From 6a567b56a84d9e050f8c38b27e37351d675814c5 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 20 Dec 2018 09:20:12 +0100 Subject: [PATCH] committing changes in /etc after apt run Package changes: +binfmt-support 2.1.8-2 amd64 +ca-certificates-java 20180516ubuntu1~18.04.1 all +default-jdk 2:1.10-63ubuntu1~02 amd64 +default-jdk-headless 2:1.10-63ubuntu1~02 amd64 +default-jre 2:1.10-63ubuntu1~02 amd64 +default-jre-headless 2:1.10-63ubuntu1~02 amd64 +eclipse 3.8.1-11 all +eclipse-jdt 3.8.1-11 all +eclipse-pde 3.8.1-11 amd64 +eclipse-platform 3.8.1-11 amd64 +eclipse-platform-data 3.8.1-11 all +eclipse-rcp 3.8.1-11 amd64 +fastjar 2:0.98-6build1 amd64 +jarwrapper 0.63ubuntu1 all +libasm3-java 3.3.2-3 all +libatk-wrapper-java 0.33.3-20ubuntu0.1 all +libatk-wrapper-java-jni 0.33.3-20ubuntu0.1 amd64 +libcglib-java 3.2.6-2 all +libcommons-beanutils-java 1.9.3-1 all +libcommons-codec-java 1.11-1 all +libcommons-collections3-java 3.2.2-1 all +libcommons-compress-java 1.13-2 all +libcommons-dbcp-java 1.4-5ubuntu2 all +libcommons-digester-java 1.8.1-5 all +libcommons-httpclient-java 3.1-14 all +libcommons-pool-java 1.6-3 all +libdb-java 1:5.3.21~exp1ubuntu2 all +libdb-je-java 3.3.98-2 all +libdb5.3-java 5.3.28-13.1ubuntu1 all +libdb5.3-java-jni 5.3.28-13.1ubuntu1 amd64 +libeasymock-java 3.6-1 all +libecj-java 3.13.3-1 all +libequinox-osgi-java 3.9.1-1 all +libfelix-bundlerepository-java 2.0.10-3 all +libfelix-gogo-command-java 0.14.0-2 all +libfelix-gogo-runtime-java 0.16.2-1 all +libfelix-gogo-shell-java 0.12.0-1 all +libfelix-osgi-obr-java 1.0.2-4fakesync1 all +libfelix-shell-java 1.4.3-2 all +libfelix-utils-java 1.8.6-1 all +libicu4j-4.2-java 4.2.1.1-6fakesync all +libicu4j-49-java 49.1-3 all +libjavascriptcoregtk-1.0-0 2.4.11-3ubuntu3 amd64 +libjetty9-java 9.2.23-1 all +libjsch-java 0.1.54-1 all +libjtidy-java 7+svn20110807-5 all +libjzlib-java 1.1.3-2 all +libkxml2-java 2.3.0+ds1-2 all +liblucene2-java 2.9.4+ds1-6 all +libobjenesis-java 2.6-1 all +libosgi-annotation-java 6.0.0-2 all +libosgi-compendium-java 6.0.0-1 all +libosgi-core-java 6.0.0-1 all +libregexp-java 1.5-4 all +libswt-cairo-gtk-3-jni 3.8.2-5 amd64 +libswt-glx-gtk-3-jni 3.8.2-5 amd64 +libswt-gtk-3-java 3.8.2-5 amd64 +libswt-gtk-3-jni 3.8.2-5 amd64 +libswt-webkit-gtk-3-jni 3.8.2-5 amd64 +libtomcat8-java 8.5.30-1ubuntu1.4 all +libwebkitgtk-1.0-0 2.4.11-3ubuntu3 amd64 +openjdk-11-jdk 10.0.2+13-1ubuntu0.18.04.4 amd64 +openjdk-11-jdk-headless 10.0.2+13-1ubuntu0.18.04.4 amd64 +openjdk-11-jre 10.0.2+13-1ubuntu0.18.04.4 amd64 +openjdk-11-jre-headless 10.0.2+13-1ubuntu0.18.04.4 amd64 +sat4j 2.3.5-0.2 all --- .etckeeper | 34 +- alternatives/jaotc | 1 + alternatives/jdeprscan | 1 + alternatives/jhsdb | 1 + alternatives/jimage | 1 + alternatives/jlink | 1 + alternatives/jmod | 1 + alternatives/jshell | 1 + alternatives/lucli | 1 + alternatives/lucli.1.gz | 1 + ca-certificates/update.d/jks-keystore | 89 ++ default/cacerts | 10 + eclipse.ini | 14 + init.d/binfmt-support | 56 + java-11-openjdk/accessibility.properties | 10 + java-11-openjdk/jvm-amd64.cfg | 35 + java-11-openjdk/logging.properties | 63 ++ java-11-openjdk/management/jmxremote.access | 79 ++ .../management/management.properties | 381 +++++++ java-11-openjdk/net.properties | 101 ++ java-11-openjdk/psfont.properties.ja | 119 ++ java-11-openjdk/psfontj2d.properties | 323 ++++++ java-11-openjdk/security/blacklisted.certs | 20 + java-11-openjdk/security/default.policy | 206 ++++ java-11-openjdk/security/java.policy | 44 + java-11-openjdk/security/java.security | 1005 +++++++++++++++++ java-11-openjdk/security/nss.cfg | 4 + java-11-openjdk/security/policy/README.txt | 54 + .../policy/limited/default_US_export.policy | 6 + .../policy/limited/default_local.policy | 14 + .../policy/limited/exempt_local.policy | 13 + .../policy/unlimited/default_US_export.policy | 6 + .../policy/unlimited/default_local.policy | 6 + java-11-openjdk/sound.properties | 39 + java-11-openjdk/swing.properties | 2 + mailcap | 3 + rc2.d/S02binfmt-support | 1 + rc3.d/S02binfmt-support | 1 + rc4.d/S02binfmt-support | 1 + rc5.d/S02binfmt-support | 1 + ssl/certs/java/cacerts | Bin 0 -> 156975 bytes .../binfmt-support.service | 1 + 42 files changed, 2749 insertions(+), 1 deletion(-) create mode 120000 alternatives/jaotc create mode 120000 alternatives/jdeprscan create mode 120000 alternatives/jhsdb create mode 120000 alternatives/jimage create mode 120000 alternatives/jlink create mode 120000 alternatives/jmod create mode 120000 alternatives/jshell create mode 120000 alternatives/lucli create mode 120000 alternatives/lucli.1.gz create mode 100755 ca-certificates/update.d/jks-keystore create mode 100644 default/cacerts create mode 100644 eclipse.ini create mode 100755 init.d/binfmt-support create mode 100644 java-11-openjdk/accessibility.properties create mode 100644 java-11-openjdk/jvm-amd64.cfg create mode 100644 java-11-openjdk/logging.properties create mode 100644 java-11-openjdk/management/jmxremote.access create mode 100644 java-11-openjdk/management/management.properties create mode 100644 java-11-openjdk/net.properties create mode 100644 java-11-openjdk/psfont.properties.ja create mode 100644 java-11-openjdk/psfontj2d.properties create mode 100644 java-11-openjdk/security/blacklisted.certs create mode 100644 java-11-openjdk/security/default.policy create mode 100644 java-11-openjdk/security/java.policy create mode 100644 java-11-openjdk/security/java.security create mode 100644 java-11-openjdk/security/nss.cfg create mode 100644 java-11-openjdk/security/policy/README.txt create mode 100644 java-11-openjdk/security/policy/limited/default_US_export.policy create mode 100644 java-11-openjdk/security/policy/limited/default_local.policy create mode 100644 java-11-openjdk/security/policy/limited/exempt_local.policy create mode 100644 java-11-openjdk/security/policy/unlimited/default_US_export.policy create mode 100644 java-11-openjdk/security/policy/unlimited/default_local.policy create mode 100644 java-11-openjdk/sound.properties create mode 100644 java-11-openjdk/swing.properties create mode 120000 rc2.d/S02binfmt-support create mode 120000 rc3.d/S02binfmt-support create mode 120000 rc4.d/S02binfmt-support create mode 120000 rc5.d/S02binfmt-support create mode 100644 ssl/certs/java/cacerts create mode 120000 systemd/system/multi-user.target.wants/binfmt-support.service diff --git a/.etckeeper b/.etckeeper index 2c5f22b..c870f02 100755 --- a/.etckeeper +++ b/.etckeeper @@ -13,7 +13,6 @@ mkdir -p './at-spi2' mkdir -p './avahi/services' mkdir -p './binfmt.d' mkdir -p './brltty/Input/xw' -mkdir -p './ca-certificates/update.d' mkdir -p './cups/interfaces' mkdir -p './davfs2/certs/private' mkdir -p './dbus-1/session.d' @@ -1043,6 +1042,7 @@ maybe chmod 0644 'bumblebee/xorg.conf.nvidia' maybe chmod 0755 'ca-certificates' maybe chmod 0644 'ca-certificates.conf' maybe chmod 0755 'ca-certificates/update.d' +maybe chmod 0755 'ca-certificates/update.d/jks-keystore' maybe chmod 0755 'calendar' maybe chmod 0644 'calendar/default' maybe chgrp 'dip' 'chatscripts' @@ -1249,6 +1249,7 @@ maybe chmod 0644 'default/batmand' maybe chmod 0644 'default/bridge-utils' maybe chmod 0644 'default/brltty' maybe chmod 0644 'default/bsdmainutils' +maybe chmod 0600 'default/cacerts' maybe chmod 0644 'default/console-setup' maybe chmod 0644 'default/crda' maybe chmod 0644 'default/cron' @@ -1341,6 +1342,7 @@ maybe chmod 0644 'dpkg/origins/ubuntu' maybe chmod 0644 'dpkg/shlibs.default' maybe chmod 0644 'dpkg/shlibs.override' maybe chmod 0644 'drirc' +maybe chmod 0644 'eclipse.ini' maybe chmod 0755 'emacs' maybe chmod 0755 'emacs/site-start.d' maybe chmod 0644 'emacs/site-start.d/00debian-vars.el' @@ -1613,6 +1615,7 @@ maybe chmod 0755 'init.d/apparmor' maybe chmod 0755 'init.d/apport' maybe chmod 0755 'init.d/avahi-daemon' maybe chmod 0755 'init.d/batmand' +maybe chmod 0755 'init.d/binfmt-support' maybe chmod 0755 'init.d/bluetooth' maybe chmod 0755 'init.d/bootmisc.sh' maybe chmod 0755 'init.d/brltty' @@ -1792,6 +1795,33 @@ maybe chmod 0644 'iproute2/rt_tables.d/README' maybe chmod 0644 'issue' maybe chmod 0644 'issue.net' maybe chmod 0755 'java' +maybe chmod 0755 'java-11-openjdk' +maybe chmod 0644 'java-11-openjdk/accessibility.properties' +maybe chmod 0644 'java-11-openjdk/jvm-amd64.cfg' +maybe chmod 0644 'java-11-openjdk/logging.properties' +maybe chmod 0755 'java-11-openjdk/management' +maybe chmod 0644 'java-11-openjdk/management/jmxremote.access' +maybe chmod 0644 'java-11-openjdk/management/management.properties' +maybe chmod 0644 'java-11-openjdk/net.properties' +maybe chmod 0644 'java-11-openjdk/psfont.properties.ja' +maybe chmod 0644 'java-11-openjdk/psfontj2d.properties' +maybe chmod 0755 'java-11-openjdk/security' +maybe chmod 0644 'java-11-openjdk/security/blacklisted.certs' +maybe chmod 0644 'java-11-openjdk/security/default.policy' +maybe chmod 0644 'java-11-openjdk/security/java.policy' +maybe chmod 0644 'java-11-openjdk/security/java.security' +maybe chmod 0644 'java-11-openjdk/security/nss.cfg' +maybe chmod 0755 'java-11-openjdk/security/policy' +maybe chmod 0644 'java-11-openjdk/security/policy/README.txt' +maybe chmod 0755 'java-11-openjdk/security/policy/limited' +maybe chmod 0644 'java-11-openjdk/security/policy/limited/default_US_export.policy' +maybe chmod 0644 'java-11-openjdk/security/policy/limited/default_local.policy' +maybe chmod 0644 'java-11-openjdk/security/policy/limited/exempt_local.policy' +maybe chmod 0755 'java-11-openjdk/security/policy/unlimited' +maybe chmod 0644 'java-11-openjdk/security/policy/unlimited/default_US_export.policy' +maybe chmod 0644 'java-11-openjdk/security/policy/unlimited/default_local.policy' +maybe chmod 0644 'java-11-openjdk/sound.properties' +maybe chmod 0644 'java-11-openjdk/swing.properties' maybe chmod 0755 'java-8-oracle' maybe chmod 0755 'java-8-oracle/security' maybe chmod 0644 'java-8-oracle/security/blacklist' @@ -2547,6 +2577,8 @@ maybe chmod 0644 'ssh/sshd_config' maybe chmod 0755 'ssl' maybe chmod 0755 'ssl/certs' maybe chmod 0644 'ssl/certs/ca-certificates.crt' +maybe chmod 0755 'ssl/certs/java' +maybe chmod 0644 'ssl/certs/java/cacerts' maybe chmod 0644 'ssl/certs/ssl-cert-snakeoil.pem' maybe chmod 0644 'ssl/openssl.cnf' maybe chgrp 'ssl-cert' 'ssl/private' diff --git a/alternatives/jaotc b/alternatives/jaotc new file mode 120000 index 0000000..c6dd731 --- /dev/null +++ b/alternatives/jaotc @@ -0,0 +1 @@ +/usr/lib/jvm/java-11-openjdk-amd64/bin/jaotc \ No newline at end of file diff --git a/alternatives/jdeprscan b/alternatives/jdeprscan new file mode 120000 index 0000000..42e6bd9 --- /dev/null +++ b/alternatives/jdeprscan @@ -0,0 +1 @@ +/usr/lib/jvm/java-11-openjdk-amd64/bin/jdeprscan \ No newline at end of file diff --git a/alternatives/jhsdb b/alternatives/jhsdb new file mode 120000 index 0000000..0ab2fd6 --- /dev/null +++ b/alternatives/jhsdb @@ -0,0 +1 @@ +/usr/lib/jvm/java-11-openjdk-amd64/bin/jhsdb \ No newline at end of file diff --git a/alternatives/jimage b/alternatives/jimage new file mode 120000 index 0000000..ca1bfcf --- /dev/null +++ b/alternatives/jimage @@ -0,0 +1 @@ +/usr/lib/jvm/java-11-openjdk-amd64/bin/jimage \ No newline at end of file diff --git a/alternatives/jlink b/alternatives/jlink new file mode 120000 index 0000000..80e6b20 --- /dev/null +++ b/alternatives/jlink @@ -0,0 +1 @@ +/usr/lib/jvm/java-11-openjdk-amd64/bin/jlink \ No newline at end of file diff --git a/alternatives/jmod b/alternatives/jmod new file mode 120000 index 0000000..71c0087 --- /dev/null +++ b/alternatives/jmod @@ -0,0 +1 @@ +/usr/lib/jvm/java-11-openjdk-amd64/bin/jmod \ No newline at end of file diff --git a/alternatives/jshell b/alternatives/jshell new file mode 120000 index 0000000..af9ad66 --- /dev/null +++ b/alternatives/jshell @@ -0,0 +1 @@ +/usr/lib/jvm/java-11-openjdk-amd64/bin/jshell \ No newline at end of file diff --git a/alternatives/lucli b/alternatives/lucli new file mode 120000 index 0000000..cbc1cd2 --- /dev/null +++ b/alternatives/lucli @@ -0,0 +1 @@ +/usr/lib/liblucene2-java/lucli \ No newline at end of file diff --git a/alternatives/lucli.1.gz b/alternatives/lucli.1.gz new file mode 120000 index 0000000..3923cea --- /dev/null +++ b/alternatives/lucli.1.gz @@ -0,0 +1 @@ +/usr/lib/liblucene2-java/lucli.1.gz \ No newline at end of file diff --git a/ca-certificates/update.d/jks-keystore b/ca-certificates/update.d/jks-keystore new file mode 100755 index 0000000..e0c3445 --- /dev/null +++ b/ca-certificates/update.d/jks-keystore @@ -0,0 +1,89 @@ +#!/bin/sh + +set -e + +# use the locale C.UTF-8 +unset LC_ALL +LC_CTYPE=C.UTF-8 +export LC_CTYPE + +storepass='changeit' +if [ -f /etc/default/cacerts ]; then + . /etc/default/cacerts +fi + +arch=`dpkg --print-architecture` +JAR=/usr/share/ca-certificates-java/ca-certificates-java.jar + +nsslib_name() +{ + if dpkg --assert-multi-arch 2>/dev/null; then + echo "libnss3:${arch}" + else + echo "libnss3" + fi +} + +echo "" +if [ "$cacerts_updates" != yes ] || [ "$CACERT_UPDATES" = disabled ] || [ ! -e $JAR ]; then + echo "updates of cacerts keystore disabled." + exit 0 +fi + +if ! mountpoint -q /proc; then + echo >&2 "the keytool command requires a mounted proc fs (/proc)." + exit 1 +fi + +for jvm in java-7-openjdk-$arch java-7-openjdk \ + oracle-java7-jre-$arch oracle-java7-server-jre-$arch oracle-java7-jdk-$arch \ + java-8-openjdk-$arch java-8-openjdk \ + oracle-java8-jre-$arch oracle-java8-server-jre-$arch oracle-java8-jdk-$arch \ + java-9-openjdk-$arch java-9-openjdk \ + oracle-java9-jre-$arch oracle-java9-server-jre-$arch oracle-java9-jdk-$arch \ + java-10-openjdk-$arch java-10-openjdk \ + oracle-java10-jre-$arch oracle-java10-server-jre-$arch oracle-java10-jdk-$arch \ + java-11-openjdk-$arch java-11-openjdk \ + oracle-java11-jre-$arch oracle-java11-server-jre-$arch oracle-java11-jdk-$arch; do + if [ -x /usr/lib/jvm/$jvm/bin/java ]; then + export JAVA_HOME=/usr/lib/jvm/$jvm + PATH=$JAVA_HOME/bin:$PATH + break + fi +done + +if dpkg-query --version >/dev/null; then + nsspkg=$(dpkg-query -L "$(nsslib_name)" | sed -n 's,\(.*\)/libnss3\.so$,\1,p'|head -n 1) + nsscfg=/etc/${jvm%-$arch}/security/nss.cfg + nssjdk=$(test ! -f $nsscfg || sed -n '/nssLibraryDirectory/s/.*= *\(.*\)/\1/p' $nsscfg) + if [ -n "$nsspkg" ] && [ -n "$nssjdk" ] && [ "$nsspkg" != "$nssjdk" ]; then + ln -sf $nsspkg/libnss3.so $nssjdk/libnss3.so + fi + softokn3pkg=$(dpkg-query -L "$(nsslib_name)" | sed -n 's,\(.*\)/libsoftokn3\.so$,\1,p'|head -n 1) + if [ -n "$softokn3pkg" ] && [ -n "$nssjdk" ] && [ "$softokn3pkg" != "$nssjdk" ]; then + ln -sf $softokn3pkg/libsoftokn3.so $nssjdk/libsoftokn3.so + fi +fi + +do_cleanup() +{ + [ -z "$temp_jvm_cfg" ] || rm -f $temp_jvm_cfg + if [ -n "$nsspkg" ] && [ -n "$nssjdk" ] && [ "$nsspkg" != "$nssjdk" ] + then + rm -f $nssjdk/libnss3.so + fi + if [ -n "$softokn3pkg" ] && [ -n "$nssjdk" ] \ + && [ "$softokn3pkg" != "$nssjdk" ] + then + rm -f $nssjdk/libsoftokn3.so + fi +} + +if java -Xmx64m -jar $JAR -storepass "$storepass"; then + do_cleanup +else + do_cleanup + exit 1 +fi + +echo "done." diff --git a/default/cacerts b/default/cacerts new file mode 100644 index 0000000..d03ec9d --- /dev/null +++ b/default/cacerts @@ -0,0 +1,10 @@ +# defaults for ca-certificates-java + +# The password which is used to protect the integrity of the keystore. +# storepass must be at least 6 characters long. It must be provided to +# all commands that access the keystore contents. +# Only change this if adding private certificates. +#storepass='' + +# enable/disable updates of the keystore /etc/ssl/certs/java/cacerts +cacerts_updates=yes diff --git a/eclipse.ini b/eclipse.ini new file mode 100644 index 0000000..db3cd6d --- /dev/null +++ b/eclipse.ini @@ -0,0 +1,14 @@ +-startup +plugins/org.eclipse.equinox.launcher_1.3.0.dist.jar +--launcher.library +plugins/org.eclipse.equinox.launcher.gtk.linux.x86_64_1.1.200.dist +-showsplash +org.eclipse.platform +--launcher.XXMaxPermSize +256m +--launcher.defaultAction +openFile +-vmargs +-Xms40m +-Xmx384m +-Dorg.eclipse.equinox.p2.reconciler.dropins.directory=/usr/share/eclipse/dropins diff --git a/init.d/binfmt-support b/init.d/binfmt-support new file mode 100755 index 0000000..41b9390 --- /dev/null +++ b/init.d/binfmt-support @@ -0,0 +1,56 @@ +#! /bin/sh +### BEGIN INIT INFO +# Provides: binfmt-support +# Required-Start: $local_fs $remote_fs +# Required-Stop: $local_fs $remote_fs +# Default-Start: 2 3 4 5 +# Default-Stop: +# Short-Description: Support for extra binary formats +# Description: Enable support for extra binary formats using the Linux +# kernel's binfmt_misc facility. +### END INIT INFO + +PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin +NAME=binfmt-support +DESC="additional executable binary formats" + +if [ "$(uname)" != Linux ]; then + exit 0 +fi + +which update-binfmts >/dev/null 2>&1 || exit 0 + +. /lib/lsb/init-functions +[ -r /etc/default/rcS ] && . /etc/default/rcS + +set -e +CODE=0 + +case "$1" in + start) + log_daemon_msg "Enabling $DESC" "$NAME" + update-binfmts --enable || CODE=$? + log_end_msg $CODE + exit $CODE + ;; + + stop) + log_daemon_msg "Disabling $DESC" "$NAME" + update-binfmts --disable || CODE=$? + log_end_msg $CODE + exit $CODE + ;; + + restart|force-reload) + $0 stop + $0 start + ;; + + *) + N=/etc/init.d/$NAME + echo "Usage: $N {start|stop|restart|force-reload}" >&2 + exit 1 + ;; +esac + +exit 0 diff --git a/java-11-openjdk/accessibility.properties b/java-11-openjdk/accessibility.properties new file mode 100644 index 0000000..c1bdc48 --- /dev/null +++ b/java-11-openjdk/accessibility.properties @@ -0,0 +1,10 @@ +# +# The following line specifies the assistive technology classes +# that should be loaded into the Java VM when the AWT is initailized. +# Specify multiple classes by separating them with commas. +# Note: the line below cannot end the file (there must be at +# a minimum a blank line following it). +# +# Doesn't work, see LP: #935296 +#assistive_technologies=org.GNOME.Accessibility.AtkWrapper + diff --git a/java-11-openjdk/jvm-amd64.cfg b/java-11-openjdk/jvm-amd64.cfg new file mode 100644 index 0000000..6cebec3 --- /dev/null +++ b/java-11-openjdk/jvm-amd64.cfg @@ -0,0 +1,35 @@ +# Copyright (c) 2003, 2013, Oracle and/or its affiliates. All rights reserved. +# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. +# +# This code is free software; you can redistribute it and/or modify it +# under the terms of the GNU General Public License version 2 only, as +# published by the Free Software Foundation. Oracle designates this +# particular file as subject to the "Classpath" exception as provided +# by Oracle in the LICENSE file that accompanied this code. +# +# This code is distributed in the hope that it will be useful, but WITHOUT +# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or +# FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License +# version 2 for more details (a copy is included in the LICENSE file that +# accompanied this code). +# +# You should have received a copy of the GNU General Public License version +# 2 along with this work; if not, write to the Free Software Foundation, +# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. +# +# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA +# or visit www.oracle.com if you need additional information or have any +# questions. +# +# List of JVMs that can be used as an option to java, javac, etc. +# Order is important -- first in this list is the default JVM. +# NOTE that both this file and its format are UNSUPPORTED and +# WILL GO AWAY in a future release. +# +# You may also select a JVM in an arbitrary location with the +# "-XXaltjvm=" option, but that too is unsupported +# and may not be available in a future release. +# +-server KNOWN +-client IGNORE +-zero KNOWN diff --git a/java-11-openjdk/logging.properties b/java-11-openjdk/logging.properties new file mode 100644 index 0000000..58997e5 --- /dev/null +++ b/java-11-openjdk/logging.properties @@ -0,0 +1,63 @@ +############################################################ +# Default Logging Configuration File +# +# You can use a different file by specifying a filename +# with the java.util.logging.config.file system property. +# For example java -Djava.util.logging.config.file=myfile +############################################################ + +############################################################ +# Global properties +############################################################ + +# "handlers" specifies a comma separated list of log Handler +# classes. These handlers will be installed during VM startup. +# Note that these classes must be on the system classpath. +# By default we only configure a ConsoleHandler, which will only +# show messages at the INFO and above levels. +handlers= java.util.logging.ConsoleHandler + +# To also add the FileHandler, use the following line instead. +#handlers= java.util.logging.FileHandler, java.util.logging.ConsoleHandler + +# Default global logging level. +# This specifies which kinds of events are logged across +# all loggers. For any given facility this global level +# can be overriden by a facility specific level +# Note that the ConsoleHandler also has a separate level +# setting to limit messages printed to the console. +.level= INFO + +############################################################ +# Handler specific properties. +# Describes specific configuration info for Handlers. +############################################################ + +# default file output is in user's home directory. +java.util.logging.FileHandler.pattern = %h/java%u.log +java.util.logging.FileHandler.limit = 50000 +java.util.logging.FileHandler.count = 1 +# Default number of locks FileHandler can obtain synchronously. +# This specifies maximum number of attempts to obtain lock file by FileHandler +# implemented by incrementing the unique field %u as per FileHandler API documentation. +java.util.logging.FileHandler.maxLocks = 100 +java.util.logging.FileHandler.formatter = java.util.logging.XMLFormatter + +# Limit the message that are printed on the console to INFO and above. +java.util.logging.ConsoleHandler.level = INFO +java.util.logging.ConsoleHandler.formatter = java.util.logging.SimpleFormatter + +# Example to customize the SimpleFormatter output format +# to print one-line log message like this: +# : [] +# +# java.util.logging.SimpleFormatter.format=%4$s: %5$s [%1$tc]%n + +############################################################ +# Facility specific properties. +# Provides extra control for each logger. +############################################################ + +# For example, set the com.xyz.foo logger to only log SEVERE +# messages: +com.xyz.foo.level = SEVERE diff --git a/java-11-openjdk/management/jmxremote.access b/java-11-openjdk/management/jmxremote.access new file mode 100644 index 0000000..a09e008 --- /dev/null +++ b/java-11-openjdk/management/jmxremote.access @@ -0,0 +1,79 @@ +###################################################################### +# Default Access Control File for Remote JMX(TM) Monitoring +###################################################################### +# +# Access control file for Remote JMX API access to monitoring. +# This file defines the allowed access for different roles. The +# password file (jmxremote.password by default) defines the roles and their +# passwords. To be functional, a role must have an entry in +# both the password and the access files. +# +# The default location of this file is $JRE/conf/management/jmxremote.access +# You can specify an alternate location by specifying a property in +# the management config file $JRE/conf/management/management.properties +# (See that file for details) +# +# The file format for password and access files is syntactically the same +# as the Properties file format. The syntax is described in the Javadoc +# for java.util.Properties.load. +# A typical access file has multiple lines, where each line is blank, +# a comment (like this one), or an access control entry. +# +# An access control entry consists of a role name, and an +# associated access level. The role name is any string that does not +# itself contain spaces or tabs. It corresponds to an entry in the +# password file (jmxremote.password). The access level is one of the +# following: +# "readonly" grants access to read attributes of MBeans. +# For monitoring, this means that a remote client in this +# role can read measurements but cannot perform any action +# that changes the environment of the running program. +# "readwrite" grants access to read and write attributes of MBeans, +# to invoke operations on them, and optionally +# to create or remove them. This access should be granted +# only to trusted clients, since they can potentially +# interfere with the smooth operation of a running program. +# +# The "readwrite" access level can optionally be followed by the "create" and/or +# "unregister" keywords. The "unregister" keyword grants access to unregister +# (delete) MBeans. The "create" keyword grants access to create MBeans of a +# particular class or of any class matching a particular pattern. Access +# should only be granted to create MBeans of known and trusted classes. +# +# For example, the following entry would grant readwrite access +# to "controlRole", as well as access to create MBeans of the class +# javax.management.monitor.CounterMonitor and to unregister any MBean: +# controlRole readwrite \ +# create javax.management.monitor.CounterMonitorMBean \ +# unregister +# or equivalently: +# controlRole readwrite unregister create javax.management.monitor.CounterMBean +# +# The following entry would grant readwrite access as well as access to create +# MBeans of any class in the packages javax.management.monitor and +# javax.management.timer: +# controlRole readwrite \ +# create javax.management.monitor.*,javax.management.timer.* \ +# unregister +# +# The \ character is defined in the Properties file syntax to allow continuation +# lines as shown here. A * in a class pattern matches a sequence of characters +# other than dot (.), so javax.management.monitor.* matches +# javax.management.monitor.CounterMonitor but not +# javax.management.monitor.foo.Bar. +# +# A given role should have at most one entry in this file. If a role +# has no entry, it has no access. +# If multiple entries are found for the same role name, then the last +# access entry is used. +# +# +# Default access control entries: +# o The "monitorRole" role has readonly access. +# o The "controlRole" role has readwrite access and can create the standard +# Timer and Monitor MBeans defined by the JMX API. + +monitorRole readonly +controlRole readwrite \ + create javax.management.monitor.*,javax.management.timer.* \ + unregister diff --git a/java-11-openjdk/management/management.properties b/java-11-openjdk/management/management.properties new file mode 100644 index 0000000..1f8d86e --- /dev/null +++ b/java-11-openjdk/management/management.properties @@ -0,0 +1,381 @@ +##################################################################### +# Default Configuration File for Java Platform Management +##################################################################### +# +# The Management Configuration file (in java.util.Properties format) +# will be read if one of the following system properties is set: +# -Dcom.sun.management.jmxremote.port= +# or -Dcom.sun.management.snmp.port= +# or -Dcom.sun.management.config.file= +# +# The default Management Configuration file is: +# +# $JRE/conf/management/management.properties +# +# Another location for the Management Configuration File can be specified +# by the following property on the Java command line: +# +# -Dcom.sun.management.config.file= +# +# If -Dcom.sun.management.config.file= is set, the port +# number for the management agent can be specified in the config file +# using the following lines: +# +# ################ Management Agent Port ######################### +# +# For setting the JMX RMI agent port use the following line +# com.sun.management.jmxremote.port= +# +# For setting the SNMP agent port use the following line +# com.sun.management.snmp.port= + +##################################################################### +# Optional Instrumentation +##################################################################### +# +# By default only the basic instrumentation with low overhead is on. +# The following properties allow to selectively turn on optional +# instrumentation which are off by default and may have some +# additional overhead. +# +# com.sun.management.enableThreadContentionMonitoring +# +# This option enables thread contention monitoring if the +# Java virtual machine supports such instrumentation. +# Refer to the specification for the java.lang.management.ThreadMBean +# interface - see isThreadContentionMonitoringSupported() method. +# + +# To enable thread contention monitoring, uncomment the following line +# com.sun.management.enableThreadContentionMonitoring + +##################################################################### +# SNMP Management Properties +##################################################################### +# +# If the system property -Dcom.sun.management.snmp.port= +# is set then +# - The SNMP agent (with the Java virtual machine MIB) is started +# that listens on the specified port for incoming SNMP requests. +# - the following properties for read for SNMP management. +# +# The configuration can be specified only at startup time. +# Later changes to the above system property (e.g. via setProperty method), this +# config file, or the ACL file has no effect to the running SNMP agent. +# + +# +# ##################### SNMP Trap Port ######################### +# +# com.sun.management.snmp.trap= +# Specifies the remote port number at which managers are expected +# to listen for trap. For each host defined in the ACL file, +# the SNMP agent will send traps at : +# Default for this property is 162. +# + +# To set port for sending traps to a different port use the following line +# com.sun.management.snmp.trap= + +# +# ################ SNMP listen interface ######################### +# +# com.sun.management.snmp.interface= +# Specifies the local interface on which the SNMP agent will bind. +# This is useful when running on machines which have several +# interfaces defined. It makes it possible to listen to a specific +# subnet accessible through that interface. +# Default for this property is "localhost". +# +# The format of the value for that property is any string accepted +# by java.net.InetAddress.getByName(String). +# + +# For restricting the port on which SNMP agent listens use the following line +# com.sun.management.snmp.interface= + +# +# #################### SNMP ACL file ######################### +# +# com.sun.management.snmp.acl=true|false +# Default for this property is true. (Case for true/false ignored) +# If this property is specified as false then the ACL file +# is not checked: all manager hosts are allowed all access. +# + +# For SNMP without checking ACL file uncomment the following line +# com.sun.management.snmp.acl=false + +# +# com.sun.management.snmp.acl.file=filepath +# Specifies location for ACL file +# This is optional - default location is +# $JRE/conf/management/snmp.acl +# +# If the property "com.sun.management.snmp.acl" is set to false, +# then this property and the ACL file are ignored. +# Otherwise the ACL file must exist and be in the valid format. +# If the ACL file is empty or non existent then no access is allowed. +# +# The SNMP agent will read the ACL file at startup time. +# Modification to the ACL file has no effect to any running SNMP +# agents which read that ACL file at startup. +# + +# For a non-default acl file location use the following line +# com.sun.management.snmp.acl.file=filepath + +##################################################################### +# RMI Management Properties +##################################################################### +# +# If system property -Dcom.sun.management.jmxremote.port= +# is set then +# - A MBean server is started +# - JRE Platform MBeans are registered in the MBean server +# - RMI connector is published in a private readonly registry at +# specified port using a well known name, "jmxrmi" +# - the following properties are read for JMX remote management. +# +# The configuration can be specified only at startup time. +# Later changes to above system property (e.g. via setProperty method), +# this config file, the password file, or the access file have no effect to the +# running MBean server, the connector, or the registry. +# + +# +# ########## RMI connector settings for local management ########## +# +# com.sun.management.jmxremote.local.only=true|false +# Default for this property is true. (Case for true/false ignored) +# If this property is specified as true then the local JMX RMI connector +# server will only accept connection requests from clients running on +# the host where the out-of-the-box JMX management agent is running. +# In order to ensure backwards compatibility this property could be +# set to false. However, deploying the local management agent in this +# way is discouraged because the local JMX RMI connector server will +# accept connection requests from any client either local or remote. +# For remote management the remote JMX RMI connector server should +# be used instead with authentication and SSL/TLS encryption enabled. +# + +# For allowing the local management agent accept local +# and remote connection requests use the following line +# com.sun.management.jmxremote.local.only=false + +# +# ###################### RMI SSL ############################# +# +# com.sun.management.jmxremote.ssl=true|false +# Default for this property is true. (Case for true/false ignored) +# If this property is specified as false then SSL is not used. +# + +# For RMI monitoring without SSL use the following line +# com.sun.management.jmxremote.ssl=false + +# com.sun.management.jmxremote.ssl.config.file=filepath +# Specifies the location of the SSL configuration file. A properties +# file can be used to supply the keystore and truststore location and +# password settings thus avoiding to pass them as cleartext in the +# command-line. +# +# The current implementation of the out-of-the-box management agent will +# look up and use the properties specified below to configure the SSL +# keystore and truststore, if present: +# javax.net.ssl.keyStore= +# javax.net.ssl.keyStorePassword= +# javax.net.ssl.trustStore= +# javax.net.ssl.trustStorePassword= +# Any other properties in the file will be ignored. This will allow us +# to extend the property set in the future if required by the default +# SSL implementation. +# +# If the property "com.sun.management.jmxremote.ssl" is set to false, +# then this property is ignored. +# + +# For supplying the keystore settings in a file use the following line +# com.sun.management.jmxremote.ssl.config.file=filepath + +# com.sun.management.jmxremote.ssl.enabled.cipher.suites= +# The value of this property is a string that is a comma-separated list +# of SSL/TLS cipher suites to enable. This property can be specified in +# conjunction with the previous property "com.sun.management.jmxremote.ssl" +# in order to control which particular SSL/TLS cipher suites are enabled +# for use by accepted connections. If this property is not specified then +# the SSL/TLS RMI Server Socket Factory uses the SSL/TLS cipher suites that +# are enabled by default. +# + +# com.sun.management.jmxremote.ssl.enabled.protocols= +# The value of this property is a string that is a comma-separated list +# of SSL/TLS protocol versions to enable. This property can be specified in +# conjunction with the previous property "com.sun.management.jmxremote.ssl" +# in order to control which particular SSL/TLS protocol versions are +# enabled for use by accepted connections. If this property is not +# specified then the SSL/TLS RMI Server Socket Factory uses the SSL/TLS +# protocol versions that are enabled by default. +# + +# com.sun.management.jmxremote.ssl.need.client.auth=true|false +# Default for this property is false. (Case for true/false ignored) +# If this property is specified as true in conjunction with the previous +# property "com.sun.management.jmxremote.ssl" then the SSL/TLS RMI Server +# Socket Factory will require client authentication. +# + +# For RMI monitoring with SSL client authentication use the following line +# com.sun.management.jmxremote.ssl.need.client.auth=true + +# com.sun.management.jmxremote.registry.ssl=true|false +# Default for this property is false. (Case for true/false ignored) +# If this property is specified as true then the RMI registry used +# to bind the RMIServer remote object is protected with SSL/TLS +# RMI Socket Factories that can be configured with the properties: +# com.sun.management.jmxremote.ssl.config.file +# com.sun.management.jmxremote.ssl.enabled.cipher.suites +# com.sun.management.jmxremote.ssl.enabled.protocols +# com.sun.management.jmxremote.ssl.need.client.auth +# If the two properties below are true at the same time, i.e. +# com.sun.management.jmxremote.ssl=true +# com.sun.management.jmxremote.registry.ssl=true +# then the RMIServer remote object and the RMI registry are +# both exported with the same SSL/TLS RMI Socket Factories. +# + +# For using an SSL/TLS protected RMI registry use the following line +# com.sun.management.jmxremote.registry.ssl=true + +# +# ################ RMI User authentication ################ +# +# com.sun.management.jmxremote.authenticate=true|false +# Default for this property is true. (Case for true/false ignored) +# If this property is specified as false then no authentication is +# performed and all users are allowed all access. +# + +# For RMI monitoring without any checking use the following line +# com.sun.management.jmxremote.authenticate=false + +# +# ################ RMI Login configuration ################### +# +# com.sun.management.jmxremote.login.config= +# Specifies the name of a JAAS login configuration entry to use when +# authenticating users of RMI monitoring. +# +# Setting this property is optional - the default login configuration +# specifies a file-based authentication that uses the password file. +# +# When using this property to override the default login configuration +# then the named configuration entry must be in a file that gets loaded +# by JAAS. In addition, the login module(s) specified in the configuration +# should use the name and/or password callbacks to acquire the user's +# credentials. See the NameCallback and PasswordCallback classes in the +# javax.security.auth.callback package for more details. +# +# If the property "com.sun.management.jmxremote.authenticate" is set to +# false, then this property and the password & access files are ignored. +# + +# For a non-default login configuration use the following line +# com.sun.management.jmxremote.login.config= + +# +# ################ RMI Password file location ################## +# +# com.sun.management.jmxremote.password.file=filepath +# Specifies location for password file +# This is optional - default location is +# $JRE/conf/management/jmxremote.password +# +# If the property "com.sun.management.jmxremote.authenticate" is set to +# false, then this property and the password & access files are ignored. +# Otherwise the password file must exist and be in the valid format. +# If the password file is empty or non-existent then no access is allowed. +# + +# For a non-default password file location use the following line +# com.sun.management.jmxremote.password.file=filepath + +# +# ################# Hash passwords in password file ############## +# com.sun.management.jmxremote.password.toHashes = true|false +# Default for this property is true. +# Specifies if passwords in the password file should be hashed or not. +# If this property is true, and if the password file is writable, and if the +# system security policy allows writing into the password file, +# all the clear passwords in the password file will be replaced by +# their SHA3-512 hash when the file is read by the server +# + +# +# ################ RMI Access file location ##################### +# +# com.sun.management.jmxremote.access.file=filepath +# Specifies location for access file +# This is optional - default location is +# $JRE/conf/management/jmxremote.access +# +# If the property "com.sun.management.jmxremote.authenticate" is set to +# false, then this property and the password & access files are ignored. +# Otherwise, the access file must exist and be in the valid format. +# If the access file is empty or non-existent then no access is allowed. +# + +# For a non-default password file location use the following line +# com.sun.management.jmxremote.access.file=filepath +# + +# ################ Management agent listen interface ######################### +# +# com.sun.management.jmxremote.host= +# Specifies the local interface on which the JMX RMI agent will bind. +# This is useful when running on machines which have several +# interfaces defined. It makes it possible to listen to a specific +# subnet accessible through that interface. +# +# The format of the value for that property is any string accepted +# by java.net.InetAddress.getByName(String). +# + +# ################ Filter for ObjectInputStream ############################# +# com.sun.management.jmxremote.serial.filter.pattern= +# A filter, if configured, is used by java.io.ObjectInputStream during +# deserialization of parameters sent to the JMX default agent to validate the +# contents of the stream. +# A filter is configured as a sequence of patterns, each pattern is either +# matched against the name of a class in the stream or defines a limit. +# Patterns are separated by ";" (semicolon). +# Whitespace is significant and is considered part of the pattern. +# +# If a pattern includes a "=", it sets a limit. +# If a limit appears more than once the last value is used. +# Limits are checked before classes regardless of the order in the sequence of patterns. +# If any of the limits are exceeded, the filter status is REJECTED. +# +# maxdepth=value - the maximum depth of a graph +# maxrefs=value - the maximum number of internal references +# maxbytes=value - the maximum number of bytes in the input stream +# maxarray=value - the maximum array length allowed +# +# Other patterns, from left to right, match the class or package name as +# returned from Class.getName. +# If the class is an array type, the class or package to be matched is the element type. +# Arrays of any number of dimensions are treated the same as the element type. +# For example, a pattern of "!example.Foo", rejects creation of any instance or +# array of example.Foo. +# +# If the pattern starts with "!", the status is REJECTED if the remaining pattern +# is matched; otherwise the status is ALLOWED if the pattern matches. +# If the pattern contains "/", the non-empty prefix up to the "/" is the module name; +# if the module name matches the module name of the class then +# the remaining pattern is matched with the class name. +# If there is no "/", the module name is not compared. +# If the pattern ends with ".**" it matches any class in the package and all subpackages. +# If the pattern ends with ".*" it matches any class in the package. +# If the pattern ends with "*", it matches any class with the pattern as a prefix. +# If the pattern is equal to the class name, it matches. +# Otherwise, the status is UNDECIDED. diff --git a/java-11-openjdk/net.properties b/java-11-openjdk/net.properties new file mode 100644 index 0000000..ac94b30 --- /dev/null +++ b/java-11-openjdk/net.properties @@ -0,0 +1,101 @@ +############################################################ +# Default Networking Configuration File +# +# This file may contain default values for the networking system properties. +# These values are only used when the system properties are not specified +# on the command line or set programmatically. +# For now, only the various proxy settings can be configured here. +############################################################ + +# Whether or not the DefaultProxySelector will default to System Proxy +# settings when they do exist. +# Set it to 'true' to enable this feature and check for platform +# specific proxy settings +# Note that the system properties that do explicitly set proxies +# (like http.proxyHost) do take precedence over the system settings +# even if java.net.useSystemProxies is set to true. + +java.net.useSystemProxies=false + +#------------------------------------------------------------------------ +# Proxy configuration for the various protocol handlers. +# DO NOT uncomment these lines if you have set java.net.useSystemProxies +# to true as the protocol specific properties will take precedence over +# system settings. +#------------------------------------------------------------------------ + +# HTTP Proxy settings. proxyHost is the name of the proxy server +# (e.g. proxy.mydomain.com), proxyPort is the port number to use (default +# value is 80) and nonProxyHosts is a '|' separated list of hostnames which +# should be accessed directly, ignoring the proxy server (default value is +# localhost & 127.0.0.1). +# +# http.proxyHost= +# http.proxyPort=80 +http.nonProxyHosts=localhost|127.*|[::1] +# +# HTTPS Proxy Settings. proxyHost is the name of the proxy server +# (e.g. proxy.mydomain.com), proxyPort is the port number to use (default +# value is 443). The HTTPS protocol handlers uses the http nonProxyHosts list. +# +# https.proxyHost= +# https.proxyPort=443 +# +# FTP Proxy settings. proxyHost is the name of the proxy server +# (e.g. proxy.mydomain.com), proxyPort is the port number to use (default +# value is 80) and nonProxyHosts is a '|' separated list of hostnames which +# should be accessed directly, ignoring the proxy server (default value is +# localhost & 127.0.0.1). +# +# ftp.proxyHost= +# ftp.proxyPort=80 +ftp.nonProxyHosts=localhost|127.*|[::1] +# +# Gopher Proxy settings. proxyHost is the name of the proxy server +# (e.g. proxy.mydomain.com), proxyPort is the port number to use (default +# value is 80) +# +# gopher.proxyHost= +# gopher.proxyPort=80 +# +# Socks proxy settings. socksProxyHost is the name of the proxy server +# (e.g. socks.domain.com), socksProxyPort is the port number to use +# (default value is 1080) +# +# socksProxyHost= +# socksProxyPort=1080 +# +# HTTP Keep Alive settings. remainingData is the maximum amount of data +# in kilobytes that will be cleaned off the underlying socket so that it +# can be reused (default value is 512K), queuedConnections is the maximum +# number of Keep Alive connections to be on the queue for clean up (default +# value is 10). +# http.KeepAlive.remainingData=512 +# http.KeepAlive.queuedConnections=10 + +# Authentication Scheme restrictions for HTTP and HTTPS. +# +# In some environments certain authentication schemes may be undesirable +# when proxying HTTP or HTTPS. For example, "Basic" results in effectively the +# cleartext transmission of the user's password over the physical network. +# This section describes the mechanism for disabling authentication schemes +# based on the scheme name. Disabled schemes will be treated as if they are not +# supported by the implementation. +# +# The 'jdk.http.auth.tunneling.disabledSchemes' property lists the authentication +# schemes that will be disabled when tunneling HTTPS over a proxy, HTTP CONNECT. +# The 'jdk.http.auth.proxying.disabledSchemes' property lists the authentication +# schemes that will be disabled when proxying HTTP. +# +# In both cases the property is a comma-separated list of, case-insensitive, +# authentication scheme names, as defined by their relevant RFCs. An +# implementation may, but is not required to, support common schemes whose names +# include: 'Basic', 'Digest', 'NTLM', 'Kerberos', 'Negotiate'. A scheme that +# is not known, or not supported, by the implementation is ignored. +# +# Note: This property is currently used by the JDK Reference implementation. It +# is not guaranteed to be examined and used by other implementations. +# +#jdk.http.auth.proxying.disabledSchemes= +jdk.http.auth.tunneling.disabledSchemes=Basic + diff --git a/java-11-openjdk/psfont.properties.ja b/java-11-openjdk/psfont.properties.ja new file mode 100644 index 0000000..d17cf40 --- /dev/null +++ b/java-11-openjdk/psfont.properties.ja @@ -0,0 +1,119 @@ +# +# +# Copyright (c) 1996, 2000, Oracle and/or its affiliates. All rights reserved. +# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. +# +# This code is free software; you can redistribute it and/or modify it +# under the terms of the GNU General Public License version 2 only, as +# published by the Free Software Foundation. Oracle designates this +# particular file as subject to the "Classpath" exception as provided +# by Oracle in the LICENSE file that accompanied this code. +# +# This code is distributed in the hope that it will be useful, but WITHOUT +# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or +# FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License +# version 2 for more details (a copy is included in the LICENSE file that +# accompanied this code). +# +# You should have received a copy of the GNU General Public License version +# 2 along with this work; if not, write to the Free Software Foundation, +# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. +# +# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA +# or visit www.oracle.com if you need additional information or have any +# questions. +# + +# +# Japanese PostScript printer property file +# +font.num=16 +# +serif=serif +timesroman=serif +sansserif=sansserif +helvetica=sansserif +monospaced=monospaced +courier=monospaced +dialog=sansserif +dialoginput=monospaced +# +serif.latin1.plain=Times-Roman +serif.latin1.italic=Times-Italic +serif.latin1.bolditalic=Times-BoldItalic +serif.latin1.bold=Times-Bold +# +sansserif.latin1.plain=Helvetica +sansserif.latin1.italic=Helvetica-Oblique +sansserif.latin1.bolditalic=Helvetica-BoldOblique +sansserif.latin1.bold=Helvetica-Bold +# +monospaced.latin1.plain=Courier +monospaced.latin1.italic=Courier-Oblique +monospaced.latin1.bolditalic=Courier-BoldOblique +monospaced.latin1.bold=Courier-Bold +# +serif.x11jis0208.plain=Ryumin-Light-H +serif.x11jis0208.italic=Ryumin-Light-H +serif.x11jis0208.bolditalic=Ryumin-Light-H +serif.x11jis0208.bold=Ryumin-Light-H +# +sansserif.x11jis0208.plain=GothicBBB-Medium-H +sansserif.x11jis0208.italic=GothicBBB-Medium-H +sansserif.x11jis0208.bolditalic=GothicBBB-Medium-H +sansserif.x11jis0208.bold=GothicBBB-Medium-H +# +monospaced.x11jis0208.plain=GothicBBB-Medium-H +monospaced.x11jis0208.italic=GothicBBB-Medium-H +monospaced.x11jis0208.bolditalic=GothicBBB-Medium-H +monospaced.x11jis0208.bold=GothicBBB-Medium-H +# +serif.x11jis0201.plain=Ryumin-Light.Hankaku +serif.x11jis0201.italic=Ryumin-Light.Hankaku +serif.x11jis0201.bolditalic=Ryumin-Light.Hankaku +serif.x11jis0201.bold=Ryumin-Light.Hankaku +# +sansserif.x11jis0201.plain=GothicBBB-Medium.Hankaku +sansserif.x11jis0201.italic=GothicBBB-Medium.Hankaku +sansserif.x11jis0201.bolditalic=GothicBBB-Medium.Hankaku +sansserif.x11jis0201.bold=GothicBBB-Medium.Hankaku +# +monospaced.x11jis0201.plain=GothicBBB-Medium.Hankaku +monospaced.x11jis0201.italic=GothicBBB-Medium.Hankaku +monospaced.x11jis0201.bolditalic=GothicBBB-Medium.Hankaku +monospaced.x11jis0201.bold=GothicBBB-Medium.Hankaku +# +Helvetica=0 +Helvetica-Bold=1 +Helvetica-Oblique=2 +Helvetica-BoldOblique=3 +Times-Roman=4 +Times-Bold=5 +Times-Italic=6 +Times-BoldItalic=7 +Courier=8 +Courier-Bold=9 +Courier-Oblique=10 +Courier-BoldOblique=11 +GothicBBB-Medium-H=12 +Ryumin-Light-H=13 +GothicBBB-Medium.Hankaku=14 +Ryumin-Light.Hankaku=15 +# +font.0=Helvetica ISOF +font.1=Helvetica-Bold ISOF +font.2=Helvetica-Oblique ISOF +font.3=Helvetica-BoldOblique ISOF +font.4=Times-Roman ISOF +font.5=Times-Bold ISOF +font.6=Times-Italic ISOF +font.7=Times-BoldItalic ISOF +font.8=Courier ISOF +font.9=Courier-Bold ISOF +font.10=Courier-Oblique ISOF +font.11=Courier-BoldOblique ISOF +font.12=GothicBBB-Medium-H findfont +font.13=Ryumin-Light-H findfont +font.14=GothicBBB-Medium.Hankaku findfont +font.15=Ryumin-Light.Hankaku findfont +# diff --git a/java-11-openjdk/psfontj2d.properties b/java-11-openjdk/psfontj2d.properties new file mode 100644 index 0000000..5eb2c4b --- /dev/null +++ b/java-11-openjdk/psfontj2d.properties @@ -0,0 +1,323 @@ +# +# +# Copyright (c) 1999, Oracle and/or its affiliates. All rights reserved. +# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. +# +# This code is free software; you can redistribute it and/or modify it +# under the terms of the GNU General Public License version 2 only, as +# published by the Free Software Foundation. Oracle designates this +# particular file as subject to the "Classpath" exception as provided +# by Oracle in the LICENSE file that accompanied this code. +# +# This code is distributed in the hope that it will be useful, but WITHOUT +# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or +# FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License +# version 2 for more details (a copy is included in the LICENSE file that +# accompanied this code). +# +# You should have received a copy of the GNU General Public License version +# 2 along with this work; if not, write to the Free Software Foundation, +# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. +# +# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA +# or visit www.oracle.com if you need additional information or have any +# questions. + +# +# PostScript printer property file for Java 2D printing. +# +# WARNING: This is an internal implementation file, not a public file. +# Any customisation or reliance on the existence of this file and its +# contents or syntax is discouraged and unsupported. +# It may be incompatibly changed or removed without any notice. +# +# +font.num=35 +# +# Legacy logical font family names and logical font aliases should all +# map to the primary logical font names. +# +serif=serif +times=serif +timesroman=serif +sansserif=sansserif +helvetica=sansserif +dialog=sansserif +dialoginput=monospaced +monospaced=monospaced +courier=monospaced +# +# Next, physical fonts which can be safely mapped to standard postscript fonts +# These keys generally map to a value which is the same as the key, so +# the key/value is just a way to say the font has a mapping. +# Sometimes however we map more than one screen font to the same PS font. +# +avantgarde=avantgarde_book +avantgarde_book=avantgarde_book +avantgarde_demi=avantgarde_demi +avantgarde_book_oblique=avantgarde_book_oblique +avantgarde_demi_oblique=avantgarde_demi_oblique +# +itcavantgarde=avantgarde_book +itcavantgarde=avantgarde_book +itcavantgarde_demi=avantgarde_demi +itcavantgarde_oblique=avantgarde_book_oblique +itcavantgarde_demi_oblique=avantgarde_demi_oblique +# +bookman=bookman_light +bookman_light=bookman_light +bookman_demi=bookman_demi +bookman_light_italic=bookman_light_italic +bookman_demi_italic=bookman_demi_italic +# +# Exclude "helvetica" on its own as that's a legacy name for a logical font +helvetica_bold=helvetica_bold +helvetica_oblique=helvetica_oblique +helvetica_bold_oblique=helvetica_bold_oblique +# +itcbookman_light=bookman_light +itcbookman_demi=bookman_demi +itcbookman_light_italic=bookman_light_italic +itcbookman_demi_italic=bookman_demi_italic +# +# Exclude "courier" on its own as that's a legacy name for a logical font +courier_bold=courier_bold +courier_oblique=courier_oblique +courier_bold_oblique=courier_bold_oblique +# +courier_new=courier +courier_new_bold=courier_bold +# +monotype_century_schoolbook=newcenturyschoolbook +monotype_century_schoolbook_bold=newcenturyschoolbook_bold +monotype_century_schoolbook_italic=newcenturyschoolbook_italic +monotype_century_schoolbook_bold_italic=newcenturyschoolbook_bold_italic +# +newcenturyschoolbook=newcenturyschoolbook +newcenturyschoolbook_bold=newcenturyschoolbook_bold +newcenturyschoolbook_italic=newcenturyschoolbook_italic +newcenturyschoolbook_bold_italic=newcenturyschoolbook_bold_italic +# +palatino=palatino +palatino_bold=palatino_bold +palatino_italic=palatino_italic +palatino_bold_italic=palatino_bold_italic +# +# Exclude "times" on its own as that's a legacy name for a logical font +times_bold=times_roman_bold +times_italic=times_roman_italic +times_bold_italic=times_roman_bold_italic +# +times_roman=times_roman +times_roman_bold=times_roman_bold +times_roman_italic=times_roman_italic +times_roman_bold_italic=times_roman_bold_italic +# +times_new_roman=times_roman +times_new_roman_bold=times_roman_bold +times_new_roman_italic=times_roman_italic +times_new_roman_bold_italic=times_roman_bold_italic +# +zapfchancery_italic=zapfchancery_italic +itczapfchancery_italic=zapfchancery_italic +# +# Next the mapping of the font name + charset + style to Postscript font name +# for the logical fonts. +# +serif.latin1.plain=Times-Roman +serif.latin1.bold=Times-Bold +serif.latin1.italic=Times-Italic +serif.latin1.bolditalic=Times-BoldItalic +serif.symbol.plain=Symbol +serif.dingbats.plain=ZapfDingbats +serif.symbol.bold=Symbol +serif.dingbats.bold=ZapfDingbats +serif.symbol.italic=Symbol +serif.dingbats.italic=ZapfDingbats +serif.symbol.bolditalic=Symbol +serif.dingbats.bolditalic=ZapfDingbats +# +sansserif.latin1.plain=Helvetica +sansserif.latin1.bold=Helvetica-Bold +sansserif.latin1.italic=Helvetica-Oblique +sansserif.latin1.bolditalic=Helvetica-BoldOblique +sansserif.symbol.plain=Symbol +sansserif.dingbats.plain=ZapfDingbats +sansserif.symbol.bold=Symbol +sansserif.dingbats.bold=ZapfDingbats +sansserif.symbol.italic=Symbol +sansserif.dingbats.italic=ZapfDingbats +sansserif.symbol.bolditalic=Symbol +sansserif.dingbats.bolditalic=ZapfDingbats +# +monospaced.latin1.plain=Courier +monospaced.latin1.bold=Courier-Bold +monospaced.latin1.italic=Courier-Oblique +monospaced.latin1.bolditalic=Courier-BoldOblique +monospaced.symbol.plain=Symbol +monospaced.dingbats.plain=ZapfDingbats +monospaced.symbol.bold=Symbol +monospaced.dingbats.bold=ZapfDingbats +monospaced.symbol.italic=Symbol +monospaced.dingbats.italic=ZapfDingbats +monospaced.symbol.bolditalic=Symbol +monospaced.dingbats.bolditalic=ZapfDingbats +# +# Next the mapping of the font name + charset + style to Postscript font name +# for the physical fonts. Since these always report style as plain, the +# style key is always plain. So we map using the face name to the correct +# style for the postscript font. This is possible since the face names can +# be replied upon to be different for each style. +# However an application may try to create a Font applying a style to an +# physical name. We want to map to the correct Postscript font there too +# if possible but we do not map cases where the application tries to +# augment a style (eg ask for a bold version of a bold font) +# Defer to the 2D package to attempt create an artificially styled version +# +avantgarde_book.latin1.plain=AvantGarde-Book +avantgarde_demi.latin1.plain=AvantGarde-Demi +avantgarde_book_oblique.latin1.plain=AvantGarde-BookOblique +avantgarde_demi_oblique.latin1.plain=AvantGarde-DemiOblique +# +avantgarde_book.latin1.bold=AvantGarde-Demi +avantgarde_book.latin1.italic=AvantGarde-BookOblique +avantgarde_book.latin1.bolditalic=AvantGarde-DemiOblique +avantgarde_demi.latin1.italic=AvantGarde-DemiOblique +avantgarde_book_oblique.latin1.bold=AvantGarde-DemiOblique +# +bookman_light.latin1.plain=Bookman-Light +bookman_demi.latin1.plain=Bookman-Demi +bookman_light_italic.latin1.plain=Bookman-LightItalic +bookman_demi_italic.latin1.plain=Bookman-DemiItalic +# +bookman_light.latin1.bold=Bookman-Demi +bookman_light.latin1.italic=Bookman-LightItalic +bookman_light.latin1.bolditalic=Bookman-DemiItalic +bookman_light_bold.latin1.italic=Bookman-DemiItalic +bookman_light_italic.latin1.bold=Bookman-DemiItalic +# +courier.latin1.plain=Courier +courier_bold.latin1.plain=Courier-Bold +courier_oblique.latin1.plain=Courier-Oblique +courier_bold_oblique.latin1.plain=Courier-BoldOblique +courier.latin1.bold=Courier-Bold +courier.latin1.italic=Courier-Oblique +courier.latin1.bolditalic=Courier-BoldOblique +courier_bold.latin1.italic=Courier-BoldOblique +courier_italic.latin1.bold=Courier-BoldOblique +# +helvetica_bold.latin1.plain=Helvetica-Bold +helvetica_oblique.latin1.plain=Helvetica-Oblique +helvetica_bold_oblique.latin1.plain=Helvetica-BoldOblique +helvetica.latin1.bold=Helvetica-Bold +helvetica.latin1.italic=Helvetica-Oblique +helvetica.latin1.bolditalic=Helvetica-BoldOblique +helvetica_bold.latin1.italic=Helvetica-BoldOblique +helvetica_italic.latin1.bold=Helvetica-BoldOblique +# +newcenturyschoolbook.latin1.plain=NewCenturySchlbk-Roman +newcenturyschoolbook_bold.latin1.plain=NewCenturySchlbk-Bold +newcenturyschoolbook_italic.latin1.plain=NewCenturySchlbk-Italic +newcenturyschoolbook_bold_italic.latin1.plain=NewCenturySchlbk-BoldItalic +newcenturyschoolbook.latin1.bold=NewCenturySchlbk-Bold +newcenturyschoolbook.latin1.italic=NewCenturySchlbk-Italic +newcenturyschoolbook.latin1.bolditalic=NewCenturySchlbk-BoldItalic +newcenturyschoolbook_bold.latin1.italic=NewCenturySchlbk-BoldItalic +newcenturyschoolbook_italic.latin1.bold=NewCenturySchlbk-BoldItalic +# +palatino.latin1.plain=Palatino-Roman +palatino_bold.latin1.plain=Palatino-Bold +palatino_italic.latin1.plain=Palatino-Italic +palatino_bold_italic.latin1.plain=Palatino-BoldItalic +palatino.latin1.bold=Palatino-Bold +palatino.latin1.italic=Palatino-Italic +palatino.latin1.bolditalic=Palatino-BoldItalic +palatino_bold.latin1.italic=Palatino-BoldItalic +palatino_italic.latin1.bold=Palatino-BoldItalic +# +times_roman.latin1.plain=Times-Roman +times_roman_bold.latin1.plain=Times-Bold +times_roman_italic.latin1.plain=Times-Italic +times_roman_bold_italic.latin1.plain=Times-BoldItalic +times_roman.latin1.bold=Times-Bold +times_roman.latin1.italic=Times-Italic +times_roman.latin1.bolditalic=Times-BoldItalic +times_roman_bold.latin1.italic=Times-BoldItalic +times_roman_italic.latin1.bold=Times-BoldItalic +# +zapfchancery_italic.latin1.plain=ZapfChancery-MediumItalic +# +# Finally the mappings of PS font names to indexes. +# +AvantGarde-Book=0 +AvantGarde-BookOblique=1 +AvantGarde-Demi=2 +AvantGarde-DemiOblique=3 +Bookman-Demi=4 +Bookman-DemiItalic=5 +Bookman-Light=6 +Bookman-LightItalic=7 +Courier=8 +Courier-Bold=9 +Courier-BoldOblique=10 +Courier-Oblique=11 +Helvetica=12 +Helvetica-Bold=13 +Helvetica-BoldOblique=14 +Helvetica-Narrow=15 +Helvetica-Narrow-Bold=16 +Helvetica-Narrow-BoldOblique=17 +Helvetica-Narrow-Oblique=18 +Helvetica-Oblique=19 +NewCenturySchlbk-Bold=20 +NewCenturySchlbk-BoldItalic=21 +NewCenturySchlbk-Italic=22 +NewCenturySchlbk-Roman=23 +Palatino-Bold=24 +Palatino-BoldItalic=25 +Palatino-Italic=26 +Palatino-Roman=27 +Symbol=28 +Times-Bold=29 +Times-BoldItalic=30 +Times-Italic=31 +Times-Roman=32 +ZapfDingbats=33 +ZapfChancery-MediumItalic=34 +# +font.0=AvantGarde-Book ISOF +font.1=AvantGarde-BookOblique ISOF +font.2=AvantGarde-Demi ISOF +font.3=AvantGarde-DemiOblique ISOF +font.4=Bookman-Demi ISOF +font.5=Bookman-DemiItalic ISOF +font.6=Bookman-Light ISOF +font.7=Bookman-LightItalic ISOF +font.8=Courier ISOF +font.9=Courier-Bold ISOF +font.10=Courier-BoldOblique ISOF +font.11=Courier-Oblique ISOF +font.12=Helvetica ISOF +font.13=Helvetica-Bold ISOF +font.14=Helvetica-BoldOblique ISOF +font.15=Helvetica-Narrow ISOF +font.16=Helvetica-Narrow-Bold ISOF +font.17=Helvetica-Narrow-BoldOblique ISOF +font.18=Helvetica-Narrow-Oblique ISOF +font.19=Helvetica-Oblique ISOF +font.20=NewCenturySchlbk-Bold ISOF +font.21=NewCenturySchlbk-BoldItalic ISOF +font.22=NewCenturySchlbk-Italic ISOF +font.23=NewCenturySchlbk-Roman ISOF +font.24=Palatino-Bold ISOF +font.25=Palatino-BoldItalic ISOF +font.26=Palatino-Italic ISOF +font.27=Palatino-Roman ISOF +font.28=Symbol findfont +font.29=Times-Bold ISOF +font.30=Times-BoldItalic ISOF +font.31=Times-Italic ISOF +font.32=Times-Roman ISOF +font.33=ZapfDingbats findfont +font.34=ZapfChancery-MediumItalic ISOF +# diff --git a/java-11-openjdk/security/blacklisted.certs b/java-11-openjdk/security/blacklisted.certs new file mode 100644 index 0000000..e192c1a --- /dev/null +++ b/java-11-openjdk/security/blacklisted.certs @@ -0,0 +1,20 @@ +Algorithm=SHA-256 +14E6D2764A4B06701C6CBC376A253775F79C782FBCB6C0EE6F99DE4BA1024ADD +31C8FD37DB9B56E708B03D1F01848B068C6DA66F36FB5D82C008C6040FA3E133 +3946901F46B0071E90D78279E82FABABCA177231A704BE72C5B0E8918566EA66 +450F1B421BB05C8609854884559C323319619E8B06B001EA2DCBB74A23AA3BE2 +4CBBF8256BC9888A8007B2F386940A2E394378B0D903CBB3863C5A6394B889CE +4FEE0163686ECBD65DB968E7494F55D84B25486D438E9DE558D629D28CD4D176 +5E83124D68D24E8E177E306DF643D5EA99C5A94D6FC34B072F7544A1CABB7C7B +76A45A496031E4DD2D7ED23E8F6FF97DBDEA980BAAC8B0BA94D7EDB551348645 +8A1BD21661C60015065212CC98B1ABB50DFD14C872A208E66BAE890F25C448AF +9ED8F9B0E8E42A1656B8E1DD18F42BA42DC06FE52686173BA2FC70E756F207DC +A686FEE577C88AB664D0787ECDFFF035F4806F3DE418DC9E4D516324FFF02083 +B8686723E415534BC0DBD16326F9486F85B0B0799BF6639334E61DAAE67F36CD +D24566BF315F4E597D6E381C87119FB4198F5E9E2607F5F4AB362EF7E2E7672F +D3A936E1A7775A45217C8296A1F22AC5631DCDEC45594099E78EEEBBEDCBA967 +DF21016B00FC54F9FE3BC8B039911BB216E9162FAD2FD14D990AB96E951B49BE +EC30C9C3065A06BB07DC5B1C6B497F370C1CA65C0F30C08E042BA6BCECC78F2C +F5B6F88F75D391A4B1EB336F9E201239FB6B1377DB8CFA7B84736216E5AFFFD7 +FC02FD48DB92D4DCE6F11679D38354CF750CFC7F584A520EB90BDE80E241F2BD +FDEDB5BDFCB67411513A61AEE5CB5B5D7C52AF06028EFC996CC1B05B1D6CEA2B diff --git a/java-11-openjdk/security/default.policy b/java-11-openjdk/security/default.policy new file mode 100644 index 0000000..6495d08 --- /dev/null +++ b/java-11-openjdk/security/default.policy @@ -0,0 +1,206 @@ +// +// Permissions required by modules stored in a run-time image and loaded +// by the platform class loader. +// +// NOTE that this file is not intended to be modified. If additional +// permissions need to be granted to the modules in this file, it is +// recommended that they be configured in a separate policy file or +// ${java.home}/conf/security/java.policy. +// + +grant codeBase "jrt:/java.activation" { + permission java.security.AllPermission; +}; + +grant codeBase "jrt:/java.compiler" { + permission java.security.AllPermission; +}; + +grant codeBase "jrt:/java.corba" { + permission java.security.AllPermission; +}; + +grant codeBase "jrt:/java.scripting" { + permission java.security.AllPermission; +}; + +grant codeBase "jrt:/java.security.jgss" { + permission java.security.AllPermission; +}; + +grant codeBase "jrt:/java.smartcardio" { + permission javax.smartcardio.CardPermission "*", "*"; + permission java.lang.RuntimePermission "loadLibrary.j2pcsc"; + permission java.lang.RuntimePermission + "accessClassInPackage.sun.security.jca"; + permission java.lang.RuntimePermission + "accessClassInPackage.sun.security.util"; + permission java.util.PropertyPermission + "javax.smartcardio.TerminalFactory.DefaultType", "read"; + permission java.util.PropertyPermission "os.name", "read"; + permission java.util.PropertyPermission "os.arch", "read"; + permission java.util.PropertyPermission "sun.arch.data.model", "read"; + permission java.util.PropertyPermission + "sun.security.smartcardio.library", "read"; + permission java.util.PropertyPermission + "sun.security.smartcardio.t0GetResponse", "read"; + permission java.util.PropertyPermission + "sun.security.smartcardio.t1GetResponse", "read"; + permission java.util.PropertyPermission + "sun.security.smartcardio.t1StripLe", "read"; + // needed for looking up native PC/SC library + permission java.io.FilePermission "<>","read"; + permission java.security.SecurityPermission "putProviderProperty.SunPCSC"; + permission java.security.SecurityPermission + "clearProviderProperties.SunPCSC"; + permission java.security.SecurityPermission + "removeProviderProperty.SunPCSC"; +}; + +grant codeBase "jrt:/java.sql" { + permission java.security.AllPermission; +}; + +grant codeBase "jrt:/java.sql.rowset" { + permission java.security.AllPermission; +}; + +grant codeBase "jrt:/java.xml.bind" { + permission java.security.AllPermission; +}; + +grant codeBase "jrt:/java.xml.crypto" { + permission java.lang.RuntimePermission + "accessClassInPackage.sun.security.util"; + permission java.util.PropertyPermission "*", "read"; + permission java.security.SecurityPermission "putProviderProperty.XMLDSig"; + permission java.security.SecurityPermission + "clearProviderProperties.XMLDSig"; + permission java.security.SecurityPermission + "removeProviderProperty.XMLDSig"; + permission java.security.SecurityPermission + "com.sun.org.apache.xml.internal.security.register"; + permission java.security.SecurityPermission + "getProperty.jdk.xml.dsig.secureValidationPolicy"; + permission java.lang.RuntimePermission + "accessClassInPackage.com.sun.org.apache.xml.internal.*"; + permission java.lang.RuntimePermission + "accessClassInPackage.com.sun.org.apache.xpath.internal"; + permission java.lang.RuntimePermission + "accessClassInPackage.com.sun.org.apache.xpath.internal.*"; +}; + +grant codeBase "jrt:/java.xml.ws" { + permission java.security.AllPermission; +}; + +grant codeBase "jrt:/jdk.accessibility" { + permission java.lang.RuntimePermission "accessClassInPackage.sun.awt"; +}; + +grant codeBase "jrt:/jdk.charsets" { + permission java.util.PropertyPermission "os.name", "read"; + permission java.util.PropertyPermission "sun.nio.cs.map", "read"; + permission java.lang.RuntimePermission "charsetProvider"; + permission java.lang.RuntimePermission + "accessClassInPackage.jdk.internal.misc"; + permission java.lang.RuntimePermission "accessClassInPackage.sun.nio.cs"; +}; + +grant codeBase "jrt:/jdk.crypto.ec" { + permission java.lang.RuntimePermission + "accessClassInPackage.sun.security.*"; + permission java.lang.RuntimePermission "loadLibrary.sunec"; + permission java.security.SecurityPermission "putProviderProperty.SunEC"; + permission java.security.SecurityPermission "clearProviderProperties.SunEC"; + permission java.security.SecurityPermission "removeProviderProperty.SunEC"; +}; + +grant codeBase "jrt:/jdk.crypto.cryptoki" { + permission java.lang.RuntimePermission + "accessClassInPackage.sun.security.*"; + permission java.lang.RuntimePermission "accessClassInPackage.sun.nio.ch"; + permission java.lang.RuntimePermission "loadLibrary.j2pkcs11"; + permission java.util.PropertyPermission "sun.security.pkcs11.allowSingleThreadedModules", "read"; + permission java.util.PropertyPermission "os.name", "read"; + permission java.util.PropertyPermission "os.arch", "read"; + permission java.util.PropertyPermission "jdk.crypto.KeyAgreement.legacyKDF", "read"; + permission java.security.SecurityPermission "putProviderProperty.*"; + permission java.security.SecurityPermission "clearProviderProperties.*"; + permission java.security.SecurityPermission "removeProviderProperty.*"; + permission java.security.SecurityPermission + "getProperty.auth.login.defaultCallbackHandler"; + permission java.security.SecurityPermission "authProvider.*"; + // Needed for reading PKCS11 config file and NSS library check + permission java.io.FilePermission "<>", "read"; +}; + +grant codeBase "jrt:/jdk.desktop" { + permission java.lang.RuntimePermission "accessClassInPackage.com.sun.awt"; +}; + +grant codeBase "jrt:/jdk.dynalink" { + permission java.security.AllPermission; +}; + +grant codeBase "jrt:/jdk.httpserver" { + permission java.security.AllPermission; +}; + +grant codeBase "jrt:/jdk.internal.le" { + permission java.security.AllPermission; +}; + +grant codeBase "jrt:/jdk.internal.vm.compiler" { + permission java.security.AllPermission; +}; + +grant codeBase "jrt:/jdk.internal.vm.compiler.management" { + permission java.lang.RuntimePermission "accessClassInPackage.org.graalvm.compiler.hotspot"; + permission java.lang.RuntimePermission "accessClassInPackage.jdk.vm.ci.runtime"; + permission java.lang.RuntimePermission "accessClassInPackage.sun.management.spi"; + permission java.lang.RuntimePermission "sun.management.spi.PlatformMBeanProvider.subclass"; +}; + +grant codeBase "jrt:/jdk.jsobject" { + permission java.security.AllPermission; +}; + +grant codeBase "jrt:/jdk.localedata" { + permission java.lang.RuntimePermission "accessClassInPackage.sun.text.*"; + permission java.lang.RuntimePermission "accessClassInPackage.sun.util.*"; +}; + +grant codeBase "jrt:/jdk.naming.dns" { + permission java.security.AllPermission; +}; + +grant codeBase "jrt:/jdk.scripting.nashorn" { + permission java.security.AllPermission; +}; + +grant codeBase "jrt:/jdk.scripting.nashorn.shell" { + permission java.security.AllPermission; +}; + +grant codeBase "jrt:/jdk.security.auth" { + permission java.security.AllPermission; +}; + +grant codeBase "jrt:/jdk.security.jgss" { + permission java.security.AllPermission; +}; + +grant codeBase "jrt:/jdk.zipfs" { + permission java.io.FilePermission "<>", "read,write,delete"; + permission java.lang.RuntimePermission "fileSystemProvider"; + permission java.util.PropertyPermission "os.name", "read"; +}; + +// permissions needed by applications using java.desktop module +grant { + permission java.lang.RuntimePermission "accessClassInPackage.com.sun.beans"; + permission java.lang.RuntimePermission "accessClassInPackage.com.sun.beans.*"; + permission java.lang.RuntimePermission "accessClassInPackage.com.sun.java.swing.plaf.*"; + permission java.lang.RuntimePermission "accessClassInPackage.com.apple.*"; +}; diff --git a/java-11-openjdk/security/java.policy b/java-11-openjdk/security/java.policy new file mode 100644 index 0000000..1554541 --- /dev/null +++ b/java-11-openjdk/security/java.policy @@ -0,0 +1,44 @@ +// +// This system policy file grants a set of default permissions to all domains +// and can be configured to grant additional permissions to modules and other +// code sources. The code source URL scheme for modules linked into a +// run-time image is "jrt". +// +// For example, to grant permission to read the "foo" property to the module +// "com.greetings", the grant entry is: +// +// grant codeBase "jrt:/com.greetings" { +// permission java.util.PropertyPermission "foo", "read"; +// }; +// + +// default permissions granted to all domains +grant { + // allows anyone to listen on dynamic ports + permission java.net.SocketPermission "localhost:0", "listen"; + + // "standard" properies that can be read by anyone + permission java.util.PropertyPermission "java.version", "read"; + permission java.util.PropertyPermission "java.vendor", "read"; + permission java.util.PropertyPermission "java.vendor.url", "read"; + permission java.util.PropertyPermission "java.class.version", "read"; + permission java.util.PropertyPermission "os.name", "read"; + permission java.util.PropertyPermission "os.version", "read"; + permission java.util.PropertyPermission "os.arch", "read"; + permission java.util.PropertyPermission "file.separator", "read"; + permission java.util.PropertyPermission "path.separator", "read"; + permission java.util.PropertyPermission "line.separator", "read"; + permission java.util.PropertyPermission + "java.specification.version", "read"; + permission java.util.PropertyPermission "java.specification.vendor", "read"; + permission java.util.PropertyPermission "java.specification.name", "read"; + permission java.util.PropertyPermission + "java.vm.specification.version", "read"; + permission java.util.PropertyPermission + "java.vm.specification.vendor", "read"; + permission java.util.PropertyPermission + "java.vm.specification.name", "read"; + permission java.util.PropertyPermission "java.vm.version", "read"; + permission java.util.PropertyPermission "java.vm.vendor", "read"; + permission java.util.PropertyPermission "java.vm.name", "read"; +}; diff --git a/java-11-openjdk/security/java.security b/java-11-openjdk/security/java.security new file mode 100644 index 0000000..5a857b9 --- /dev/null +++ b/java-11-openjdk/security/java.security @@ -0,0 +1,1005 @@ +# +# This is the "master security properties file". +# +# An alternate java.security properties file may be specified +# from the command line via the system property +# +# -Djava.security.properties= +# +# This properties file appends to the master security properties file. +# If both properties files specify values for the same key, the value +# from the command-line properties file is selected, as it is the last +# one loaded. +# +# Also, if you specify +# +# -Djava.security.properties== (2 equals), +# +# then that properties file completely overrides the master security +# properties file. +# +# To disable the ability to specify an additional properties file from +# the command line, set the key security.overridePropertiesFile +# to false in the master security properties file. It is set to true +# by default. + +# In this file, various security properties are set for use by +# java.security classes. This is where users can statically register +# Cryptography Package Providers ("providers" for short). The term +# "provider" refers to a package or set of packages that supply a +# concrete implementation of a subset of the cryptography aspects of +# the Java Security API. A provider may, for example, implement one or +# more digital signature algorithms or message digest algorithms. +# +# Each provider must implement a subclass of the Provider class. +# To register a provider in this master security properties file, +# specify the provider and priority in the format +# +# security.provider.= +# +# This declares a provider, and specifies its preference +# order n. The preference order is the order in which providers are +# searched for requested algorithms (when no specific provider is +# requested). The order is 1-based; 1 is the most preferred, followed +# by 2, and so on. +# +# must specify the name of the Provider as passed to its super +# class java.security.Provider constructor. This is for providers loaded +# through the ServiceLoader mechanism. +# +# must specify the subclass of the Provider class whose +# constructor sets the values of various properties that are required +# for the Java Security API to look up the algorithms or other +# facilities implemented by the provider. This is for providers loaded +# through classpath. +# +# Note: Providers can be dynamically registered instead by calls to +# either the addProvider or insertProviderAt method in the Security +# class. + +# +# List of providers and their preference orders (see above): +# +security.provider.1=SUN +security.provider.2=SunRsaSign +security.provider.3=SunEC +security.provider.4=SunJSSE +security.provider.5=SunJCE +security.provider.6=SunJGSS +security.provider.7=SunSASL +security.provider.8=XMLDSig +security.provider.9=SunPCSC +security.provider.10=JdkLDAP +security.provider.11=JdkSASL +security.provider.12=SunPKCS11 + +# +# A list of preferred providers for specific algorithms. These providers will +# be searched for matching algorithms before the list of registered providers. +# Entries containing errors (parsing, etc) will be ignored. Use the +# -Djava.security.debug=jca property to debug these errors. +# +# The property is a comma-separated list of serviceType.algorithm:provider +# entries. The serviceType (example: "MessageDigest") is optional, and if +# not specified, the algorithm applies to all service types that support it. +# The algorithm is the standard algorithm name or transformation. +# Transformations can be specified in their full standard name +# (ex: AES/CBC/PKCS5Padding), or as partial matches (ex: AES, AES/CBC). +# The provider is the name of the provider. Any provider that does not +# also appear in the registered list will be ignored. +# +# There is a special serviceType for this property only to group a set of +# algorithms together. The type is "Group" and is followed by an algorithm +# keyword. Groups are to simplify and lessen the entries on the property +# line. Current groups are: +# Group.SHA2 = SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, SHA-512/256 +# Group.HmacSHA2 = HmacSHA224, HmacSHA256, HmacSHA384, HmacSHA512 +# Group.SHA2RSA = SHA224withRSA, SHA256withRSA, SHA384withRSA, SHA512withRSA +# Group.SHA2DSA = SHA224withDSA, SHA256withDSA, SHA384withDSA, SHA512withDSA +# Group.SHA2ECDSA = SHA224withECDSA, SHA256withECDSA, SHA384withECDSA, \ +# SHA512withECDSA +# Group.SHA3 = SHA3-224, SHA3-256, SHA3-384, SHA3-512 +# Group.HmacSHA3 = HmacSHA3-224, HmacSHA3-256, HmacSHA3-384, HmacSHA3-512 +# +# Example: +# jdk.security.provider.preferred=AES/GCM/NoPadding:SunJCE, \ +# MessageDigest.SHA-256:SUN, Group.HmacSHA2:SunJCE +# +#jdk.security.provider.preferred= + + +# +# Sun Provider SecureRandom seed source. +# +# Select the primary source of seed data for the "NativePRNG", "SHA1PRNG" +# and "DRBG" SecureRandom implementations in the "Sun" provider. +# (Other SecureRandom implementations might also use this property.) +# +# On Unix-like systems (for example, Solaris/Linux/MacOS), the +# "NativePRNG", "SHA1PRNG" and "DRBG" implementations obtains seed data from +# special device files such as file:/dev/random. +# +# On Windows systems, specifying the URLs "file:/dev/random" or +# "file:/dev/urandom" will enable the native Microsoft CryptoAPI seeding +# mechanism for SHA1PRNG and DRBG. +# +# By default, an attempt is made to use the entropy gathering device +# specified by the "securerandom.source" Security property. If an +# exception occurs while accessing the specified URL: +# +# NativePRNG: +# a default value of /dev/random will be used. If neither +# are available, the implementation will be disabled. +# "file" is the only currently supported protocol type. +# +# SHA1PRNG and DRBG: +# the traditional system/thread activity algorithm will be used. +# +# The entropy gathering device can also be specified with the System +# property "java.security.egd". For example: +# +# % java -Djava.security.egd=file:/dev/random MainClass +# +# Specifying this System property will override the +# "securerandom.source" Security property. +# +# In addition, if "file:/dev/random" or "file:/dev/urandom" is +# specified, the "NativePRNG" implementation will be more preferred than +# DRBG and SHA1PRNG in the Sun provider. +# +securerandom.source=file:/dev/random + +# +# A list of known strong SecureRandom implementations. +# +# To help guide applications in selecting a suitable strong +# java.security.SecureRandom implementation, Java distributions should +# indicate a list of known strong implementations using the property. +# +# This is a comma-separated list of algorithm and/or algorithm:provider +# entries. +# +securerandom.strongAlgorithms=NativePRNGBlocking:SUN,DRBG:SUN + +# +# Sun provider DRBG configuration and default instantiation request. +# +# NIST SP 800-90Ar1 lists several DRBG mechanisms. Each can be configured +# with a DRBG algorithm name, and can be instantiated with a security strength, +# prediction resistance support, etc. This property defines the configuration +# and the default instantiation request of "DRBG" SecureRandom implementations +# in the SUN provider. (Other DRBG implementations can also use this property.) +# Applications can request different instantiation parameters like security +# strength, capability, personalization string using one of the +# getInstance(...,SecureRandomParameters,...) methods with a +# DrbgParameters.Instantiation argument, but other settings such as the +# mechanism and DRBG algorithm names are not currently configurable by any API. +# +# Please note that the SUN implementation of DRBG always supports reseeding. +# +# The value of this property is a comma-separated list of all configurable +# aspects. The aspects can appear in any order but the same aspect can only +# appear at most once. Its BNF-style definition is: +# +# Value: +# aspect { "," aspect } +# +# aspect: +# mech_name | algorithm_name | strength | capability | df +# +# // The DRBG mechanism to use. Default "Hash_DRBG" +# mech_name: +# "Hash_DRBG" | "HMAC_DRBG" | "CTR_DRBG" +# +# // The DRBG algorithm name. The "SHA-***" names are for Hash_DRBG and +# // HMAC_DRBG, default "SHA-256". The "AES-***" names are for CTR_DRBG, +# // default "AES-128" when using the limited cryptographic or "AES-256" +# // when using the unlimited. +# algorithm_name: +# "SHA-224" | "SHA-512/224" | "SHA-256" | +# "SHA-512/256" | "SHA-384" | "SHA-512" | +# "AES-128" | "AES-192" | "AES-256" +# +# // Security strength requested. Default "128" +# strength: +# "112" | "128" | "192" | "256" +# +# // Prediction resistance and reseeding request. Default "none" +# // "pr_and_reseed" - Both prediction resistance and reseeding +# // support requested +# // "reseed_only" - Only reseeding support requested +# // "none" - Neither prediction resistance not reseeding +# // support requested +# pr: +# "pr_and_reseed" | "reseed_only" | "none" +# +# // Whether a derivation function should be used. only applicable +# // to CTR_DRBG. Default "use_df" +# df: +# "use_df" | "no_df" +# +# Examples, +# securerandom.drbg.config=Hash_DRBG,SHA-224,112,none +# securerandom.drbg.config=CTR_DRBG,AES-256,192,pr_and_reseed,use_df +# +# The default value is an empty string, which is equivalent to +# securerandom.drbg.config=Hash_DRBG,SHA-256,128,none +# +securerandom.drbg.config= + +# +# Class to instantiate as the javax.security.auth.login.Configuration +# provider. +# +login.configuration.provider=sun.security.provider.ConfigFile + +# +# Default login configuration file +# +#login.config.url.1=file:${user.home}/.java.login.config + +# +# Class to instantiate as the system Policy. This is the name of the class +# that will be used as the Policy object. The system class loader is used to +# locate this class. +# +policy.provider=sun.security.provider.PolicyFile + +# The default is to have a single system-wide policy file, +# and a policy file in the user's home directory. +# +policy.url.1=file:${java.home}/conf/security/java.policy +policy.url.2=file:${user.home}/.java.policy + +# whether or not we expand properties in the policy file +# if this is set to false, properties (${...}) will not be expanded in policy +# files. +# +policy.expandProperties=true + +# whether or not we allow an extra policy to be passed on the command line +# with -Djava.security.policy=somefile. Comment out this line to disable +# this feature. +# +policy.allowSystemProperty=true + +# whether or not we look into the IdentityScope for trusted Identities +# when encountering a 1.1 signed JAR file. If the identity is found +# and is trusted, we grant it AllPermission. Note: the default policy +# provider (sun.security.provider.PolicyFile) does not support this property. +# +policy.ignoreIdentityScope=false + +# +# Default keystore type. +# +keystore.type=pkcs12 + +# +# Controls compatibility mode for JKS and PKCS12 keystore types. +# +# When set to 'true', both JKS and PKCS12 keystore types support loading +# keystore files in either JKS or PKCS12 format. When set to 'false' the +# JKS keystore type supports loading only JKS keystore files and the PKCS12 +# keystore type supports loading only PKCS12 keystore files. +# +keystore.type.compat=true + +# +# List of comma-separated packages that start with or equal this string +# will cause a security exception to be thrown when passed to the +# SecurityManager::checkPackageAccess method unless the corresponding +# RuntimePermission("accessClassInPackage."+package) has been granted. +# +package.access=sun.misc.,\ + sun.reflect.,\ + org.GNOME.Accessibility. + +# +# List of comma-separated packages that start with or equal this string +# will cause a security exception to be thrown when passed to the +# SecurityManager::checkPackageDefinition method unless the corresponding +# RuntimePermission("defineClassInPackage."+package) has been granted. +# +# By default, none of the class loaders supplied with the JDK call +# checkPackageDefinition. +# +package.definition=sun.misc.,\ + sun.reflect. + +# +# Determines whether this properties file can be appended to +# or overridden on the command line via -Djava.security.properties +# +security.overridePropertiesFile=true + +# +# Determines the default key and trust manager factory algorithms for +# the javax.net.ssl package. +# +ssl.KeyManagerFactory.algorithm=SunX509 +ssl.TrustManagerFactory.algorithm=PKIX + +# +# The Java-level namelookup cache policy for successful lookups: +# +# any negative value: caching forever +# any positive value: the number of seconds to cache an address for +# zero: do not cache +# +# default value is forever (FOREVER). For security reasons, this +# caching is made forever when a security manager is set. When a security +# manager is not set, the default behavior in this implementation +# is to cache for 30 seconds. +# +# NOTE: setting this to anything other than the default value can have +# serious security implications. Do not set it unless +# you are sure you are not exposed to DNS spoofing attack. +# +#networkaddress.cache.ttl=-1 + +# The Java-level namelookup cache policy for failed lookups: +# +# any negative value: cache forever +# any positive value: the number of seconds to cache negative lookup results +# zero: do not cache +# +# In some Microsoft Windows networking environments that employ +# the WINS name service in addition to DNS, name service lookups +# that fail may take a noticeably long time to return (approx. 5 seconds). +# For this reason the default caching policy is to maintain these +# results for 10 seconds. +# +networkaddress.cache.negative.ttl=10 + +# +# Properties to configure OCSP for certificate revocation checking +# + +# Enable OCSP +# +# By default, OCSP is not used for certificate revocation checking. +# This property enables the use of OCSP when set to the value "true". +# +# NOTE: SocketPermission is required to connect to an OCSP responder. +# +# Example, +# ocsp.enable=true + +# +# Location of the OCSP responder +# +# By default, the location of the OCSP responder is determined implicitly +# from the certificate being validated. This property explicitly specifies +# the location of the OCSP responder. The property is used when the +# Authority Information Access extension (defined in RFC 5280) is absent +# from the certificate or when it requires overriding. +# +# Example, +# ocsp.responderURL=http://ocsp.example.net:80 + +# +# Subject name of the OCSP responder's certificate +# +# By default, the certificate of the OCSP responder is that of the issuer +# of the certificate being validated. This property identifies the certificate +# of the OCSP responder when the default does not apply. Its value is a string +# distinguished name (defined in RFC 2253) which identifies a certificate in +# the set of certificates supplied during cert path validation. In cases where +# the subject name alone is not sufficient to uniquely identify the certificate +# then both the "ocsp.responderCertIssuerName" and +# "ocsp.responderCertSerialNumber" properties must be used instead. When this +# property is set then those two properties are ignored. +# +# Example, +# ocsp.responderCertSubjectName=CN=OCSP Responder, O=XYZ Corp + +# +# Issuer name of the OCSP responder's certificate +# +# By default, the certificate of the OCSP responder is that of the issuer +# of the certificate being validated. This property identifies the certificate +# of the OCSP responder when the default does not apply. Its value is a string +# distinguished name (defined in RFC 2253) which identifies a certificate in +# the set of certificates supplied during cert path validation. When this +# property is set then the "ocsp.responderCertSerialNumber" property must also +# be set. When the "ocsp.responderCertSubjectName" property is set then this +# property is ignored. +# +# Example, +# ocsp.responderCertIssuerName=CN=Enterprise CA, O=XYZ Corp + +# +# Serial number of the OCSP responder's certificate +# +# By default, the certificate of the OCSP responder is that of the issuer +# of the certificate being validated. This property identifies the certificate +# of the OCSP responder when the default does not apply. Its value is a string +# of hexadecimal digits (colon or space separators may be present) which +# identifies a certificate in the set of certificates supplied during cert path +# validation. When this property is set then the "ocsp.responderCertIssuerName" +# property must also be set. When the "ocsp.responderCertSubjectName" property +# is set then this property is ignored. +# +# Example, +# ocsp.responderCertSerialNumber=2A:FF:00 + +# +# Policy for failed Kerberos KDC lookups: +# +# When a KDC is unavailable (network error, service failure, etc), it is +# put inside a blacklist and accessed less often for future requests. The +# value (case-insensitive) for this policy can be: +# +# tryLast +# KDCs in the blacklist are always tried after those not on the list. +# +# tryLess[:max_retries,timeout] +# KDCs in the blacklist are still tried by their order in the configuration, +# but with smaller max_retries and timeout values. max_retries and timeout +# are optional numerical parameters (default 1 and 5000, which means once +# and 5 seconds). Please notes that if any of the values defined here is +# more than what is defined in krb5.conf, it will be ignored. +# +# Whenever a KDC is detected as available, it is removed from the blacklist. +# The blacklist is reset when krb5.conf is reloaded. You can add +# refreshKrb5Config=true to a JAAS configuration file so that krb5.conf is +# reloaded whenever a JAAS authentication is attempted. +# +# Example, +# krb5.kdc.bad.policy = tryLast +# krb5.kdc.bad.policy = tryLess:2,2000 +# +krb5.kdc.bad.policy = tryLast + +# +# Algorithm restrictions for certification path (CertPath) processing +# +# In some environments, certain algorithms or key lengths may be undesirable +# for certification path building and validation. For example, "MD2" is +# generally no longer considered to be a secure hash algorithm. This section +# describes the mechanism for disabling algorithms based on algorithm name +# and/or key length. This includes algorithms used in certificates, as well +# as revocation information such as CRLs and signed OCSP Responses. +# The syntax of the disabled algorithm string is described as follows: +# DisabledAlgorithms: +# " DisabledAlgorithm { , DisabledAlgorithm } " +# +# DisabledAlgorithm: +# AlgorithmName [Constraint] { '&' Constraint } +# +# AlgorithmName: +# (see below) +# +# Constraint: +# KeySizeConstraint | CAConstraint | DenyAfterConstraint | +# UsageConstraint +# +# KeySizeConstraint: +# keySize Operator KeyLength +# +# Operator: +# <= | < | == | != | >= | > +# +# KeyLength: +# Integer value of the algorithm's key length in bits +# +# CAConstraint: +# jdkCA +# +# DenyAfterConstraint: +# denyAfter YYYY-MM-DD +# +# UsageConstraint: +# usage [TLSServer] [TLSClient] [SignedJAR] +# +# The "AlgorithmName" is the standard algorithm name of the disabled +# algorithm. See "Java Cryptography Architecture Standard Algorithm Name +# Documentation" for information about Standard Algorithm Names. Matching +# is performed using a case-insensitive sub-element matching rule. (For +# example, in "SHA1withECDSA" the sub-elements are "SHA1" for hashing and +# "ECDSA" for signatures.) If the assertion "AlgorithmName" is a +# sub-element of the certificate algorithm name, the algorithm will be +# rejected during certification path building and validation. For example, +# the assertion algorithm name "DSA" will disable all certificate algorithms +# that rely on DSA, such as NONEwithDSA, SHA1withDSA. However, the assertion +# will not disable algorithms related to "ECDSA". +# +# A "Constraint" defines restrictions on the keys and/or certificates for +# a specified AlgorithmName: +# +# KeySizeConstraint: +# keySize Operator KeyLength +# The constraint requires a key of a valid size range if the +# "AlgorithmName" is of a key algorithm. The "KeyLength" indicates +# the key size specified in number of bits. For example, +# "RSA keySize <= 1024" indicates that any RSA key with key size less +# than or equal to 1024 bits should be disabled, and +# "RSA keySize < 1024, RSA keySize > 2048" indicates that any RSA key +# with key size less than 1024 or greater than 2048 should be disabled. +# This constraint is only used on algorithms that have a key size. +# +# CAConstraint: +# jdkCA +# This constraint prohibits the specified algorithm only if the +# algorithm is used in a certificate chain that terminates at a marked +# trust anchor in the lib/security/cacerts keystore. If the jdkCA +# constraint is not set, then all chains using the specified algorithm +# are restricted. jdkCA may only be used once in a DisabledAlgorithm +# expression. +# Example: To apply this constraint to SHA-1 certificates, include +# the following: "SHA1 jdkCA" +# +# DenyAfterConstraint: +# denyAfter YYYY-MM-DD +# This constraint prohibits a certificate with the specified algorithm +# from being used after the date regardless of the certificate's +# validity. JAR files that are signed and timestamped before the +# constraint date with certificates containing the disabled algorithm +# will not be restricted. The date is processed in the UTC timezone. +# This constraint can only be used once in a DisabledAlgorithm +# expression. +# Example: To deny usage of RSA 2048 bit certificates after Feb 3 2020, +# use the following: "RSA keySize == 2048 & denyAfter 2020-02-03" +# +# UsageConstraint: +# usage [TLSServer] [TLSClient] [SignedJAR] +# This constraint prohibits the specified algorithm for +# a specified usage. This should be used when disabling an algorithm +# for all usages is not practical. 'TLSServer' restricts the algorithm +# in TLS server certificate chains when server authentication is +# performed. 'TLSClient' restricts the algorithm in TLS client +# certificate chains when client authentication is performed. +# 'SignedJAR' constrains use of certificates in signed jar files. +# The usage type follows the keyword and more than one usage type can +# be specified with a whitespace delimiter. +# Example: "SHA1 usage TLSServer TLSClient" +# +# When an algorithm must satisfy more than one constraint, it must be +# delimited by an ampersand '&'. For example, to restrict certificates in a +# chain that terminate at a distribution provided trust anchor and contain +# RSA keys that are less than or equal to 1024 bits, add the following +# constraint: "RSA keySize <= 1024 & jdkCA". +# +# All DisabledAlgorithms expressions are processed in the order defined in the +# property. This requires lower keysize constraints to be specified +# before larger keysize constraints of the same algorithm. For example: +# "RSA keySize < 1024 & jdkCA, RSA keySize < 2048". +# +# Note: The algorithm restrictions do not apply to trust anchors or +# self-signed certificates. +# +# Note: This property is currently used by Oracle's PKIX implementation. It +# is not guaranteed to be examined and used by other implementations. +# +# Example: +# jdk.certpath.disabledAlgorithms=MD2, DSA, RSA keySize < 2048 +# +# +jdk.certpath.disabledAlgorithms=MD2, MD5, SHA1 jdkCA & usage TLSServer, \ + RSA keySize < 1024, DSA keySize < 1024, EC keySize < 224 + +# +# Algorithm restrictions for signed JAR files +# +# In some environments, certain algorithms or key lengths may be undesirable +# for signed JAR validation. For example, "MD2" is generally no longer +# considered to be a secure hash algorithm. This section describes the +# mechanism for disabling algorithms based on algorithm name and/or key length. +# JARs signed with any of the disabled algorithms or key sizes will be treated +# as unsigned. +# +# The syntax of the disabled algorithm string is described as follows: +# DisabledAlgorithms: +# " DisabledAlgorithm { , DisabledAlgorithm } " +# +# DisabledAlgorithm: +# AlgorithmName [Constraint] { '&' Constraint } +# +# AlgorithmName: +# (see below) +# +# Constraint: +# KeySizeConstraint | DenyAfterConstraint +# +# KeySizeConstraint: +# keySize Operator KeyLength +# +# DenyAfterConstraint: +# denyAfter YYYY-MM-DD +# +# Operator: +# <= | < | == | != | >= | > +# +# KeyLength: +# Integer value of the algorithm's key length in bits +# +# Note: This property is currently used by the JDK Reference +# implementation. It is not guaranteed to be examined and used by other +# implementations. +# +# See "jdk.certpath.disabledAlgorithms" for syntax descriptions. +# +jdk.jar.disabledAlgorithms=MD2, MD5, RSA keySize < 1024, \ + DSA keySize < 1024 + +# +# Algorithm restrictions for Secure Socket Layer/Transport Layer Security +# (SSL/TLS/DTLS) processing +# +# In some environments, certain algorithms or key lengths may be undesirable +# when using SSL/TLS/DTLS. This section describes the mechanism for disabling +# algorithms during SSL/TLS/DTLS security parameters negotiation, including +# protocol version negotiation, cipher suites selection, peer authentication +# and key exchange mechanisms. +# +# Disabled algorithms will not be negotiated for SSL/TLS connections, even +# if they are enabled explicitly in an application. +# +# For PKI-based peer authentication and key exchange mechanisms, this list +# of disabled algorithms will also be checked during certification path +# building and validation, including algorithms used in certificates, as +# well as revocation information such as CRLs and signed OCSP Responses. +# This is in addition to the jdk.certpath.disabledAlgorithms property above. +# +# See the specification of "jdk.certpath.disabledAlgorithms" for the +# syntax of the disabled algorithm string. +# +# Note: The algorithm restrictions do not apply to trust anchors or +# self-signed certificates. +# +# Note: This property is currently used by the JDK Reference implementation. +# It is not guaranteed to be examined and used by other implementations. +# +# Example: +# jdk.tls.disabledAlgorithms=MD5, SSLv3, DSA, RSA keySize < 2048 +jdk.tls.disabledAlgorithms=SSLv3, RC4, MD5withRSA, DH keySize < 1024, \ + EC keySize < 224, DES40_CBC, RC4_40, 3DES_EDE_CBC + +# +# Legacy algorithms for Secure Socket Layer/Transport Layer Security (SSL/TLS) +# processing in JSSE implementation. +# +# In some environments, a certain algorithm may be undesirable but it +# cannot be disabled because of its use in legacy applications. Legacy +# algorithms may still be supported, but applications should not use them +# as the security strength of legacy algorithms are usually not strong enough +# in practice. +# +# During SSL/TLS security parameters negotiation, legacy algorithms will +# not be negotiated unless there are no other candidates. +# +# The syntax of the legacy algorithms string is described as this Java +# BNF-style: +# LegacyAlgorithms: +# " LegacyAlgorithm { , LegacyAlgorithm } " +# +# LegacyAlgorithm: +# AlgorithmName (standard JSSE algorithm name) +# +# See the specification of security property "jdk.certpath.disabledAlgorithms" +# for the syntax and description of the "AlgorithmName" notation. +# +# Per SSL/TLS specifications, cipher suites have the form: +# SSL_KeyExchangeAlg_WITH_CipherAlg_MacAlg +# or +# TLS_KeyExchangeAlg_WITH_CipherAlg_MacAlg +# +# For example, the cipher suite TLS_RSA_WITH_AES_128_CBC_SHA uses RSA as the +# key exchange algorithm, AES_128_CBC (128 bits AES cipher algorithm in CBC +# mode) as the cipher (encryption) algorithm, and SHA-1 as the message digest +# algorithm for HMAC. +# +# The LegacyAlgorithm can be one of the following standard algorithm names: +# 1. JSSE cipher suite name, e.g., TLS_RSA_WITH_AES_128_CBC_SHA +# 2. JSSE key exchange algorithm name, e.g., RSA +# 3. JSSE cipher (encryption) algorithm name, e.g., AES_128_CBC +# 4. JSSE message digest algorithm name, e.g., SHA +# +# See SSL/TLS specifications and "Java Cryptography Architecture Standard +# Algorithm Name Documentation" for information about the algorithm names. +# +# Note: If a legacy algorithm is also restricted through the +# jdk.tls.disabledAlgorithms property or the +# java.security.AlgorithmConstraints API (See +# javax.net.ssl.SSLParameters.setAlgorithmConstraints()), +# then the algorithm is completely disabled and will not be negotiated. +# +# Note: This property is currently used by the JDK Reference implementation. +# It is not guaranteed to be examined and used by other implementations. +# There is no guarantee the property will continue to exist or be of the +# same syntax in future releases. +# +# Example: +# jdk.tls.legacyAlgorithms=DH_anon, DES_CBC, SSL_RSA_WITH_RC4_128_MD5 +# +jdk.tls.legacyAlgorithms= \ + K_NULL, C_NULL, M_NULL, \ + DH_anon, ECDH_anon, \ + RC4_128, RC4_40, DES_CBC, DES40_CBC, \ + 3DES_EDE_CBC + +# +# The pre-defined default finite field Diffie-Hellman ephemeral (DHE) +# parameters for Transport Layer Security (SSL/TLS/DTLS) processing. +# +# In traditional SSL/TLS/DTLS connections where finite field DHE parameters +# negotiation mechanism is not used, the server offers the client group +# parameters, base generator g and prime modulus p, for DHE key exchange. +# It is recommended to use dynamic group parameters. This property defines +# a mechanism that allows you to specify custom group parameters. +# +# The syntax of this property string is described as this Java BNF-style: +# DefaultDHEParameters: +# DefinedDHEParameters { , DefinedDHEParameters } +# +# DefinedDHEParameters: +# "{" DHEPrimeModulus , DHEBaseGenerator "}" +# +# DHEPrimeModulus: +# HexadecimalDigits +# +# DHEBaseGenerator: +# HexadecimalDigits +# +# HexadecimalDigits: +# HexadecimalDigit { HexadecimalDigit } +# +# HexadecimalDigit: one of +# 0 1 2 3 4 5 6 7 8 9 A B C D E F a b c d e f +# +# Whitespace characters are ignored. +# +# The "DefinedDHEParameters" defines the custom group parameters, prime +# modulus p and base generator g, for a particular size of prime modulus p. +# The "DHEPrimeModulus" defines the hexadecimal prime modulus p, and the +# "DHEBaseGenerator" defines the hexadecimal base generator g of a group +# parameter. It is recommended to use safe primes for the custom group +# parameters. +# +# If this property is not defined or the value is empty, the underlying JSSE +# provider's default group parameter is used for each connection. +# +# If the property value does not follow the grammar, or a particular group +# parameter is not valid, the connection will fall back and use the +# underlying JSSE provider's default group parameter. +# +# Note: This property is currently used by OpenJDK's JSSE implementation. It +# is not guaranteed to be examined and used by other implementations. +# +# Example: +# jdk.tls.server.defaultDHEParameters= +# { \ +# FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1 \ +# 29024E08 8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD \ +# EF9519B3 CD3A431B 302B0A6D F25F1437 4FE1356D 6D51C245 \ +# E485B576 625E7EC6 F44C42E9 A637ED6B 0BFF5CB6 F406B7ED \ +# EE386BFB 5A899FA5 AE9F2411 7C4B1FE6 49286651 ECE65381 \ +# FFFFFFFF FFFFFFFF, 2} + +# +# Cryptographic Jurisdiction Policy defaults +# +# Import and export control rules on cryptographic software vary from +# country to country. By default, Java provides two different sets of +# cryptographic policy files[1]: +# +# unlimited: These policy files contain no restrictions on cryptographic +# strengths or algorithms +# +# limited: These policy files contain more restricted cryptographic +# strengths +# +# The default setting is determined by the value of the ���crypto.policy��� +# Security property below. If your country or usage requires the +# traditional restrictive policy, the ���limited��� Java cryptographic +# policy is still available and may be appropriate for your environment. +# +# If you have restrictions that do not fit either use case mentioned +# above, Java provides the capability to customize these policy files. +# The ���crypto.policy��� security property points to a subdirectory +# within /conf/security/policy/ which can be customized. +# Please see the /conf/security/policy/README.txt file or consult +# the Java Security Guide/JCA documentation for more information. +# +# YOU ARE ADVISED TO CONSULT YOUR EXPORT/IMPORT CONTROL COUNSEL OR ATTORNEY +# TO DETERMINE THE EXACT REQUIREMENTS. +# +# [1] Please note that the JCE for Java SE, including the JCE framework, +# cryptographic policy files, and standard JCE providers provided with +# the Java SE, have been reviewed and approved for export as mass market +# encryption item by the US Bureau of Industry and Security. +# +# Note: This property is currently used by the JDK Reference implementation. +# It is not guaranteed to be examined and used by other implementations. +# +crypto.policy=unlimited + +# +# The policy for the XML Signature secure validation mode. The mode is +# enabled by setting the property "org.jcp.xml.dsig.secureValidation" to +# true with the javax.xml.crypto.XMLCryptoContext.setProperty() method, +# or by running the code with a SecurityManager. +# +# Policy: +# Constraint {"," Constraint } +# Constraint: +# AlgConstraint | MaxTransformsConstraint | MaxReferencesConstraint | +# ReferenceUriSchemeConstraint | KeySizeConstraint | OtherConstraint +# AlgConstraint +# "disallowAlg" Uri +# MaxTransformsConstraint: +# "maxTransforms" Integer +# MaxReferencesConstraint: +# "maxReferences" Integer +# ReferenceUriSchemeConstraint: +# "disallowReferenceUriSchemes" String { String } +# KeySizeConstraint: +# "minKeySize" KeyAlg Integer +# OtherConstraint: +# "noDuplicateIds" | "noRetrievalMethodLoops" +# +# For AlgConstraint, Uri is the algorithm URI String that is not allowed. +# See the XML Signature Recommendation for more information on algorithm +# URI Identifiers. For KeySizeConstraint, KeyAlg is the standard algorithm +# name of the key type (ex: "RSA"). If the MaxTransformsConstraint, +# MaxReferencesConstraint or KeySizeConstraint (for the same key type) is +# specified more than once, only the last entry is enforced. +# +# Note: This property is currently used by the JDK Reference implementation. It +# is not guaranteed to be examined and used by other implementations. +# +jdk.xml.dsig.secureValidationPolicy=\ + disallowAlg http://www.w3.org/TR/1999/REC-xslt-19991116,\ + disallowAlg http://www.w3.org/2001/04/xmldsig-more#rsa-md5,\ + disallowAlg http://www.w3.org/2001/04/xmldsig-more#hmac-md5,\ + disallowAlg http://www.w3.org/2001/04/xmldsig-more#md5,\ + maxTransforms 5,\ + maxReferences 30,\ + disallowReferenceUriSchemes file http https,\ + minKeySize RSA 1024,\ + minKeySize DSA 1024,\ + minKeySize EC 224,\ + noDuplicateIds,\ + noRetrievalMethodLoops + +# +# Serialization process-wide filter +# +# A filter, if configured, is used by java.io.ObjectInputStream during +# deserialization to check the contents of the stream. +# A filter is configured as a sequence of patterns, each pattern is either +# matched against the name of a class in the stream or defines a limit. +# Patterns are separated by ";" (semicolon). +# Whitespace is significant and is considered part of the pattern. +# +# If the system property jdk.serialFilter is also specified, it supersedes +# the security property value defined here. +# +# If a pattern includes a "=", it sets a limit. +# If a limit appears more than once the last value is used. +# Limits are checked before classes regardless of the order in the +# sequence of patterns. +# If any of the limits are exceeded, the filter status is REJECTED. +# +# maxdepth=value - the maximum depth of a graph +# maxrefs=value - the maximum number of internal references +# maxbytes=value - the maximum number of bytes in the input stream +# maxarray=value - the maximum array length allowed +# +# Other patterns, from left to right, match the class or package name as +# returned from Class.getName. +# If the class is an array type, the class or package to be matched is the +# element type. +# Arrays of any number of dimensions are treated the same as the element type. +# For example, a pattern of "!example.Foo", rejects creation of any instance or +# array of example.Foo. +# +# If the pattern starts with "!", the status is REJECTED if the remaining +# pattern is matched; otherwise the status is ALLOWED if the pattern matches. +# If the pattern contains "/", the non-empty prefix up to the "/" is the +# module name; +# if the module name matches the module name of the class then +# the remaining pattern is matched with the class name. +# If there is no "/", the module name is not compared. +# If the pattern ends with ".**" it matches any class in the package and all +# subpackages. +# If the pattern ends with ".*" it matches any class in the package. +# If the pattern ends with "*", it matches any class with the pattern as a +# prefix. +# If the pattern is equal to the class name, it matches. +# Otherwise, the status is UNDECIDED. +# +#jdk.serialFilter=pattern;pattern + +# +# RMI Registry Serial Filter +# +# The filter pattern uses the same format as jdk.serialFilter. +# This filter can override the builtin filter if additional types need to be +# allowed or rejected from the RMI Registry or to decrease limits but not +# to increase limits. +# If the limits (maxdepth, maxrefs, or maxbytes) are exceeded, the object is rejected. +# +# Each non-array type is allowed or rejected if it matches one of the patterns, +# evaluated from left to right, and is otherwise allowed. Arrays of any +# component type, including subarrays and arrays of primitives, are allowed. +# +# Array construction of any component type, including subarrays and arrays of +# primitives, are allowed unless the length is greater than the maxarray limit. +# The filter is applied to each array element. +# +# Note: This property is currently used by the JDK Reference implementation. +# It is not guaranteed to be examined and used by other implementations. +# +# The built-in filter allows subclasses of allowed classes and +# can approximately be represented as the pattern: +# +#sun.rmi.registry.registryFilter=\ +# maxarray=1000000;\ +# maxdepth=20;\ +# java.lang.String;\ +# java.lang.Number;\ +# java.lang.reflect.Proxy;\ +# java.rmi.Remote;\ +# sun.rmi.server.UnicastRef;\ +# sun.rmi.server.RMIClientSocketFactory;\ +# sun.rmi.server.RMIServerSocketFactory;\ +# java.rmi.activation.ActivationID;\ +# java.rmi.server.UID +# +# RMI Distributed Garbage Collector (DGC) Serial Filter +# +# The filter pattern uses the same format as jdk.serialFilter. +# This filter can override the builtin filter if additional types need to be +# allowed or rejected from the RMI DGC. +# +# Note: This property is currently used by the JDK Reference implementation. +# It is not guaranteed to be examined and used by other implementations. +# +# The builtin DGC filter can approximately be represented as the filter pattern: +# +#sun.rmi.transport.dgcFilter=\ +# java.rmi.server.ObjID;\ +# java.rmi.server.UID;\ +# java.rmi.dgc.VMID;\ +# java.rmi.dgc.Lease;\ +# maxdepth=5;maxarray=10000 + +# CORBA ORBIorTypeCheckRegistryFilter +# Type check enhancement for ORB::string_to_object processing +# +# An IOR type check filter, if configured, is used by an ORB during +# an ORB::string_to_object invocation to check the veracity of the type encoded +# in the ior string. +# +# The filter pattern consists of a semi-colon separated list of class names. +# The configured list contains the binary class names of the IDL interface types +# corresponding to the IDL stub class to be instantiated. +# As such, a filter specifies a list of IDL stub classes that will be +# allowed by an ORB when an ORB::string_to_object is invoked. +# It is used to specify a white list configuration of acceptable +# IDL stub types which may be contained in a stringified IOR +# parameter passed as input to an ORB::string_to_object method. +# +# Note: This property is currently used by the JDK Reference implementation. +# It is not guaranteed to be examined and used by other implementations. +# +#com.sun.CORBA.ORBIorTypeCheckRegistryFilter=binary_class_name;binary_class_name + +# +# JCEKS Encrypted Key Serial Filter +# +# This filter, if configured, is used by the JCEKS KeyStore during the +# deserialization of the encrypted Key object stored inside a key entry. +# If not configured or the filter result is UNDECIDED (i.e. none of the patterns +# matches), the filter configured by jdk.serialFilter will be consulted. +# +# If the system property jceks.key.serialFilter is also specified, it supersedes +# the security property value defined here. +# +# The filter pattern uses the same format as jdk.serialFilter. The default +# pattern allows java.lang.Enum, java.security.KeyRep, java.security.KeyRep$Type, +# and javax.crypto.spec.SecretKeySpec and rejects all the others. +jceks.key.serialFilter = java.base/java.lang.Enum;java.base/java.security.KeyRep;\ + java.base/java.security.KeyRep$Type;java.base/javax.crypto.spec.SecretKeySpec;!* diff --git a/java-11-openjdk/security/nss.cfg b/java-11-openjdk/security/nss.cfg new file mode 100644 index 0000000..3535a40 --- /dev/null +++ b/java-11-openjdk/security/nss.cfg @@ -0,0 +1,4 @@ +name = NSS +nssDbMode = noDb +attributes = compatibility +handleStartupErrors = ignoreMultipleInitialisation diff --git a/java-11-openjdk/security/policy/README.txt b/java-11-openjdk/security/policy/README.txt new file mode 100644 index 0000000..e9138e7 --- /dev/null +++ b/java-11-openjdk/security/policy/README.txt @@ -0,0 +1,54 @@ + + Java(TM) Cryptography Extension Policy Files + for the Java(TM) Platform, Standard Edition Runtime Environment + + README +------------------------------------------------------------------------ + +Import and export control rules on cryptographic software vary from +country to country. The Java Cryptography Extension (JCE) architecture +allows flexible cryptographic key strength to be configured via the +jurisdiction policy files which are referenced by the “crypto.policy” +security property in the /conf/security/java.security file. + +By default, Java provides two different sets of cryptographic policy +files: + + unlimited: These policy files contain no restrictions on cryptographic + strengths or algorithms + + limited: These policy files contain more restricted cryptographic + strengths + +These files reside in /conf/security/policy in the “unlimited” +or “limited” subdirectories respectively. + +Each subdirectory contains a complete policy configuration, +and subdirectories can be added/edited/removed to reflect your +import or export control product requirements. + +Within a subdirectory, the effective policy is the combined minimum +permissions of the grant statements in the file(s) matching the filename +pattern "default_*.policy". At least one grant is required. For example: + + limited = Export (all) + Import (limited) = Limited + unlimited = Export (all) + Import (all) = Unlimited + +The effective exemption policy is the combined minimum permissions +of the grant statements in the file(s) matching the filename pattern +"exempt_*.policy". Exemption grants are optional. For example: + + limited = grants exemption permissions, by which the + effective policy can be circumvented. + e.g. KeyRecovery/KeyEscrow/KeyWeakening. + +Please see the Java Cryptography Architecture (JCA) documentation for +additional information on these files and formats. + +YOU ARE ADVISED TO CONSULT YOUR EXPORT/IMPORT CONTROL COUNSEL OR ATTORNEY +TO DETERMINE THE EXACT REQUIREMENTS. + +Please note that the JCE for Java SE, including the JCE framework, +cryptographic policy files, and standard JCE providers provided with +the Java SE, have been reviewed and approved for export as mass market +encryption item by the US Bureau of Industry and Security. diff --git a/java-11-openjdk/security/policy/limited/default_US_export.policy b/java-11-openjdk/security/policy/limited/default_US_export.policy new file mode 100644 index 0000000..1f38934 --- /dev/null +++ b/java-11-openjdk/security/policy/limited/default_US_export.policy @@ -0,0 +1,6 @@ +// Default US Export policy file. + +grant { + // There is no restriction to any algorithms. + permission javax.crypto.CryptoAllPermission; +}; diff --git a/java-11-openjdk/security/policy/limited/default_local.policy b/java-11-openjdk/security/policy/limited/default_local.policy new file mode 100644 index 0000000..2a6d513 --- /dev/null +++ b/java-11-openjdk/security/policy/limited/default_local.policy @@ -0,0 +1,14 @@ +// Some countries have import limits on crypto strength. This policy file +// is worldwide importable. + +grant { + permission javax.crypto.CryptoPermission "DES", 64; + permission javax.crypto.CryptoPermission "DESede", *; + permission javax.crypto.CryptoPermission "RC2", 128, + "javax.crypto.spec.RC2ParameterSpec", 128; + permission javax.crypto.CryptoPermission "RC4", 128; + permission javax.crypto.CryptoPermission "RC5", 128, + "javax.crypto.spec.RC5ParameterSpec", *, 12, *; + permission javax.crypto.CryptoPermission "RSA", *; + permission javax.crypto.CryptoPermission *, 128; +}; diff --git a/java-11-openjdk/security/policy/limited/exempt_local.policy b/java-11-openjdk/security/policy/limited/exempt_local.policy new file mode 100644 index 0000000..9dd5b91 --- /dev/null +++ b/java-11-openjdk/security/policy/limited/exempt_local.policy @@ -0,0 +1,13 @@ +// Some countries have import limits on crypto strength, but may allow for +// these exemptions if the exemption mechanism is used. + +grant { + // There is no restriction to any algorithms if KeyRecovery is enforced. + permission javax.crypto.CryptoPermission *, "KeyRecovery"; + + // There is no restriction to any algorithms if KeyEscrow is enforced. + permission javax.crypto.CryptoPermission *, "KeyEscrow"; + + // There is no restriction to any algorithms if KeyWeakening is enforced. + permission javax.crypto.CryptoPermission *, "KeyWeakening"; +}; diff --git a/java-11-openjdk/security/policy/unlimited/default_US_export.policy b/java-11-openjdk/security/policy/unlimited/default_US_export.policy new file mode 100644 index 0000000..1f38934 --- /dev/null +++ b/java-11-openjdk/security/policy/unlimited/default_US_export.policy @@ -0,0 +1,6 @@ +// Default US Export policy file. + +grant { + // There is no restriction to any algorithms. + permission javax.crypto.CryptoAllPermission; +}; diff --git a/java-11-openjdk/security/policy/unlimited/default_local.policy b/java-11-openjdk/security/policy/unlimited/default_local.policy new file mode 100644 index 0000000..2b907e2 --- /dev/null +++ b/java-11-openjdk/security/policy/unlimited/default_local.policy @@ -0,0 +1,6 @@ +// Country-specific policy file for countries with no limits on crypto strength. + +grant { + // There is no restriction to any algorithms. + permission javax.crypto.CryptoAllPermission; +}; diff --git a/java-11-openjdk/sound.properties b/java-11-openjdk/sound.properties new file mode 100644 index 0000000..68309d1 --- /dev/null +++ b/java-11-openjdk/sound.properties @@ -0,0 +1,39 @@ +############################################################ +# Sound Configuration File +############################################################ +# +# This properties file is used to specify default service +# providers for javax.sound.midi.MidiSystem and +# javax.sound.sampled.AudioSystem. +# +# The following keys are recognized by MidiSystem methods: +# +# javax.sound.midi.Receiver +# javax.sound.midi.Sequencer +# javax.sound.midi.Synthesizer +# javax.sound.midi.Transmitter +# +# The following keys are recognized by AudioSystem methods: +# +# javax.sound.sampled.Clip +# javax.sound.sampled.Port +# javax.sound.sampled.SourceDataLine +# javax.sound.sampled.TargetDataLine +# +# The values specify the full class name of the service +# provider, or the device name. +# +# See the class descriptions for details. +# +# Example 1: +# Use MyDeviceProvider as default for SourceDataLines: +# javax.sound.sampled.SourceDataLine=com.xyz.MyDeviceProvider +# +# Example 2: +# Specify the default Synthesizer by its name "InternalSynth". +# javax.sound.midi.Synthesizer=#InternalSynth +# +# Example 3: +# Specify the default Receiver by provider and name: +# javax.sound.midi.Receiver=com.sun.media.sound.MidiProvider#SunMIDI1 +# diff --git a/java-11-openjdk/swing.properties b/java-11-openjdk/swing.properties new file mode 100644 index 0000000..0f55df0 --- /dev/null +++ b/java-11-openjdk/swing.properties @@ -0,0 +1,2 @@ +# uncomment to set the default look and feel to GTK +#swing.defaultlaf=com.sun.java.swing.plaf.gtk.GTKLookAndFeel diff --git a/mailcap b/mailcap index 6fc0538..87e4cc6 100644 --- a/mailcap +++ b/mailcap @@ -348,6 +348,9 @@ application/zip; /usr/lib/gvfs/gvfsd-archive file=%s; test=test -n "$DISPLAY" x-content/unix-software; nautilus-autorun-software %s; test=test -n "$DISPLAY" inode/directory; nautilus --new-window %s; test=test -n "$DISPLAY" application/x-gnome-saved-search; nautilus --new-window %s; test=test -n "$DISPLAY" +application/x-java-archive; cautious-launcher %s /usr/bin/java -jar; test=test -n "$DISPLAY" +application/java-archive; cautious-launcher %s /usr/bin/java -jar; test=test -n "$DISPLAY" +application/x-jar; cautious-launcher %s /usr/bin/java -jar; test=test -n "$DISPLAY" application/x-openscad; openscad %s; test=test -n "$DISPLAY" inode/directory; baobab %s; test=test -n "$DISPLAY" text/calendar; gnome-calendar %s; test=test -n "$DISPLAY" diff --git a/rc2.d/S02binfmt-support b/rc2.d/S02binfmt-support new file mode 120000 index 0000000..2894b1d --- /dev/null +++ b/rc2.d/S02binfmt-support @@ -0,0 +1 @@ +../init.d/binfmt-support \ No newline at end of file diff --git a/rc3.d/S02binfmt-support b/rc3.d/S02binfmt-support new file mode 120000 index 0000000..2894b1d --- /dev/null +++ b/rc3.d/S02binfmt-support @@ -0,0 +1 @@ +../init.d/binfmt-support \ No newline at end of file diff --git a/rc4.d/S02binfmt-support b/rc4.d/S02binfmt-support new file mode 120000 index 0000000..2894b1d --- /dev/null +++ b/rc4.d/S02binfmt-support @@ -0,0 +1 @@ +../init.d/binfmt-support \ No newline at end of file diff --git a/rc5.d/S02binfmt-support b/rc5.d/S02binfmt-support new file mode 120000 index 0000000..2894b1d --- /dev/null +++ b/rc5.d/S02binfmt-support @@ -0,0 +1 @@ +../init.d/binfmt-support \ No newline at end of file diff --git a/ssl/certs/java/cacerts b/ssl/certs/java/cacerts new file mode 100644 index 0000000000000000000000000000000000000000..71ffb5ae4c135fe98d8369c501fe482ae28721a2 GIT binary patch literal 156975 zcmdqK1zc5Kw?0aDh;$>}>`f!x9n#(1CEb!rNp~X>BHc)cq<{zrg0vtANQfvX_+M;7 ze0{(3o_o)C&;Oh&zs+W@HP@PRuRX>y$9TpV)6?zKZ73)x7~mBSd8ahDFtsspylrA> zY2)hP?t0hF-N@P1!olXQgOP=q8LP8}0~8dr)nM)I9VmEhRxS`9a5W4l1o{+sh2_D* zK*PWwxu??H?-TY>2caM!F^0>G2*Sa_f+WGHAY=qs4LAgB7!5Tr4(R4t0|gCL6f%_h z*-&5#5ZT#LSTy`=M=4a!CqN-7E)F8YM+bvIV0Jz*Cp(CpQx_kd6KHXOFPi_ZVLU)L z5D+1Ahk-_bX9|XcqJ%YtfCw;4_FzGHm)ei&h^|a8>=d@XgDc z9}jSh)?*3F*;r-PDhR~ADqitCZ?73~1s(w@1{@w7PR3IPpH3_;F4{XFsOPq)B9oPG1VET)r?H`- zf5O3oV1YLf#@PYPvjcFz^GCS;)M2flK;|$YeB{p&kt(`R`#Z%tq>aAV+lDXp(7C_o zRhxnjB<5V{Wvd-T7U0RA`p_h`cap#C0s|7$i4dQ-v(Pe*%&t2U8K5PYWh7?z1(BtG zHze^$$Eni%SbOyW*^1e-`ru(Fm}qZ^@Q_~!kCU^773CNP{5~#0lbJ=LYd|a&dtG3F6=d zfx%oL$UohG!w4ZTl-H*X4G#qy0)q(!3V}g^34wuz`sOV)lkx&&c;5w<#kr`p>IKrf z;We(#pdu`mxwVK&1Hp%{BkXw^XH0W4yQ!z*_GTYFT99(O^T=gLh!|{T`V~u$lWx*m zDLPZTo$>~{J{{T|X!Y^9!7W~Q{L>Zk24#LbmRWye@@Rhr`0h<;Jlr&#*s*v|O5v?; zz9#S6yRy{F$q(O|a3(~nyYE!{M?)|3`ga-G8d2B8n&Ln4rg&0L+PGMkBBN|6eggrI z8g^+hE4EikIhH7WDXuw|!`^0I`$--~iMcwKjfADL!p)LcX8)cEy%$iNpsu&+r|ct$ zp>;~bC_lLsP4`O7wBFC!mQ;2yH4m)S&_%5VWRNIY_jVD?b1>bJk|&A%Du{M;pA)C& zI|mol-pf74zT(!Zf{{}-J4I1qOZu9WD6GA<@EHZwd6EUh;svzv$wmZ1$ zNsl~*Ub)|Czk`Fs$1_CESqjQl4Q17cuWnh;fI^+tWT}>wbqy*to$5R!z=G2lcK01M zarQp&W!BeE__5lgTdt6poKN?u_}Qonl~_xr2MY`=G!%598OY=h)%`=ae_=tY)Ge)B zTr=DneV_MuoL7+!6B!yn&;AcoLTq;oLFev4csYiYh8B}S}7 zl=l-IEhqS*Xe-7Q;RISEZVB@oxX{eVx0I)Z1V3!pep_8+k-F?;u2Yoq$#{^Q>bqpi z&p7Jc!BTLbH+fJk3ww*XmGRSNo#BNH+409A)kkSb_g^lyF2WI~8&^wNyhAFek;;*X z{FoS^h4&iQ)reKTd?MSdX+>uBG?Y~vC0CsEw2>eoTwER_i#?p#_{)aO$K-8ihP_F) z6RtX~(b+JW^yY3S`?z7RHvTVoC7s145#LGh=T`^S?n4z0}DJJ2nT}9*yz$0P7q+GkaaX; z1rvh^A?S>K^Xj-XWNZMQ&#)Q94q!7F#Ce9s05-E=R}F%l``c&$vJ7L)>7y5plq6ZFtRd# zKHh4wK>C^~qQ7lsUJ%;Vpymht@bC+IZ_i8{Ir@ z+}zx3tQ?K3ob1id3?~*NEB0#|nRTU+@Xr9#sRhu=f^&^ThH4cd5&vSST=iGIyl!}l z%Ybn~*ynnQrgk=(8Za7#s5F=yVs^s8V&nZfEDcQJ%xGevkY=eA}B!{7v!%m5#!d|1-hANcqLnsNQVrp$qVG7iE`JhXS9K+NCb52n6zS~S? zfI~|#Nq|^11=m|~#n9u>SykrG7<8Vfb{$x3u3ovU(?V+mJi3goM>D4J3CV-xSsS$i zOhcccu{(4}yXsMl+vn=j&DEOnQfi%+X+0lCFPh$f$>qc>noQuhGyg26CDg}Qz;-s5 zX={ESTG&x>RV93=?&-FK$csVU=$Y3{evdyrd$fvDhEco#uiB{5M`^%ro0@8dJv%V# z&Fvd@TkeHw)DiWEY|qk=pBf~^E;dYKFx30Cv=eqSa2l&!D18nfo_NOhIXE1Kc=#GG z^y-H=qZ0PAY2)${CwgnVRA$l8Q2kJ&MW>oK=At9N7An@TznsRO8Ezc0%$_(g{Mnu= z#BldRK#8gLQyR`<(LTX8bd^C^SWF~c@?f8rU&8VFSng2VtB;n`jC~08BUV3TJ~Hq5vbCds%#OgE#eqS^ogM0+$}-JVr=utS zGbX}mo&v=W8%UyQXDkYk9lDm)SDFVE6oTSBeT_5778>?t$S_)z)E&|mmkNjqJXJ<} z%o4Vw39~oX>_)oI(J8nB6kPiM#Cp=B@l7eRxD(LC_qo%{(s2Fuhuu%V;nm-EkUBH3 zDBy%af*^hbWaBV*XdP%6XlM{Ch#3Ki2>}`&9uWo_kHXsB-T5{fo2!MhlbemZldCuD zl_Im6IXSTXMI#|r7+uRslHXos=RE$}>h$Cn^{RUZt;2@!zRJ0GEuRXkYX8vHpvnVA4&R$PSvAB5&e_ zc7qdnQ^1d!`PGDUAje;l9QC(2U)YkkA}Nc zP=2N}#0jPKW`Be{9o7*UOJAaJ&a4rwo$6cG`+GRO5;3@?jUDatkBB~1vV52E#6NA_ zdP?wx@y;$^Xlk;(Bk^;l9(QAJnkp2!g$2Xce4~>7V)6^M%w#Wm4F)xC=VjSs#Leu~ zR0-rp*xzKbaK=>y6H$*kfvHr;qm|>Rp1X^hk!U=|nG;&PqcXZj4AR6%s0s<2zBfc^ z-p0~IGpSzCgz)i6LJ@UdS9rY~wypFiE2?I)`p`(mtZm(+npsh#a5~Sgws~UqsJtUn zcU9OEx)+#0lrpa-MR{oqiZ%>#dz0?Ik~{&WipRy5qx6Nl8OzzQ%olr2AZUhpf1&l?|!2No^< zMXmtr=)xU_MMD-97uQr3mDL44u{;pYVyskbq&s5=?A!L{4J!sd^D*su< zpy40mP6OX&8Zbg$ONKorwtg(Qejs7rp5HwL`z%@r8!B``PNs8(5@mgZr-VSE8X28R zGZ0SkEq*9LasP}+lH2A8hL!+q@a=4rd@XUC3M~ikc(2v^I{xW4g&6w$lERV}7$ur9 z#>(wVSjr|l3QQ2adUD|6rx6s(>@g7*N6M$!L|yQNubn#gbHDl4!iarWDJ5k|#H1?k z?ZQm>`Kkc-iyE>E$xlh_&^21aZ;O#6C_nHT9=jnl?V5$c76fIau79WQWbBJx_|4hZ*cgnw* zPlG5^J`m;p6DcmJqcg?g^QSF&>-Ox(=ipkAz4g&U-qx)5V}TQ^+L?aG6Q40M?>>Cr zqRL7bF!p6wm+(gm!r^z-$MWfLbKj2Y9;g&5nMUnKP#@nD>xwv@WMN>`b@4H`ouV@~ zL!TXy{SreSAH|OU%}u=NwQgd#$(yCSC?CBoJtCD|HsNUApy>J}t^(eZ2xfId^Ot$$ zcZ;pDm=@gv|E-0NA=NKOXGXyvseIWl!sD*}xa{)Pl6fWB!m~fE`==JpU zWHkYlh}FW4&Cj#2jdxDcV_IFsqrXJFo^^ z067Rc9Q)#KPG)Y-m$$pd#=VZHTUp?tOVl{j{208-{W6+NxcyHX`MOK~w^xKfyPYp9 zA<(vf(_sm`OcCIKb>_?k0sJgz%F8K1h*cc25a=6FqEL6C+@YMHT%l~B%%Mzx7X|RL z0Dg-Dzg>ZIHc*zp%M3VY2E2cUaseCd*EdS+~e$=H}Lw8Mw0}3pIzq;%;#+U^Vu*%u9Ah40^aXHaYAuJ zfuO*^4;S#4BoqS_E9ATilp64UHWLacYv2yQPsk4|w(_pxi*9 zt7im_NBuWKU~ge%<7RJSX5-{&WX5Xk?f}v_d+6kFN+1Q0T%JsxRJg?7T=t)q9V2rK zS3rL3|FA*u&xXN*13)(z?M%uY(2wF=G)5B^vQ7nP~w-E{Kr2KVk8a*@sj;G z-kCml%=3+I8kvQ7ryqxoqSRdCC+nNLW%i23B80Ny>Si;`FIy~El_h-i-r5E;iA)9_ zLDOk7_ixKQ^b>vrHQK}AhQ&P}PAHW9iSR!0WYu=8U>0L1`m~_siU4~1WRm{!atRkP z9Mqw(Zp=sVcB3fL(ypqP>C1{xC^G|edLOXk_1}NtD9~_tw}`CBR!yr%cNYq|$JCPn z$tXvsq9Nc(t~!Vkwu{Wg{Pc(yC52!P2B(5*2!VvG$Ug>so=$ZA$qa5|71bQm#lcWCEH*u<{ZLDpO!S1IzNu0hrY*eEbuFy*Puc8^s+NTUu5QG zvarS?S6@@;vpR!epL@`*pCZ==81s@T=T7R2=O)xoi)f^RmpZ$GwS(DEgu)j+f4SP^4MM z*<`{q(5)RroR^yaLnmef>u?NHUV~GL@j*EMZ@wRdhB0$;H9F(W&j1T>|5&d3e$7_~ z0Rjgo1c40{0*8NL5YXf=3~~(Vz+4xyGqOCm=o%-ZA_~R?IsnW#5*mVviKB^w$z>D< z5e@bH0EM`XyEm8`M0wT?1&tWO+lV{4QmA>mxm!56QK+#}m|IY&vMR8G=|D7Ry-?A} zu6l`I;;g#`h3H*(YbV#U+g-YrXn0p0&*=EG&VYBx0&y+D+yL*x2?TQ3**VT^j~Q|jb+kAB{Opx5PHnHKO#2VE#PCSfYJa})a_`m5-e z#Lxs$ghX|7?#{&wE@p07vlrPUSVyA95{k*wb<}uY1*n>wxi$6+^1u@Ziqr4u;unewUU}C!ImGl}rQK zCWU3K>a_b}T3H@DJMClEk6#}kw|a6tqX|Lk!DE)7&@7d}^4u|~BP}zu6MDdYh{&b| zmoWI{G`o9ay*5@s9tQmOy?{&z-B*GT51HF8)!6xbldLZ|yGc#M7GO^m51tAx=9zLba9cXSSI}|?8#~fSAm8l!QAGq-?&px4B4Ly) zu+4+?qDZ+|M@z*WydF$%`dh~6VR-&i>b!dinkV%f3isYk-N=HQ|w-s0y5v-s10 zSZ`^f!o*i=QqEUzB21gkpyL~paYY_&CC)9nUe64UAOS-u;jhoD3&S~j*A3B|xtPnO zy24=Y2IXy1f5$C*Zx!h1DSQBTpUuyA1>a(!cHSN0{LE5McOU zZ~(H{6%N8N_e> z^%b386d#qZ7Dh$QK_73;9c?6}&Q?i@eI7S0OFji#;n--$qm-e3;-TtOxl{KgAZNw* z>-(2t>@2cqLqBEFGRZhk934~cd&4$3%_0w-7+K)(Eb)H%Y=Wo#zTN>H6^>X~g(a}I z&xZ&v$oSiR@(p6f-lG<1BAbra+I{L;NO4Pi#-8#OI-x|7dvim|UQ-{II9Pss5q>!RTyULHnUs#_Gy9#k$IpVItMZ$hcALKR*}B5Kv?JKO8nz{p2xFmFQToj zZdetovh4Px#|3tb*)7*gzj^yAEL|}v6H`9s6O^trDHd#nD8bW+Mkln}af74pV7m&C z`&Unb4Ev46poxjpbX$2IHMX^cZjjj%O_FwuOy=jHr>@5@gRvdP9G#G|NvV`!%z?}~X@EAIC=}4@s$5~LS z<1Z{3-j}3G6k*T@V{^SYbTVHP?U`hI$tg)QDhib%D975JlBTRAmzCN$OP;{q{}c0$ z&aNl>hSzPnQEl!^{PLxm?z6gcpLGNXi zev5Q zv|Hqq2dxoFNwVd7C)pmp^mB0~dC_UL$$m1Bpr14o)|uI%=FfzD5S{&yJk?fpXdaon z$aC5^LPcT{aD{EY^U2bZAr}Yvim+_1(}fM3nw$iz`K6LhW}n0FS%Sqsz$d~rpU+oM za`frQkk1J?fylPuv(%=RjLKgG9umgz#_E)>ec140cf)D|-BI$H#(LuG5m@2v8Ja3m zts%189(f8|Djw_Ru4qN2drc4Cyom^HWnUG=>hyeDYn;7FJUQklAyN7WdP~EU)U!!H zRz}t@i(d82j67D+udK<^qirV~pAS(@0s2EM| zyW z;m3o`Q+hE^;cP16ng+oj97F|H<*$<{c~!x7a;>QKOA%j4=(gsauw8Hq!6O}A`0IlYSM$_1F~OK zRnZPd`ZBS{I5ypK(N6WRF10IH& z7x|ll2sRkLU0p7kG(1#CO*~nOCt=v>Yq>dGfZi z{&C^`5z8-_;=?6OTE1pdwq>lU(+As24o?{3y<}RJsLBeXw(84MI_u;MNK&1lk^PE5~6ft^TpDZ9r_Nw|g; zY;e_y;?w3g$&3a)`-Wl##ci@Ov|my4FA$5Q1aLhG?o)DUiNuEJKKq64J6gDVI=R{z zxjEV2J<~NeqcdL?LcRf*aIr|cdtZxby8Oa`j{pX&0T?iHfdN`W98TT(cx%#l_$%>X z>puu@(`y(2SQ@t=mNOg*Hi6RlEGX12XF;I=xUAx=Ko@K4(QzAYdDtyMt<5ER zHMfD%Sjfm=1o>wO8ga%Q6(ZWGxk(cP!gn_@Sx^eZ4e(!aCQy8I8|7t2phfm^{d%mz z{;fN4+@^qPM6~+l`$=-{vHQ2bMVl?-=-6zdj|bYVH^Htd+peaW*~q{@WBtj|u#u`` z^UaE|GSMVO0(acCO1RC|e@iAX=6QLU3zM3Ss2XQ|Rr3o3l%6WdFQNvHQIfub{It>T z-K($1{A;i#zH75nW&{nqJ3-qBG=xnZ;fKPBpmXLejdiT0^GLh12)}ZxoML6cwg;zzf|IVT-M2sk-=U_I(q!ULV1uZNIFk4Pdr@of+qynK2|`w0l{{2vxmg>E=1@`$gT;{75f1p3I8VV zp|w)}L!;JaU>QrJn{=3M*ZX49_a6i{4swWZeV`#V+eNtI@JGG4Or6JtQZT9eS zR9S3^Wd0%flAtO*`3}YwX;b9S2o;i$?v+LMppHCL>Hg>7opdYqAZ7ep-e@-Z^M;(2 zF!i(_RTcsXESLxO&6Y|LPyJlT?Kr4y$>6`jTX)*t9AY&z8LFfo59qG5d`N2~z)Ed2 zq>Z^rzx5O=ch}X!?!tAcA1@PwTVd46l>A;V71siazfQP~eK*!B<*ns0T zoBwtls3BfS-6h$Df{iM9o}PL(9#{k<1ThnEc+P?d*Ji>duA*jiHVXccZYkF)?Lj0Mme|&J7KcGyeq4$Hxa47!W$|Yyb*{v(A960mRYH zp@;GM*K^=$Rt13fhwmMyB*|FY}M!`(&;AFZ{0bo#x!Txkvk*HrHJhL^1-#-tS zvNbOc!wFB;OJ!Ga66|lWL|ggM-Xz=Q5hY7_()qYOs?dt9H@D4&(71_ZgLxp{!_qft z`Ki|%3pE3QH(52K46sLRMJhEDG9&Qp8uw3X%oQ-+ry<^*4P0nO(l8DKF&z2I6xoEY za0!!z8~FI(w(mg2;!>*PL&ei3wqeLxKkWD>J)WH`)`g+C;6yw6oZyzJrMUB($xg(j zU%txk%nrhTWWi{>4<5q`dNv)^j8q6d%BM!gYj*yN8bIt7{>(VdOwb3lbUz>O62;Uh z!sPhx2;_qteo|&}DVEg7BE+}o2G?BO_LWb;=_mbY3f5}9K_S>_#|=+r3q|=9GaRR*}Yapta*Zn$H z_L%O`sdsRXcRGhw%gw6NMKSxtLCyJ7hfq|c2LUl3r_yfqe*Pff&1RT2rhpr>v_;AD zGD93S^<7YWOs!R>lME8B=4i(rlb>OR$A(V)3%`3@SQd96&_jF~dUr7K0b)cD?*z!V z;<#p*I9?$PG>~Wo-2lAw&JhM1!9I7=J(b&1m>)Ic?Rt&}?7rN!w0js3-|vRW1@Df6 zjUWmc4onC-ixUB6$c^&@mxKfb2gK0;R2@i9hx`LH9!Q1!)%>sAS_eq|x+-cougrjj zMuZiEf@4T6=@kv^M9*A@Cf4lTS1oQ~skyoSnsw@U;Kg*A1G!r;KYyAXpC3o@3#IVb zAbe|6NiBZ~ZPHqvRV$=T%XvuM!XHcN@3I?yZD}rVn4Ln%;i&+HBR+KQ%jzMl_UgR; z0AXdJKvFQbpccat3h^6bj+hXN6Dx?)tW8{xm-1hIC-E|VB%c1FsR!ti1+%l4lvSH@ zwAst}t%3RUc03N=RJ0kj49Nn>f71Fq$U=DWZ9`BQ0CS+0#f0U0wnfv`cl}qs3mGaj zgxQG1^p(hUU4lecvaWs0|JR}`_#j+}D4}6oMOP$&sLFYr!&Ov;<1DIjZny$b6H)JGrD8+$a! z>HJ&GAZN-F=l&!nxQn+^;%7Jevxr2Q*c|1UxjvmYsAF_ z!St58QeaoMP#{Hg&=BKvs%if{j)(qL1-h78>-;bGX=*0?*tQgV^Kaw&d}uJ>`f?~E z$1Q0&(UPWpkqCEIMDWXpmB^9#^3p+OB2PZ>REL`FUTS(q_;1mKzwPjkdV9@$1>_#G zhQJGP>Ek+Q4)nR1IJq)SbjR(B8^Db8BsC{t-Lo=Swz9wL(b0-l#@+iwI??PMS-_il z*3%6_c3#*(oI@x#W}WI=2ut592$InXf2OB=WunWRq<%>{*L8a_O`@vjy^v?MTd6to zAqljfuz_S)XV?dtxa4>Ep9OM>9IFObNEtU2%#Nu|OyA4|G?3VTfgzn>oYRQkWWB7ff8@M)0%s_cTYJ;g8gV|Y>c#Q{&9I0+|wr%80Kk;#de)C z+9@`Q?+~N!Bo-{>VhTPmt_z7NLsBx8Ts%U3y|^f#H?QwPN7KCq8~osg+De~BL0#_D z8e|P&xIh&f^9!@l2*~zxuy8fA0W#??SCnfg!#{O}GVta=K9@0Iv&vk!x+u_MK|p1l zBvrpe{n^d`3N~`rum*5-FYBJLk!69wA)0>~kcGu2yE;Z8el?-1CFZgM3Jm53^8%*j zdAt=Mwl15Xf9F{L7!*|@oEJ_PoZyh!bGl;^Qd6oNXBA}-`c`cYjsES_?$63(ao6;t zdIP`vU1CdM75A}Vbid)uTjk=*6;BMq9X})AC)Z_fFW5{vTGvO}`kD6nsY`90TCP&W zPC{GzmNGjiQXbz>t4FQ-5GFO|ttnFnHMwcb!t*8ud08)kMB_-xAL%pP{oMr<%<529 zT#jxXFxtCCbE{Pav_6B2+{J`=Urri#DuqS9IOxKijBpN8zjLP|HsHX%Y0v{ra|oJ) zG00t#++5!^!LJ_}8 zI0u{}>aJE-j1j!t=USDOMHXM;Q+!*;=xb%+b$jyH2Z z4e!CRd`Xmk*6S5?zHm8rze$~lZeb-febocOuc{$?9}6o^WI2iGKZ{1*#{RTE|1+J` zsAXuKY`xD!0?wz~5yZ<_F@)CzRli3uz zVeV0Xs!(XSf#SycX-{zCXdcZi0eIjMb>3 z7w?oacT1vdv+DbD5_ieo-i^95d?Pg5#CXWyD3ww%Hf?Ps@KCR{a(GZK*v=63^PMGk zri}o)lDFxyO5ciuW@#`<%uMeOa9G(1+_=~KWd89mUTn-RB9BY%e)$j4FI^9|pm+?B zSCxWxj;r-~5sHcBmfrEQ2)rvNk0+Xx%lb6tZ2$7pfz~&ImQcqC2ufete&<{Q!~*<{ zNw~dth03sP03tU51Z3U?Dx>Yj>LcM5KM@Pu-J~PXd39aL&R7MR-%I8BUkyTB zKyVqrU{_}+S4iXmd}*y=WBk_Ryz+?~3O=YJ9$j9F`l;mhL?@)sGtcL9J&}yNHD)Ne0p=JUEA;^moR z$xF169ey}Ao42g+C~_&>;!d*m@hqzTfWa2*vs~{QzEfcLU>9?CTt~RYwM~LLYsIbh z>r*W@G1}}>_ZBGCefeQEKWS9%FbvC5q*OdktuD*2K`YzN>V1ietn|1#5iPA3WMVcb zI0NvPF8O~P7&rtnI3WK~^gkU@5Myt^JBB+sHIVmte)3g8gj84jDTos=)&Y8v1;hkm z$fL`n38%V7FJ2Q-2*IePE-nfo5dXtC#APWJXj@rsN&B{{t6u%1LJNXNt#|l6H?lvD z=jty?TKJ+5>Mc8~)Fi>caBhdJUuIraHjEb%1z&Rf$gK?6B zpONr3Vx{md{f!m0>#TLrwm)6oHB~R9xB1;tXL_$)(5l5ynNwOwNQ;@yid408Vl$df zgdDR{lFKx}&FM>B>!py4UxYwQ)?lv6ZDefqHtPkvJL(53s@F(AA~z}@1TKLNcmhs( z*=JaCBtRhhPl)rcIe)zVDRL-(U@3*5{%D^a#f%nYmpS(Cfpp7K^Q7skg1iGOcrOMs zA}6>v-+C1aGpc#&Vpi$pNpqOHo2=WmVLpK&+Ae)zlL34okUaoYQkmJCxVaf|7&+fH zwYM?5N_qGdl>m6RUvY`Ef-A0T902AOHoyT{_;5fLKI}yn{tbeeu^d|e^;WrC+QTpH z_~rhJ4Z(xIgTsaDqhMob0&_d7ySm7PxX6z~#m2ilL2(Wo7yL5#Hi-Ak#Y4pgUnM|X z_B_AEe~O{l#?=1p$M2uUH9=-xDSN z|MX%12_c_SBOx*PaOD`Im3@%sS9<5yCLl@D%CvaO0CS{;RA?TCOZR2(Nk2HsfO4I& z?2%Y)+_z?p#_C4-+S9lIM6InI@mWh#T$52_^rGqcZ;Q`Okp$JTH)RKP)Wc|3nc|3Z zH^1aR?BUBRbwcOP;Pl9GrFxllR zTEVE=7dHtf`##1@I#R&q-q5LZJ5zx2i{wg-?1?e)PAj(+9Hf9%;as;S4wO*?Va|w@ z`=8X-X>czPvIZ3V^iMwWchUy|haN<_SiNY&lV(p%f2H8%?5HR}^vVv&vE|JpS$;ye<<3hh7IO*XA zId*oZU(RsgxJ60#+*a!@2>G)(-!aTn4uFEc=E`2eW+Js5$jEebnkbD;@Z-C5mUhp> zVsA>`t)7xRubWRyF(jSMUwlZlWJyB~FnaptCB4NybQuzn^!(A0UxF@@4F&pJAqPhR zbjRs6goh#o&ELAV7iLAv7E>q&hRtz#g9nm66@)UNVmrmoqRr93%oaT$lz1)b18*az zt!z9P5Mql8Q$~Z&S3ev0A=H8~`F?x&ykRijJ(e3U=T9DoFgnnaqoek$ejuVHTspvV zx>29}e9YgwtoUn1donn7U5!cv83_A=2U>5}$m!@pG2R#->=;0n&5Eu~&qOGx~Sn(<;%)%kaA2Xr3x{eg%kzXRg0#4rh9)HC=w%M82Z zMp3bEoCRbqCv^5bUu_SAjem8;^-PV60&>8Nx(L=n61sraRTK2zFol0Yk7fQPEZ6zR zMdO89Whw=6sGjiy1;w9kj-=>8BU8MDPApLZHL86T@3Dc>%3hA4oQpsZfeJ<*86m#c zu`tZ+U%uw2`0x1o=Gp$*&bwYe3L~oelTHF zcRRErzf4ZSUuaa>$lk*+PoC#t&O6FAhY=j2Slgk~;aVJX{60N~9QKa=Psih^ViVxl<;+&U1tPq)=82!+Bxg3+^Sz_r= zv&r{}#^Z$@*?P!(ld&sm2eD?y!X>kHmJ6nqZ^j%&WA<62!)vZL`pa zND6tYC(x!X2FX0;+1Y*LZHzZxv5qn9SRsMW%O*RsBq_w$%&j(hTLs}O>w1rtti8!C zf=Re1UINUwgX~H+pW@t;yxEgR3)D$WUAXjaV?o-lzK$9R9<;^M zj@lvFq0(IXc{2_A=9B)&-ZW057!-ltjmhL>hk1y$(_Yfyf13vS*P?UdD~*SV2DCjA zc%fftJl79e{kNgY1A?@ITA7ton%6jdSWs~2ztZ>X>6?G1ck=va(>pKf6kxH5|31C* zSK&Gj00Ea9`~aC-XZ!u|UM6t-51Hn_*m0_0GAqP4IeSmlE8_G%UI+ZzLLrPYI$|%> zofb40RTj!3F}|MDxQ_!}&n6Uq=KAC;SNml=DG5h*ix~TmvEox)=J>s(*16LvvVdy> zFq%)Ebnk$VA2)ygj@0{b>^np9e6uh@aaLr$bGbLSWB(fzjas} zD3B!#7;5g@qL#E?$r{S@_Af#AQ@PNIqXg8$J?RJY54`8=*LbUTEu5nRVbr@jeop5L zy&VNE>4{1D@lNgayKFB!a$F87HPsbeutD}uob*Y5THo^^b;I3HEvoPL@qQ~-#uTW3Izp>lXc^4)RH8+lj0D7Pk-a96XsDv( zvvPaF@g>psqt`r@)Qsg?u$1)ZvUdX;>1XbC#IC%<@CN_l8Gl)b*@?Ys4-5yN3g?nx zuBIoqQ6DD7{j))PZBe<5hG!zrh}ZbDuwWV?MW3epEeL7oHJSbnaFI4A*+7UU&z zW^Ad$a@Lw~$MFJNtN*H%QrEOnLE~zlAvAP_yI$vhvl^=?>$R%0tK-*g#q+8&E)WNh zRl~s!=7LnZUvGl`UE};y1Y{~KwF4_{W7qVafvfQIs~eCiB<92x?uwGsI(S?Co!dhGJJPa@3s%1)e@^y7lm*YDutR#(cZ!bCZD0jn4qS|Fp94vz!`uokl zLoXdH&A-i=o7J0OOsB;qCR0dY2+5gD2u=`nCj45onke7qX$77mIRQJP!mPZ|d?65e}?Cxu3tfh-l?#28}WRI{S*_iZLA(K+KmtdHv!9U77<+8!uPIsbUU z8*5Ipq{tUPG7u4}?Q-EwKL!OC{|P=~XLKP296t!i`a(ct3TA?ahDHG~gBUNpYGD5n zvNHzJ?e`5xE|rkg{_YoPfC{J7Q$3RCd|IX6$v&J8GRN=0TwUfkLF5*3#UN_1)p-N8 zYE3c6>WWToYYwIe^_P95%d;st5cXxF4?i7oEmPw?+Inf-NVHx(mj38{4D>e@p24T= zS=2eMBkG@DITdKW*?P{yY@z*33yNr;>v+=_Y|!0xQ!phsG9{`@N8e{H(3$hYz2)kq zr6%p2iRAajS-UBzuF;#JFsv4FMUAfmt>*g2bM(tfi}Gl25Hh!v16WW4N$>7)OmB}g z-E|PsYfd8tqiar!V}c&mz}d}dK1&YLuzEHV zvo0x?`cX3d^Oof#%<=vsIqI_ck>B(ev_0< zcYjy~=d=Q+TV2jre%kjcrD0}C&K$wfSg~D9>8IBW^&oNGR0^Mc^iNDMP3WZVg zH%+NhRZ3%wnz!>3+n)weFQNo|7@Qnj57T(Z&A60go!DpTDuEevi`|~4k1FUM$|ht1 zxZM8J%hkle`I0~Ya;nZE;nxf?vMWOjjuW6%K>+*{T(}b|N%mU=A1AXECsTLs#^pV^ z4*ifM&X8-^4@AMqKqTkHDDD|m02voTp#xRN5We8DkQtj;TNRiSP+JD1lL9Ay6`7q8 z4geQ_PLWcd_qtdn{skWjp+Y$Ue*&l)15CKH9cVeYfb4Ln&1!iG^DR0aWg%h5>bQjgOv?S1uypEobVzwQ{#J z2#RCK4kvz_g`Vc%af4p_y+u`^T$*?8;&X675L110rwBh*_^Y9UaBkzGNl=KxTgO+J zH{m!^jg(Dvci$g9EdM~t-?lz_V8_Dgw=82q68qUi;-yobTxn93;>?FqP9Im^$D%I< zlCb8_^o2ZR%JBXlJ{=?=o;{wG!;7Df59?-GI6oR zNN_HY1@&JG^7JYf2qKt;B4>@5zK5%b(XZcVAcoW{0zn=&5FlE4K$s_-=30>F4>4ua zmi`xE9_YU)03`M1Aub;*G_lopIg%q3W4-(t#Z=QHYBjp45Obw?*5|UsOd0QfJod8U z+9Tb?YHyTTxp9cTApClup-iJlrUhnpUWXM|k3SpFUwVq?qmiP=P3~6msr+C#DT+d7 zhteGA0AYp^sKf=J+RiO1$~@--(|eMK%&(hA{70O?>Emn9UX#V|BI9`LQep1DP? znC_juG)k9yBam_Hupi?zhL@yeQC@-XL`@XjU|K=!P2xru!i@7!MNJL^0JimjJ!OrHu)p2b3M277mEo8>|PBE>|PDCb^$`T z6^==SHQw@~hjgXS2{6g8e+Q7XzqH>$=wEGgdA4FhqBfw5s0}a0)sB~EJ7N9@K^tyJ zm=H)0Wx2ZIvU2rbpwb!D0m&T&A~c-9RtlH7qW~lUr7Krd$N$`^{}W)nTQ)S+CgsrL zW9K;D9Eyl8nUI@9i2P_C3r;KMjVDVRWi?~km1>iyiOTP!N0W8Fm7Htd`6%%wj0J6Y zZ*kP_@l+!82lN?;@Hv(5TdXVU0CASpNt z)eYS2dSP|Xfa5bP)|TxnwdJuEZsVk&RueOOJ^X+LktDKm^zK{q&XGUg(AwJ@!_g>d z1o-cCB+1M-lFm8Dz#BytXYO}@`Zy*c>R`%Cs)_IdR{9PF;Sb*%s2HY|9vU4+p3j72 zq16P_Xkb04bxG@Hqdt1CHq`P9w)U6e$00X239(opkiu~RDHqi}7YTg-0#1J03!ne?l}Q8h5I~X` z;DvL+E!|yP80xatdwh)}g8}*djvyEyv@@hYLW5Vg@G@}&U(~W9q9MvS0lVS@CGfxo z&u2YQ&@k216n;x60fX2e#tRxfaOTYDxybXoKJRN~C6`<11Bt<4b|C$a6LgmT#|iA~ zdDZ;CJiC9vgGvG$e)c?~;?6OmkHH^Gp)?nM=Mzi%5~;Spg}NnHwi%9CIz_vjCAoh) z2Z^hnZZj%cO?%Vy{^_nBrX5(-Oq4%rcx$U6hH#t{@m*^#LSVOK^43t`W2!~ujo{Ql9H+=xdmm~`t13K^)SD~IV7!Y||3+gh6 z`n#V)kOoS+P!KxDs%2qqVQcZ^gE(a7M+O1QyNF2E4zK-e9E}!MZ7m?eeOc}RnB(SW zc@gK*?Rt%t;b*!MVt5CDmazer#XILhj0}~~6ggXUzsu||-~m#-Cdg{?U~CZ9nJ^+^ zqllg5I{_PTd6--tM8QUpI2)P5gw>7pGROxMK!}S1J3X8ohZI|@p7S#7XL(RSsRI|s zSqKmKpB{cS|34Y?pE#O=!X7B(H(>@W4mgM1&)sskx?MB^g1?tbsVsK+$$G7odut2K z{PZKqolb@E60#G8+YoJk2FomY$YwrKZcr#KXr8(8f2e!QfU4SVZItd15b16NTy%Fy zDy4LHcS@%q-7VeS(jt$U>O7=;C6J?AKF-5+L>5)VLdBUZE{iU#gy7?ScWFG4i;%bo+=z%C^ zX0zxLf!}u6dbmjkX)%G*&uS0RS*g5?k<&9{PcVRG|BVK+Vl;_qJZ4(UKOAyd2!^qB zvJOV?YjHUX;^qgo4+txXDVxFiGx7bSZ~0FkA_A$X%uG0N*X&%utdI^{)*5@TW|B3_ zKk92%mqF}wt@_m^==0^Sp=^5!g9n`$D1B>%LTQ}o_W*mL$LFXj`m!@|mB7(Ya-e1|LgPfx2IO)E((_O6D@ z)$Iu4qjL*SCKuZ2T`mSiDux;iDz)W5z@F-qMy4m6t;^B{X`&Wf9&5hZeWV)n30q*= zTSXVCr>bG}Me7?b^I$Zy3ztp6z_e6J`$%<`q>5G7H~OY;Y*5eBuopLmW>MJ{v2Q$( zyzEwMx}Z&wc5m4BuXpRI0mC#BsS9`lDGR&O>rHWto))AchGq=5^FZ!a9i^gtc`5S)34wD;Y0 ztPr|Vg{E>T((RheJ$c4jHgV#REmfJy1AAM1F*nVfD^8WupqujqA`Uf)W0xPNK_^Pv zw}iM}Ws-G>Zr>2t6!x}dty{o_B06cYUJkWa!C&jpv-pvSR-+J6?MH6gem7F) zb6jYoL~i2lUHWJ53Q-$(`6w@`3{uO{Ug(p4lEYfZr$XOdH7j+eHMlx7#jz8~SP{oq z&m4ol1L&WE{8n}r_F6!Q{?$M5FlzDp1<_DxKnb{HVEW|8%pEYu&krB1+hoZ@-ERS@ zpNI>G_DIIg;??aXes!k)mgN6+=njm5(0m_L02vj)mQ!}%zjw_7Ktjds62QX5r2Id1 znSVmy-q!+8*D!x4lV46Zy3b*Z#sDCQ@Dl(P*P1!3a;im*C z&hp`*V%QbGD$P37Glno!83W`wK8*{S`Nu* z5y;XvfF^y@ERMh=ncYUz_!2^4v#dV(LKt5ceO3YV9hiMpPa3a)QNy!FL%}Dn-cqw_ zgza9a@+0}#269W-yFGhrMNB_>^2B<}ku zgBWlLyKP8plO2GdK&05dz>!Kl)4dQjKVef~>QVa*UN`c6(mSl1iXnupaB}~^iu47` zP#UgE!lbF2W z+q{o|yg;LYU6|p2_ryFGfQ|<+QSLbb@Eiqr4*%foHYtJtc?j(Q&&Xf-axj3WAGW7A zzq!-BPLw{7Z2+`|-*L4bp$<^C!q&*v&K9Ub1(fg9v$WMR*8xgO-JYsP_;(xm%P+sQ z0MbmI2%kOp;caL4OKUA1TOhTHP|j8hsH6yN7@`Bv{<8*47~yWCOpZh-nc=wO0uM*2*`*)#__rhCaJwJ0D6 zui#0riay4~lcOMyp_%XH_HCDJX!!`U0!B~G54koyD5j3Hg%DGf6_nsd5M`gY7pERP z^Jw2-c*%?!OV_$^vriHr!mr3RtlXNarL8__wnSEL&}ms2*a%rl=gHDlg-vcqiw)194K>Q`@T#(yO_6 zVCH3r9zw0f!z8R4^}cVOM$mn8%LD3C&m7g8SVL7o4G5wMLXr1R&Hcsd0(MLl+uJRA_DaA|`aO z5N&3R8ni_l=53#rZ@M<|<5abXw5JjGXh^qGM$BS<7@?-DM+w4+jEmQdQYGnErifLC zhlGk`#pg6)+00AP!V6`X3_%#R<#B-}odk6d{lxi&>0SJB_X3#~W4RK}qWKu>>uSV2 z)XBST?PpEE##YN(-$?IvsKp&0o8d1l7@W$#HZ}+};HHKQ44_Z%V~@W|?%eKch7V#6 zU=84h`T`spF3_^>uR$oUr(Dl}sSp!pIx1k9<8rAR9?upP0e^}}-4Tk$n zKY#_;Hp>bWd%9z80681Kmj4Iu#0!-0;r4zvQ4AFERxldoZe~plL+ACnRW^ig5dwq_BM-2V@fdGi)BKetE{%p>ne$Z=TRr;E|i|Wb0QWd_l=bd7l2NqiQB=ZTn);! zjpS9rQ(y83+#IlqWnRP*7$>h<7VeFtVdjbkqweG0!wx&xm_q^b7=e`g=V7SLdXeW*YyW`_p;>AMo4k4<6djaefcV zt3N5qkjcCO$%9?k3TcH#hlfg&iJ<=2FJ9-RIl)p-ojxna@9j`G9{2W7i`^At=5c`H zSJZ9}QLKeC;N7a2A<`%4l0UcZ<(A|d_bhQp@pi6H?>J_{2$?|PJG!KymO^*W(N?1) z8wPB!K4BDntnvr@EgyG#;uGc{eWRW$<`I*hU&g}k9$PaJ0cXVOf^h(Xy z>G%xKcZoK->DVevus4_>0R+yUYF&X?5rkx83006vMHFV{9lx<2RPG8xTA~*Y&MjkuMG)yJ%F5=42q!D%Mv8?K^aAx0Y_)tU=2%M0#n~`I;=ARK@ zMBPEjPo~!$x#YHo|F*7po9+if$-`cLPWs^o(J{)48h<3+E(#MCkAopqXKKEy z8I2M`4zV*V*ernivNwM6)*`Cw%*-PBDsS^Vy zf@81f1n8W{C85)lLQdVx;10}%B}fV zWyK#w02nlAerqG3M9r^6Dloe$r(KG^?N zF?gVU_nSct%*FyK4iC$Uza{WI|0pZ|Uv%sLgft@v9G|Gqq!*8yuwper0_4gFczgO& z3DL}`I69GCxlT>&*>omYG;m>SS^jyB1&7Fbc#(> zA7Z~Mep+q&c(eb4dbuB(1J1pJ|P87SAu^IQ+D!nll~Ph7*J4ehUF4{b;j- z{fkT$5Xl5oBhBB{J4ad@cOonpY!AY{o;7+2I2TdZ5V}e=I4hujMBivUHIAk;wN35E ztvqN4&F~$t<|(o%fKRkTFcYo`i7Jd?t$IHYiY|(@^v!!F^lFzM)S;ImPurLAfE8xf zs^0->wi634fUn%L<~ zmHss<`b|m@zL%o=5eEGxCEO+&e%#ZoOx>;89U(9ea<6rF+pZ22(!LkG)3eqCrayiX zYJqL4zq(NW`rf~JR6lp7qqcZH7bVI58gi%235DN~Wqa#70W>s?jq>vJk%&H>6h3wtw)E%0mgs=et{eIw zM)0W`ZxSCl#5=j-^aSlfF@ytq2g?YT> zg$?up*#f|EV}7}~qE<>EiN>H2P9ZQCbTUIwjk|uH(@r9)s(xj@hF^JNC_L!rt&$!X zT((5zaZP3wP}I~AS|}SMkuMXxj7E?3OMP23(zB8_U?@wIda;3j=E zfF#V*!0L9fmi}5cH4t+luZ%^50CQU2;G3K5ZpJBFK|Qth)#shg333lPX!uLhBaO$4 zk+v;pDFBX_OO=}KK*?R9U@OtWPVBDr!~_scv>Qt|4HPLcoCg^Zvh+Gp#1tAs{UhLTsW!0hWx@*>VX?~_es}{vTXoatIs6Ukcy-C ztF0uKHu6Q369X~4h=O+)n>WrozT!DAJ@#@`#iQsnAmh1Y`RBh>>hyyOen|434%Os5 zRIaRaDV~H6W3$`!#M2)-eQn87(R@i+Vnybwf_9DXu3X7=2X0S(fSawBk%Ja+YN_?Z zR#8raUl;~y53DF#12Ihb9>X3HBr7S8J^KhHl;r_qw4{FW$2Sb%eE?_juYryS-L3lq zhd?1}0qp!Wzs;ZiGr9md4R`E*#yj;hAj|*v^1pw9e=1lckkxMWrrYJZoc5_G1$GVk zp~A>-B^|7ZoCF-cStIG)c<){OLt1U0T!{4Q}LMGY+V~ zTzp^7F&vS-!%bezXPc-OBBzhUSkH5n#MF#Epu*NB z-1R#BBIc}jfmiOGsia$?91OfE#)U!W$D*&9c53yz|Fej^w3hv)Q7 zO!<@-mXdg49VIl$X8PIH!Mbi$gvQC7p4FjzAO;d|{c3yluF>VzAzDW@@Px+To>3%- zxTYc670LUdPm6Kx$Mhj5zTe7lR%;rewi8%!na!%sFQF_f3@c=-88Kugcb-1wJiHQ4 z9IO{~G`H9nkT;IoLoAA2msMXMF}9vHKE=^|e3Z3ZZDo*8u(2rBD!_MbAOdWo6y>!_ zDqbP#)}l3o&h>diyCXxkuM?JXweUK?WH*q+tZcQBw`h<%2HrRLiwQ-24P@e0eRv)m zG%8rEG-24@4I=&`Kj$zX$6B!3r2aBkDYR^yDpCkz(#P!R3k585$&g|RWYG$qUM zbV>`u1wBWgjNTt6beDtY^AJBL@9I+r%)IckwO2eYuJC4b%yhQJz>;2~?%FnGixlLN{WJO4|I@a5!*aJSnx30AZHR?KRtF@Zt+~gwz7gp&Pr{p3Ef!n46WB zCsofuUDwaxZg5tNjhY>aazEyf#*K~X9|n;sAY1bSs4T#5 z&%ApBV$UMXkoZ}|S8b8B6o2V?Ox$bHC+{o#GB6WQM}y~lm5}Ge4kxfxSLu6hoR;y#rN9FV-n$Z z!EZg{+{}99q}5AK%42n0VT>PUCSKC|KL;Gl9wFDMos%=wIH#6Lq+P+4W0qT{t* zf9~5;PlXnW&!$j!SpEqRPa>^$@H`C_VH!0IHcUPooJ(|Nq)TtUM#6PVbhrYZrzmB> z76fUtQKqP6mZqi6_)zOVFm%Li5 z+LLu*O*53@peZ_VVxDT*TA2#&pEAFFG@r7ikj6@!?hgS;BkEd-Tc=H>PuX3w5P6&# z1s-2#>07n>d?Wbf<-}~S1vJtOymhh%;0bgzFD24dyWI=9QQL${Qo0bZ@P7ODM0^F? zBuApMJ=%Tv)Q=-Em;`(B#Ln-a?*Ymc;PL>Va9%fRmH|B*Z;Pb_1WMJI9LLfoUr0xgRxuG7S$@ znC7QfFR5BZZsTJy{^S94GG(t;z0Jw6=2lupkvJ%Gp(7mR8xi z_4cF^nXPJ3cbcp}dulU5H9oB!X7*}za%5Cl7~xaR$EwG>l_)nz=vBwZQ=c0*m2>u9 z5$AE~$$v)AZS+g|;vHk?Y~}fO0e)cv1;-Gk*C=Hxg+E1zf!uk~AI^$*7^_WAwdhe2U=x9a`HdCEq+49drAlZI1m^}8U?aO*>58^`r9RtO-fG>)GGUL zU*MlicdleT_9cw>>&jkjy^}Dnt&U+D6F|4h)sZFl%l#+MYp`o$osHuL+6YD#o(Rp7Wf$O1?Bw$HCvq% z9R1bHMi0HY8W|n$&cy(&4GAsJEm@Pg^hF75%GBo>DF~CWAv_p#_%noaDxawX3+Ngx zi`wC_$--={+g*$cm_`9_Z&nP^T;$<9M~kPSJwm?4rob*Z zaCwEP%C{f8Ig*eVjQ3%ZtnTypTq`;lN5Q1|J`dfoDohgBsJGGbqeLv~YO2>uE8K~x zdtg5%$^92c8GXtr%XFc!I-gpQ2(!ESgs$oP_R$}Y#-06TVACXGfT-r-?@;Qqax{B) z@Jh77zKJ#285%^Qmo`)WfN?F5G)9*CyGP;`6o<#MJx?`Fy%dj{j#FGX(hiP^Y!p!zwYxo zea3txmA=KCCpMxzPkZA_S)cbWy^=WYM@Fz_@c+CgR4-?3CU{K#JVDl=MzP@9z~0Jn z3NiiFV>EVBdf)V1FlB(~!puwP1~Aw#kWF13&BP}S0bQu8L$2XLXWR_IdX?*M%3j-V zv{zHIH>2y}cAhxI7{diSz>kN+Lxez2QB}k3BzrM4Kf1HOpL|*1kj#hj;1Bt-M!zf& zQWzNB@B^)o>fQox<-vzynEg`WkXQU1zpIef2eLl=rV)Tf_-`wO|7=|TEeZZVrV!2m z1d+cNX26hvb!IR)FfX7tS`?E?n8=l3xC36&R1lHZ_MqyiMtp_B(kx^Za`N@`DpF>h zN9;|`mXx*M5KOLt7<_r6Fh4SsE#|wb|a^}s~D~;0Tj7}Io8_~t0rDXY+zJBD%+9g*}?|u?7m^6TS6k$H;{UTc@ zUNY-KeV0hrnNY(NC?D3tx~`1?PyJ*Xl#XGNN8&hz;{<~*YBwbu#_zmICs&zqtH)L_ z`pncwmZgKr;!*)zmEa<^QFL=nOf(u^`Ykc6*!-~;{(duEptZS&(#>m*GdqS1X^pLI zO6>_Ln}c3Y49)E?o6}P{-R*8*jR*2D@>i9#urwI*;&FrW3o-^UL)+$V7Q92Wo=Q~u zJz?z8DEPJ%*E5?X|LJtG-vg(j6k$&ia0ICc_WX)*MYcr3XGvf74|BK+R`PQ_LXjLZ z=F`7^Sv`((=G*`QFO5ZtYyeK6qIqZSpI3J2ZgZt$<(TEK)DKudd{mC6Z02=ryy}tq z9unSgS=6M%c&_@&fx&tO^Bnf*eI$+A&^tR{d%Z9OaHkr25}hJPZ&*J=pYEHpe)5C} zr?oE&7(Iu1sF9H-Ip3biMSRj!EbRr8!Bp`L)>hJ~E~=bOxFA0Tp=eQ4V6~0! zdg;ETL?^UFL$30#ioGtOM%X@ih3o(1v*5R{_2db{mg;%%ta6JYE)-YuA_s44 zdIhR`D9Ozyvbs1r`O!2_U%o>xE;qwQ$A0a&8bLjw7v{xl3RY5#%0Uss0x^b{?xB;H zxWDqD^3CH?>8>&YTMf1onT^DAnsk(}d9)PR!eu4p(pHEqiXx*%P(5-z71t*GU-;cz zC6V7)J2@+TQ5Q!lOw5b3ae7mE)LT~zjZki@TH9d}kQSD6lz-N2z;T3)u8m)l+QeN( zRbr5adZ73SOAZ`>Q;YrfB&jhLJR}455HE;mzjAIFcQ92C3~EDl6s^K%H$6-BodZ>l zVT(yI-%xJl#+SWd3AQAx1RP5F+P7i5-FBWl_y@YA9hfE3H=-%fC(L@8!*H)|jxlsi zcXNr!#3HNbKrkj1-PCs4aY_dVHHaQ{oE?4ugQI|M-yiK5p1*+AG`#~}ik}%JT3bC+ zJsUlpAC1KKY4dw6$KNpvr`InK1_x?MfCIH8zh$Jm|g>MB<>lb^jBoZnPekwmpb zFcl&!Kp8*6IvGlmWnDY3{z%U${`GNuQ3v+1n#MVF?HfdbQE&W;|1=CflwO2n6tLEv|Z!j?) z$KxeIjsh@W;N|ZS1z{dJ9zK=l@#LNqGft@3eZ;-GX))MIEZWoC58V7FFqep%VDYhe zl*^Y*5agX*1*L1>X1R=|bI17g9*{H98b>4pyM6(SYSIv;8bO3^4z1kLUV|bDoLr8z z7HI>By6KMiRML@cnevZS?qJ}jLfKFGKMkN{DKI+G)iBci84o=`0rlS~P!B|b8XyX! z{s@K;*5+3*#zn3}S2Qni_JBp~2cU2p4Cy^cNdVb||8-5m-y&qcGzt0d@0CzY=x5aQ zv)J{cg8p}1!v90J@lS?bgoNI=Ea;(H=6_hDd1i&0RXj}|6_9__cTC7msi=wY-D5Hj zJ(@v_tE!CBCoph26%N50!#OmpFmTODPLp;;&LUzj=n@`S%Whj*5r zj?^%>xV^VzZR4yP)qHBLKhCf$V5eQ|zj-h+G5e|_wYTpvWgTLyrYfqW;_@)Jx0tYE zEVB`IuIR?A&rSuX;|88SbMCNQQLDA&G=z=Z6_jsJHExI(V|@tL^>+Q|=UNTKD%3X1 zVW~ICw;h{Yd7mEEkTaWUyalZmQ%MDdOf29gYwfLe|G01A_xW7caMP1EYEz)*{2l&` z_I}e#gBsJu!+io11QzHg?yPU}RLq?BQAISp$0#70B>G~T+6<@-QRY0>5E%8F(GVY- zAG#ChJisy@NZ; zNBiLb+%@t8lM)ZiJmt5U7Xr;Z7ii{T_ht?Yay`8Sirn@5=1==(dSKrovcKkLAixS4 z8ksp+0Gkx)foZB+KL8v7=B^0N0@a}a%(oeihfBb}_pbkBeVvB;U8AEF zOm^g6_*<1t8>$QB+bE)13+Zp3IPwuKYo;i7>MVRJi;1|wG&3Suc&dFmv&ix+9J=m# zKhl;{HO(56ge44F2A4k$)`2H9GFuqdFv_)G<-wpjK7Py>57RzQ`pD{o_XBy+sIFNF zy(XPLuL2qK)`-#Np6vBvY`xZ4PltX&dBIl-hfr1UwDx#fAT)Y1<*l7BkLlJ83-ugTn0G@S! zPdfhY&Bfln=4TJ9BvonxJ&+v{K2c_$Mgi#FrW{Ei)Bq|TkN?#PX>6H5RfT`&VeoqJ zaQ!uX2?cC-h1K+X4(j(^02K6g#4HH(AJ5;NUHgLLM_8Q*lq_UurEDIyARlCXos3=` zZ8Buxb~7iC4BQ<=CNfjclGW)${k}^*X|c(AjRw}y!^uNzGO0!9{?(d$2C#rH$%pk0 zc`Rwr8{iVBH0}Di4uMKCjWK=GfJ4t`IA(F%Uf43U>gntm$*7n)*W;?ssm%B<2USCRS&q zm9Df#h`fcor9=Uc!a2f1jRkR}iht8jQ*$$L<A^ajN-G6dXcgE<%xTtMyeln{X-Q_$56{mThAKU`1@n{8ZB_v zB7p6;wR80UvUX@GfETnFFvmjw)7rbf46l#4lJx!YZ38?DAN+-d73c*4{I{kJjm9CR zrE6`ZOGs&>2kh^$vj$RHYzeh=b*=S)Qs`Q?gtu%M9WCJO9(^NgGp)Opn;%E1eqshB z8Z18>11l3F0~;&-kCr(&G*o^;Lcw3ZNO&hbM*$$a0~9p;pHf11_c7IGPJM|KWc5zwP7vQ}(E3?$z)zN20xOCECL4F!bbxh!B^PoM%Zc|p7dkB&@3kz z=-}+rl86ueh%mrc9yg7cE1gjXSFHKINLW_qgMOpo{8otf%slWU; ziZEt8Nyehs%UHTNpJtk_jOM{Ol*ijT-@D@i6fxqrg~4Opxcu+~-ZdSB`-JK-je|(K z*3e@pQ#r$7k^(YVtDN&dUCBq!kV2I9uW%Tvs5mh=`KyU$zP4~@rKS=HzU-=RFm;ZN z+xha2;37$;ILNY*BGszJq|h}?|J#@v2V&{S$Ka99VxRv7W7q2=T=^1V0{ zSf5SLyw_b{ooOt-)b+*V%ISid^|>+mW`fPto?anv5d_Pl0VCU?{pl;DRr4p^lIjPo*$dPdNC4Ldpxz=j8Yt)u1PlNQ_yPus@E~ba z2iu*5KQ(O1VN$#;zpoMr#Z0FTxbN~Kx$pAxc>J%}VAS-SCAD)SDQ2;|vvQ$7PTv$Kwd4Sufk`7_Duh)8wj z*5EU^Q<`LL+>@d=Guia`)ny%SzU1eb##NI#fWh5J)^h!4u8^l|H4<@A%q-7MGmV5!=?Pz5?o4x^l1`3UeAr<_~CItKN{i-^e&%< zoaeOP0VEFNA`(t!C-1g7+%-`gkJb~5N90>n>xra~N9jCqg!FDV!OaEgIDl`HVzqyH)wbsw! z%Ww#+!nE>spHi*02!#bi2?dNyjoMR<%z%x2CbxZj#zv;VaSw#{dW6r7oXzxX?^gVD z?J0Eh%QfVqLcTKWoL($keKm>w)gLCeikj+>zc#eAc`Dk`TdW5Nw;9n=2NC`p|K{Qi6cnjF!?GGw!VVH9>r+^D#aBW z>OD^q9E3X4PUH>yWEz5K^1d$_ z&L48ym3hA^^Hd=M9Ye0CMjuIE^81;cWY`+2Wry(Z#K-SAi*9METx=jo-bwYGg8I5w zdgz<9{NLlUhh&g{`5S+3Xb%z}ca#rcSrL+z<4CGTcv0AnG_=}5_8ac_qe#8O10|?T z9(<}TwZVacH}h~|&mFg={myjCAy6g%6*(2B84%~ zQ%MKn&`@vc-_u=5OZtEBQ_YXVft&{s5%==QVhp03-ewz~Tj5#1zEGOc@_8{NAA_ca z#uMsc)D$UN#Vk0aT+gk#TOlC&g;N0ysuXtWO6P~F?9CWUUVey$X7c}`77)Z-rc3%6&tYHIkP`_-s zAx+LVg6;}|4bj-Gl45Un zhS?GIZmWs?wOf5(7juyNiB31LEZ3QrJP*8$71wYm!*jA@*}_ zARnl5iZi3YLKUyt?OTNx(>9bU>D`Vb@MA|Z)H5~JGY5|9($dk=)ib;Ok2x^u3#aRpL&dOgq6$CSImjd=1f@9t9RDbU#_l$n9MTyGN3juB= zmm%QLIG_Kx4?_MQ_dy7}4?@`=_W>MLbFUF`dmnclF8s5sR0BP@xOzh0J-4VB8A@Iok67YZPeg9LAD^Ct&i7xvjnc~J~dke9R}54|CJv(uD3uHlD}gq{H?E#e49uDeONil z4i~sW(-J31fyty=8ApR4+2JPxh~A!y55WiEdCvua^a7_du)cfIvjaeRLD1>x-oIK{ z8vr0Z?~ejsZjXBYI0}5dJ^BETfA*Ub>^ku;xR~>nzw=`i5SPYf#Shm1KVm@3ya9Wif{8%iafqocPifyuo9sZ$zv;e2@-Skh}Iy*6Dl`H0vFl_DLi zMVW1UwQ{1pfypKPUM{(uBWW`$Df~&bl-E20(H&=I^15;@CMn5k-&r-mWhZtFB zY*lhXyi_UIcX5zJ-I-K&i9w37+B-b@ITB0T&dCy3eflL_abJmkn3op&g*T9Dz$}## z5O4T@;LYFWI7>f(8|fGHcmSL`xIuUemPopHefS1BO?RruYp$x7(WmH)U3EK zD&Nfwz15y(U;(fJb4Pb#jt`fB|LN=flOs9Sp?=y5{ng<@km%^>*l2l&0dy+Ek6>8| z@xz*(x9sKyt`_?9dOYavcg3aCG07Wknh}0plr~APpl&2|_YkOA#i~~N5#H?Vi`Ux# z^bSX!c~`qFtsSQnXr2x4Cr8)@F5|`&s(7qd9nt$|$Xs@~rCEf?Ied+6RbY(Z!F*=- zwa8DbC%Qx)%5)qGEm-AdfgDSzh4h1`l~b6|OGDBqjoJ#7eJXyf4E`PxmXX$dhL?|| z-H-etw|s^}8YG%kL8YO&rymDK!DVjPT)@kGLxaXVN7{cnD39*SwQyRAC19Yf?l7OO zuvI-_gfYTVBD5{up0eyr@n*$tEWd|rZO#O43Rx;rI`{n-7rFx_P~#fJT4+zVAT}Jf zRk+vj+&e_yGL8|R%mi&Qg(Okqf}mpr8+s2}reeZ;K`|WZGLilANhEZ->TvwE4gPu* zJ4EyFEZc0Q+?Ek;y4$DFWgN?*gY>hD(5J%?22kSeBc@eS6^!#*n`%w# zamWl~coJN6%Am60um^J+!Q)VTI{7He*KMpRk7ap}7JCo0A_uPwOvYr3n+*&21mC}A zmUG;b`>rJbt^0Y*B2khJQKwM5ge5551`hFJYNzf}2~8N6X3tP7W%{Fn_AjZ4zdg$?4~Kc}2(M$2q{9!Vl5MlK8Aa@W zP=lc!;?hq)QBH&C_(Lg&EIUm^sVPX;ZXe+;)Im(jdM0qz*^|qf4FP4f5!OiHb=t@2<6=gIcpyX8Eh?l!OdPI=(n!miI_=rYnRP<56A(0Ffpj*?g zM5F+3n?t2EYF228A11wZ3vcx5MfIrYz+?FC)$S@62RD8Kb?=VqckD5xyfL2q7Mfv; z-_91C8c@6TV0+b{Vq2=_JZoO ziz;nhkA8Jct_rG*ZxyVYwxi{Bp0Q>%9+DHnRrdy|hjm*l?}0;sATeCWW;KG37mbGr ze;`cDW|qlZJZewih`I+t_&hlb%k%bgHWcO?GH==g=jO?)kn5}-VH$!@0dmC-ND~S6 z?IARH86QTr7>Zl+3r`1~r8d7pFFrpd4k^t{HSP;3FV{TEARZvuj8b+snn7;ndtGRv z^l~C2e!=`Y7}SY^1bsFl*#%Zgc}?OuKpArt&TKVweyDzR?u|K-SF0hrRAro^zILy8 zn0nhe1w@$>x@~-KQxV}TxhC%BE1B$!jpYp9oExp_ePtI}1`=H5uVtx=p^YdXD*mXNha>ncN<0f zniHfj#Hzji-t)81k}GXM$=hHIH|EXuxq76emSF#-05)HPbDoZZd9)-*%((u@&VNSfzri{qcJxp^{n0{!a4HvuF4qpIWm4}S#&VZd#ynTCyX0~1&~WJJp6l0W zL;b|3_LU*O)_80L9bF`jBx^NH1v6f9sYoEhi=HLm%lgG9h?wU=pdG=W{VI%5F(Uf5 zcrUhFtLrKewR&~j#^@a0#o$tt7@GLLwzp(NyIy#aP2zxgj{WXiqh41(?@<@V^kzpx z3j`gl$TK7THk{DwEuP`-sAhXOGQ>O=Fxq<(toDL7AOV? z-QM5CIK$CNUVH+^QIcQ(bnMYN@UbQILBsV6^ZrF(Rio#DyI!f3UZ>8K%HWM(&+Zso^ zlrwbn!8{rvIXFd=wm`@wj{{_yb4lDWp-bVngUHi#hqc5vRa0jxN({g&2xiRGj0}wm z)H$}^7&UZo`bwvu*HxmwXp44M9P2V&H?2FQ(owIZ*`wv&R@R%(Q{nsgJl@kRg#e10 z3$-!`IWe7dFFSbDd0wJgH%2Gg=cD)+Tsl&JM$MJBJ8*vbBZ#-L)zY%n(ABfnFxLbA zYYGgV^~^Q&?0aB1>u;R41>&?N5T_OIaT)?7E++VoM-8C((1Dix*?$IyfDRNk z0TyzB7bBGZeMx#M0L86?4UTXty!iLygu<^La2LjJL0jKavvYrmpQ9d}j#laN)42m_1= zFmRgbQGMI(8H1ZvtzexO$cbhc0P@{}A%aKm&)VIe7%7Ze&M}$;1DY$bBbB4H_z0@Dml>(@Sa|zaB1cjFA>mZ=FgMd*$fBDvz>DW=^Nbw6)6NOJ}`z4=ft6_Caex4+f7{Z$HnsGlTC$2 z(3QF%Xzc6cv7RN`8A(!-lTD5spjrwmEX~=dvmO(fhJ`RIcMX$l4!1Np779=*>Su|V zS%Qr{I+KvURPz(}?|1JOE<{nTB9sY!79bkS-qQb}MF5m9{y7o6NzTw!%*bGqNV3>G zeD-@{X|{n@EyhORnWw*QOWxIEiQ={|dtzJhU9CSdzIl7BskgZWomVTe4?JL zzB>H3aQnIdBrGn4^fIp(JMe;{wi#fa%lU^f-Qjk>1C9BsCh3Z5ACRa5(JsUx`wqWU zJm}%-%6b^b5~Cq_v029U!lI7>V6IR#%wVmWUCp1qMa_O4&O;+pzBW%Uc7>dFJv7~O z%MRX|80%BS_?AaiZ1dcIEwS62Dos}d3+=QR>d}qN=R_$5vKNu@k3i+@_R;z}vibRk zngg=jg)a+hv#J;oygpq(pBS%@`Dj3OxB9W8OeubG;H3E|iL9Qmv{%5Rh4Yg1W6RM# z)*cE~brvRA;+T%4yGDXC={ov8r#Q=+Zgy?NV%)-7N@-+a6BF}4LVCQn z?qAEB^TJs<#OZ6~a=oFfPoe4hVVtFcHNzQG!BerSFNE659L@$h1u@fR#j#tLsrIh| z==A$ls=G2v#~?o}P&|vQC#O!2EX6qtX~N^nsACD`@xsPd57>D5U1`xlD%dyd}~3D7B9VoUh?Wg1r`YUyb?zyr1e8O z9-10*4wU$k^-X$Totz9*iR8W8(1{z->oJN3^w*M^BCYe@_z03x1TUbl7SD2zIK0xz zodlgmi!7We!odF@^4TBq(MLwSaf$cNVkiWZjkP7X{13y0i{C(ltz?B zN(2N%=}zIFq^R%vz2822pR@Nlzt^?A)|||><}+c8dyHqqJ#xQO2Jw%+9{skVryxnV zvh?x1I_GblYUW>^YUiI|{kv05zx@P?CV$-ZWGJU_52hK>Z}RqEuFcfO1V>- z>$k95&&?Uf50I5)UbH?XaN!A+IVt*lds1%HmkC*9vTHoND8~xNk2}v$nknQE2ZzIR zQFvy+LF%nOl0DKV$#S*+mq-C=wmg$L@0yr4AvsBfZ?X0%m6xux#+v%_;Z)LyWleq$ zL0lHDffWl4+}03pxMdAVhF<%lu%D(2ofEMOi>)WMxLCl!F%(&;_+(g$ly|L4RAn|p z(=fBim}g6V1&qj|_~E>I?Jmli+uhP8n>)<{`gGh9rV|uA5{qt#E`^q31)!uJZ#(GV zJT0*jI~R8ZXfmUc>S@BKrL@_Mlg2Q+O%4mTlPA0y-3e5fVFB@K1kcSKkwthhXn5Sf z)iY5h@^ec(G7r2>)i{VDwIWm&+CMjSJ5#VoI=b&9VJy;3E(_9Q!$NsY9g{Aye#Iyv z|DeV@*$J{lhYonZeiDvT`KF97*y4d#w0!*T4qY)MCp^r7qqj$+q{8xQXNx=GqPORG zRqrRPJUv8aFXgE!Ke&_T1+|^qSrA+8YD;4pWj}pCdTgkHYp&YKOx2t0 zv(EfCuJk#+oov%~TBMhF;uEAc9`|$jG~D0Rb#~ko0C(99+Z6RzuMy4$-dX#w`p}@a zk~H)tIK?wCsiO0((_wcV2&X#-+~$BaXTF+q^E>o0R+!=Jz?=RB|3k?>bXgbU#b-aZ zA{dEnu!|=qO|WEqZi4HpM`N6A@qHe=T2p^onTos{MXo~KBn@fFos2q2^u)k~p?3wf z%eX#HKCgKBXvLsNjo;{YPg!78FTzQU6Smdl9QD%kN0myoRs0L2`~3wCV6m>CaR1Hy z^~{G)$ccTZo}k0T*fznDOk@t!s^))5qVw`g`y75Zl_`=bZVi%$oHj%FEq!wmCp?GS zkuHP~$tDw(i=Y3_+}ayO%qC=F7zz~Sr!owZtx|neRu53kkIcgYC=IJa(4OBG*W&5% zlziR(4XJHx*AopFVL&3W*Y@$+4Ng85GeVD%4f2v#rd!Mvc@ippH_)gSma35H@&j1k z|Ip~j=zGtnd55Kz*Z)JQ(V#|5jH)Bq8|U*Y!9DGCD2Q zxL{EJGZ5{4h0f5FfE!H;6i6dn1fqX|;?u^5>kX)4l9#0!NLX-6XLn)52jQMM&RFQ@ zCrHmC&j4BSSrgKFq~}dBcj5;xBxpO>`1czJQDOK1S~_XME2cE&YGB;J4lUAZo*-6Qo z+|nn`csV~fudk8<9j%aM%9_SRyhr=rc#zV4YHZdZ!)7Uz-8)M5qKP3A>;{#4z!df0 z57VIH`>JYfxl9rGZ&XYRwFhtWCl%z^5l-3KuBxl~D7b2yJBXqAK_@jw7FcaKFwm`5bJ3R{KAbN2jBAh|pk=U=XA- zpQ-x~=<@u^82=Y}9?cIy`#5$t)uf3=pM1@x0xiXwd>*FjXL+&9@$|!UoZ9CM?yT>M zdT&(7+&%JMH4l%`V{_UaFTaKVeX9)P2iR7mk*1uBsIgplA)|4E5yAFlTEsAmI8$_+ z5#?^Clsk-l6sI+AxLxII=?>RDH@{{Yxm3jOCj4b4Ft?hq$M(KTQpWTWnH_*RSIxhY zIl{q@U{;Wk+6dYDjPazfHRNfbnpvcf#JKJ6uL{-4$)$IrM8r*uil*u=2`LzqZ0WR= zVor2%7tp6+Yr;BKFMTwasbj5zL5NuxOH17`uEZ-s%2TFdVeY^6X3&d(D-!t`lhyc< z{OycUruGC)o1)J$XWE5vSqWu82ax?=+n7dPX%nm_urXByQptSh+JwGxmv?cHY!bUb zzX)dYQ_C-{hNsHqvw3ZoDyqbILBENF#Uy9~km;F%ftq1}b^&Y!1{|-m?D5&mLIYE4 zQW`l)F;Ydkv#MZrHaf{Wm!(U{SR|({iADfPpMs-4Fl4~~_s=o{^Q%vF78&cFs*#D2 zBk5^n;OSuC^Xld^vg9+aKY&6D43t1ykOEA8Kw;C*k4c^Wz}691AJ7O15JNcpagWP| z8`)n%1~e9&s4$(Nu<%(q^QmaEGclhMg`VZC&kmVbIayC9qyGQ$xAISrR!-h7Ka(gF zA1v-CutS8q>1R(#thkvJ+WffYL?9a0Cg?#YL}6u|5kC1%+_%CO#v&=GFnpZWPo-U- z8B~Xgq>UQH_#02r+^7@!VimcIO&x2x5`&hbhgQ01oNXtMi4|z%$~P_#zm<>pV2n#B zxxLJ*94DTzeV?T=E?_8GH&Y_h^DC}VO}1kV@#dV6$BX67PzggFU+mbCrrDEn1-lKW zopK!^1()79K64a^h7of#Ioc(@{%+rFJR@c-=kydE0<4kdao&zZ*A<)P{CW3r+a9_& z{m+)e+Z+x2PXmzfYYIjX9ffRKzOTMR>tHFsBu_%A!HTPrURvvo{z`ogX+B>-K2zuQ zzZft8d!-L1(E1DLqksYUN^bweyuXiHW;Tb3JY#<<+L-9A*|+{E`^h(*2$0t)M3TZh z0y%*kE_i9SA3;I`6Sa*%_pX)H{-ff6Sg)>z0^K2?{x{X_x`%g}YtNL>@`c=ym8juV zVNLaRRZ1SxJSny1?&d^{(;XgLZGhC$86Y0{;UWJ%Q*eqUw(;FeU@H6LXjQ_A#XGQb zE$Qv7pF>gJw~`5edlo#$+JrA;pb4d$D}l!qU_Fsm&!3k1CaA_0jPT7F*~{j+>!;Dg zdxpdTjr9%*S}#+EjzlRBnHRbCRZG*>EmfZ zD{TfV8ooi6%NQMGVU(Ko^g%q=eXs4l=LlAtD_Z-(yq-1IR?xFTXBaGgfx!SUoz8-@ zy6|zB^=!_NPVe8C?#glvxvj5|8#);9gZzOP(gkuecpp=Qqmkc`Fu|mW2`VbTHj)pR z6w`GLwt;R?T+q!^JVnAnQw0`w%8_$Hqe^lnsQ}R8T>jvKH%HFM!P(l*oRJH}agM}{ z7i6jIq?cEof5pF;{wfL*KK(2-7SH8J&V4UZ<_q8lhRK*(g6&*>8V-kFN?1=>n_13# z*nrR_>rd9^(@qnPt4{O(mmcbQl35E0rlAt*+OR9*>A3Sf%c zO-v25^wlAaGNSwUl5O9&-}!ut7VKu*H@Vp~hsq`Oj4pp9koFV(Ijs)Y?|SZNWePlm zJ=o$RF>pmf4hXa!*wNvk_36C!YpTt6rP?sB0f(#>Q0=S>)fOOVF(fO;B7;VIHH%5m z`pb^ztQ!6G|2FOB`1iG&<7_%Opxq2t+O2Z=OSniyT>mBfEGoR{7W)^|o&PU?zJGF* z+QIC)rI0M+`X6sTIZ@XPr=S>q5E=6^I?2yJFrXsa_Hg-i?bv%+h>8w6 z`={-uw(%sKJY^#AsS9WavQjN%pYMR9n8?AttwAJK;qH1kq>3VaHu7rUzYu=uc3Dv$ zL3>*+8ryX5YYOgNHwboDLFPx(%rl$l1YSY+8g{mKg=Xd&gY-l6Af!LHewuX@VG`sb zwzV>ShwLbZ(AU*}H@>&$uvWm_FkDUc2n)l-e_2;~hb036aufYF9In*ZI+3ffdC~*p z+|kv3df)Z6RmATioj1*9pskn(iZWCn+IJAl;%fCKrkL0LAM9&UV^kdBY`ju6^S&K% z;VAtNN1Q6>15*j{3?Ydj6h?+iaY(LARC6z6ToW zL`N-at&P0F0p)>(U$}T0x4~x0z7tb?OsR8yQA$JUEF)Q)PrRxoTIt)t(mai#b%S>` zGDI5DQmfH8G$fiO=!ZTE94Hpu>%7g|24Bj*kabdWe*1CLSZwPSMz5@Wj)&Mj?{a~j z{@^KJ!|A8svP9_ z{_&+Ym%JH&RFkoV!Lx6pxj0)seeu|69`EB>M*E{|?0wu)Jzpn*M?`~?qFWaOL2ay! zYbVVr!G6-Ku#e$vH)@h%tC!yUg4a3bVF^0Q=~67XRd0yK3jNEx?^EJ2pWt6n@M2~!0v3{-kuxc< z0kk)AVZ=V`&I9^pk!HRLZU;NcW`Jc1Ye@X&)V;bSIp*4>ql=l{?p*k(Uryh_g zR`3JQJR_Awq%%aE_z;rO&0Dy%)AMFxeV}yMjhzPLuJ{;dTRj(kgEp(>}1 zLhidUdo$L(OE{#_h%n+t(d0b!$5?AY*ls(sB$0!&iftGs zVhD=w0zR)|EmBW#((qm@MzZGR8+X{5jFTCc4nBDV-K4;^(7iTMpDuI!0ycq_ zL`}2$cxP{J>s#&J*paap@g*CVvB!kQUT8vC1HPtfB!A_WVU1E(>5}q2Nc%u|i4Y&m-QU zh_U*SmBu}{gWvntl=A0t-WY{SU&NG&ci%LJE!4&F>#i}GS-?u`*76;YDPPt)nVhpP zqTr^3Xk=A!K$IMjR44Fy%r>w17;TfvgHRT?zH>>Ks<%;4PoPjlWGnfrT2Q(IiJEc& z-wy`^hEfG1#CdfgdSL>YinZI~8V4}Mv4d1%QVKq0lMRomk4$b(cdGdl-!K^dre8O# zr$YZ-yNw0`<~C;y+TFqpnM6W(e$@Nh%c~5&7p<+Ql{G(oFC~{o&1ZL|dX&AVN1imL zZInS9zx$)g@ekMWT9^({*Rv#m_Mkgz&n~2gV6qX4ee3;|pStj9vWY2awQc`I0f6`_yR~JqupB<^9AG2wCbEH1_OUpClAFBo5q*Z9) zNG(+!-N9ec18GZBVyK)@rda9H-d#bK&G6cVQDNb1FB(x{ zKiEdh=UJ0j#bge}=52lXM*lRV+Dq-`J zxk*`L48@-0k|o@#1>2bLNy+0+thU)VspANHz+b3dS?8GCCexY!M1)NL@D{i4izPpk zfWah1htk?)?~oI(NBG(i~e5x}9fA7T5 z67S%_EB@|)VQa5Ky3e&xyW5E=m8@gUCNG1e3Te_QB2Tob&8J_=Z^ExY&<|<^y}K_M z|9wmRc@*^YSI~RH{rf;qcKH z(@JqMABJq-=K}^JHZ2h+bj)?dQErts!6kh7Jpwc%M;+0xbdt%p@6W5Zk_0mfuLKi) zY>VU(HY3W%oAlttS=Zn1iZ1wZW-2br(M^m1R^d}i@zZra?SQ%FB0u_R9DrgPSPQ^7 zD4!dLUpdiE1C`>x8iSu>L&S}&&*{x1tqka|>d>)pug?E;TF+WmfPNJq1;7lv&i0!C zmNRi)JN&P^(LW(^x$^xtoqQXk6QxQ78h5^yHjC2Cee7FqZI#Y?=HRCGLW=5WWLr1i z3V+-IMV?iQ2^sRs_@b*b>-T4xQ^N~cYH@4PIS#6EA|PmDZ8>08p@Xk0ic_Yw><2-* z%$so7deuVj-J;aNEEBW{`}EC_dE_F5GVs3hS|56WfcF5tJ@wkNBrp0Ga*IL4l+I>4 zRSR08bra25u-2-PQRq}pC7bC#3I>r+$p>~lsQjK~&;*%??(!Of2h;NI&C(+2(iOZ~ zxrB)crxWgm9zE!$BkqL;v0Eo&0&nl{9)IE5HFIX|9gA4h#WQ1UC$8hUMKf%!-1bcC zWA?pU_}$r1J5MxTvzrH2TKd+FeD74PFJx2y!H2)Oj6ziy%dsc_Mu!}(H}U&)ahuAN z&s`cnu7fQ%GDV1n`y3zM8@m*2`KZqH`XP!dYAKlYj7t#c@a?|aG1|3QkKcphW>WR# zbk%yz5OS+At775ADekqXlqj8r05Y)y+Yc>LiLXV5(V^P6~ zij*UdhmhmIWkF@jCn>Ba0m@y=BEm(tcyP=mq>u;&f=M2~MTUSq+30|h%6(SYot%)$ zpg!d>-S7&2LJ!7Hn~|k?Nsn%d*D#uVzHh09{*y+@Xcl{;GV6prlYBS~F>_g`*!qZe zhl)by!`B6MY>4Mx@+pPWAJF;}nw>UPrVn!24%afY^=+4Vw!}Hm@BTvB^p_X>x~uQ4kH*)`ui$B{fKcXVOSVz9KqWr;a9 z@r+t}GNx3{%W47EM&U7rixc9x&v*Z;mFY3(+miQ_>hXS)3?G;;CEwft7Nd38qGPKJK7MLNt z>(n;S%%Ja+We60QC~RzMl6?M5u`}^VZazs~g-hwn>c&<^yZeaxi#z0rHB+x+=wCW5 zsbTc2-VxdS7U258U{;4Y1b3A2+1T(V9;;nX&|L-t3V$8{aDKJS;G^Ui8Yo+T==h8pzMdevjeMIEpBE&$;vtZvX774mX(>~(hTi$CerS^*T4s~W2 zz!MN;$fnahf>YF9MlJAIg@YzS(drYniIRn_HkH4uqh^)o1Jy#=;=?DziJPdS{fWxX zW4xHvQ^czXa7Ft8LEo|`UU=eR`u$MF6{H`!j3jS^@SbN06i&Zt zFN2zr_`>5esJ^7SF|f9@Hnjd{cb+@`3bA3xfS?8ufY`7X?!252U8t|o6f)EbA1jpD z9Pe)-WRQ=~H3SzIx+JDSz`_)_GXjP<*^$Zu!>b<}*`IP$UJPb~$AVV^TNqp088Q-p zPPy8F2q%WHysW&4JdobK8VmoE#^&;8{~|EKc3R?o6=^)5N_iD&{2#E!e+n-23WSB( zeTliXtN7-YGECAyVdIN&8vgfG;Wi$cf#DHxaQAG>CATO*a!q-AA4ObxvC*vW(6 zKSHH?VXkOseH&jjPxCOE@I~z69O0lzq7DpN1F~Npu3s$(GqaWXCTuP0VLPnTml3Im zBNp78HZqz9U`{)6`=bVRFh>#h45ZN+#IRok4uHvR7S;yldH|V*m5Uzld1;7=wS^(C zo^fjoFt@(B&c3RJ?)>+4Uz!3O~6CQvBy;~a3{Bn9uyLi|Due-=BPi>A|)!#=xS#B1y@VC(!+k}j! zIFbVudQMXtd|fu=$*k#QHaNzKK6zR5<6}WnQ=Bkz)sRMBx@s>aiH*yPaZY7aBgfI3 zf^m>9beDD_)=!EJk4aNLYA+t=ksui6ggL1c6LZr%pbxse@azRio1qwKwT&0gq{MiF zQZ=XZEWu1Wj=xi)7Q-w2n*n>K0o%#>g&QpSg;jabN7jM7%I;1uPt5lPbRbyT>60DP z=7OQ0$?ie-3pq92f`W!92+IMoWq&~>1@i|={dE4i4@_d$s%mORebCtKoQ4q=;+QsBdt&A z;r8R5 z=dg>s-<~3~>5p~8>9K`X=`z;P9_sGceiorhZ<$Apsi1d^_f|BM2Ialf&x&1tGV-Ct zz>!}=yz~rcSTBGE;LAIYPyUPXmB9F0BZF%bg}4F7UY(v5#0dcb^#g#IecT#bXwl>^Q(Y-Dc}r|UZk5`fx(wRJeJhj%EAR80%AN5Y0_SN z;$Nm{fG-jiKId)#I!72e7+INEna?=B+0PGIPY?eec*4I)xB6ps_SRVny3JVhE~@Am zLlIDJX@!`If2n!vvAzM-nvuDqH53MiA1JScZV69Got3#aB#sZ3@#u=B{_cRXYMp?1 zY_Mdb!&YqKT+*55t|G#fZJ6RtrTBFh2KTSFdDRAA2|h)9L&#I{ z%bhY)5H!LNlDsZ!&?XQdLnsi~Wn@lB{4-&RQZjCpHKE6JBSu^wbg<)WL`ZI^v)H61 zcok~FvE0dV;e0+6NGthc06Scz8^Vu8>M*Ie{po}JNGgN{_s0({?MJMsipZd9 zlB=l%wQfHs>6IW@fjd*B+ZU>2XyoW%54hxdrwsSz)|Qt&QP+bwTt!!^1DykG2QmQF z3Aza4P+bSB(;$xRHH85v;|W0o=RQ4_$i(FRLek|r!GHm_}{Ule=?WPk#kt5!tP*~ zVh6n7L7(NcX4R1@`Scwe5ihxAZJ0v<1^b8|W;!cIQ(&1VlmETQczEG$uRz}!AH11l6`m%~C&QPP6)9~w^MXY1Z<}fU^4j9Tc z2j`{-UrY|ah2;4)CiuEr4L0+xrh8kxx>J$lTFR}w$cZcNNf3#AM8c@S2vha}ck^Dm zKAXx6`ACRLMUuob!-HW$wh@s>nwk_`YKhyfAo-FEGa2c-k(tn6_@)X6``!A>3uf$i ziqlWLHD;fPR_t)Ue9wuW#5DJv3>*!l3L{xccNtiv0?^04hO(12Xc$aw1OziG4Ju;? z*tl%b!#PtsGLY1S?jN_-jj+x7EqyhrZZy!`6no(l$37?+K1?x8+_U}gmWV;NW?eq3 zM%J7S>=QH!wd6P?%Q{X2n!v}Kc>W`YeLb+MhH7UDei@>DXl-R;4!rbitWPs~XBHEz zcik{H{nTz2K)XSJcH^CEHx%^3@9KR$Mk^tG%^pfz+=o;FxX-m1?Jwsq+Z##G?9v&p z9qZ{-RL0Xrbf8d^6>yAMSebx+$6sQ!|EU}OlPVUSa8!LWhLZe}T`?WKFA(LjKl9q< z80z&32goZPUw>(jsIy zZ?+P*q}(?qmeBoz4i`n9G;I`lONYXkyXGmAVn^V!tip6Jr?|Iy7S)1lLmhA&^Mfce zo7^&%3gIn&)Nio-HF(n<9jZp4bh)Bkn}pcxmds=)R$CxGW8takQ9bGyMsjg(+=n_zLwc->+t(OE_Wj0hya+Hm@}k>bk5fSH!}szS7bsl;blm zR%8^Ev9BZ*Bv#Q^nNSbrN&X;=HF8Q9VwfPeNRi*ryvbQ=`|+;gf+b;6(f!JmCHue(r4eB?onZrCTOx0VuALbu^HI$+b-QY@AoMe{ih`&tD5)kW zM<*qV&Sw;#&A()1J+GJk z-@br<($klob~U-sar60;h#WCe7y?20?iz;JZj~75pN<=cnqH~S1l-`S9yH^`q5%BFh^b4%fkTMgf>PF0vNhWk&73st|pIVmnw4+2&B>?VpH;j3}q zwVoBZm{j01HA>FD@IQU-|elLZhu3iD|opC(j? zu8X-9axo(FKj?ItacEIROonN0$h#{0;p2TlV9l%hD;?$;a^@ZT98wpAf}m_hs_?ks zr66xDm7yOJ!-7ClA`P`KNUAgT#O!Mxgja}A$}q;9(g%j_jWO7k;~9k(u0W6OF;8?v z?#HaON@d53cVR~@bmn_k2h5DqZ_)&~F8D$e5$7YCstOG}RK#mgPH7YotdndYtuxhL zsd0Y)!GfgNF9FX3trDBlf1TzVT~4|iv8$b?U%89*YQ<46(o=PLvCoH=E*cyDLk82RFO!4LpV+sUh{BW>dy#7ntM@wV(LhhA8uSY3yWBNhqsxL!XG;k0-Hp zA77uk$cX&o08iUoWSLU8I4udYLs)=F)fBht^?hN}AJ?QKgwr4FNje~f2_K-a)xFR6W4(czyV zEB^p6%DPPD_<7PL_JUj1lP7M+7(Dj^R77xEKB`t?% zvokC*Y_;uIXQ}?0a#U5~`)W(Jm`|`7msnrn6WLDiSf7rX8Qz&}vs~CGfC~c{D_~@C zIl1Uc9*lmPC?IrVay^IdbtT`>(}11&1ju*mg`I-94kl-@*{ExV3J927WO)#<;05hW zf$5cC#)}#+cq}9(18WBddqc2=(dEE0BrHOJ8RL9`z&_F7;VI#=iK&tOMVJK`RB*l> zyz}$2->jO^Pn&jHdVaP$1STzUUP}lu0|5|#K^fQ`o;3pfk6ZCSS;E)LZ=jEMqK=?S zt+g^FM$=qova6xNs(8)fRUf-}S?NQBce6~NOokHtz#>hpkaT9cqxz$EDf|=pf!zc( zIB{i1(|^edzc%FFgum91!=breYsgdd`ypZ~TQ!b^^Io&cCDMB;c4|=gd$_h5i^MeW z4y|bt4Hgw!xi2>j*@Nmdh)$KN`qR=5Lnvtzvl*d*REqQW`r7EM;z^|*LoU^Xnz%8}n9zsELsQWUr%5sHpjD#0 zs-9u@BCmtUL36u*X#R@3Wxz#I?tS!@2|RuWkC-beq(`gzSIhYT5N--(3;Gny?$n0Y z;4`EXAtLtWxH&@&Oj2i#0VX~UAIAjygNIS2?>>;UE*+$L_IQ@A!_!qAHFo7T_9ntg z)qlsMfr@^u{0NcEcA(FLXcXsVA(*!p34;8n-R&Ksp(rx9fX}XnJJWVjmwKcJ?Mk$U zz2QEagYNCDZDUw^FV35Vw1)~|kpZUXO}-o#XmM5F^KbOLTt^I)E5v{*1JI%bc(Gns zM4qxO2_%S_<3&nt-3NTl=D%9Rq+ikFXSnsM)aR@O==UHhh@JG83joa*`wQT%wqlrH1wt(tD2(9;q9_wXwxIeoP!1om7(j>aS( zIrN)i9zf8`N`0%9AvRp~E(XpZ8}2J}5nq81X79VY-p9yQ=?TwZZiJp0%&VCMM!$K0 z2B(pIqsvIjwNf{cE1`#h2lANEfY2{q2)(lRey060KZHzI$jBGld8zBba~d>tye9Ud zqKxDq((~ONzM#_O2muFRSP;-@WomD3WN+?hf7yr&4a^V_{mrdAjhzC+(=T^{cpw}& zM8NF`+(m^%gv3F#F*g;kH>Wo;0+Hk0ICc3Lfk4dp|C*;KfP+&yzzg&E-?X%UvVk3> zO-oa)($C=^#cztN93rEfI7EV9mFj<|7-l$I<}Hj z!hEJ1bM6&w)($`1@D_^Hmf=XHnLz4VKi(J2XC2wpM?SV6Pt12GE8%^!EfHiv{W{~e zgOAF~UB?~XTto9=`L7=Yif?>k8mJG&R7&a$IYcLt^?dJ1qKZmp6R<<-N3v5#0u%M! zIheKOVYqzHQO}|A5PFa%6S?43XH)=tYC4FuK zeL_J#L4PJ4{@w~=ZfNp-S0!wG4_CCle!H_!8W<=F5(R{f=r#-=i08613>xa{9pu$J z=&N@ySMLz6-XZ=b(`UvMC=72xeTFYyEvuGuT>PrkZ0JV%_^d%|WR`+zY(fo36D7HE zy%IJ!zOlERHi47hgQgr^fXuAr#moE7c+&|ZsybgjvFQ@!D=25S(#}2$j|-JgV?A-o zg~N);&h~&1;a3^(}H>{W)R>|Sms=Hno*H(AGwVR+2yt3j9p5Chrkx=P@r5xp0DNs53&(S!cs(FY^ox^?eT5!Sr&Jk)z*wT}bM(N( zARUeQP?EFI`t{@+)QcYbdX?+22;#d29>7$=i)sj@^9h2dH@r;3K%-!t?*C3tU4p}f zgAC03x<11FZ0~p3s`;P({=YFl?{8?S`hH#$B^WN=by*|oEJ_$omrEt75W?sRY_vQK z$Z4I!*Z#PY$8Tyf@@OWnvt^vlh5l<;1e7%+xh&k52X>-qXhP2EAA07z0-oT_9(B{( z4dBGebtM~UXTj21z~%foIrA@eWIr9mF+T$+m&h@hHXaJ>k*H?U=QIyAeksHJ%M1S8 z(b*ioL>}GsOI+GiAsU=0heJDNPD%^oj5d!WTdw-3Gc5CwEdOgG*^RsJcWEaA;M0H| zT_85j+{8NfvWd!2&UB^`$fLH7ds zPUzYVpN4btl4wXj>S6g7MPk!2I*$d(CbKHL195WOe+#9_#VL2J{*2p#?3>ErEYNHlT z(c|&&$1d*0i!XL@-i^P%eRq!JFePI~v71W?MPeT9b!UYW-2HhBtN=R$XqYJ&w!5VG zPzw(EBvqZN#%qqZCrsX;fgc2y^Ys-R<%|)%>?@^E{w(5Txhy#Hri{EwiSRQk(L|Or zE#oZR_T1cf$JEK3_eW%d%oFCU8+G??-u#|e-k)9Buo0d>Ob|t6kqc(84YX(en3#}G z;o+Mr<1>@hS7)LZ51&Jgv4Vr{Rxc_gQwG!je0AstisA8}G!*1|I7_;+$2oo!!KFnhr^pSLG@k4I1FMEqbS{D}bCCI1vPYd}s z!wm@h_3I^Mm~X=juJrCex8RHQ#hHVwPR%0)j0wmHnCAHx7i3B1ivJf0weO!=dDe8p zhlC@W0jE_^VynXd%V08(CF}46dI3OCFGHZ)As}xZ(P!e zuYP+GNANXcdb0E;W&S@#MUI>meCFLNI#H4Bl=ht9;RVGLP!6YjsbW>akI6|M7`f|x zr7GWLicV4(WVcn>c}(_bH{Ru7kB%zHSQX@)$Nq@-*MCkU?ANzhGgU!~SZ zn2EvH?q4VSREI0%n`rB!#8{ZI4 zwf(@t2l{GUjU23h3B~;~RumbF_|&CvwES%ga#c8c`DM^p_!k$R)pr18O+X>#>AEjD zyf^?}+f#;Hc4qdoex1`0-NoU5`}+QAGxFuoBgd}p?OG>x(6%|G+_aSde4Qn=j@Pah zUAbnvqTcgdraW*^mDP>Feh^gR-bYilEIdvfGeeg)NR1*MMkx;Wewcn~ngvolZusnO zS^M$L68U!3A3Tf_f6!*PwT0 z5{2DGP>a0mWs0D7p3T%?uk$;K0f;FJRfcI(RMgRDjbuIwqi|0PPU6{npB>MXZzt1< z`iIU5A%1j#V%QBCN&Z$(Jt!Vghbl(s+=HD8 zxGR6}%-JKn(0zM*3%b*N1f9JV*xbn4)Z&`XXI|+%R287_K;R8B$~{oTI*@m4oA1BQ!8y9K^!J%*=RJFnBs{98k{l!@v5-Kj}wL(i~#> zT@v|rw4j_|@es8Hg+%j=@K9Yo3I7;gRJ6XeVS>~j1NvH7x8JbFzR0qJMU$Kd`bi^T z#KUYf(;o;<`-mqa(%diuqmim?VeEQ)puO;Eshg04F_4RhD9!SIv35KeJ(ZjBLgl$H zgygX*?z@0e{$J>g1tJP~P%dU&wd;no&l%fV&XL&M+T%FjZ z8+su0R!x{|=iqo8XXVGu*TV#Q9m_#TB*Z@IPt2oLvNuMVDhY12FvY*#Cpp&-RM5G5 zO@svl1^PX4a<*L-8CPccFiM)>Vj6qm$F>vl91SV{ZCcZlj!$^r9EOR51h_+ABM5O! z$Hc03_MCDhm?Vm%eSP)U;oxc4M3TmXGlNr2*!?DQrUlfEa%G`Rj(T7#+h$eanpJt? zgah?6_@kSAaZJA5GjN~}oP(H@g7s4CRfN=SE)cV?HSbdeGR@LrI<6Z%=C8vRB7QDG#s4NgakAG$>Sd;7ep7%P-Nv zc8EDYAT_6aaQ{Z1f-tDi_vM_|3r`z;7CCGQ0pi5gd;S{gc6RT}(pri+3HcSG2J4+M zw2TWM-hh_LNw7W>^~;7OVAz_SwLL(*WkhH13a}knUxwUHXLEC2llu=>au0(B#NChp z+26R7`?sFLFmmGjzmq0f6A6X*>bw!1(%A~H zZGwPe#8Y0TYjHPpQ!8U@fy;-Xe|V;8KwgTC5!fsNF}Jhfo)hf5syJNw>f4 zMQs`sj|Gn8PYE6N#7yQ_V}QfG0yLu7 zD!l6Odj&m*+P1Z0OUDbIQL_w0Wd)8wBh^`R+&#%sV!eL&9!*)8gz=VATO;jHWtr&% zI0YO%vE98flN8zoO=>c|!OD3SawJn}Xz<@U>zKbDH>uFvgYwSD-%g)UQG!l%gO@l- zK4cH2Y|-deKsShdR!H#DpCE8w?^UUSRc;?r_mHh8N&YSOZ6zymy?1x#2iMbZgqA=Sna>Kl z)?b7k@FUxs@qMQk@FXcw2D>cMBd~v@*bL8TAS#{CbsW!}QN}KQUb?DB1WZT~e-Pm=P6{c19dZfHnVn|$=g#J5;{h>KGRnqhdB zp}@n$aGQEuK^u41MT6#ei~8Et{9l`wOpNST-O{%~=4I;?+F<(V3ZCyD=k4hz?0hmY zt}gP?n&XAnqk)`a0>?VSH*D@v#Fm83j$$ROuz5S$yksk?Yn{I2bgs(JZJIsEjeKnq z&hX@tuoftAHU(d>*4kZ^K{{QpgLJ&Y5m+7|R>A@J&7|izf&mfVfRnjPFShQ+>1%fo z_WqX^jne==JL3gQ2@(o2P{?cwz96o>;AVqH!MS$!3MQP+%OKf-;QMJ?5YVj-xW3E) zf9=)b|N0mIQ+VWU!y@$>S@m5OIts|rqx_K#JvMkQ}oy8f7O1ID!_%C+XF{dVr? zmRs!AbMx*l-@_|?!%8HoiXbM89G7Ti_1*++lN#OiDG=uip@;|JM0+i$!ApF_FKHAt zDP_L}M|(WEU*zF;s9QH1m1xo+9T{N=ug0Nb%EHErC9x_$Ghj@d+e1*T%f>ud0rwgY z@`tm(0)*&xxXuDaz2`CO^s<6mAt(ZW05S5RiB2O=BA(K#JNm6%x^{2c69&iWGAl?- zp_jhTD6FIKtQBo4(XA0~FI#YO+I!=4+;B|f`8CjX-Y~1J zFGsnBf^f1nfbwuQR+5}wgxdO*<)okShk|a@qwN&9IcMyc#WX>;WLp2ZlOwV>I%~5e zYSoT~S$a@ZCm-8)Q+kAWY4+Srk7zTAR8|6B%xqt%*m z#!9k--^rT_n(EFJ+s+QD(idDC7Th$0hs5Sf&9Z?tSRe)+F;sEkpe_1EO0))!U4a9;t1#QQUwWC6%7MarijEkyhJ2!qV+_ zOxKEN37j-U_duzJ!WdUD_Z?v|-Nd`fAC#;kq`oE`G}@vGg}MKr$?TQr8f)>9d6jJ+ zOVzQ6GE5a*)kN9z>b2IQqsKRd$Ux?MF3yOiPeYE%ZK8vmq6Wxc34M5Nk4#EM+xvvq zhM3ageUMWjZbEer>f^&myuu{OzVzbX7SBX}^n5vP3gTagA>xr4B->rK~mEvZZtS8T}B%w_)MXf#iY=`MknPS1|@nhOVY1-($@fcr)aY+Z6Mp!b1>b#E-coGzi!9 z8R?o_X^siLm7G>`Rw? z926IX!WAH8oROvxE1L+03zYhg_Al|y-;sFo9lnc9M2c$CYO>$2H$&t4-{QQWjS*tb z6tmN6yp6FAQE)nO@9;;;j0a}tvb*8HJJ{P{s-u}-b#>&B{Zh4@?qniTk(ud3fo%IL zqqM(sPd`EoC~$nt-J$(MVinbayZ~Xws#WqsJ4$^%*mQlDdz$v${@qREX!bJ!yX_~!7x)D&xr+yKu{GEpr9lg?pkrCs zO_l`bXPH+De=wP#IDsb2nc@3)ibDdgHUF27OXTinwT_gq33g)`nCjoDmu|cM*SeIx z;`$8>eoU!8I?iS!#6R0o@5efnM2K(tulg6<(*1Jm)qdr+YKQQ;ogaUCI zYrQp$s7Y6tC>WB=UT&Z0lk~!ctmz1hk_!*MTaZ#1+S&*4dQW*KWlqbzoErB``fgpo z8`u&I6g6JK+I4p_>`LsQMFCe*5D>jP=a_~CXOYp9+!&6;IkWaCRCqoCpoF?^NKXSZ z*C!$X!gmAs`I+#+37*~YQtY6y(9cg?!QFYsC(u;`OyNEIcZpy?D(>{3=6~j^|7kN= z_Q>0|>(S5`+ZW>A3JxAtBOimEwvr$2s*^p~ckqW~D1xF39LN-Ql`G5bWvhd1h!~gX zfX8K%*;)yvXy;pG->$^plYIDc@?)(N2N5_u_t=;1>7116tmyRqj|!Xvhq2Trtegx7 zFG&^PEL?lN%kuVLEQ#YsDR96~WCwAo@6`6C^mrtjk83J>y#IB znq&4QCQkYmKy)5-4mPYGgDH2@TQsa**$3fnFp1IB2p?1vJ?pC2$e=`{lisz})-^r( z9uM`7BeX;Th?E}E>ECK?Csv+zo-*mUks3rX%r8LdMe5z+EyKr6NfilGVv*AE4E0|G zLVw*0UKeeDyzT&&rFxXOIC=z))b=uTIV6PN#NjMDl(fOFDHxqa(CVZ}L&`>hRx(fX z>e*ggi9{~Q>(&uvgmgtmR^m?8x~olxQfxN@&6lLxJrue7lVk(#0f@zNDUMukkDAWqvk9qXyr{o?qI zy;$zaFm0_a&HGvpUSRJ^ujU+P2*g`5Djx|Aw2P5Y6p!AJuu1va z0qO4U?(XjH5RmQ;DM3;cr6r}22I=lDX%VEnKUl1__CD*JbN4>axz|T0{L?w-|0&;i zzY*_v$F!@5sZwW*e9exdG)MDGp{#m~g?^S|7|MDT?rxFr|}G&TCygn6bE$ z+NqD|Z9}TZAzwZu3cH&bw$yD2PNsMmfZItql@tv7)FWqw*x*IfX)>Sheu!&2s=G71 zpM5qaw0HH7AC`AFgoOE)Q^9mQ*Y8gWBI#e22q6w6h=4-?ocg;Zg2M)W{?mUoaKQhr zf&&e#KVcsML4@|MbU`F;Yb0^6wFY?lPI&S=-Re#bg85dt2I%Wn1DaET49~3`8Rs2! zkOOFMyKTV+Bx!E7u)kma8}9gbcA9n+#Ntp-U&D|c)94K`*ksg@b{&v1;ss~^j05%y zvRpEWb6WHa2JI%~6^=7WO-w3C0}t=p9GlAtPcrG^!+w*QFh0s!B-l}wdFE52;pG9G z?R{){8I6(^f(Zm|46P}y+7H+!1gp#yRpIV(2+h+;)@UjAsChSOuOa#|J{efB?ZG^$ zIc-kdGh+;l>U3lYmBZR8jf{_es3urK!mh`Dj6Xe0i%4&&SlDFtGJ=b$u?x3+8U3({ z3%_nqyWHyLUAY)h?j-@Y!$D%IPn7esbF05@W9jU|AeJqXEfgZ~L+|F!J^5}mcMAX%ZRr2rivFZ~^E0!= zviC%bCqF6d02jp-n!fUe=Yl|yd^hw9<-*d@Smz_y?bbn6ymt)KA8~J>6klTG(;iev zHxoT3lN^4@=FYNZvZz#!(&g+mz?s!n9OX!StYuxg$Rnp(S`lQ59$x3(N5$AQm}fg^ zFOkF~X20nemHjdZhaLJDTojf%#MOII-%=f9)^6&h6N$9Km}{!qVh#2;VPS<5FOesQ zo{E#gyoICwqlZ26bu*nQAwvP}YeKd+Wh*9f56CwKSjekj!Y5&jjX5Y>37B{6Ud_Kq zlXsEz5BHOvPfwxLp>OgRtc&`#<6{7oH89CLN|%Sx@M?p6-M)RU7MytJ1?CZrO4S_} zQT%WMTmWeY8`IlV^>-iidysR7N%y!o+;hKR2)qk`pmx9^c=H{G{wRfbd;I?)KMkM| zH3Q|{`Hw)NLaXcv=x5nF-^xaqIswFNKpx_D77O47141;n*z|KC0FZS0_2Tc)^`onv zjDhs_)4&lP{%*Vf?wQ^LvF}74pezeGq=1s*U5hSI0s=07QbYe&Eb{N5u1J3dPk+lf zetkygbMA)t`iX_A0VFrK^JCaFr6x-{%ZqulKfxf?bszAb0BpzZCW^7bEe3Sbfv~C6nzk> zB=zAG-&Qi3Kuy%EVSFY8dFfV2kaya4we8hm^V(5gAiG(WNl%QSI8I-*Fn`gQja#E9>*6Eb<`-6D+*V@qa}(S2sPSXNky@I*fIo1Sf5HGGc&;Hlq05#NTc_<;*{lnaSIhotg9Gnh?7WG` z;V3Qg#*jU!&WkSi9P>rwb>S9qaxou>5oXvSSpAhD=>~HKgO@d%(UW2b(jX1fm09YD zO)_P6BW3-D8Bin2+?N!N8(bv5t@ilI4n$JWEQ>qeF#Oi*C%vY$UA-Z_D8+pRUNNG% z4+wC-Qxx~2Ls=C^S;#aSiX2xly9iX>@ou9G$J@5A{I~)c)I-nb5o~1Fqu=Ub?4r>k zfsK&HxtrgQTji-0jq!X69r247w0ajwAS5kM1{paocI9hf@9yq5Cb19lnxErkGR)2l z;m{TF99=T|xvdQpLayf{}s#&eYK!|9bv!+8yrP zm0SMa&wv5QfB?hQ7}3EWLl+4Ya%^n&>IDXgZLvs)t1! zCBp?yHZVGavg{p*IWAd)y<&B;PRTG^>U-#^KZOfnK_Cvck!i5PmIAu?ku_nl$-K+f zU6VUDb0Q8SsX>SZxs~&4IR&5ZM1*TcMd`EA+=Yy_)Fz+hZU5qG`>V+ZGfOOGh`8>X zt1zht8W+!lYS>EK7T=D1Muu{5Wc_d1GR?SxU8|U_s7ix(?Ee(%h?)N%SJJ-+Zq1NbTjoN$YXS@)(eQTZ)tIj7odeCRpzu zKZB{oSo8IrqaUh7nv=7ZrgE#X67ybR&j=@&!^Kj$kQrrBhTP4stXSDMJTCyFbyU zexBn$+8uw0=YXT3Dc`NNPiox!4?!8*CBj4Dbmo;T-jjQKI7o*-5y#=ah#VmmIois+@u z!C+2ioN2*3-Zx4MG3IZcPoxTb| zW^*aDft@KjrP{s4J-@m9nGXITi;j(k)MZqdf`0PD=Djy0Ri>4}^;t-@#p_;p5ei)R zjff3TR21Orgi2MjvHgop(+--}o;QC8ej`|+Vn0VVu;;N7gAffXIdA+#%kmi*@vBB9 z&21mnzHX)7r~Wt7)}v=Adt{5}n_u%UoKk|65etTxuoc}j(QS}+Kk55Lxe5oi2d93M z$)ZJEa}P|Et9k|<`4}xD3MX2SLQ-IVVS`kJb1sKuq8|MC&Q7s@oVmtkK+F$B{I^E> z`&{Lg|7D<%@jxjz8Zc7V?* ztNl*uS`Q%e6GCc^L&~z3KlqeN9fN^?ktmH7K$WcMehz)!85K_tDZbSk{G7t0lTX>>B7+!% zPW1T3DO+h@uM_iC{A85Il-|%uF2)Vi>NoK(&Qu0!BjKWvNBYU$-W&sqAEGI%!_?NOO(5dZTY}_m~%8m+t~<5f;RLa z)TK)*k)-n>p|=JQ^d~! zHJ>ZY=#U?ONzr=p3^NuKht|gKDW?XMNg!xoV7qL>JX2?AKKnN2$0AybQaFE8E{E2P zVp&_2UMgDYV7yAd4F^#~YdzM(r`)yA*B~6iQOOc#;L=D8tc(rh+@MnB8Uu^*H6qA@ zN4iW2Xk$7Tt2>vUMnDi_P`VuQJ&(&opgW4-(<(xMCFmOG$=ge5Ct$hY_zLr2wMCaY za9GW%r}~wOGMxvLId8yIm!Zq$YDj}RhuIkTuV@PL~-q2n@9)ho`ug?9@3{?afm3T@2*WAb-^O*O8hJX0}djNJ9 zGywHsvd((z-O#>;0M2K;ha!d6LC)X{nbh+2L{A$$Dh5-^@SdMcdeWUrRF7O@g>8&_ z@$V_44Xw~ydG>*jKHeZ;S7!|mYIBok0hIaLKMF#Hb)4-_;nq&TKUMgaScD}V^=VJZ zpdue?M{f7CHO}?!Dee*(Rr*|)Alq5D3uF*yGUo(5cRs}h%#;qnIfQ`{%Hzl2-wu?` zKnkQ-FwMNLVe?C}%yI1n;jN+2GGapYwQhnq1|x~Zh2oKsv>@W(HGM8rE`z%6bj z(Zw5WCWDk+PQZPd_JT(wv3E>B(#9`z5`wFpNs0A=+Ihje&xc4v6hh@bf(oo^3wN!h zvA%BTl2b0a81|YWP-$UG_bASk*Z{3_#r5!P>`jZOx^Q%tdEyUvUy^!tf_BAr>owc@ zsWnABs%PGLvCM>$bu=RH_XSU&lp_m8!P6NPbzs9LlP1iGhru5zo@7U}cm{`#q%FEG zDs;)L!I@N_*u>aR;xwBFn>VRjLJ(h|Uhn2cjWefvP%jI|L=1TbE4~KO?`>pSg3o5| z6f`^=#ioR(K}7o`n$EeCz@k*&U>XP<2oQG8sELAy!M!ja8uu)J6)j+k*ybg0aiVV` zp3nzS8#F)4Uk_m@gHA2(PH(s!43WO)e(hN~4n{c;p7#t%igi;?sKs>vdT@hg_sMrM z`_KCDZT9LPlG*Z{zsfdJTW9CPlnXP#C}zzhZ?MG+GX3PFA+NHd_|9dr$mtSmxiI z8jW8)&Ns&W5KJ;d@Sd5N^OJB9xPtl|TDTS`~qeg@gWD>#spV6CFeIm(_DR_I*^S*eNEO10V? zL5_^!OU9?MOZv;@{75mFk_MAd(b!*$$dTVrjSdZ)N8^b#i8GATISqFh&ukidiug(! zKMD__W8tTiQHrE0Y*~qa9A4L={S|+DlcM-rI#^0;r$Ryo7)|5rIu=d1<{+tWi#L@o zcBiwJQb|9(w06g&n(Z&J<&~T|WkJl_u_cQi>SWh&T zC}kRxD;VQGC3&|s*hZC+=u>tKEmDi{F}?*kin2oiga%oxKH1z#f*~la`7eos>aJ<0 z7a_Rj9+l0{Zdm3THhT?IblOnzeHrzMZ()H&%x=_OLH zlutD-Ch< zqdSYvL+*U$c~%Hbulfn@dUrx3Zoo6I_67x1%c%!iVv$_Cu&kR`c7d z{fnFW+s&=cQQ-t@&*qPbXt)?VfB15k>%sM3+}wMI0$`$d9Zrq~4?eDKH}i9hhiiQR zGrW}PK*yqulvlP!#=0^M>Oz)`TbS)4PYffscbEXv&3@VQ&31&b0w2(Hfxfk>uK|6m?LFgihR@J z>BKjgs$yJw$>a4(9e#Gt5V!B>qqDnleyF{SBFDs)FcUN(ZSl!;*$+OI@#hz|?5{1Iuk64~CdSM-+Qk$a_+5vHg6Wl2-22l+Lk1%y~h^>jv56HZfk=P}Nz4p=YEl)V)6bPwx{fa~#x zLLB=nA>>rojpRs!hP@8d$%v2RsXA)Uz&rNcp;*5SuI=-q8Sc-{&;}n4lw?+5!-}>i zXH z;GhA1-&OzroXq?G>L2@ed5OOI=So)|gt!Fuc|UOt2*zB{7E>8&=9`nt3~eXbgMxHssX8A9kr@nqa$<9lIQ=WJlta{&n>ILV#SOQO8nK!c#FzcA+GR9V z!#B2+bsp|y9vWf77xw5Q94@rEeJnk*I=&Emnahmcv+iX)nq|a39&DQRU_<$l3!WZ6 zsMV)%e9fJR9yWi#hP|%;XzDa;NM;v zKZHTwQT!Bxklo0cZ){WlBNq59>jm{}i2t{f;9ybRpp4X${D})4G$1ucFij@)Yvd(ZAVPZ=a zZ&WMVER-7Uf({Wpy77ud#YMHKy);WhM;Fy8*(|Zd@~75f@6n_B+_{pYqmuDb1!VB> zsI@DV0hgN%b2iUz=eoF}ZRP+>94(^dsFJZ*{^7Fx^HL;)%rg(fsn4uxels<;Sh1M| z{wB*e9isKc)^%`Ra`Mta`_e}~^C)-d^Rw~fpBF{{#49lUjW6r~zAyv$g7@7k1$YG~ z_y3=7lMJ%={Lp{SEBM`A^3Qn%e<8WtdvC(Yo+pVl5ruCTIqtK$0sV@6A1|gKDb3O z)kq54c4S$^cqQSf&?Q|twkqOYeNF)geQn?VyiV%Z0tC}+K@$=u2?Q)+M2}kY6=S4u z4;1(7Kj@OggCF>7?Vma9R>ZxLGmBHjmrT>K_7#EHxL_S`(}HGc>Qbm1ph56 zfpE59Hh&23e~U_RXEpzXNANUdmZ5tw|G5vbm!HE&bX3bQ^kf4O(6<%a4DuNYZDv!x z(F|1%jN2=gT_+B+L>M7Mh=)yYL0yAB`o55Dt})<#e$tD-qGvIcmzlCIU@*c)d^7Z} z7Hh^O@9EfLSt{6DduwYNvPVuiru$@C>l;j)$BS>lffaMgd`P7yvj9 z-vI~42R7yAP<+Sh&!}T`4|RalCh)WPp4y}oR~3{KClZkd9)y9}xsqa%!h$NIM1ra+ z67outDw;&X@^myZDk5}0=>$Lzi?|4o+`J2MZ(j!Rs(+_BS%88e+ntm*E5L68=mNLx z+drg(|0mY)cfsp)9_C@Ui;H{40W%^ul&|Vll|igq2&#~eni*eMz@C%wgRIDT78)=` z#de%)O_iXYBkM|;vh6J~U5?J&LOK-n`T&gF=dreBX;N^S7E%Z~-Y zsEc27<$dym`=rmcdVS!>Q_PZq`zDP1iCS(z2;nYkc;Hk05=uGVYP(M*t%npDC99u5 z9h5vh3*mM0+AX-$lq=j#jw0doT&9JI?Qe*$6+A<4C4JpqoGvO-Susg7&`G(XfLx-} z7Z8Jm&E}J`5td#i%L4nErcTR@sthY5i@+^Y%8XHPk^iy->Hx3W7gvn!%*2>`l@ptE z)7%w(+*Lh+y|Kv(k6huHjT|bj!vWO9*3E1=e%21U#n6wgf{s4Qp>UX+r!s!cuKEMF z!?8_53haQm4|dDR`z)l1$P(ykEu@d|2;zn7e6@`}T^X#|hACWvu2}ul&)lgJhzX{X z-H6OB1`!(!LKdy1Ca^Xtau7r+rW@b zk9ew-6?2wQ2?v4?qLKo&R1Q7eg`{KZ!(*$dzP48oy)B^p0z*36@e3~T>Wl*vu?Bi* zu)AkbfamYv^*0o+^a#9={kWB$<30F*-?W1=%nC>Guh9L+gy$ayE&j}C4oj*p74}8)j5M*aD}?IwbArrzrt)MxI~|dkG$cY zxb!fSWApjCov;nDa4l(kWqXP4m}pKfE>%zLlNU^yCL`fG(Tdlb8A zu!EJ3Hmp-!u`y5i{P`7AGkeI|`}n(AqHl@F&8z-p->LV4Q9*g+{z8CRgd7(G zA-`W=F-1Ls-sDiZTCclfMU`ug!fOFxthUF~gG!Ow-Ns`=eA&!iVsvM4L}DtwR`QHT z{=Pyk9H!0``<>pkF_Q&clc_n+qmWfcXQe+0#2pXVsgD>v@K#SOFSH%V417ssFc#4&Z_IuXV{F9 zq(212*DMf0=yM}WLObq`e6O#QEWAV1ONsX{bI`wBYKWwvmlVM#T4qy{Nfq=_&qtU+ zV|rkyJK}vh6%RVeVr2IkfBL9+t>OB*-!5G4fK2?Pe=;=$Q_E){wPTS=xykt zZ(`~MD02XhHimX4roS2DfVA%Y5EbP&qI&>{?gAjX&W}PBNNO(UpV3_F9-7O^{F;G| zfC0$i8oCexw*zD~e%XRxnj%zZA=Hnf}Rxu7|wJ1Ys~1Q}(>YZCU*R z=Fk+O7LHsmT%VDML6+?mcWGx)Ej+*C>P#*?#WKg7t5XW8?(R4AXbW;)Eh zspeVxq?OXePv8K^a^EVyG`x;XVO=p{ogEl?fj;-TiRi+IsTUc1o zs8u>6Z-^4#Z3F~5uyqXNMHfeY%4-!4-4I@3X-bY{-Gkq%sW&?{je}+rskaki=)-lg^m5g4;=JsNr(I5<={Sd zd#z6!v$c*bUXi4n8R+g%(rZ*SYBWYalSg)KmUzOe7@EW5Leh2x{nT&n!`mCHRtJW% z?HJ1y8cY8q*!uY!*_OblB#jm^qSEJtVCSr=lJsI@Er;39z>t_b98UmAt)!Z3u2I-P zDB^1a-V&ykk^ShGhnw#Lyy5yCdOZEkZ)DC`gK#1kFX5&qpJp89rdzi|O6>_6pfd~? zp$OTHl7d0Ncbd-6E4k13TUWfg0OhEAwnJrOo)Vsv)v&BGzGmfdAk|2n&MV;C+2T54 zcWJ@!=~HCpS4q}%T$<_1WX^GdgtM1*ru6H)wp(7n}O;6NKaaYWmO@tIHVNEHFLvVMqe}$NKba! z)`UH>H;B&<2-a2;Y#0)GV};fK(Y-nN%Xi(?__^l66flLjZj4kvn?VMdKU0iP|*53v9Zd(o*81MHoj{SmkC?tje zD0l$UPrgGs=$}PD82n$}19WkvpKU(SXi$PK7N&O2j3Nv|cm6sWx5STy5efcS7!j~A zBBdV-16t93FYJz{K=)e*oe>y)diyEhXzc%$Px($X0_s=5P#&O#0eEBwXn+74_->FT z3sB8szLkx=z5IXYAM$r6P22fve!TE29v%o?-Z-|hcrH&KGpz$#PEbkQcQu1gWl5E5 z;y_l>s2;y$Jc$y=Org5Qbf9dN}Za|X-4P#Ft!xL&CnTpAKrpGnSG|RVj zh-|v&vP@s-T}r|7p3*0ydJwjIeH890%+%BcZqE6k&VWGq!?Eh1C>e!8i?7Y;zcGh4o)Sfz=h8Ig)bL73bK-p-q!&h9JN}vG zYT7|b-lMjWhdMGj^|W%>Vvq>kS4KyFGjjcu)gOm_5(TEltZ7v0W1u<+SG)f?R$l^} z?r`3eE8cP>#g3PR;I$|YR53-GT&sileANqoWz_ZZC<$FgVXW1tPA}tU(v%ExL2^bo zdOROf;tHOE?q)8XM~2UnrSc|J`yNamDJuHVl6PBb8ZN!Hs-f$&mjWD07cpK}_Y z#K#n06E`E`|NN|@GzQeG0Ljbb6cIagx+HA;BB+(C#qu%jF`|WH(Q1KvXMWs+9QH^? zQt?(;m|eRwkBrHHt01B@Nt|j_vGPk%Rm|6Urf;7^Bkfqv5z;|9eF_OfU89}VhooOS z1Ro`5-t=o55X!+~f&U#R{1;9dM-21s?w&?hU8f-qY^%%@$44sge{$XKid?SmZB?X; zkTt|uj*TWU*>qv_#%;Po8{g519W$PL?+8^TVye#NAfRT?82Tb#i-7AQ9n7oJ2jJ!P<}0RMe9-B`$K6-t{gV&l)C%?OxgZ(_Ji_5)km&P@ z$nueV&xGn{7@^96jP&jP4-rWr!+!)OvTm2SxpUhal%iEshg!U zKwSg+gl$cojKAxN->Y4r{W?X!UjipcE6~ zgtyyc?w5El8rt0(Ooe}}_%3?5BZ~tAje*<`FkY>l}@`Gtp%d>3~I$Uo#nY#$BBFTBFSx+U(<6FVx zAfClPDPuk?N0&pfuM#N56D^QB@U4D(oK2{~k1A%s6P>fmSR?j{*!Uakn*y*ws?RbvPfn9`gJfSF8^q2&Ame%A>^PXTD77=Y=)@6q z@~rU)t6`*`TU4vF@JlCFBxvRp&MT@w%vvsq8#%u0H&8g+$|rtk(0jDa{BS&~M4U7< zAeJu4QVm2EuRYhX!{cAgJ(N9o@5>Iad&5}}rW6HY^9kEqu<=Wzt9!jcX3*vh?SBj0 zFgOB{_-XhZmR;|byy<~jvv?cl^2)H2~> zgPO8EHw6OK#sl+?kCV+&`X9X=6|r$F0VT2q&yB^dq2%&e$23s(;Attv2t12bVt&+U zl9;j|c{Ypv%GR;+j0S7Sh0OBo#+oOoNmg1gN^Zq@Xf=++S$N>&V8{8RXhhjd$!{_~ znT}x}-0I>N z7fK{4@;xo^Gb8XHs1y7TE#sdk6yR(&ycIFs8>r>ixQs4We=R}_iE(@Y{|(vYMU|0~ zzL_uK`W&99CwzaWGF)b~F4**I%>^*6FUeF7qB*1@Bs&{A!8xGyRcCx*?N*-Z4T%yV zX}Td#WIsBjU0^%5q2&CpDirh$HNIX>g;dOuWzP-t{1}Z-wH9>$r}krf1zEnoD3~>> zw5yAJH|eUwv8&U9clhC8ypv&;9&&=FT3uil@+QZ&205G0_!>(HCm4e_oAM#Ux{)zg z+DdgEcLvJ^!3=VOqh35(;e5VbLO;{QDY01>{mwIED^t;gWYBka8}Vl`)6m$(5NHOy z8}0;*g|PhI9{Qtg`krDeSLd(22ni_0-l~Oz|4@vDQHMiG5&E#&f8XkFE1LHY8c7w# z2Mh?eCkr$Jq^u>7^&=oOd-!+k^2Rl zR!^G*2VC33Z0x7;RiSkP{PXx0gfM~Qv;<+<=do(BwrOAqahT)!FgD?n%WoTq+RB## z6(cNVL7r*Z)3=ED<~>-8AJEvJyX+zm6`!Z5g8_Z46L@~)bHPe_7 zmDogK$^}j_k30s_`hi0qH1!tUkw9w+nGbJX_-Sc#HTD#e@cU6PYd@%oK+uI|hv~B! z@e(HyVeRPer;C}V+N<#~L)14^BvHj%6~pDji2*3Rh<$6IC~zsk-a^e+@A zgxJmFOn`ckHrhP8Bd_or=jK@`0gvgIJnTn-A;_C5e6P6N9?AO?cdR0TohK%V6TQC~ zdoXHIH~+yaC}34t#dCi4`N%PJ23>Un-(Ilo0U6413a*ghnN-SFWH~bQg{glPZEaY(B(BnzaZ#6)-T)Q7abfd&9J`=8gma&~(X zv^paCMkC~9?Td}Y$d%4b-)CQxJN#G_9%~$;DmY>>)NgngH+-%r&Y-TiS>}w=tA{5_ zT6hvz`)yS%x&~#NJL3o)dr=hFs|+w9%g&tCr>yW zl6t_v*oOX^&bm*?{)g}QbH3{ym+ogm3;u~yXp6y1NtrN>4g9b(bQ6h}QyOp&bTv}V4No*67uQ`3* zQ>}gpSfxqPmm`c%y11dqn{vagm95~A&$z&sFz_T_Ik|p4l)mK`s7acd^eyQA&g1sL=h@;0ADS)lsujf~siWfD^h>kBu2yY)D`?3d)ZwKPq` z)WO$<7Txur)a5oV__fZ-oBK6gWQQO!AQisV@R1KsS`@O#>Xu*@*v!7M7Yx5wF`?<9 zsFF_bHT^b9yId#N@HAhLI8M<0B`4ud*6NEPGkeHSMQ*;$)|lD5Rb5vJD)iJS6lClk zGKyAZC;b|_=tou(7~k5UtIMO2VssS5DtVhhQ{^i(RmAyNo_N@*CDJ+Xm_7Cwz(;S+ zj-{uorHeU6kLcg7^1igmL?~GPE_+D&vmD`W>Fj*h$mVQm;|5eEfQ;3j=KG2NhW=In z`Wpf0FZk|;z{ul`(W|_tm%b1Ew=u^3G0?&izeF<75R`9kch{!|jCUu#>n{NEPT0Sn zR=!)stw6@F>3jeYnh6lYU}n10#$djG`LDat-$C|=qtK_L9*k!kJ?HId!VO(#4eXn8 zj`h;91LncP!t_|Ygxw!4kXt=UaKNdNFK9diziic6)Ttgrh!k>uy@H4& zILei!_-gp1zGgiat$NpxZ^&kNw;TJu#(YutGSE+fUv&9tij}og?+>ONI2h zXz+%uM^8j16*B=;72txwlsXnv9dGx3b3YLj)GrUM^GJFLURQK3RpJN*DHAh+C zQ|H!pZV9RYB;t(P{#UH+L3n|cd`#OEW^z%uz6 zR3^4iRb#_v`bJA0BTGH~Ixa?!laQBINdESH6wk(k265;)XT>826MC4h@5J#LY(#b_ z*@F`-%o+kYZk}+`jVc@xUg{ZCzkYc^A$XL5?R0z^R8zWt!skS zT-w}yqM3~k+fpw=H2%<4^ABGj1~^LiL=d;?i`-DK2Ei_%nxNo-3IrVk&Ch{KV4#>p zKj=12roilW%R2=T=bzSmD=D9!{-LNK_wV zgB=XtW)HyEa#E@VG0BCz=lwu6JxS=af1{W~B3SMSW{ew9X7ol+9hGpgZ{9V#Mb|Sf z3U5haV}bD|^@)RiLEKdFIasy*sKLB|G)V_CPKI%2q5B9EvSTPN z@K!hQ;8%I7>ftw1eI?phkln}8q>RcOBeYih0d>(ZR%d#GE_UrGzR+(e4dVGZdexB; z8yV=k3N{3@XG$PL)3ftUZDe2(!s}~C>sk^c7%rmM)2%T;<;;s_jMVsoV9Z87u=y17 zAzy_pjrpyEG!~u6LFIW_eKm4gg_YmUcmPUz^y0nu+?)+c3R%VRJ7e?_C@S-)z|)UA z&{OGF1fSO6-c!l!!WwXX>@}LAv%B;De}ez7Fx2IiRRn~gw|$cO<}AMxO98_qQ7Ya0uMz_58O4@_wHWzrs+J?+g7AgRRZh_(@N$JMo;@FoR_mvQzJq zHg3ai&)~pY76JWoFSC93Zi!cB>gq34G-42_Yvc%_Qp0 z#l-r}RL7?Z#Cf)RbXAvssItQ507s6V8e`9=gY*eI4d6qLcX*>3AjmX13*k&<7Z2)9 zEHltQy{#VC@_EYJ)ysU?};w(&aKd_JF|AxECG3Pl6!?2(RGtjSrcWtdy4 z8?UCWkXvYYilvvt;ZiOto>{s}?}9YJ<^$uBjj@A-1gt&wbzjq zb{RW*oiIsY7rkX%`Hepj>wh3pw6-sQ6A~%kHX*8?NpzJ%(9sf`TkZ=-o_4xsNuP>O zdpiBP0)HLvKb=;)uln|Bay4MYQP)Ifke1%h`t2plWscDwhU9E+$Eb=MlGQU!kFa+0qF_-1yi`C>LQ5MWjHMvE(Ih+U`gW-IQm|IIplGxmQbeAHEo0?kMYNVw*#^qqT=l6~l?=b# zV=Yhek^EOiDI)|cds2}Nc-P`mh>PZCz7^VnL)>ehxj#b~Zy&U&fGB21Q1yKD=pWw+ zg}|=-SSlG-dXkVI^0&f0T}196{(o3_Vw_k zU-kq+WdjnDvMXiL4x0PgLX<9iIQ3_4Zv~>X$6VA7=h= zmH$F=a8CfmU4e|E?sp`IhX6hW1QbJBt3B!d9=rAA)$ipJg+zbqO2VNbe;0(hbLH*a zXq^oie~j{mM}xkt3~XlLJt{1M)RLI!~AYZBu|#^!@VRcjLdS z0?a(vNQ?fMw<;gudwCQYNM^kwL3l(}R+o$d(RgS)ykc%P_;7v@Pl9?sIy@%5l+w@i z&2|?pYTuiOG7iu=yl@Ny7}4_Q^J7s87!MB=_CL^_U2Q8J$NMbVj_6&4nIZZN$_|!G3R2JC}KDq-6dAx`XFQr zCt}>zX50faId{7oj$`-u5t_WSN+Mb?7hVGaOI0LfRGoWd`79w({2N$hySR@}*j?%z z#N$a6jWIn-%1Z>vVY+dshsBB{CQPU%16jV&P_^3N2unc+Z;pC@A+|W!IaYe{G%;@Q zH(dQWm+&9>xdu1eJvk9gX&TyHnm`=|;4ji-*`zeNbae z9x@LPrv7U4QdcY!p(tQ2O>y3#W>$^YaLsC2XX48Z?}A`IbcwN2v$FDM>g}%U>azg- z;1NOWS^r9ihaH6Ze)bqdJqrk7aQG8usw-C#J(T2@OLyk_v&47X-2BIhpZ8Q`xKn@G zE2KT(d07KCtNh(wfr+20forsUDr&*Bf$TLjb7Cm>&Gxpf`TuU{=Xa6Vf8WqgMgV(A z?k^eiuFVq(1b7|}EC3Jzm{AC=o~eD!muYgL#+!G^1+!sf4v_1H+KQY&RogtIuksjfbS zjfd?!GzMeR?nsC8qOv1gJKGsL^Qy#;Y|x7wzbL*;!oH+xA!};# z0_3_gc1ZEPkxzbkRK+(UlzLWU$PjS@Vdl6m;<@1R&tx;@TX%Mz=iac;E!6blx#ias zzu0~?=E3iAbIbwDhChM{*8PdfqVzN->3|l^i$F*UAA_+30Yd%C(D{T>Erii8`vZy{ zgWGD-p+3Zix1mnqsU4a9>M-e_5w3i^Ah|BY{Wz-!gV5aVDR#a+Gsl9l-A0@sRbVK? za6#i+r~mc5D-QNBR&$}|EC-7WPV*-{ z{G{Jlmz#(wi5UFXa0-aF$$Fg`T_~GYgvL)Q$j!Peu5l_ii4xPcbeHr(H^sKdp2JZ- z8XM3EQ4)Am@dPOqmFUrzI2-Y9#P`@lbko;Yk;jxfp)ScwLJA&15Q2tfpNUChY5N`% zA6wac#(mj={*K*LKKa_O``l@r%=&{t`4ih1sR-wfnwJh<&QNI6qb}@^1mRHZQ|30; zd~+Hxj_X5_cr79@p}&LBe{n?XtJao`_*cRh-nvi}@2C`~QsDi|{}62d!x!AkkpAp8 zey(N@>O0&ha~jckNKUx6#DU$<)K1BrDM-m;*g1I!lCzud6q|(AfJWo`PJJKF8`f)X zyfVCdMV{hnUE&jtpry36A`edOjf$hUWOheDV zjHp2feDpq0A>qcr6@_mqvn;}^YAG|LFHT9iERkxA50iO4tJ4&N&x9L-e-MDSSs4FD#7i&QVK(KXghIJ<;+MlfgRcWe%Z%6B-j2k^=;%eI9Se!R z7UiEva*N_zv#Nxhc1-euq^}WPky|^a?5i1@Z3(G-?ZRIiiq&51X0Q*tLHxk{Q2ABf zwFL6<8l2oRhWeGA2}7GI%G}QD0V$QYl*S^1QUci%7Mgg>Uk|tBxr+&t0zA*GhfF;5n8Nx#7lK@fJb_<9yndHibR_!NXY&qb1 zXL`BXEM%R9^s3Q1b#7|5FEW3AQuDLj{7q4N{1BZGbPIy4^1!2V8Epc^&x_j$7k4QA zbHcklpp|N>4!|=oeyxp8{xo1fbdUk62ld*Qx8XHKD(-&(X+Z zmBsY?;CJh0`A6LIvw)204`&Jv4O(4N*;Lxp^QSWfkA^C2@8IcVX>Q>{^w^m4RzjHd z=M+VFG#q(JWuQ$*%-+?`_TKR%e~yKnX*q80@FwmZ@W zpfL}yyV)3+Sy*msY3x5PIazPneE*vk`*-eKpL``q1~1$E*I`L3Yh+2nPgB$to##yc zl)}j}={Tgs7@`ZS-47L2wM!DW*uPO*Z;$OXQO&puPH^n|P=Z8rs8n4SJc zqZ$^Uy(AA^_E;?n8!ts9CVYMg%WjkEAeIx3F(_b409}&KOK`35X4Ry>Rnt+LhPY7M zX9<6p&Of7l%Hpi?8Qxoma!hpiS%W%qP{{8{s>mRJ$MeBQf`9-A0}c6WW$Aa$vJ%|4 zgsq{>b9gR^yc(s6xWY0di2)f3mKq8a0yKaf1N8P2{=iiQcJQ5dC!O;RKGd%AYpZa% z#L43pe7YW3!HXo2hxz$$B;{jy2@YiK8yoV!9FsHjAot>jUAo{928%Y9*(iQx^PN4F zVd4^$*A^e#f~T$ifRpLcA>PSth4dDEmglqc^Vg7zAagDr7w4=7nqX+y-VK+sWkj~Z z?+qBd%$apM(uU7zIhC9*ql!|$|$+D zpyb(Y;McEeHL)po@VUl@SW;>zS3Q4k|3aq&`_nxAa%#_2(;^(=9c~c*sI1sK0A=di zbk)yl`X5_6K!1S+7#RQ*!~nVD$#tm@}IpN|B-k1e}9L6LduZZ*C>(gHCuq< z%0szY!alTnSWnA<5I#MzpWz(%niM07UNb^#9(^ZMlUle2>Jw9S{k~vTv2IRq{|-L7 zS)RGC*h6Enp>QHxa_jdG1BTj@K`(*{$ zA!LoY6`(rW-B-&hk-Scy> zFN&QFYKuH&?S+~%vA4inj*YJa-ZCX!(APEuW3!EYsWmUF{|LSegqZ9gwh)5camCwm zT{rz)kdT`*F)>qhXCV6Mvh{9r{p2sN8#PxYx!t$BcW-G4D5fc(Q&^ zEPM3o&tbiQTez>t-ibhS0OsMaGu}Iohi=b@CH=p%%RixhjsGAM2CaFVg}JUm)^5&- zOPut2oOkkovVpK+q_M#Y#Og~niF3MCe}8CX|>NOm`c0&fuRf!_?T$3YjtTYr< z82%d)+|OoZ#Er?ow3dbgt)xcEq*DCCZ*eA<+XLP&Ao20+*MB=cCQ+PgGfcFezT~$J z_h^a#JlvY4MM1J~lRrw107SLREqcVG)5a$^Hb*WXpMlCI2$o}`Qi$_3erFspIRq)o;Xkqv)raqpn zL)Ta+0l_Sx$-H*3tW!-;pSK(X%KDNj-rB*I+sL}){yHEL8|}>k?Hi4j3e3wWxgi_1 z3kqYgfu1Z#PLGezG%c_=jcPq^qOE=3wnD|uqKX~AVe1je;O=p%Fer>&JU8|8)j5$6 zWZqW?QVPIDXN`e-d6i$*HhXW096t}x?Je#O+kUD{YX8>T2e4!Bc~#bSrmtMI?ErLM zyT^L(biXVV{1A}e?*gp!(+>-M@s4VUx!L*rv4!3-s{Wv;4lvOllqx7Va3w=$UHhL= zBP1N8xHZ7>0NA+z<-P~!fT*Y_O(-_`3{rVko2X8M{5fW&(W;&a$w$cBeaUiz6x*FD3pNTCZzx=!KxkFC@}W5mJLbO zKqklPNZ0f37)$bQx2EbDigcL3Z67x9??<+_dmXsj`fo5$(+_csKLsd*fJ{jA4XQ7{ z{c6pa+4q?%NT4vSWuRo%(hZv6jkI0V3^mlZ5pJbnW5mJ{%>*pi&Q-hJvX35k6o)ap zNNpOsToohU^B=|%z%*PvbBnmy9dq>}vN*JMoJKT()FO?Z@j|}I0VjWAnz$2ChnN5> z)yuyu*GL;O@D(wIc+)F|4Q1#=2F0A{j_<`Cp(Sx=iAjf z>oN^{nW#p6Dyp+XuT3vP0+B(*+Kf;fOPxHJNdx?bCX3UeurrCCc{$e^)K6{Ye{rr> z9`GMy>~t>AiPW7RhEgos3;Kq(mIA+#iS0Bj9a)cx#-o=O$PNKyguJHasIK@PBgv&6Kq+_v$4?0e5$kZs1o0eV;^hBUOLOyuBL?dNrP%NOvGnK1sRfjvekgUu_ z@`ZTmlFEpDk5JBORuVR{bsa>NxXx{TYNeS%LkmsA*xwBhJ>}Uj8G1{%u3}i|U90m~@GVw%pF>CL;`R`6P$yb-8D* z8ONwsC7(igZ=ij;uiTVn(1E+s8{w9Zs6`;~E#Tg4DryB5vrW*yqa$h;bk z^)F0ll)*lpgjeQ{G;?baIB(`<5!zIOb=7^fD_9_gZ($-64Ks)#U*)CMPnby!W$|`M54j@>XO(Q2x!Kyu@hwuv zS8(k26BV!Y#4(&=Orvyh7vjBNDMe!9cASEaw&e;r1S(>>!q7tFvSvo#_=XTmeMFEW zn;!s$!|3w^f_ly(6B4?A1QKWTOxSB6o+1IG44S_5oh^n{D8@N1^k*8bq&(YCN+{Dh zr)N?|vRB6kgvjAFr7CYl^s`GHi`uX69msz@q3)5V;QZY(2pR+M5)pt{&hbZG0hIH2 zqu@zVRuiScTRiBi^*?)z|M3ZN5B}i4I)eXSxP^a;2AkN1nCINg`>IT$$|N0bMH`7= zpu*3vl=`lNW>3pcID@0PT{lV~u+2wGX|}YWNrfBrQamSe3O$#U90cY8M0LYqgoR#acc`8hfF9ocrOIgn0_&aEtw1m;)c zs1jX>w8)dj?V9ZvM)TTJl`T!2p)kCXc(8bhQx=+pRSC;^r`2l-shUz{$fC&j>Kc+J zX-ko#^P;MF`kEVQ?0u zh*wt)$omi&k$)B(xKH|Zj49)+5ybU(8RmD4F~@^FxVu6ny|!CtsWBESwe6jrGNN$! z7z_H7oQN2+>;<)5L{{p;G3S;OO8a-uUa%}XPA}#QHuVTY1$wc*B2}NUfJaqhX*rRY ze@D<)4KMbTCz-D4WmD~E!sTRbMNza_lhmVA`f*-{m2m%z)sUH)1YQ=DJnf@P8#x;> zfhQ_h&)-LuLv+TYV9?=^WjdU^jY!V6MtLh>`#tDsuPhRw^5iM1$oi7-mz~$~jIjvc z6-BR}rQe1UH%LuGi{vik)~Be><9H}!MyLq|`Q&Dhk6V|`!*{cJ?1RSOtUGBt9&m?u zYQE5TGi_v5&BC_M`0n1Ae>QeJI)VMuJkv*{8m``7p&#%%An#uW{CWLg&`+MS=i(;7 zfGr4CQRcyJF(-jMO8r3qqrm=?d8W)iN06uia%090jV zk8s;Vw2qluJZ;NY__<*?4DY@ra1`;fG~=U^US4@n_+We|ztL0`?rR zCgPGL9+fR}yOdg&&r~bRTk+m+D_1olsHsv67PB??E1|(HXDMli_1@@xuL+t#-eun< zN`Egv4Xof6cH5{7=3yPzRy>HJg*V6g^E+70` z%{-(U$Y(XoB>l5I{iP^456vnF*VBNV-Or%qTK>G+w`lvO&6gakb`B#>3NojCQO_E9 z*84~l`3Ojph+aY_Q?+z+?rmBHa+)W;(r0Qh!DKjc4tH$(mJy-(G_XJ>YK{V%;{n(K zTA+`D()DyTdS5Zs!O|-zCDuSU&RQ^;BYI@Oe={BmFz_uH6g>ps9}r;BztC9!Cesgq z(~MZNmNyXu&zf(Nr6BVMZTV_&Lo-Rgnu~<7J3~eF&V|qM91De{9tq}BHTScwO$(T= z8FC25I7~}dGrjx7HXK=aAiwP1V2&qyH`^20{dp6H2 zy9CsO-*~keKFL9R4^nfXz{UYKUc}&v*_QS63v%+;91-7DZmqNQjN0A|ciP_EjOS3O zQkFM1mgd;{Ee0EafgVREnY2wfbtiH`_A%`%tLWh=j36ZunDg66PYyg;N}?)w>Em2S znRp5e5zoFwWay2E2|okYY{IK$91|O3ryc$7GskF#Uwgnk{%z9-537Sza7Uk`=-zIB z_Db2`4OzKMC#-Z?5p}Mh4&9_rip`265&|9kKB%yhhHE|-}Agoa9XcY$c>tZ60RQb8) z9#O48$xwr*V`l3mFDr8v*N1b4CnB$6c~rc+E`yW%*GtSk*Ukt;A$^#b5Dac_`@)VK zFRcXrm32+T&kfaZVh&E`0KZ4o%f2CWNfvPqiGNizp9zK7)x zw~x&ZhJUmD21@n8LX%0`;GH2?ur;Qm^V!@RaRMy9h}hlZD~yAo=c{1I$`k8r^VhuK z?kjj&-385wvL>8o+q5u3?Y2FL-Q4St0J;?3B$ z;hTEvG*!Ec?jy4$>irDI(!{6WC|`Xq?OotnC#7)Te?;Ss6)^a?(Mp0r3>2(IV4hcM zRUj3%pJTUCp)W%hFow#KLi;>yhcSsVFgqGrfU{gI?r)Z1rSGh!MYhdwkF;5)CxHBNb-L-ts9RmYAHv%GxA=RlzioiLR3 zy_FyCC9?8GtZzTnwie$Dl~8upuOiseltUQ;_4_ZR{d4(y>nro9O>Mx;IxapVGhQNe zyq#n87k*|vAd0wSB!DP;teTe(509w3ke8w9VVKR0v0146{4lF$zgyT#=`3d{^2lA8 zIFjm}PtLOC^Jh5T#(QOinQ(f#--u@SSPjqZx0UJxtW+CdrD6|O`h&qrq^bz@=COg^d01%%LVEnWC>It52w>7dRR^<@vV#>P5dJWgD#d5?3zgSzxZqoo?jNktAzmfJu9!Yr>(u$Cl%g9~nr-Ux7 z%;Plw>7jXGGw{#8mn;6>3wQW6K}kfSDFFytptKq#Fpv_Gso#9#RYM~XO?fWNr?cZ@ z#E>?7V@barVK?Wc3M&h1P^t(f4v~(CwFVW7;%~?ady3sOYorzpar)PDiYCS{c>U@} zScp3MOui4#v?~@5Mulu2X^Mu$&%3HpV$#N99kX;7dNh&7k;U0GwHc!Mx#-wGu#EQtCxjy!U(^>3q^7|&;qgJ`@ zq#w%#dlTgJX_vk`d`~LSmY|Jay3g z9#7}!BgV7%-SfN;F*#lB1yDNhI$%f%E*a>|8%6J~$V51L@eMCy&x(%~=8}_m@&d8p zSeUM)^1vX_a2dQ0i!sgH-6m&-FPR9(&sxlwXneq~D_?$2%UOAew^}6Vpyl@2>5xOI zu@43l2RT`SE=cM|PVb}rW~8gogI)Th)BB_Vsy#oML#QBN5cps~LO=rlF&C*q7_42u zQ`~R%IS0tzp1H`5#DLawVVJRRvsPn5YxSPwZcp_7F8#@%6~5Cc`HW<=jn!T zuqH5DbqQ%M8bS;}LS9(wxyqHpFoF26(HCxh@|YwGoC8u(IE-qAyxF|y=n=M0)|(Vi zoX@ccI15x?VvM-(g{~ERA}2{FM^rWaCgxc+8Xg+kMkOm``pVH*Y6LQD1LSM%a*a@} z6b)+T*{PM@&*XI0uEl;fLXjgrs23oj_O2~gkZ*^lt6fS zp2S&RqX+%o=6_C4G_|)gejqP7KPILZ{<8N!6Vsmn`67)}j`6Rm0UC{(^nFABz!JN2 z#*-le4s8uL&U$@THEwV?2S#fWuWI2CzXn*tl z%*^T>NS1PT!6eW^IQHFJ{Tozd^EQI99fnjQ&yP&pjpAqXE{oOmx5&ptDN-Lo0&Ptt zjf^ZJJ-Kb#%BYATPS@UVc$cq8Mb;&I#(`#j5=(SX7AH~MVlS74vG$_{h)suizj`-A zH_9IF25Liu<8VUHeHB?gKcio=i!R$9@kGjV1a|AT)`|8@m7C;}G%^{SO*kl3*0Lh$ z9?J9qRvS{aWEfv?j;{Pd>1)WiFZ#B7v@6ycNj}TLFPU8|91ppo^jtP(b5rQZyGD_g z5f-MABG9kvz7~G%SqFhkie!a~-&|o!fM<2cxJIyhi0`(ke zege_#G-eO`HIG+5Bc@KHMODqc59Tq%2SKkyMQbRrYU`P;Cur!T7x9{RXf(m%!v!<_| zbv@6yd|MfMiS6xUKDK-3a&RCqk@!k;X9iX&C*ieH1%?r)W~`WVsc`z*$jm|a1P{PK z%2;e^M)VyHm-IB%Qa=}&kQ^l+T(|3oGRuo!Ma%x0yWjUrJMa3oloEutb<(YA)z&Qv z{Szd>hq|*t3Wj~^Oh_9~u6?=`kL@j9F3kZsJSdi{5KrA$e_b}lr0B7ZCu2FD{kBKY zdV`;WJiT@U{c(}^Dhpdfx*3- z(>8Rz7wNOO$LdFi2!y|Y8jKS#fQA(ioZ&wNW&kaLKc=Jf){lT$QREl-4+U1hz~CVa z6A)w|rzd?#r0{;dD)M7*LM0`+pESUqbaYS@tiQewpzLwi0{HV-;Z7r#nf)HP@0jer zmjC-V^iMHe-B)a;jT0a+8jhvs8v6vz7KlT&S0wL-7gC=vCFW8|d&Fk8NH)jrgJQ2n zj;veCsZS(Q#i@H&O1RF_#^2QUx3RI);PXZcl-a!KIg;huV$68e-y5a0-K~x2oSwqZ zjZmsvtc4nx@jBZ~Zf-K=c?EcNzHMBZZMB>ZOb<#rJ7ge8;dY@ZIc8Lebfqjw38$?8 z)Z%dFvZ-~`q~N5v@LEsVfu(@9ow_X)TeXW}u3AI#@5UpT0p4N*;s*1=F4zWXF-jaF6fc73?5 zsW{H8PVpnAo1^!cepKoxYe{ltt|9+=)k&^&2->nlI-rF8IJ*0r12~`LyZDU+%qN=O zC&C-`?|wqIeXi~Q`V-*$7pu5W11nRP0?67YNLCONAY#%5lG3LAU3{kTHBcc*SPdg9 zr<|Hf1uVpL{NyVy8F@Cpos*;Vc%$dFsegMt;_MPkl(HfX2@}ZDe6k?lIhIg2=lT4= z<_4Ez7Y;-ol_sJEed)uZsKX{{+1?kynt)gvB;&?(2o_1qPt>l1@`Bl}`X4u%vb(6; zSzA%yH(K;PUEB(w;rUC<<|9Ko&dWog2` zTv7o{YCIe2WOJgF!HnK$8&|lorLp1N?CuO%J)(sD;+T{j`dYb)6XjbSF9ll!@oJ&$ z(?gvmo;r>W1YogbO=Q_wp(~Z_{mb;$Ct~CpC`l!n=pmJCxGL!)w?PT4ZB6}8IzqZlak6tUsn_|otDW8!@&e|c+z z0<`<~jLB7MLiqwbT*|cateTSbC2FUW2FK(arJMO#<|*w5S&XMhr-S`l zyEo<~v?-Z1zE)tL6@X)Dcmlt9ep@^g#LG87Y#{9Z+LBcee^am#Ogc3f#%!@dLN|?! zP1K+qZ4Ddkf(2K`9|UW&;yQ*fWg_0>i^74Vx;^z2vKx6;b#{zP8A%Kr%~;P9Q$Jsn z4;n#mQbr4mH zBeR>q^Nik%;5b(K8@!d~P%2p1uUwaUr*<7g++RjuXKeusy^G=@d_P1SDfwHc2xTb_XSMml+SvT z#thlB+yZ4=QpWRM*pp_ni`ddC$ad|_*}>kB;#M>3WeKD~hDqZ!4=Li9MGlX|`U`NiK1)+8sR6@d#0gRIiDg&PKRe3a5O;Tlm5TgqW~%eVL3hNn+)-cBmESP-^##6n zSm1i#L?psD#b-KO=(^Z%c!k`CICPZE&Q5~Kfld6x-!N_Ufkjt6VSd89Gb)5d02&(w zcPr1M@nmU@=44uaUU2Y|~u>Al78lCrgPh_OA z7ksHMKB&*^A8b%)ZHbJgbI3po56B7pq`&}LUXX6nH>hE{omDnE?A?|`c1||R^1C%-$ z*ck4!^~cNq(Y^l(tUnJz!#v}QIrl=%fK5v=!{etnxG7#lz=zPtlnVf~;FJg%FH~N6 zdM9M~JI9Dmta2O-uc@gfuG3N^?Zg&3rAi(hzVfEor6;JJ?(t63qlgYVk_?`o3)(=v z90#Sljh}7F+TqXqu`;DbVy1LNzxeJUfaQ%Q8+ z^NEyMyQJ-fqb}*ZlG+{Ml`vWZF9YkF9J1KZ-Zuym;mk(_d#WO|%*Fn4Et^%6DD{S%Q^;n+ezwU2>@Ysh@vf>ZQ&Yfn_x4 zC!PFpo|Ji~C?1yFOhm0S1!2>M_lf{+WBNloEu}}{A&6S4P<}&hQC2`PadTiVohvS zUM?ky#>T`&7uq~>!%I8jTZgU&PdLF{~u+Y`9eVglT``m9)r1^rboqD;>9jH@LSGl$)TmwM50 z5ypz|f-jJv2dot|KWgwrr4rXf}mSI9cAI<}>XC ziULBA_$AscNC9vHG^>fqHLN8>kXRrJyROiWN(7pc9sG%&%K7den7~kh@gxXMVX^23S3k?5atjCncA7kuf>K8AB7CJ|MjqFKoifP7(^GzJdcY}%u)I~3`ogC^rW zAGPAqDR&aaWhL3uz2QyG?bH0k8y$&a@@R<9Wzhav=;^TSa+i6aAVh<}J(^ShIBd~3(X|9{ z^z5~*jqb@tza{_xz#Wh!vp>r5m46{Sq$0g9q$~j4*&dJ`8YpK*&@=aK`OM?6`|i}m zr~FaeEuzdIL@#iM=8!0yGP(wKrUrzR_J)RpfHJHdpo5iA*T4WU-^QL0FhI=7$%$59 z7ch|EuK7^+zP$e9D%DTUAvg-O06QZaGZP~_+s~eL7!+gyAwr>F-v|(T7NBMLQTqi& zAr$)YaS5%B?rBVSANRp!(A>4Rv)|VW*dLU}897+)4qchp>Dd5BJB;_s|Mx!7Kl!2x zpaB~;YHxK(P7CKaj~p*-f^(Mfme~P#VLM*(swjm>%3~qxct+3132aL^UV`t zVsEWwz3z8Z%RUw-ZR;M4W=dI%SZd!1LMM520s}~`SD#cn@e(Gm5Sdp)P212KeD#k} zoIt3I3JF<#9S-rSB?@6BIU6SsVI~Ep307AQLg6^W%W-c2aTFhZB$=KEw^Ia3wRGas z*5vw57civLg!~4mSBQ9?jEO_Tc5}vaEZZ|isWeL+EZFP8bceY%@}bCBXAT#8Ei#1u zm%C2LkOKw+Vs^15avi(Sjt0zQ9CeOQpy3@wI*ZDA%qnU<4C&%jk@jA?S9q?x!<-&X zeXcICSY!k{$ldMiUXX^jIvkM?0kh@ShwMz4j!zzHExy1O z0A{$!-;g)q9#vp2NlOu{YA;;gU+DzlbWY2FWME*?`>g(`vCPu@OnIaJ-FvcqYH|Vk zDF3g4f$t++`}3hc&)tV61Qa@%=@}uw0AB*pKc%O9B$6j|y!kZCOe;uYRBzTk}lF@+m2)FzU9y=5}rn6#?ZhZo%FW-T^NJprj zDM2r+P+P`ybI79aaC^FneiktkE!=hReNj-7LsWKF?AO7b-7CW?yXBzBQG zulwu8VHl#GqE@t2=iClC1*NOjna z!5H=;Pkp-=8kA4D7^2nZYN61|9LZqd-DqF0z~w_UlOtKOrSHuj13=Wvq0S=hf0ZRMeiJ>gRP(|P7!yG(*!tNAO1s?g~ z|7*uRE;z|N21%FOr6e`AY(a#o$li$&Vs1?K0^ zGDB9+OP9HwQ<|rayj-)Gp3a36YLwGhZ^llu+L)P)M9Aj^Xc&WKA(2{ZQu=;KRGAW| zLV35`8ZEOJ0H=tVf=~KJHuC6A0PMgQDzC9z)dO;wzT!f+l<6z>1z{Dm^^36HY4H_! zbP7EDUcUgcy2fHTT}QnX&4QWs|hv3s;~Q3tyDuEv_34 z=Ji4sVVxLv^#;jPQk#nP{G@9jT9n!``frr!3Ik_DQwXrm%OkLU+JUbaxIiP$_t{oX=0!>$c zF$b|to5Cw!@R7I^rhr}CqWbdIqa;vewQ(ZA*{M-zN8Iats+GhNzwINdh3d=WgIp{n z>@(0Y$BpH%7Vhd#;!-QU7hW-ij-qLThP=7>A0R>1MQQ32PwU33l!*=-=cIuWuTkSE znA*04#6-uSlF@azQar~t_Stv#fbqG-Ur0drNV5TD1R=b)U$!>dwiBc0MOudi?Mo2^ zvgnHQ)a?ve^zy}qRqIq^bgFLFF@3>tQv>1lY{Gzbxy znMg^#p~4f2DUnkBzqaE18NVOpMF8`-2jFTI86>^uoNJ{!^|%#`B)!!V>hfuhl;JML zDxw(UXA0+a!dpUb9#Pj{L5r{4ISIrGtt=Y5-g^H~cF0i*1@z|ne@-IcH}li(JO z>em-xdVGz7m1%G8!lb8KuvS=mpa&>fC2pa82At zVAqPFi?zusO0zETK*96uh7y0PWxOj7MYg>`X0AXLoi@f{52dn@3{j(zjs&sX4pdl= zD+vOFI{HDN|2m9?$itWYq(~_mizPPB(u}jKYP2ahFm@}o50SILwLbgES@h}~8{K+{ z|LNj)u<2}*EIQH^=y-_n`2JjE3%8-p)snh zs$b*bt~!(s+u4O|D`81d4s6EEuPxN7@v|^D<^Pm9cidrW-mq*5{pGk=&Jo7d!xbZ2 zIYBU)0eW8NNjNyY=SGC+$8^-09*i~cgs@K1TAUG7$SVGeoD6}$X0TE7gx;s#%r|X^ z5IOUzT>(72k>4|@mfqDvn_%H$3f%+ne>^++aTf;jZ#*6b;Bh|ykE$f!b41l{Kk`3pV$0)=lpZ?@m7(rzUI-PjR>O7r%J!1_}vw<*WPJ>WHf|w`cV16>pva#tHVDFNYHJY{}$A;sL-#>*$+vQOb*mTkJ#0Y(%n} zXT;WKUC8J<7|JJxM)?Kw(d-}C@dCm88?nipwbCmF<#Z-cUMuYD6IdF0w4-6Z>R+Y(prGdz?; z@BG2qc(he}$z*?Fj4g;Ee1DR+V8TRSQ~ zUX^?=UK}1d-om=nRtBh7vpqs2P3))OVEu8*@`@zyuK!LsJ7uHJ$Wua=HktCoi5(GCm`fQ;3>wByY33r zUmWUChT7S_WyI|ZS+GIjtAV+JXf-Xz8zP8F)m`)A+Y6*DaEul>60a|@`)Sznt@9!R zZPBDP1Yz6SBW^^=nemw%oT9iEmqTu8QA3nPJw?h*rFzVIEGSZ_oXUO;f#EUv-CrQd zlm^jNkR^Scdr_w`e937v2?<=vzkjwtN00ZLV&S+|&~(5>??O=?5gT+cRFGUasw`N8 zNr1gBYhNMrubN+L@l>-&Jvy4&>_6E~WcLhi9lYki(B-q6<&2&(1jfQElgm|sahGaN zv$cOJB99d?7;z(3@G2g!@MFbujJKxb?ZwV28eK94>lxq}as5@=SrVAx%-iG^;`qfT zG2qL-_Ufr~kQz{y9_f?eMAP3;35(lB7Wp=Ts^r(&FTfjIu)~;7Gc?xNG|VLzpQ(iK ztFt!FI|xIu3EIGYpVK1B$_aTNm1Z&{w;_Tg=KSvYm| zr^mgI$WhRKy{`Oo^Pl>O%=AovEELdm_p3+X*Ye-m=AV!~A5A$cr+bMYES*Sh@`WHvR_$<$k{uHTrU_ z0ebQHePXuoFOn&CM!aS5@0ZYlmXHXj84xDpls*YEWijL7i#X29_G7Z`1)#ZNL46zV zNjo|zqD3l-+2B#-DMB~lrgI>|^rCdiTh_&>%iq4hPoA~6`U3NY$l_q8I3UKT;@s8T zcczgTiUn~*@R;Sw?7)+nY>@NGnq`H3l_Or+XqB@ub}k35Jgo5xzZ-T<_~H4ZCh7!& z1vf^88@#4ki0mpNt-OhN6R)G>j5!e~-pw&+c$T<%@8^n%leN&oga+sspdiwU@Fol6 z#db2Wmc9tHX)Pl)r!O^?Tuq@9CT5>}2zMx~8R6(1=58i+-_Yw{Zt*B+Q89#F`%bq1 z&J<~m5?izd7;iMOb~%abJ)6M10?29(rP!cMEh`=r>1-B{N5`qx4d@eur zNmXF^ZfSvOuPFgzyEl}JI(|hNy>8zW?d{agVqGyD5r)66znq3uW`0wwQER5OiPEpK zmuUG#3xZB0RP{3nddwQS6{Wr!{h}Ojntm{L<}5~>uMJxVX-10JgnIw;LepS7f@q6b z&kUTh9s>LMXR=s^H(s&)NVH=|``j6{l)R?oOkHjdarxbW#$UPxe`D@U6K!!NTzwF^ z{HvFipr77PMY>M>;Q-@r-|)x4{SO*9_q|O3sv?8)Mo;ZxeH?$EZD%3No+w^>z$v9_ zU?uFgh$@aqVdWA7|CgqK@muWNSL*~U>%yzvE^#KgO`VxM%gjUcqM=IE@p*?|`I7x_ zST;r&y64Q=3MNUQmXowP)S(=U@++L^>U3I!Ma>QqZ|&nhL~O-g-!RnesXTcil1hJ! z9mMfLmb(CGyyshqr8lun9^8^97!}C%Kvwie_lXWqx$$(>Rsr_i1_y4m>C`?+KehKW ziZ@J6teB|*h-mW%G^LKQ4b#Bk;z)(pXY7H;voPH){y8K93lmP(0iOeK<(A6jLmI<* z9akFqDNeLA53SVTA*QG?a>v}wo3v4}#Urt$H><^PBcw&B2@k{B~0`SIYm=IJ#WI4x)ks6_W19{1Q=zHHQj zky_2&*;(99$HkzA77_4xobqp?X3`bntHb4pW1hPk7HP6RX08UMO}yiq1CF#^1>zrG zMj;OL@?C8(E{Ee-=WawyT~djM4BLNyb`R43LF@D%(3*?&7g~dA0gzf95WWijKI?<(QR_4#M)n;%leGqbVO67ibd+>B=d%ID?fH)<^`WYv=sXTZx z`P?|JnQeE92Y&jzyG3`Hv9ToYg>5AkMG-Vyeter$7~GX|64%rgaki8#yGvoHx{W=o0}87c?w-@mwF9Lb%IXeXHrFFc(hD@|OpVgK@uvnHJ@kz6Pz zyIDfbPMU=NHL&XW^HyAw7e*CB0-C+mGEbF7O9*E0SNM5mhddf$ywlj`;Svne=ZL== zgf8kXpv5VmWqBy{Nfi?Hb-&#o=!n<(hR+ha)vdLV4hT&=|C7nuU3sW3)9qcH?kAh;%^G1mbY2cXi zWcq4W;zd*b_W}Wyj-?>ozM!5(RwUviwVg`I>lf(uR;4muiL+(P@LXv`DAwseXr0WU z43G)R$BTi6Sr84r65Ln3WeSZ%Q~^e(8_7TDvmr)pxoNe41--Y=XFq}{Q-hycwKfiV zfYP`&po<1DQ0ym@MEi032lOu!1vdi(R7L8>*ba8EzEB!oYQ6aZAJ8Q53= z48gl&K|t~I*Ye-q?w{hVcf@hua>XmQ#LQu?DIC{M_(Hf`C7&@o4GXU<>R>Q0baM13 ze^=@w2oJTZtlH#y(QN2(l4TiMD7LNVi2vjO3iV@^F#4CB(JOp9t=R#4f%0acN=a(| zs?udHsdk$5wd~YAY)8~*`TLLW7n6l+Uyaov9DMa7R53eCcqC3NO~ zc83n$GZ0KTn!Pjn-7-U^MhrtA7kFPIu`V~{x*qDtRSop#zgS|cC}Bq7Alu?FT1#>* zMovmoGYaG_JFe{Kg+O#WdLqS^C2Z+7P#9+WWxO_;b?^wSn|eVW<87j}9M9W$HFt0i z8lrKaHelm7T5kC-Prec#N5RL=77NQ84SG0&?wS=oWyeZ%gf|b-y=*=|aJ;dho~Htk z*zh$3aYJ9wDdXT~)7JK&Z(I~}$3&RE1O8AOm>!G>%O0n+wKJE&L)NTFzCT{VQQXBZ ztyEG~Gd+DVX*Y}8Y}sO{eHg^@)QIljyxQ=HDcn6tz*H1b2-ox~wRTk3Y^YyqS~^O! z1fVJ`rbI>SN2!h5{-(qZ0|+8QWG{4uiN|XOOL$Gsu49q7`{c#vdF^<+eM{}H;-DHg zT~D*l?MeKRaDX>|*Fpan9{mjk`Zt)Z+Ad{G6$nnx+D4nl#qM_Gd_>LpliA$oykb}L zFqKcD*~?@!zpf)BDq;DGzg7w>Hb|aQ{~iR~rJ9%gmPCo9&J2%GWgS>g0OJ$%tiynn zQk27Y>`Wh+_W8-L(4!i5XlwY;W;{%%L@66+o@Mgm@JRa}g6|^_-lsr~3rxI3ATqV` z)40jCLuacZ)sG~fdQkT5$hH~8Wng*Y?EGeFn?B6Tdr@_fyOAPc#hcl3HR+Q9MX9(arPIr9GF`HZ064>|PDZ-C zB=EHhSYvebZr^%Ftjo&=mpOu=-HH-~d7N31HP=m$m3Yl>rbmjVy73M!uv*F+?6`47 zYD^iuwy#{g*obNOuL8cpE<9s zgSDfs0f6iGvr(S$kJ{q7zaiQH0MR-Ch!%fO8G;8d2A;d*K=jRNu`2g*M^ zZ}j4iU|LY-(aa}#2kRGi`~K3j_?-#=y7YtUN67e7Xq@qG#1jKM3&%Y|0|Kkx%YSjF ze*)+1asC1EpJ_bgDixhtoH=z?3_w!d z15+okBg$?G(7eXu@sS5MQ2oI^EV5Rk1J1bmW|NqQrJj_AsyFBrCF15H7uFwYr|mw~vm}%?Cv#JlTAm6I51~6?U5sOQt}!i4HtIP|xB6 zm&0|my!=gFbJ*L~@%W+L1?^B0QIM4 z>7;`$Y!kOV#r$nlmYl^Q?@T!HYuqo#ZIbm@<6*XvJp_OwjFf6W%@h9@hj}VO!&GHq zCCY7`*BZd{Bt+S&KoK3IW+?k8tH{*ebH*F-RYUm1R!=VkKA-fXLWYMZBX^sg)d!l; zDQZ=Y6%&0(+Mr)GR_;l)D#a>P&KH3gCE=XiHPn3ir?$77mMKEN$;%+zqG)RwRm+Yxd30fq@Kx)NE{GeUXbF-D_F>e-E~I%PMH zKf!SXHilXffbG~tv%1K|ntoGKu|lEnf*K^`87k>zn;=LVd2e^*k`=p$BF*}KQgyt( ziPt5|m&Kqi9hR8)?xwi9@#v$w3$PWuU`Qf{s&ecV;wNhF&`-GGqd>ZCXo1WA4|i_? zRaM)rjndsH4K5nVMK{tN(nzPIbR*p$-6cp#N_PuLDJTdCNC`-TNcWkbD8BEv_q+G_ z{=NTm4r8nVbFDS!eAeQ*ueS!{8zO84bGd(HqM%D`WsSOZ}ME4>~ZYU zy7>PhEZ5*1Gwbs}1kuax_2GI|NYuPyWi!9iF^x`db4r?rPSH~TJksGx7_9Nx=esNlzY56_ z(Qxy6)t{$~TF7tP0>U@QwcjJBHeLgJhaDVk z2{;ug2zL#va-{9R^NM;_CyO{DtgrgIHpJe2_s9nV3^GalM341K4OJ;pm6A6VmtS}# z@qA^vhdHV2Lm&9Om>pw^OwXcQH%a+B3lt(aN8=kRL z1=?Fkv0xvZ)j>-^Y4uWm{i4FP?-u-wSh-R@&;yREhyLiO+&+SG$wg@onn*JLpn8^)3|E?0?y;UV320*hA0L}M*Kr<9d>tFU3Sn(DRtEk_y zmsNzM)P>|30FJ%Cv+mv03jlM5)PZKZA0tn0tmf-_0bm>g3n%d4Vr9LunSn7wKq(zN zJ2yMG=KsVk{|TDQVW)c6pLJP>k#0xIrQ0FhQ?lKB;+LM(JuWLRCN&@^T!Y1Ch5yU*9iBl&AW7Cj4nwKu`LO*IDAeTe^VyUh$@Jf#0P8{u2Qyl?esrlZL*ye|V> z6R2`E5sv5_t07?cX6x@nuFMujSeeGM61Ue4Z^ZVtBDT@rhqZySe7@b>M%%2_{xC|& z)-JeGt`4R!Acv*w)s`i0cxAgcbLG>*^{-zB^kImP4JCS&Fsb&JoC;+G9RhF&d%R^ZS z_Fm+18vanbi6T~^wL64Xq!8^^!uVd9=2{@(+3exTuBS;d5#=i-y<2(aFeyl}`Nhw%@Zrgf8577DI)GES@`se(JJqoAvM{&+VGfH#w>cbh(%`VS@G`Q|zhob(ynMveI z2B$g^$++bMw>JSgK9BU{&s>wE_~H~d1*73-jg2S<p%uB|_mC4yMr#sz%MGLbczDziya%Lwi;iQ(?ln$^Q+4+2mUhw28P=lY+# zxFbs#I=u-|uJp7l#;Sq~`@Co`{3j52c!#{?VPQNlrrd%DE+$c zu`eoGLPPI?-*x6Q8nV8^fpQVmT=qrcdnwB3R{sE|SvxCup0G?Y@*U8>b9C|K8_(0C z@I})E=7|5YQF)u$d9YKuAw~6j{gi%Np;wDqO%lh;vA-z(>%QauJk@6ly+YRJ)GwVd zxA}rNY=$%5xN;GjCuYZ*Gjds_dBS`Q&8uMM4C^C(TWs|%oG5jyO>&s!aYtDDE)&mo z`@+YVpbrlhpr;&MY^1rBH)p7NYCOy6gg-bLE=bcs^*ofBGyjrkg(mtKLo})scKyh$ zB%g4FlPyEJ&!8wBJEx%=*+OWtZ+q1R-&;c$y+er%O-Zr(#s@Crnzd=pX}u4kE_S@cCUc!hQc@-H zuTcR(Z@p?)P@Ca=+v!~dL)|puQg1kg`!t<~4BNqKh-yFV{_?e8-@OS?x|>+rnp{cH zZ(E9I{+ArX0(^V00N)<;4c{I_d7UPXq+Z+nz<&5R{#Vbxe8FI@TXHORo9jqQQ%wG$ z*pChc>>sUf&?rb!zixlsi*Ut;$I1*0y}uqabxn?Ub->BOuK90V`Je2hz7h9+bdr*n zK`S^W78S1v#aQeTCN40v-j*%rxj{yScJ_Z)wL5fab&21#&!rdr^gK504$q5aifAMx zwaD&IRPpl@lJg7#lSuZ{IVpE1eY1o2Jgli)LN!Xq)=?^j+#Rf+Ou4%Xts;bAc?B~* z#x$~0Ipxc+Z*OM2d|fw<>b$@+epqeRn!Uf^YuzDkqZ2VF_eMoElz^2PsY1OWCoH*h zgO{y4LCD<8=`|my+n`ZVA`289_aa(mSN>_Bm`dsgSSq3N8aZOt)-LE?%BLN+Q@neK z3@X%;B~0^OB?7$zv9ikCoa7rLkjHa~qH=P^?enOb!DP*)ggF;fHFtMko(15qZoCMo z7Bvs>-wplX2v_(PdF=HJb>Ks)e%$&#_h2=80!R|8R_s!Yk{XJAu9z2NGLt(^!!r^! zJI%fak1U7ql~*I~4oD9a+K4U@3JuK%z3hK)k=ZO80mrJD9k>+Do@J{|}# z9b!xv-vY32o-ew&^QY`I7kT0%*x6MbjmX* z$pQT~jB4gUY~9>|LBarFyEJzPsW5}t*+JqQEFfjBn+7376doaGV*?-xWd)KmF$SiZ z+S?mgo7jNFfO8Fj9D)IenGLu;&~wiW2L0uVe@{aH$9^|4kqKJCcS?`yn4!grimxrI zj#jXLk>G2;+ch5rM>tvq4f1FACL=Wl8bqL5$}syWIy>Xs&^2 z3Axmy62j6?C3*J6o>rkmD!P^=V9&fc_pB#~mMxBj?%5QE97O+AagrT7um9wgyCq`L zoBLa4Ql?-Z3U_84ZY{4JBF1Se#M1A~9e(l+O~8!5p4PXOCp~Xeg$t?>fCg z4QXU_Xm8O7UK0MkuDeA7CQBLM{Ln>e<-5`Pgz78NqA=*WM0tt-BU^g*u`&*}>UX?H zECt&OuA!$9V)T>g^4a-oM=a?ooJ;F)L1;ZYB`=*qn3VxvK?i zbvLtX=!W~t!1)FbzL{1Mw}8P+TeL^7*%_m0nI{&-+=X%(vD4Vl9(za?8z;RN?{v$s ze`u7StOeI1`Q#I~zwHY9H`otF%?ne#P-{=m{U%>)DY3sw<|%Dtk0XD1PjZ@FJh>9X zY%!1dHIfD+zAr}KL#MMfO`Ji@@vZHLAq)nW4}=|H<3&az`Q#ya@bm78%e%bSS@I<# z4Zeu?4EPjRI%Xy!Svj@tK(QR-t&&^oBao59Cu{#&y({bETQ2IsQMl*Xk`t?$gMPLg zajCqsiKGjU>QE+QIKQ1g(yU79HMbI>f&`p<)lg_2r%#R26DpTmGd`afK5&idG9V{= z3Rq2@QHAtetB9KxXq&(DE#5Nvc=~=T3kN`10F>I$>OYJ=fKK~`IbmB%LyJ;k6#0r| z8`ak#So^6!-#RW6il_Cfyr|w1 zN+g?;QL*G`PZU z7%M|`PyB@VQ|y4VX$@iu;!+9j9aY;md|7Hp&{dxe@n?H$z~1|OR8E*J`2+WT~m)v0e>?41X^2%+!JAk=FXcXZp8!RQ85g)nC*7MGq8n zzqGqksQ07gJ>aR~4PSEJvi%x6gQHEOm4r_nd*L3dG8o5=gcICsRJC6br#)v~_kQiz zkR?R)w2hjk7M!4iMbnVb8l{Z4l#Pe;MJ>0I9%G-FGykaW;Qb@*(8JfGHSvxgMlT3! zzkMAe@fhYCC|KCX+a3@BUA;~}rE_56DM$fpAIb$8 zH(>XgTL%vFz{d566O}vQ=lq`kW`DB<_lYps;nz?IIbBay|ABgIm!Psg%7gyp8*aJj zH+@b74(o}jXp%hMdo_#!nMpnnq`pD|z%zgqK3#uZ% zkhXvV++hQq5A{J#k^57)d676c&NqujQXmt1o_JyV|BlQj1wQ|iRpyY zgiS(aX^E)-qht`<3#3iNan6d`ROIEfTDe5(X!^rhiwGziDYfr2X-Qi@TVqJ4J%Dwd zb4l_EnKs3?AvU83SEzIJUE0&nbXOf0;GD#<6mThdg=d?9;C3H6?4pCW>Hz_IF0bxA zjTZ@h#Y_&;?-{I9AEB$_xiau6<|l=JZK|{_lEs|4d`idp(fxx9Th#Kg@FAZsii{G{ zHB__ywB{Xtawh&rU)`n~{F5;8maYH!H+%zhIk3|Je0TqVZv+qev=JO1mXyC(2;ir; zY<$31|98j|nZZm~mJ~D!%?(-Nk2KfqrT@v4cmN9%w*4LF9Kvv)3{hpp1Xo_DVNO9jsfe(*-r7*tyh3k^7Ru|)s()AL)8_k? zvj+x}o8{1Vh%wM)@aLN3H-bzqId*kTp^!6zR1MDExi&Ap;6v2eym)BnjHgxtNX^<}yzjhI2JAmzD1P%a|(LQ~X?Mv!2R=k-GjDaUts+NzKoW zi6_VcC>(oW_$>0p>#=?{5^tFoO=Vj1iYx-tu zfjAtNfvY6#RnuJ*pM7Y3g`UI<^v?D93PC*AZS(F%NY2Ki7Z$8Kw&9|dk@wl-_m!9n zdAde4SmUIv$Vf!zO<+&63{msJ@y+;RW+{AJtuj0N8Ruf>feub9sl!Yx(ovR?MRQ`T zg#b`DqMA0dj~Yq^b4E#!Pia2z`bq!OFOT$+O4hd-dz;4zAMw$>{f^%oXGv{@KXkTA zb<}T{<{fvzW*Q)$vVKR3>y@$h9pmKC0}tql#bY#&AJ)< zBeHR&EPiLhreP4_v-jOSm6Wk!6SlZ~C{gnt{oSg+JtqHOp7E#I|3~fUO-vVrhZ%qW zlq!RWgv8chC&50>j-u2oP9u_~jIhcU`izp!F)*6n)ncz9JTHm21}~o!hC-IVBys~+T%Vv2(&(bFXHzpChMs z(XNeN3!)S(-eyG~$n{6NKlvKmu8-i;BI-HD#$m~;k%hJ#Obe|vn6W#bel~o@cTO!Vy?IQvf zH#g+k5N~uPN&YsgPuZf3ALQ%oHAX_Q6D~xHkH*6Zt<#(7v$RGnAj2*zR=?Vrt(_6MaFWfI>0o`|{D1ZQO=?`V`cLE+?|3B5l&x9HRHoTC% zxx0B^{IT=9K_Za60XtsidkoP$ZFjwuHww743dEQQ@i%N$vCJU?lFroe-Z>8J)K*8-a!*lx$FH)Q~aN zytcFttSeU1Lm)jfKORphKhe)X1u9jMMfbtc_<_GSIPf_Qu{iX%mz%c0fwjnvVPSV%6j|ofBgRc zWCqStqHje^g|IrAzAL@w$s_+HV}$9>u94#aB&h}GTEIhi87eJA5i8Q?7QLg;`}*cl zZ@-Z(-djGjAY-nhzx#de0>VP%GT7uz4ME3C*(YSSq+!h8lN>`4v8afi_fKGDC-6?H%lo*GS)m((p{ykkM~`H;$T$&8qyt;Mje1+_fr|^$;RxkXSCB ztE^zdRnay~8^d3b^bnJuEl77s@?DazAG<96hRK0tH|&co3GA^dQtEgNqzMY%##T{m zaqxpAzE9)h7F)br3v?fo&>9Gr;ibGeX^&l8hg3GT#4~by&|*Y7#UP)G=Bygl%B1#rYnI#Qg zNr1CJsB<<<>2R7PuOj!A1IwK*K zxA`R zFwq>+;i6O+U()D`atEt1aJB@B#?Pb3(5H9C2C^9ppx38Kizr>N@p#s+-v8`e*b6?o zW9RdRghSGiOh`M}Zw1dTTqsm@*-JyKpgsb7^`%v(#AX#ihT*FSzqR=1(~mGZOQ*lc zEijMvY^;1QzlbHlK_WPt*gc}I?Q12jwla?P-dpU_8s~f^j5eK1VDmIYr5ne3-rbDx zh^GxTmoJpp^`*R#KMW~?X~cIwsrOpv74Ojf13n6X0uQD6>C(?>kr3t9e2*}Hl)m2Z z&=?r$*&CR<>pix9;>cicbUPim{u}3m0i5>-aNhC<&ZFzZMSx8?df|u(dQ<|;;cxG< ztE@inEtm(gftc4`4Ga>5gFZPr6H=aZgNm2ADU~S=kB|@RvAwLMbEH0i@VA=V@8g-goVnPZMv5j~ zCNPZ^#z@vv05=N|iB)5an+e`&7d%;Z!FB(N9A%=#H<79|RnziZe29NN1{SJ4vC>&q z4kM8__9WdKJ!Q6)oL!6rO8cUwAT5P*Qg@fElY4)WmT~0Gy)LVwZXydvSZSu=?v4UB zDxJr9!%(Ehcy)05@+me2#j=VkLl5z~U3$3@>7`;>QVN=Iaox%_yT9giJu;DC_t!04 zVMk7BT6_n3lO_$vU1N4e*0`nmj81-Sw_@R}HYIgb_{2^QVJMiy!p`$}qa!B?e)Xq>GR63sB!eo2Z2zX)Au zRxO|&li7?e4L>oWe8f<|KHZi34Murl;<9N z{J1YvqD~IH)TsM=^<%d+RjR zI{u(Cm_94D)Nt|r9{}y^5BBx>yDR>ur+wSzJoM~7?^;PEbTNLpPn`9(Em%MG30U9? z!$B~dK-V(s&t`vsVCPn|Kk=<*|0_R?@k$68fewFTTO$XizX;Vebi+qW&+d}Tf9p(F zG)YS*%ML>c+;zBbDR%++r4YpkvJJ*GFC$s+91{CvBh_#<=%Ute*jhIJwB1SUsR_za zCFf8H`cQ<;G5%rH2FZ8Z=imD4x9cvQIi0l*tV4Fo3|YwHPt6fP*M0*C6?!G{*iY;u_gof)&Uo@y&*!ENovE~k#o;e_?rgI)E1`uZ zr@{yZ5PON4$Egpl4<0>ysz787Ba(JJ#!HU3x)%9CPCR0VchRE1@szwS?IZ>AzNUsI z!@}{$Cumfq9oB5kEJrA?Cnh;lyqx}It7D(-S zy$h|0HkC7Ue;{8<+{u06zDI*ID|8^~13Qkc=vIPJ{BZ;N@mGuTM&?*yL5o(N5&L-y zPSxfT;)FVLgYP0Sj$gAzkSN4oAe4IX_KZvPu8|<>E@})i?MZ>2EJ6w@RLGmEHw(8nuznR_wn8`NAHhMsd z{w**5KQP*P&VPgXX8_DU0bt(#(`c71I_{q`vYESgDE~vQGslzM7Q(JsdA93>7As1|8$+!n)7HMuz`IWd9rq>w zLOG1V)+J_A&t8xK(usifaokrn_lY}}%js2tS$^)$Wp>fy8|SDe=~gGR<$im2ypCJD z@|hI8Q@m@=OhxQlP$0%a*DdKsHlvb>?i711Em)s@Dp-uAm=v)ztXDl>>u9#B4c|qJ zNL@^`GEX^jl?028md>N{iRquQBq~xjn|Agy)>^KK_w<0WD(;!gNFp@m$`^k37v~IE zUwP{*DPk&bPn)LQB1=dUrcLHiU7S3zHK*v`i6}1rL?GoP0eA8#tGW-Ug(j#os4NkTsb z3}Ej}G|h+V*FU3CE4f3QjRh2T_p^e zQi4yM`AVd$$xaM3gRLXfTDa-m`{qheP2;l{WNBKu}_>0z0SCXBOkS)rv(Vt!qkjP$o{Rf>}@C6)q|e@8Wb z$AX*6yrB3`@^|Wo&%Tm}+0qf-h=iz@D92je}*b`D}h%AeUf; z33~690Wk(4ZEm=G_XTYJeEV4M#q(EDbdCHeN1q%JHN>s+)Az=yM-nDE{q2cH9Okkm zQlPnXMy1>!?i2NFq=AUwDa_SfE4j~j0(JO;?? z2wu|!b`oB`r!(Bn^+1eCHhp#n@|_u+g%PO}v`<>W0JE+cMq0l_9{+tJzZVmjaU3rv+z^QuqGnsK`O zJQ;Lhy0s0OiGo#du0N%X{BmOWevMAD=yLZH4?g?CA+;w`+0f9csZqOl-x|z>S(a z=8w_*mfsEbGUO|IlXkEx2f|6~WR^A&>N#F(2=SkJK{FF8D-(cNUC+SCz!;dX2>f9U z6!4ljm>Ad_ndzBZJ2;v0ko8{--`Fp|56=LJwW8Q6L?7f zivA+OAfgpo6gn)_75?Yb*3()>@#Eh8|WGs(J$&?|) zg!GDC!7-sy(bzJ=^6LZJgm18-68ZLA51kXBG$UWpJU?cTPuZrIw2`H}zw*IOYnHgf ziL-kA#KT=U-2zEX^Qk#lOg-1P(Y%kH!Y%_x1A<|;!E0 zL1~c1TuaFf2hYDIO1_={!2cxy(5-;s)CfpG_74g8NtBEpMD-Q*w!wZC?EGh4J^|KYp+Q)VK6hytyZ(S{~POt`C9fK(+7dBi)w_5`bH zpe@mROuqNzy5_@J!VtE^T4xHBe6p6YIMhc<7tQuo~7Md472h7o?{vWl_Ve8^X5H z?23Yr9AH)OPNq7`6U9yLTRp=7Y5%B|mgjud{eTz8Bk@uL6oxUN=4s^7iMPjV)JSv= zF>f*mOL_-Z=CbyfqQm7*%Q*-S@ZAIFo_sgJ4$;n>i$hXO3ey}cD;_;8LM+m6`8=UF zYhS33tqTF!Cw=lDcMTqz6e`lMANqA#)K5P#9qgO(&uaR&nos)zuWm|2(ry7a^QbzN zVfHhA5F?laz(jz46$tHt>9PO<)*#AT^sB!&=hf(yAG6==S*{6KZ)b-8<%MsR4c$!X zNbyw;CNfJ3irJWxt`|iv_AQ}S80)Af5^=3UNj+Pm=d(5-l#{u?p9xD$)lt9d4`C=) zTZjuYeICPiAe+Yfq2tprTO-=p0xz_L z_Gg!jMHp5`xr>LhXY0b>xBK7|iM2C4TRCFLbySn;hOJS!J7X>C${k$b)wJsdWSsYG zGCICJV}GUtdD{7;VO#Wxn>e!<(nXKU8-cA<=}T&U}T{I>Qsk4+qa!>bu+=8yFZI9NDPY`tOuwF{_O=_tp_B2 zMG$anJwIxWZ`N}iGvfvWyv$&L`j46YI%am2?)-W9M;GG%p@pRRx2MmmT4bz(Qur_ zj%xx2#jcoN(F+}Z)(BR6wJqMJe^`v5X2VYYur?htejtmDHMR8kafXjKo!@Y{- zH%!9}k0RWW49MJB{t0>W3l>m&c^5}WBEWs^Lk~V)+}dl z=cNsTAOlu`Wsm9yS?H134Hh;H!BjRvRw4Nh&n=9Q_v3H~@uMm?)6)8)_aRYc@%hmO zxXAmMqEJ3ST@b2{$-j@_D^tkby(ps{fz5D3crkD_M7B4&(sU0GCywV#;?oD$MCN;q zbSQc{DWyiCniL@CPqXL6^7&*%8MD?3M z_(ZdE#eTnJivpvR>CWUOL#nu)M62*@6XevM_XtfC^CPX1KB)X^rGD$AQ;}{2Dx0vq zrt?giBGgf_U2GoWPwlQzLZ*Bq@y4$_kh@nVAVatbl7ftdMtOr#tWVJ2v`F4*S;f%}kuL(ShH zY4UEpn4JVdz-!d8ov7MD0*%0!3GADHg_0l`-{)Z8G_Y^-&w!e56i`WqKnDj23kweg ziE~3-ebpxRR}sFZ*D$hm0Bip`0Sf$(L>}THgaL#Dgb9QV1PHNHCr`6AQ0CVvnxPS*U1m|Cb{W@xg>zQ?2J>A{CUMfRT z^8%`PIxj@J5?xh>PW>7067%#$7t7AFmT@8n3*JT^i_7?eXl*+ttxp5Lh4s_4kRC9TfE74-i(sV!>kWDST4=R6+je+?N<8GsH zH0`kHd?M94vn19z?PMR^kRwT<%xEypu^U^g0Hf&2L6kxi`vb}UdBUJv^xXx3LQ=0kxY1Vw=BD!TwI&6LGf!2NI$^&RNiOP~wGPnVfX-(sk9x~3W*#Qr?~)Aj6f&%SvZN?U(h!v>eT26|YGOMx z$fjQ)xUtG?@fiTPt9BA@OA-Tq~WMcJ^Q8H$NyJS^k{Y zru9pmz`y_$vk-u#x$?```ct2Sjc$2cKs_eubsaI_T;ZvhnSg#(%3QO3|5-?be5;V= z2jwHnZ*_C!4gPkvt~Cpw@_=m2Rfqd^(Czl&|IQ-(AVIg~3i4`}IV39Z+ace$mioeFiDP`qP5n^z6hB^p7CCaxI4c-z%%* zSPDswzP@9(P@cUZp<(wu8$ANyRwzZ2f>-2t7H6)|g>v3LohQYbXD=%eR!+P@q{#m3;7AxEx?PwCbLxg;OB>dxGA53fW z#Y9~2C0mSmnrrYHIpX2 zqJdUZy_6HZjMy7sxVwf9uAla*qm!Yzqk*NKrNI*?J%=ZHK-ssRrHv&pTn-=-d~9xM z;9w3AS^|4JxJps2Bk@s?1MN`GdFmDs}5Sd<#`nly0U#!egULm>9a7 z0NrRZHbw>}R^~T$D-t%hij%#ixtj?{*xbtei38Bg=4=Ag@mN~hSlL*ZTY`k_fgZRk z`xPW}wKON-8Y-&7QYu0+%z(#pW&0vyQ^)|H37ANC^FiDI5CZz>EKS_auWot$q8u|o zM00H_V>A4`z|AWlpo|b2-i~pHIqTEy&#^gX*1|J3}uG8}Czj_?8#FAIB%)y`oxYq?&gq87tG* zK%|zu0z!_Nk^F}Klmf_S{YZyh= zWoy}UxZk-+bvNA$K{-q#;=K&bY)92BX!m$wfoJw@di*DOg-%P{xpfDzEOM3`iM#WJyg2^xQRyi< zf;AO`H!eJ4<+Ia=?U{)YL$&7+8Jc%e+n_}EJ6>m!>1Lz9Sh&Wmza%QJBFw+bjjz0H zzyUV{Ja9+1ThV5@+y}6 zpJXY42pub!<0?w`e>qF}pRMyh2pL05crZEj`P~gXby|$U`B-e2vM->73^ynQ;hi*( zM8QW43A4pN9D$gGGUv2-a_SOByAQ1|!x4@{j#G+gw-cy=VbR1UlPALBV$cSVm7`@(j{fY?VknicgPqT+6)*X z0>uom4Xx!~Qs;_fUl%faStEW25$PoBt0%%6g5Vas0*4l=etndT!IaD)ZFKN_>mBAb zDDa)VI6kSDtnSg`5>-Z?*lF^0Hh7#q$`{k1IrdbJ4?U0#Uq4UpUJ}#u;HXc;a*tha zY4V?{_-F3jz`)>2`#PH&nfw?YcxxkT{MyI>ftnu-&`=6Z@UOJ)RjAnGmeReIVMqDT zGVCaS%dn$hid>fj+|IE7^a`L+@PveJr`AobROR)$f13EeE39x)S-5W3%Ku+o+&^it zR>6!t>-jb3U?Mp&(a2WuUVpfZ4%!R6dy$J!C%eTu55sVnkyGK`ciWP^lVVUYdRuF4 zCXTGUHXuvU-fS84>}j9Q_{wgE0m_K_G&9^8kdCUm!qoRO z%<>oGKMNCyTp)1=e&b8o{cXQIZ-7v#`k%$h2jd8~2Xkd{WU&RY+zLeh*zra` zSW1Dt^c(+7Zg$djR2n!hizNvBw==K9*Z;|R|HAl3P&kgkUB{2vsmd+i3(e-TtzVB@Rpg*QZ(BE8R{Q?y`vM&o52A04 zW#D)#!{!5mx=N!j`-b#>A1xq+9`11aXC|z2Bqm#5BM!$;#JTD5G;#h<>-4YkxVJ!v z^cM(0B?Fo?9(eo&Aq4vS=~_6OunD&laA5CSK=g0+cwTWvUe)%X(B1TSimCml)%zeo zU0tVTf3$f5acq{Wd3rzFJbxVi-(TQ=pf`)KB%+fEPq#Y-;r&7K!04Q8xDVfBgABeO zkec;FboH!>K&S+LKEF2$Q7>eu{n-|WW#(SW$G6?^y$JUVaNrgBJ+-W4zyE7nffrzL$=_6H2~(0^hq@yIAN}TP9(B!3D?g zbB3wUw56}N`LBB9Ck8;1*v~C)pvU%mFY~puyaKZtI_g2}nR;!u9QL28=;tWBhpH=ROqzv0ZOSb|AI#+nxjJ z1b!d>JD2_sw$gBM7^gyxGU`P~n1@V(hq#PUx#0l=;S_=$=`h5KQA;ZI={Ig`oi+Zv zKHs7oEl{$U4$jp13dWO#^tpu=y#T{qTVvL&0SYGD#*i1ZSx!g3uMFY3e5bgr@0XLD zFlzr-vi7$JY>jO6@R(S?ou710RXa`J4SJ%!4%xlKD-YGY;>8@M}TPr6Ay_-O)t-bjZ z1ADhW1FBrVHqF&sI_Ovc0NsCV8cc}57Ma~olMCht@#A`(d7|XEV~kf;8UL+aBd+wT zj2#={O7~se`lb{T8XM~-j{5M&A^;QYYUglsUssr1l>lFbPJzjn1^8aKR zeSVnu9_xsG7{S%OR>}6sIh9y(vA%rJmuqDb!dy7Or9=sjX(vqa zNKr#A+Zt|`P+xG9@?Z<4rU;m+*jUw&zmT8RY!xakLFmRq+a6ZlvU;C^1&JN;*~joO zp-?nL+D=|y_4yPzzMC36$^#>0?eZ_JUU$#pSv7>X9J}VD!e^;U?$w0z)`>i_ET_nS z5*^-Uzox^QTsJVI>#-fbLnzSSN7~Vy3{{kUpyiUb@0F;^Mr3NGX9PHMH+&`u#F@NL7(@=y*A(hy z?Gr-6bf+4cqJYH)I#q%m+^Y8Gr7)B&;hNy5Mp$TD_}s+Hb4gaD`OkU2(P?tip3BRX z@3ea@5{~i?BD!>35n4Uq#-xVuIUbTTB7A)gD<^?BinCfVR*Ny(l+>0TS*`L1{9g&R zgSqK11@IgGd5wNcG9MtxT!18len>JL2o4s<_78T9EAhSEg`%WzOMI_xqAVpLe*^o# zT*;fKKuQVC#M{JDi9eZtM z$NO|&>7vC-NNwUMy_Bws(y0*A^=Je?pIvZ{$k%AUSE@8pn_A1ueh&B`g672if>MxX&2<2co{>A_S-3S05fhak#+LjB{=y-pCZ%vObKh1!Vl5C3eEj3*7m2x^5$0TZthvy z6s1(v&eNc=O5tGS_m)``i+@4%>y(1PFi|KY``MAx^jB|_kUe|ZKKgMM`Q2%JH;I-= zUadIvhf);SmUrOnw-HBPyjTzn=v&5PapaS=raLuK|Nw&BN}0esj+Ua@KF%5f*QuVc`dkJC(bRuj2&^{O1?L++Z+Ja@)0 z1huM~Cx}3B%N=Z$YsyQBs%Yp5`(Mi&!HrkpZUE%TZ_KURHE)K$#myNIH+w+bG=GTO z9f2?%_zl%zmeIO}T0O{hhR=&*e|*zdd4$_VE)QjyX~0xh&Hxh1JsEog3mc%(SIXVc z05G%M0d^c<&YtHi2$)0#wVh}U6yktNx%Ic0oNAYo(vJnsz2t1h_Pn8SFMR@tsHNsd39FCwrKhh$0Ud^HPh^DEO zYiCs`O0D=NF&*@uh~h&7=vM~ zGZ9LWtkG)UWyz9KGO{F$>{19(ipUz-iCi{1$o3Ihdhjp2!PE>Rg9PEo3o;R8UVKa1Sk8jPA`?y9=%Z;K6Pr}LJMPWrhIwYDmdEu6u&qF&lSCMRQswDUlntV(NnB7 z*<8=iDZT&lF<3wGMVjmm4XzgqO(ot>KQ;Wl$A9X=;iTVw{ehs)1xS3i+GB+kmy}8qTgatR z=(PIyGAMPBwZ=O94VZHXgClO#Ev_22w!+hSqcJCtArE|Wb4Bfn{8>Aqd|i-OYYZHp ziiZ2(ixBuC48F+PaW|1WXnRXj2m>BT0bpBiy4I;kq7JO_f&+f~H$Vc4cB#NXG;oX2 zO-rfd>J0aULv=$e0iZbU=ae579_0sxB4fLWla`VK zNLMrppNax&5N{fd^hAM`#OhMSwqlCpv@*ME(YxTE)=hGS~R+piz1=~E|82nOVQl-S#u zwx{UYN@NTPojl)wQ82gc>U`xKwZHdd@WejJVdYcv#^+oF z$@}K(EYe%%z?XSD%qE%3&haIV+G#(Q3Yw-UU2H_>k;#{s3`!icUbT<4Zhezd53bUE zQ2?|XV4spmx_}}<-5laMXf(EiLp!>>X*?BYM*%I$u9#L|{k^itGw}13Kl?y;Dd<}` zl%ne8cR)j878W5``6Wh6FW_L2fjYRg-L8nPv6r-$x~(C;-;s~0({lFiD8-s5bv;cU z2cL<5OoAD%td7B#btK1M?ke5FH!(r+&)?AIEN1$Ai}GUfc~jmVd3o_MYM{cXNg)H4 zhi6;I9Vpn%AqzI)mD!cL!!gCHC&Ngc7u_55WoSja?0XwtKbF89Vs&Yj{5Fs^!W?vL zre+oybL)op%>DTrV+`lJZ-+gXqbU=dAB|7;jG9Uo|8nbM`qy=ONdU^^su`2?}3@z_QikduhnGVSC*9me7-xhR=`JS)zQM=?Q&GSU& zAFOVyBitK{wBE9{H);sM0os9sgYijC17e z+XBtE%Et>7pQqL=Uw&ydZ_(d|4bGNF(-<{X-fCl|^cjhMix-t3VR_lPd}VXXK!S6{{45}o8_NX3usWVEURnEf52S=tKE!5`O zxA~cV!8J5HR5vEE9W2GyYLb7oq0?_wtDE!oSt?=v0PCw4KaxhP;LVTico^m|#lV{*iI(79J32TRZr@M2RM|Pfh;e7cRx@0<}C9!;6 zX2cZU0m{K!>e%@0@#gof>Y*|ev0ZXU^vYDYvDf(YdkH>hs}r%KI2$VM3hh*6vz3xo zI7(VrfJh^P&6YFx=e}&a5QcplVfJ(a`ONJA%9L&(48`#h{fOPKmf#E69oP8h7HoVF z9)d?fNSClW3zdv(@jj4m8Kv1{f~eMHj!SX!U)$C>SHgYplo%TVlJ~Z?4mvDR45j zJ@ra>?I%j|GbC9CobD9Z!RpTA`Q7(rsSfUm`uj@3xP9-zLyqAKW^8d~3sYWl7kb~{ zagxWF&}B3k*A@9jb9iuS35JvRJE>M@vYvI5ZmrFDh+DIS4H{M~ zs{p=_O+I@dnIT{Z>p|qUIOKp!kXV&xYYZU`<|6n4F~`Nl-4Gaev8^@iW^a!H)()}f z!mn<;(D0^flCC@x407>+<7-LV@J*b^rpWNCuo?(Tq1 z4!1=k!5H9IJGiGE7|85*0Zsr?G!bsDK%sg-u42G$_5@KW0w(y*b_B4yCmew#@F7Hq z$Nz9&JE9s1)^`K0;v)v(-hL`l7M5LJ)UEd>X6v%c$rGXNGSwmYl#+E)MkaSAHpr=Y zdH@noNO*Sut2G-EaQE{5-yM@45R@4Z@L%6$fg9lTqZ5nrC$J*Qf$+}#PuAuWZso9c zX8L;`yx!}0!I1ZzgPV*mKJTpDp!q{x_qZVV=%FFhLAtgTb^SEG^%>s7m5SE5T`K;*ERF*gbq(Cln{h~T z{!JF2MB575bE>{PD)ZcTEtjIpQPieSlh|z5tg5?x`x(x+zp<*ub={YUCqEwEV$3H4 z4e(>)HYig=rjp=B+ogHJwXo9Ph;o2yi*4g$3#>8E za~SOIMsT~Nf$p|6AkPAH&2(UohHXfLtpv@hd7>IWy=TCOyVK)bdHWJX1rvIhxaa_U zXW98>ckeeMp#M`o=KpE(KY{UbLq+9&eS4<$nGT;xo>?4Qebm*jjF@cJJo>(*3?$aV zTi)QJ>0&=mN#~TcdC@W5E=@Yu1*ecVudlrpcrmyxof?NsW72yeWS7`=gYo5l%6ZwL z&Lhu8>6Y{LH14=WMMLQ=r!qtU~{SGOM9EbKOGNucH%NtS)yyorY?^ zoccOBij9^=#Xp2dq)`KtaM1COi5!b@83WjF{McHxjSGCGK~n?AP< z_Zh#tQl9$idX5pMws{>gd4Zy|N9FKsYY%E}oU8meJGovm8yLP4aBTAIDo8cI`||;l z_Ox-E#O%ePYi9&&C~fv9i^l5Y-eyjQ<4LVG-k4XKLK*cK8n`|@X1Iy$E6xsuwV4pN z_ZB~NtDzU*#By-7CWt4X4GIEjy-jt2@7n4HJ6rvyTD0_J1(y6yG>VDWX?$i2)%d)B z-tXxDWLa*v4*Ns1v7K@?+h=G1w+vR=x@GV-#f2FDg-Anz;TEGjCIJun=g(AdhSS>hp7+jU3EAp^wz&>EGkScJzty51g_nX7dAct`)8 zHz)eAuuQEMUB192tt=x(*q1p?7mu6%h?4wl>)Onq&z9>Z`(U?*D2Mmnq{Sam zGFfT12xIp57(H60>q#y5>^MySj5qX9d#mW6>U2KN5Gyu)8ZcvvQn@RQ0jyNJc>_^? z?dA~ttFE?#Cq?qLDDvehb<)l_ezv`2(+E4^+8??({Puv~zyUiOWo&X%R&x$RR<-!6zR>X!{>Z^8IVy&zo)FKK1u1-fohlD990&HdVIdEZ^+2U&Fij;>p>RNpe#HMp9hgF zlFe0YhtlMho6bf+BW(7DiPBP98shNZKyj~_ty3AFU64k=DpfKsec~4e;bT#Mja?gj zPH$G);Kg{;WL5*!Qz1llW}iwY7}_^q=FV?*!zQId`vA3gaWki~V?E5l=ev14N<@0TiUH$ z?hwWa4yWDGsyo}LKyeZ<1?2%HfPd2*)H1sEOGoa2XFoy#3uHgRngcQYrMhwPU%X64 zNFSKI5_MxjP>L`E4HIP3%OnH-VJg5^1XRQNt(ysO91%_>XA;~z z&fu6_K9jbclo^SLdW(RDqs^j;;4NZgjX@s)9A5Fv;LE&i{!~ktFx9 z%S-nYY~KeH9ZIguM`k^+)zST6USKE1NWNSWc?ZFp>9OPS{@IxLC1k#XS5BV%zU`dT z7eC9Q3_8(~sW%wy^LGo$EswWPDo4zV5+4Qb$dHZ@ata$K=LE6SVHk!2ya|T z&u1%7xnIi_A3uPnF;3|`6cZxK&$4>Z*X0i2jhMjGyERaL@xIE~Z^V-)c8w%r2 zM&C}r%T)y)LMmkMv&vf?e#G4L