From 90533efc24d89cd94a98b7d96cc4b3816c2234a8 Mon Sep 17 00:00:00 2001 From: bobbyonmagic <237182227+bobbyonmagic@users.noreply.github.com> Date: Mon, 19 Oct 2026 15:56:46 +0300 Subject: [PATCH 1/5] Post: SOC 2 evidence from GitHub and Terraform, and the part that still needs a person --- ...soc2-evidence-from-github-and-terraform.md | 234 ++++++++++++++++++ 1 file changed, 234 insertions(+) create mode 100644 content/posts/soc2-evidence-from-github-and-terraform.md diff --git a/content/posts/soc2-evidence-from-github-and-terraform.md b/content/posts/soc2-evidence-from-github-and-terraform.md new file mode 100644 index 000000000..bfd198879 --- /dev/null +++ b/content/posts/soc2-evidence-from-github-and-terraform.md @@ -0,0 +1,234 @@ +--- +title: 'SOC 2 Evidence From GitHub and Terraform, and the Part That Still Needs a Person' +excerpt: 'We pointed a small evidence collector at a repository whose main branch had a strict ruleset. The ruleset passed and three change-management controls failed. Here is which SOC 2 evidence you can pull from GitHub, Terraform and the API, which still needs a person, and the four ways an evidence script can lie to you.' +category: + name: 'Security' + slug: 'security' +date: '2026-10-22' +publishedAt: '2026-10-22T09:00:00Z' +updatedAt: '2026-10-22T09:00:00Z' +readingTime: '16 min read' +author: + name: 'DevOps Daily Team' + slug: 'devops-daily-team' +featured: false +tags: + - Security + - SOC 2 + - Compliance + - GitHub + - Terraform + - DevSecOps + - Audit +--- + +We pointed a small evidence collector at a GitHub repository whose main branch had a strict ruleset: every change through a pull request, one approval, and a required `test` check. The ruleset control passed. Three of the change-management controls under it failed: none of the four merged pull requests had an independent approval, one was merged five seconds before its check finished, and one commit reached main without a pull request at all. All three were real, and all three would have looked fine in a screenshot of the settings page. + +That gap is the whole job when a customer asks for SOC 2. An auditor does not only want to know what you configured. For a Type II report they want to see what happened under that configuration across the whole review period, usually by sampling. This post shows which of that evidence you can pull straight from GitHub, the GitHub API and your Terraform code, which still needs a person and a signature, and what we got wrong in the first version of our collector. + +## TL;DR + +- Settings are not evidence of operation. Our main branch required approvals and a passing check, and the evidence still showed 0 of 4 pull requests independently approved and 1 merged before its check finished, because admins could bypass the rule. +- "The checks are green" is the wrong question. Pull request #3's check passed 5 seconds after the merge. Its status today is green; it did not gate the merge. Compare the check's completion time with the merge time. +- An evidence script must fail closed. Our first version could pass a control on missing data in four ways: approvals of an older commit, alerts it was not allowed to read, commits linked to the wrong pull request, and a list cut off at a page limit. Each now reports `fail` or `incomplete`. +- Terraform scanning is evidence of a configuration standard, but a pass is only as good as the rule list. Trivy flagged the public database flag, and its security-group rule passed a Postgres port open to the whole internet, because that rule only covers SSH and RDP. +- Access reviews, policy sign-offs, training, risk assessment, vendor reviews and incident-response tests still need a person. Automation can gather the list; it cannot make the judgement. +- The collector ran in 16 seconds with 24 API calls and produced 11 timestamped evidence files with a SHA-256 manifest, for one repository and 90 days. + +## Prerequisites + +- A GitHub repository you are admin on, and a token in `GITHUB_TOKEN` or a logged-in `gh` CLI +- Python 3.10 or later (the collector uses only the standard library) +- [Trivy](https://trivy.dev) for the Terraform scan +- A rough idea of what SOC 2 is: an AICPA attestation report on your controls, mapped to the Trust Services Criteria + +```github +The-DevOps-Daily/soc2-evidence-collector +``` + +## What an auditor actually asks for + +SOC 2 reports on the [Trust Services Criteria](https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022) (free download with an AICPA account), a set of criteria with "points of focus" that describe what a control usually covers. You choose the controls; the auditor tests them. A Type I report says the controls were designed and in place on one day. A Type II report says they operated over a period, often 3 to 12 months, and that is where the evidence work goes: the auditor picks a sample of changes, alerts and access changes from the period and asks you to show each one. + +Three criteria cover most of what a code repository can prove. In the AICPA's words: + +> **CC8.1** The entity authorizes, designs, develops or acquires, configures, documents, tests, approves, and implements changes to infrastructure, data, software, and procedures to meet its objectives. + +> **CC7.1** To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities. + +> **CC6.1** The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives. + +For a change, "approves" and "tests" are the parts people get caught on. For each sampled change, the auditor wants to see that someone other than the author approved it and that it was tested before it reached production. For vulnerabilities, they want to see that you detect them and fix the serious ones within the time your own policy promises. + +The usual way to produce this is screenshots: the branch protection page, the pull request page for each sampled change, the Dependabot tab, the security settings. A screenshot shows the state at one moment, without a reliable timestamp or a way to tell whether it was edited. An API response saved with its collection time and a hash is better evidence, and a script can collect it for every change in the period instead of a sample. + +## The collector + +`collect.py` reads one repository through the GitHub API and evaluates eight controls: + +| Criterion | Control | Where the evidence comes from | +| --- | --- | --- | +| CC8.1 | Changes to the default branch go through a pull request | branch rules and classic branch protection | +| CC8.1 | Every merged change was tested before the merge | check runs on the merged commit, finished before the merge time | +| CC8.1 | Every merged change was approved by someone other than its author | reviews that approved the merged commit, before the merge | +| CC8.1 | Nothing reached the default branch without a pull request | the merged pull request behind each commit | +| CC7.1 | Dependency vulnerability alerts are on | the Dependabot setting | +| CC7.1 | No critical or high alert is open past the SLA | open Dependabot alerts and their age | +| CC6.1 | Secret scanning and push protection are on | the repository's security settings | +| CC6.3 | Repository access follows least privilege | collaborator roles, judged by a person | + +Every raw API response goes into a timestamped folder with a SHA-256 manifest, and the summary marks each control `pass`, `fail`, `needs a person` or `incomplete`: + +```diagram +{ + "type": "flow", + "nodes": [ + { "label": "GitHub API", "sub": "rules, PRs, checks, alerts", "icon": "globe", "tone": "slate" }, + { "label": "collect.py", "sub": "8 controls", "icon": "gear", "tone": "blue" }, + { "label": "raw/*.json", "sub": "timestamped, hashed", "icon": "database", "tone": "violet" }, + { "label": "summary.json", "sub": "pass, fail, incomplete", "icon": "check", "tone": "green" }, + { "label": "A person", "sub": "judgement, sign-off", "icon": "shield", "tone": "amber" } + ] +} +``` + +### The test subject + +We made the collector's own repository its test subject, with a history built on purpose. Its main branch has a ruleset that requires a pull request, one approval and the `test` check, with a bypass for organization admins. Then: + +- The first commit went straight to main, before the ruleset existed. +- Every pull request was merged by an admin through the bypass. Nobody else could approve: it is a one-person setup, which is exactly the situation many small teams are in when the first enterprise customer asks for SOC 2. +- Pull request #3 was merged while its `test` check was still running. +- `examples/app/requirements.txt` pins PyYAML 5.3 and Jinja2 2.10, which have published advisories, so Dependabot has alerts to report. + +### The run + +```terminal +{ + "title": "collect.py", + "steps": [ + { "cmd": "python3 collect.py The-DevOps-Daily/soc2-evidence-collector --days 90", "output": "The-DevOps-Daily/soc2-evidence-collector, last 90 days: 11 evidence files, 24 API calls, 15.9 s\n CC8.1 pass Changes to the default branch go through a pull request\n rule on main: pull_request, 1 approval(s) required\n CC8.1 fail Every merged change was tested before the merge\n required checks: 1; 3 of 4 merged PRs had passing checks at merge time\n CC8.1 fail Every merged change was approved by someone other than its author\n 0 of 4 merged PRs had an independent approval of the merged commit\n CC8.1 fail Nothing reached the default branch without a pull request\n 1 of 5 commits on main in the window are not linked to a merged PR\n CC7.1 pass Dependency vulnerability alerts are on\n Dependabot alerts on\n CC7.1 pass No critical or high alert is open past 30 days\n 8 open alerts, 0 critical or high past 30 days\n CC6.1 pass Secret scanning and push protection are on\n secret scanning enabled, push protection enabled\n CC6.3 needs a person Repository access follows least privilege\n roles: {'admin': 4}, outside collaborators: 0; the list is evidence, the judgement is not\nevidence: evidence/The-DevOps-Daily__soc2-evidence-collector/20261019T125319Z" } + ] +} +``` + +It found every gap we put in, and it exits non-zero, so it can gate a pipeline or a weekly job. + +## What the failures mean + +### The rule was on, and the evidence still failed + +The first control passed: a pull request with one approval is required on main. The approval control under it failed for all four merged pull requests. An admin bypass is not a bug in the ruleset. It is a feature that most organizations keep for emergencies, and it is exactly what an auditor's sample finds. If your report says "all changes are approved by a second person" and your evidence shows admin merges without approval, that is an exception in the report. + +For a one-person or two-person team, the honest fix is not to pretend. Common approaches are a reviewer from outside the team for production repositories, or a documented control that someone reviews merged changes after the fact within a fixed time. Which of these your auditor accepts is a conversation to have before the review period starts, not after. + +### Green now is not the same as tested before the merge + +Here is the evidence file for pull request #3 as the collector saved it (indentation widened for reading): + +```json +{ + "collected_at": "2026-10-19T12:53:19.848831+00:00", + "source": "GitHub API, The-DevOps-Daily/soc2-evidence-collector", + "data": { + "pull": { + "number": 3, + "title": "Examples to scan, and the IaC scan script", + "merged_at": "2026-10-19T12:50:03Z", + "html_url": "https://github.com/The-DevOps-Daily/soc2-evidence-collector/pull/3" + }, + "head_sha": "d4b17526cfcaf516833023b9ec402f45a70a10ec", + "reviews": [], + "check_runs": [ + { + "name": "test", + "status": "completed", + "conclusion": "success", + "completed_at": "2026-10-19T12:50:08Z" + } + ] + } +} +``` + +The check succeeded at 12:50:08. The pull request was merged at 12:50:03. Look at the pull request page today and you see a green check, which is what most screenshots and many scripts record. The collector compares the two timestamps, and so should anything you hand to an auditor. A required check stops a normal merge until it passes, so a merge before completion means someone used a bypass. + +### The commit with no pull request + +The one commit without a pull request is the repository's first commit, pushed before the ruleset existed. That is a normal, explainable exception, and the evidence lets you explain it with a date. The same control also catches the cases that are not normal: an admin pushing a hotfix straight to main, or a force push that rewrote history. + +### The alerts that passed + +Dependabot raised 8 open alerts for the two pinned packages: 2 critical, 1 high and 5 medium. The SLA control passed, correctly, because the alerts were minutes old. Our default SLA is 30 days for critical and high; use the number your own vulnerability policy states, since that is what the auditor will hold you to. The same run in five weeks would fail. + +## Four ways our first version could lie + +A review of the first version of the collector found four ways it could pass a control without evidence. For a tool whose output goes to an auditor, every one of these is a real defect: a control must never pass because data was missing. + +1. **Approvals of an older commit counted.** The first version accepted any approval from someone other than the author, made before the merge. If the author pushed new commits after the approval, the merged code was not the code that was approved. The collector now counts only approvals whose `commit_id` is the merged head commit, and reports the rest as stale. +2. **Unreadable alerts looked like zero alerts.** With a token that could not read Dependabot alerts, the API returned 403 and the first version evaluated an empty list: no late alerts, pass. It now reports the SLA control as `incomplete` with the HTTP status. +3. **Any pull request link counted.** A commit counted as reviewed if any pull request was associated with it, even one merged into another branch or outside the window. It now has to be a pull request merged into the default branch and inside the evaluated set. +4. **Lists were cut off silently.** The commit list stopped at 300 and the alert list at one page. The first version then judged what it had. Alerts are now paged completely, and a commit list that reaches the limit makes the control `incomplete`. + +None of these would have changed the result for our demo repository, which has no approvals at all, a readable alert list of 8 and five commits. They would have changed it for a real repository, where a stale approval or a missing permission is common. Each fix has a test in the repository. + +Running the fixed version found one more problem: the Dependabot alerts API rejects page numbers (`Pagination using the page parameter is not supported`) and pages with cursors in the `Link` header instead. A collector that ignored the error would have reported no alerts. + +## Evidence from Terraform + +CC7.1's points of focus start with "Uses Defined Configuration Standards" and "Monitors Infrastructure and Software" for noncompliance with them. For infrastructure as code, a misconfiguration scan in CI is evidence of both: the rule set is your standard, and the scan result on each change is the monitoring. + +The repository's `examples/terraform` holds a small AWS stack: a customer-data bucket with a KMS key, versioning and a public access block; an exports bucket added later without any of those; and a Postgres instance, encrypted and backed up, with a security group open to `0.0.0.0/0` on port 5432 and `publicly_accessible = true`. `scan-iac.sh` runs Trivy and keeps the report, a summary and a manifest: + +```terminal +{ + "title": "scan-iac.sh", + "steps": [ + { "cmd": "./scan-iac.sh examples/terraform", "output": "92 checks, 12 failed, 5.0 s\n HIGH AWS-0086 aws_s3_bucket.exports S3 Access block should block public ACL\n HIGH AWS-0087 aws_s3_bucket.exports S3 Access block should block public policy\n HIGH AWS-0091 aws_s3_bucket.exports S3 Access Block should Ignore Public ACL\n HIGH AWS-0093 aws_s3_bucket.exports S3 Access block should restrict public bucket to limit access\n HIGH AWS-0132 aws_s3_bucket.exports S3 encryption should use Customer Managed Keys\n HIGH AWS-0180 aws_db_instance.app RDS Publicly Accessible\n MEDIUM AWS-0090 aws_s3_bucket.exports S3 Data should be versioned\n MEDIUM AWS-0176 aws_db_instance.app RDS IAM Database Authentication Disabled\n LOW AWS-0089 aws_s3_bucket.customer_data S3 Bucket Logging\n LOW AWS-0089 aws_s3_bucket.exports S3 Bucket Logging\n LOW AWS-0094 aws_s3_bucket.exports S3 buckets should each define an aws_s3_bucket_public_access_block\n LOW AWS-0133 aws_db_instance.app Enable Performance Insights to detect potential problems\nevidence: evidence/iac/20261019T125335Z" } + ] +} +``` + +The exports bucket and the public database were both caught. The open security group was not. Trivy's ingress rule, AWS-0107, is titled "Security groups should not allow unrestricted ingress to SSH or RDP" and it passed: port 5432 is neither. The database was flagged only because `publicly_accessible` was also set. We removed that flag, kept the security group and scanned again: the only database findings left were Performance Insights and IAM authentication, and nothing pointed at a database port open to the world. + +That is the general limit of configuration scanning as evidence. A pass means "none of these rules failed", not "this is safe". Your configuration standard is the rule set you run plus the rules you add for what it misses. Trivy and similar tools accept custom policies, and a rule for "no database port open to `0.0.0.0/0`" is a few lines. + +The scan reads code, not the running account. For the period itself, the auditor may ask for evidence that production matches the code: drift detection, or reading the live configuration through the cloud provider's API. That is the same pattern as the GitHub collector, with a different API. + +## What still needs a person + +Some controls produce evidence a script can gather but not judge, and some produce no machine evidence at all. These are the ones that usually remain: + +| Criterion | What the auditor wants | Why a script cannot finish it | +| --- | --- | --- | +| CC6.2, CC6.3 | Periodic access reviews: someone confirms each account and role is still needed | The collector lists the 4 admins; whether each should be an admin is a decision, with a name and a date on it | +| CC6.2 | Access removed when someone leaves | Needs the HR leaving date to compare with when access ended | +| CC1.4, CC2.2 | Security awareness training completed | The record lives in a training tool or a signed list | +| CC5.3 | Policies written, approved and acknowledged | A policy document and each employee's acknowledgment | +| CC3.2 | A risk assessment, reviewed at least yearly | A document and its review | +| CC9.2 | Vendor and subprocessor reviews | Each vendor's own report, read and assessed | +| CC7.4, CC7.5 | Incident response that works | A tabletop exercise or a real incident, with its write-up | +| A1.3 | Recovery tested (if Availability is in scope) | A restore test with its result | + +Automation helps with all of these by collecting the inputs and reminding people, but the evidence is a person's decision. In our collector, CC6.3 deliberately ends at `needs a person`: it gives the reviewer the list, and the reviewer's sign-off is the evidence. + +## Build it or buy it + +The compliance automation platforms, such as Vanta, Drata, Secureframe, Sprinto and Thoropass, do the same thing at a much wider scale. They connect to source control, cloud accounts, identity providers and HR systems, map what they collect to controls, track the people-side tasks such as training and policy acknowledgments, and give the auditor a place to review the evidence. For a team going through its first audit, that coverage and the auditor relationships that come with it are the reason to pay for one. + +What a small script like ours is good for is understanding what those tools check, and the gaps that are specific to you: a custom deployment pipeline, a check the platform does not have, or a control you want to test on every change instead of once a quarter. Whichever you use, test it the way we tested ours: give it a repository with known problems and confirm it fails on each of them. An evidence tool that has only ever reported `pass` has not been tested. + +## Time + +For one repository and 90 days, the collector made 24 API calls and wrote 11 evidence files in 16 seconds. By hand, the same evidence is a screenshot of the ruleset, one per merged pull request with its checks and reviews, the Dependabot tab, the security settings and the collaborator list: about nine screenshots, none of which shows the check's completion time next to the merge time. We did not time the manual version, so we will not give a number for it. The difference grows with the sample: an auditor sampling 25 changes across 10 repositories is 25 pull request pages by hand, and one run per repository for the script. + +## Summary + +- Collect evidence of what happened, not only of what is configured. Our ruleset passed while three change-management controls failed under it. +- Compare timestamps. A check that is green today may have finished after the merge. +- Make evidence scripts fail closed: stale approvals, unreadable data, wrong links and truncated lists must never pass. +- Treat a configuration scan as one rule set, not as proof of safety, and add rules for what it misses. Ours passed a database port open to the internet. +- Leave the judgement to people, and make their sign-off the evidence. A script can gather the access list; it cannot decide who should be on it. +- Agree with your auditor on how exceptions, such as admin bypasses, are handled before the review period starts. + +The collector, the Terraform example and the tests are in [The-DevOps-Daily/soc2-evidence-collector](https://github.com/The-DevOps-Daily/soc2-evidence-collector). Point it at a repository you own and see which controls fail. From 9f1b6181c67723beac664550d7ccab768466c8dd Mon Sep 17 00:00:00 2001 From: bobbyonmagic <237182227+bobbyonmagic@users.noreply.github.com> Date: Mon, 19 Oct 2026 15:56:57 +0300 Subject: [PATCH 2/5] OG image for the SOC 2 evidence post --- .../soc2-evidence-from-github-and-terraform.png | Bin 0 -> 84457 bytes 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 public/images/posts/soc2-evidence-from-github-and-terraform.png diff --git a/public/images/posts/soc2-evidence-from-github-and-terraform.png b/public/images/posts/soc2-evidence-from-github-and-terraform.png new file mode 100644 index 0000000000000000000000000000000000000000..ec50b827c3efdb022db8e47a5d68c9b2e4ea58d1 GIT binary patch literal 84457 zcmXtAu$VpC4&Uxj2t?RlT&*zn3WO$dAnU|S{hK5x~Tf>-!h90D$ zITrw-qka>VpX5P(!y4(EYC>5ruw9boxN;LFs0?A@VB5DsLPV9hXmTkc&(HI3f%$QuNd$|| z0W3m=GIv-V!nwFU_cG|pkuT>K`}V{`vBXe^xe9Su&#kFB_%9ye8R*U}fj=wvyYBsZ zL)e1bnM0B`i5tAIrqHkjN>Ra4X4N;%zY^^UQ->aB+Ez_Zc@3xksz-Dsy)=HO-~PDA zJ+r<~`IXzd+{X3XaQYtBhi}5;zu$~x>e#Efj7S=5I5qXHS-s+Udcib#YUuc-$9_e` zQ8ov`r1xW)QPCEw>!9e}>q39M7v`MB&C(mhhYf(Qmp(VaD)M!Ti^EVXHE%UpvWiHp z83XRmCH4p9iBY=CiCJ0I({^O>OuF{gpTP~3j03OY+N2~~qjKZaJ`BzDHS`j)GTNu% zP6*OGi$wEzNwU?&BJA7Tut`Mia&huRwV)cf(D|U0i;@D> zJ13fAbEP(_;iSV;JcVJP;vH5+QY|4I706I0WSV$S1K{r^nJGzjLVrDH!w}+%8b_aDcba+WlTjI3I_ZVCzQc^3rSn!9jZX z(>REmJ;Ni7{c~x2Jbjn81qdFYz9d~+D9X_Mb}EF-+2d|PcwXj`S+UDH`+!kgt?J?N zsKivRv?-hsnzW3H1vNTaok@df_7)9lt-S|U|J7W;7Hfl!%;weBF2uUt*T&aMgg!?( zFq51~=Y%E)@Wp?-HZmPi@qkzcKDQcetApTYEb#kZaclf-Lou|S zVxBOdlk>>4aU6x+T9Zu99a-R66f%bmIhUfp9BVs zx$Px3aI|!KXlMiGK*Q}nF2Tsk5w|fnZ=*zqT5Y}lDgG>VVDAc}fZKnGyhz|fH}6>l z2j&j~zx!&!*w6EtE~0{!g&(}wo+w06Oa)yn;c6-3%8?E#gxAr?ysH(K(p-iYE*){u z3_-F!mB*H%P(YVAJDgkw)$7EE;pK!Tv|9|84)DvEco<$zSqoUY#EJR71H!d|fhoLy zM_lplhAg|=5^BMcE4)L-4;c)+w|)$*oP+4W2`3rPRx3lr&?)Bm|L6n=Gn1$d>;Yux z943*W^3z>Bk7=d8IP@jf;MSIpLq-KV6tP&@4CyJGbdAIpM<^J8TI@JtR2m;Gp_3np zc3-*-C;Z6lkw`mx##_7L+;xZ}DIWds3oU$$u6>aw88k-9j zf0qx0rJUW=yT7br}dLdJ_TJfqU4Eksta7&o* z?Jf}GwTb82tND{z86THPO61VED5=kubRDFz-?b#j(3l%l%LoA~4K+RK;53T#OKwbG zog0$FCVZPqV>{L<18=vcaepXhZ=&y?iCQ^Xg<;zz&E za=kj07a@8d0FSOh>hpf8gpexOVVI7g40S*Vn`1(nVF!--&*Ln@bbC!h)lq7<$**^H z>oeb4ME{v-6R`2O(lcZdHvS!3treWO&qq|-_?%d7tPaH1ZV3^7TR~Y?s+t#CjjQEh zgbi7eagakQB=Do9W*NP1ac44%T8l`=-w*15T%zo)sAVR!9?&8c?T>>dF`#$7IlVQ? z!t+A5@XsV5i`Q`5{U{_L9>t{zJW#p#qq3^!T%9y?Lb($&BBDla`7X-?CS8(YLak)# z{I_mqL2|vu+C!pZd#TKIdb2K5wDKGaY{ zNNIqRL!jhtJOd32KYbR%dM9zdS96h;m<}CcKsRMS^Plmpmb*(&FsqZfz}uU1KS)a( zG88*)0{7;&WrbT60_yWY!mOwVf~1Y;s7VV{f55v(&YwVRwk!_O0Cf4uC(p0GHxc*|^-Bx59$Gx-bWAJwoK%E& znD%}>fEQ`ia{Zr{A+s&&ONq_ z?(a5^+H;KBy^2H5yv-X70<_A5c60}Enf=ftTJ+Wb?TB>gVRJ_sgMi<%%klVzr%wN+ zF@DXX^954uu-G6C?+_dF4roH)aBDYpn*v;*Bb=+!G`$YJ0tl<|qFv z;m?BB`!bRrz{oAW#Jxs7I96I`zX~%m?;VGqZWH1MkMYX|^~-bw8r(VrfkdwwNh2d; zps1lpTZJz(ORi%k95=(9Hi!@s^Qxu zHHeug2WGziI(bafdLxDxY0(B~An^N~m`fa0*KRG3@?#s{c=pVnN#l?LA83AW7(gm3 z40pkx9`Q%J+41$@KNr?zZ;~x-QV;;Q*({BA;pcLDjn_nxSm+5X7tnCeKy}tKkql1Y zT_Td4UK!Rm8I+agQObKK1uTg!#nX~>+2W13B0P8hweK>?)_yK% zKzrXp{pP?}^d*f!_v@m}zWgi;!GIfz`5-w&Po8At6^1`*|4b5!a`3vA4<<&@p&!D( z)oy7t22AI15oG-#EX)WW&|^bACD0h|8l!6-ZyWo*2Jg_8cjM)Q1y@okOLO4mQp@A7 zb~k7)h9yY7T+>%BrsXU(cfSNjm>ja2xZQS}JaRWw5+s~FM;z}(Vsk=-A#NA9L|o3}rIADq!pmp^}*4j^Dt+?9NuPb(04OI#LWWxQ-Z8JeJ&F-emp zR#}L$7w{^a4f+YR(rmxcw7%%{d@dLpAJOE@PI<{d;rEVaB#Q#c3}+xj4sufk!W-9CyU(QB7QWkmziv6fCmF$#>ezf7DD?c zUZr#G$Q0TL?-gyl6P7S^mimNce9PDX4?{%}?$}W#Y}AfgWE?`$K@^ z_F@1|a;8%Ux>TR;fUZ{XU`&)M(@+*(VXSh-1a1w%ZboIEBk3CG1QjZY@xE}TsfwzO zX$S@aM19Ed$i)&sc(oxAjn&M=zlj6Aret3ThMoGH&x};YJqZbHAIHmGJUDmkkT6vC zm1EyY8ZU<*vKkBU`*IDpt4sWZ|JW+bemZHeZ?bVxnAeUe=Om}{7?|8|=Ur%ij*_!2ZmyKS&e(CSlnK?| z=Vkr*9v~7?e3UnhJsxz%7@^+*7I2|M`U-UiTnnDT6Ju239+U?DTOz?E@20>A*@L)A zrlP&wyFJZ}F@TgLFgg`!rKn!>xxHBWx7Be=pl8FLM*`cQ%s9|bb&UgYr}3Tu`ik`? zBY88s8fw$-D#&-Tj$#0;L~v6uz+JnV&9U-4?tV_<*Ol{z?4Jx>{!NtLYLUTnB>_$x z7~}5p>0!H(rJBHId4^G*uodOSrJGpEkHS})LSj5W9$or}b-Quh=E3}9{u?_d?e}}b zgy*#oAO7{Ng{-RYTc^&v?3=%2e67gv-oKXhQ{VkSjgp(iGT;4w@fI3SIrXb} zOt9Z9Hufp*Q1}95f1m}jqm5#+!no(uQE~=n(Rree&cC1^qvm+C_VIF zQ}Wc^yk|8cD<2iQ&=qvWj>`{1pU&y-&*_FPjLqp6l z0m43%^YK|xmg=vb@FNU##E|RO^LqlP#n;Bn?kvv^wnN-Eo&0s1hbRWhtL<#Bat6Ir z6lB}+ULVaz@6Jwts*mTW+D$a5S(1@ju`Js9rq`?UcZz8zg8uN9mt{BXi$hWVD>M-J z7-%{}RoS?{PiAN0EC9Q=J|*N=4Ez_+sRVs3lurPe zpI>f&PJ}`&rbc$y3*Z}*R>xm&w;Gsb+s%y|l&7cs7b+mJl+^T%UH5@z@jRCgawXJ` z8?l1EULKjjLz4OaX5UZ*IhCOs4ApaTuMk!<+o~?%1}cs5W@*(cqT|?djW{Bc+05q z5L>4{Y=Lw8vX1_;&V$b!9T@H7g+KFK-6?to`srM~jyTbB@7SXSHSdFEAj zRi?|~1x4IZv?R+j|Eyl6k!?v*Zc;X{)bj-+CD~0*KE8$?| zauStaV)9;^`m@6^{gg}?A>TB5M)ELAiNvS%KK!-@a0?ooie=Sq_}Rr&x_Gx5`e52J zsIA1|RyLTfaNr_rB`;gAY5nK7syz#HR`|U+Z=t`mvU+dp`=NT*GQt9rsZp}-nd42^ zxUJC(a@Tt1cv%!p*4`45eaIUOVySG#(+>R<&|l8yYmbORL3v0*I{O^hD$|DT5>G`> z8$)*T4|<3m2f9>;^z}|- zQft#}-}6Uhqe5tTI)7~tPO(82PoU!+TeJPDxWnT5hBAu%!Tc(zYs@MfZ#34h#AjOkq}Fj(@t~H+wJ?f^C96eBI5Dc# z+Z3Pr80h-oT6&YWHZrdGi#E`SA z+>mHd8JsE|MS~P&m_CBO86&wT@K=;2;e>r^jC6ZCCYiVnOL<18xSjw-LF&kY_C=? zkrm6Il@pD8v6Tyc6;_RFh2Ws8(VCYvfkGe};2a^@GctmW*Ukgg#vBeb2+V5{ja`8V z-LJK&ZNh*sB)RoOUg8pBSu;tPfWZ>tpl;5KT{*P$#@FrEIYNg-XP?A1M9fH1vjpq+ zT|qo+IOO+$!yji?a5)gncS5iCK772&+C#PZ$V#KUqAp5Pa2uE4>tIT^i2O$MVW0?^ z;!)ZkosZ~G@#qpJ{BqCietFnOzMHclN541`V&;6fmIKtWTEhpy1TGG=?2VNcyxdrY zk=PooTEil%(w@y4LeL7}tZZQMBSo2w+_}S!BJv{|KpKaxfBB6(94j9^$G{YBi$KiX zexI705JO-2i(U4E@1O51`hm1d_bS%7iee`4NhRsoU8_~h!SQBki*#u(6C!@jS%&{e zt2vweJVM3R<@>?J0d6xR+n$FvB#+;^8Jb9_ewh_0LBBuK% zf=^mFa37@&ry@Y&0sMW8u>;(RJEr-uv zaf&OY*4rxlh+9|qVm_4yC|~!;QXqCKYS}f`c#SEE)012UrE*DLd^Jxq@sCg8QJG&u zoj3J8;xKKGJ+|2(EPvY62L124rQXjT{JYfL$-f7Fj%@F-Ts=((&)-R+i!#IW5hh9E zd;P`FvhR&y)dznTn_DtaR2^DNrI*5CA}AAnL?w_S&a{X*9Fgy}ioSTyE}%$%egL_6 zb$Pl9+Ll`^Izgmhf*IYc^ouDkUr3x)J+ zas^j>D+tL+4$ys(cmtHF|C)p(@Dm0F^~CyuSXem8kZ9Hp?hWbW{BiH33v0;8#dbI! zu6$spu{!zfby@Qv`nwNy@46sKyiGX=kjj_pkM%N5(n1ZD+W>-z#6#FwyKO<_A1j4S8dC83e~!* zjbVf&HU1z>E}TE!qrvS4mnC0ti@dgPC=UHiD~K}h{%YC58-_1F{1>?{!K)|q{t zx7Usro;O%G!TW+QYo|fkvijBAwm6VE8}!-HqD>M;=la~E!~5g@itlielQE?M`BwO^ z#6KKa^WD6k;A%PGd!J%E`iV%VtN&=+{?L)>dz}j3$_->L+D|hR4W;F$!O_=O3ge1L z|MOgH2%<;HR^d*AGSiJjs0eOYKbAX5&Xl&R6&06xu|?-+&nGwv!8;gt12DW;3F!y* zpUI|zjZ9pG8JVn!oNkV+G}J4X|L{m|eDHaU)T=8uz4W91161CavkC*31<-7@j9-(N z&SwyJ>@6$J-*ombYXPSsbW3_XR=M8>LhW~x4(iOSOx@TFtJsJDo!8puM+AzOJT5Kq zmlJ)`@O0c&k#h(3*51HIvo={|tPKyuexkDPFj$)D}j=nMSANoxHyFyBdvasP$pc za8|Qc`~d-eq3NwF+38!;`%?~!b;(e9?)f1v&hZ4P%l<AQ$h0~H^Npqs>)ehzp;^u{aomqEPho9SyfVHk$p5PHp~1@EA% z#*Tw>Iv8zLT<#}2VJ$SBHxCb*(>b&`GbE8V@t~;dSP~)T%eQFGZdFLMEvMe2C#l?o zr{=%GA+Pf=Gw{wrLkuSyxpXB)ATbso>V{i`@NWu`ETeeeBkLv+<>_uU zB{AJHvtKbAm%1psBscuIB|N$2ss3ct(h%$lg`( zU*a<)VMHCc8aA0QZ7fgx6I=85LQeDAliJd(EY8vdsGY%4yM!b{{XkOYMwHx~*f%Zb z>DPIx;k8j_9p`bheHG>01)=X*aF=ttI39Z@Bz3`=F2OnZB+`t%DL%H4${v0Un`27| zq*6M{jD;ugQ+Ml+TX@Y;$Ud2`GcFTHvOV`Eq=a^Q>vA^F=2YSs1ham89X);t^Jn0X&t)D@JA#yasW>{B*B}jhpn`6b zmD?;vkcO?)zW#o4KencMq0E%SmB{;X3ks|Akg}Rb@G6@4G4r4Qmg}i{u2^|LVG^YY z?CtBu$ArCmvQo>}le_j^>Sa&s190OwMj7pHK1r+%lX7dl6AiAhk>GV^QHN}^#pTXo z?HlhC){z9Go%()K1uIsNSQOM?jz5pH^2u=dkQXIgj7K{Duk2&X7Oa?rTHy_CQn?5V zP(eXL8WPO{bj#xZ4ff@Wergk{KCoONCa~eelmmOHsU0=BE z1W73t*8q|oEtpU-{D>D(a?`{xG_HlA&=ekP2&s*eOI3T2nlpc!^-pAM01abS9B6cG zQvT_ji)-#PYeB&q{FoQuuL9cYde3PNT#ECR-jgV^_vdhF9hba3|G+AsHkER#I(SVm zv0E~|o1}$MKqm7_nZW)hP-U?I8t;r9y=+Dh|C4RLsXi6!aFb_c}W#2cr$H$CN~U^ z^jj7n{&@_LiMDpEiPaCgY<&Thd~snohFb(JJ%5h|4X?Jh{@Lv51^@GNFK9Gs;vC#u zqgocnbN_**t!pm_d2G%A=stpD)SxW%cb7ycnN*GLIS5yN@?_+$qysM}W2^c1uXYC& zZy=Rk^r)tL9=HE&4mv+b<#5sN=Er2|;vJj@y&_|DNiWU!d3n^R?(o7Dj`?~=2zY$TtUzEdh}->r z6K|HM2|zjByh;bV&4$br6l4BpT6891ojEr^fX@DiA;l=E`q)gM36+?4`nN z@b%J&Gx_3UwOh8Njh@EUPcAl##{pMxg&Af^39g)IXWaFrryrHL++K(lSrjTfa8}iv zxmGwLHzN!T&=M=YGoZ@9GgP8+kfDqixe5Ch8OXMGIb4XnxgRe3h*#E={>r%P`y1JT{afPl(_2lWMpsBSU&|q zR)zhUf4N|wj%j`ovahf?{FNuPX7<)aDZoJ+9MjEXF@fz_trw6iBw82^5y*Mb z@83Cpm>f|bI%miHTn~t>$?Ba-c+*qmF6Q;_>z3Npsbe;(5|R#K5v|?gCj9tM2e^C{ zTDgQ2^sjT3hf+gKsE+o9I4P(F>HD@pMHK3EFGMdG`{87!uKMzZ_%;ga)*+%1si{Yr z^_`~z3w40(bMJE3H~Wf3go+c-Rfs0Z_8wC$cK2WMmOIn$%=GQ|*<*;EKgFD_2zn=MTpz9Leu;o%^k zf{T2cCt`St+(j0*K=7?mcbP9Bti+h~mqzdQ=$KFRGwwuliC9!Vcx>*r^5xYXb9}xC04v2O@Ff5I0qO?sIrCft{;T=E4=2-7 zgFBMpu2p{+H-Tj%1YyE@4)-aaFCYBdvHC1-`6KokF-j19K$UZOW90CvBoc2|B12DQ z7XCuAmqdp|)@q33tq3lf8>|RmKs1XJx zbMOtG`Tw;sqC}sYMe(T{frJ?USKxQ5Uj)NOt0zFvf5@ByXZ@QYO-}`ljw%CTj`tu> zu)8n7TpFCe)oLao6O;uGphJP_WSI(0EgqAa*=sw>rZH@6+^aABfGnywbq*tnuG^%D zK`Dp3EzV0%mP5kjTF#i~+fJH-PmWtV60w)R;W-%zD!yjV2wX2io(iLBfVi7?zC2dO zE-sW!qE?c}^nh{-u6*Oy_YY>eN_ipSpPeJYD6T>wf>B=>dvc@r_?UOX{d%F*+oY&T z0b_BYhfJ8sOWtoRsvG@Tx&?3y%7ou{spI>na1|!^hVSJ#RzFpp`+IgWcS^I31n%QA z%O*KvUaP#Q`Mgmb)TPMJmqJGn(nMr&c#H94WN}u;-c8iC2&p5pl+0KVH>{W{)1Z}4 zh0r0lzovOO)j#pFxB2Y&YFMCV3$FDCrj>|>Ds(3C+!cShl^Qq6=mXrL5*nL=nFx>f z%nsHmq|x&f?#ByfMR(5LM`6uMVN_;Quup?{T`FWTCRQYB)3Fc=oK}+HVwLAl9=5TrJ|vOa zZ*iAPlr|4_>)s!qo!0yS!`K}`+N%^)LjOK7QLCBXqVnBFj#N^TC9B2?)D1q1(rRPN zq(*!LcX}Kvb(;^tF{jH}kF{PWlV7mkIC;X}jn%oj!FBp~@5+w(=|q%So+ywoj!ds2 zv4}kstNhD}c`SyTyoBpLmnDjBpQ?OzjIx5)MT7Ct43MNi(4Lg5u1ZKX^vR|f;vjEf zcfTJj%uN8o!uny- z5V#*y97yh!Azy-I$$$$tSI0eyo$?6rCTg5T*Lx#-HyXLw2i_8{QVzoZ|+J4|5pS_C94E5GhTq2v~@usU)$CoPc>T0H}vT^J(oi+pe2%tukaTc4R9udWU4XX7P4 z+-z3zLpc5B)&tzpIM#U)AR<@`e7!X$?#))f#v4P&kD+E^<6EO=9Js03zcI}!T$f>t zP`x$wWD$aMmkgfaN8%l!&v@j?mCFeUy7)|o>g`mq)ZkP|CU&tlEdAl`EJtec#_r#Z z-hKw~7gR9#e)K`n>Gd!?_@CAZKWTjboS=QwmdOQNLyaErWmNAO_&UHHpQ*+^6ro#2 z>7!QNZ_f56TKDOqWK0eOZH(ShFELpf1ee=Hfd}r`onya#$&T?QRTYXcgDaiwpCf5>M7y z_)j`TlyEZ3cMao;`gKV8!p@BG7sqYpnoYTn_(=(#G!xjE$=6AVOoS?tVPP&e1Rq)q z@89M)x&_@1%ITZk)2FA32=rZ4N%{hIo!f?KdGKZlsJ>;%j+-*LmHMQYG#Oo@v{zGt zv9`SR>}{JMVQ&&b32w(jC~6w03F|iVy1xmw?^dfJsCMfJeX!#BJ!pzG5A57sJQ6CO zVee*`Y~2edH%_D2-SZa=p~BFlDa{Z3jPm2vPSF-Qg;o4g_jYNskOV4Q5hUE|@`1AS zXocaI6$DHl_2#iPUcVnBT+2u;5a{refADft0X~!+XJ(@xoM(PzC%iE(-kM|?kt3CM zjq24}H$Qm4yF*JuiYJ^^wg%SZ={3 zmyEV0+(CtE*sY7AgircJTV-@}l&S~;!~3mN*3PBHAbMgTN>l!uI(N!?Y^o3;jnH)J zNaDRC1;aC_q8RpL-AGCh)CpgNHdwI(L8)dbDIzs|GBdh}%$fLQ6G##rp+RI=b$nLX zJbN?a+0*1YeuVo#t!3t)9dHHx1FKLQJLlBK{wZ>@kh`FEy5IZ9&0vEv;k(ZWrMN+jg{WVZU2i zVu>n(8u(@JnFg8+6VI*R`dBy4Ny}a?;53f3Y z%4$OrRwz!?iXa7qKkpuwG+Wg7>%RnD1owoj!S9gDJs5%o80-E9)ng=F!s!GrH{O)x z!&-EzFdz`Jvvh0-myhewc&>FUjKuqopQ?!*TQZdH&LY*mP`kfAGXmEem3`G06VeC(o`v|v!4;bDcR{cx%|aEDSmJT6nefj&GqT^ zjtEgP4}3RZ82twMW$))U5={k9Q-0j^EUa0-M`xP22MwuEaz0leOKz)2WX49n%qCHb;N0&hOs)v%N?6g}u5d@Jqyg%}j@* zt~yK7eSUHvjI7U4d1SD>zL!b)vwNh+C-vr{yD*_dhC9>ttE zo<)o)982nbjCftpDYW|hN{&M~_Jh@$XnSX2YG=OxcJG<{?eom79-&j>v)=0RZ^nNo z-QcXW>|E33=!81mp?fv(CP&Fbz9R5y!IxL?WWO)@>C^5%718B|E$$DXuZlv;r@z#k zomeP29%`SZE?N1+`&owAR2?|rE zr%Y2OzH&xl_OPup+>=V2x}@qvj*lC32}hxfIJ1>aRg&(4-C0gTag~tQ3rOJj>e`Lw zwS%;UGGTm7snF+IM%;c6gR&<-d0FkHZ{%{gYLbc5z0vxs9dNMDdUJh_kIwNbQd(m$$S2J_sEg#)P_lFI`p#W9b_hNzXUe< z$=g+uKP3;v?3vQHQszp0I0-v-X2g)p_ohywvwCunKENc#>D%?cH9aAV*dJ}WYOyoS zvo9zx}9Cq-02cicZT*cvHONC$Vq5*QP7?fKkYtzd0ta0NDXoAY^lMCeI8;2L(VLlcf&r1%FbTrTo`>>ghxN>9!a&4BqGinHQy2jXB_GbP9#B5^PzAlinK_T;?*`!M z%yG>fN!+>(J*jToU4MUD5M8kDu_`-UVACn@de~l@A%3wCYxNr2(Ail{5!-(S-@3nl zpagZxCb(u-?c^5dUAQ1|tcTR55;&~@j>;fBc&?-k+Ir;s=78_wGTSJ#Qylp9rWy+1 zr4kc|w=zEkaS72g`?Ns&Q&8)<3%IzK#einVHTd+`yR7dxR^FaWTaeUt)9KH^7Zj-J zIHS>az)9dN#7!mVp?iQ4+#@PRPff8=kSa--CYg4ofXcOuOSmve-B%u&3!57kiHB-Y z{%wmpC7%177Gvg?|F7*H7&&SF*-)!56UO<0^yU?%@9xH&7I_ieEA4#nv# z7UBlsBsYZskKEW0Rg->a-;@cXo6$MPy7X?v^`o1WO1NG+Oa+AUhptM2sZoK69<^wU zao)M{m6Ca}W4r?S7;t{p7N!*h?8X9W4~u@mFhPD-{(wHCf`#QQ45V}UA-ej3wm666 zCk-%6j{ur_GgoMb{KQH_#A(QG9z5z~v@T9ATnYDSW%a^o!H?6&ZI8F=eSUbl#5~fIntA)v zt?J|%)@tAL(RLt7_bDfNU;d7{6CA;ZTH-(`XzRbW9N^EQrApD0w4`seNnB`hH?@Ul zP~CmBLg>f;EZ@2S&sP<}Jh-Fcb!O9~3BspQ^G5#nX3^1}@k)s)sm&sPFT*^fTqVaN zU5SkiM|9I6M|9bhp%gQ|&8DW6HTy|dSA+Cf#y^gdxU{lw@>Bz95D%}dC%1#^$D#1; znF>$8V=b^|{_xE4rFvAuS=@=)$qTHCKHz1>_Da-JI%(Y-OUxHSgm;a*`F>X>s4PoD zFfdIZ=8I3~51zL7^mLd=@Y%z1cBir2r6#Ia!Nn`F#EE`zf%Ne&wQ@}-1R&9mX%G(| z+&J(Bim(!}l(D4uV;u~7!P@8xI$R=zo7%vVJZF|t*V9YUz3v}%6#CtcM*UBXxfVBh zB!F^JLNm|6YVMX39AjH58_C7_YYsje8R4LUUc=5V;mW`C~QhV!Klr<4leb0pVBvf7|Dh^sJa-p_@;F4vlg4~lS=#nrNGxR1Ac zV_+pg@ALNprr%2>-gpKZvUv)_`eCNdXfVY z-qAjZ?hE7W#!wxQ|HKYdiNVPrJXBX(89mZYm901t-*z9Sg{t$j10GViMPb6lu5WE` zZYbaxE~7Va*98OLTKclf06AjI)hdLsx1VTmIemO#wCrwOjY|FI(T{Aq3m=<=c%2*< zeaqdqd01u1=lvYQGP0xe5~RVZMC{aCyd6yD)g-;m-(lE(-NhFhp-1)GCcy3iZ!LT1 z$k$5o*joIjVv>K2c75umIQpyAsC2X$&u{VXv?wZQx*|#iJ-Q$GVCP7#U+)7(WyaLT zv4IT<98Z6Hnqvzkb(L8E%DM>_K)P1A>M9lvTcp3cuUS)Ib5X9&wqfkvuaKYC4PI}= zwJm10akS&d)LAy49KvS?Lxyrsq|o zcT2F&XZIrRF&}j*4m2oHD(Jf9X$sE4>p)|$kN5RMs3fK)>P^@M9JJ(Ujm!^0(K|1z$DAXSUkN;2qdG ztw`gYO9D7e+2vOfz+?-)fp=^8L%?+I^NgFT*6EJUl5q~E%mP^-<&@Qcd>m`5++CX( z8sGu))^q*nys=1J5(Oy&BU~^X*!cA5hyI_LK+?F+`nFe&LLEMP_G0$qVF0v2JzOIKvE+YxtzrdS)ypn0=6^;)T+AuEHKX7I>WqTzr zSC&G_!g$Tg1b99j;?=TYX5tVovxg)^4xw(ET6{4*Dz=6Ow>(3&U;@rY_KbFK-mg|G zqesJom$0*tq4~ScgCt1}z)s$$6z`}V{fO%3mQ(2FE#lVuucgkqt(I%$~{)>At|GzcHtUFQKT!HX9MiW9I6~L??`Mkq@ff>-WbA6-=s^n{V~UJW4g)1NlCX@C+u0bY<)|RoO;1 zyEQd#%DCS?yE*A1mvV2Fk(oiktR)p0=Ub_aQ$ zlgtnTl!Jw*-#HMsxo07gm2LX6u+ik)GK5|p@+VUfQVc_`JUdsOQC9CsYYKrvi*cT zA5M^k5-=3>G%oXkCKn2r43`oEt_(DL2pk{pxt+wNa!ILClB6);pt6)5L*>X$E(}fe ziiFtt0vmJiBU3La!7<|QT)GERBZ{HX?uY+R@+&j^2YViIpoDjLLU#2Y)QW{7Gg{69 ztYwTz?zgTd`)W9!v7i5BHsNp37Yu0CoVVRw`r0OmnefFoBpSVqo2-($4bCQo{a$}_ zysP<<2Jy1nGKOJz^JQpltp7JY9h)al5g8%!`;xGdqq_e(;1IW(bCU&MB*h*vrGexE zFK*mr7@_i0msz-5%uJ-Uh zc>GIQAq5e@;Xlwd2V@ojx=1qkveEGojqz#*PL#+l&>~Q+`y*pBqUXPu3S(#u(GX}$HgNQT`@c^~8FZoD3U#uys z8JH;uG&;x9x9`o5_!rWg1e)gTJL{}jFQq~Jk1&8&xGVxU!Krl6lpQUq`IZfxt-JHnp z&PDvN%L(D`i0SwLUTEoE+4lLxXB;VVS(q>_v6RP8re3J)`=Zk$J&HP?<5tS|M8a=f z;-q-W&p!3^WrHE=XDnWP6W@tpVdTuu~2pC*reIaW@6A1C)uhSf3sNQBjg$&1sjRq8|FY8ZO`k=JiL zujrV5d`6N6@84%mGyoy4;WYDj=Gr2)hsw3QGJLC&{?0~NHYzkR#H!N@thhz(J|$?} z(~`{T9U*s5VleN*_& z>rVLh*c8VXA#ox}99dp!A0TA%tY;Yq=R z+i4(ZIN9SjI#C2+_cf2tydH-iE(+ejB}gcg+LY z<@iMj7yIYG=HXC1{`!TWSb$CLS!rIK22G+rWzQ__mfUT3k)4@~nD=1X=>1T8 zbQdQWc{1(yaF+#HS#tgmMg3y9->|^&#)h7)GgGSy385oNON|8h*|nwXO1LUCbN*)K zr=wc8&B`y}^}>bAxElcv+Zk#^-K)q)Sr*GMe^)#YvX1p2@xGeA()s}A2>=wdMSqz4 z&?Lq%zk8s_rQ`5QWwNINcqcm_9k)qW94KAQ*FRsbMLN!bUl7GUwyQG%Y=f#2}v8&txl!&lEw6-r~Rc#zH}>-Ep9 zZ7r1XeI7~DJ`YLdE7%iL`qa9DrX&6jXUX?~0Z$B(04`1S8XX-L6#cD{*3v@}1e%!Iu-hDw{c!OY~UAP}L?zODED^1~hNGyd_)tZZN^-7fs#xfJ)W&N_sRv-lz;GHwq1&21MWb<2v1k+Sd*NH(f>EN>Ef z0%fBsKS*PUdoUY@SMAgd2bf2x3Fmp+?n`&Qa#1{lti8V0{g_7Ghp$TE-i85lx4w*_ z2limh0vI`wOG)O!2O$ZF8}8iU_L2f~Cx)wcqY3fm=t=_5d~Uley4VEByJY{iWtIPB zsdE)d4|xhbuIA|X*Xr2ppk)j-=E?advdaXEMfpyN8?79?KVgQ$<6D2Aa{bjv)Ibbk z1-pd>_Ax}|X)cxO!a*N317Hd9Gc`=#QYWRyFNFb{w8ql$^!detWU?$t-RC5`{1+zj zt4xZ&8RGw2TH$#Iq9G4c@8>v1vs3zyS}w8sh^kBr+Gi+W&Hb7Rr8ZO2zr*WYDdQCK zjC!3cfZl^0U${E$pWyi~fG?IgZLIwjw&I$r76G%_x$p`cyaAVi#;4(zp7dbwtLow} zhXFb@aTAquMbJY+br zFhmedz4{D5q^A`Qs#4Ux$^LmWG?(;PbVVPs>3oEy#zFeOZ~qD(sAA&8A8?b~F7-|a z2>NVuQsYHQ$(~D%O3s%jEV}xq>C~|Vmjg{wKg#D$G`x~8u+VmTVZ??A4__JRvDR&Q zh`e8nNWW^-uQtBQk-}0;R-6;ySzWkl6qRh^pXedF-gDaweFWJS=>uklD~<4t8-WUF zYv{3qJaT2zZUKf1|AQCBXaNB?0gQVov30PlqoG@#?@O&tu2-XQ>69Ard}> zW67EFS~VaIT}GZI>#nTm>;}(8fZ6$Rn+0*9KRJxySM#)5NJ-9c@M1cyiUpk1hqf{U zJ(I|b3aDz0hcIT*rT$)d=H{8agaCB)SMZ^eyrj$OI=rOmUKNrB= zHrifo(ox-EmWba@9IMHfSIJz+X9sp@B*Ko}NEhO02ZiQeG1+SG&e-AU*@I z9P7IAw7tIv$xtXJz%S;N@4>y-%k<=z;W>X~ZoA!+(DyDdq$2%Q?j~v{x8%F8r&%t1 z0~Sqyla5Qj>3Kb`IpdPH77&iEksLVE3RHT*%DbE$mR#?Ac#z(|>%C8HWsyPbZm{*t>3a>3#-%4<=w`0C^62$xu3%qhaPYCE$6O& zes!d}#9wZ^KiH7or3PqszBbvH@XNY)H9&iU@jL1Lul))ReEDY~Nzx^)^?#y|Mc)|4 zm)X0o-~RPbr&R*$ed|V`JiYZ`la+axS+3J`r$9qm`d9dMS{SA$f7~($+Nw?EoJd@smEBD&HMB83F=n+A-eTK_h zsRGjX;=rdF>we5}%SYY!-Xl!N==^7C!so5Jx&ln?m(7`~zlQ^5mt6H;Q*>*{W>>ju zekbwr-g9=J{LWpAdZSAC5+u)fW#;DIAnt=roRi*;e{6QTcF&%3?cMY-lHD#WXRTB` z4@$}9PG3 zewPCHoxAqLp9p2Ju*t`w&2GS!o-h#FF8^&XY(w(=7p8N|+e5qQ-<-c9FEV;$y=7sV z%b-ylv)p;$)D+1fms1Q|DWj^-B#re;&2&IZVpNeK;=Hl0?AQgAPswddbElO7(6W00 z?E`wMVokn09zJ~eFEo)_#2JRFUV0wU;Wr}4orv>}KNp?-QUlD(uwVzx3tZT_h=L!Z ztyrS#Ge!nqG)R^J?D!?V3dAwPlMgdp&pl6rJq^YjabdyvOLSZU?~&?)=>36g@^oiN z@9cB9^nnz2G}Jc+A<j!J!lPk7eFJ2{6i(X* z2a_9EA=&XglIq9(Go085iRG*$Z6chT??>AK&6?1S??j})el1K7_?!%2o0KHQ-QPAJ zD7t!w)3pL=@GDgj?58B_%)#ZwR8%#SX40MRkq*fHwjKI;XpOLxqy#C$k63LthOU5c zZXl2P6`;8cf05iacakW0I)D*GHy*B=>|=EsXpLnSGn6g>WyP>a)&(RryaV&9XEqOK zobkTiabGsKR=~G$=)!dH`SvXq@@mutxcg+@@le2`@p%8yl2jUg8O^J_Vtic(q(!{z zWC>v|r0C$bz#WKQj$8)e0?Irb54{Jj`sh7%*50uNyk=_*}23DS-NO8z$EFUfQm^KB=r0$N7l zbxlIl>dl2uDu<)%6XTZ#WT+~rYPbUGj8&SV(1tA`TP~%0eHbE_zj=?gE@HGjf0ji) z)0H*#mJlx;fCYC-7=%GSI^$jV>7gdJ)N!T2?`r9TlY(7^$sG&60%ct(uBIRT?%J|5 zpHo{aBlENF8An9#xz?!La@4au$dN7dfbjLtKHD;7>8Jc!<{+M%u@nW`_Xx*9(bg%H z&n*dwM95c42*dj+b2Qo}&IEY2*UH&HAk&g0h26~8g!G-T$~FlY-c@PG(i`8Mp7GYb zk9T8X{$zC09MC(jL_e=&b{vlO>+tqFTe2_px-*QKtkEbjow+$k6XNNjRY2`t$#M|Y zE()x(XJyVa%hEK`Y9eY|fDc(T!f0aQAo2$d zTV3UYTy)>{&Gu`|JUU@!@H6AlO*zb0OCkP#wZ?vNL1wr{=*PB|5EBjtfk0d66o) zd9et-LpOk-dj0lyMoi{%_U_TbEazV$Y06~`-YR;u8xw!I@K{vSK^|^)??>{V&$Uwy5FZIthSNaDaYG0ciR>f?K)$*4bSGmm}&jo?(3{F z>)Xh1VQanvPso-vb->tdE8XJdzmDYHWxi7M+CuIoVd%Sl1C01S;u0aHI z9S?LQvtlY(99-3iGQRn?l1a0)qn9yGE#G!nt4i{gN1+u);}kmP z+omXK`YMn?aJnHc%1z1=UNPJ8mL_3&uBD#yj;qp^%F-mws*7{Sl{uXSg9;ocGq%$c z^-Zv9RHtfuZ$$3Wvx}b>N+N1hp*~I`cfdG=>*NJli|_vXEAD*vUlg0oG_5pLrw@$X zhq5hP-WJ|>1ZVtJb;N6}Tx|OhdR_kG8?ZhHdUI8f+Haegdwo4@m_T%v|PWm|T zwZJdyQ;{1w*+=T^)5DAG)!7+9!&iv+ZYWjzOL&h?3U=!@y-#;2!#N1YmJ6qJRRkg! zHwES0vpsLM|J{F~?bDW{6ncWJG40D`Aup(`@WE2_i^szn^;&n!p(D$lsv~IW7)dh; zR`fMQwR}7;AMh9{++?GJ>t(EZK#8NCI0{)Mr_Ro;90~D0>TQ_(ko%;4l*sk+>e-(F zKy*v@o=?QV<8L6_K4!e_ZI_O}T%k_a51y4*Vp~N^U&8RdlzDp&52-Cp8oNLH#NQzx z_}SE!LVaqG&-3{<*1e8yznp=W2yugUYos(^^>m zYq_WT@a;?5@*iB$)kt{jkxi;wN@DXU&FXS9PIL`yRwzisz34z>Amy6Lmle>Zq6pu^ z2DSS?c`7Umz!Rhm91v5RaG(I+v#|`-n@BmevsYQAsQw8)?{R}tM`n6xYvUbZ9 z?K58eDOuwG7bak~tINO{s^0pjW-cQCaW>3lghd5F? zL(1nO*+TyTjy!7+%f<&egl_as0ToL2ZmW%{XD|jBU=}ZAe|#l1r*&s+qQwnLZ0>*) zuJdbthdIC+TAFdpuF6aZc?v2IveSYM_dV=&xf;4VTn`Kw#p~`Sys##J>U!7Egvcd- z2h+HyoIOS-d*1$45A?uIt~bjOMRbKv%K_OUfNd7R&~P6!!`w$ge84YaR=9ioj}6EJ zm#dQ=6P&t@$nS3ypZ3*%jUpN#JP(|groT7`FE2LS>@_C>OS(v&TDy1|zA#cqgV<;l z3e`2#5v}&7y$tv!SvH+X;qN&iGk8iN(L=0?Vee!Q|Ap@=uT$D$aZ>`sn{Ou31E&$+ zt(C`Yha`A3)FXelD`Qw+wo}3#jXXCgB9Y#+zB=4kvo?l@)KL3IQE-U+!%7A`Ypi<$ zekm!+KQ^a;E=;m0#w^S$H%Xio!ha0|Ox-eoM(2wln)wqDIrPq(fL?nFxFJSaGefmI znpg)+)ew?R216NmsmYz(ca>iBZuDPoPF!N!%nShZkcP_P1pKNHzT8jQB|_%sB{i+s ztEz^duN~l2bv|d->>g}N7KyFqC6^m@b`R;x3khpUx@+z0G7~=@7L?@=2N2ZEpeTJBuxx{7Gp+AHkp^?!^}{ZR|RK; zPqzBQNO0?Xb6t7j@t9gqCH7dJdC2>EZk{2TDA?G+QXx&Sk)k~K80Z-8cg-&tBr z#DJU~Rpd_v;>h^tT4rLn@`QiaVx;ggJkpVqjv*GjiiP@4ALN_bz77QtU|}J3_#2>i z=W5)GXmT;dfBdV-pQpANNlc6IVoSk269jz92hd7VAmz5d8$Oq z`0uc<$$&wf$D)LODh(^&u4IS?YBCKTJmPNbt>C8tV=hp71{1NxYbi2tJeN6b} zJy-}auY@08Q)v;4U?o?Xag%znZ!dO0*J97p*=Kwkq@!A+2UKrxFHTGLlt%ZR)d_#P zzwsSbo;J#D+ZYP7V_O4b@VcYMD~qs3`vNje{E;lFJDj`%pz0s{2|CLP_t|w*V)gP5 zlD2=cHbs#GX8sBd|NdBP()KT4oCgh@)&>3pfIhBz_6s^cS9>Xug!Hr;@v!$r_&9mQ z3vntir?zH>0wuErQj!Wo@075g{s^3}j!~IO1!gwDJ`Q54((OmZ(!Mt%PnDPr2>NU| z{Gk5M_y4K02dQ!93hWocZ*5jCYmpSw z;LDc)6VnyJ({BAU^$@P)y?XB(#0%Oz6rX2VDX@sH&ZbGmP=C2WeR$|@j!jo?{!(3q zl*!-EoOs%=FHVs2M1<72BuJ)D-ezhcJsjHD<~xdgO^k!rSHk_uz=F@0=0_r`)4zDYwth4|xky2P;RBQ2w8P8QgZt3f45F0i0e96~ z$){z^8vb6!L;rk)sM??9&VUvZvDPC=9D|*^%v3}bznzYF50-9_j=j39#dW0-o5_wo zWx>Tye*5yv^nn1?35xe%&fP58^fUsv!UCipv;^AsmO*1}kYo|7E)ECbe)Srq8VJ#o z^E&G^lITt1W;*=6j(>nw|<{;!_5dqO?dWGhZ;r4ar-7jG?{ z&+`rS3&7WCB~K)545|khob zcM!DcxtUa{$uTE3*KC7^2q?(?m2Jd`RuYT^o>oBFu0mP#HzjPa73FtrMchNrZR5BR zAmX%W(U^#dk6IqATLHzL9gTEFRnwck^+fTm9!!q>6zv=lmy-Hi<@tLH-M9gcI_=o* z2a>O<6)bd~wC9x4QT*>yXFr?ye&0Fsi(%W^*-9rJ;nRTU9e~9p9wpxu2M3R95n*bB zg#;;K(0drlZoR3lp@ZbqW@Lqs4BA~vQt*sJD7^epbD5K>FM+jeewLW6%b4tt?}nDA;}Mm@%2GM5Ak|PGpv-xY zK#?L26`p}NX^7QDoW7c;)Xu2xBMnL4Im4})X&>{7hI)tnf6un-URkYe5KreGOyHq( ze?HI7j-qP5D{w}b$4ZNAsA_H&(px!)PzxAQ@2-krEo)au3}*0jO1p-{*)JY{Zg`lZ zLz#V^7PVgjBEO^s>U_yce@hLPqNeHP!Zyr5dS$Yi9V%Y&4;%e%8GG9P4;sc0KU7hN z?1=EmzE~kVBWmphK~R!J4{~F$yB&`RI~u#;9i7_Dhi^7UHz;cxN85+{zY7<9j&_6E zJtuBWW5k3M&{)0r$(h&jiOL6Q@S7Wh-gNmL!@ zgdKQ&eNXL#&%^M-_qU%2eey*o-x4`qUk~omQc==rol;==y;7KPB>5o$(d^qVmza09 z>=z%Z1}{zW7&E_>JKOb>{oio$o%q=1&#O#SQm2(jkI^6o>vzeZUug6U>##3-)7PvD zE~1ECJ`4?dYE+A6z$QLs{DH8tEsqf-S&aFeUmV_Ypgu)uIJj)s5Zjj#+H+`zezTnU z*0?9w%f4-*Q%}vwcx`l1n$&X%j!xux#&D%Mmi7)1MV|Vr=)eq^Bi*qS&p(6MJ@!hp ze$Q`#s7Tq=gQM`1QLGMyKU)o7k0WhqfAM$H>+8U+Hhx=q>XvTrZ;!=WM>AikpN3|% z3sW^}{tX|DD~4Q!tFqxvst!d-#{~F&Z&=QHo)n>I$y9wj`6W_2<%Cml_tZ(cRgCX7 z_m#lb8R(PAKKHt~<|Uxf;lyB(0P$l%z`rJjS-av0c8`!5rB?q#Z z1zr{w#TwS4z&A^CDB@R=L%;&6x)B=FDun;)4$N?p6s=$eiuD`0Q*SBxs(d4XO;OJ$ zwhgWiRA5Lwe^472j}DH?Z(sk{Qre^&S#>w|_w9D2t37Rzzk(7Hv%MTT#Ds`ye0kU) zZ4m%L;*l%tMallxa8GiKv0$ElRUVtGD7my_NE6)Kyu|9=;t% z)2H{Aj-;n&>;66abK=+X*5{)n5#GbMgFfHh}>s5?>kapTjJ>Dm2h&& zwj?U@mcGo=uI*v)ef72MpYOhc#ks}7oa6xgysEn8=j!2KcPHIK7-VELP4$u)pAV$Q z64rL@^$rGGb2e+ntDc+CrnRPOQj`sh*AqQJyI8I3mz3jdin-~u`Q{K~vY3E}Fzb1t zBg5KoT*WqH1l}vz2eICL^yhVTRiN_K|JRL#_&oK z8=ifeZRUlGRzY-Z`2xVsL`@C!#RSmD;#OAQPutv8e|mV8##`ZcY=Slq$$TSl^7PHS zKiy)N_F!Kg(4I+BRB+W<>~rBhyiIVo!0{y=3H?uu#P zxTNS^lY2zWZ%q<`jhQ9)n{Iu=pg=z}*OfSR>`4K^JL8e1N5jVQEG@fe-VM%z>6P9E zSw_YeE1`vo^N%JfX5#>g$h|fm(qJ!t+vX`vlDQ)$cs64gaW7ql&y7Y_yWSGAcD)f? zrhggM-WQ<$Iq)#2=drEH!cnZru_s8M3kZ@^fp;#@E+2@m&Y(PtRaWfb11m%PaF z8<%Hn-;}~?F(ps#Eah(E=&`rh*2p;R3KsDCB<9+?^{2=?+C4#d8LWqvOngMxg~8No zIdX2U8!?6)2D@#W)+m_c+J^k1U@KWr6A$0mXPro*dl&J^Sf*zzdZa8Lj)-A^$EyYV ze2`w@kd3S{6xik6L)-J=(NdFMI<;8mD$G!R{jlTv2}1dT>TsiJ$+Z#*8_v3eQMH3? zG1B`$b3{hzW%2Ud3Zj0UW0VHUZMd~v+s2!71M29>rItwBwKK}E`+n#=;TT!$>G`71 z%Q})NQlvqotfj*VUm!_up6hasXK&iSDuv>&IbLj^={-4DguX4d+x>kE`M{_FwygUi zq(KaRUjf=X5xyPrivO22ne~}XeMOS?9V66T73^kIkK=gG@5y4a>^zU_BMeE!4Ef1x4P-5e-&m|5pSHr z$-9zWDNMe1zxRbA@W%Hq%U`}%KXMOG{-{_o z++I{-<)qfT`e7bq>OcF~Og9Y}@)8?ir^zF~Uw{a-hua1)`ZrjJF?+%0qSzDgrgpu0NQR2a4Y$$^+C#Q#@-b zC9$@5r>y&qPdT}W*j4!raFU$rO-|2;#xCt<8v~Nx24eCoJ0;FW+veTh{Cac*NlNht z8hW9spMGG-xOq>MBv_9H4|G|tJ_%DT@z4wjGdpS4W~?&vfRni5%KBC9?mY>T=t{fZ z*a9(nGK>R5g#^OA5)V*5k5w-3BrJ=7smNsqmozvnB`5TT`#Vx(aM;!yo8!G=D$QM$ zlq*{KfsAat>!+X&=tWF=(~=TIFV4yn`Hu#?Net&R1=NG5L&#pRC^fgMA#`{Nq*!6(Lvla&DV2Iv|B^_?j zX*K}Fy~I)^vBT%KZz3Z?^yde4n@kUSG&uuTHh>vvc4T zRET2ONpg}HcHIB-iAr6vzn^?#)>tDi^4E>eqSEre{gnYzss7{nV>^$E_o~$rV1}-} zS_#jL6E*zu#_X+EhZ~f3Gw*pR(7M>aXi%A!cCJft7Zk@5+U}kL1y4Twa~T0W_gbzK zz}I3OkmMaZ*VfY5cmb^EhjBe2ypym9HWj#n8qmjP1==YG8BUH3`8^F^&5F;HWt^Pz zG9LwWzXv=?>|2DP8g(}$r0(yRHMJ@AP`mZ!hXUi~CbOIXBtU(kA=;T$*Kma&plkF= z{|`X$*#KZ9TD)xepN&2kHc~DqxgcNkzS~mcYJx2KVVte*_oI41&uO4gT?`c5gTbPP@SoGVn9QCqFG)aSa=v$>pzRIg(*_2KA#WN3^lh7BH~wq?@K*zTM8 zZO26@u(_~$nNVn?2&Pu5X@&#@JabNrZ*?pLga4CXr-~t6K_$DxN|roIZ{~9CWu~I( znN^o8$W_SI4DFBI9Qa!4wr~`3T!i-v*mIk;Q;=H`eBY$*$@cuKfSROx=6|`e!Zqy+ zWPWi?Qjamf6+==ZkBC}_i#KYUNRf^i@=iRYa1sAL7qGmDOz49ACV+N-5t?lmzv3|8Tv?}WgR{d`m}u!#BD?A zdvKVND?=~LPlOkJ$;a#<@uIca57dH0RTq2s+3fUbptpzo;X`)*i|b{z zF-z-8i|s`?zZpXytl)exr7BJckFXp=SW;*Iyt9crA)S!DBgESnPrd?l2x`hD}vt9~TV{0{p=2p8Ro>ba=mKN5h9l4Rby4TO2Ui@Dx3 z;)PBDpub5u(vlM6-!?`LwwhjD83*Kt2ZQukm;zkz&>)D7GNwMl;Sb2^2GdoCt zy@50F5N)h2!Hud$6=GcJlBtk0+110Ci~5p_Y7&9P&=!#5Yx#RVuBf62F{>Kg`E~;0*C_P_Za?WS={IHZ&eNL&gRU%ZZ3^`}GO0HCj#mPh;Anu3-k~>I* zG2Ho{qW{zid9+<>!#>gXv}ntx=f%c?A%R9-$E&W!pzag5vS677bhS(=y84CVNB%Js z*=Uq`3oJ)$fP5ha2C6#pg<^-&y`ez+hrzSUe$ZG5A>9$_V=fl_+oZvN@_%C~N%QQ~ zWr1G}+XJ!yIsfIpMl8LSJP*gGf*Lilw?n$0YN7f|!p2?C_QbK&_0Nd=-q6wp!Mknj z$3EKR#M)h@p0FXI1lv@H1`zS$`^#%T5RCK2>@#b!?I+}9Lj{lpAZ{X>c@% zRVV|?h1W>~$yWDpEr;$>G4PF(KIO5W@jS;v&^hlB<9Xan~ z{W!OH=$QrB*$z7>B3#4`!Rfy+|P`8UkZb%uy&*FnrhMmZ|vGi$7t$CY> zgPrqDECHb;uj>k?!A*n%w9kH02|?X3Bo@hk@g0jsFb&Br(9^ks;4Ti@??!0e=f1Jx zBvV*`oN?Ue@cel*pz2+ForHTP>)+&ovk@;13<1OgnSI=t+?y7zw7>B3{Oli6(c-cd zdotedLpYjF5@c1tUd1p$&E-gw@H!k&i$O9Ug@Ma${(gqJ$3_L?;cHHqYhm3f$FMz= z)fr!1JDA&*uY0vmfcTf52nixEfqOV*Nl^}(#wQk!F8hCz$_nMusW{svacLtiEaiCn zT|ZrQhP{iQN=Gl&A^w`eJON_;OmUde9dpY&p&1XO623*<;4&KyOnjJ-VfIjVqTB1+ zQS1KA0PS=N#vy=7RIO@Ej!Y4&WZ(((L>u$pA9LuQLWXg(pj#%!C3~>4sxm*~89pPL ziko=W{)ypc7+QgFpD~`x+2voi?0m;Qq8+~b^)<$6Wvq=a~)RF>( zC(m@eT^;8k$q`|(;{yd8%8?MFHq>w#&-e55C%@Q4ZYa#_>9*up0Dnlw*Dyi}&H0<0 zkwY@n?uzLT(Rr`Bs%EcCEox%F}{uV z*qHyC6bkHl9G(j|k+&fFV`~SodzQk_nEp}UAO=Ui>eWIIE}mSf1#QmEzkn@A?2aaR z>QQk(NRBsuJ<&oCS(4$Ow&?8>K&DNQ7m-N$D zYh=UcUi&kiv2kCJ(UH!RB<(h%jQ78C$BUcahMEsIku>~_weGdds>%Ga>h4-Fp{-rK z-ksg}UK_GrXG$4cDCCZ-Gxm%ft%vucDo_Z6`XpI-)0X+)*$s}1z~hHXZ;>z&y?@zf zF+e!fMrf_kY}OnW62&TcH68EyurdCm`}21(Jkm?EW39BzfZSSF)BtCV5{Pgt8-YbI~dawAg<#I=O-{G#YgZi~;mMdZ3eA zgwZ=}RS5Q$gAnO($q5)Uay@;_HDEgyFBajEsC$fEGj3-BN^FOy;hz@;nb*SUcw%6{o zDDcLC1HZ>jj=jhbaTTy}7w!1BOw_po9BPmmwXiJ*lUY#7bymLDV5RxB3dQLw65(d( z!UJWk^J4Zl?{13W$JR*a`8E_^TI?B?6vGMNhkQ8X(~EKCJ{M#8h`7lXuKCm&o!fS! zYsxPizV)9Gna0-!Pvt)y7bh(WB2^M0l_)= zek~;En>Y36T>{+Q@;f@wBS{zZVUxt}Wocp0PtBm)+l8nIC&t4rZmt1kUzUD1=<0DY zgCaF-ug#c>T6Vcl9$V-lBK#`VP9k#R>Ei$P@FzQ67XS$d`Vh{rDBpujDCm{!e7vwm zzH|OF0p5u}*ffI#x{Q#Xw=dg^5$pELWMmh$2yyuw9vU zvESSG7YI@vWmS6`tSv$*B3K{7x2WY4693<)i?8+R%d*WpFcx;}z#6iBR<4ea zc*&yRanK_jPO+MAR)6w+(heim%@hulWTbQ8m%qadLu`dkFwp8Rww@eftu>R+HDr~! z#r<$m;AtU!&apq?hE-$!Jo7}lNz__1q9HMo+oU^?o!=WNa)usO`RByHfPrGk|CWKb zjaGc$?;yAeF5ZbeHv|=o)7gKf#KMKYb4j^iLHZ|VWXVMtY__wk9X`9*w;uiK&~jsR zFwg#KOs&*eXGEZ+bF_T$_oeEaHa0g+kn?rhQD27us2;~RYXYZX@TGAjCt*zfEgE$a z2f_BrE1~~}r1#*N&TxJtB}z)fc}}bCoAmK%if8NvE?!Q-J-bG}$N8qd0ul!l<%MXa&`QD;TmuwF}6T$R2F=ea7GCK zEC(4NcF&`Yv!Tky^1qK0J>tqb1@OYiR`}d(&$P)-yvCiU?dI*y@l%Y_a3eFHy+RG= zm|f1CfWp>3qY^ex@F9uY=Z7rbC;avt6B%J&BVW8aga2T6*~1@7&%S&dB|DtbIeL68 zJOCJcnIO%5f^c*Iz{xX@ zLZ(vI4=Ktf}EOL?T zeBQrx!kYZX$CFiU%8d8p_t+o`rLWA+DS0`Coc9`uu^C z7`~>dSlQ(4;oR>s)V7Zace?;RV`~+It~Gz@!+2A(Bi@IN6B2@1pMJDbec-Tfs#3=@ z^HTfkD{Ze#5&pO1Kh$o=Tdl_^*SS%cNT}42H^tTmJ68i$U}8UWmW-Gm?tHcX9)$wR$|}x{cz;8#IM$wYHf-A)(5B1w_QAo<#Cak$*|nf zPZ3b^>us*kJ?kLufxM)pmaoT!5u2iRwZtNN02`SmfmL=(K%`Gqp{6+uQ^_NxBslB> zklKaoPYZs)@jN{-o@*YMuPq+v&f&J6}_gJ$Ti zG6|D{A)jX!KLrn8RJ>E+4<7#=`qNq5&Ty$???s~Rf|Ni@v4Of@cHz#MSmbTI4hfUiok09={IBRz|`VKd{OE1ug^H&#BBue z?!4u}qU$yE0ZkV)G*)Z`p!KmA0M2`RGwlrJ;mwY=G%YWlf2n6s(|_9FBKpME22XNt z4Le4bBSZQ=x(P6g8&WV0OI)4Y$-7H%?uwVN(oCG;zBY0aN(=IMUX`}m*I9F*tDkG$ zLZn-0I{w6m=1BE*;Db{SS*oXKK>H5b@gE9MUntT|x%Y*YSnE1r@V^E3eUL8eYgW4A zFQeCNOyNerF0$LJT}<8+NgXu$r>deQh~cbZlfu0^RgZ= z2l%EQ>16=#H$ji}Tz5|aA|jn1Dz@an%K|*KmAyk!go3BBUNC}vB|la zqSS=={Hyh006_L7U(^tH54MEs=6ZZ%XFs6dk zatf}8&iU4xhpqjXbJ&qYQ5QZ!Ur*Cvc+VdF%7AsUVGLWnw=Mx`EN({!ZHd`7=#B|S z**?bW)^aone?4smG)XO@lFv&X_vr+x3)8lJUYmq?nnw;(RxM4D)yA1oev`^CMBSI} zG372*Vvh7Qysn*2dlWQ;o3pfQ_rS3dQoW<$De$CgCK8W%cAp-Z|B^S01B?tzNK@HO zsv@Kp`S879IHQX2g~j)AVP2yC2PVmS=NU?AKQtm+!mF_1BFnyp@t+BTj}>E{ntcg4 z4o>F7_a(4m4n^seDxR;d0Ow}?s>{1y5Mz+DTVM8^wxSiE&R4e{Y@f zi$D;EtwoVWxqd0xA30+_UqF2fubXR$ z8+q_^t{bX)hl6+7^}gi%$uA&CZt#Sn;TsaO7-A~Fzz;aVbef^RmNxDnh0ylM057cEWFD8lP6!Vs0hJVGL~n*c1(E!Wye5tbl{ zWx%@tx$Pblbf#;Um)KA7zL&^z^?T5R#Ib%(URM%zl;FwjGueJs${l2-%n{Og>Jdhh z--CRXht;VGMb2zIlLb6Q<=pzV;l8mG*H1KQ;yn6*bufdkNqg@DoI(@P#e*SbeeR8`aIX`-BR#2McS%8_kCa~3^-5sXT z(>9Q^``MxGE6<>7B|G!}I=pDbdKx*jo0oyj-(*A$j2pk;LXgq%!1urBw*0d_u9${! z1m~a!g6eglu^@!JID_Q#DRWr~bPCL(xE=OkdzBJfjKRNm*Ps0LG^@X}g!)v~k$J~t zqU!I(%T4EcR#W4~bmYG&F2S^U33eC~#iMAvXNp0E+gJY{J|c!C!ro@{kGs@f)K*Hh zHLCj8IkHhrWFJ1k>wQiwqxI8$J`Oy>jdJ2S_fQBgyae`~MJBtMm#avg({ERBbqpCs zpRPW7{9gNl*(rdW)OtDCJ%y8$rtMB%#eoPY_&4$%nooTF0@~A&03Jfwh|4>--e|Gw zl;PXf2>iES8)N^t*wPrxVWxNsu|QG04D_6`KDfGQlI?N z0YaHrnDvRCCUWjT=({lKsIj^rR*+IkUp5RsCR7R#h1!k;V79yM3ok;k6?MN>w8Z^N@wd8oXeLJ%Pbblfp_`J@m*;;C&dRZv@T|N=!8h zH=6j2J6uq(*Qp>e`)fFM#$ZnyudtE>MV(uBcPw8x&wi(8{u!t$%mZr-!fnWnwZSI4 ztf5oXn61$eBi!X+!Hm17;55_Vw}Lm{qfG{HdwKujzjOEg_KA~tnAGDlo?aC=q>PZc zC1rbb2cUW0H_o#7kFW)=u~hWfr_~QEl+`Z@K|6OmZr$l}REo8jW#U>pTK8y~BkKQ1 z-$W~V{dVm8?>&Fsq zx_dkHT#y?3KQBP7C*3)$UVMv|JA298kXFQ4D;74Zh@g;{^RJz~qWExd`qlv5!0c%r ztdOoT`@szY&a@N!?+*{XG*AGJ$v+UO4UEgP$|`pmv#?!PE_vqo^DPsRqc-^LH(f()e=%6Dms+phIRLEsd5PbAC*9Tbp_sjQITD6!* zbaUY&AK*``CN$L+^?Ul&^4Pr1c!eW{so>MOchrmFzR4=K4-X|{`%Y2Ad=+78)16un z=P|iR>+|LUPYR)4Yi0nH$*WZFqsg#iu+ProvAZw1)0DJPxT2BU5i44vQ`xx{bd1;g zi?kX+fn)XNxMh&B(znjeXO&>32KF)2efe5@9i;XhSnNyUt6!zDLy#kVzugZ`wVH6t6KvgJiPq6 z$?q&%iH;68Ac_+F9v$SxwcPS-sw9yaN+QqNH|v^X(;>qX~d z=2qF6Njf*welBl|>*|`72Sd=DqtofShIQ6&a*dT4AzdKFd!zN9U4I=L+LF!3(*W?~ z=Vd|HgCM};Xn?>*h4JX`fQG~mGI@}7SX8v+oig@&X^#h>EH1G= z@PruS=*y$5oZJ7@5&z6;cefp`3GU}n6>jb;XEqHCtg7z$J!q?YzCydf2tZ^CO`GgN zc;UUr4U93r$r&7L6IE+^v~YdsehnsgxPCWd(=UYW5#_CeWbgZH-I}9~tTWo%I|n^N zF^_ZtpM)d~hnXvKXizk)DXT#vg1@ruRkRX|WDHr2Yr9w9W&S<>|7iLSe=6Vqf5%=2 zS=pmE5y#$ykjxZu++>_vM)powA&x>;SxI){9NhNK;TTzwajb~SJXU5%{m$q6c>Ml? zbKmE>?(22Ep0DSC#@??{C?e*rsC8lRPZNdsl9-D)_!=~JHwGw z?>qxz#ZvB68y{-IB<)la7%|hhfFG(}`nI(D^MWuZfC2Jam_I-VqkL3Rc=bPmJjgKF zFdtM{4(E2*@iDO{YO3+Mwe~EeY!}xbE_ZujgD(Mg6)K`2K0vSNVG?;cE4Ar~i-wR=yu%Z#Gs{idRLhdDK<_ zDcn?uF2;u4Y$t@hSghDWJRB1?2(^3n^))qC(KA3=P0vRiw6t;(pXQ$3Q9}wqdmaS| zWQE|yN47rb?teK^V2&F*cjniqm0P-6zCipVH-{nJ`}7KW-P;^tPv{`&4|5Zlf(YChkhy0OufE18 zJ^xhjDYuj6LqJmzp`!IEo(N=3K(3O~m^bce&c?Pq=7YVOh@m-@LyH$PRRvQay6@rWWUgkqwNfdDdu0zD82;b$6#wLU!&N z*SuuWRMc75@N=ng`0nfY@r<3N)2E*yRXctNhY+3a#ROT%++1yM(Pal7-!*Ymr-df2sc1f;84GX_%6Nk!k(KkO?s8N${d%1p4Qf)6Q`eT&k!<$53X+y-Aex;vqUrBKj0 zB2!nM39Ne@{2PV~%>Xyv%hR;ofpn;>X=b^kYJ_IWjZ^d4oyz?1a z>U*2chTvmeB?WJ-Z)}Bfv9tEiImTx^X9$ear(b%454inx`{-nh5g(EV!zUko7MV)} z)w<@QR{Togl4GxyS@$J90W*w4T98|rCSEP>6nFLrul{ic;`C@J8Rt(qP#5a;xRD?9SI{nQ89Cp6PH@T}z9?z)Obb_T56uCe#O=&fd+`&N zt+@!l;?OGuTBFjiL;}_QM`Jxqs0&`aM+gtH0}sU*VW%L{arzFV@-zU)J6MGWVv?uy zk#t54ZL`G8j6Qix?BXApnN=S#XqfO;fsyW%s(X9&n5 z7FfS$VyN5_UHE(<-y?R70sM8xtfPTB^dI1CK*jndC&GY0^IA(Cf z=}6bvt!AIWAcPlrM{2eE&Nv+pr)gV$4QTG##h7g`87?*;`3>@t%+c}z?9rh2oge4i ze{Vx^#dml)=@{)fhkim#o!wA!wF2T!^^JaW^-QSrp1&@7>hBG_dM^=bMj(aadySC| zLa#W2SA51LY_(eAM0 z7dWI!IH&qcrg?wEhY0;~)aOMCl4n{^G;(tyMz?=n=HcWrNMpwCDq(*l!c90p|Fy=@ zh&?XD78;)47gzBW+Y(@2F8)e#FE=tx78~nSSc{fWNt{XqZq5`|MW%3N&KKhEGW>)> zrEOl<7(aiYgE8-enkmSK)REngY4rM|_7lyIU>UgKqd5oJ+5NU-VhDCoeXMYe>5@qy_L8D72 zl5`Ra3ip-B@S8gGKeNFWrRGRS8;YYc1v3{>MiUK!!8o*Ze+Ftr;4NYrCc&=8(|uBx zK${Z1$ViMg4gAc8C4F4W>nWu)#hczaZPx@!V}ifJNEB4OZgWLWRk5BqS%<`6IKHU2 zn7lVOugZf|LyqPlnIJlWImns1x&X{!GS_Ol%fw)JCfi_v`#!#9j-RXgck!Hu^UF0) zphXSw;==fs2NfsRUvbAqV=lf6EU9oiQen&B#2W=uq5KB_MYzQ98_YX;0OeM?ss;_K z0e}rR$*9?~X7Gl)URI}qTRFbyIsNXnL&xxPtM1Q)tA*UfB}~NduAT&QPi9CffN`jj z;|v|QpftZ)t~wIsD?Hb4A}|)4uZJkX-u0oDq&I*6oMvD~=W_ zjP-IP=?O-ush^?MxK7JgGK(*M#~F_Q%2kK`Vh6sx$W`JPBmtQ^XGfIiDWPRl*hup2rEUk@s=C28oHj%3sh~eqUBlDX67&<+MtyO^K4hsDD0J zeHF8&7IM*Ws(eOJTy#B}nvb~cyRCrzHONPiuf|(;#HEREt^THP%X5}jQD*96dEs>$ ztR4Kayib0Ow&WY*ry{q{-;sqxD;@ucqAKI+3 z9wWF~$j9jsUaH-ky2qi0VE@g(&PRWtoNe9TSE_*?Wc;WM=h9v0ElYzRu#dYk-JDig z<)ZMr=XluNzAe_Qm5%pVz7aZ6T`27Mi1fIgLHm@9bh-ApR=ilmqqA1~PF7U8n`;1W zTqQQTG~cA|?uRVe+(`%Bx?6^sbQv$BIl5mhPRaVlp#FOk_LwnS!{&>f^hmUFr3g?a@{YyKzkf#3V;K!^0jraXl>yDoUaTwAL40c}^B$HjhbX?-&R04)p{Ri<+}$1;mA}rw=iq z7Mf`W$qDY-(57YL&zRTAgh+QiDvN{iZt5-`q>WYcK$0?6LL+gC&Yd^;P1M~z3ahEF z?ZcE8q9~xT59|o9uvD@a-5M}ZtzV5p2S@KNMn5>>w5|&3`eu?10w3bJk{PD?2su4p zFAn00{m6xr=%*#0{mP#|QU`03%#yF3yFK+WW4{$hYjjf38c_#&4?G%sTOAh+{25+T zgpyGHPq2UZG9x~dT+i!@ekniYfZi!!S+U~eBoFKCyK^wdnu5E`g&zVqJmnBw?inaC z4hKWHGdUoP-}Ey5FirTZS^jV@z*f5HP)Q97_sIl8O%!er^w6R;;1j8`(Y4Dw1Xy28 zJGc<+dfDZR)t++B*U8Xe*~cyKSVkJ{+U#9=n$1IG@1SE9Xs~pGFcjR?X6Fe$CPu&O zXMC*GAefe~lY?qA>CgXi8)xz^=w2pxee=H|Ekl??BcGJ3S% zwM>89NzX+n)8;FisN*Yi?0P#j&7C;}^55{}=32F3xy@u`Ez^@r)^3;C@r!?x9*>)i z^dtvDIDXH(YNQHhWvyTdf)B7jLEOZkY9pJC=DbJGgunXbS+(D9n>X#as`_QM1weV1 zR-df=z)o)v)IZx~&D#E4XQjN*^Fp*%d{=yWCpx8Upf^@s#BS%VX5U%T&FIpPB)|U) zJ~H5$beiYpP5#US$y&939!{UhyEoH!-h%Ft@J;R9py`XW2_u9H5Oc+NZ^1x@b@%&A z(OPL|)}V1{FIVjT>Onl?(CbP}$QtwNOia%x3A6Ls)MNu@pzJjFq4`8OgLR_(y?i=| zsYyvKu;J3umfOcB#%Xr(+17g>Z-33;f~uaslEAj}lj6)=iMuR-5 zx+VbT^;N#lT!DFxgm|CGmkat(AmN;>ra+ll?d;*yJD;UM*B5>7rbb@s*5t3iu11l4Z^OIlHwKw zJejW7X`nc}WjE>gDm{b%u~S$Uh3|WOP)wdQ@)bN#tfri3+aqWlUUzS3U=8aPlXKj6>TmWBJoYJEng~IsuW##uJj{h+hR@&CB!Q z+X|nt6TeeTUOB$}-QF7}`5QMVhZxZfGJ{7`C5m39!M=DMJ3H^ga+BhhWJpuV(ooS3+3fxihdZ9FS$uVut-2BamBqm2qrKR3w#RtHvz0QmSwP_K* zOvf+w#7clAeP#Q?J8~KKo+8Ssyf#89fd_sWEP~SXU(L$lE_~21^K}jP7F*?!=`ZXN zFUf#cQVDrvxnCvKKQq9I<(q3z!Z^#Zj0t14>baE0cyo^`(Qi=Vr)nQ^lz0 z%4L+aY8br9^IAwsw$ICQhvAPd`M$;4+dmBLXbc&%*AeTf;soYL{-dS5?f%9wF8DTC zqNL|zGT@-q>EXL>;dZ5X!^|cnw>?!3bf)--tM0dIW7!0!V2Kt|pY8!%sfY21ESNWF zTr&>^)Ml{z7R)6kji`#Iod^R8P^k* zMV9$^MaXJeiQ5|&ef#p?BoH-nPMS{F-)4ePk$*j|C^KMTSEq>F#Xp#Q@}!_D)WF`z z;&kk29{=7U-O0@+Y8tFN8TUcjt&mh*KaSKwwideeuNP{lJT8>IRUqPm9c?i60GS3l z-XG^ju=I)D_z#~D8`oVOR82y~bZ7R>8^11OD2=@sYe7$)>jiz15dP%j=qF%A<4$iw zfc6+=-@FY_L&$LT1g!9K2345UUlZhN`alY&;L6+-z8bhS7|K#?t5g;}!)&&WDqPSzu;DS3&l3^*!q#BcV^YTaUjTpM_R zACGrj_kyVkzi~Lv^@~6ctB9qzH^JQHpH0vV1`OjOEqjcK63DcNXEQpDJM$9wS#^5={gye98;{HFg3TNmMYIYQG2mWa4yfp1+mdw==2egSZ+YO-<+ zI@7v48Wrs_G?2;Q2`GzfiO@1`iy@$-EiKj9?@{Mq^ulOsuGmF>#}g@N$M-FYDq5*k zBvXIrxqF~W={;(G1w>t~m;x7Xw1@XvMS|r$Q#x_wHFRvqx@Aav;;D}~(3$-c+8DOvjWZrX)~z+k-%J+?#%_%ctHDiwZkgPHOL}o&|1kx|mk?L5* z^c#`+dcTYQMC<4|2L@cvIB4_k+q*{`FBv`tqwT zi>aL?(8kiPU77B3oB12AOrD$sPRgb`i!U5(l5|?W!-p;yOGMjFp9}~UjE;UZKvP{^ z#dI};)v(Uid5wPL*M9kFzlxl^&y}}eDAB1Ls2mM+o3!6 z$vWofD&n?p(1Ai3w+<=CQIP`C7&cs9b?1wf?#|_UuXhi)|U<^0WywH}1uw3DCBt;&k zdHgQMKE#5+0^?k>Sw&KG(i=Rx4vEMk^0Y2dlkkwxF@<}~_W;|(RSJw_G!?riT}ceO0r%bO zK87@h@qgB)wb&7GoahVW-top6^KjB&nb5I${84om>QDc@S<{)DGj{_PKV0DiLWK-_ zpmbqjJJCtuLX(yszYd;}9;07kp(9F;i*@nOYJ{qYbCgxC%&@ZCUoyzY9A%%cd#qF!V1|osS z;#7`lkxJrkvac3CdKP%FI@NU^MmK$~q|n{`F?{)0KJ?z``r`vK=zTNjLLq6jksLjx z1w;6FCO@0VBJ))9(ZNgHC1~DNqes$pIdor9Ud3Qh9bw$-L}`v@#!6jGTmcFDu4ZoN zZGCM23V&fB^Cd@}$LC&ac#GAsOqDHVngbxl6q6@mTz{y4FThmu64v{DcEWu-80X zC}%NhWv-7FRC(m74PBv-41gyxuC#7ba5kNulG>#=%_U(I*(G6PAIAg; zl-Ti@m}Kyec|5rB!}1;28y)A@kR(gIZJ%@T^I&4BLXW&6YRbq*L6|brth(=zzOda+{{&S6Va31*Ym^wp9?VcEUACXs@qcl8k1Ot z;_Q#?J3S7fSGWoMc-L@L#+YUA`RzqVW^5abuywqu_;=N999yU?RpT+kj6oQN{2b%t z2Wxk6)#T_>Bwet(UWFWzrg7t;Q&%_=f-bEtstvT3ytf=vN7TB>#9~kC!LFklrji6m zKFa05I!_rfA<`c{K07k{ctR-hbL(qR%|X+Xgi7SZ9P=t+b46KD={sLSD8!4l4S!V> z{Y76JGf^D(4?6GjJ{UB8sGzIJ?+3$6k-(I4NqbEr3`Z3{v!#h z#s+xP0xEDUHw6)Wma?dert<53#IJ;2VV7LQ-I3%}Ko|9l@sxNfy+ZJBQ!c%}=1p6l zyKxO`s!xc-TMVE5;a!hpAt2_M6S+8>1I#t6gs@zAV=_$OJ;#N|wRPoRo3cLdi1u`F zt26IkhlVNt%jmNGcj=u9;tKHo_BX%1FcC+Jd-MiEmW`Z~TX{d;o5qF;8jykoy#b$C zWjrrpvwoi1s@&~mf{q?ex1sEPqh;rFow9MF8Gd~GB~4J}A`SLY(ZoAn-%)at;CFJj zUF=HF$?gHx1n5Sg#zNk`-{_U^T}uKF7a`gf>J?x-*|IX$@FqI%n|~iSQg$P`K(ys1 zLA20%{+9|RqPkF>j8ockuR^~P^k(UEul7ei>eNkPG%+5(Fm@$3F~>}_ zr;~91!B*l*7e$(otdtY(i1y_`e!fu0;cMQBKRzf*PgRl&P|Ofx8*$cP*zmqQ)gM**Pj33ok+d6>wMR|q zxgmq+LPjSn_%C*#UEox9;--uiN@%OT^VVFe?uzaVxD^Y)x&oQneV0Uz*55{UrF>h{ z?1x&LK{?IZY<0v;{PGsc#rkhII(R@CF;g*myJ4ps^dG3;L*=-2PPmAYUPKI#mWp)5 z$z}W7D^%RfpCc5csr^gZB9HFpnKyBbLhBMBJrmoRHA>{M@+IcDFS~SW}@2d8tuM*#;}!NX0_P;IO%v5{T*p(4Ydvoe_z;~RL0^5FZ5VtqPv`$n>jBWr zDhUDu0+AU*U>X9+QHdXaIxAOybDYyI;YmDr)CM0y$FT#Kvp($`H!k|aF85y}$BvGY z#LGV0#zb~cAl+B$jWXgsMN?!o{8PRX!V$`Lg-Zu(eIEX|*XZg=@0YA-6UhjKjK}iV z8-Dz9xo*E=7Sl~np7>5fASbi*K|scsWXJxS!sPSl6&3N0g>aO82j>6+qTVehS3~?3 zRmvNaW5BYi;{%AXO5RKHP1oZGMDJ>78&{PS#@`!hJ4b|AX^waV}v~ z{mQ^o;X)~z1>>1nBh{K8d}N$6;_Dk$pCD%gUdOoT(sz!Q1Sl?+Q2lNQ{1wytBK1tky<5a2mOMO0&UQ10&xTlIh7#Xo&dtI0FD1D_tcQ$VuJsNu^cz1IaE;B*kaES6a06r5l!d7r2pxyMSK8k-{1DR-{I~t2@9QC*3|SZ%z;Am0=u;Irx&g+( zgX98G&)=A|;#t``o^4Xa6>C)!?3I>W9#LU}hssZK(iz!vVy4R+`P8pdVI`%h^aJT$ zK9H(wUJ|mZyA*KBzxjX<*s*@6LZN zL-BN|Jma=EMBkB``S*>KNVdg4d?QY3_`zY2yO%!YjHe!?^8&1z<&gbWN>M#wA{$H; zLg|CH@S%L~20SFK$z>l(2V;m05`3!tg>r4XqL&k$-8Mo&_{MAr$@$!&i@8!qPaMct3D(=g%~-$6>XS`!>5Nn0qRdJ_9tGmdE?yO54w$>u*1 zVesKhRx+LBT&1u(fUI#M#y-Qws+>voV3UzbH;-2j|B{7`HFovhB=KWjWH53e<5>;< z1XX?jJ5)E!7Q4|d9>>}j$we^KY~f9MfE>&E@hjv&hs9gNh#EqN#3=pG5$phn?-m8x zo!|-gOLXK%rK8VJ^(FcCR@eB|5V?Kb4ZyFGwlFs~Rq+iok9ubuL|fbZZu7EseB8On zt83-EJRZY9wWSS3oRxU|)G3-H{PTK=ZAK7{Qrq6QE96)`Wrzz&GWo%sMUp5BFyik# z(om+x0zEZZ*b)2pgN$#6ALf(9QG5w$^CYNq$|L3nst3t3>&=DvZi{#0Hly6T(v4E_ zb4|uGM-i6wS8(5jUk4x30+v;NH)co%IB;0v_W0aEjA%VrXxL8ia=^jq|JW-1fh`3U}agYWX-Ix()9#xL7$lN+WC-;VBs(NDB$u7IK%A^elmfRT?#Q6 z(nT#X%4Lq=CoHUlmG%PEaJraS(n)iK4*t!74*tW5_s9)*xQJ&=?0M#32pBxJ+T_br zKwP&tGQzX^)tNakCB9Ax9o{Uy7Sg_bQgmP3_e5qR^tz0Fp7t#2`h}4p>d3iBBI`ymUUYPzbPP(P^~%+ zc$CNXt1~YA1&P-X2lA(AtH)3MHAOXG9hG=&%<&07p+5yIf*d3p3ibiM%#B&xQ7<`; zmD;-dc;AEof?ZCJ*wC29i*#(_cJ>OeQpq8K-~22+x^VFTmDU%<0#uz`e*iGUObVW} z@MMNonA_;BQ%woX7yiWO<{!p{o(BBA7L0J4Ec^2V^I2-&%p~6Dr(r&CGz-qW>t`un zyq%bN5aVX2&aZy6EI@*F@TijhKHG3fv8=Cb)=FpcKvCi!zQhs3FDPkDe@13$p!&;? zpG6f>8z(ubo=cZC7DrF}ANlabHgatZUtEoLThTT7lH_N6`qykzNc#NNRNL*(V)eW< z%*6%1Vyk^)E3YL!hJJ;TX)eCip@Sh`Vhb^1_4x$&EIjw1(QeZb1d?O*uPh4~wT87? z#SZdpwY>&2<{%Pl2g*4aR5Gp_S3}%i+j05!-}(1cFzrb=>l+Tz1RVu5SA1Pb`=rlJ zSo36LU}{>=152C3pIjHIZ`dAMW;AhIPy})vaPS6W9e;4OzxKht(Up20P6duhK3$I9(=5}X3IOpq_rvJVB;~CFS{#Ndm}4H z;$2Wy%&lj{S!VfA4LX==#j6XQ(4 zt09C3kZ%4Tqde@-d@oTFgtPJLOFQy+D2SuhYfut*$Cda7`pmeyxvf8|SUm>LUVuSf zdC+s(%u-T*FjeRsnutOlxX6Opc}jYvn)Jcv!{96yYYy*~__hbZ;ng8VgNv`wR3Y!1 z`8XM)xgK8hqN$E~pP6lPIaYrH)huV1ovN^f#0UKCx`qDqKy$(EONm3^i++;ZOR5t; zQ&;MqBl|PgcNid$>{8Lmx2CHL_c_=j#UL|{s0`EAX>MWR?3>Z^t+}aC&&tk=cRR8N z4pgkWZ^14UR8(4IH*Fp(apWHl25TnK^4CKTynh&!gTakLiN(_gxXm;$=f(3~b9^_i z|1r5qfn8f=hyvQ>-=%=4U|KAzz}J~IJw)75@gUFLE5`QiDI~rRH*LdC1n-&15TscB zaTYSGmPc4FuxzT*{~TPZSY~=W zdo^J(8f>Wuh>}WiSP(!R?ZTQ!xW2^tbkEa&qG-_)k*#UpEQYVPsl2SxV{{ox+1E*~ z)c@w7cjN?5?8caoVvASiKcmHqsZ3nw`U>5E2Jh)Km?^2`g4`31sD!$$^HdFYsEe9wL0P<6~kSTBs z&4iTnaik`GKXpp`A@E_<7==%tRl}nA2{5ML>VK&5gYkFYInC}TW=y#{fMDOK}%sg1{R$u@HOezL?)F6x9ut`5O zS7wd0ClF-Mf=aj{$pAo&^fXb&n%Oh-n{6@ZDNQ$kHT9bUHp1w{u(VAHyZZ@@xC99d zn=}|?IZo$GB-or(93k$W3egOq>9QXW{1 zLtf?NvIteBxz-F{Agheg1RW)MgNfnf<2YIrS6@^HXDC@Q#Gw*e53j|&_ANshr* z_$`au2s?{n66rZT_NC8F?V>Mj^RJMOi^s+OiU>;FrVK7mw(+%rIiCFX_kVFV8T*^kCt)dBzFaDyYD_b_fEAmL` z%EIPY+!atLe&uDcI6p*P-54$M6?221vzeQ@X1Da`oO2D0jcCxW$hw9xW1=0Znljgt zM4;2dhZg9|XA7a>lDxp`$uivJ2A-ANy7?N)Xb-FXjhV=T!JXOQ)ISbGOlWH^U8z^$ z-^@uBGKjR&a#&|lsP{%}>^#IMeEx`7+NQ#^?-h;L+3O!>H1H-ix=e{Wgl9(7XGh z*HQR{&I@@If8DDcb(txF3w7*&jI2{)*H9O+RUBmxnItV{Aa267mVYgD4Ou!+K#>b0 z<|aCWpB3HKYT|1lEInjQs^8U{S@*^E;TX5~m7(`KNp&g5)~}hf!1@!Enfqx>N9C4S z_$f4tjgOj|y*8Qz(g9wH%FOF!Q&p@x%GtgxpTy^3OIq;qrv)MAe2 z|Hm96(xbveT;M%5cd5cXGWM(wS?0X~B{ufVU?+vbPNlLQCHNnwWjuPNRn+=xd$lHd zYF=WTbPi&`yRqvfg4(-~-ZKUzx}MVF15&JVJ!zUw8G z3T{jBU7VnU?Nct91+1ooqk3VMGI)n?tJl~7nnY~hr6lM1`_(jfCX_Iqr|FyGrws6X zA7ay`2<6%RfyWIFf-a&92aF8X$=wJ}H=qR66Blu29EzChB}uhy@^U^Lq=LaEFKT^( zhP zODTu_wL#^m?Vls*j#~V(6wp=-Jfro$j8AA0?Kwxzh6-=*=EJdR*V7Iv|I*`0r0n0R z5YBtS(?Yf4nU3XitF2GqX$BxK1iXC^eC5ZOOr68?tpZtBp!FHW2&hy2oxs?XJIV?4 zKsdLnZ2xu^ZW{B2HW@dw0il%>e{c0cUbPFan@&D-Wfz3et@xn$Eikc;C_sh=`L$ZH zx;Dz?h~B!I0)J&?r&WN&2}m1`2Us&^YepBv;%&KmA*!sS?g7bLOf!lxHyVAz_!d9p>vZ#b4wkjcU$T?Lr zT==p>Nb+ zr)fkMd-T-~RT)0RfQWc%j;drS!p$)znl#H;!WiPr@e=Wc^_f)9t0;`k?KeW^?wWDd-#;_kf#?OU0qntdZCvZ4>{ z*EmvY(ZP{VwH464@Win-+uj5o0=-JSB!8cAUQoXzZT{1yHJzy8w(dxp!0oH~rSHBO zL}$oiRb&7Dxr>6)mOuAvb*PI9mgPox-IiijiN~skcX}s-5o*xl4mVCB0_FWGtQ%L0 z-)wO5C*c)|*ZL~{#D>)jca+ykESOLrS}g!lx?!A|BxES%?ng^SP3i^J>m>w%`Ie5L z0fZ-Tx%$3Cb@a+*4L`Jt&}$Ij^vM$NoqR!NLSnyedE6IO#F4{l$v{PEmR?-ChF*6z z2$PR+F;v~qt8r1b&ZnbeRt}oqIpCD^R837~;X#^cpmGB5X9uhW0^2Xxus4{9N5ack zPC8$OGN45m`~bQJ-r954@ zPyw-QM54cJ{oYGcK*-cZ&{dCp;Un;@x^NTp^Aml$FCat1_2mkpw8L#~I=VcU4Ot!^ zv8K^o(tX3#H1o01_(G;ibM?<}z7lCwI|`ko9%0(6p?|5WTiIq~(UqI?dOD7z!Q$1O zQWrOy_VSMXPAZP~#cmG8y1cwP9d=G}+2NXCgrx#y>VA?>%kz z4GDZ!MaMst$RtnvxDdp`9c?W2zx4MK7%#tx(pWFZ8^R{*Leymks-_)Ct(X-?(O=8igZN#~^AF8~1{&om8 zF!W>eY5^|-I#j`hR&>2pDT$g|yus?(zKNR;|5jjP9e>pCC}4lVNh}US2OIB1`4}r6 zCQ9}PWB?o^&6iadm}o4Xr-E|HqV7Z7m#$c6SjSU2+*J=_EY?kfBSOPpf&MfUi0fxO zs#Cr5ZY4y>G?|&*A-MbgN0vp0?#tXrc|JZdh_-Y_@!Izpi0gs|}qvU3oSm4MX>WKgul|420Db%+&8jsf{{n~2Y z8P0`$X_)<+M51jii3z}=EtTd?%Du`>Kl{lt_B9`mXJU1&gq4)z$I+Tkr9RM)Es z5=O=`EVyqxOq+1%3&GwP*S!03icW!3-Cm1+6S`ZqYK{tSiz@XHAaP6Y-sYr0yr3Q` z9>gTZekqVcjQtT{fAI+V5!47;r38B#@})8jnUwqE$T5~^6E;=3%fL}A{R=YakO)wi zbh*Gd9r$y(Pz!$EtdyA+Y7yR)Cjt5=hMU~OE6D<9)KS6D$Sj_dVFxHO&(Tlz?u50u zP!LyT_&iYVHKaYjn0VW1Hi25mMhEW{(_H|{P4fJSP}AwBN5{T7d?`rMtzrvmQF+6h4+r&>YSpo5aUy>Ga(Ek&LH|~4J z=AhiEhSEuYNv40+V~1L%$)=&fa>Gm<1C_Q{kJe$tTNT$lX|R$#6O;lxYII&IKbofm zXe{((TerBwuV-6~GY-QDH$Zh|ICc{C zF$@2p_4zTctx$ihSEgG-tQy2bUVr691pZdXTO=QGp!K6g)$r+!HCaQT&f%4=7&OOM zM*(H*W+5Na0(w|DisDiT}9mbGIvPNjT+uHbH-lOB3*WLHwuF_Nwv zjFuWJN|N9V!1Cecm(tIpRydStuU!yZ^sF7d03U+TAXr+|6$_S6>8Rd)#)Wi?5-o|n zMq;Ns#^|t-IZ^^vByH0P>s2b^`#|erqaTaW>{3QP7d-D4S}-l9r#Sh6W%IRYl`BPA z+8^JW-1Hr~QzGaKaGu=?D=rtN(*EkIYt4SkVI*=H!`3?xsU@J<67c04YsFkV8rPa* z+Bm4Z(e~!{0yj0GHbx~!tg#VCuKjtzd^=PHBQVVcQ73gixsVeJqj&m_ii}=)&B}v( zOdl7Al#QpNF~_-d)4wbgcMlAiGl=3Auw&F21{yPFeCH;8aH1R0pf)%d*Gf*sJJKQ{=esXwgnB8& z5@cSYH?*z(-BZc%v7U#$h;UCB?(pR8gaaw z#;wJVwjT#&v0GMMM_J855*?Hl+n>Qw6P`)W)mTZ)p`gz?>ObAAj&w@Gl*fE}Wd2L+ z?26LNstyNV(p&}M`)C>k0gmc*&hsEKIZKwNPDiGCqt!8yy&4QJy%!eborwZGu5+G4 zsk|ivO3c82t7EkHwv`u6EL*=F7ME*08hTZ{T+#Q6hD0MFS-JR-2aQ1}P7^&0eGnhj za^Zrh_?1YjjOM^+hi59W{1^&~YZf^tX1@cswhj4f-PSO=-6rHf%K}dkF1=7CxaCII z=KtDi*VKVy&9~sjX0tf-7;n7qG4p7YQOxZ=6VOVz>{In&8n;cUmPtu)rZ7Iwm=iL7 zdT^;~Kq})N(VucqFN$jK!7nAAneHqR)*Fg;BsoJ99BLp^v()IR`0d^&`bb>e?^?Y#8%a@U8b{jCTR#a+davE znGe?;f@|FZ0diMp#^xCeWwrXOzMZuVE*U2FEj=Lr2GWE4QekmYUp6%%l?pp|b*Ks7 z6EFL7(lC2Z>*FsU3({$ItKH2_*UTk4m=ed+BBf;rF+!j8iYv@0xVKEtk6GWyh@UFn zd8w&MjV-6v@FQe?@#O+e_)u{k3pyQb}glnhrCW<%nP@o zf_uH5Py&%{7+MHXjh;8%ympK4(vA{hl9hz{%+#>gw)?;f_rJvW$~~XVnCH2dz}%< zJEFAn-oLgjMeOyKH-82t1OQ(dYJ$~)v0h0bNzWdoB#hz@;YOO|1fK|=<&zVo<|Zy| z6|5Y>qJzIv-Zm8}q_6thWM7n$78O>F0jSefBFP(uy-@mi9oZw&pL4V3 zF@E2;hOzFZEIVcCj;I^(>pIeHg}yzrVrJD%-GTXb-BTQ7nsO*q3dJVm@9wkp4tt^vVkUU@0je+N%GfJ93SMPre^nL%7m(@Y3S{Cv; zJqd3U>|_B<4ON>@6;I@7fPdZ4RSoqig=+Wmz6D>P%()sJ4Ogr+KDt7 zf{V#^dXqe~GX$XJz%X{YmB#6XiQ_$e2=_L}!HcAOcPG@n^OF{IRd*A%BpH}hY z;dq3v;U|Rg=aa6Lv>$t*I)Y&2$42=x{-aho5UD6eBuoNHs z;1u1fTa7JDvf)%jm^JEd-_e~#+%s&QhMbcf^sVV89?%NES1+|C5vOh#Q5e=4Fq*ht zcl&=dy=7b!@BjTzcgNBoN(iiU2#89GBB;bNq`P!?qew0Yf=DdVprF7mFmy|-bV@8r z3P?yxDhU4P{rmjC_qf4>nPGNjuj_Trd7f9OOm{<#*h5GsF$HdB5n)2qlv)tfq(Dsr zzZz1X-};?BeN^ev3?p1BN};8EQVdxq1qio7PapS>#Vu1VOa!a~UuMg?HT-z0^B#MR z<~^%rW%ww_Vr@S=ykVjN8gusB`7fEBq?{P+vhv;M!uxPZytLJdtB?kpwaiGVh^s7@ zcrkXaTtaUzuHn(z4#98MaW>&5O*>JWjKii}For{x`=?vi`~lX@kJ=IbM-k+4U5MuC z#+LJWHZwI6xa8H(G4Iup!zB!^kexi@CsqvEsT#@$-jzYHZV({t%lx(%x|>;|_Ca5U z?T#3))fOoJ+mV0L&IAf`-OMHz;dkW1Wa$&HU5|+rMNAJ{t&4fd(3y((*uLhSMK+1E`%i4i>yEQh?}ZYko^|ru zvnCuE4+gC0lji9>y7#cawqSa)cwB+zVg89=?!C%w*z4!#r0!d`(yS&wjvBAd&sbI5 z524@RD6Dy~&YyHZ!x0)#Z@sy<_wW2|mZCrJmxTPy z77CrE{T*F#5`4QQdkVZd?tRo@^*34CmxxRrXVC>_DS=Y^c~GbB%dgS(YnF_?jVL}x z57!a)BYFkXq;tqZy!UItaqMoc5>C~LYQn%13K%b#n~^Fm%F%7@?&u9k<3y|pNR3Vk z(RtS}Ci2@*ik@%qIwsCE@tqGmQ{0boFuJ7el|&CTRi>_7c_s3c@e~$+H>l+4TJ61% zb^WHm@3RM10);f>faO$EGLt?At<n4yTsBD;=8-b@mW%fs}yftaVpt z8N(JbWt=u{w`s@zNaEk7x$q)`GjjL}wLyeJqt(a<+M$b>j;xN694gS|&}c((lNjm# zypp6tmZyYrTD)n5fx6Nzg@F+#^Z4d~(O@0a$;T2|@VJeh4*PhE;_=o9M^Z|CYFHjHkVti$zW6=^4@z* z3cxy7HQXeF6#jFR`?GogIf7ck^qFvHyIvR{Vs}H*{rc$_!fTyyh2_os)-b?yR*P0% zs{5s{$j?u1YfXn1zDd@xchW^)@BDL;#Ao9!X7 zD|qLF`>}m?h9R>2wLwHT4x;T>f!6q5-Elto9v@}gj4j4=*ILI1C|D|~y1{JD55M^R zBufxUWN1<_8ru8O*(*27T4I~b7MQG2#2d~ts(3Obo=8;NY;eJJV9l#TU&`J$!Trf` zELRIRpG}91f#Ta$>?5chX*eBjJ2U*+tfo8>4u1s2<7W^P{=BOZtAPha9q&#{41$P3 z4>!**5L)MaN|_EmHZh;T?p(Pph{d5C${L_I;-94V>YZgMB#@#18Kh|?4*A}t9t+ok zGh@9zqU{^hKc?77j%4QsQ(x8=Vy-UV6Udgr$aM)b|+^4?>%qfSI??GE}2J zy}?@W)APU-u#(j94?eY;v)NDXV-(>H^4E7nVjxflC(@qb9{Io1M;IewoXK|ODo;T}w6HCdG4gN&9I}na zL5AzG{(bq)+tzzDcAh=ppX>mq`an095W+ zwj~XA9965D{`8RehKFoVS$ml=?+dgp7qTj3*?^B?F2Kid>z|V?)=%7)i|IFQ=&&aP z^X`hY#1fz0jA_RjdP>+OrOfNa`2ayY@R$7)bRW? znG8cd$EVn&vFOd|cDAO-`;-Fis_*J*KT9G{1y2=ws*5KXWV%6uTV+^R%J?)&hH!r| zG$YS)6k+nz5eA6zFy(!<33LONT3hI;vEj(z<6UN?NwV<>xM4{{VOADm99cg8aG8%> z&WfQT8CBSg*JaQPC{?nxAjVgl7dsc>TP1&^DC@+q;h-} z=1ac?;z0zJm1o0wa^P99TRr}`rRm7wLqg5Rt+w0f*ACf7&l2*r z_NG;JTmZe$%=3^+kDJeb0G-vjd}2YfDppg!vKsv#%FWH>7~N5-V7xWsi~3`VT_k{B zWSZB#Lb+A}(Xd3XVU)7D!pqw8$7E-N(x0Ir$HPmjERBje5Bi{x=P?g>%I@M=c~B*E zdS^o{jrrAbIJnLI9DL+YvG*n&U~^q%%RRB!>-QukC2qqJT!Mvk+g9(s90y$Z5Fff@ zdm*v`AG(g!Lv_@>>*>3roASMXR}|K*owFzEBbwRoB$>rDIaB2tyk`6R&R6Lnm!-O2 zZetkm@jEAt6QJO>H2wJjk2nuA;n{Ak4DRX-ev}K*Jq$Y5Z|KU7EsTC@Im1c*H1&uz z;BYI1^DDqD2uM?EF84^+aK}5tkngB?sV62{4B7O>p%n#r48JS#+5^8IY1b`+pExz1 zlHpd`DG9@M=+lwsG#dYYTOtu7pt*V9(|ns40Mf9&SEEH_4qU0&lT;uhyqV@3TcB75 zmu#0FjE;G0VlOgZZhN%QESMVlQ5p9TpW=}&-AGrW$L{rg`pHB8s$^+$IJ1;%2?^Sy zDLMJp@w^9wgrdN!TuMMzAziH?+PqolN1FW5_)kr~kBA;I1ai!$?`j2R|G#A^0B=q^**n&>14+0> zW1#t`6{mu-LY*CZoCTCIRE;6wL<|qV2UUIDbb-%P53W5(D{%E$PEOyNBf6Zyf9+P$ z5cNp~`amtPxzm04mqWXrsa?`o-8W9%=9MEhN!lrFbnZO~Dr}xx*$62{mlNYYea-nx zNhdoM^%9#0E1LrsVMz(%*!&(=#sygMwNbd^F2e9C_SX^avH)bzH8@l89*lM^R+YzT zd250Uv<>cKXp^)|<P6)ZKt@McOCS=Ze=%gxW6=bm9Q3+Ra-by&g|t? zyvmL|Zo@;P?f%El->@QxZ_*t_p;q7&aQ!DkcI&+pb=v74^U4S=c{s|JMZ$cnqD(F3 z{mDMvU?~i;(A)TbvI$0O6V9E?Hky3Z^S9cNi=A7~_z1S>n3M0ixB3T}A;)Z%qjh9E zuQGHS=+XYS!a^CgLU{1&_3e-{b-g>!TDbOt`!5^@RTGj+V0tu+d^e+QoRMaR>|dTd zy%L+Q2(MitkO?8{`20OK4z6j8fL_5-Oe|~Qv+m^t-E!2@_1C4i85}haW)BgTUtaVS z64v5S5iIo#KgvPW%S)1YkY5^yuY`2nQy#?j+zAJyBTs{ytj0Ja_PPlsq zHo9){Ia^w@V>!#F7UuerWqft~&cqubPQUv|K;GQmv^kVDAP!Y{)S`&9K8q)}5bpRS z#{iUA^SyW{7y}8Pou6Wx)2ZQ0T$r)!S8sPBw~W53SFyxB#-bt;pFoBS3i$sJQoSn; zP$Rb@0m`!m(?;g`mij(oE}pthGwtYaQs%nV?kISYUu!) zcv6G9zh6NqTw;j01^Mhh2qI(a`Las~d%!sj0qfs2PrcFhza}-kBI2YO0TLbCH;!&l(*G883ecXVH{TuD*^_~rFB#BdS0mVmZKfQgP^s|laR^7kxe-}Z z)yLpe`vCadz%vY&S3JGRSN}{@lZBrQk%aQEwaRlh-mYh}!FTmzlbUi=!^Jf} z+?FX&h=I1Fke4r`YLkqLf*jZ4bN|%kp68@_KbRYN}H|=4_Y~Va*5ok$x$a9Fp{m5i)g5Ok z*GS-<+?djdv5qpb-Gs^q>SY7d*a2<~ZQn$Pi^Z(BJT<0%IChM71e%DbtZHtkj_7;j zy$mmQzT9cbLET__z=^qLVpU^xPYL;@Tv@xbf>i|{87B@+m~zaUlD$d*uO$Uk_ zh%>-#Y#4+orXSqX6t@p^MZQd^c4DBlas47fB|b|!86B-_l!?b1>0XfVFS8C+=srLP)cg7h)^5!;d-z89mu(qUpvXtm!oD=! zp!`qb#G4Z*(-wZXo_Fi?GdIMP8~}%48_jT6=$-$vr%c?A9sjt9ZtyXd7d9~P7DPiG@c9dl2i@p?2w*_fIi)~!AX$M4ydDq*BZo$Y&$v8 zvjHRE*pEtj8^h{&;Y{xsA9C2sr+!7IUkC=FkO{+Aq4pNCN$n;#U>%@0AB6UvJ7*av zbUm@Te{HArB2ZDux`+|p$%Xl;S}0+o06M+C-Db*q+-A;d!2{W-=a|yd@iQ7- zQy_yF-kfc#7abk@f{Ug8?|=W#yShPtPm=d*i4)xXJsQX$-x0iOQzRK5iQlTTVRz%l ziX&ODJ%Xr+mZZ&UG>J(Pg55${d~UgbG=s@L36+VV_j}|=E@-UA%F=95B!eGc0`6HD z9)nLJ`vv`7e#Fd_I7vzRv5xyQZL2!VJ^HRWnt1Y4MZgq``X;GdFILS!9fA6J z^EMb(g5rD8h^qVV?VpLB@Pt~BH1pe zaZmfBEZsth5Q>-zHg5j>wq5|}a^+e%ZNAz#11%9O#gK*Q*Z_5=+YwHC-=jLt)F6Yh zEIvek7;$bvw^bBTHw)q*y}kG|4G-d-48nvJUzSODpJnEC==+Scb{MtP7VUCPzN}aL zlp7{K6fy*kz2RU9KvDUR#zw2GPU$7DvvgG6vMdcd4&YFtqi*AiYPP2vAkU%--S{_) zK2B$HdFs^;y-#ryzR;|i8!^v`?>f)Vz5+heow`+pHeQZbfTwlZP<|cc#P&^%IMg87 z|7MVGNgNpF=^T4iJn8`Ha#g<4o8QID3f)6I@Ul;hx_B`QCjFZOp^@Osq75KQin~B} zixH?RS-J5pDRsLNpbG+YnF}=L!IXAAP=z)P--IwYS#~`hjD&9x^!?D?_MBc2~%#Zl7Hios@{08z=H!&`O|L?U~FheWOK zR%|3Uf|(q#+Lms@HKzxNuqSY1ta45%weFDN9(IN(gRex7$M2_l0^yIH)~=@diJFT` z42hY}T;|K+P&`Q)f2T0-Tjl_(xgu%^MF!9t@xL zBU)a&zREb8Z(TZl@bSU|mU9PANvXqKs6!+&N8+Z>yI1T^|KRgZHM@tJR25Dz403HtCg%Ic<~YxJ2mnTraMC+ zZJQ}HM{hRmCKpfwe|G4R_O*g^gZM`87IYES1{mo@RA6y%}R zj&%Fgh$_DT`H2$pf(>3{FS}AZG)`|%QPx*A=UuN{Ygifmepga{_VTN==#GUj@5TM& z^YG#h*%U{QPlSIWLPLr;qpzSrp+;a2nAM1yYGk5~i7p;&Wz>GMrh=hT2zA_G??-(x zeXGjBgE;om-3TX-6TTz{$$qv|&hl&ez3aC})btr|)kR&<;Nm5i(&G>$y8)LC=wlY7 zv)M0$);H7Dg;6Pul;H}~Pmp~1WQg-{RN{iK((6a;Q4YDGBpo4r5PTX|>UJGvhNxyp z7>QhSsdCeeQ{vG1D$Hr%{YN6%Pb#VuZn~#SPfLaIG|%i%kpPjFG5&h3WB`eM<-=lC zTYzLNo)gA|TfI16&+JYQ9{FCt=u0Q1*ZfZvKVEt9<2la)k;M!puHl@K1i?c@n7#Ek zDtRADXDTD;5!9|M%xGS0^)OHT_rJXF0nIn+WgseD`Z+lrHqF~oaJ0*IhnyYvV0##q zYjQ5;kaCdlfPMct&3A-dZ{ofW&{!vT7oz}w9A8H~xcL0NFA$V)=&OvwH*mukah>h6 zvo#%AwjDDK8Do@)^Q*`<{n2g4A!QEX@q8H^`bJ=7A*#3rFwtjE(6@E(BTF&dS5vTMC` zorkrD9(&RusIrUK*nO?tcETBrfwU91`h&J)Kxhdfb@Pt6h%!J0)kq*(ZJUE%CWE5T; zr|<;Xbd3=}OG8}3GZ|#&6%g?~za4rsq~vj|s^?9gr{A05Xil!sGrWKNmfJ^ecZnCl zrHGT25J|I~fP(-Py#yn$enVs%|LI2r_Vf|!_lKh(S)O1Vn_jpKOPkPEq|giU+a&lD zOv}P;5kAs@g}ewy=stlcWh(7(g;(_C2)V9V0BO~qSVMma8Q*L-q$D9f zZ|`&sR!0TaKTMO9fVam?r}ZZ0b3}afy#q2l;)F!{71-KP;N#Y?T;z?7PA!dwVvliB zgeGx4LB3@AH;iVNo|@i<3e-s#&fZn{D{}0s54P5R8Z858NcCR)3!&t_w!597jI4va z6)hnjJl;o)oy`Rm3oSXeeB19vnniuB7z-HY>O^K|dv&wbSgw)n_$orwgD0=3MK?`^e{5e2r8-qw{LDNS9LvE1PAEa4=4~` zG50zk)2fMG?mjD9(g(Uh|A77W&2>=gkvoRB;O}N$=yDKUvGvP*lx} z_yGDrL+jGFQk9-mMqxhfx7LO9VUPV6>m!bz`BMgZCX@aR@Fj$t7wvubGt4hE#hfX# zsm1PeQ$ErlFAMayP%bn#cz#VN;*7j)Pbm<|*e4Na>QE9zfoXekp)q|dv7ecRKAx&H z@R(e=G2Kt3!+$PSNqnlZLae%*UbXisWtm#AM8?X*_d=`fFuTA_eU+@wjC{l-l{CVpltf`}c@S z%cWKo_OPEY`ojY{2{yKBFTH70;m@a#>A%C*BoW1KCRjLK-ziCpVR2k`C(Q~{wSNOe zk}+l)?k<1Q__!Ynl8H-P(U{cxNy{k%2k18apMFm{(dc5JYjk20!er~6f%81h8ljR8&w3k`Myhq~H7Cd!l2|pv))9b>?&DSV3syPZ?MU1i9#dY4=07w&)EZ{fIZNXSMjA1%=bftl9tk#^ zd8@v0#)6MWzgFn`bol=I1CbAK5;-w((4$0B zP1VCjledywS0b|Yv={uYs@VZlTGER#e<PK0pg@m5WrWW%;@?jR_+4CCzzKJAC{BQ&V*nV9V#Ya^jd!&3KFC+xV$sQ#J=K z>+d{9G;{_`v(5#OQxW47@woBVRGkk)(AI_qFE#C0ctyV3%6;Qc8P`QVPS zk4m4~hgdsg<5$Crt(VLfch6e67P|HC^w96<JN%Vi5Q@898C%6fE(5_qGm{oCq) zpX;QN+X@7c%uKo97TiztIGS40`{PjdBv^<;&3DQEz&2gbQs(|?gdU1q$B@eK*JBy` zA~Z0rSH3Tnk%oFxu?ktZ?nobP)|VB-zmx7?^8nO50VWfeLt8od@c|-*BDAd_J68-R zM2U+r?W+9u+N_kvnk=H&eR}FQMZ~c-TA`zd)|9Txl?I4CQ<wM~0rSU!F^ zJcd32VfvNPFyKVOn)HcbctPxY4f%er${dE68g`4QbO!3!ipu>o-LGO8lCAx2bc~{` zDl$sQnZD@9I>+tLeN7TVS zLUZ@eAx^YH_oa_IHtHo9bVWI^vK>%V-#{6?8rbuIG{GN7?B8co&kkdQxU(r6I>}*ZTa7dd=dHK@WJUA3N+i$(Mlj1SrRA_i5F#1 z2y8M&-X0(y75ib)wew0xZ<~GMmV_OEs3oe~hpNNkbo+{l3gU{tu~-NhTR0^f%hX{5 zQf0H)h`B#gr9H}MCXG7c6t*R=#h8*b+%~vjypc}t3N$ltX3G#0mKJ#k8>UG;5p@J) zqM~9>J_W`QcOCpd1y%%=k4y0$pRA1;&!uhr95H!u&|$;>mYiV024se@&+5HZgd0tD zC}T1pKgBa)a!JG%V_XQW=nUB9h_ zr{C53(=^AjiYkq*izA2i?%UYVwS=Qy4#ofTh;a*Yt@)RezP+|SK4ne4@5xF=XqSa| zU?HT9%A2D0sxTN}UNv<8_^`ue&$q~nZQmu26&vm0V!!|zT$1MRo<|%Pp?-x@J2PMx zP=HS5&E7JafUKk?HtuTiaqu15o>bG#RCsec!x?Z|uA+K46S2SPr?SC!5Z`pyby?%? zI6^&OX!w&#urfSz^Pn|1^s@F(KxGQ-@k8__McS2E@_#n~NVN#XS7&>Ao`!IMNl{jq zP!=H2LDjK>Te!~J`z@Il~6 z*(;W4QUF0fK)g7 zP|EtHq7Z$*S(ON^W69M#;ii~ZDL=qDfh=)q+zUIvVUF-t()DrA7v4Ut%Jqoi_*4fn zoGVWGDJk`;@VtUD(qVUVZ>TBpOEsDZ+|cp+FqCj>UzeAWL+e=tO5vFxbT?^T1v^&yEyV{ScCzpikV5cCX2!{9tA9uH4&x ztvE7(lorR8Shc@|l5Y?u(K@y1B%voiUe1@(j6!M5HLzM1LW?=xj_aGMC(2;tLD$=|!mSBPCx*c2zh zA$`6kGp&?OtKCL{V6&#PFQ%46oLt7V`O_>Xc%Of~W*uku&w$W5}6#b>u; z{r#RZiCnsAR8gGB*WG#Jj170u-m{Litu=F$0(&^Yx0HDgV_N%t-f;h!=0UKQ_)GQa zbg7J|eKd2HX+#0dTfr4)lIW3>JySx8wMp*Bk3nWx1v2A=6F#9>}koYXr_5 zrEGiSXA}j+MgGpMtfaV_?kY>DYiHMeWd|k$l##)Bq01PQI#S;oIp4oAku4Dw0s~0N z2vh^uqrvB6-8+E~2bgymn=`d;ei+mGMM@no5BV+fxTmqNc`t`Z7g4S_)t`s^!v26; zRp^qEYxolg3-qw&&L%)^6l-!uzhE`c2KNcKmlf@*525rE{}WSA1yVG>H1MGxA&;%6 z>Cn$m#fcpLT4}8NtDEr0eP!fedqB$d3OWY6QU*stb~Hn&MT%PA#;enj+PgInxcEtd z^YA-P5~f2Ykj{Pb{$`$MoqPH%v!Z#c26Xn8a!q|&QRl?oniUH=tLk31=D2U!l?! z^Xod&0FRTdPb;Lm4SL*R>E~lDE~aKlga)vrDKt z8`<4@1wAMhbc6K}v(Q4~gUf{6DkkfTN)&(Cp}ZOmE@ErS(LuuFZMBi5sC3tHyk4LD zt%{0?$seQY{yU(Drz%8*vEQ!whL;b`Eay4zuuk~wesGb&jj=%x0sf?CzquYOKoG;l zs$|rZmule!uE>5*+e5dce(if9TUFkBWhoc>a`g~q)@y)@#NxL{ZB8t^7(4f0NOjQi35aUTiU7B$xTe>x``18Tfb$KQr>269{zBk$+DV>{chYrAp3bQ<1$Yriz{L~t1D+w)W7 z0sMz`V#qV_;xu~YMW}T9#OfVxizp6eNdXB*Ksr^pkpTI~Wk8LU2UI#WU$d^-i4{7$ zFeo9zT26w-o~Zt%!RXhVHw{zH*@>dB`bnDi*hw4;^G1j-TWP%?)udi1R~_j-d;P_~ zNF<3ICSQ82?b9a@e-3q~nUmlsT7P(^>O1N4f|sujd8SK#2W1^Z)O{-8L?(vo+ck{Q z4d``V-c|@<3RtI6rvH{r`dh||dGsc-ywbj&*c9f+L%zkwoe8g6CujM#Y#k{u?ZEOua zvm7({Hmq2ixHR3#d?McXy5b<=(X_9`*Q`NvR(!#ZT<_xHWGb1GYUC8p~= z^~xiDO!9uy+xRWR7-&rBC&fB7x}5SDZI7}2C4D`SZTdOO9e7QY@U75j?8#UiIb?nk zv4QxIVa7Lq-#>lF9WB-m!3aq{d?$r+AFS%;qqs^ja@;@ygK$lIGC7QqsBrW+vb3VQ zyb2c_vxJ`g>V}j()$=Q3g@dgJ(vHDeKZi!I$f{H}=W}>lM?N=Ldx?P3l(d2gq%edS z``YR%m`6*^2xCyZozqcngcHPMGX%*>^~Y*zOptyXx>Bp?>znv?r#^#g67f~wAK8*j zV*s6!3Ve7(wsopjz(-!lt+Svq*pBvIHpMoz52IzniF3BsY~~OzVIlc3yW$la_DeSt z9u`GvJmmT{nt!~MhB+xq+1c#%2xEwiPH%8`^vxR2rf$2&#!~9LG|AV$S|5F-&dTzw z=-dTO`{FH9!Be^9qUQ&Jq&NKesj2mh(^?9h_5b6g*^c;PqrW*S>Pg|Ya&HlS6%1VY zmFW6qO_too{9vi!{H{aa>ub3;7I_aDLp+|hFL;<9T)_vd#CckBTa>TY1%0w@V{^UX zE70nF)Xeg{KjHjo|J(CMc?OG5{;zUe`5SvqTjrWC-!g$e7C5)=^wpO z>=$o7HuCsu##5i& zcMnhGk_1B0qhU);qOCvrM&3WY6Kci>Q-|3Cc6+|8^wd)-OZ5mU)z%ghjmx{o^e<0j zHR3_0o)k@lOVLm&f$7B?&hT{@{fJ~WfPO;Q(M4+vi2H+nFHR3B?t7S zuhb@)?DO4oj*05T=r?E2$7r)aywo>lV`ee$g}&t=)2TRNcCgJ=XVXgn-*rLSDK7Yd zyS(~EwO5*(6Z!)GK#96nJ92+RfP^rSzAHsZ_!Y~8IKO}tuv-~42x#W}ng=G?^MDg! z%R$3q59ogdU96H#va8W5cO^!^_=nx^&?bg9%y{v32si~Fj2QUr7 zM7j$P;YIzKFm;UZzt}6i|0^`=6-dD^LqsEHboVj3aQ!O7^EW82&gyuRBJST2?lJaG zIZ0N+wN0nZ;u@qKG%TDIXcIeDy=3yPvLkw|P7?$%tm30wvZ-Bh_ji8iguZy1|7M+y4~A z0^9V0SiCj9>=s`9n=yd{9nFpry7^1m23R0+A#Q(^oAALf_Wn^EGluH>Wuv?b5ILE4 zivpML0BL$2z+(HsN4f2vzRx>pxClT0@M7-Uu5x0&QRPB^TOK!Ah}U@1h?dh1(A9;y zT^klzS>hiO0cpBfT8^Uph*zjLo`TtQDBZrgJ28dth8UyMJvlM6nE zLA&(->@X{@M<7MI2c(MqGy=NG5X7k9ER8bzP zbow3L$w0^e7=2{=mkeKDfcnGN5RI+pm?T)+0zr&-sRI;M)6$!HbiN1C0e6PLq&st9 zn1;KF14DwI;d7`=umE)WN`1oL3e{W~a3l2Tut};IS-3~ea~KF!t8VSam^(b#dc&j_ zjiDqT4vgWk>70WZG@Dw_PQ3EAEX;4PQ~A{~OdQZ=k_J@X4S!4YpR)`@j%S2O%k6!j z!M_3UG5*KZc(KPnlI7u#lT9S>WeMMfLO;U`X%}~%Kn-Ei@I!uXgah|hX<5*nJ)tf% z`?hmDy1g}dCKx1Hsy{;50h~d4a1-N%O)BhZdi|q*#CPr3YIz5tnuCPeCY!un>T*E zE(3Q!et{w>Nl!h1(Qm+cDBaf4Blv@;u5CjN4#e{b` z;e-+$B&3CA__FUgG>`9?Zr`_n-fmYD?&2QWfdXWRNjfHP%0*3Y80WT#oM*b0HdM!FZ|)3}UYjq(K7R z2FOAesKQtltzCEwVRKv&;WDx^jLZ%t{ET{}c)LOrmu|Xn#Xy&~+dt?3JL4v__Ndy0 zFMj-eLH2SQ6=i3-tlSkGs<_1vr-JzUnB9(yQyOQZ1P&!smI;*(LPuxTp@uzZ3cV!b zi>`7FyD|zD7g_dGzLnbGLe!B0BItjRoA3XfbBJXw^tt%>mzUs54=Hyk&!l)9c;yG- z_2X>}Zjx|HQ2(Q!+M<~q^yE6PiAtzckc@AcA*svER5g{BIt|tytsKFV6@w$T_v$h4P36x&1r--z@Uh~?8 zC{?sft0eXO9V|rp=M_wY%kze?Peb}vcc@-$IEx;<7VzJ_vR`S7u8Oo!5xo14@=3SI zlY4oKpI+y*WQ_@2Cc3}*8{6^>V$bcofcyxzPwy_q)oN!SRCy}=(Ku(NxhFTGe+?pa zd#z&>Agc4)6PYEXldB-y6mRVmi~C&rPh;`jDJ2FYQw3GOpX z`M7%>%o4s zZf?x@wwBEb7LJh-Vt82Ws;7I?vRK{`gWWB#>T>uLkm%Y9E5xoEi1hk6V(DN@TU^oU zrdMj~UkIY667nOo%A;3XhS}Oq37iHW>69wK;+O9~56*0&{xmEls%HP*uUgo(zgqj^ z26y*c7J^DWGu@_>S>}v5;GI`==a+P6bu5lv#`1ULYfz-=phV~@uEg@D5Lwc>Jr$IF zrA6_H1BBRU!bxzC#=={fpjS!5>q+$`|C|O)_kSeQS!%}@D^er$bRvbzDGLm{A4xH@ zM6#9fpvrhr&U{qZRc@Ku7KpP!kiOu{4atyZB7{uL3jz{I`>5MIc0&=Okp>YwS`c9y zAu7>!I}aSV$~JxSQ3M{Pl2jpXzeJjS4ek)GmXT8YoJK1Lm5nVUx(3E7(REFz=Uw))2E^(iw$wqjiZwIyXfQ5waFla1MkFr9=M0LTYtTZ z^~)I3?%I@S(ej;B$tCaTZe>94sCSBTjil@N zjeZ%G+LPkm`&8H$H&8bOQBq>z4Ez}Vq{!G}4TajWnCPEKr}DcknI`oCp@8 z!+}%X7vV^9fpU8hZ$WjJj6Dtoc=T~(kObKFMWBs|%^}Q@CN_HTsR6A>P<|%Ju-7s6 zxV`OVfqevJ{x7g=%BF3z?}C~ddxsK5%{91=BJSyW$zTj3@3oWI(HAes-Da0y!HjR- z?zHiP?#)%Z8ws|xw4Za!Ggbuf%rFLa%I@e1xzK3W(B|N0Fj zT>d$Flodf-jjo*t%{urb(n{II;)RI=39)Hlt$|_nL9_{yr-ov~Fg>vxv%O$UfiGR;+>WyZ`10`5tmd~V{gZIJ1Najg_cu5nG3bzax?M>}qf+L#4+hVb)zLpX4^mbW+8egxWg|d({{L zi9}(aDQ^QpG1Z`2vDDigiDU(8*b}i5E9FkZ(o|tu>ifox55H1pquow3=cD~6EnU?DdDexsv_%6#>si^08ZwDt_$I{+}0MT!Iix zja5woxs#(;kq+1UnyaO!I;p7=^jYbS~s(II?c`L_UoiQOPX+ZDwi7L?I90I3F!&l@SQR1jgY+9P zW$u+cUfi~M{Yv~r?jO;`ukFv}}S#rn&uKt0tH`)cmi#cooVf3?Aw zckLYkRB+FxZ|3fsdaoFUROKu|IIMam($aa^ru-iktAgqu3m!w@)~%ft+k1JrUs0ybx(m zFgK_?vo-+I>sT#fIL9i5-`W4_S-NU4F=Je{w*Thmbtw**Ykp(>I<@O0EmY|t!GRkx z*H%fcFxwICs;0uGk<7-Jb(#No;M# zTrIq=)xZ;Lm?ey}cYhbHscT26;kQERIiE71+m2}dGp5mW(0(iZDK@ONDmtA5*Z$$f z@5E$~PbU2~uxkKEzD)3PML9EU5}1x$%(tBOzBu3D2+XuL|9h*AzWAzL zdb8_}OHqsbv87olmAg5%4tj-Oq_h|42RCY8@2zs-G@imAtfSTS$X(6#9^!O?EBSsQ zm35w;W{%ZOoDrAvM` z^>Pamzy-D|CiF~?N-v#y>o`)FS+EMJFqUgR-JCSZVBXWY{4{Vzn2i<_T8E6`H;pca zF+Yf9yKM>L1j^0X;GQ+HkG+`T5*+ZlC!lU}5dK=H!?5|nvud#~4fM+xW+LPF8~&8> zOf0a9sDrD~{mVQPHlBa@$Lo76PtM%)y(HcW`9wKBi`skw_ADOFX7^mvn8`w3)J1zp z(NW(^U&6OKJksTyZFHQz$|#|W@VIfu?%{&6l(|;wK<}ToV zG)u2)v~{TDp$fVyp`*pQ0q{u7m^S2d)<4NGtuFHyI|`lVQk8P^jJacT9cfQ`?ORnh zP;VwBPW(sZdF$4iPPrHp3M)i2ck8!Xr9Ommk|v(Dd_0da=#&{~FARqp=1UTZn^3O96>pSKIDP}?Uf zs+%5n_gS4_dExw|Dpqk%+61R{;4wFVfudQ1*M&u`ml^2d&(-d}VQg0~4v%G@`Pr*; zj%Q?IwvGgw?=i!6zr|)XRtlnwOt2En2>J0*U7&tXJKBCC=ZS?Vj>zmuow=EOBMV}? zQ;SNX5NA>PLiVih=*1`tLXkyJoZU04xOjUD_Lb&>Ory(iZcn{gnN~beK26enHf-4Txv<4qKZQdL3duPYqJ40C|%cBM-ryk5c z+@~)I(EsWjXppv+bz?<7UaXNHp#Q;B zs=>%S3T={S3d3DQuj;m+aEgu~?Mu1xr?G=fFzNA8Z6LWyDB9ln3RK6)e%4y~&R#KV zm!->)rL!ws`>Z{KQ4Cebo%C|F&HV2`w!zKqBz=-@bo7IjFG?u3&1U}M#Bc}Mka^*u zm;+HZ+%C}NqdzVESX;m%ZOrQ}vJC_NcU4kX;fN~v2_LjMVBO(I4${5-t>AVACnyLf zchtoGcEC-uz#g932#;P7#ijQ=2xGek{4H`AK57&nNPj0-_+a&6%oD4Gp9befu}`bA zSnsiW)s5T$?CZWh0O&=;sGe-dU%{1Gw?Qk&esi|9+(a<`RdJ)(iEg}jG>ZMym!{pi+p#Qx`mbTPH zV3}&F?Y{Mr$e=1t14PdvXY^8=GxZ>Q<^O)_$Q`qyP*kX|L-c!ygWnN!E^R_Ie1y{^ z3X!=o8(c_fYeDY)Bp#@7*4pf&V)9v@eQqnHiz_1+2eeS_12bAV=gUftn7?$9yU)I1#2Fn{(Njj@dRyYbi3u=*|!dgCUVZCMw5MuXz& zCAP62uu5I&YH)l05q^eg?92u)XQ)xQe)LO*0KdqhAy6VN;I2{WdvihL*w$RKWS0Y$ zcm4W$X_(#m?m9x!3wT=Y9zRTns=n{K7fq~R&5G5;uTppo=Ker9nSv?x8|c}dHbO+I z*w5F<#wITvM*R&f`Y7cRtu!oE{>2~MOs6P9QUNjK?TwiblYU@U31yVKzZyAO7=rwEBQAJ(#>#(P47y)%8hA_*{cG#HEn z%vW2*hJS&BTxS$C2VeB8($5JTd(6kSXcw}@Y1(`1c!bpr-09?Igw_;OV8fI1*RmPZ2WByl3{w{gU089-U4Pg z(T8}*jqGFQr_Bmez6}v_>fV{-y}SL$Gt-`39;DOiz-@k8 z8;h-uYV15}seG!S@mTyX37BW`=QN4gCZ2fDj};bl4{bwjn^U80w-ION9MB>-BPlWI6ZNO;Q0b`; zb6LcRjxv3NRJ16ymKg6T3QWkgrQ%OA?!qEv`kr1Azfu!r*DtO{5Ph2rT;!}nN&31# zJDib8TQAU>j~g09hv5_q@Wbr>Re)4UF)~?NR5$-1$enh+|IOHeFcc7kWKA(@x=JDh z40HR$oNeyPHpYNcPPm{n1!Q9P=BG}S^71*JQBpq-5w%`OR6?7RqUa!~p7(UL%mHPN zap`D0!dD9Tqz^;}vl*Z00YIJoJeH0?{}+Uu#1a_J;^(Q?f6@}m%24Mm~%kNGu{oG3Mn;8ibMZ2B2rLEI!&WNdp&R@Wby+UgB9 zuOYKa^1ug^mi0vkA4xEeM|6zh4Dd%Ed{JS-dMHFTc(AbL)f;SmjvE;t7JVve^)`op zRFu5FbjZ?}eF}3hLjS>&JBv+)B$7dn<}#7O^m*66GB4?Q-)qVB+53s5 zKA&{pB0`fs2gZtccPxcyyiHhP?}Mief_&U^P(Ry=Nt<|MI5>h*jGoRh|0YEu!?2+b zNA9Z_-{*xBtkoI^`n1HI&3ylLA~#f5?;ZHQACofvO>C@3{Or@zadaozy0(TN5b^Jj z=Weimo1>_dhCO^X+FKcVc;X}`_b8nh1sjijiNY49S(`2r+4d)^uCeCPrGz%YIf~wJ zpjUChKXi7D7=I+z4`gNM-UtW(2~#22f566`FJ%C}ABgIbDq9+s5q9xaa6L-fUCWHZ1gT0b_I z`-SJ|`jQd14<#X0awwb$Y<4u&dc#4#Oo5ssPUzi|%;b{IE3mvEiw8}6SLIIMZYh$W znL;|d{3I_$%nfJmdOnoIVdeCDHN_Z#r#H_kH1#VRZ54qhtNB*1_{UKw6}Ci;-jllK zc}9CJ4UBg4(Q{v`iJFHrFoWKNX*nzWy?)%-J?8wtZ6>6XPUJrwUlZa9_|`x16FPZxmE1K zqd9$pX}sZXL-lMQ9-o1WfyAU+Vg~O688Mc0`c8!Cv`;=fP-iVoUM~G~n*jx4(xI7K zi;iY|&{FBIaL&{plEcqUADOzTE6={f8%<*uC@LJt)RNAc^^8+;6fpo2;epx^7&~<8 zgVN|{KTsT|#I4xN&0H=$*O*9VlL^xI&uamMvRt@k+^DLO>-Hz0)UzMGmMK9`*rECK zhb5Y?c7H5&NVKX7s398<-Fd6|bYzvKjvCZ}Wp(h7F-g#p^dafzm`A|XevLZ7t=sSr zxc)=zfq?dZjdmt{Y)}?DuQGRUL=vV3z!%-U&`NXy_g2UT8+!7e1k5MIhU`fxz)2CQ zcvO0%SEo{3EH&(*k-{A4l0UZ}%)hqm@x$CeVDuoC)x06xZk|s6A;6a{J)20Jm@ne{ z2vY||7*g))eq^uaI6afhbF|O`?{Y&mEFRX+w^7pKSDH;(m;KTHRUNKB{NBtm8W37D z(Ovr3=5)-RmQ5L8R_IqYSaLsar$+K^p)Vh(`S(S~r%1}4-6UT0=Wj{H5sM6PAtH%} z;iwJVUu)RhbVo|_<;;HxNU$cnmgi`L84XgSqOR}1cGYWet~;3H4NNepzMp-!jLN!* zsqYEcvd{M>)I@ypwi(k&1y6fkSz?8TB;6d3K{|S{0`<&A^y=$BKH%0zYi@Kyrb2$9 z;2ci?Zl@AeH|K>e5Mg%rcu`utW<`#3eUUTPjg$fP@14yqyFCKDPMl(gith_HJl2hS zZuB%>?%kvaff6*vBTbUAve{t3_;SPJI}lr)#!op#6cI$Z2ge-y6M0Qk^{h}>h;u@_ z4k3P3AuIDG<#PJKbv(qwuday-w#a87HA3%x_Z!*_YGK8J9o*P+_ER(lGH`QMzba#C2?)j#atV|aEp1aYH+vq1f#(|B0BIP&Fbny zOVu?Z1kR@zq38LWI&g&d*9WOaI}qEG$}rTsOTmLKG@>vX^<6xIFhr^0c0==Z7-Xi* zP(xG?u>U;4uO)>Y{|zc*Ss%?nVq*UilUn|K?Jms0Q9$>JYD{>q!Q;);0Tt#pi{Gka zaNwkMkWjzG>X8a&o);kB?ivrq%=S4u!h&B?Y z0hn~jjNjf?d_m^sXY+O0_|NVo&1GmOlFmLU%Y~8#r zFhqDT2dUblI0rH1E^l+r_dmUHfeI0!8F1IG1TE7KjRh|!X;B6rIT0(VF`n4=nlVu_ z+pwypNAXy<9cFdlj<;3H!LJ`5xIVBL1+(`~eh@(TIt+=)nAn^O22Q$hG@DB8FNpxX zbHpBxLvwoZt9Bla5#b7}hGTAUjun1ASdF<0542F-g%2vk0sRP%`8=dr{i@ap4c9yM z#zZ~k&+kevV(8{Ie{cHkY6Dhn^txY44r3n{q66rrhZvH$dAp?%iVU@;gZ3nOtvb!I zhdvmRHb*z+StuJZh^hu|j+a``wb@;%Vnd(0+^6Qs+*O4xg|a znb`!F7I?3UbegCRS*oLINXmTP@QHWs&m^-^>g(9?M*DR5OTY3xDp=56L@MmP6s6EO zT_q=(YEkB%SKlu$i&A@Xp(fP~6BH>^m~M7)ov=9YIyOIsbhr zb)e8tN+iM=9r=vg`0X=i?Y9L%R47%X(;+onOp{sYF}5H8 zGKh2#eYdW`KIPajX}bb;H{hA^DOG1ys? z0ZMpSP}k|r_0A;8OI2smz^ttpII0?-A8_BoeRF0$8+)s6=|iK_q>>azqx-$P=66PQ z(^&~ezlv!fhL6AIViR2M)p$s+2*-k2>#e1KBg>=th`)I^qei}W;EfD-f9;^hLsQtX9dnj6lj07Gc7nZl4n)&{Sv?200hV_Pp9Hei zNU>@r!~F#ryu_%Ev3RAn&5H{s?$g8?Tzt1QCa@ufd^}LL)fSJHBZs3qq1;bK$abO73aBJ=Mit&R%^0zBNkOle;L`)5d!F+EUJt-sZa11w+%%=+*$u9YjgbEG5 zvh1bC9;O@xm;JR-s!5O|_Z3!AkglBeYcw6XMlUhh!b?>AP{o?8Fwy)VSNnE!LwN6b zD*VYuVtO4HuG{XbiqJcj_N>=|I2oE(j9bOdd{3`ZQ$o})~*y7JU zZ5X-M^Vc5!M!%DvlT8i;Twq3$Z>mRYMoZ$3k!J~t(5I0U{~{F*-Qfo_P_=TZ*R7P4 zgpVicXA;I!tm7$u3q@wU)2FCws$|&N-B(h&Z=0`-a?3P-ORnA#sQ?N{0ZVe7? zXt)bGVH%wO(D<|?y~)EXeHX>6y^z|?5tO5sCKPO;BBYI5hg)Kz2C@M^VuL+9Y*6`= zZC&M7810~^<&YBtRULl4+1$7qtaknCO~#Y?#8@{xm6UbkuIJ7yNtNs2^95}(UY7MW zW|ouq5%OMUG)!xDIebt;utqEkOmrw<31Yk7_k}Qg<<0BU-c1AkuM3AQ%@HS5c9mo6 zb#K=zI!LmAn}$ye=D)oPW1<{^DVH^l&~vo$j@}O`vr>Pr)`Y?uAAxFW#XW!CjE}d~ zSL=zmWh?|vTGg-S$m}ykP+q?JY2HGAMG{P@Z^JREG-1fVD*L6gz+ijiIm&;8NC~y) z=g@vcmA^&N9NT}6u}^mTa9r%A0AfUz?)^-Q;Wiv7UgW@R$a)Bbz#g`{@k+X7uX zg(tHt1{B^QLFU zm>Y_Ibf;avd`E_3SjUByQHM0PNXh`l3%oQO(*u^|M_U~z*{(;E)v_6g6lG0fSMTIi zQdJQ~mrfEqzrDt5Kk#ilXli-l7$d-KoyH8m1x@OhVO1=-Wsp&m<@a$fUjN5Mf$%KFudyLwyx zRh|*mnn(Q)08NbE*D6OChu)9`IQMr`5vuulk6){E`~Gyf{fh?~2mDjQPY3-BaW9?0 zear7;vXJwD_k-a%2!h1H={Y5|h`(2q?Wny&`+NI9W`uO%Y_M4s1(`m1&Y{T8`giss zKi6YP&(vvgwTAL6-=%!yv?P1uZ_{my?}0|dq{gPsSBlGKpYg~~k`0y#H4BTF$8Nt9d{cV4bnW@qJe-npO0B#X;@uT#f9A8o;MLMeIze4 z{(H|Jwdm{c3_VVNSPR!`ll=(i3tIl#S?mw_rkKF5xAJ+_TQWbZ3XUL1-Q7$vc7$&b zC*CP%MIs5P{Q1NBbPpZ%!i@zcx2Q&VD$kB=F!Bfsvymsaa!Y5SK@%9n=-OmyQH&xY z=5Q!s5^a_e%Wv+i@Nu2xJ;w$2q-q3vec90XNA3NqBEc6sWdxVKn&Xt`;6El-c0ifJ z5#PhX?a?Rb@|~*q@Ocwl;xDCD7SdQlKz_}v4OGccV|JgFNaLICuDP&t@9PJXXMmUT z2ysGKD#*$WG#w%gO}RPH%IZM5I6Y%s<(r`rmJe&sq;3mMEhnE3_95xst)5lUu|M8! zVxMemM8=ZU>7t?6#61$$I``TVO5OW|0c~omU9!H%HU$-Qv60deX!#II%h@A#EJsf4 z@T^`gsmTF2tOz77)(MU9!R}*i6Uc(>Ma^eI1D^AcZ4U)AG^N#u`oK6$X@8D?*afaF&bo=~`bpt5g6 zmDOR;6w7&VALq&%j52XaOff!AT4?$uGA2z|I=h)82(NJ5cTXI9pU^u{c308Ax+k=#gg5Lm$0}M+ z)T14#O^dZN`r6x8yym(#PE{N0*v9o)@A{mZJ0Sk$#yF~wj!$}@0o@e^5c0e^>UGa*C{6hXZ+oRShuk67w%GP8bb=5A75{7o-bp$QaO zN3ie%hJ8@N(rs%@z_CW|&bvVHM-7~cG=A^j5Bj0b6!0q-(64_AB46-uK@%Y(mWhzW z9w-8)s15L&CwBE(IVT=;Ap0pZq)S$kZYr$i7jBc@M|VrL6I31XGR6{h{*ma+Z|R}< zBb!kbC+D)~WE<)tAk^(?QDxWhO#1`UuPdWtfNuWlf&oVi-mh{F+b;8WQKLtK9?czx z7TEW8BcJlgxkQdcYmVAfB1)p|dY#^vb*Jq)5La;tJ7NY1F_!WQQXjX2N8h>(Jj9(g zvz7J!`v`f9iqY0sV;$~En|RQTu! zquu@I%nR{f{9}FfP4k>cz>ReSaUBT4Ra+Bq*pgG5Hl8~(`Bj(-G(#*Q9sDu9c?Y8{ zb)?|zRVw@O!#J%WreZ5vq*P9t(u3CRlFT&!nMPCV$6M_LiEc$?C%Qx;c${kb=?s<*85M_=?;RH&hXOX18TAXj?uE(I$TXLXxm)1^`xZSoj5mNtQ*Li( zb?X0F0IBGyAdi#{_yGgjJ~4nFVBmlXS+yr|h7lrO>Z!M(3o+{nOGMRW~f;qrhR9V_Ej*rf2K7xO!#EIBtI zQLLTrIXx!r7D|B<0lB5G1zf{KpHA~?03{l^oLCMHguxhzgmlSmzmZW+@A}Vdj8k% znzciSt`ABrs0QTZ#m3QMxsJiMVtmpmMcJ+nMnQV(y@%8sHC}}8oz~D>5{SSL98dwc z4H87-4vp~k(ifmlgKO^({lE7xQNg$Fs8JblD})RDi1FGPn#MZ&z9b~AR^{UM;nqpJ zDT*`0y&Y+BfnvDMhE>^2yT$|GlJsA?$R}Eo0It9B!G?FBK0l7^5=1)TQdBDNSy|9g z`0~Lc%!C<{(0igns^2os%in_zuX1cy>CrD<+oSod1U8Ah{pA3D+%R}n>@Var&q6fI z;R6yYN4d|Qd}X1Z4YZNdN;nyAW&R(V9&oJ`6$451q*ePSp9f+cbgUK*xS`R{P6(}K z9hzuSs%5z|@34izE`m-%??4|m^am=egF7Vo0$1X3?$Ey%7Cg}8@j{Az3J0wME*xmv zHr?msm^xF+J!8!6j2Mq+hdgKlkCVn?ykd(`$jG|HL~}4ecn3CKin4@#8LLrsd!)?T zQ5MHjOPSG-wZqh*^eXNCst88|n8t}Y166BZIOfmw?shXEECdiNR5ZEV8!uh46AF6| zF$vG>Vn9n>p|d;3AlYtKLhm$o{BsQYQE1OF{f6~K?=Ufz0^_b@=STrcT!Y!eE@IMg zgLHd{z~marySN8$=Jy|Yc`qI)Zr;E{;MK=l2n%18jmkKu_hb!@F4cNKZ2nRfeyo=W z+>y|`@u4!=0p`}3d&f*{rqHOHpA|YZ0tazjKv36XkvA+NH`mG4c-X@TKwojTWh%rj zU=R~VI3PyfB6|xwI^9a&MCd|B!bLH=l+_hdeNoAXB2)v0)G{fc$F2N)Do`4 zs)r~=4i<@mAhZQamoQh?T@NL+(~v9|ROk#$g5H)bylBs=!pS>F$-l#trDh z`A8{D`*#im?0KThwu1w2V|Kf<;+#s6(<<+K3H1EH@qny&R87`TeCc~W15Rcnzvtzx zogk#ip#*EUqqpd%1q}nG=KT>hi?xI7&M5&lZE_uYZ55{$5^x|E35{(atridJT7?s#3s1oZT2> zc9R*P4kmul&EEwOUK9|?<5ClUQ^Lr!CGGw+Kn>uoV$F33=&;|Tqk6}~2osFx)|+4J zG9xo_lKA*Y9k|)R-|N-@BW`jYr?_qo1_ncT}=zLFd3%4S7+>)`9}TUPtVnEW0t%BUH!Y>%9>$-0>#YN5jV_d zWDN{hh=Jn8tO)km)VA;7fQq}ra=zE%A0)*R1W671dfH}9oh2lW!! zS0vkYD-X2S+I4rK#%5epP((6ee_B=@gd&vH^Lgw?p{>XKcxZfXvlB zqwufx(j7OK4k+n@^xNSgMau&P0))(k@W9Bjb^*n!lj*pWqp{OmJJPU^Yg^YBw>W!6 zv<;Q4W(H zi`m%GfPMK?Yy;uw;r+TL-9{N645p@;F#6_wTjOiC(gt3nw5_u8z{t$+AO2n2W4fiv z-$#$S@(KzfXPmPS3@t^HMhk^IZ~Y9esxZ?>0;=(X|gwLeq* zZ)xQzOW$|^4R`BI2J@sJ2?Ag5@zJ4o*!Zc?f4tXAR37`tdVHBFe^5ZmdzOv^J)Ea$ z2>#_rjbcP^l*0c!|ChYe2@iji_}xV(x>Qc}9p>Vpx|&STr&Ciz&Ob!rOw!Y|YmeyE zcU0I0n4sEQth-k!r&MQA$u)>-M3zbTLq0UxyU#blQdvt*@|~NArp5Sug*lpK)PazD z0TZhFA6M4uP$)(0YUW&Dw3%+Mw|0*r2w5FNHjD}BfrZ`=6mvS7A$0C|MI8~ye6cPeX=53;! zk{HlQbm(PCUh>F@@Yg<0T8+UMV{f9)JZR9hJg0Bp4j- z;kZw+794=Y4|Jr#TX8vG6*13?z}r27)jVG^a`amgjBjrBNZhJc%PTMX(5N@VsaEG4 znLwSmXlY|rRo)_CUHIy{hTQ@o+;PQB;K5zm6DCqHRw?D<1{u*Vg9D6d(29<&E%aZ78|%Ytc^> zRuPMPkC4(rUj%{Ptr9z0htWzY{GLmaS_M)pzgGGS!-tJXzc`>TEO;tsmoJkryS>8Tg6Whm%Vnet7-->w+r_&?B{2r7H2CoJu=jBgLKP*A$_O zTZXW3v?zkHU8y?N_A&b-$u@mZGy4SGZe@6T2wDN4FO zX{}ASq6^g?kKUy6rRmTFl()*L*$UF(aP8V7Y{-=~2unpZJo>z}?3hKzig^m$#VZ-P7PD`!gIU-YGH35*wVf6COA* zG}dZ^c@X?w51^dq`NGrXG5b&s%w`bM0kE!IPY*yF@QG^q1B@weEvzc8kr>NwP;YW3 z?FPGx9@8Aq`mnd>|C(w*S{1|&RKW!#-`YO@{kP%;JjVj;Ql9#dOOROoQ`t~>g|O!` z7t{IA-+cI)~d;^ zB>yoEA&qd3v|(x#T?k;r3AN%x|4!k7rn<7|I1C2O5TvdW3n7uky~h8NJwPs=&(&O7p5v)xrS&E+ z4+dP&Uv-@CUF4E~#Pzbq8!MGwKii!y3&mk`g=))vz4D|8#`llFAbNJFX~6ajN&oJ> zXxk+oLvl^}xoW~dcjJWX8!?Pjq&}F{1?(NeBH%})tL0+?5R9K_O>b9#R z4zfR>Ri5dc7--BAc!vD*TW2gRK-?E0CmTj)9m+^c;{VVqS(kW(&T7Is?mup?(-K7Y z_0}yYqCe2mGkQ@zX8Tkm%v+NOO!l{w|@G4zT}N}BKM=)+5bwuk)7 zz8Nxp+Das2a#<-9Mdi8%{viDNFawtw4ope5;5iqD57Zp>;kl z#Ic+FeMOyk*HE_6Y9NjU#C|_(^I#x`+7mWM-I|}0u!=I`K|6d7TUtK<{k74o)6eK0 z)OT>+)&QubhYB5m&jsWw;>>g(Hzq6X+@2L)p4o~6f~0X-7!_#?H3jtMld?aDxQ zM3IWg7S|`k&nnBGj6Md#aRDhT*Z<4_Ghsx7)}}>i)QYGAo$VwDiWzxHpO4ALxTtwuq8``)OG}z;V+Fcrad9Th(K)`SiLT|h@<})sOe3L z_GnQ{n+T;8T(5LWAub@`CWW_88&ii91GOAU%sG+te6_i4IgO*ef+e~do$_&Ur3GAo zl}5Q-Hn*2*?{&m=8^n8S=eW$^w(9 z&|En7drzdOJr*9^C0Jt^u)T|P!X><8VoReo$bRz!?#OHr{=3Ga8MhIW#$qN#(I@Rv z!@YXlk1G0l655e@aiujY2o`-qhY#5fkP%$k<9a{#h8malIMv;c2{j11&r-2SO;YMb zLvA{4iI0hWK~;e&Jt`Gah(7wFOer+En?XY_nS11h3~Yw8xRl5$9D|D&)KIKWw*(^d z7AfvZNFbxvtgzVXamM2KK(kwDu-J9(T>3Vq?!sxj3J3RCb>AUQoa0%)RmBacc=PlK zb`*U%%9C|}y6EuTm@?1aIymy3FT)q<_HJ8kHlVkmM zMD_1LZL&6;b=slRfb!`P5+bd-duL9Jmu!4kJb0-ce^o<2baschxgzuU$LoN%=})a>CoT*M zY)dUjKR@~VmtH`Ae=-FCs(kL(D7z%yyJ3D7i@a9u+1;d6*vT|rMjOBQtezLQvCC1^ zo&*>E#g-$zJ-asjWH`t%dnWBca`I(JyFmoK#o-4IAg6)RzHKr^OanC-;G(Y6pxGis zsh?T%QgNXqv|}}G(Z$SNa%EX7V6Tn$yCxK(woHmDS3AFtLY+FoL`vYjBZPsLC-x)#o`^IM2i+WFl9DX+#Qo*x_Ml z@L;;&KNzm4x$MzqglyzDd|0zT5W62p6jzM>UC9d^$|I*khbn1ck@lDb8zvleApPA) z9YDRV__3;LWQgkLZ3`!sS12@8CH4QvnzN%^VJa^#Uu8~2jrup^-Sd8WY=L;M$S##fhoo1MzH$_wC=cG%w@-63(iH@u(0Cmsnjr9d6LxNonX@*NjD^Vhp5={!XJ27Q^mTE+I}hR=38kOYIfk;p*#9?KJu9pQ9P^$-X{-5&O9 zP6eTCRJS<i8p5@708fpv6_A;MHX86pdxmh(Qi$?2*$~DC<^* zu5L#%=6mZ{e@#S;+=z{5Ync_+K_P7%^tAk1VWb+!0I0oOrzDKU=F2jK*H7=O-V(Evu74m4ec zCvN9)j})=ewBali8Aa(hg@g*FM2^V0gFiBoj?zR<^$x>mE{%dQtNv<%QD#ltx|QBf z#g&%)!!rN(!5lmH?uo*2Om|>Gc{|^cg|*Q+hx*XjTX#rZ&EzQeqzwP;dT_uqAywVC z5C}&aTn!d~gn0wOSnwb>9{b70QGR5 zP^1{8Py&n!iZ=2TUeW3qj!%i_`LZ`-6h%ip^7gQjJdZwzm;s?%#{^(#NKo%`hxh5x zQeW=VjSS*UPX*`B>N+iGa#U!XCUMj5eHAqw;tS&7o?#ra1yNU{X@e-DCu5Pc2wb}m z1m2ziP6qOxrK5RYQIR{pKN)B_;(2HHNv*w(tD8|!nN_su@&4JcC4rwR--=8?ImIFm zQVzi3KcR1Lqr|v7uJzkswru4@E~TiysX2!>YulCs*#|BBI6ObF%_C^ z$$W$0O+J;Ac(WZ|#8WouKNi}h651uw&jVNgA}pS@A!WkwiVTTIn3BM>!$FxHtnpWO zV^85CHT4d7`Mv6M15xx}56IaV+iK%|lH3Ea!L!{K8?_Xg`HxCVEC|q^74}F72S&_Z z04XBlltK%%Ldf9ovlh&eMIEI4W2sqoOge9p#Mw99f@g2P6qVCru|-XVsr(Xc9WAL$ zJ*H)$;fYj<;|txEXT&{Bk9CNqAq0C=829WZGSuCTBd4*slq2i4twe_|>D@b2-6`UVJsu2t`&;*V!0RK#Kgg%Tshm4oJRK(5wGF;+a#;19p8h3EY8=c z23K4DZ()W4#*#SE>xg{!t1uhTmR&7~6y|*(gOLvoWh8q%?*!M{%#R@C6x%S zfdj8A;VWj9@7^m0K;z^xTGjL~@n}tN{mIe%Jd@`JPEG3bne4LMAsSw!ZQoC``1Ch@Y|}rN zy~3B(+u1dBBjidnVOO*4-YPE$#m(E!W#E|!mINwsYR`*RzATiKH=jAs&lL1tx^{j3 zyKzfikrg4V2cV0C{ ze0q0ib=hq`pY?17>on6AOrV&z!xU1PQ}@|Ai`99U&;PeTbBN=JV_&Iu-+BdObKY5W zDDy?s9)dY|s2DR~+tFY*6SCFyyq1-g#*#+@3}H(We#4?SGY|kL{$<_Y8?`a4Rm@Ew z@pZE+x7##e>tg*!*}LSg6LO=&Sy<>26V{1D6KNo`4ex8SkIm;iz1@Rx*yZ!OcU_z- zTfm(o^Mh;uF9HvUHHLRDRwv*o+e|rIwksx#_%Zwqp{$ba>+#D;{vq9(_#AjP@YU`n zfO2HKkvFv8CPjMo!50B`SH{Qp6cB7u%z;0x)#^}>1$$;qo{={$@Lq&+dwo&Z&1QcYn5sNin6y% zaa=}XM2OKst9Ok+A7j}0^AkH4n%%oGCg>Tn^iC27JJdmFMvP2*K`ohZB2`r~dgtX> z(p^$YH2>S5ev?YV5wMuz{=<-CC*%5geJc9bEjS<{q%Ta>IZJFXlZz8yg3(w7%5WC1 z0KG8KdhMA~$>IfX*@W$XEjSH4;asUAscq1Ay`YBO+`~wOY2A5uAJM?>bvHH{Z7)vl z+oEvQ>9M6NB9|hZRI{QH%-s*H;lU3EGOERN8)rx$N)M!k5ClE**)rt9RJU#s zH|uJsKEaM7nJ|P^X=BxX4Pr!;7o0hV{5ML3ukk@=I}-eyr82QvQ5w`tB~Fjn4*aW3 z33zb3_J!f95p@{#_C+)$5;P~be>0I(jM{9qT1N~)(T3{$O^m0dB_?NMyyzNT zE$Y?yQwlUs;F#`)q`+u=4#~K+5wU(BP&WRylad5Q10w*h=HK5{$_0~*JU}CMbi~*c z^I{Vo#PB6}uRh`AvtR$H{QZrhq6go9>X{55e>zJU8Y7{B)ujK`gzVkwasL6-@}j7t z+IbJJOhWYZ3K)C*2799#=-eUAZx6#y%R|&`T(@e;038s?ie<##Go~CVW2KKNQyzXC zIc1IMizU*M|6>1%0@cq7`|5AhCM~w)`&)y`X{#c_8 zDB9!TvGE>1Zi}AdaHol3mqp4Eyxz_=bf8ev;-8lv`mBEDG?XR?SM zFhvK8s|g!ZvoG@W4N)$F@%thOdvyA_1nRt}Ztx`~vOk$q zwAc_8Ayn~oO0NjV&dbbQIyRbTx({@YK^)Te@UzM24{J59H>V9P_vvMp0{_sNSuvemsbJJ9 z$g4P4_6e=rq3U0Pw7|3y!dknatcBAs+wIMn15r&N&8h3)BW{M*v#cWuj9?6smqnU5 zu6Q*-nBSnKlg#b(>w29!Wg;H5&>AknaaiE_vy_)7TVIC=2Jh!oa(ZV75KZ-ee2QM2 zpSZ7=MiN|eRqP=7(e6S2^R;;!#H(-(o4lHiHJ=>aFA@03WV7!mU984!Bs;_QdC=Dq}w;E6Q)||Q!q9bW|5mCwO9z??3i_dC0QT+M%fgE$>4whS z*_isg6U(281<~$8Pg2qwbd-a2S}Gr-2jee-o&!~kjf$(5+{G1l#fZ7hN$+419OwLr zVI24RUanXuqTREbzt6}go%5AU9Ippw#F;HHm#}C{Dl^od@OjEr3Yj5Ew#^gUTDFGY zW$_fQ@t1#DiTh^PgR>CnGkakU3nRDFBwUCR3v`R%Aq1=Rq2non+s0rF|}X@Gev?9h1Ia(;wG zD6{pu2tupw87($9dV|D+<;xdAW*I5Jt-2Y7fC~V#8{_e}iW;`0%|L@v5=St07`~!u z!YT3`Lo8umHxMiPRSznR`QH8Yy#_OM=2LzS@Fm$MfNkoKk*$_qvGM*WOzcp#pd?B& zgwB`5rEM|-sAWeh6QkPoM(*KqsHYmhTm(683Vhgj7MZDLnA4=eMbwPb#ZMZhB3lBC zeI+r@BQ-EhBQvXaK}N74$UsvzEtd-VwVLqv2&N8KqBVZ!KqoiNAo1~> zie6`wGmK6X`j~%|V&GdzINKWvx3c#B4LQf}lHQtJ zLfh&_T2}`Aek(dG;G%{ z3v2AsAmrGVF2S6=%xa#C8s>IMfoo+$o@7IH6X(PD-JGK;Rkqe2%A;8*Hq<-3ASL`5S?OfvT9 zeLGUFr!5g=MnB_yyd#`&Ptuh@4I@SJnw9=bM5GvE8qb5`q>C2Uk>vu!!35{F7zsuD zRBv)ma*k=?e6+nH8qf!fg+d2JiiU;WJvs*KoRCORgyuhnvrAmUZR&*wiLf7NEpfmo zm{m&6AzS=Ukrj4ROjQ z&P6bm(Q2b^So@~t%BhN#1Xipnl0XKMW7(53^e_n0sb{jLbQ&4d*ZaN#i1=`{k#oqv z`Jb(81lQyfl;E7I=X;XbbI1gPD_L$w9U#u{@?FaL0R*&N$iN-KD zH~|A=T7?{$eNSJk`*rEk0b-->zLemo#p{3?^*fW~d-G9^qLd>>K&&W|{C5Uu%n$^% zMHxE3n0bEVj@dQuxfDSO0iM{l)o9-wfwxk2&Kv&OcPwZ%>`7r!VgLe9S3j3^P6 Date: Mon, 19 Oct 2026 16:14:55 +0300 Subject: [PATCH 3/5] SOC 2 evidence post: rerun after the collector fixes, hedge the auditor claims, record the Trivy rescan --- ...soc2-evidence-from-github-and-terraform.md | 103 ++++++++++++------ 1 file changed, 67 insertions(+), 36 deletions(-) diff --git a/content/posts/soc2-evidence-from-github-and-terraform.md b/content/posts/soc2-evidence-from-github-and-terraform.md index bfd198879..ef3267557 100644 --- a/content/posts/soc2-evidence-from-github-and-terraform.md +++ b/content/posts/soc2-evidence-from-github-and-terraform.md @@ -1,13 +1,13 @@ --- title: 'SOC 2 Evidence From GitHub and Terraform, and the Part That Still Needs a Person' -excerpt: 'We pointed a small evidence collector at a repository whose main branch had a strict ruleset. The ruleset passed and three change-management controls failed. Here is which SOC 2 evidence you can pull from GitHub, Terraform and the API, which still needs a person, and the four ways an evidence script can lie to you.' +excerpt: 'We pointed a small evidence collector at a repository whose main branch had a strict ruleset. The ruleset passed and three change-management controls failed. Here is which SOC 2 evidence you can pull from GitHub and Terraform, which still needs a person, and ten ways an evidence script can pass a control without evidence.' category: name: 'Security' slug: 'security' date: '2026-10-22' publishedAt: '2026-10-22T09:00:00Z' updatedAt: '2026-10-22T09:00:00Z' -readingTime: '16 min read' +readingTime: '15 min read' author: name: 'DevOps Daily Team' slug: 'devops-daily-team' @@ -22,18 +22,18 @@ tags: - Audit --- -We pointed a small evidence collector at a GitHub repository whose main branch had a strict ruleset: every change through a pull request, one approval, and a required `test` check. The ruleset control passed. Three of the change-management controls under it failed: none of the four merged pull requests had an independent approval, one was merged five seconds before its check finished, and one commit reached main without a pull request at all. All three were real, and all three would have looked fine in a screenshot of the settings page. +We pointed a small evidence collector at a GitHub repository whose main branch had a strict ruleset: every change through a pull request, one approval, and a required `test` check. The ruleset control passed. Three of the change-management controls under it failed: none of the six merged pull requests had an independent approval, one was merged five seconds before its check finished, and one commit reached main without a pull request at all. All three were real, and all three would have looked fine in a screenshot of the settings page. -That gap is the whole job when a customer asks for SOC 2. An auditor does not only want to know what you configured. For a Type II report they want to see what happened under that configuration across the whole review period, usually by sampling. This post shows which of that evidence you can pull straight from GitHub, the GitHub API and your Terraform code, which still needs a person and a signature, and what we got wrong in the first version of our collector. +That gap is the whole job when a customer asks for SOC 2. An auditor does not only want to know what you configured. For a Type II report they want to see what happened under that configuration across the review period, usually by sampling. This post shows which of that evidence you can pull from the GitHub API and your Terraform code, which still needs a person and a signature, and the ten ways the first version of our collector could pass a control without evidence. ## TL;DR -- Settings are not evidence of operation. Our main branch required approvals and a passing check, and the evidence still showed 0 of 4 pull requests independently approved and 1 merged before its check finished, because admins could bypass the rule. -- "The checks are green" is the wrong question. Pull request #3's check passed 5 seconds after the merge. Its status today is green; it did not gate the merge. Compare the check's completion time with the merge time. -- An evidence script must fail closed. Our first version could pass a control on missing data in four ways: approvals of an older commit, alerts it was not allowed to read, commits linked to the wrong pull request, and a list cut off at a page limit. Each now reports `fail` or `incomplete`. +- Settings are not evidence of operation. Our main branch required approvals and a passing check, and the evidence still showed 0 of 6 pull requests independently approved and 1 merged before its check finished, because admins could bypass the rule. +- "The checks are green" is the wrong question. Pull request #3's check passed 5 seconds after the merge. It is green today; it did not gate the merge. Compare the check's completion time with the merge time. +- An evidence script must fail closed. Two reviews of our first version found ten ways it could pass a control on missing or partial data, from approvals of an older commit to a branch name that could change the API query. Each now reports `fail` or `incomplete`, with a test. - Terraform scanning is evidence of a configuration standard, but a pass is only as good as the rule list. Trivy flagged the public database flag, and its security-group rule passed a Postgres port open to the whole internet, because that rule only covers SSH and RDP. - Access reviews, policy sign-offs, training, risk assessment, vendor reviews and incident-response tests still need a person. Automation can gather the list; it cannot make the judgement. -- The collector ran in 16 seconds with 24 API calls and produced 11 timestamped evidence files with a SHA-256 manifest, for one repository and 90 days. +- One run took 21 seconds and 32 API calls for one repository and 90 days, and produced 14 timestamped evidence files with a SHA-256 manifest. ## Prerequisites @@ -58,9 +58,9 @@ Three criteria cover most of what a code repository can prove. In the AICPA's wo > **CC6.1** The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives. -For a change, "approves" and "tests" are the parts people get caught on. For each sampled change, the auditor wants to see that someone other than the author approved it and that it was tested before it reached production. For vulnerabilities, they want to see that you detect them and fix the serious ones within the time your own policy promises. +For a change, "approves" and "tests" are the parts people get caught on. If your change-management control says that someone other than the author approves each change and that it is tested before it reaches production, the auditor will ask you to show both for each sampled change. For vulnerabilities, they want to see that you detect them and fix the serious ones within the time your own policy promises. -The usual way to produce this is screenshots: the branch protection page, the pull request page for each sampled change, the Dependabot tab, the security settings. A screenshot shows the state at one moment, without a reliable timestamp or a way to tell whether it was edited. An API response saved with its collection time and a hash is better evidence, and a script can collect it for every change in the period instead of a sample. +The usual way to produce this is screenshots: the branch protection page, the pull request page for each sampled change, the Dependabot tab, the security settings. A screenshot shows one moment, and nothing in it says where the values came from. An API response saved with the time it was collected is easier to check: the auditor can see the source of each value, and you can run the same query again. A hash manifest lets you show that a file did not change after collection, as long as the manifest is stored where nobody can edit it. And a script can collect the evidence for every change in the period instead of a sample. ## The collector @@ -69,15 +69,15 @@ The usual way to produce this is screenshots: the branch protection page, the pu | Criterion | Control | Where the evidence comes from | | --- | --- | --- | | CC8.1 | Changes to the default branch go through a pull request | branch rules and classic branch protection | -| CC8.1 | Every merged change was tested before the merge | check runs on the merged commit, finished before the merge time | -| CC8.1 | Every merged change was approved by someone other than its author | reviews that approved the merged commit, before the merge | -| CC8.1 | Nothing reached the default branch without a pull request | the merged pull request behind each commit | +| CC8.1 | Every merged change was tested before the merge | the last run of each required check on the pull request's head commit that finished before the merge | +| CC8.1 | Every merged change was approved by someone other than its author | each reviewer's last decision before the merge, for the merged commit | +| CC8.1 | Nothing reached the default branch without a pull request | the merged pull request behind each commit, and the branch's activity log | | CC7.1 | Dependency vulnerability alerts are on | the Dependabot setting | | CC7.1 | No critical or high alert is open past the SLA | open Dependabot alerts and their age | | CC6.1 | Secret scanning and push protection are on | the repository's security settings | | CC6.3 | Repository access follows least privilege | collaborator roles, judged by a person | -Every raw API response goes into a timestamped folder with a SHA-256 manifest, and the summary marks each control `pass`, `fail`, `needs a person` or `incomplete`: +It saves the fields each control uses from each API response, with the collection time, in a timestamped folder with a SHA-256 manifest, and marks each control `pass`, `fail`, `needs a person` or `incomplete`: ```diagram { @@ -92,6 +92,8 @@ Every raw API response goes into a timestamped folder with a SHA-256 manifest, a } ``` +Three of the controls look back over the window: the merged pull requests with their reviews and checks, the commits on main, and the branch's activity log. The other five read the settings and the open alerts as they are on the day you run it. One run shows the history of changes. For the history of settings across a Type II period, run it on a schedule and keep every folder. + ### The test subject We made the collector's own repository its test subject, with a history built on purpose. Its main branch has a ruleset that requires a pull request, one approval and the `test` check, with a bypass for organization admins. Then: @@ -107,7 +109,7 @@ We made the collector's own repository its test subject, with a history built on { "title": "collect.py", "steps": [ - { "cmd": "python3 collect.py The-DevOps-Daily/soc2-evidence-collector --days 90", "output": "The-DevOps-Daily/soc2-evidence-collector, last 90 days: 11 evidence files, 24 API calls, 15.9 s\n CC8.1 pass Changes to the default branch go through a pull request\n rule on main: pull_request, 1 approval(s) required\n CC8.1 fail Every merged change was tested before the merge\n required checks: 1; 3 of 4 merged PRs had passing checks at merge time\n CC8.1 fail Every merged change was approved by someone other than its author\n 0 of 4 merged PRs had an independent approval of the merged commit\n CC8.1 fail Nothing reached the default branch without a pull request\n 1 of 5 commits on main in the window are not linked to a merged PR\n CC7.1 pass Dependency vulnerability alerts are on\n Dependabot alerts on\n CC7.1 pass No critical or high alert is open past 30 days\n 8 open alerts, 0 critical or high past 30 days\n CC6.1 pass Secret scanning and push protection are on\n secret scanning enabled, push protection enabled\n CC6.3 needs a person Repository access follows least privilege\n roles: {'admin': 4}, outside collaborators: 0; the list is evidence, the judgement is not\nevidence: evidence/The-DevOps-Daily__soc2-evidence-collector/20261019T125319Z" } + {"cmd": "python3 collect.py The-DevOps-Daily/soc2-evidence-collector --days 90", "output": "The-DevOps-Daily/soc2-evidence-collector, last 90 days: 14 evidence files, 32 API calls, 20.8 s\n CC8.1 pass Changes to the default branch go through a pull request\n rule on main: pull_request, 1 approval(s) required\n CC8.1 fail Every merged change was tested before the merge\n required: test; 5 of 6 merged PRs passed every required check before the merge (#3 not finished)\n CC8.1 fail Every merged change was approved by someone other than its author\n 0 of 6 merged PRs had an independent approval of the merged commit\n CC8.1 fail Nothing reached the default branch without a pull request\n commits not linked to a merged PR: 1 of 7; branch updates that were not PR merges: 1 (branch_creation)\n CC7.1 pass Dependency vulnerability alerts are on\n Dependabot alerts on\n CC7.1 pass No critical or high alert is open past 30 days\n 8 open alerts, 0 critical or high open longer than 30 days\n CC6.1 pass Secret scanning and push protection are on\n secret scanning enabled, push protection enabled\n CC6.3 needs a person Repository access follows least privilege\n roles: {'admin': 4}, outside collaborators: 0; the list is evidence, the judgement is not\nevidence: evidence/The-DevOps-Daily__soc2-evidence-collector/20261019T131136Z"} ] } ``` @@ -118,17 +120,17 @@ It found every gap we put in, and it exits non-zero, so it can gate a pipeline o ### The rule was on, and the evidence still failed -The first control passed: a pull request with one approval is required on main. The approval control under it failed for all four merged pull requests. An admin bypass is not a bug in the ruleset. It is a feature that most organizations keep for emergencies, and it is exactly what an auditor's sample finds. If your report says "all changes are approved by a second person" and your evidence shows admin merges without approval, that is an exception in the report. +The first control passed: a pull request with one approval is required on main. The approval control under it failed for all six merged pull requests. An admin bypass is not a bug in the ruleset. Many teams keep one for emergencies, and an auditor's sample will find every use of it. If your system description says all changes are approved by a second person and your evidence shows admin merges without approval, expect the auditor to report them as exceptions. For a one-person or two-person team, the honest fix is not to pretend. Common approaches are a reviewer from outside the team for production repositories, or a documented control that someone reviews merged changes after the fact within a fixed time. Which of these your auditor accepts is a conversation to have before the review period starts, not after. ### Green now is not the same as tested before the merge -Here is the evidence file for pull request #3 as the collector saved it (indentation widened for reading): +Here is the evidence file for pull request #3 as the collector saved it, without the author's login and with the indentation widened for reading: ```json { - "collected_at": "2026-10-19T12:53:19.848831+00:00", + "collected_at": "2026-10-19T13:11:36.394769+00:00", "source": "GitHub API, The-DevOps-Daily/soc2-evidence-collector", "data": { "pull": { @@ -142,6 +144,7 @@ Here is the evidence file for pull request #3 as the collector saved it (indenta "check_runs": [ { "name": "test", + "app_id": 15368, "status": "completed", "conclusion": "success", "completed_at": "2026-10-19T12:50:08Z" @@ -151,28 +154,44 @@ Here is the evidence file for pull request #3 as the collector saved it (indenta } ``` -The check succeeded at 12:50:08. The pull request was merged at 12:50:03. Look at the pull request page today and you see a green check, which is what most screenshots and many scripts record. The collector compares the two timestamps, and so should anything you hand to an auditor. A required check stops a normal merge until it passes, so a merge before completion means someone used a bypass. +The check succeeded at 12:50:08. The pull request was merged at 12:50:03. Look at the pull request page today and you see a green check, which is what most screenshots record. The collector compares the two timestamps, and so should anything you hand to an auditor. + +It asks GitHub for every run of the check, not only the latest, and judges each required check by its last run that finished before the merge. A re-run after the merge does not hide a pass before it, and an earlier pass does not hide a later failure. A required check stops a normal merge until it passes, so a merge before completion usually means someone used a bypass. It can also mean the required checks changed after the merge, because the collector compares with today's rules. Either way, it is an exception to explain. ### The commit with no pull request -The one commit without a pull request is the repository's first commit, pushed before the ruleset existed. That is a normal, explainable exception, and the evidence lets you explain it with a date. The same control also catches the cases that are not normal: an admin pushing a hotfix straight to main, or a force push that rewrote history. +The one commit without a pull request is the repository's first commit, pushed before the ruleset existed. The branch's activity log shows the same event from the other side: one update to main that was not a pull request merge, the creation of the branch. That is a normal, explainable exception, and the evidence lets you explain it with a date. + +The two sources catch different things. The commit list only holds commits that are still on main, so a force push that rewrote history leaves nothing in it. The activity log records updates to the branch, including direct pushes and force pushes, so an admin pushing a hotfix straight to main shows up there even when the commit list looks clean. If the log does not reach back to the start of the window, the control reports `incomplete` instead of `pass`. ### The alerts that passed -Dependabot raised 8 open alerts for the two pinned packages: 2 critical, 1 high and 5 medium. The SLA control passed, correctly, because the alerts were minutes old. Our default SLA is 30 days for critical and high; use the number your own vulnerability policy states, since that is what the auditor will hold you to. The same run in five weeks would fail. +Dependabot raised 8 open alerts for the two pinned packages: 2 critical, 1 high and 5 medium. The SLA control passed, correctly, because the alerts were less than an hour old. Our default SLA is 30 days for critical and high; use the number your own vulnerability policy states, since that is what the auditor will hold you to. The same run in five weeks would fail. + +This control reads the alerts that are open today. A critical alert that stayed open for two months last spring and was fixed in the summer does not appear in it. To cover a period, keep each run's folder, or extend the collector to fixed alerts and compare their `fixed_at` with `created_at`. -## Four ways our first version could lie +## Ten ways our first version could pass without evidence -A review of the first version of the collector found four ways it could pass a control without evidence. For a tool whose output goes to an auditor, every one of these is a real defect: a control must never pass because data was missing. +Two reviews of the first version of the collector, one of the code and one of the post against the recorded output, found ten ways it could pass a control, or count something as evidence, when the data did not support it. For a tool whose output goes to an auditor, each one is a real defect: a control must never pass because data was missing. -1. **Approvals of an older commit counted.** The first version accepted any approval from someone other than the author, made before the merge. If the author pushed new commits after the approval, the merged code was not the code that was approved. The collector now counts only approvals whose `commit_id` is the merged head commit, and reports the rest as stale. -2. **Unreadable alerts looked like zero alerts.** With a token that could not read Dependabot alerts, the API returned 403 and the first version evaluated an empty list: no late alerts, pass. It now reports the SLA control as `incomplete` with the HTTP status. -3. **Any pull request link counted.** A commit counted as reviewed if any pull request was associated with it, even one merged into another branch or outside the window. It now has to be a pull request merged into the default branch and inside the evaluated set. -4. **Lists were cut off silently.** The commit list stopped at 300 and the alert list at one page. The first version then judged what it had. Alerts are now paged completely, and a commit list that reaches the limit makes the control `incomplete`. +| What went wrong | What the collector does now | +| --- | --- | +| An approval of an older commit counted | Only an approval whose `commit_id` is the merged head commit counts; the rest are reported as stale | +| A withdrawn approval counted | Only each reviewer's last decision before the merge counts, so a later change request or a dismissal replaces an approval | +| Any passing check counted as the required one | Each required check is matched by name, and by app when the rule names one | +| An earlier pass could hide a later failure | Each required check is judged by its last run that finished before the merge | +| Unreadable alerts looked like zero alerts | A 403 or 404 makes the SLA control `incomplete`, with the HTTP status | +| Lists were cut off silently | A list cut at its limit makes its control `incomplete`, and an error on a later page stops the run | +| Any pull request link counted | The pull request must be merged into the default branch and be one of the merged pull requests evaluated | +| A force push left no trace | The branch's activity log is read alongside the commit list | +| The SLA was rounded down to whole days, and alerts without a severity were skipped | The age is compared as a time, and an unknown severity makes the control `incomplete` | +| Branch names went into URLs unencoded | Every value is encoded, and an item for another branch makes its list `incomplete` | -None of these would have changed the result for our demo repository, which has no approvals at all, a readable alert list of 8 and five commits. They would have changed it for a real repository, where a stale approval or a missing permission is common. Each fix has a test in the repository. +The last one is easy to miss. Git allows `&` and `#` in branch names, so a default branch with a crafted name could change the query string, and the collector would judge GitHub's answer to a different question. -Running the fixed version found one more problem: the Dependabot alerts API rejects page numbers (`Pagination using the page parameter is not supported`) and pages with cursors in the `Link` header instead. A collector that ignored the error would have reported no alerts. +None of these changed a result for our demo repository: it has no approvals at all, a readable list of 8 alerts and seven commits. They would change results for a real repository, where a stale approval, a re-run check or a missing permission is common. Each fix has a test in the repository. + +Running the collector also found one more problem: the Dependabot alerts API rejects page numbers (`Pagination using the page parameter is not supported`) and pages with cursors in the `Link` header instead. The collector now follows the `Link` header for every list. ## Evidence from Terraform @@ -184,12 +203,24 @@ The repository's `examples/terraform` holds a small AWS stack: a customer-data b { "title": "scan-iac.sh", "steps": [ - { "cmd": "./scan-iac.sh examples/terraform", "output": "92 checks, 12 failed, 5.0 s\n HIGH AWS-0086 aws_s3_bucket.exports S3 Access block should block public ACL\n HIGH AWS-0087 aws_s3_bucket.exports S3 Access block should block public policy\n HIGH AWS-0091 aws_s3_bucket.exports S3 Access Block should Ignore Public ACL\n HIGH AWS-0093 aws_s3_bucket.exports S3 Access block should restrict public bucket to limit access\n HIGH AWS-0132 aws_s3_bucket.exports S3 encryption should use Customer Managed Keys\n HIGH AWS-0180 aws_db_instance.app RDS Publicly Accessible\n MEDIUM AWS-0090 aws_s3_bucket.exports S3 Data should be versioned\n MEDIUM AWS-0176 aws_db_instance.app RDS IAM Database Authentication Disabled\n LOW AWS-0089 aws_s3_bucket.customer_data S3 Bucket Logging\n LOW AWS-0089 aws_s3_bucket.exports S3 Bucket Logging\n LOW AWS-0094 aws_s3_bucket.exports S3 buckets should each define an aws_s3_bucket_public_access_block\n LOW AWS-0133 aws_db_instance.app Enable Performance Insights to detect potential problems\nevidence: evidence/iac/20261019T125335Z" } + {"cmd": "./scan-iac.sh examples/terraform", "output": "92 checks, 12 failed, 4.6 s\n HIGH AWS-0086 aws_s3_bucket.exports S3 Access block should block public ACL\n HIGH AWS-0087 aws_s3_bucket.exports S3 Access block should block public policy\n HIGH AWS-0091 aws_s3_bucket.exports S3 Access Block should Ignore Public ACL\n HIGH AWS-0093 aws_s3_bucket.exports S3 Access block should restrict public bucket to limit access\n HIGH AWS-0132 aws_s3_bucket.exports S3 encryption should use Customer Managed Keys\n HIGH AWS-0180 aws_db_instance.app RDS Publicly Accessible\n MEDIUM AWS-0090 aws_s3_bucket.exports S3 Data should be versioned\n MEDIUM AWS-0176 aws_db_instance.app RDS IAM Database Authentication Disabled\n LOW AWS-0089 aws_s3_bucket.customer_data S3 Bucket Logging\n LOW AWS-0089 aws_s3_bucket.exports S3 Bucket Logging\n LOW AWS-0094 aws_s3_bucket.exports S3 buckets should each define an aws_s3_bucket_public_access_block\n LOW AWS-0133 aws_db_instance.app Enable Performance Insights to detect potential problems\nevidence: evidence/iac/20261019T130914Z"} + ] +} +``` + +The exports bucket and the public database were both caught. The open security group was not. Trivy's ingress rule AWS-0107, titled "Security groups should not allow unrestricted ingress to SSH or RDP from any IP address", passed: port 5432 is neither SSH nor RDP. The database was flagged only because `publicly_accessible` was also set. We removed that line, kept the security group and scanned again: + +```terminal +{ + "title": "scan-iac.sh, without publicly_accessible", + "steps": [ + {"cmd": "cp -r examples/terraform /tmp/sg-only && sed -i '/publicly_accessible/d' /tmp/sg-only/main.tf", "output": ""}, + {"cmd": "./scan-iac.sh /tmp/sg-only", "output": "92 checks, 11 failed, 4.2 s\n HIGH AWS-0086 aws_s3_bucket.exports S3 Access block should block public ACL\n HIGH AWS-0087 aws_s3_bucket.exports S3 Access block should block public policy\n HIGH AWS-0091 aws_s3_bucket.exports S3 Access Block should Ignore Public ACL\n HIGH AWS-0093 aws_s3_bucket.exports S3 Access block should restrict public bucket to limit access\n HIGH AWS-0132 aws_s3_bucket.exports S3 encryption should use Customer Managed Keys\n MEDIUM AWS-0090 aws_s3_bucket.exports S3 Data should be versioned\n MEDIUM AWS-0176 aws_db_instance.app RDS IAM Database Authentication Disabled\n LOW AWS-0089 aws_s3_bucket.customer_data S3 Bucket Logging\n LOW AWS-0089 aws_s3_bucket.exports S3 Bucket Logging\n LOW AWS-0094 aws_s3_bucket.exports S3 buckets should each define an aws_s3_bucket_public_access_block\n LOW AWS-0133 aws_db_instance.app Enable Performance Insights to detect potential problems\nevidence: evidence/iac/20261019T130925Z"} ] } ``` -The exports bucket and the public database were both caught. The open security group was not. Trivy's ingress rule, AWS-0107, is titled "Security groups should not allow unrestricted ingress to SSH or RDP" and it passed: port 5432 is neither. The database was flagged only because `publicly_accessible` was also set. We removed that flag, kept the security group and scanned again: the only database findings left were Performance Insights and IAM authentication, and nothing pointed at a database port open to the world. +The only database findings left are IAM authentication and Performance Insights. Nothing points at a database port open to the world. That is the general limit of configuration scanning as evidence. A pass means "none of these rules failed", not "this is safe". Your configuration standard is the rule set you run plus the rules you add for what it misses. Trivy and similar tools accept custom policies, and a rule for "no database port open to `0.0.0.0/0`" is a few lines. @@ -205,8 +236,8 @@ Some controls produce evidence a script can gather but not judge, and some produ | CC6.2 | Access removed when someone leaves | Needs the HR leaving date to compare with when access ended | | CC1.4, CC2.2 | Security awareness training completed | The record lives in a training tool or a signed list | | CC5.3 | Policies written, approved and acknowledged | A policy document and each employee's acknowledgment | -| CC3.2 | A risk assessment, reviewed at least yearly | A document and its review | -| CC9.2 | Vendor and subprocessor reviews | Each vendor's own report, read and assessed | +| CC3.2 | A documented risk assessment and its periodic review | A document and a dated review | +| CC9.2 | Vendor and subprocessor reviews | An assessment of each vendor's security, often based on the vendor's own SOC 2 report | | CC7.4, CC7.5 | Incident response that works | A tabletop exercise or a real incident, with its write-up | | A1.3 | Recovery tested (if Availability is in scope) | A restore test with its result | @@ -216,17 +247,17 @@ Automation helps with all of these by collecting the inputs and reminding people The compliance automation platforms, such as Vanta, Drata, Secureframe, Sprinto and Thoropass, do the same thing at a much wider scale. They connect to source control, cloud accounts, identity providers and HR systems, map what they collect to controls, track the people-side tasks such as training and policy acknowledgments, and give the auditor a place to review the evidence. For a team going through its first audit, that coverage and the auditor relationships that come with it are the reason to pay for one. -What a small script like ours is good for is understanding what those tools check, and the gaps that are specific to you: a custom deployment pipeline, a check the platform does not have, or a control you want to test on every change instead of once a quarter. Whichever you use, test it the way we tested ours: give it a repository with known problems and confirm it fails on each of them. An evidence tool that has only ever reported `pass` has not been tested. +What a small script like ours is good for is understanding what those tools check, and covering what is specific to you: a custom deployment pipeline, a check a platform does not have, or a control you want tested on every change. It can run alongside a platform as well as instead of one. Whichever you use, test it the way we tested ours: give it a repository with known problems and confirm it fails on each of them. An evidence tool that has only ever reported `pass` has not been tested. ## Time -For one repository and 90 days, the collector made 24 API calls and wrote 11 evidence files in 16 seconds. By hand, the same evidence is a screenshot of the ruleset, one per merged pull request with its checks and reviews, the Dependabot tab, the security settings and the collaborator list: about nine screenshots, none of which shows the check's completion time next to the merge time. We did not time the manual version, so we will not give a number for it. The difference grows with the sample: an auditor sampling 25 changes across 10 repositories is 25 pull request pages by hand, and one run per repository for the script. +For one repository and 90 days, the collector made 32 API calls and wrote 14 evidence files in 21 seconds. By hand, the same evidence is a screenshot of the ruleset, one of each merged pull request with its checks and reviews, the Dependabot tab, the security settings and the collaborator list: ten screenshots here, and the pull request page does not put the check's completion time next to the merge time. We did not time the manual version, so we will not give a number for it. The difference grows with the sample: an auditor sampling 25 changes across 10 repositories is 25 pull request pages by hand, and one run per repository for the script. ## Summary - Collect evidence of what happened, not only of what is configured. Our ruleset passed while three change-management controls failed under it. - Compare timestamps. A check that is green today may have finished after the merge. -- Make evidence scripts fail closed: stale approvals, unreadable data, wrong links and truncated lists must never pass. +- Make evidence scripts fail closed: stale or withdrawn approvals, the wrong check run, unreadable data, wrong links and truncated lists must never pass. - Treat a configuration scan as one rule set, not as proof of safety, and add rules for what it misses. Ours passed a database port open to the internet. - Leave the judgement to people, and make their sign-off the evidence. A script can gather the access list; it cannot decide who should be on it. - Agree with your auditor on how exceptions, such as admin bypasses, are handled before the review period starts. From 569f766c4bece2da22faa962dd35a3be75d21877 Mon Sep 17 00:00:00 2001 From: bobbyonmagic <237182227+bobbyonmagic@users.noreply.github.com> Date: Mon, 19 Oct 2026 16:20:55 +0300 Subject: [PATCH 4/5] SOC 2 evidence post: rerun after the check-run timing fix, narrow the screenshot and sampling claims --- ...soc2-evidence-from-github-and-terraform.md | 37 ++++++++++--------- 1 file changed, 20 insertions(+), 17 deletions(-) diff --git a/content/posts/soc2-evidence-from-github-and-terraform.md b/content/posts/soc2-evidence-from-github-and-terraform.md index ef3267557..57b85a633 100644 --- a/content/posts/soc2-evidence-from-github-and-terraform.md +++ b/content/posts/soc2-evidence-from-github-and-terraform.md @@ -7,7 +7,7 @@ category: date: '2026-10-22' publishedAt: '2026-10-22T09:00:00Z' updatedAt: '2026-10-22T09:00:00Z' -readingTime: '15 min read' +readingTime: '16 min read' author: name: 'DevOps Daily Team' slug: 'devops-daily-team' @@ -22,18 +22,18 @@ tags: - Audit --- -We pointed a small evidence collector at a GitHub repository whose main branch had a strict ruleset: every change through a pull request, one approval, and a required `test` check. The ruleset control passed. Three of the change-management controls under it failed: none of the six merged pull requests had an independent approval, one was merged five seconds before its check finished, and one commit reached main without a pull request at all. All three were real, and all three would have looked fine in a screenshot of the settings page. +We pointed a small evidence collector at a GitHub repository whose main branch had a strict ruleset: every change through a pull request, one approval, and a required `test` check. The ruleset control passed. Three of the change-management controls under it failed: none of the seven merged pull requests had an independent approval, one was merged five seconds before its check finished, and one commit reached main without a pull request at all. All three were real, and all three would have looked fine in a screenshot of the settings page. That gap is the whole job when a customer asks for SOC 2. An auditor does not only want to know what you configured. For a Type II report they want to see what happened under that configuration across the review period, usually by sampling. This post shows which of that evidence you can pull from the GitHub API and your Terraform code, which still needs a person and a signature, and the ten ways the first version of our collector could pass a control without evidence. ## TL;DR -- Settings are not evidence of operation. Our main branch required approvals and a passing check, and the evidence still showed 0 of 6 pull requests independently approved and 1 merged before its check finished, because admins could bypass the rule. +- Settings are not evidence of operation. Our main branch required approvals and a passing check, and the evidence still showed 0 of 7 pull requests independently approved and 1 merged before its check finished, because admins could bypass the rule. - "The checks are green" is the wrong question. Pull request #3's check passed 5 seconds after the merge. It is green today; it did not gate the merge. Compare the check's completion time with the merge time. - An evidence script must fail closed. Two reviews of our first version found ten ways it could pass a control on missing or partial data, from approvals of an older commit to a branch name that could change the API query. Each now reports `fail` or `incomplete`, with a test. - Terraform scanning is evidence of a configuration standard, but a pass is only as good as the rule list. Trivy flagged the public database flag, and its security-group rule passed a Postgres port open to the whole internet, because that rule only covers SSH and RDP. - Access reviews, policy sign-offs, training, risk assessment, vendor reviews and incident-response tests still need a person. Automation can gather the list; it cannot make the judgement. -- One run took 21 seconds and 32 API calls for one repository and 90 days, and produced 14 timestamped evidence files with a SHA-256 manifest. +- One run took 23 seconds and 35 API calls for one repository and 90 days, and produced 15 timestamped evidence files with a SHA-256 manifest. ## Prerequisites @@ -69,7 +69,7 @@ The usual way to produce this is screenshots: the branch protection page, the pu | Criterion | Control | Where the evidence comes from | | --- | --- | --- | | CC8.1 | Changes to the default branch go through a pull request | branch rules and classic branch protection | -| CC8.1 | Every merged change was tested before the merge | the last run of each required check on the pull request's head commit that finished before the merge | +| CC8.1 | Every merged change passed the required checks before the merge | the last run of each required check on the pull request's head commit that started before the merge | | CC8.1 | Every merged change was approved by someone other than its author | each reviewer's last decision before the merge, for the merged commit | | CC8.1 | Nothing reached the default branch without a pull request | the merged pull request behind each commit, and the branch's activity log | | CC7.1 | Dependency vulnerability alerts are on | the Dependabot setting | @@ -109,7 +109,7 @@ We made the collector's own repository its test subject, with a history built on { "title": "collect.py", "steps": [ - {"cmd": "python3 collect.py The-DevOps-Daily/soc2-evidence-collector --days 90", "output": "The-DevOps-Daily/soc2-evidence-collector, last 90 days: 14 evidence files, 32 API calls, 20.8 s\n CC8.1 pass Changes to the default branch go through a pull request\n rule on main: pull_request, 1 approval(s) required\n CC8.1 fail Every merged change was tested before the merge\n required: test; 5 of 6 merged PRs passed every required check before the merge (#3 not finished)\n CC8.1 fail Every merged change was approved by someone other than its author\n 0 of 6 merged PRs had an independent approval of the merged commit\n CC8.1 fail Nothing reached the default branch without a pull request\n commits not linked to a merged PR: 1 of 7; branch updates that were not PR merges: 1 (branch_creation)\n CC7.1 pass Dependency vulnerability alerts are on\n Dependabot alerts on\n CC7.1 pass No critical or high alert is open past 30 days\n 8 open alerts, 0 critical or high open longer than 30 days\n CC6.1 pass Secret scanning and push protection are on\n secret scanning enabled, push protection enabled\n CC6.3 needs a person Repository access follows least privilege\n roles: {'admin': 4}, outside collaborators: 0; the list is evidence, the judgement is not\nevidence: evidence/The-DevOps-Daily__soc2-evidence-collector/20261019T131136Z"} + {"cmd": "python3 collect.py The-DevOps-Daily/soc2-evidence-collector --days 90", "output": "The-DevOps-Daily/soc2-evidence-collector, last 90 days: 15 evidence files, 35 API calls, 22.7 s\n CC8.1 pass Changes to the default branch go through a pull request\n rule on main: pull_request, 1 approval(s) required\n CC8.1 fail Every merged change passed the required checks before the merge\n required: test; 6 of 7 merged PRs passed every required check before the merge (#3 not finished)\n CC8.1 fail Every merged change was approved by someone other than its author\n 0 of 7 merged PRs had an independent approval of the merged commit\n CC8.1 fail Nothing reached the default branch without a pull request\n commits not linked to a merged PR: 1 of 8; branch updates that were not PR merges: 1 (branch_creation)\n CC7.1 pass Dependency vulnerability alerts are on\n Dependabot alerts on\n CC7.1 pass No critical or high alert is open past 30 days\n 8 open alerts, 0 critical or high open longer than 30 days\n CC6.1 pass Secret scanning and push protection are on\n secret scanning enabled, push protection enabled\n CC6.3 needs a person Repository access follows least privilege\n roles: {'admin': 4}, outside collaborators: 0; the list is evidence, the judgement is not\nevidence: evidence/The-DevOps-Daily__soc2-evidence-collector/20261019T131928Z"} ] } ``` @@ -120,7 +120,7 @@ It found every gap we put in, and it exits non-zero, so it can gate a pipeline o ### The rule was on, and the evidence still failed -The first control passed: a pull request with one approval is required on main. The approval control under it failed for all six merged pull requests. An admin bypass is not a bug in the ruleset. Many teams keep one for emergencies, and an auditor's sample will find every use of it. If your system description says all changes are approved by a second person and your evidence shows admin merges without approval, expect the auditor to report them as exceptions. +The first control passed: a pull request with one approval is required on main. The approval control under it failed for all seven merged pull requests. An admin bypass is not a bug in the ruleset. Many teams keep one for emergencies, and an auditor's sample may well include a change that used it. If your system description says all changes are approved by a second person and your evidence shows admin merges without approval, expect the auditor to report them as exceptions. For a one-person or two-person team, the honest fix is not to pretend. Common approaches are a reviewer from outside the team for production repositories, or a documented control that someone reviews merged changes after the fact within a fixed time. Which of these your auditor accepts is a conversation to have before the review period starts, not after. @@ -130,12 +130,13 @@ Here is the evidence file for pull request #3 as the collector saved it, without ```json { - "collected_at": "2026-10-19T13:11:36.394769+00:00", + "collected_at": "2026-10-19T13:19:28.577807+00:00", "source": "GitHub API, The-DevOps-Daily/soc2-evidence-collector", "data": { "pull": { "number": 3, "title": "Examples to scan, and the IaC scan script", + "base": "main", "merged_at": "2026-10-19T12:50:03Z", "html_url": "https://github.com/The-DevOps-Daily/soc2-evidence-collector/pull/3" }, @@ -145,8 +146,10 @@ Here is the evidence file for pull request #3 as the collector saved it, without { "name": "test", "app_id": 15368, + "head_sha": "d4b17526cfcaf516833023b9ec402f45a70a10ec", "status": "completed", "conclusion": "success", + "started_at": "2026-10-19T12:50:01Z", "completed_at": "2026-10-19T12:50:08Z" } ] @@ -154,9 +157,9 @@ Here is the evidence file for pull request #3 as the collector saved it, without } ``` -The check succeeded at 12:50:08. The pull request was merged at 12:50:03. Look at the pull request page today and you see a green check, which is what most screenshots record. The collector compares the two timestamps, and so should anything you hand to an auditor. +The check started at 12:50:01. The pull request was merged at 12:50:03. The check succeeded at 12:50:08. Look at the pull request page today and you see a green check, which is what most screenshots record. The collector compares the timestamps, and so should anything you hand to an auditor. -It asks GitHub for every run of the check, not only the latest, and judges each required check by its last run that finished before the merge. A re-run after the merge does not hide a pass before it, and an earlier pass does not hide a later failure. A required check stops a normal merge until it passes, so a merge before completion usually means someone used a bypass. It can also mean the required checks changed after the merge, because the collector compares with today's rules. Either way, it is an exception to explain. +It asks GitHub for every run of the check, not only the latest, and judges each required check by its last run that started before the merge: that run is the check's state at the merge. If it had not finished by then, the check did not gate the merge, even if an earlier run had passed. A re-run started after the merge does not count. Only `success` passes: GitHub lets a [skipped or neutral required check](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging) through, but a skipped check ran no tests. A required check stops a normal merge until it passes, so a merge before completion usually means someone used a bypass. It can also mean the required checks changed after the merge, because the collector compares with today's rules. Either way, it is an exception to explain. ### The commit with no pull request @@ -166,7 +169,7 @@ The two sources catch different things. The commit list only holds commits that ### The alerts that passed -Dependabot raised 8 open alerts for the two pinned packages: 2 critical, 1 high and 5 medium. The SLA control passed, correctly, because the alerts were less than an hour old. Our default SLA is 30 days for critical and high; use the number your own vulnerability policy states, since that is what the auditor will hold you to. The same run in five weeks would fail. +Dependabot raised 8 open alerts for the two pinned packages: 2 critical, 1 high and 5 medium. The SLA control passed, correctly, because the alerts were less than an hour old. Our default SLA is 30 days for critical and high; use the number your own vulnerability policy states, since that is what the auditor will hold you to. If those alerts are still open, the same run in five weeks would fail. This control reads the alerts that are open today. A critical alert that stayed open for two months last spring and was fixed in the summer does not appear in it. To cover a period, keep each run's folder, or extend the collector to fixed alerts and compare their `fixed_at` with `created_at`. @@ -178,18 +181,18 @@ Two reviews of the first version of the collector, one of the code and one of th | --- | --- | | An approval of an older commit counted | Only an approval whose `commit_id` is the merged head commit counts; the rest are reported as stale | | A withdrawn approval counted | Only each reviewer's last decision before the merge counts, so a later change request or a dismissal replaces an approval | -| Any passing check counted as the required one | Each required check is matched by name, and by app when the rule names one | -| An earlier pass could hide a later failure | Each required check is judged by its last run that finished before the merge | +| Any passing or skipped check counted as the required one | Each required check is matched by name, and by app when the rule names one, and only `success` passes | +| An earlier pass could hide a later failure, or a re-run still going at the merge | Each required check is judged by its last run that started before the merge, which must have succeeded before the merge | | Unreadable alerts looked like zero alerts | A 403 or 404 makes the SLA control `incomplete`, with the HTTP status | | Lists were cut off silently | A list cut at its limit makes its control `incomplete`, and an error on a later page stops the run | | Any pull request link counted | The pull request must be merged into the default branch and be one of the merged pull requests evaluated | | A force push left no trace | The branch's activity log is read alongside the commit list | | The SLA was rounded down to whole days, and alerts without a severity were skipped | The age is compared as a time, and an unknown severity makes the control `incomplete` | -| Branch names went into URLs unencoded | Every value is encoded, and an item for another branch makes its list `incomplete` | +| Branch names went into URLs unencoded, and answers were not checked | Every value is encoded, and a pull request, activity entry or check run for another branch or commit makes its list `incomplete` | The last one is easy to miss. Git allows `&` and `#` in branch names, so a default branch with a crafted name could change the query string, and the collector would judge GitHub's answer to a different question. -None of these changed a result for our demo repository: it has no approvals at all, a readable list of 8 alerts and seven commits. They would change results for a real repository, where a stale approval, a re-run check or a missing permission is common. Each fix has a test in the repository. +None of these changed a result for our demo repository: it has no approvals at all, a readable list of 8 alerts and eight commits. They would change results for a real repository, where a stale approval, a re-run check or a missing permission is common. Each fix has a test in the repository. Running the collector also found one more problem: the Dependabot alerts API rejects page numbers (`Pagination using the page parameter is not supported`) and pages with cursors in the `Link` header instead. The collector now follows the `Link` header for every list. @@ -247,11 +250,11 @@ Automation helps with all of these by collecting the inputs and reminding people The compliance automation platforms, such as Vanta, Drata, Secureframe, Sprinto and Thoropass, do the same thing at a much wider scale. They connect to source control, cloud accounts, identity providers and HR systems, map what they collect to controls, track the people-side tasks such as training and policy acknowledgments, and give the auditor a place to review the evidence. For a team going through its first audit, that coverage and the auditor relationships that come with it are the reason to pay for one. -What a small script like ours is good for is understanding what those tools check, and covering what is specific to you: a custom deployment pipeline, a check a platform does not have, or a control you want tested on every change. It can run alongside a platform as well as instead of one. Whichever you use, test it the way we tested ours: give it a repository with known problems and confirm it fails on each of them. An evidence tool that has only ever reported `pass` has not been tested. +What a small script like ours is good for is understanding what those tools check, and covering what is specific to you: a custom deployment pipeline, a check a platform does not have, or a control you want tested on every change. It can run alongside a platform as well as instead of one. Whichever you use, test it the way we tested ours: give it a repository with known problems and confirm it fails on each of them. A tool you have only seen report `pass` has not shown you that it can fail. ## Time -For one repository and 90 days, the collector made 32 API calls and wrote 14 evidence files in 21 seconds. By hand, the same evidence is a screenshot of the ruleset, one of each merged pull request with its checks and reviews, the Dependabot tab, the security settings and the collaborator list: ten screenshots here, and the pull request page does not put the check's completion time next to the merge time. We did not time the manual version, so we will not give a number for it. The difference grows with the sample: an auditor sampling 25 changes across 10 repositories is 25 pull request pages by hand, and one run per repository for the script. +For one repository and 90 days, the collector made 35 API calls and wrote 15 evidence files in 23 seconds. By hand, the closest you get is a screenshot of the ruleset, one of each merged pull request with its checks and reviews, the Dependabot tab, the security settings and the collaborator list: eleven screenshots here. They still miss the branch's history and the links from each commit to its pull request, which the direct-push control reads, and the pull request page does not put the check's start and completion times next to the merge time. We did not time the manual version, so we will not give a number for it. The difference grows with the sample: an auditor sampling 25 changes across 10 repositories is 25 pull request pages by hand, and one run per repository for the script. ## Summary From 56a6f084d4f6ba20b72ace32e5a7c5b3464cce07 Mon Sep 17 00:00:00 2001 From: bobbyonmagic <237182227+bobbyonmagic@users.noreply.github.com> Date: Mon, 19 Oct 2026 17:37:49 +0300 Subject: [PATCH 5/5] Publish date 2026-10-19 --- content/posts/soc2-evidence-from-github-and-terraform.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/content/posts/soc2-evidence-from-github-and-terraform.md b/content/posts/soc2-evidence-from-github-and-terraform.md index 57b85a633..842d63e07 100644 --- a/content/posts/soc2-evidence-from-github-and-terraform.md +++ b/content/posts/soc2-evidence-from-github-and-terraform.md @@ -4,9 +4,9 @@ excerpt: 'We pointed a small evidence collector at a repository whose main branc category: name: 'Security' slug: 'security' -date: '2026-10-22' -publishedAt: '2026-10-22T09:00:00Z' -updatedAt: '2026-10-22T09:00:00Z' +date: '2026-10-19' +publishedAt: '2026-10-19T09:00:00Z' +updatedAt: '2026-10-19T09:00:00Z' readingTime: '16 min read' author: name: 'DevOps Daily Team'