRB50C8)5^VtDLDav;XSC#{?;jwr<O)jom>Y5XwNS1Hoh-~wf
z)921t(>D}}1O3K6&6aKOIF}+Vp@y561f|PGx{1I?lx$-iDC0}FpyhBb(=K3#f?_I!
rj+@$8`Vxl1=+92p`+L2=`g8U7{{P1C-x&BC1Ak-S{~rd_e$4+1(%dSM

diff --git a/systems_design/scalability/index.html b/systems_design/scalability/index.html
index 4ddef7e..1caedc9 100644
--- a/systems_design/scalability/index.html
+++ b/systems_design/scalability/index.html
@@ -1422,13 +1422,13 @@
 <p>Horizontal scaling stands for cloning of an application or service such that work can easily be distributed across instances with absolutely no bias.</p>
 <p>Let's see how our monolithic application improves with this principle</p>
 <p><img alt="Horizontal Scaling" src="../images/horizontal-scaling.jpg" /></p>
-<p>Here DB is scaled separately from the application. This is to let you know each component’s scaling capabilities can be different. Usually, web applications can be scaled by adding resources unless there is no state stored inside the application. But DBs can be scaled only for Reads by adding more followers but Writes have to go to only one master to make sure data is consistent. There are some DBs that support multi-master writes but we are keeping them out of scope at this point. </p>
+<p>Here DB is scaled separately from the application. This is to let you know each component’s scaling capabilities can be different. Usually, web applications can be scaled by adding resources unless there is no state stored inside the application. But DBs can be scaled only for Reads by adding more followers but Writes have to go to only one leader to make sure data is consistent. There are some DBs that support multi-leader writes but we are keeping them out of scope at this point.</p>
 <p>Apps should be able to differentiate between Reads and Writes to choose appropriate DB servers. Load balancers can split traffic between identical servers transparently.</p>
 <p><strong>WHAT:</strong>  Duplication of services or databases to spread transaction load.</p>
-<p><strong>WHEN TO USE:</strong>  Databases with a very high read-to-write ratio (5:1 or greater—the higher the better). Because only read replicas of DBs can be scaled, not the Master. </p>
+<p><strong>WHEN TO USE:</strong>  Databases with a very high read-to-write ratio (5:1 or greater—the higher the better). Because only read replicas of DBs can be scaled, not the Leader.</p>
 <p><strong>HOW TO USE:</strong> Simply clone services and implement a load balancer. For databases, ensure that the accessing code understands the difference between a read and a write.</p>
 <p><strong>WHY:</strong> Allows for the fast scale of transactions at the cost of duplicated data and functionality.</p>
-<p><strong>KEY TAKEAWAYS:</strong> This is fast to implement, is a low cost from a developer effort perspective, and can scale transaction volumes nicely. However, they tend to be high cost from the perspective of the operational cost of data. The cost here means if we have 3 followers and 1 Master DB, the same database will be stored as 4 copies in the 4 servers. Hence added storage cost</p>
+<p><strong>KEY TAKEAWAYS:</strong> This is fast to implement, is a low cost from a developer effort perspective, and can scale transaction volumes nicely. However, they tend to be high cost from the perspective of the operational cost of data. The cost here means if we have 3 followers and 1 Leader DB, the same database will be stored as 4 copies in the 4 servers. Hence added storage cost</p>
 <h3 id="refer_1">Refer</h3>
 <ul>
 <li><a href="https://learning.oreilly.com/library/view/the-art-of/9780134031408/ch23.html">https://learning.oreilly.com/library/view/the-art-of/9780134031408/ch23.html</a> </li>