From 1bbd4c2ee1e6b7970010f5195bdcc199f51dbea1 Mon Sep 17 00:00:00 2001 From: nscuro Date: Thu, 21 May 2026 23:18:51 +0200 Subject: [PATCH 1/3] Add vuln data source docs and initial air-gap guide Signed-off-by: nscuro --- .../github.png | Bin 0 -> 36045 bytes .../configuring-vulnerability-sources/nvd.png | Bin 0 -> 21211 bytes .../configuring-vulnerability-sources/osv.png | Bin 0 -> 50630 bytes docs/concepts/.pages | 1 + .../about-vulnerability-data-sources.md | 145 ++++++++++++++++++ docs/concepts/changes-in-v5.md | 1 + docs/guides/administration/.pages | 2 + .../administration/configuring-http-proxy.md | 8 +- .../administration/configuring-internal-ca.md | 3 +- .../configuring-vulnerability-sources.md | 103 +++++++++++++ .../administration/migrating-from-v4.md | 1 + .../administration/running-air-gapped.md | 65 ++++++++ docs/reference/analyzers.md | 3 + docs/reference/datasources/.pages | 3 - .../datasources/github-advisories.md | 40 ----- docs/reference/datasources/index.md | 45 +++--- .../datasources/internal-components.md | 48 +++--- docs/reference/datasources/nvd.md | 51 ------ docs/reference/datasources/osv.md | 53 ------- .../private-vulnerability-repository.md | 59 ++++--- docs/reference/index.md | 12 +- 21 files changed, 406 insertions(+), 237 deletions(-) create mode 100644 docs/assets/images/guides/administration/configuring-vulnerability-sources/github.png create mode 100644 docs/assets/images/guides/administration/configuring-vulnerability-sources/nvd.png create mode 100644 docs/assets/images/guides/administration/configuring-vulnerability-sources/osv.png create mode 100644 docs/concepts/about-vulnerability-data-sources.md create mode 100644 docs/guides/administration/configuring-vulnerability-sources.md create mode 100644 docs/guides/administration/running-air-gapped.md delete mode 100644 docs/reference/datasources/github-advisories.md delete mode 100644 docs/reference/datasources/nvd.md delete mode 100644 docs/reference/datasources/osv.md diff --git a/docs/assets/images/guides/administration/configuring-vulnerability-sources/github.png b/docs/assets/images/guides/administration/configuring-vulnerability-sources/github.png new file mode 100644 index 0000000000000000000000000000000000000000..99fb875f197ad2847a230cac21d63970d91d20ef GIT binary patch literal 36045 zcmd43cT`jByETfsQ4As|1W*Kw?kxxiN)?b|08!}zA}t6g)lj4d0&XQ#1>7PCNDD}n zM0yPbgs$LU>@l^?!!N%#e)u*z6M z>G)}hICGO^*PQ|6)3xCSM&&~|);iRsZ~yxfVb&xs?0ffWCC2|#`WF4_fLKub9|cyF~{`1%SQjdQlUHnTzN8sL5F0X`PofzTl^oi_kZbDuqe=}+>ru!pX0nxVwKTHk?US5^}D?Umv8y?u>sBX zrL`G)B7r1l6#1?a+9OxvRy^hiKbhT$pC#Y;28&t3e!JV?tr4LJg*7BYZfjMArP%3E z?`RVse$HDVd<3-BOJKn-^*MM>X^mEtrjD&(hO z*h*Sg?dW3zm9^?Md#-w)ErTukv6k9xSf>{rV>LqrzVcbrM>OEuDWRg?dJ*N7k>`o`ILex^wMWZuQcbSlfU`QU7r7DZ=lO zZt_i}TRJsWPe^|XJ?&-Bm!dxy48?clI5ge!oyvE1Xk2L#^LQ-gHPL1a3c{VTferD^ z%s;!)|IvJs51lhjORJtKZ-P8}G>i@wp?-{<<^-OhjY9E_?TmBUj%)cYCX3R3rg$SZ z>+G8m3`Cuas#n&S-z^Ei>#_o*K@qaf#bX!K|YRq_JQhFR3FD`_!pQB^t z3(<|>{z<_eIC6(kJw8q`KQcui2-dvB6bW_;E)>Pbw8M^&IQ-Th59O{&Ha0!r8kiFD zeKX9P+3d6v@MgA+@9FGTOS&rzF>x+<<1b{yR#!_#4K7MzmA&JE(UOh4-8gx%+W;H! zkQ=H0XZ|eZA;gjEbul-gqvhFLlrfkaB9C0U#29L}3E!-)?fJ{dWS$3N8L#|K$RT2? zc|`8`!|XiLbGj>Tug{_OWvF#rJ@!s#yFBnQj#>-< zUlGeRb|Gx*Y|HiEr);jD6$?=naK3Y);1YuEqY}v2B-TZF^(ErBw{|~~pgh z7ygBe9!8b|!}z@lBQd)eOeu9wLXR%fCLO z<`OK%?kKhNg3dS0#loIk1;Ue<>rW2~Lg=XY`QlmEE4Y!0t51@lo%r&$t%=J!ic615 z1mTLjific)7Pf_zhqupIXFhu zrYB^1P3|r>wm$`)nqvp-V7JMrD5J|V`J8-OF_Dlw0X6+%KV1RnJeKtK0ZjbY*zaB| zDdIzmfqJI;eM+zT2;9rawFW+hgLFW@l~9iLj4P>kFH4+EGgxEw0!u$Y;oGZ;T>Uek7#%BW5;FTwZipV_lx5uGkP<_M01^4I6$I_QYAD5gOMA;JP(&+I(Sy)w_p-G+4t~rq^(KG!^Th^# z%)I?k617K-SJ5h*q2HJ|()XZd*vo{yuC-Hu@szZX{N3#^LRc9zP~-Sb5=G{u&us*2OLWH2-P`>aTxV7t-Skv%Rw5F0=+#v z^GcQB5Vj+tfcAKeT#HV!maZLxon+BznPFE>-q|9o0w*T2Yk&WB;0A*7uNH7YIPt$n zJ|Tv-`itJU)~WGIok#^i&c@BHZOwex@e6-__fK7oKhCCnfbnzkUI~KaBc}#b8PX4A zh`aenN;Drz6yD;}IsI;OO~dyKX3BT>rS;yff@=1G%At15TNyf;@p?fA@F|K`=pts3lZGN;V46&ejO=_zHpo{kFK& zHA6jnH(-@s=(5snt9584I!Vv$$Ee>&pJ1B`cWlV=-qcT-A`^fq`fY;Fk2_1l zmoWOzwRre?X6f5-4R}(Y7X?AvYPUbnFqeD6Qnci zQdUKdMa!?R+R7(if{0}vcVM2w+vZi*HbvpHBHcm=&gnjn@8To6#Wi0KuUfb&%lRoA2=S<%RolAcvi?GjtJdl01 zI6A%e-AL!7m={TX!KxH$vtvqz#m=E5KfBdg)$K=9KZtV!`@F~mdNUzQPk>gMSigtc`m$5ATq4y9w+L@{VNDsJjScv^s zFzxG;j*B*C6I* z@6F|jp6(*gOkT?Dz6cMMNMWqTuYMR+Rx-oTF3-Wv{^d}+>?r0osZ`!nGnlaB#%P|; z`YOubHAJiDA3WgsP$vBo2sAxd8-D|tV;n!c%*`PAI#UBK>yfG(j9X^8*Mg|D_fF3H zD{l*Y1YZ=p{ohjOcCPwu zU{f*o$k+uCVygkar={OXWc zZyq7c)Z@@29wO&2_1HS62c3E3K%fbC$dD@J!tKQ&x`!TxS*(;;>8*j~@hA71QC4;9 zN51~t^PFV_H1K9VIU3@KO-dKIgHT2U#w)MXP|jk4?p_&}zFE986EPp&y{yiWFPg~r z7l64xPvoPaF-1uMQ)f$q$wEy1pl|shG+dk}coso997%@stE{hTErKq$70O&yNcC0% zz)U-5PL1X3k8=PFzN-c?NcDzegNk)s|8G#F<`y_}O?vGo^yk{&1~JY@wyDbaYD{Pn zmODf!8y74GeWXRQwRC4U{R5jQ`dLq8}!?T>eoC8V&5@a7lT!2-y7nS8sY=LM+3aAxoT6uU* z#2>IscZ`Aa%;I?*H$*3|^$zEUgV|D++Z3s)lF3^+Qe5PVdJlqt89jMU<7Iw2!4^I| zFXOau_cze3pTP%?Cbx5)i$2{e&u8j#rb1C8#pg}sjDjh~qx|v_l#{mWMLr{Y_J5`a zW+s5HM8v#_adah5_*e3n%51kGlW8aQ2e;SMEt%gq?I+UT3r zYGQ#`iYHnUN(2460$89&4RRALATz5vXkt-FYmC-WI^Yr>xPTz z$4uUfIAmx_zamo0Q3b@7G0L+`;f$i|aAc#aQRi>~xq8)_v{Vgh3+q#%zyxkhT)n}W ziy{Yp?UUH=ULsbv@Hm-?M7Pc5_ajS91F&EyHEkfof6Zor=FM+UULG654D~A(7yI~a5qB4uHQloJN>#Fcnq?kJ)leV{|6LY{*6%Va} zkt@-zc9M~9b!eh>C&BeQCl=Z_nL2XRLtoUSb65e!r{PSHwp~msV2V72{7!lA!MmeM zPzA37LH5~QQvevEvOwp+cQO3~Dy?+hsyJJfzinC5R;PZ@%(Z#0`LO86{ZD5? z)UN`03H_+m)MquiOEsQv#v!rBk2BNckiitK)M(oVzT7-r-MQ7wgo}eCFg^r7;m}67 zfExZj0zebU_>bPC;n3Ngd&Ls1;t2)bE#Siz+a<_-GO%UPw(u3AZRbcRI9TfCu=%j} z_IA61&)}+_V)Pw969iATM`G#By{@+D2Obif@St!jJI3ZjQ1kQ)5Wh#X6Qmuf*^U%z z_463bo6-b9)xzuSb8GH#_&A)7i3_8Se)zQyP<#|@Ut>#4^E*ia=y;2{*)wyKN5smV z9TU$Z)p?A=Hw8TGawNA6hYon^`ThztM#-`KFwda>vHGR1EBfE;h|J(dqm5a(RkrApI5B;cNyOvV^_3VxhNlbI+ZQ;)^hj!E~XLs>uG^ zl;UPf-q70?ZuK)|54i4#Bz$O{;6a{7l9!|TS{8H&WvicF(&BZ%9F-3I*AED|{yU%*rr?iq!#Pk*hfFPKKZeL2CsuD(fn=}qa zdxU})=qKu6XB>z)$*`hSU3ejfDX{ky^83n(h758*Gv9@2B$;lx&mg(EB_$L?hj~w= zpID3L-vKIAd z5eI_XzYux)Gn!A-p`(IS3#8xF`p}UL%Wrf@JG{^}_wx^4zo$=b2CL`9#$B?{hLz^r zJGF|j*ANfq8mL`DU=EZRz*fPC6rfv);HKr9_pnJ3aQbjn6(5>F>_sY+xh{gB)TSld zP~1qR`TAC(BUXA2rYPPH{sH<8gqDrm&90X~6rhaSSL(55mcoKi(_+ec7 zjStOQjGC>ciaT%~+0neBUBuUaKu>Hsm|ZnVvOF~3Y;CL_RTOM`v()>drD^?P>;o<{ zxo6zR-GT6-hHNnASsJYULa(vcG2eIUldG`A7xnut$Ou9$gxy7|v8~ywL%fh>$9|Rv z?yycUTXdOzr|d!6HRQmov*|P8T%T*~1x|yX ztwfSZDC=@Qw07yN+x1kCEqK=k^CO2mv_;q&=@Vvj#w1$)fNg)IhFNfwJ{Vs34t{&! zYMd<+dJwaE$4_z-Oh>KS5|(JSC?@6V`35m$9tL)_M+exzx;QrviGg)-tE$q>D#JdL zg>O45UZ84A8?MX#6Ykkstl)+S4Y^FKX%m7KuGD@v{cR0J=qR zsoUkpqTDGk|6!9u z|F@Ab{{u4Q|D;=s<4!`fva5*un`uGa8ilM!tExMx#8}$!HUE$6yX+ig*`XtfPeikK z;W)S&ENaksqL0m;nVRb`Qd(t);qZOe($-^EfE83^~!y|y;6<9 zU`_TTsD(4oZ)IXh>Bo}hv0>gvI{nPnzv+{!UM1L1X2y7H6n zP``t(3$b%^7TNG(=U4A*ehOIDC7KM9QByEqV}M(B5w&yu&=%3430#fYR^4oxPV>8eR*vpa*e?FS7`oQ}x4 zLSKEqx!MTDAwloBRHdcSsrSvBwhEpdHSIKN8Agwic^~(vGUQ;U5oisXZxf*S0jkR( z4mrO}Z(`?+IkG?=ji*_Cy1T^bJ2RQIXg9q#RP;>rdUy?+mr)n^>aZXbnOL*t+3UdS zzA;)6jhw0);;7td=M*^)3nBYeKH6%2&zCoSORZqUv+=7a{g2)&XO;8OrfpC5=Xk4E zAD`7*z>{73VDWK%oT}tn@vt$AE0b;x;u;YXn5l?Obp8Hx(0qBJ!?&f!{Q+0TKXo>R z?dh<2bQSfJ+2x%CH7opb1UO6_1pyjr?sI*Mc)Y72P=frr2GILWd1{!_|M;3 zP0RW2ecu30B-Zr-b4psNyv~@HaG6XO-JoBMtaB}OEu1T@5$|5Q>3LQo-o7uZI=hWu z$SYm;#U=I;tzBk$pX+b_t9NscFFKA&>XI6mty@BaHH6!??@HXvV@9iXbbAq6k&^yJ z!G6w5i7ihrO0D*eJrA^?o(??+&azQ?Gsa2f znv%!q8+WOT>*i{I`GSl1^f+jXX2tqM!0t$GT1J*~jD#HqPlGhQ7(e|>)=1II&b!xBg`dn85VZCHA ze1Wtj7qPPR9$5w3$tMq9tvu6JOQeR|E*}8YjR;vCf$%?AgI~qhFgtsz2!-c!Yr^-_ zQoBo4T3#krUQjCpAt(&4CI=l8-uI*+i46V0nP2PW#vZ|XVg7W@Wjj9BP6OLS6Yi#DxC4> z?1C;_r7cQKrOLE#sl8NXc0mzf_IM`Pk>1ocG6}&2Ne`Ot+v~6G0BB(WtO++n%8BXy z9{g~;h8x{#s@F(9(|=8=UFt^55Sqkiizn~W1H%|!%xgvi$V#rdT}u82YnGpzx9P_= z5U8a3$=W%oeQ#aVDnPc7JWU5mFASGil>^!cM8w4c?_t~q5G3&gazoLJZ>Sh*dG)!QDMqQMl13L zb>I7m+{>1OZ)v422gFQTHS`6sGa|(XJINU#-q~|}K(m=AG~um(lhaOK-}|VelVs${ z(o`?y!pYrl%`}~utg^#-hoeX}ThBIXTyHO|UGtAa8i%WUMz9&DqO$KGNYJ#84A_VM z)n;l}B>|*uc2gy686BJfAh*L2i$6JCHVSYq%+g2zVpZKn=kT zx7#Vr8{r#+3}xY6evHyj10D3X4emntqA8b|cVsBm(YPTCpmZ}vG@?iZx?ah87#fXd zU4mI$^&I^R)~KE9XzqmzM=t;D7_V3H;I*%ev#m`8t%~|`J=-e({ttDC?da%H^V~zKFSK*^GqpC4pqr&D%@iuy> zq()z-hUR*!Yl4IQlC?&F(B)+6C%R3kiaO%{?N!`_MrUs)qhxgGDG&1AK!X$M&vvE! zvCtVyb%)P5tLY}+zH6agC<)FJwZ@P~{gL7bHH-a5zQN``x6p7@IsFy^77a%+~I=TvK>D zBK@eo{tAdk!l8@V?RMQ90B6eQq$$B2tNPjXqR}P`E7;FDu0^!%Y^&&S=aptZD=o)` zr0We@RQ%GGkfsDRm@TVo!vUVTUL*n?L^kguJ4 zeWZ1FnP%oCl8Dpn_8Cif3lDE0sN((tpgwdjl`oEZf5hqYT>M^ZV#8H0M>OUy-C{E1bqX<~j()2+^%`*~-tXty zY&0K_Uj}Y-<2@A=oPH#q&;ivc!T=kexu_5{-;?MU{`28VH#l%I8ph}|pkS2=u5DV` zB&#jY)`k3B#6Mdc&^v#6(VbDt;QmJrMn8E7OQ~6kGPkkZC_eB@L|LnY-ocO9ttV@d z+>o<^c^uPmPmt_{SX+Y3`;-hIqDcZlv< z0Poog`P1rZ*-^VkDo)Sqva;9J>6;UGlG00`f(+cQ&wR$mTKTwrZH9`xzci z)x=vkgR{5hgeX!~N*g4jcLaH@NW*uPM8O&QoPtIWj-VTWx>P17coyn)J%u<(_}G>6 zSAx|__;%XR`_ri3QFffpNI^R{P-)9f(|V?KjZp86}@$W=qjecTKEdcmIEJi-9Qp3+GT(hsE)F0^fZn? zoQSb?gyQ}PAHe*`&9wvx%HE(ubOkX}@aV3~H;PifWbc^EC`OLAZzpl5b^IEGaq3WK zLj*i8b`Eq__93dzz)`0q|HGakz`Zpx`o+WfasUpJrhlT!cv`pb<^tPm@QhgWjqgG& zLiaC7-bin%CU1VT`@47+w;6=TXj8&fC~qBohjJh%y|>M6jtXC{6;Q)yMSj$jbQ5Tp zr00vJR&DL#Bv5rN8&6dv1GUguCszb77O<%!7C5crw53+g%6``o$OP#Lp;vf>(@2aESHK7?e>+uU-cx8Y4-Wl z+Y4zp@2GBL3-JpMCG`EKBOK4zwgR*C`PlYraqgthM|K}a0CwD8ME-L5$9Ilz7BYH|bV{V8deHwe`UTLthN@PS+h1l> zUnp-<-X3o_k^a!ZN}q5~yaQGYM~4cl`_=O}O*cH<%C06xe66?ww7#^NciPQ`G#^vP2ca?8e(JWUB^(84E%?4h7V8wSDgpsy9RrPF2;S?^2EufA(w(i9Q1Gc) zZ=qAN+9!lny1H#P-Z4i;!P8Q=qfM+Iy2ws>0K#+(Hwa$(+_I~YH!T@)V(FTHMOw3e zfY@y|$8n0i)biyQ(sT-txHqDusGZxuZKKA$M!p?tqq%QcKp5 z*9^x3c}578C>Mi2+8|LqRF~E@I}NxZ+_>Tq@#D0z2HsaB6ShFTQwD1qn0z7q9aL>y z6p-jhgZZDx)NgxIH7+MsDDyx_s|`vbljhwAlorMGjcwltNm^fq%ZD7;i2R11ywY&8 zrVCUZv^!3uo_X8?&*rmF)jUSTI^Z>lCX7ZHS9R&?ot>OOudv3>Kf*>3g64UCbz9(u zgqyRjByvA>(T_09c(P}w9tY#ix=!%I!m^Lq2AVw4lJe-BuO(^YF&=N&I<@A-!j7&0 zFRJEZHESGHU7k$$zS(C+$R#HmGdqbCfCZXB2fn}VYI$SjF8Sy!_-R;T=m8~fA%EfG z#RA!?Y|H9WGGzGbbqyhAXdnSR<@sk{XfF8#OAFeC(1#bo{SzBBGv#jZ0;UN|U&tdj zi>pB~px?pA>AWnQ*+9v2ZL+{^JI9>oI-EJu4OP87ON&~81!saA7tPHuGhe{<|IqNk zR?~$54PVI(mh!+G@WUEsBh)b$?DTL6xiflSAPxh?PNU!`wPw%*-2GDpPF7gUpB};K zBDPphpN=wa2%9lq@au&0gM;(DBaW0gnQ&HO^ib~;$Z-`_%3H-r=811%(&Kf3>+$*; zasVX;$37nf=OPLkR@d!5RK?0n)=7kCj!aJbnNJt@y^FI(T?A*Zidh6VtQYjTmw`)qb*5u1Y;9aL4E?-eWcD-UWFyiF23^*K)>jqP{MY#F(&OTrV0L_=(V z3H{^ZIghFLd;*jyDh)~RD>D@#{G59JJVpdv;OQU?NEvm-k0 zx|OL>TFZ!Fg;b>7AJQuCCkj$X(b zsUu~|_D!P0yJcH%E&r-j)p0=7mnk=S;M3^cV7Xg&!M1JimWf09sMX!$kec0X%m<{! zemz>ItS3y$E5Hz*N5x#Dqx*~&!~z?4!5ZE| z@3!|u{2I$F-%Ayh9MdM1!pAjH(A&g-#mc$n5Fu(--Lq*xWKhRQ3jCCAuzcdFZjUAQ z^k7TwaQ#jAs>H0#skck-%7uZe-(JchPgRRg`j<)VQyY{ax~!-P*C4m5Ohom*XHr#P z#&npV5D;8zsmcgX4Q z0txt+9H*NW+PgYUpq}F!iPtJTUSD~z?_B5YYZ?53iB58O=fU+#>#IFyKI7=9kl^^i zhW)i7h#~6ha3dcYqDwCzULk18MxHp1(VGfvWRK4|Z~@}zk*~c~8i&;|(lc8Col3Ek z^mI!D>1n(O`?D}v`M5)2bx`mL&O_i&s{mna6$wzjU+!RshjP687O)ei*32a%^X;SK z5a4#N%&25k8@-(uf>ALQh}nk(X;Oa{yJ{~y{c?-25~UuCDKq^wPD_zb|S&Xej^==$=M)ChpBy`Bm(Vi&tZ@F8XKFPmozJs#;+D0Njzp0L-@`PUB#b z=h$E^L(0NF_k#N&s7}K;-zjh-edK;e+$70qnReqvm2;8X{oI8pw<6)EdiD>3QHmcs zk&W0{H{lrdgg9N5pB+|rzmz?<(0MYh27a+B;w}XBHvtKFH8sVB2|=rHAeo>m&aN_y zY0}SRWk3J0%qg4|_N7QgvK)I6^;x#X+D#XsA3%n*Qj-TSO_Qr=Clk#)xCS)p>Y;R( z2^Oae%bLOFhQFVI3TO*hSUzlg4B}YzD`&93{J7j1Kjr)Zf2S?q9 z3pz2)8{5%dF;UNeo~{iYj*R1^U|a3C~ZX>pTP&M}~1l{?m`Sm~9vR_Xjb zF!5GIBXo^=rAoutqG{PSz)E26?v=XXqiQLaxJvu|+oJa!ItK$h-=$sRDFxcso+Tkg z^ACe#DRyQlBQBbv22)2HoeSBEMd`+EQZa{B?z^?Mo5{pW2cDPllhfDk@<7h^=ATD9 zdNr76Meg>fE+X6e+imz>g!&)iDrZ#eR!2|-tM6+13$isv zmr0)1<&2^-x|g?TY5&6cDcl};c}r~>je*<0iQwJ~FaBQK6|f60%i=aeZ?h%UoF^BMrNoH*vN)<+dh`iqdwU1@fjwV@ns zY=3PlkJ5_#(D%)QlrsI4%|}#v5h^zrK`ncQAq!+yLSF#=yLV4TnaSL5Q23DZD89WM zXm|f7z-P3i>0eP#-^lKMIcM9$>}eQ%oLEJH*N6rW*ab7BN$RIp%^d)f9pKpU4%7(k zec!P88Zey%H+>|;xX*w0X1VD+C)LzI9(}DSo3EA(jy;^%B74In-b<&On5mDZ(epxb zLR1<*YU;#r3paFny^u(&^bU6#S<_4p5&_!qxwww60^o8h-PdBEkX|fYkPVxx~|YKx?H06XyE5-5R z2}+BF0?p$xGr1Lff_lk9ZtO|4XYr@|T)tZ>0?@C$Hm@sjh;xcd_JIFlKa1bG&M}c~ z{ASp6;G%+23j#c2_vGTD?kypOh2sVe(z){{1&uxnfthWEvT?P({6lg$mbw8vVDANB z=N73oVz=e*8cfg)vNEFOOvH9@5dUkUhWm zOF8FAGU-6^8EF!Ju6(NV0`l0*-3eEVYGk%tWDy4;>C#T~glhRx`5# z!0{s7aFp7+h>L>bHb)keS3XV!;Ezg10If(WGtuylzOj^AbPjbQvyXY@uX_n;0FyVA z&o@i#A2^px(Aq^BV-19_;xGD7&!?)kwY9R>5(ls+(VwOf3fr9=mM_U7`>ApfZV^4- z;i+VZ9i>0tX|)=mcUQq+OD*UVd<)l-wk|&Yww000o@Wi7_`mXf}dMlcvdP1f0<~V z%6Gv-1@#A0prTcOOZG(%;4vlEY_Qgygs%$J;khkv{(im6^izMX1Flmbo6d0rT701_ z^n{9pTr)q*Q4`!Kl}z1%jw|m0NMxvQYdLXc$=h`in;i{#M4U0AC2}vnODF$ez5a3! z0CiT{8t2s#6K0_?tmysm{a5|1)JDIAKj=zwJrvU)Ai|OzV7isobg|codEPmD3?{FF zK0imKp$yjkXw?yh>hcc{JI@@1$49Isq@Wf6zE->K9^0#L@*?W@dUUM?{gy*VV4WSL zovFdYvSkrHMjj_Im1KF$5KEiKVsl|Z3e_g0$%_=ZI25~F=2=70BHz8Kec*392s)nc z54@KHxfmI|-Fb{EeSezmhrP1OvQq)Tq4JT_qCbkl(Mro zK6a5y(9oEKe;lVtJj0W7CFHjKr1^yCq)(3QJ|vseFVlhN{|XWuJh%VdupMjxd+7V9&*zp09x z?#lFXp3iWX4*DY{wFJX({Uc1%x|Hl%dyfbpx^dihOG5M>#0UU(L*C&YB~}z;nIH={ zV{4l3z~i}3%rUEOI#TZIT4C9!J1m%)*B+?!f!wk?xn_tx9?ws{TTb5fbYZ;S+F)3l zU0qf~!1luj|LW{P)wUR~Sd}!aX1`tEdsH^+TKn#!eT@d!^Fx4^qws|?^QEwE}g%$7pt`tBap=XcYFZ)EkzZTwWw?`50VY`%Jui}(= z?EkJcBx&ws?DRzHk-D3OWZ6#Xj&m*Rm@^td&S6=C%z{yGK%re%_gi94W%L{~&X`9^ zkOGWCO%yGq1Jg&2l+IApPh_}H?$KL}GHwpdJYK*=hzT*;Tt2?SP<8y6l`ZM!R$Apc ze&c}|S%@(i(!rCkGFJ@JMes@ZB^Y2!mkFgDlp`l@^~IBBJG#Wv4w+kxQYQMd1413H zN(YJ6wzXC51B$l$S{HS&ZstC#)N@2_!ut)3e+9vF+1xuWq8AXlY?@~u^d30R!z&mL z2S629=Ky!X@UzyoPP&P;S629532r_$@7V*KRM5NE#D(^bohJ_w^V>=aZp81w6J<0t zj~Y=mSAtf=k`C$Uma-;X7P%hEXi9ma{@$-?eQ(iPJd`TRSji6G0|YHO*a5r=rzzfW z6e&BozugyTo%-6Z`%iOkqG$7ZuZjyL>y58SfT$9ohVr@O?flOVyZ{p1AJgRL$$i>s z$XHSHQ_*}}JGAi7$bTPYn{|zJGP{z@hR8XXf2}*f{J>+B-i)Zdvcj8H?-jmvu(qNG zjy>z;xB6A6<{Mn)(XGkH#QUfcnt6FitFN=gXvuj>c%$3+_V#7JO%?G`Xn22>CC%2K zle5hH=Kf?YtAg+YIf&@93FYq$MSgb4CA;otG}Wagwg0@eiiJK z+76HfGrje4|K@=VX)K1pk6B3&^YjE>`cLYZsh@a7)IpWRJ%mrW&YW(1b@a3Z*bOcx@nB$&xgAj-tUY&#RFAxi3*PhZtq2W!pNoT8ggbZ0laz$43i zp`TC9{zYs02%7-VwtriS;oZ_n2MGBCzQXV~sbe!HsD{Y}5yV^Xv^Ybm|87@;eQ+o3 z)*^MlYN|$q%PSM1VfW1J8WugmDge}=6j$TUHOs5ZHdLFNxmz)|goUQ3Tcx|C2=MUo z&3@krx@DvBXch;~m>Y7@)%#N}^bKJ`9=rt{bhg>v*HhvGTU_-~SlSR7IN2gJ%{~vv z6I?V=SE-ZbakU97PZ*3LnY@dWKG+&ixbL%( zh;;Nmh}b{1{qG-6Rr;RXE^7@HT^uq zkzTy-*_E)*=w_G(&2C!Q@F ziy73DIj7yE@a@Y3(7awQ`)i6wETLcVa!+z7S0W@Anp|icpfo z*xiq>5v$UP-hWI7m!(G~5hj_+3&NnAXODg$03-#E+$JF&A#$r5mi+)DcA9zv)g?;( zYnLDa`ePZ@?^&JN!b(~mu32cGg6Whh9-6}KWG5benN{6_3s;gp0hv~EiAsM(+od>OTmbo9#%ow`3G&m)m}}t1=?Gj=k+^z zDFxF82)IrRAp1Ko}VY@qZYC#zbi>*`;$&r(B7caU0;9 zIaU(ZQ6>&mRJmw}&D8z_AP1`y8QIB@3zd4=~ViDh#g( zbVVOts(Kz_jKJm;t^?pz0HoyIAzo2H_Su5jaSenC*TUM!0-6)Pz}ZIKv!U;neV&nQ z|7CGOUjFxCiPrjF2;&C-@Ji5QFF;Fw56wTL#@vdMYX;hV%B)PHqFUWFqnkOcw8wl` zMv^Wwzb7{z0(@9&fs3i={g$@eT#fW^tCP}Cnl=W+DRS4VU-o{uV7IWT6NAuDJa$v3 z*q^7NrXx|bg51U@AIc1`r2Q>EZzy@*ogtBh>^P}(FZecK>tC7@|9R5oBa5{0pG3hQq?XxJU+kcFk2jV^z?v7= z1$E-F{O%QXad75S{Oc|64h<1ZOrTy#+yj=Jb!oJoUUMk+_=;LfZ=RFA&g-f~ai~DB z;=)a~gnjTeCZkR?Dk-xQ*0rQMz+6gwyB!Z}kN~d&3bx-x#cQxHx7U6R%BddTfod|n zDy;8s167DFgS_B6e1AD@K<@G7mu|RK9WpaZqIzPi2_I`xneLM5YfCnma~R7N(yDouk?nNd{<% zOVckCK8*@6pTBLMKAFnUtBzvqwtTjTi3nHs4Ikz8JLT^HG67wj4sX8KJ3D03BS^RX zBOzgl*ZOIz>$Kzv0UL>qUMs`qg*;U?kmLdOburVViRR_RN?J7`oRbZL=q?N~e~PGC zN!h11diS7w*)EX(IQ4rH)glGntYxec`>_x9T4X*XU>xv2_K1&RZMFxz!`L$$ZY<4QiwYhNEh(8{(<-I{p`MQxVioFjXeLn z(*Cc$>JjCIBnFCSxCyf}393nT&_9m{a+RM`;fTb&zGxeXv+SDl|CEk=ix{8k7PESF zGm%{eXDaqj26LZBY-BFLl1&3}-E~%D+d`jhn)cWya9mIeeY)RPUHz`ruu7Hm~nODXyLT+2t{WKER3T!ft zoK-;om6>Q#DSzT*QB(`)?9Ev>BFfw+A15K154%=ffD%2I&p`PTE~PZ*6PQGkCN*~v6Iq| zqS$%3X-haBq6G_;KY%Y*d}3hS6ys14s#Q0iQfT5U5|}IEsd@sgL%=~(`zJ1gM^S9 zF*Mgirv!fqqp!1beKQdI62K6M;#3`o;SPpUE&D{@^-DwM#`|=jZ5VT$T0=NWxH{Ta z=qL|LC1`CLP@6dL+2W76%zR6KVcw3u&A1<{Zx&W{m7 ziDwdU1f?ZSyysBJ=j)AzJ3kS6x;v9iFmTyj~Q*@x^0Q$Ngn~L6kg<%;0|IfN(HFaa&Ied z(1YmeV8+!@(pr&q^(WBU1rXDN@^jz~(Dk#LAH?4H;IzVe3K@YqJr=mp!}fzOfRQh{33B&!9p(Ka1Mqf%2usksncrzyiJiIx;hHn z7)Kzz1Xj17413P68L-RXC9{FLLAo+2TO`-J-tv9JeD-d> zbFw_}TO)0j+Koy1uv66E>tGUCa-Alu-91#|5`A0N0TATMxhT%MBmaDElQ={5_OW~F}=F}H0X?L75^p`6L(wV_&o zA7(z=tv7By5vYh_4vWn0^e3N&3gBBE&Y5GAMY2)^6Zi7ZujxE^P-04u$BjJY8MrsF;?}Gkd=i|gRx_&ow9zLO@Y4C@oX>5w#YsqQDqX$- zI1#wp4J0bpT58C+@Fp1jHY>+Pxmf9G&GNZTve^4mm9!UqOH ziN13V;G!=TT>(dq?+aW37;x`+j8!i5%irKF02K+0`x{d7CQodv-C1KU2-Ei6Y&D{< z-Y8P}TVrdza%PLLv=Fz2G-ih=bwH9ohm;lCy401lQ4Qui0BDHv_UXB z(M1{28FlnBh%%#_z2yIY-@QMav#%d9f@x}WE{+wZ>bHNjcN1Q6-S zu4zkRJ&cG2@-_mJM_w{26zP}RCm9}GB&Y+SY>MSy3nh!!f`D|;&qo99m_}y+9$LN# zEUiK3XIMOUaBcXnNjw227XXEBM(~zIN($km`(>0Dfqi*1h%hv0LlpnF_sN{f_i@k@ z^9k)ew3x9zfchDt0LdK0+eF#qFklyU(W3)E-dOss_SH>TScBWDR>r-`-<~wL?Fx8s z!oL%@U5}%%CjwO&l#H<5w!fIHQ#XK7%4j-7&;#WWo0Y44wr^3jkKtWFRyV(}B%zRA zz%<6sI0=;XyZp_<$K|CSmXwQ}*b6jIdGZrl7v%~- ziAE~3bl&&@51fPbqW0jzSgSAgh5}lUscFouX=lL0$stCn3uuKhk0a$4&f2TlP{{`C zU>-jr>-%6oo!ZgE@@7!9j29pzE)kHAq?dJI=N~s;{C@mEt-s|@e&oCzkXd@sK}DS+ zEJQMYrP)qn5|s68Qxuu1KhGGj6q1be{ODH<$}%-WBdn?4oo-fO_Y-GR1jWcZD|$Bz zK~G)}o_d}T>*Gr|Qa$L?s*!OIGDE2b4N1HRT?Ff`*cQ22N#$MwLvUgN9|b%9f+asL zs)wZ$rg*iFP=*A7ndjie|G=k2_ZdEZt~UZm$e;^O@oC7Q8;C2sXg~sBgXrhaUIPuU zL?+i>9Y}aI+iyIYDrMi2RRf?pZJCBgIY6tVTP1;E-ZBEjGSa2PSF=uR3hTEPI_2+(6ox4>D(t%I+f&-O2V9c|pG z{xT}{1oKj9Y|#zZUHv=DG3%@8bf^jvlQa97-aRH<-#7*YF$Jl`hJ{!L|IMad(pCe% z*2Jmn|13OUGspugU-V^Zf>e6WjM! zb1nYcI%Q(;+y1Y;vGz$o`G&E`>^JQP0we<><2%T?O6_F`p+`qBr-}PEO6#F8EUY)> z&qkX!aKe`<5-?d@VAz$ehJ7H^c4>~B_2T3INZY!91+rE=c+slK-t_#;>R{64;^yCt zFZ`rXH&4F-k(PfDoXnZA@zaxl8HX*Kksg69k&6~cPbD;pi&OL~J#=HoLNDsai0{3P zDviIm!!Qhhe^x0ka3XuK_fz1Tcedlq@!zjgZ0y!vwDvI%A-lkozWDxE9l`%y2l9V* zoifl6%F^#aDmmNo1c7WU$6Czw(;Cdr+)M-@@sGLAzY#w`@-Yic_j+Q9%8w^DEY~!W zumqJ^=fR4*y6NLWnUY#IoBo(x^ty<3;+m-a3$vrx_Ah$+N|WI7+ZP&E)$3oUTQ&ql z6qnBslalNAVB%o?Mn2kgs(1X@*KE>vT@0@2;E#&Z-_g9dyt~yQWk%zl4pCor6aEb~ z12QhN#`ZdDDy>}UnM`ZZ)XAr_!rnzUxh%Wc$9o=`!a7DR(q#4Ty%fcd>x zn_Rw7!StNge&PF==`xaTlaFq@?#=bSa|}9Xy8>rv?;4dDibyGl?o`@%29$+N`b_vV z7ePJSL&`s0Ex_&yNn4_Aup-tuh9!^lmV(g=C)Ou!owLZ!l&TGb`BxV_(fd!H#Qn0N zn9Qm+#)Z`HJ);IulWV@V`J8~%*qQZNzgs7H3(Q8hiEMW-`BkVC8_w0+!fq_Mpd-n| zVuQygvE?aM?et__Dn)G-vS#6!Li#H=M)-%UhXboUI`YgpzpskcM(Mq-GQ{t1gm0!1 z`55t0>A=jFdT38_b45A(>=pmF+yK$Tc__v9ixBsdDxwEME_~ z0rFtnujR=k`JQ`5)+7j5n!YmWxay%g9M_x{SAmU@tWo0ma|aHB5W zC=@Is>sPg-=zQ5wmm*F(X;C!*2-IJ3f8ZYIol7L#v3T zsY!u^K_2_$ z%5#lf1N^rm@I$41gqaH4t|_~L9sB9Xn~%VBQl~%Fii-cXM2ahZkbXVk{=0uM;`~+6 zJcE!!-R3jZX2e%%&MaJXW471rRyu6yBv8R29aXUz7A!_JX#-6N3}QfO$^*3_Utg}< z{XV^w-f3w36$F`Pe^g~EzbDYvCph3gl>M8=s1V2`F%k%1n*|9vfxqd^vW(K%aQ%g* zU-wf$a5PW98MyfY!5|1`v zg@`TsKMQDT7`K@HRoR|Ay!vq*trVl-Y@ozS-)hcF^nptT)FMc&I{nSz z=aBd#7+n$ORm#fOnOI-&H(mX3GVsh95DQ{uAcfrKDT(|Sv;|bS0HwYQ+te)LHvttB z;UXOS?7ivEd8E7NC#lFcSE^0~zdNdgJ&5R^cIr5<1wbL(mG6(ooQBJ@j6VS7V|^vR zh1Tf@7Coz)t^@*`TBDhf1S_cu_wj5BgL=b}OfvvUu%rZK&CSi&44%HDPsREu%a2vM zG1aw&kPELh?5*nWiMtx6j3Z1f?;>(%67H+%zcFkCsTUQ?G_?sn6h$m2!pDF{RPVa~ zdrbBFxX!BTvtoyH!D}xrw`HCdLkvuxH87%8z(3FUS|7u|gEDD}uJ*P5F5B0r<=mb2 zCZeF37ya}Gns6mpzr?r;5E4bxIxeu5jS&MfCXEdprbbKl0XkCf6O(02u?Yi-$F;dT zh2(8b{`ZfG9-WDPj>+3R&1BII8%(3xEX1YEV*JUW#w0bB^^W>4W((Yex;ReZV?b}( z|B*;&%DZAy&2yQJxY1x)5AeF4>h`nhsR1X=#n2um7{_9^(RIRhEOoYOVu@9|F$<52 zYlaln@Xd!nYVX#Ch3?Vx?-&jI4QxK``$tIM{o6|G_q+dh{!0HWM z@HG6#{l~=r{(TI*BclLH_W;x!TZPZ(B3q37fa^tLJKde|-7pJsG* zKh0ph=l4CfT?$mz_Ve|t3L^W=boP$^eA$*bXgf$-_YPnmrlAD3`1e^P7oY$2otluS zshXnC<<36(hmT!`rbgPC6oo2-U(zo6?bQp~Va9;qt2=cze^OO&YZ1+4M428Jx@F@t zwoFZ{Dpf&jrpDDp|1i<{B#W$_dv6RG92piCCKI9!H}Ks_H=E9=L$~BzfyOpKUE3ulblp?>d-B(B5tFm#iQ-Ildont)PmiP_tM*m zrHoFaw<7yq^ef#~#(MQ-+{!8`_CGp0y6xm5e3%;;cfIG5OK2GmGMNvsKa(RdqE-A^ z>s>X9c1P&}r-^1A*hD+b!@8FS9HUs#0os}HNm>MNh9@r7Za(q&wm)V~IKm~#hzH3e zGV6^roy|9EovEALy$vuDW5OZZH8mm@6y%JbkF@L0y`oPsP1V)v@}Os+XdXeF$-P`M zG4dZz@QW7gb*|IRiv5r@P)PD(NV#KNx85nhiJ(zZ)&2YptNf@o34985^Xw%V}JvhBZG^GO2anb&<1opU(XIM)9eV5E|Ah&uc+L!<8ohE+;^ zC5C?FBV7i03|+rv$vADxM8prmaBI8Y%SP>~leWV4?oBy;Yg)vlM%u%L+bWH=LEtn! zOnFXg$1QAgc`On+AxFMQQ`3#;IvKH&BZt|Vpc{}leVY(Hjv(=Ax=gM0J{VMkk&l26Y z9!QBs-#}1;7kz3OGxy2-QYQt2e^Ao5DKF$eu4yOWB>iVUVqQ@~Adn|hx6(WQc>l(#p{Ihrjr2p$x)5V_D{jBi^wEDcTfgesoztkpQ}6`CZB8QJ+K>bPUVWLKtoaY`B)=~Ox5+T4LVf&g)ZNlt(#`Vqrw{}ohV#gCcg#fRAP5@rK_8W-$7A575MRZK zPPI#O@}0$+T3ld#ip-m1Va({1r1(5@rBWK}bM!PO!-=^{Wh6Q_!FS{egG_ZEMOIk% zX0HVDnRt#ke$WTpU(5HNq*|l?vL+_}t)!2I)>a=QI-n7v^<&`^~aWt0@PP;4(r}p|s zaiSF!{4`A1we8o1Ktt#de!3#02?HZeG?d@Nh!QM^g3Z+C%|L%AB%|+w+a**ukx_-u ze}~Tzg~8 zIQg#YivePzLk@ndrXn5}<7k@3=buHg{y-|M326&dyhH94Qxx(Q#pK{3RV9U%_LTGo zT{tROz`@WPg@zWhZ7lay;lNtHB`nP@<=E)R==7NtMaxFwYz1rSmh)ew(S7lAz*G!W z#F0J;rHZ8L6yz^iWUxvR3(osSej8^-1Mx!%aUx&0PuTC8)hSOQUH|m9&w1wHBJ`^r zI|hxJ*Ja_qQTu7vm%fqPU&~A1gr?E|%#T8e1wM2`O{i$HOAY=2QH6o9PyNf3%M8`v zk9(MgO5eU)Fis4h2D_b2=QD}-Yyz#yH9!I+)M++wUM`z9X@fTCw2XXhVuamGt;vth zlpm0>&H&pOSRVRn@9zBaqox23d$WWWa=Dpb5tF67G0r(%OY@9%Ksd^;JIiRQGiZCU z|1FzcWQ*8e%|ve>q5z-sUHF_sK9w?vi7HtSTagBvoYPUtQnl zlp1t(gM731{bmw0WRX&RKhjCDsZ%RL6TWyMWY#;bL9RWcgt0qSvh_zIm$~lk8%{MQ zIdm$#kR@5DEjYUnFmCjmlr8je!+J#IuKcOdPk&-wYtuOLWCulL!-qnKy0sHrXJO=w zVVv83tCH; zA<_2?WKz(lf-(O_Pys3|pJZ)#)@`%vVnVodv1k1HQo{2IHAXNIo;r^aD~J@;(;;+u)UU1dW*~Mk9qe(Bk-Bb(Bi&ED5ri~ zg%;}G;?nRy*odC-QL*!Ebm@mLR=g&;USsu#` z-ou_uWg(q%CLL1V;f1AOFHcynUS;;e;hY~`q%fA@Aa~D(jCU)w&f7}=@U?Sg#{`~j zB`<;dy~iijy#4n0^gHm)ysH{znR!>rKRJ+P76SUmC1*`mCglCs+u(Y?)GGOvKS-O5 zz1%Go2het+myLUHmD|B?e?T9Cs-3FDzx=ad1duhE7?|CbTAAb^GK{zVQIoP+t?s!e z5|A_P5mh@Fw5*m zK2*UvDs|8!)AtMaR^?*M{nQrd3PJw-QD{}~-tz--U(WY^bj7oiw370Bry4 z`ql1!@_+D4_{=zNR4mZ0P_nbF*v3Oa>sXil`&~kMHw|UY=&eMO@KV1pUK7Rw0r3cs zWxp2+*W%{W!ryog#2wqT8$Dl^G{c2Y2MP*r+DNaZ#qqRgv$i-PnElU-K_Me^{{t*tleN*BHkS+q(qaV6OOqxK6;B&tB$vFzyrHSyMv1~GCR+uOMlPqo2SsBAby~|y1YliqIc5K^e3WH zC!R6UDv5Y;pPhCP$}?jAD{6E&5}DDo?<_A@6BSgjlO9_R_$zR4%8v2Zb;^cyq9aUV zY{zDXC-g}V_ldnaym!1<>nB&jccT1AX1z|&K~)OyQf1zlm%H7vT^S!KDms20bsFCY zd?2|YaK2nJJ>C6r*MqUHq<9LN>ycRvnip4(sTmQAapM+7L(q@}M zTW+j|Sou=CK(k8U3uf(Co}chs3$Z7C#Qn&1$`cX%{lf4zQ(xC(*yr-R3NW6H*{j#M zoD1&pgJOZWP9`2To<}IuCeP;9Rf~4V;#?9YOK}sNd#t=2g6Vo5!R(?f({3@2s1&c@DKMWl6j*JqXK5ai16p3yiwSj z@e`tr@UE*nEp*g`ig2HAr&;&8WB8AD@6)DxFk*=_j@~+QEMRF4d}}BjHop2uF)z|I z2{=BYOHd)TuI{%gP+y4?Kgybq4ACp*w($3wG-n8>>lac5k}vjtCh;E?PrB$h&eX*8 zt5Zrb)yxdKKKX8ZdPOB1b-CYZ?u`{Y!=6Rh)j;La5yaqER=Xz1J#PNdbY6>f6?CgI zSUz>Fa6~LN)N?pb0q)2gXeGDp2k~7S!+Bw0-8WQxkHq_I)F$k^JCkF%t_^%jN59DI za4-EqCwmieEiV-L+^NeY!|jJ)zkE=`jo6rj-5&_81u;7CVz?(*9FgKUoo|@Fo*|ld z7Slt$uIy#Y!bWzqQ}g{q9P_$!N9rs)tXo#z(WK{ikR|FRl8%x$BCf)3@kRZ3tlL6t zKWwLz(oWiUh0DrGsXXhwVc{-<)5CINTf7zXl1L5C_b%GexlEC9D2ljaXXl4q6z@EQ zy6fhNN!}YEZ-JyAq>`5Zbvpf=BG+w+-phn7BR-_owVcBG4g12oJ+Zb{y^Cb9d4fr>U=a}SA z^ph`Yb+5-+C6ZijTwEx4ZV0UF9;ONEv}C)`{$TnS^Uw2Y5$RCDw&+5!rvV)+`?6hy zB0UqoM#Wo^JGM7bB>nS`d?g!)oIW||w1~W{vT%E=qcyFuQZeh4Eaf+r=oWQ__Kp7Z zO8B8cCp}^H`?4Qhu!n1{weW(Zn`W7H6iYk((pWSs&1uW2MbG;C?VCe%vT*8YIT#~)qWfk;C z^n?{vV|mKQW34gb{;k@Za=RvmpfPx?m zn^PsXi$%JdxbuLoaenjC{dPOboI|KORA-S}} zrO3T!dbTXAJmpEi82MB3PWzVPa^gqX=)k@;A42rB(dv~%Y#w-20*ZO^dUeOMF#gP+ zqi_|-J$v3S(eRb>Gf;ZaaM}9ng-;~bqC9btajULR*L`)u<0^VrujN`GY*Bb3$`9k_ zPh{m2*@${AKhUYb_zT*UW##kSwMBN@Jh7=vOi{=+El-S8H^^MJx~iqiSc&##p*U3o{(ONk~6<|W3;G8+722J6l4%m-Bz z9Xs|DmH`7>VpdP7r7baH+#&tE#-d3~`$be961tLKSmi>eeV9zw z((8|Uil~jRm=>zgX9gVlzAr-uQjHxubF}JxU^hC2SSem!+LP_2rAETy8Yh#U-*Y3M zFh{A2mmAuyeBtpuS}A{35zqUikue#UC5f$E*4tto4v&LQzA#$r^;6hlY}+lgWki}M zs@z*Lzqu}h=8&5Ax-|d1vrLDw1y9=I_>P_q>f8IN69@##CbLiaRd30{hjCsr0V4bS zK2=V(*@oHWMq?^)=7ZjjLGqS$8F_a7y&@I(A|T`H5?*9}ba3^~*Eg&ySeLXH)6QIY za=YrL8q0AAjmlPCc${l0rNzQ6m(0jG*E-e(e#CwS(p<3f&SW#_Nn0eO!2T5Tcw5vz z;P4cQ(iUX;B`=w)!Cr?j_<}kR$Ez>Vr%b(%F;6)?@@1=zNmLQzvMnQ&Qn*J6{e(Q8Ui;nX4koFmi(t^xn9BlJm|6xELN^)v1Ia&&mf$3?ctzde8)u8H{Wo%}) zKuI{@2gvRa7J@KaU(P~VCLIWB=W5y zRSemrY*?qHcgyFA#hyghQ??Zr2~7ST3g$KcSh0tW)EJx4w|BVoGNqO``a+=Hp%}j% zvKNmMm6KvfHCA<+bvdm}oqG123jA)9WMe-jW=iBu;%swA1ur^IdfL>ze$8Y-2CVMc zL1!m!+*)oAxdyFJXxe)uF&U}%sVpqm%6CC;S4aJJx2$=XTK3c%Q5O!{a+)h6 zw#yg$jM6R#x`)ETm)cg=?wHq^iC!0rZrU#u+k9YTWG|WPaxoHvPeKYFkQOkmx+)DN z6@GYeM~2AyJ9|qw6maE*NMZ?{o}+~%Yx@C@iL6AK_m^EFO4qgEr4cO>XQ_nUS8#VV z;SQ}*bCHf$#6v!(j5%J)n(#k<@8+`4-~&jGOQL7S{W|L2X8{Q@z!F&-^4xkZv-pZH z0kWtt7s&}@L~|YWtKhGwm^7LV@H)l%GiOLMi1~pJ0M7+_#RDGI$gPsDAI~24OOu) zDDGDy-7Gl{7~CMZeOH)`R#}P&Gq6F3Q9^KYZ~o+<=!AW~?X7$yg4{#xMs^KfX=Fuw^TBnJ?590K7zWHc7nDvECVolK$S&%`37pudDw?X~M#~o~m7hYyPiyYV2i6 zw&lK`h@cYUaiNj%g2WLFmI#jLLc%k7kC${y%hWo>>y1Bca@gw*p6BlWdN;e8`5SXU z#1Ij$6 z6GR*9431d$p7P;aezSCM4EuKaV7)7<0l#7PT5e(U=NQ$HAzVq$v(C%6 z)r;w`lMOg3l_c-^>5L!I7ELoDy!f%_L$TBck~?ob7Y-uqmw;SoDe_lGfaT@byl^ zzCRy+I>0!pVYg>KBuAM~z(tntc%Rs!Hh`mJ<|NhZwM|27ACh&K>0~B=<9X)sGd}!! z$t(R};GhPdH>S_5gP5QjWh*|a8~w27{?>Taxia66#(|D_Ke~v4$XVNwRDo|yCtEP; zY!8VOS-qSuSt`SJ`@gnngr_EaBX_VP?c+}+0M|&ZXSLpETn)aw= z=lZFGMH|!lKUo!rw6@5k^!h)pZ)PW)#h<6bcXW}70#OZ#zj|2on#DZUmVVYw8{6)f zGiLbhJCndX@dKmCY`Yvs^QG<6g%Zt18GA2l0&(WqtGTB~^lwJ~;sE;-MN83}ZuunO zD9IX&b2QpJ-D@#el?P)W_pHB%du>v8MRsGds*g#6;OVq7*jIddkhlQ1!M3hcAP_}H z&H;11?Is>A>Xa>?BQvcp;=s%oabTv%2_ws)mkBYmD0P!ItFUMw+DC!{JN$0{nhXTY zJ+&)u|G+u6f(@(fU-mTrqCZ)8h=}J_X15ynGni~#9{3X!@F@LM%g(E+nIZk~VFJYpB7| z^^`obq=5zTmil}Pa)e@aI4d?QJA6Tr#j$U4qzt@5=9oqqx~Hvy8Z^^cEA8}e&Tmsg z+y-Y;H0eZ1o~J)&D#cY1?2bJ4pp=0i1__)m8yW6&HQ+k9J(&`FM@DO6)P$g}8$E+l zdicF@R=&Yz|O*+ z-ZW0pc~|T*`RSCU(f9+>D`_?zyeq;WzD4PYsG|aY$|D65+^bRQF_)gkF9BU_KxoiU zW@s}~2o80_NtxK$;_1C0cdCu*He?hvS#Jq3L5H+UxGmC01%t1wftZKQjjXw@DH$44 zvMY(Vm0cTWPF3acT3HIe5EoVeGS)pvX{jxO>V59itmKsD6rA30zh53q7Z! zP0Z|49ZVozrt)~ZyvTvN%$tQYi%i}9GF@E*yxJtX7SA4mUBg&51o87PTS=c4_Kuvq zvJQNj4+29&fY*ePmoFB*`ON}nlbXLJZVU5v=&^2JQ#uKr*x;nRjheaV_9ijeuJf** zPw5?r9ZlU$l1<)rE!~~NXAj3S4((eJVLbEplJr=yXJvRU?AqbRpTpLE+RkbM3teAIPs~?(Ngfb8Bh*ExV=zLX%b9CCDVQ&#c zy{Ogkm0Kg}4B7y=AKl|#T;1>>M;q?DvaSD@`vG?mR;Qgg4?Dl zO~o`Lm&97}S*7anjP5Ka=K+koQXlk=%2onyBk9U4!f4*p!;ZG2cU>r*S8qOhj33=* z(68yPRn>k~;yDw1^`HpdCQuXsh(ja^Mip{}(sST)r}cA#HqW9b?RL^D<^Ih#imAc2 zNeb&AApSjXj@<}g(1t$88y!l)K^~|S6XN+0|CCwBlro7dZd-GoBf4mD4a&i}m{CER4DG+JRRVGt$?K9GmW`4Rz^PF*330B*AJX;4VmrD_Iyn`#&X^wuQ$V3$% zt^EGOhX~MmFjPLXJUYS|1P?Bi)%DY{O{VI@mmS{N z&O+?omXI&yy6Knid2TQg1zyTyluP$%yWaBN#&Ub%mc+sbyP&U zVuZEvP&p|^ZQ^+aIgm|GSjT{6JL_n08AJOsQu6bRWvk1psT}pcuBv^s@61XY$|>*v z#5wO;KsS~y(>1TI+QzRJcEg_oQbMQ7JULuSu_;r^Do{I8`H{r*)(_4${tjx)xX`E$ zFn@D}02FL6bG2Q~R7luf|Hh<*0y}9QXyu-pD(vg%*{r6YuD+2oLgu zEsT2)=U}0tgD85~aS554ELvF7rXn)&Hu*GF0Pg%btdvw8$xWI#Y?R)u+l#7&^K`Z~ln%b_bh^#6tW|N=A}NP7q%=C*_soYPd@b{7;=?Xu7jw(SpzeBu5$9 z!%7#@1$qX#vV>7C=#g?+9J5lM;c&E_mK$#Uo)kw=zxwLz6J^d%>hsB8J!1{WdFZ#r zMk-a{j?vXQ83t@X28Iz5Fi({v0R6fzHS%>@KJj<;+g?2;Z7FmMKZq9EgYn<_RC+t` z@vnu-x%yTteiKS%W)zx4G@3XGr{5Q4@PLR`7=E>@JgX>jITM=@Z!76>v8GrO(stf0 zmCwVQ78W?k=_WGWDCv%@PDceTuI;&crHP7;6vl|wDZ#@(aRES9>#quGaBD{wVlO)L z=&YydX8GybSLX}ZC4Mag@|sg^kG~N(4FVY=lKpE=huxz7|9Ae+F(ILl^B-_arl1Qa z%|vw@OqgG;`O9(0!vBgZ^FQ%&{#Opsi&E|`k;z3e@H7}li62l|2TGJG+7}w>J@K)2 z@*0YnAG#W<7$Yx7PAq0xG8NL`ybws%{zE#JMxUo%-_~nRBDo;pOd2*|?8S27f+X^5 zLaxaHl8{h+$E$IgzKQ3C`=L|ymR#7J>Vg5wt6Jotdb`Wf6>Ly?sSZr)S}5%b9#t6{ z$vgd|WV1$zX_e(T{9OHFqA5uN;No2_R_*8fafX+Z?~LE9Tf$76Xiw9`VFLe$ zb6>*cxoi4roApA)m1>7#r=d1+p}&SZ{iy)N(U%%L6g6czz1o@l=^UHOFP1j$0F24U zSjg*?cz}{K=+I#1w5w$()rm5o%y-q`O8m~LZrLnWua3)8QCLT_Ccwf{l8lJ6er{iG zzrUcQ7~npX%%p-91{T&YIm#z}U3R0<{%O{0{q~~et>I@608IIaLn@aZAZZ|$pZjb= z*~%SSHVeqw2Q0E(0&G=!!pBazIk395UUGJPD!}VS{!Q7g1IaVEs2bF zIIHJ2q!DiVV_LR|i*21fozMjTb7>W~f!3+lUXG6sZ3&OjOnv#`K*rVgbi$h)cpg3e zP2+dtvD1jQWTy0n0^Rz9X0yKhp7z|68BXn4oNt-qm|uHWFAe4>`lb-Axl74u-$8b{ z4xLAl$T+RPgvBEXwywh+x-*WyM~lGJa1*4=`vpd37}jXL=C zzV*Ib;5)Ckt;qS&NwK_SB|Nv0#*|ZM7V?kLTBrS)Xt@VM%)qwskBWR|5NmSPneCyN zM^8SoLYN!PIPZ3wHrr(szTzS@OS2VTwY)_)Id9m%KY1~#gUK7}@Wp=ZfMT$WXmJ?p z(+t9&k_ZOlH&f-ecjrSh=}H1lz4WJSl>ZsYJTn01IiM4xMUc;9km|18w?lX?UAh(a zLgtw!)}W&H(DWfk7HF*k5=bIaX(qklkMC`7znN2dgpX;kb1J#cvMHf!Yf$=wyI$wG zOdp2A+Vyx`tR{v*9`wmmr@i^&_RQJF?{`wG5V{pBEzoD`>{6hINBm)4y)&*qHj@Qb z^Dbt^w+w*lZ(LwLW-dsP^Wqw&b@n_TdfNB0BN!~R+;BWJdWL>-CLDkZEmhb(FCpk+ zkB)hz4-p6cdi6(pv$2YGNNR~TdYgz835&D?|D%(6s~nK`S8B0xgh}xIf2NEE5ZElN z7UXgs+PwKn3SO+|<=rJq@+i4M;9Gbhc+tgrdK9?%7G9$L{85Q{&nVsOL=7(q>H2#T zg$>ojPk*+z&~)0S{sxjhR+AaXTAUQjeWNqk(BpV1PmXq4VrM3gy>U&It`jytj>2@$V~T2? z&4k39>kg((-wV5@Its|8%9f46Z&QuVFU$7lvfG&oDX49F+{+>SE@z%%{T!1|XA+)G zH~x4VKw?#gMr$Np2p-r}z}o1M=?1#E#~nGyGwuZ>(qVM15y{PJ5IF z?A%WG;em7+_X6?rr(ChfS`^xN4nqm31aQhAc??EqLuukU)OW2^ z?@NtCaHh$^h3tRUmklxXzjj4>BA6nzX;`+!G;NK3bJz@>CbqxCGd|Mp)idg?adFz2 z>e#e64QbU&!uRBuyn@n#LwDB`P#^r?4SqFH+mJcQtA=5MABaz@kH@~CgZ*YvGyphjn+MeEdyqB z;OAO2U$7{hV zP7a(z&HS(zz%hB*_gsZPntG)IA?ZZqND8Ao&+sbS1*AlnVwIRq596=g=T0$AY_bM-i%GCAa)G0t=(D3KD8gbk?XrqDLgy^J{qW`X`vnU+mQ zz1uVR)MFP}r^$%vuV-G#4UXK$7fQ9(WjZXbU{m)9S!55nx3qN-z@#m!Tcdl3?li5V z<+^v^e=wx})c1)Be9HT%wRCAcCP|VLmDo@D(E7}XOO}l5KIQHmd}3UaqURQ(td`$$s4^ILUEO~jxg+7tw~Em5e_FH7f$ zy$anDUn%uIe?$YWDjwG$jq1U8W42C$g8JP&D4#S^6ka2;Qrs<8DKdE^HmrO0UEyO8 ziJseTjT0cB(rm)xa)^16#YngdU!U{=Te(g!5>hmp>BkK(yW4`~-wiK(LS>QlS9wm? z*vrVL|NI`gm)OHXC1fbE-Cg^QL$cYxx5{N+%w*w*)M87o{Q@tSbo{0e3Bb~8E0sm^7A zW6LKpB!#z*klf_SomX*M*3LkRCF|QC+=gikrXy@KC1OL+CMmBem){xtwi1P+w`Olr zZ2|@l71v`@7 z8E_y_`zLdSxUi;I*eIw;ALdpCP--h{`{S(aaI62$-H^H@2NG+M&N7>Ub=K#IMRxD^ zho?%sV{BC@u9?}I5>L;~Ppog}CZZ=JlY|73r={%?{9w3CKWFEGyP*HWeEnCRE|XjH zWp4VB^i_UN=O&PU*pN?h**`1EPBU#|F3-D$-FGk8V^SLo0lt>GJXs30p=^C14WBAo ze%h7Px{+2l$Bdz-NYu&swe~>Dlb&rp{OVeQ(@={trc`XQ)XbNBmaRhfY>rufz#nM~ zZrOd}WBTuStHJj{p-D6lQ7CZ>#?^n5^l}TY@lM(Zi2O4ZYLB>ypasZWn~a95*Ys=pRc z3GNSR{VNHMyLj4rjY>%-&*@g}=d1yH}KrbTZGeZBB$r5~zqv-RZ+eWZIR!Gf? zmhwYm)MJ`^l;rwsjJp-_2Jk;NTBmQRVR;M}Pksp}dnt~9*5D0xxidZZ&6NuLvxdsw zJL$DF+tPBEnrvFyHcXUAyRqRA1<9WUc;Oz z$DVrhNK|dbPkga>5#4dwq)fV=<@o|_R=gfpiwHT=5G)U!Y%U^n6`l828gQSV;@j;^ zKlZV9hy90Q88U(!IQ*k|EB38~(Od-MqZn(c8;s5J#DO&Q9 zl^;V#5n;nYex+2v4PgR>pf7a?ObCZ4jR+{kpz*KnDCmm!&ZBdjgM z$+){gjU9-+6h5cQUmokyr$@ZjhB3+Wzb1bz^i#51nm+1o7j+Jn<@m+r3(DPqXejUr zY^~7{V6p()^@#sxJKb8e;5{@cHSlzl@f*orIxpd;h2r12EN@p0;ZKuAI70*f9$P$qQ1nho z_1(`lnTz`XccS^COOeh}cSd8XCQ!z{mweILoGV3uubFnJGyfx zRD@4jy%w~xy3i!~3@mBBbpw707jf|t#Ng6pwJh=24DR^TVd9r_d9yWm;*$Eds;Bo&e9Uv|Z&GQFzCx8d|Hk1x{ynJ#Adi=H}5_~-Ny3v0>)Q|}M zd5R&4>mWdC(@k-&;rLH$?%ABO35_3%Q9gul->cHvT9e;P;o4zmzk0k(MhB~N`72SV z>1(wKhzdXNrThDFr-1j1U*a!0N2?`Y`0xmLe=eN!uZTtTT3g7RHgHmfNa!El|){MXn#x0}~GJLgRQ z9?<;@Aeqpgv6@t}M+5Kd*ju;Jo%iR52|K6S9m!O-^!@gFi@F!V8&~lPd)}&X#D+iP!71q!)?_(~Cti`~udZ=?%}|b*SVQb5&6a#|r@JJ@t*%@;K^;x+ ze6P*;DktDbuXcaH;^?+?o{G3#=-(~#`WnIj8Q+W2xLCBIthU+TTTu|$+7F*ehb_R(2nRo)kgcY9aZNr!xORD5T zGzrxnylqHs6{@$L*x$le{>M^Um!Q@M6RrBth|ez9Vsm3I!Gex%Haq{(`K_ZidNA^U zv+q1`wk;XIplSgFlT3Xo-oetqi?U6lKuY|h8ik`$7Jo+YOL#9B(J*dcX>4&_SlCYyf1Kc zC@KJgyrdYHKw6N|Y!1)|292d&8b@-+;t`CMkTI)?!7QQ3;M_BB~WA0p1Ikbr;r>}+gBYs^i_nSGf*&EXy@2%xMb3t$^j^`%d*!Xhdhb8i?Q4^}urdeKIcDR@hwC*?tnX3m?31u{p$bnD^1-Ha5?hXoORJ zSKi7gjuNs-Enir->zvw5)K6G&f^Ld#He!PxnOp>>^@)03d(x_-Rxly-8FqF;%CIVAln_U;$(-nrsmO6-b?R^^Vt@M_24mi zuPD4H1@9K@Wa!Un&9hI*!K6aPPfKs52s=~YGLKdfV#lTWde6j3Eo6>&0H>62 z-F6cHvaCQgjLLW%`M|tTHQCUZ*LD`-ALAA<{fKY&wJ?Z^a%mH_Zf~{csr-k>uTDkl-sOWZg`>a=FQB_>VGxtD@Y)eX}V?08In^K zoWzkV;V_)~W_c68TFN-GO$dvbw=s<)NyIPj@lK|g+`b%5b1^*Tz0$9H2m9~io!lk4 z@ zC;t4F)t7vMl1Eh{juwJN4j%K4xHLg>Dk?_<_YV|TN+o<%KB~t}O;YE3{w5hMUoxN(V}-$Ad!+*AF4ig-(D^ufF*+c<1(raqCati+_Vc zt$y!6Db^I^ZxsB0m2oXsKyvce_{7||a^mM)`Z!yE&NV8{p?ZEM$Ipdj1uvZ*Kzv(_ zpEK7D2(~EWK(~GqLAka4iJu##>_V)mL3XBzT^Sq%ygYNXZ5?ABZ8 z&;W@>o#7=pyP=C>*ZG$9gYwDFV^lY-{45HF5I%Pl7#4HQ{8%szKMB#gI(C@hP3jKcqz zZFt8+JF(=S{^dbyGZgrESyBg>}sT)Q;0A`=$xa2}t+OpN;Uoo$C#IlR*FRrZ{r{=A($(m>n%S%QnS_4`yg z;p)J3B*GRtphqnK#qeGi9SUuZ{Z+?mlm*qmT`oTfI0L;;Limqgge$Z=%g~<@%MZ)t?9UhJ zN5>;D_{#hf>>uiaFYAkSxIT&@5F6h(giWE#2RaCYeZ|?T>YRSvYtp^W>P&iK2 z2Q&HN%J~&*`3au+^cCpy5P^5zLO7$lUM|0OLKim&>fuEs!#;Al>Q154FrvVG@M4WG zEys8s%qjJxnT}J7}}4}7Q?(E=(hTt zP*%R_WOt_&ErvkVtZJUsB3izJqpza^d`V_>ZC+ZKQo^^e>NiSN$Mv1gACORJzI&f= zl>lKZ2ErU8@RbQPR&tZsiZyGNqA!Blh8Ja-KPZEXs)T(!4-Nt*c(?Rca>T-JT*N^9 zy&L~x6Ha334@BibegN7k-*1TIjK78=Z=pdF%%5d^?}bJX)Rc<`752R42Da~YbySW> z-=F%+|^il-89IH|z?FHRF zl?#~EbwoT%b!yP~UKeRcJN&!!fa<>C;<;T_fK`2^E3dFxl~gaRTP({CWeo{YtZO)F zfC888{z@{EX9p>QPB^NLN7qUret>!oMMQy}5|Lxq%WU43v)$9!=C}~9A!}Wh`@RXn zJs^#FUpzoY>m29E8NZp$=yX5iLIn4ihr4L|bU2uWf-})_o-Yk3d8g;Ot1LxXLD|nWt=h*W zM?uhonpI?G{wIUA*B~<-wlT}*s$Qj4ey`Dq`Jfk^988+7pB@*3vu?B>z|#ant!ukW zfGW>CG3e37aPatBkU#SW`PX+ZO(?KKy~bIgIa5y#{Z(4sA(}fRq*XQSDmFC;=i}*J zks6Y1nnyPK)`zAp>u&U9->9o|_1VD9U*nrC7?)sb!_*cJ$#<#0dZwpNEO=>XnIaTA zGDC}>0lCXB4<8WHv{Og{d6sI$z7J0*Hwxi*a*OaB3TcrZw9?q4uh*-rL6E(bp_{oo zGEpaA6`QmU`|4Zjk(fS@_0}A_Dy-GLQ0rr@8M_*KQOZ{Z@?E}2aDTkVM~j1qu#?yl zWQU4R-WqoYN@SL6ZV zWzdZp9_A+2?ir+2!HzOXT*Tr*<#|Zf$)_YQGv-*CbmX}L)!XKDFLsJ&oPg{!=` zJ&kS=e%Q=xG#fHOhi*z6xzqTxqjcu+VNBaM>AkNc8=jzw8Z@PW6JDf zpW}b~Dh^0LkiWmTW=h(ZhScCS7y#9w*(naW03m#4agpICvKIR0Q+*28{2TCB~5n1gcpq zNvz99UJK><@L=r%4b50ejn_Zrt>XU*M)hB)QU4DaS{QN>!a!dje)CISQdWJo-mv$X z8uWKIhEEeWf8>5WM&Ce&KvfNthFt(sBgqwf#NfI4b}|XTQ&L9#_p_En+~1i8|LQzH zzw*{CcZIjdjQZ1Aej^lt3tD@$xy^NiKZeB|=6>&X@KbGwLCy90{KU%e;}UWA;gDqR z*N$ADA9|ZWMt<9-TFz(5yL@N1oU&cz@ODMI9zcmq(+}nqyWYAXT<5^K-4$93=)!)i3{IQgp4 z2Sk5MLTn`2x#V!J96=MUTt zozbc%+KL8#f1#&pr%1UTHNn#1Zjsc)TX+TmG(*UsgeR3HSVDMWf6PF<(}fwz$!_3! zF%8jIN8RS?DgugkpL9Qhm)p7L_4$w%UD-lae&VrA_nCm8>5AAsJ5b@J-tIB^Qs2LN)54NTY0r|ZBR{JEyS0u~8NFO6Fu-p{<-cU+hTnU@^B*AB8-Uid1> zn4Fk$do9@N7(yu4zuI?~&%7L&qG?grcLwE7H|o6~>wowo&xccEZq|PuDA$uDYB|-b zFIK03vr2L-UDc(y+ND(u(`G=InhN^I*oYv+U@9hz_})PbbcwR$D)47F(?AgUx5G+7}Js48GO&Gw&%P( zS4u=^!SoQS_&s00%kY^d`XcDhT)Z3aLix{T<p zmF>d~uPr|!%f$X*eb7wvnjZX~2R(XYjsW|n84XL$Pae8lECj}b1rtYb+55A0=xS$!blStg8XSZ4# zUz5;t>kpXRAJs6e=&RRextkU=qwG1oRM@t&RC!DmWC>J(voiHSY^}oewgI$TS50Zb z@-B~0e4m5`3#)930;td}n^b5R{IR%!z#TcamPrLuy1r1auH5|Onr~OAjCMj;PmQhk z+eN`!1-Iv`+0sXN{rS1=`S4W5qqp>`to_^bc5ecD>%iM8_V-Ngh1P9!<86E1*sWy0 zVK&lIJVHqWX3USD$_Fx`cJrQ?$Tpv{y0ouz^QAfGuO>HV!I-3Wesr;|6CXv(QF@Lc z(pf!Vw|)$ERm#&$DVF5rX@qh4lB(LqS#4+0`uV*w7N{lwargkR07TWrFZRZN`XN4e9#8x4WeK4g|*Jc9#QC7E7T3gfhq( zt>FJ%%gE7$f%m-`J0=?%v?V}z+v_+O$VEc}1S&-@nx zm|AJ+QgQEvZ$Kch77d581lG~5fzyparXGNsca@YQSe06F4LfuL4UP%d?z$dJ z^wJ0Q)D-x;wJ5q9w9L@>AA?teZXWB1eef5Y;cKe*?l=Gu32lrg@lL)$?? zKj+UfK!TcqS2T*K~F1(#pqilK!ljnIlC!gCEDSi%AbleavcU-HEC$A2FORlyhzdDby-sq3_ z-nEB$_I5tODcbDf9OrA4ZKp$uDBeqhbGF~p#BAH5;`oV}@QtOyuE=pay#ye%dY$=4 zs1zV0atqwTnbd3=w0o#3J)0VC^$;S_wWcEmR%CY^Hx6RS(J96gR7soKS_%7oxxaCB zu$%a~Oo)ru!jH%vJpZtL!^`Ll-0tpL=hy2Ii`y9OAeXdYl6rvop$}PU zYK7t(tbPnb_g?#V?__M~Ones~dCpOMr4zkF+0qY&J1=gB%I$5@d;Z%0c>I;)$e7AM zziS&(q}if!?nHMiI^6C`Y&Z(GRXKRhhV+`uM%~dKEyf)?-urgL{~QAU2)GP>LTirdKWA9r#tBoh50Dq*t z+0=#B*i1gvws|47s+Zzix3k&s$v2o{=egJ>)fsc{JOHS?{7&S;hLsZQzrF|)Oi-1) z^GK-nunp~U!eX@IM_TQRUCzyA>Lg)?EKe=tcTl^K2VWn?H)7abywhunC8+5o=-akm zOV`%M)}p>bW`8lFlZsl?&lm4{Zyxp>HOqOZm9JJtt##M+PeM6~Rns0hL1A z;&KuL%x~N*Xn{@kD95r*%k-tI{NYz~d4@$ge#D0%%lupDd34 z`E*sL9}4GBrXf`eIHF-SwnU@WJ~)T!gZkPaTE#H7u#aXt#XBG|kp5Ezw*irWN&SS? z$3a>|Z8^8-yy|N;O+{CzX8VYkO9uGf3T3^JRauufE2N5eow4-?eig$a%T#{SK=%V%7+#zmKJYqj-^JYrjJGgng-52v>WZ{+*Fik1xS%OT4-wtPTCix@VYiMT^DrxH zcEXA8L%{PPMq}3$&DOL^w8WjI_OlK4-a^}Dvmi*Z)VIFv>O6%o<%p=vi4&M;IP;I5 z@j=H1Gl&ZH%h?-s&cWcz=5&3(ZyoJ1-`Gm3CiQr&fnbF0Fh#}CDxV?l01P%C--LOO zge_rAc^%IR4jkH91oco}hM~K-qH-(sdi$({cr|yIx7l4JI;wpt(~3rd?p9Bb}_e>Hai8S{JWokj-}bgb^QDr4Ni^tdki zhdQ=i%S1?^Ut*yJXB-_KxzhLkHkld-jW`)LL3%Q^nIC??`J=d0i{L zDMLrzF5hzuSP*)W<8-GwUcm*U1-UgaQ0k=+Wl)Oc0(JMF*h)l6KY@`U;`^AD@bXn1bgS#a97<0{ZClkO~kjKjf z?w(qMrWu>n2TUN&^W9`*?Cwr+fd0?kF|g(hJi_U6&3Q<3NTuO@eX9LrsTh8A(}B<6 z&tCs{Z5lVKZFUvM1)UvyyEej`x>N2JPJf##WTI*dTR za|qb>t2-hGb1O%r`Js02)SRJZ345#=!k`!f9N2&Oav(J8{?z%fYoa4p6Cyb-8W!Vy zmQkLYV9_uU&eibc+z@=FkVhwYj}$zbcc(gyo_?TT?!=Ci($?0O-xj}(7~X<>cN8YU zS#SE6Av$hQzv@-Zog$LKt0Dy8N2Z|BG2YFMgv(F^dndZ&lb_~&7t_qajN9)P*Ky0b zy#YrP4^G@?tRM2sbQ+osVu7k?m-SnFrz*P?fU{qM>lKbBnCrI`NLd|wihh|B;6svVP}6=iAVUj5oNbbaJVoyS)r=?KCuG2JBMj)#znXbn zS*@N)Zr>6>hXFf}85W*BJdA?V^lLu!Y1J*!Dg7!<=b9P`Q{=;(mA7nf;N>0I2wdW9 zW?Vo_HOU4F$uG61i)A&mPNj)nK~=V6U*Z`H#4X1y(%vW#e>1iOf+VKEiyagWa9DP& zixrTEay|WbVg2wJvnI%_>tdUZTd;SYs&d0`lCkf>2iag^w_5bUP)x2^;v^>crLOY# zLC$54b*#&IdGLMhoQ*_4Td&vr>jo1qLYywjy}*Z+EuPcftL0e5Ayt+NG!A`IlaO)_ zLT`{(MI)X(yK3XLnW|T7^Xvc@nt}K?UjGYM)g=Ej7yUmyDo~j(#XFnIl7Gq0jPw6` zqQ8~xOQD?XWw@fEwenw_t0v~3fn5xo&^_a>#|~G4jin)L|7Y$@4>?ZLJ%iUS@xKS8 zrpY)cpcv7w;^%w|GoU{a@@I)NUqlu!9p~XPNJp2UvHvC)zu|Z~SA+w|FKF(!>U51? zI-%kf2rRw%`rpdp{r^T~QK-cX-AmLI|9;S+m*D#lhcrwI50BC`nMfnl%Ab8-pl&ix z8b*uTm<0H{>r`Kp^m$yHn*AT#<*1x!9pOT;z1rX8^&`Oj6{OXC`wDbHJ*}md&XOLL z8;xvtNOFk-Eg0&f!WPF|m|>%IQ^%RpVSm0d6IYy=`(!4UQ=^{(T%@S-ZC+mNkm%7T z1={e~buqmJ>`+cpho<*TQ~Vrx$(1Pf6`)hg|1yoP7ZUJ>qlR@uZL;s{p-`D3@pC7SC9R{;sMg~a`W_nwIs-$2*3m+r~y5?WoX+*!W zS}6k>DRS8dSQLJYFKR$kGA-vfirReGMO>5VllB6KX0o4U9*k46dAr4r2^Rcr<-*Ip zxY%^700$?)dkihi3j-zOqN9vCoo+;L!`^r4v6&25yp8Ea6D!^xb?LNWK1eds?)@VM_f?it<;LxZ7df?o?-PfkiA-J zynXF7EGbib{z6SL>Q>5%$2EX+^9aT?5LEFJKJEJz5EXpc(zm5}OHG+5S?sE>T7IiT z_ZJRZ74K|B>Z;g!0eus>*a_=$r6MzdRPV)(MWEImr+<*3)MoVDCpYlfi?Kkx(CU&L zCDcwjLi3TUz`g3UWK?bnSrmhVuY1wU*r9rKw|4W-KA4QlZS)^Jg}qyKg#)e7>_e>}HnD_W@K4B}vC3a0p}|Q3WMK zlF4xy_p|2)UIQ%?U1KlsYX~`iMWN8ePXa#Xe7(YZ#k|jdEk0`Vv_GP6Jd_z$Ru&*j z)F61yq^s9}v!+~Sq8sF#HO8Gyw@8?I@6dpUgJ~eznb$pCeGqx2+pw3@G5Cm;=|(8BQcJgy5u=1GoDR_ z7Zx$LWn-gS9K)#K$H_^%*C$Xc>jA<6B0C3UFb_VY24uz zJ*Q-eb{UeKnmB(@gMOBQ7YgNbuI`1%q^*wQ)>tZ(0IE!%F*MFawVN1Hm17GpL>Oe` zorfgzW0%o5EtGl|Jb(yeH@>wJA0LfXg!E#hMr*3SI=B=2X#PJ)L>&trQPde@)9z5r`B4 z=D=E0(iaF18w3iU4G4GdF`J5a-eTuuXWm|ZK_{$#qWGjfy7@#CbM7AVxC`5@P`;}M zr^Ctv&=w;@Y}0FbKuil52oeglr_=E>AOFf+`EnRnm@%vaq2FbNjoXLA3XEHrD+EH- zdBu5m%u8Ig%Xk|x3;EB2r9#yPSNFEf(aZ`4rwjk!*{`uc_Ynr40C{8*5~$i=`~920 z*CFpMl|Q*^X7Q(dlPJch7|N&dMYC!09Oe;fEfOeV_yRRBwdWy@PTTcM)NI%XFL{?G zs9F{I-w%dAWrCuPTbb^kAYBFs*p#4LA7#HSQaKf)s6m?>wCh7#Q;81}Fxs9F_G3P2 zP*StA8wyS}e$|A-WB8e>ob+ETb+e$R)IeZ(5ls%s3poBor^S!3LQN()@k^#_%%=^i z3e|>W=q391Px_iQfVEhlgPa22BvjNoww)Tz+a@ziL*u(MC3PBCdE#pk;wtx&njsui8|t$MWr zW>wd1PG#-HO8`xBWr(OU3>0tEDCyc%fpo48@dKLIaK`3w zK#AeG$vBuGgN=%F(27{}9IRvFP^HCC`bsK(OFA+Z?VL(hV5BbsVFPMZxAq_{^tuC> zf^Q6pXYLL7J|JiHXj1Jx>X9F+)4*K|y$X(ssjXq?5;F)lap992oh~(;cNB>4V{ZWn zKqV78%pjDs7~Q_B97>4e65mot-?RZ~$FAYV-)k(mYjec9O|4~wkAa-N+Qfcz+<{m!BGwReQ1uOGY^VArTssb=YJVx zGStvE;cWX=ipsCs=91L_6<6o`)cZecIUQjBU}oV~0z;AH11l8D6`%-T`WWj#RDxSv z23`$NgdM5DOj^O;12!AQP?PzD_ya_nacr4}W+CA10#yY@J2fFQ+yn!wkgmOp4pN{?DFh7J4q;W4Q2m|KqCB zW1ghxxV2G)S7%n6?;*kONngtY)Soxnn(JbUQr`nC+OIyW5tO!%>)7tWui(+e#08hX1b?V4@?AT~a!}#Hdnb+c`b7OoAne|!-mU_d0nJ8E8sjUo z8%kEou^ngQH7h!{@U6|k=ZL{*JOcv+x2%qI}2CoDKFj7=^0s7$1GA zJo^_U2B!l(=s@ID6LK@FQn(em=sgqCB1{5uwb7j!J8sbUa>03L^qT~iG2i}oUtG#M zq*fI_%5?*MPWs)GSnE2ID%WU}n%xW&@ILkDZxvniZ&AT24T>rZHhwf>zXKM zVZX~7VKo=X+sqdG?Ovwvd!^3nCy3{7j$c`+F2}*2MK#z&3L{)1xe&KsM6cc})aHhp zbq8M#O>ON*#!R-}eL@%yldP z;l?c#iI_5^iyb!scQA2Q+(`##eaoQ9>dinnr6eRDXQ<>o+RXdJuBY`wTh~V6_OX0w z@tXFP=x}4HWZfCN5j>$Gi1L{FlIE%tX;$f#xHq>(E+>v=!Wb@GWjvkY5um+1 zT1s@dnshRz(ur{O^am+MG@CK;Stgk|%1d|&8ZqMJzV;fNJ!SpIYU~^&saVPLp>s+> zIRCw9WR?8g47s^uj`n9UP}>>mR0*3k;59y1kHu?#b{Jj_>U>8BRRYTMwL~{*>(@Vz z^Yc=slNDw-27=a!?~2%WPGwIa#jbxeIU<4ki$}*)0ugWkF$Om zp;dc+joob3ET>i-F#9yg%P&=cAj5oAQaxy9Rd`=O#Dcqut2Pzn6&%bwm>87c2LNv{ zDL2vYc@x^9NOp*dr;_uxYkD8cv^M3OKctxrUxxN~oy?3_rzfMy93J)aYIuw0BrJkLJs;M*F_c(Yd zf}*N7RBlSFki<8yN7}k-QJ#e=N7z?Kt~vu1Lu0q{wIqADboiY}2D9pN4dntML~2=T zsIuC68Vh;$g{B@hM8|sJy{wDlKmx{J$?`bY(vc%E=={-5s{U^{f(aYCUHA#o>T z*}8MTW$Dbotq0#u&liMx6W8AfmXJxg;TqU+VQ!f4SR!ABDNj~m)#_otTgb_3o9@RY zsX^n~6zGVhaYM!V&%mmF;ygOkI-v}XW$)E zRxd63=Kj)wu1C6=#d%L1o>w5vZXFf>cLaOP~)bPWKYv152Ao?{6FsBR8d$P6FV^^%Hv>1Y3-^718kg|+K|K<-+wnmDN^4xz zDJqqT=?}c$pyu3!z=l{c<92ApmWCJm+SqdHH3fw(AL+%XVxb8wlR}R?qm$LrY`Y&> z1J0#`uz7sP!(1cpA_REStjhoQx6S?wZ07%AL%r?)0z)so_5p-G1^P2O;3D9aXkHrq zWl8_zdeHv|cX)vI$lXWVcQ(HzG9D+o-^AeaI`uO0?<@qzt%&?ZqZ1R@veB`f-e2+C=3%SmE*X^( zmsJdO3aeZN3dDDEO`>H76&!gn#_`v)P8xk*`Gzty-;*_s*z#ZU99U2VpLkhZlmS)C zI?Ju=-n^6L!qw2_(T6?~s6Uu9|44wkObhosXjmyMp(NfE!z2>AEYjWvJu-%ngjJ_{ z7xH@gEH2V4$^dO9BhOPfW44|WzPpv1ZFML%@Jwb_>ZJVX@a#kHZN02`Pf#b%A5WFF znJVbKx4$L5*KvZzTy-i8Y(0lH5lUv55+*HYRlJ#(`O^_&8t*eOb~5-Hh#~zZjh9Pk zjMfie+AOBARP%VrH+mX3pVsQu`CJT)qUpt4g34S2WPYRP?(3sV;C?Lf-k$t$ogn>N z`s985L%JpFeaVhnj~mBFA2`JEeHYKduzh!0__jbtW6lQ2iCZV$N#vvTwPVTE%wigd z7nA`I$lKBkf19I&2DXe77Wm#PTVtagLvO zozr*ocnH`3WC(?Q;Mqf=Nh=xC zBbP*8KkjPAg^%KMPpKxE4>5Lq-+Q>(K6q`uk8q~k&kM6e`5hB~AQQ(&zJl>Xlzi=u zFIIG96{>gQ`5ZWY!MxDq3fS>U5f7> zvxP@}irL3otdZnVrH1b7^7rn*U-$*DeLzi)B+b`{XEFc&d%lQ3=xch8lpn*%Y+|+q zt3N^#;>oeEZt+uP-nM@s*W*!Arf6}=q-@N#?d;1=YDL}`h>hg^-HuJ>-0`d{=v#%9 z6lC6nh}DkST?A<%C4GxCtxVH&QRbnWOj_9(sLAReECn^c_?Ci*)@AI>5yOY{iYa&# zg#?xtK1B!Jl9=b^0RQ6R)U%AFe&3uN#!WZAvO!T__5(LJIQoWZWEzC7LHE7qqHl$$ zp*Szm#^4esCFLo%CJK42kLFD0M+&iel?R!-E(z-KA+o8J$e5C8rH>SuppBp7%wgT* zoWhS&RQOTMP_q#~m#5`P#!qebb~s#Xc32(T&wfmfW8@`z3u~rYa;|&~x{QJTEF~ak zso|X0Y_FW{C_d9l8tU)p|3HZ<6f5k=KKlbW%v?XR{EH~^iN5;fOAgVT=Qz|?*V3P6 zECoK5@>z@HC&hs0JU^E^)+Y5!>6i;s$c1#NS`RgW{d(!v}HN9akjeN_0d5>z_J}R}cffRH5 z#E8Zb9VgqbZ`r3zC+LXX8kz58TT8yJ1SYVArXKqCHBSRRLl?B_C37QGP81$_P2MiA z07l8bChdar&sa-6I(5+2tlU-7R;aPvZ-sJP(iN)+s!ny^cYl;x@YJJ)(`{wC*{3?V z-Yl!)QT%fmcIe>DR5+4)@~qP`d5>(!s83;04E?Fi#p(=maTfJ%z8qKV%}!5-m(};l zjoZMe7^uuB>EFu$VWTj1NXst2kgQ zub_A2#++RA2#{FuV&FNCHhKA3|x77xDnWCT0U@r zuSnA*O&ta9w^PB;2NZXuB)Ez)Z z=kd#iO(DUe#_};2V(3oLGO~JiLe*9ctOw@`9IfYsZw<{-*wO+zko34>P~=H6alb`^ zc+>OuoT+3d&E#B5hxO?4a(Vrp!Z?vL8k(BHw5ZnJQTpK_c}N>>nVLMFDv6tAQ5j~3%M z0q1!f1Ok3&I!bIgB5WLAWjxE8G7{KgrrX~JYQ3hHQBpaRYSbXhlK0RMq?Y07S2Ka* z2IZ(5B6k)WRguYs11Vkcm*!B~=~F(YU61@Ta#PF6viWOtvc5K|;27k#un0qFh-Q6O zg{kRVJZCOr*T}f`CuE-M=yOx$+WqhH0FY`-|UMx<$4L3|` zW0@3dzT%8ygdz>N;hKB5LMl!+AK#S(0{VPrdx6jBONS1!y9g~()iGHU3;BpL){ILE zT#^@a{~@sXYY{Hyu?y4pJrt}J8c;a&Cb)!T=vS`mvOPP~^VI3o=xdv}%XrDEvBA_@ z%g08m48!=8R|Cc)o(g)h9mT?vJ~DJtY-CdU7OQPQyrXtqvRu&Uo>dX_Q9WT#x_w`w z*4a(1N-C@MrCzz$rc${rKD#Z%uaPj03OLfGBnIPL%}R#9PWX2g7p7pwD5yo2KxRDa zV{wTm=pA)QveYe!f!J1~McqC$V(64esei#WU5Q)O#g6TA0j@Ys9iN4U$xB1}U1fr2 zyCPk}HFtB8C?khB>j5YGu%rf`L>%Y1XOB{L*Uw*{oP0R2UW$a(%wOdL2SsB+EqCZo zDy3gC6kJGuj_NeEx>8KEN=|UDz~f#V@t4b0MMc)MED)^jC%LGb&wTz!)O^v<63yV) z3~(}?Ux15ibwje`7yV&i^Elb`d_kUWGh2(o_pRC%*3Fp&SNjJz2UzmGd4M(OJc!Pr z^xM|3=z{w_FyY-ZtBORsv%eS)^AX(eWUqD`z&=sQQk^E1OjYV~;GzM+n20HWBjDX&avWL(>SN*#D+(M8+l zRaf~>CJ^W_5fL@n;I<6D5eBAxO~}kH8qNNZ%)89$5{(?bU6mi6eP^&%xC%R6%nUC)*16q@7>g zeLp+%-bvf6wBulNzCWR-Pgkkf@_~TsxF~b&9&J!pw=4kY7c@PJer01zn({;)<;!}$ zF!<)et4wb7b+@xbSN}s>k5rz5o_oGsUjrzbM9(a%uAmztp-yn{L-Dc4=xwhe z{Og!0xQtnJCu(8haerAgOL5+3MXrAm$crTDy5V=`9xaE^<%I1b=Sm#YVP#Uzd3v}- z>F<~HQc(%pg^!tva2xJ4Wx?QF#+*?%YSkj&3RX>+Yf1T(qfat)|hpn-fXhW4} zNL>el5GAU;g=Ub2smKID$HXa-epRZ8NnUOQ`DuYi8*2&m)HRD%FGgUxaGX$;6Hp~+ z!|HAE&;Y?Q-DkS)x-WHObTb)YZpuF+SgG-X+gI$94llle3&4#uy01aav|neJ=y-00 z8Fg%3wG5UGi`{U^6J4DtC$c*oG|=C=y)&A23CD@s4MjM=@B{Ep@lqJtJK9^D8&=qA z)!T_dd66#-1h+rmyniIhHrRA@uuxc(p3N7U-)s1aV3(s12k}v8I)w|jy8sc;Xl~Vc z#eVobubeyka8k(ze+J*}X3u#kriZ%!#h2PfR~81aJI))#3BgF#WY~ zicKRtEdKX42R-yX{4qO6HW&`w>TsOPdObg-`^I9RNjx!oZAA7cFJ7~zH)AI|Su*8t zW}dsi4ghsV4$c^jWLhw9?f~kbl?2PBzZQ+Z@;6majjp`d`cxGDnL{Br?E;RA5S)Xn z+|4z#b&Z(!-&&2c=c3R4!Uc2nG14x3HD7uzj$9T<5ex-qt-T6r!^hl|XYQ~_H`00H zu$X{!ci>AzdhHScHhGs5bnn6IcJhA2dNiz(bTcgGX3?n!2XSuLWt&Ue&+?^i3@Frl z5#L=1i`gLO>BCK#z6}OUpG-lN8M~urF3LN-HcPMBML9QTqjo|^Kk!asw>_Cypav0+ zSEG;*HIouQO~&#AWToDps{%2qQR)|7F)~wGK|pI>e!}e zP3fYHo~YXKP6EdYKC>pGc3%BowVZi4)cYRCr{pM0Mrc85NQSxOXpqWa7Gqy4YA}?J zkkWz-&UC6FIoHU@Sn4pOCfjHjOJk{YEV*KABf^n&$c!`0SYq5C`t$yEpL_rQKF@D? zzQ6D9`FvjQ&-+act(wzK43WeE<?zuG$+u=DYK#up}K;FxzTqsODl zxmHq=vF|lk``}i)d`cG7Z%MfUbM6~CFZs3ZHjQ>wyt|8`FIuM?AGlEe{-^A@zjG1W z^fud(XLb#Zeg19|Aym1Gy{L9^^7g;>XY5bO(Nt<%4x2~4ZxWMr)E?yzsfZqql`#Nn zYr8r+2D4|gSa*8z?wC+73cCaYc;S3BT;PXG58*#J%6h5J9|J%%`E$g_Pun;~FMo4_ z%`(M1A!olEzHl_n!J(H`8`M}Xp%urGRk^$f($+rX^{Yd!z!FjlbWiXM#jC3{s2 z$Y)gQjXzz!GBXJUoV-hCt2#=Hh8mPncXQ*C<8r(rNws2p#keao^1Y%Opxla#i{yJ> zCG+tohaBe(Z zss3`)$(CEEYE9<|GbxM#Ukay*@!T7W*diJR`U@iLuC>2LU>UD}zKq8Mdh0G;CN8&r zU+%q8+GFKev`7=Bye{K`AYKc572{<&j~BYS)R3=Bqsm9K>SE)7l49uhRs%}A33)7E?|4c>;ld)O zM0&FOh{*eU@LDHl^c#iMeTkyi7oZGu+A56NkidamV+7thC|EK$UC*VcaR2MgD|gUN+0Gb;j=pl3$t=g{u>CN_pw0SFPAIxI0l z#u4w|PNM}7?0erHhu|0zf&CZj95Q_1`CX9E*iE2o` zBL6%kpLz|E{IrPQyKJqU4c1aa=3m53PFvIzv_a7R))t4SYrU93^#&hUHGyH?s{PmM zNYCVyRRoE>0@f{UCJEdIgcSDK5Q|)CsCg^6xsMCm9mJt9%6)4g znSLeX7wW|sW}#ub;=u|7?o}O671x(w*}rzx?Af6-%dq1eM}22K8UCdjtyhI{DHKX! zj}FG4$^UjJ&G12UPCrTf3dbsR8L;EU!UXaT9Oc*WK(s$<CKBjHY#_0K~+L#Ee|E$o=4#`f*$BN!)CZ+jfr*+(H zIi|8ID^l^2*H3{VV2P|bAtenrtO-GPd(bZ8C%cZ!A;Ke%+6VUQa&G{0nDC+k@oUd- z=F^{QgW`_aJIY4DyB)d1k-}%X!>?Z2HUQ2raJxR!%8ZXYS|A>>lp>6YIG6?la2PaKvsB zVWA4cU5{TURxNK8(ng|~s|QZK^QLD7$9wQNm6_2TgEpfay2^BY)-ms zOorvgB$1FVA3DLg<2c37=6hGN)Fh_O-#vx zhKBCRPq!(LU}t?jOGDPG%O1!S&=Mxq&OL`XXI7O&X-{)p8FowL?YV1%ZIfQmB~snm zl#Grjb*XimiXqZgcXSJ`d@|hp^(z$*_UGN{Ij!h)f=gk*&)AXYdX&rIzxm8#yV);> zl!=z*+2SRQZ6H!2xU*%eNnw{IZZO9nbV#LG-&bTMWkK*HN}-7k=vyhm=$m`{QPHsg zHGGf$4}2CEy^rBGp)kT{EdrDl`j7t;{l$%tk~{F~SX&1+@XU!4@Zn2e1+F-{)9QHj zm-HbG-m$pI%fZK3S@ox>de(n`jI1c-&38>s0h5Hc4+1=1vrl-&^-6vEg}V)OpKb(D zIvW=RmGN+&#mLe!_pR$_&|e*Q(s`oS`Z(hU|0Z`H>?_y5Y%Uv*u#8QT+yq&1-CQAK zx;x5=8HC2BLWMn%Phm zHWl=hKGh2l{~x_k=!O)LQo_q%GX)Xj{dz+#O)7bP>S$e=e++hRUzh zEL1C5fk1%qc0+YiG5zmd<%PR0X@z|_A0Dk*k-sBJZxED3Vn2!_llbhmLm zHwR4pM#U$u&%Z^PjvTqS(?Sbavf`Td{US9Ww3~#c qBS%>(};3J(sMAT74d? zDwSuWe_lLwR_x`Qj#OT;4;>o1Pk5ST9mIcN}M~E-Rn}FLVCvo(V zUj+CE>|+P`Ht?6hM_o<&4{mh+7e2mx0sE#Fcx}J$XmfB)?T~aN1>A8#CweTH|HCC0 zp4+Q1ZO6G+zk>ts zJ#>SPruOym{T+xbt$O|Nc?&Pe`kZt1YTgd5$mT#)H@Uvhj`z=%F~F58LGwMyuIWL` zR>#{{8y2?|4ns)e&M|4_YZYs)&nMn>bX;>m@S{JFhtvez1ALYe*<0fM5rPfA1IVrY zZRol=zxQmlnZRfw@Ql~xcCUbFY7@{ab<~B%_NOz-`1^t~%NBUu_cIf;4VS4S+R%@w zHQ8$|ryBSAN=e*7thL3}H^#O%_}q414^MEB8V{zpXGpJeGX&IxRK4!*@9!&PylIe`fV)eqvNgXn2BpI~|Q4?^?bGJkbTkz(nNa7woFjvVvbr zI>Ss1znXIN1T|9a3qC^zuA!@H9k4p=cA*$I6SuW7AR1Y0T5_<2ZKbY`oYSHIf2Tk+ za%}fIi>zBU^#^*iNMyhM<7Ub_`2735p&wjNp16O1Y&T7c@GwDQ4-Xrs`*w5YlAOoR zp{G>N9#Y)>YgFiyc&T6&#esWTPibD=^7`zzXEN0}DilpD+Uef8rJsJDWKr(+oPT@A zQ7v*c{8jzVo1GM!u6tyqoi*7qo%03h$+AiZyD5@28Lqr$bXc`T#U z{l*DZv8B5Gq%D6D@P++4NMmYZ3Ar-Rs@&RV`*ZZNHvL_E15=RT{YG|9_QNCsC(b%> z8!0g*IZ=es0)A@Xv8(jYS_%4ZSoi-&IpgJ{e^%#WPPfn^s|1LayNbC?AGhPlNcw}n zOo07a=XX>7pZvH9=ah5V9CDpojzNwJAymiKzh7%@DK89zCz8?h6-U{<2@-LuCYPaG z0wMcgXa$L|_RXSE=zNmBKw%_2X_TI#u9xr1foc{Gb6e~C>ICB7?qP$}#x_5iv}CZW z@X2;p%l-O&g8Y;?x7Bd@lz^;i;e?y-&is#fr5sVi^TjOJ&but}OcY#d?_n$G#g*FC z(eG%!D-HVaCG_c3vkJBi`EkiQQ6|c_^R}H#q5oy6i`%N3cX!s+Y4cR2 zd4c>}(bx;afwMb`0t8f~OP!h}9RE>Z#{Y)L!ot*M%;A8nH9eA~fK|0Nev+7@eSVQM z7J619{=Ic+l=Z|}5zsHcj{5>LTA_cYjO{jX;djmEJwDH>D_qf6S{G8=Zu&W$;k^o~ zncVenNs4r4=0+TiuPyc+DvllOI6m%u*R#A}qvozzz4KTol^r}^6%K0$DKBd>O-Q+*JJZiygpSD_*CvFjej$WcLrtl0Tijw63>9^VRw6Zbaw zrhtTcV~jG%@_7A?m6!-Uo*vnVitMA#K~UTMr%|lAH;_)HMech<)+D55P+z=kjquqN z&(1|xniP9w=wT4ZM#WP%yX7)TE8P}iy!E!ffTxQ^?$1^oogD{q^zpS8 zc>+umvGx_SwSP)TR<&-M9K=GVVA`)gfJIEkwp^31 zyKEjiC7>#;Cl2}`Y245~Q*!vK31Scz``tjZ>Z#>;A=9QUa-PbT1<27y-81G1|NYPfBN7lP!MDDF+~FesX3YMBr_4_@w{F);wbW{<4D z(Z9S<9na0WR%Ex;KzfKq%IHcm7jbz`Oq-PW!0L51F$n66jMq?kwcb1t*lAwh!gs%? z&cePW^XjyYV)q>_hqmm#IQw|F`d3%$UQrgQq6q!fW^USkXBcs)^-mz=1A(wq za#UDa@q|iq+qH##3nf&x*%VICd6_HhwB^fz%*x$N_CYp>po@(OzzWUT!gXSQTUC2m z=$a>QA584~S8wE;8fpCcI`O&nck5xplAyo1IR7omfE{Vf^N1j8ChU+|dk%C8k{LEN z<=K1>#7vg1k{|i~WRu91%f2(1&q-iYM401uu7G7cx3A!j?EF^Az#>B3HLwvA$@~)P zY*^RW964*R`9qSP&m1pH3DbZ4Cf6mN1IQ5(#~Ys-dEpn&b(Ke3PcYC^-3Dy~&Uq0? z@Oel7l>{$P3j1c#;BBDrWNayV{gx~znWuX=CY__fzojC2y>)Z&7T)tcU+2b$ovkwQ za2J7VHFo>x!N+#bUjyM#X}9k>ShV_W-9xGUOr`dz~?!ZPnfiOk4-Dxjdl`%N$ zGs^yrmj`|aXWzgKAJ!*UD3L3zIJt`4fz-bU0n%;&saj&Hn_A)&gz;M3b?r^8`f}VE zbIhf2BWI@~s9K{p^)uw1hC*wr72ej%2JY|g14hNxNcO$&;4ZonAO^B)BoN#Woks$V zpqP!6r>||j#+K$DJCq&Vajbd`qZ)g^${ldzL&Pa{bsipmI8FUo$YJJr`s;e=w|Yg@bX>2X;cFR*SagO3lQyGCHAsGMW6hqE-t zm%||vEP9ber<2o9ER(BjE3m65u{>+? z@Z7wSK7MLxpG32^Sg#eYg(8pOH4ld|XVrr=E&X@RS4T(u*3T>tfrs$2xkxd59lh?v z9PdOtcAPNa)T}9VI`LNb5{GJlO{S?JglyVB0_o(Mv4B0O5%_-b%VW}9*(=59M`G!A zouT#)MKHVyqW7JQ-TIp?O2SdKS=Y3yuc|>!Ia_Da?W~rU1>SQWnjko0pD37^j-t5Es)lD}+qE)$%w-lR`t|jC1ovh(Na~6~gN5OJPXtCGHD!)6-8c!ZH;TF8nCq7UWwi#bfYO3B>h zF9RvCOc=V-o1YOxUKlbr1H)#cgc&S?pFSkZ36{731;O`y5i!~%^N^N8;|oym5a z_Vq`plke2UPPj5Dj+!?=FptiBv%pGt9VwiUTO$16o`!x3@=?*u0DROg7CWTTq!?)P z09`fYX(%S*`@K&|+l!}ov~Tw9&~tO%PNxTKUn3K6op-peqQR0P@5{U7(g2jy3 z0D;KiRc1-^5cdYQP|2LLh1t0~!~~f3p&s*IA}SVlpzGtVt8RX{c+M)$V6qcR^Hk*; zJFAf6CeZ{wwlpNi(5b?Xb2tZsF)fbq?5(GhK-_5Ko5tn&yVaX*OSoDqMB@&` zKppW70TcbZopZ2GU|0suu?>h8vkx`jq}qK9=$a#UW?sc7ARlEI7GvGjY7j3JJ4%Z3 zoyytF^(b=^LiF8r*JeUgL_6@S;V>AZ%JuzwpIVP0TK#*rB>awu_IrJ+Z55}O=I;$F zH{j&VuCw}!hE00kv7wD}rjloqvvc?0Fl{1Y{x_nPFk1nUNYN&Kd?9Mf=b*HA7ZuyM ztuYKSPhcMJ+7z#FU2{Isns8=R8>T%@e7ntIU?MY%@2Wk{wJmz8;%;na0*slI=q+h5 z{a1X3ai%_FyVvh$UwzDB{mSYIc1rU6;`+1#6vq%=XVbv~=vIa@2>f_7?#6oY$)bC# zCZZznz5A%dt=BYdXcrhsO@Z{$u7>R)?M=m7`T0m8Hkx+Cgj-k0$pc@at1KIeSv%cz zVcLU=_lafNy2O3`N8SXXTE<$;X-niML*e2>Zey-sooYh+wQQGaFFI;SRdb7Jg=9 zG{RA3Ao{rk&rnsyJDqR2{S|Wpl$bd{Jhdl?pa>?szO7Exg`pG_2cunOpO1MS1q@cR z&Z23j|3u4y7>I8#TUhVsz^|N`tcz^+iH^5}&2`Jlxj@^8RNYncQ5>C#ndscbZfqmp zLm;E)MVHzvY3;6u6vqZ`}TAm?1_tvO%Onbz3dSLbk{S%oaF z(N!CmnE&sA0wnEN-CU(~P84M%e?-h)=VA+`?t5QDE*P1lI_`F5+Xe+*J_5QwUJ0gR zBdeJFc62i2%Qx0LC1foi5VY?aU=N&4*)^OX%L8llI#-uZ3a^{Wo#docWw-z0!g4v(i7Yzxvx7yc zeLJkK7f$u<13<60fobCmO4$ML+w`vW z4;zr)KdcuZNH?q>x(*7&v`+y|-WxQ6GMWrdpaxpU&lj=j*RMbHIrta^f;4QC*S5ru zE_m4lKHnL6Y^OXg;J`BM%-+|yXNKSTaUEsffjjT=bMR1?aeE_8DEwSn-)gcqSl6mT zdI(LYXD4~`_*wV=^0i+`KG2?kgRf|K-%n0lBovz26Jodhrn1Agh{>iwau!;(>i*(;(C z*(4~+K92Fl{FKkc(Pm?ty@7l-9bI=@H`LVcqoPP(=UzDA=+q_4(6}o1$2)iOEeH~5 zFF7#&qI+L2ePS2K=BXu7r0HK(h;zLSzu#5bu=qW?VuG15z~R5+Q#1z%3hevP%H z-F~%=mfE7pl^UM!(!Z)Di^H4Z9jL?U0$UZKfs8|3Int-))z&Pl_ts66E7?P}LkGjH z10cFKbsxxk!r&8NwgqZcjEdqPzOs$&W1=xlF*Vict8?g0$InmvIBl?Sc>7q_h7hz& z+&RYKy+4W2_?mAuNK6+~C3fn)knx9dwGsPp{cuo<_#UX=$Q#~O-c1DPp6o+y>@R$RW$<~?r2BKf zij<8p$T8Z_7&~CK9?*f21*AciE&logRa(tcr6LxZ9L!G~Y446EQf&3fd`mu`JUq`p z6$--n`fB8$o4Z20IIE;fljN6k$D%I?pM|?08_h-KJP4v1Y&}A>h5X+b+ zeV+7i9kp682s8gaUo`pylPe7pX|i!0sVt?w8*Ry!SL4Vf9{%of8v$4)J}YE0S$r_B z?TL(M$8^LtK+~>@ousi0d(!^a`Kz_!-7M@BupyjXxJFF>i3La@3%~{b3a8!4clQ^* z+=KlZ7M$X&!cd7nc+-tr`hN&VXgR zvsXNUMZ5xx3-}3*0zO|6@KD;9(|xSNzbl0)*-3ctPH*eTG8&!^(0T>ppGdKw1G1UO z1!#>pkK~UVS9%N+ksPd);^X?c3v9R1e4#`O!F?^p+ogCPoa)&M48TMM_8yQb!)@NL zvSjr!^`a*zwqrLtxIlMP?{d0#<_A@Ha_r~QCADm~JuqnQ<^!))1}Q~*PSjDlwEn!q zLI--PLpemw3WJlng?fZWe&@WyT}jD>FEHNKM01u9`f6Tk1A}StImzjQOa@r8epIu6 z?RVGl<8a)yL11~n@%a`Lw)k5awNnitN7OgS5D#tNd6MH&p}pHLDQ<*X!!49+K*hkr zqfYAWNHo30zEIq7Pjd^8{awG?i+>W@tjq(_5D4+~bEv%n65+`1(iwjp!QDpPzUjWv z7NcMOS^8$jdr`g_!kRmj;iaHDO1F+en7|LkZm4P*ppmisr6ry{Fv2f(oaYamY&saZ zqUM6wCoxE!pLr$~gV&b-+qr8%RK&)m2Ol{|JUnWv*RMZY+mqerKm@X1*TV)~4Dx%= zG5~t`WHOjyyn}fJuR2@~90xxwo%ztKLLI^%N6gyNcu8&Bsyw}Y+;jRVhVqox6V{}lhNT)O6pa@uNnh@Su9sJ7k&a@AKYyZz1E(yW-?NhSUQ|0E`UUt4262(27 z(@+k%2|?s?&-0?iMF3$#=H&D~g_o4kSNBP;|LaCG>W#r-^c}PL=v1G3|F($h3^h@= zQ94g_t+Zi=z70NQ88%uo{IQlO*Y(K9{E{%SP3KkL)C}J@g8>&nR?s^6MG@m z5$46ojx&xk&6<_f*DO8gPqXt@M4d9{rEDWk>RhD#oPw6B{7Gc|fG`+5bQ*Vm{qQ6N zg$CUz`BU;*Td3c?K(wUTyuI?{hD4B}zYG{sH-I@RH;A@L&fm?Our3|1WBH{m{NvNe zMBMF29ikUyDE`VqP~8&yNoB$BsJNqh#sWh|4ZpD;F>J=FKxrJdFbZa>tJ0Wmf|w-| z%lz8P3qKBftMBqcc;kb=&q)SV-2$$9X<#ERa^b?^p5hU+%+Um0voRq2H>i?}!S^*A zDE09zfQsz>Ug%w%DPEhl0wT1?N2mUjZ7>Os$~f2H_48-+I-E`QNx;r{1Ob4pc<<;m z&IaF&EQJ6-7n>>wk6uWA{>e{@s}eqdtfB8zE6GFPMM7NB!DT%Auy&$d#(rH?PKl7B z2&T_HAbm&)pC>rKMwXC8*dkppy12=zSTa>e=00I@dyO)d-JqjIsC! zE>EkgyKUW>ST)7l>ZLbS3ly?>3xuUWgYM(2o3BEh9Ft|d?eRO-|AB;u73qxi3Ds9% zCOnLKb3MVx&BxBs=I+IxN4+>7N(*Y+Bd@J(fD$5VfG>oj%l#FI+$tWM=zRgg+Y^d|n8^(`2k8Fp#Be)9Hn zD_1K#;n$#rG%LwEQ0wRS5ow|Wk34*8q%`jfTV+=zg~rv6y&mZ1e?T~26gg_I!2b5~ z@#qM5bGP=I<&`TEpbso8MRyzyXY{PUORE7K*3Z&wrnhTGHY>9*zxy7rOY_9MhL;N9 ze#xk^3l2NiW(Bep%#$3bZ-!J|-vfYuX(X`_EvM*2Zj(KmSqFe%NOZxKRZ3mPbvszV zNJIV?n}Op=X@ggUlI&;$r!{Kab@`9a1?)7OM^h|4q=&v###Nep5y~xuURyb}cdI@v zVX(;Zik1x2Wiv@Ztw?o3b!#@7hOX#b{~c(5tTR!LSMB+obA%!!N5Y6=bxJ0^3&N>|59=@~@rQa6!%<7@&KG)uVZ6)4aARI_r3P*+H>qUbrM z8x{Qtdze{$Jg5bW4&6H{z6Pyw#5^Gm4ak)V9Gk*xblrd}kSeE;@Fs)vbdz$(4;+eV{ zmq`f+(p7^xDYm4!s)}%OXD!r)2{RxYYKFQL+ULp2gpu(5sA?d@BPMJ;csi4yMDgfZ z&q}Jp9SFyY@jQplRV<_UYAa{6+`&_sn4H=0^4|D&Pc6wlm#@816k9w!ni+5ktWh*4 zzO39!AM^DG#V0u92JS=!PK+zv+zP?reU)BycPm6KKM-RjoQY?u9>ebMqoqV5&FzzO z;$CEjbJgH>t-oLcq*u=-2y}&!m)-{ArD3T2O)E~#N%b`i4m4x_7Yj&q$kmVsr<*`* z%;Wv;Om}pjCrev0#X{>(Fj$^W?L7AJr2x~rja7ZJ@MUZR=21 zzqU{F^1f<#a%=%6AEJM{d?BfFW5Yu!=?(;@&8qr2ke6`!(BOfw$uq@Ji=htalDPgT zuT3KIQIGz2?JnjB^_Kz?n+9Uv{u#bk{!k0oQvVO;=> zh3{z)@9B?gkYV>^+yMeR#DWTS){qB?YFT4~g#%K(a(6I}e#RBKt+rBQI&zAchu zIqXYmZ{Xay1_f#&M}o`->>b92YT#syHVgCt%>35JAfx@W?mf+U?!6Ym%3leC ziDsI%or=ky_uv1#*yLx(F(C!YOT((C6x%bsOAm7f=|k)d*oG6mYuGp$7=Lc0s4JhC z0_wHtuQF0+pehq|Man*(&NGESi3{ryej6Bjk#Av;Swrfv9CKDH?iI5?5>scfP-YH`tj5FsbksO6eI z@OVYzYF{b6U=1VJf|Xf#ScyyQj`!byc zn0lD}@*+<*KRCVE*;H`53bWyf-TZzATof)W3-|5VS4X0m%ykM`UKS-VDUR! zw{r?dkskix2;3se`?XIw=7`Z4QA`E+s@mOaAQ1+UhoVh-Gup=t>YoK^8-$~ftaIj* zDv=ecoKH{{3CN`vq5^pVu-^vWCDs6~jn2C0bgHiLR!z=%f`Ju~qV!cs+ixR^o{EYd zS{m}Z+|x8I)*TRq^;-jl&f3>&t2hQ+Fb8XP9~{Kg%-F@1%yoUOSSvMVGSrQ!9)Qmb z0e-NQCh&JXiY60t7bPxtZeDOTJXsjYjRajc-2SjXT=vri zm$Ke3qXF1croGIY1 z$CC?)0tH|C(#ad4{`s}_V37f*PFWYwQ_H2Brqo8W{C@?)t9{!OKfO6~6Ogfw`YxM4 z2XZxi5Z)(j7`Q458qMf*4=*k@ZvcaI=G%+UYhCX496Q>{?%rd}5PC;OPvaXoI8D0Wou{GMH6`L2>tWV>@yt&UpIA8A5V6 zeDtE6do)m*Tpjgv#_voi{fi^VRJaJLD5kru+?e9iy1$e>#GZ52lKa`!@t?A)iof5k z)1`b1ykef6dCB==;(5K)vMjm{t=|?f1WeUOO?frv>!?$1gL@}N?v|{+9ork=drTIU zhrd^Q5S3DM{pxsWfn7l2Ysac^(!@cbT>xcD=up`b;9yGaGeFG^Dhb-iUHd7i<`jh3 z?TKl9*F*B|R_<5mrQ>MVmI_1VoG4^okd~JT4 zO&%`cXOv5R^FRQKlMJ-;Pb9U`Om;H=nAGwdjZ2C|Y%0M|0aiQ;(}4KFGy!H#P|E4C z`FumKmeiplK-dMGNpyp3^!lYXI{R4e174GNrNnjk@?R&{>5esBC40DkJyU=`;t;=f;Ez2W z9+ReGn<7uYpwQXME-4IxcL5MQnM zY$Vb>yr+i&FQJ!XQ*@V0)XX?Qc3+bwXcfescj{XJeR+r9Xz|CswlWzPq_;=Y70syF zjg25GZP-h<7J#NRyMWb94Hf%uBv_HnTe8HH?eg~iPw{Ru-t9QKX&$P(+RK(PAE<}% zD>nTV+8yXtYkT+m8NjobuvK}P#L^h#;^8)%fXc-qf~1#k@S*fG?5d7m_e@xxYpSyzk215cmrveI;<8-j|V(rvUJ6(b;t$= z%=Jg^x?pQDKBHuLDHG?$G$_c-W29)Sz=`%&gc4l|b!XBGRku9^njxG1q0&YV0`}d|Y zTk&7eBA3N@(t(bRwI5{d0yqR^*Pih)?dGi>+LAAQd+HnNJ1$`x$h4|^$yTN0oFzf@ zo!#yV$ln4Y=r={IR*8;KPqq_2YiAAtWK%hq#XZZWTJS1jw~7t|PJu-L3u%rWq$|=x zT~qU-Cd&1xWU_e2MGo<|7@yAk9qW!-?14&p`C?(U;JB=aaL^jfyA`0j?d8*^+m+vS zom?WbqHZH+>H=)~wYX(-AS!|0J|%GJU#g>%{Dw(%ZjP6=D+Pm>xr)>Q-FK#K8zJxq zVC%_IdK)NHmg&CDn`KvHQlM&dgJ7|nwOF5;)YXXqYjWMujY6WALpm@y1CM+6#uA^u zPSKHXV@gFzF0;cr0KP4DRl&)k);cye74QyaP04_Gr@+W2nV`^sqiZhh;@zxVmnpMK z?3E7pwO36!evbn{_f#P^m%@~~a1HVoH7kQVh9D;aI|e$_{Ngl5!!-r7&t9p@_?&V1 zdd9Kjr;}tYy|>s}IR4`Iz8KoOQ9)<#6N{oCMYoaZH3P|}j4!VY{h?BzVdBAU-M;~` zzr4*s*{rcap#ZMfD|G|t&hX7`zu9z}4srhZTG7unu$n#UK zWere&1bQ1+P6?2;nLWD}nBIBDJyrqD7_6B{-}>HZco-lM)3C2GR%Jb;#o1EJ<6wrn zB%2{^9k7ywjLlpFY+>iB+Rh)FZ#?*co~f`##m?kjeP{2}71oD$tLXf`*i;7CU=!xr z+*Efvo3?#_yBqh)15P1X+7pEn`!vWMxQ-?ziQ)T+mxE^hK~2G5!_OlFl%%f1Va#|{ zhw(**7Yv=-5knajti)OEq5kKb4Cd)CGA^#$9ex>wL=v<$oqg9{GmL`EgxxX&sNmV^ z_-*G%c$QLJ@1-J5aiHQU2@qp9odArsPyZ-E*#IgzIB478Io1euRb(7aKyo}?ZP@LN zhJ$54HB?>$)c|7D6LdB*DN%xD$jd4R4b+fqin=gn`z>?HhroU?JVX1K-U&u#$=is7PR#WvQNd5? z1lgzS^~CBY?h5y)v@cL;bX9(^cPbrY^}7Pr!t%zW+b&hd0F@!RWIsC>a4%QXj(M_p zF7)1+#Kv^hdL(uMGr?Nf093f<$ND`(9dOG5;xOi44|=mCA0wwrWe}y9!FF z+1S`ASJ59dQ-u#c=2h*p2=oe23{n7`O@Lii4bT0_a2Oj0011=mIPU%hrMtZA2EKl< z+J9aGUbdxjtqeL(r54BjS!~fjJ>>fRW21oa zMaF+eze~_r>5eX`;A6uVouC$&QQRm9KG67 zs)D%xYWQ5$ms~i@PIxLZ_!xrfJKVml|6*!-ZW{+iZlZT+qxpfIK-AhyL0zET1Y)Cd88)t5*mt7Mnj3ENNbtmK5U1V14C<99yrM8Fdo5CdP=>bY{gfjU#*Ca{y!oeAyRp%gXu zmNB4un*uDrEhg*&1X+Ya!#59e6Rk$XEb{TeFuj0b1#IudfKxb-?xh9Xq>DU_jd`Pe zI0qv-A9kwGe9x|kc!~Gf@MBZJ<`^J#l{iB;r*Kmr> zw$Yx_nEx$9zoMg$d1#yr|0NocYJYPCj-)<{CVV3o09m6u`|)`G=MgNslTi!ZZk&0s z7)srD^^v@M>6pUa->cq*b~566HvA3n?pX!s7<_QhN+Cs^}n}g(G}A5}FH#Z+vygeIv@}4Sz4xjdMbOg-p5!IFBz%J=P`r z>0-ruECfpGH&Pra?>$PQo6im}eKjdBhr6z zGQS2S{dZWJ!8l^!{<_31D_7&^J-@hL)2-9t;kD6_Fro=@T(&sv2QJRB1gE4lrv4F~ zwue-dZ222LI*K*PfNT8prAaN@?f^#quWqa+Cp7oca0i8H#@W&!TKhvT$KyYMcVo9m zF5y@Ei?*rg(b0bSzOq9*s&uWQ=s&;I_pIZJAPMsC7mL}_zatHewA{x`sv8q#PT6tx zrvtr(IwuN~`mlx$v$0H+6v#p1Uc-i=>&@qF^QE*p$7w>i=PePKS%sHHfI%$+Z@&yt zpUYj<{!d^~l!sb1kkb zgWkw9Ma$V@T?>)&U+rv(0qbsOuQe>*?cL3(LVdem1a}$p^;LM*UsqZQH~e7l=v+{j z5^iTboEkI5!|^3LzK>t0s(dm}YOftpDxK;$YX4(b*YN~ZF1jyI&`3c1S=A!<9KPl` z#_)5Kaz~$pe)VPVd9|WV^w*knAz~+VS-gmqzm+oNtFQkztQ7s~CokS^e`(GwAphev zG^U{{y0VkwrdQVsIk$D{zvckJ*sBII4Bv z)S}X;txe4{g5R{Fqo`zIWR@sgAg}hOyHVF?Ar|w!TVz&z;>uYCL}!cXDo>v$E+^|? z7V5sQYe#z&L$xhlOg&B#8A1>F+8zN0NmO+JcCl9j$6cz@nH=~xW<6!^+_1=IF!}v% zt5Wp}+eFp=&QRsEisHU4)yl2NA>}uO&5na$kFZC0GUpgSG1x%!-mlVwfx+i5$*EJO z1&c1eefE}BGxkt;s9&4UqWe9R@t0naJy;;X{)2Kn5Cp<}zLR$?WOiG!H)tf+Qp@Uv zfb!^Us!(l-rA7+sMb2&)^nKr|V{-q<>La1Npaq|J>rQ!_=Or-aZSGRl;t!t71B0vl zd+E4yKPVmR*L3U6hHzRgFRYG_Ir<34CDEYUna=QvMU2fo_?2-J`Q_-nZ#%fX+xaX@ zTH~ESfxZzes&$ZcSSGMY_(O_|oXV^hUo4izHTdHO8_T1wMf=@1yB19rbt>6E?Ap#= zsm||(%%O^TD>DSuWrCEdvhxGUUi>iP!P~jFqSd)&69IbE!NEA^ZO>jSM9i#0ezZVE zvTMCu6h=@?q~~`n_^Af@$@JYmZWj5!Fm*X;%FXw8`zOV2Wd?XkR^KNWpn0XE|N3oE zR`b?yqOV*u>!rY$X-!BefAv&Oa5_r}-KMUAmXl_DQxiuKZ9=ojXE~wAcp#h&5188t z+-J!5xP59?^6jSPfvA)}H`LcaxzimGke8iX8YZB18Vs|o{*}8tFC~(|wTG5=cOKVT zvd}W(Y{41Y!ZQ16X2s5QhHPKmF?gyvFXB4+lj6*0Z{}+FSdDj{Ck1P#Z}0YKh&@dy ze#i)(9#D0bS@K&=S{PyPI2d|MoN50lGlBIG?H$s6PzamhJ_O&VD!#v#*K51xm(TGVxY> zqPX&5!OvDryFA6%L@R$~fqqn?%;Vre5P>F^avkJwcS2NT3|iCd#*oD)ppVH59-B0n z)Dv#LFDHfXiT-mi;9X}FKa<9P3Ci~-G%IM>gYkpT+2i)=(T8zF#^r;b9%T63J@xnjBGKW?xer8{I z2An|4nh~}&Pp>y@zW-_eNp`wH4ctPjDz`GAqYP7i^?{fOF*+XU-O?~AI8g7bVUN&L zL|`ZxV^_MI@lpA5&xQKeL;0Lu{yM&@UZz&@?Lj-!EB*7A%d`Iy8Bd7Q| zLo4meY0eDl5y!&qNIAVWz=8p(a+t&o)OcxeJbq+Cs_ zGM|&Wc2z4AFP9(>dNk7aXj_9bh4C{qxd1mmjds}bM0-EO4RX6$8>~I@W~=6&#eWM7 z@#}%wbGEoqn~>t&;ION}2`9)wGm4{fu#068x-e&Mr#zsHx$7>Ked_ja;~-w_ga$YXdR6T)4oh!i^Y;aU|71mE=ePU8 zX^wu}NXYpsj}RJY`OA#S3F;gbZW^4I!}zpt$z5O|7Xqpc4^64xP*gh9SzdyEkis28 z^sfHxaK3P{#G<%%(X_gGj^P-$_31?l_~~W*!$hQvnth+IaOsn3G#Ffz#&`eli8qk% z41eUq*S>~B8UmDh2A3?%&R>p?b;fr@$px-w1^zz&XrA;J6BHU@Uq8_0ewZ%@*^UpE zgC7?T{@b$J%;R%Ud@SV|Odx9WG7CM6DRsJE;vkdLenv|HgC{EevU%&|kh;`^&w<0@n4!vQ8*1TF_W@*3s zng(6!s>OULXGYGga0&^sm(p38e+Woqq#*$pGx1Ij-QYAqF<{aLE4#>N_#vdLE)mjm z@DOUk#Kb2POR8*0Pp``8;t*#`&F>^|!b!=ADX<9bI9oBxc<$5cd<2?23C)(iYk5TT z7Nve}9E*JM@adTLSQtgg+`F$2|1g)bYS?hp-`ZBrmc7T+O8cVW-W3-6^PD6(HL;5f z?AZSnE$o82*{3eeZ5tQ=*-JOyIlkQqTNrrUnL6~=nbhb!(K+*NkQiesZ6m(dqJk@q z9v~8cxnKO*rGzp!rY<{pZdh@K4nSm7UQe|*osnT@B6BihTyy7@r0aIBKeORD=Ysmh z)tL`}@C)>ypX){W;YL>F%KUd7&XzmPC(uL9uTfQcv*co>B+5yXL_lp*pn#Dq*Eh3s zB_H5|X$DUerCn9!6OqAuFHS#W7FO`)H!(Z^TNE^9xpqghyz5L#E`}J|xt~sHOT)Cg zAHQ$YR6~!CYxWpQ{2-VkjUEW| zjQ%N)YIlY)+w_7BXb1!JCp(8<&dto9ykA{XxexaF@LGweQ?LlZQvIEY>q+pxp?JWP z^(R8|pw;s!Nzp3k;S-B`i5coD2pkn@ zNW{k#)C!eZBG~6H=oS4of@iH@dIO*pdW8Jw43D_svy~2<{qGxeHLDrWkT-749uKns z1@!hy=UK7V*XfOyyY6SWL3{EoPQAE0E2b$*ioC9JF27cB1BI07E-PIbP!T>+IfpBV z&aP`V5*7KqNsp0vs~qZyE@*&A2p_Y24&)-}aY}{IdY8il_v1eS!a$zPJAJ=z>3LPA zoLX+);RCiMt*RzoVrSi09~AT z!dnbQQ22r4QbwcFCGxX#&D*+F)ZvHR=EIlgzTzlfQJWkA26!JOz#+f@lIRLOmT#fv zH;}mMisINx+l{yWOMgNZzNw5qh#lhUsvHJb-&OreaBF(-gppkai zVIg(TXm4m)0fpN;+qG`h?)$f@t4bDph`!+{eVWmo!R0G^6?1JxI5cnp?W(Tk-P7E+ zXanH93pP(0^3(dYwdEI@2LyB=Z#?+tws0yp_Ajz-D&%wQ&l2-?7_&R7(o52;JD(`n zTUU)+FWw{G^fyCP1dKbe!+qx=WS5p5zyS&GF^Ynarn+ib708tq-YZ-~+rE7+Bi@*4 zQsa}>l99Ew59vXd7o$I1{fzSsx62wvOLnDG)q~?Z(@z~Y(ocBkZ53Ua@ApGTrMT8O zzq5A5v|z~S%67raz-((0`OQ!pwAzUiZ!s>ZT4LSn0(n#GLhOa#vwmZ!b+R^>ge{1! zcdor4Ko_F(TcZ-iWudYR{~vMh9o1Cyb`2tmBB&r5P^wWB1Sv|Bt`q_3U23G4&>X=LEpdE>uN}dEyPX3zvr(KSCj$yUuWgo+ z-m%_1=x-+Wv~er3e)q`UR*ly-B4;n?uyXvf28d_ZqZKEjM{_g6e) zJ9%7$M>wt%pQ~u4;5oHUd}2aVI_1sy7PwqY^-E(NMA!S9ht`6Ms#!~$UDRRN#TLjwhiVz`fc91jug zFD56R9W!+AYmb&R|7%LN{>AxCpe38~lY3I-S`!Gbp!X+-sH14_3z-rp3|-mvK?jKH z{7=Q3W~)bjzrBteyH8u9zXQo>{g;fNlxLnCT4+I;)O_WSBBv=!lWOs3APBxw%;)&i zkf!74TBVo+WEiNy`Q#Iw-Xe45TEnRW&JCr4r6U#F<8J1T7WRJCC9yGtz9I6hW*L?k za+PX#h;L9mj$${eez2nbdgZ4`|Ht=%l4vKO^S^`uGQ}UKvcEHr?$ya{UC$=nId|6S z$dgBi_Ov1dAYc9_es+jRRTqx{(3H#R{Z01-vy*aRFLz8>zHb~A{T{Xpv!nfWfT-7J z&S1u9y1OPE?7KGvl`v5WXXU)-$v^U&45IkBn&5y69)ICq=w8?I>?ct>*OXkwJWVdy zV@2m@xAN-ne`JVe*sT*&8R&Rniqb%UuZ(=2ua{j+daednS(#;yfPVb>dy*+VXe>u!?#`IwkX?vumuM5Siwl zHi}HD$7zo1_Lr!zpCy{(CyD@&k!!wUY%=SkXKl`FE7NO_wKe#Ou3r_2NKAiiPBfuj z-YIb94nPOEYC+kSy5+FEem~#OG?QXdtGKh0eX>ma{2%C>^=M7vO1-}COM1#Wu?ncv z{{0JUN#3;LoL`vq$YQqLK`cx4b#6Lmiu{b9E5RIu0zwitJ4xLx^BQ&uOt;L^p#%F| zN|HeTg%eN;(cX}VR&KFvG${{AKW_4!YB#KtH~*L@-=mS$TKMSVd%Nnn_80etuc2-{ z$_ma|Y4Fp#vXo^~+H_(-pvU^ZY%ymk2}+Hu{>?hu(1`9?&3%ACK}#!QpU3Y)PQk>^ zqzh6HpST3)4soRmVMLF^jdW^!Ab&pbfQyiCgsHjEycd;_7G5^wB{8B@$a3Ce8NdbN z#@u) z;Z~|p5VdE-{g2yREvZFjT!-vrg#kt!o{s8XEqe0eBJFb%afV?@PU?UNH7UI?b*_-u z$YVm#y|`4QkmOhXS@ze$PZ>M7W6o`yBm0{ea&Vow^^|3+GG?{hRhYpp5Pw;F$K5ni`RpC_okgw4}ZS+sq}|^T^~rF4|cAFpMa*ZG@Tzt^G~= z^hDRvv)r15H!tJA*_A6LTfK1^#fbHU6dWevb}WBJ`qQE%i`W@<1Y~a&qhh^Rq<6x( zKlBf;8Z0a?KQqy~HJ~*Ya+C<)ko)eng8MKUQn2+Ri-Bpu$I{?$Ov@e9iSVFinW2Jm}(rP~>Jo_o19SlNVr^(V4@&%7wR;{u&kb@+oxUV)?f+ zv&!kq)?2=a3>4uD$Uw_U}S{(L+wN7j_63}Qb6 zOAR09n9ePKlC;PCiuxy-F-1h4oRZb`#)f;bws93eFVXl> z+x2Otb?MJ-C(39m=vk*G?j$jPK3bA`@9_NZ=4!5nf?k~JLD6h9xz5TV@aE6hut(Du zJOqc(x~(O+43Rg4+9MC3q+fZv!DwCk8^n)ep~qW>&?j=y(2(#lt2!eNh@V>e&5l(g z^r(%p7%HxsP7FC9Q<FNm*ZP1@vuY>QiI%(L%b46dM?P$f5bxH5M}@v;Q^Y%aC`r>b^W-u$7mgW#!IOC zKuW!|#J>2fLm!rPu25(oTxc{g{BIBA0F%L0)s5j8z%;1)tlMtF!Ow32#emd743oBI zMi)WboRVx~3%TOPp>C@3`9>J>O@V=Zkmt4V4bjg@pF|-y&oTW4oC_qh|87y#D1Ul3 zpW9`)XNSKoT0D4+(gSMXQ5;;|7up^_rM(CU>=Iw!(Ec@RX z+x!;!TMi~fEx@P<$W;o-V|L@0}uDwn)8Rm*}y8xJSQ0tTNaNYg0 z6>Gm-qFwfY-qV~uNFUE@9t)^mawU)-`d4ZY^3`<-uneJobkb|dxeoo~QdFCaoyjer zq^$pde5KYpj{PBEX~9Hg%7}Gfin*@303;a49+&6WPz9rjfc?OJwHDS6ps&bJ${gwi zGYtV4BM^*#&?C{^FZ3Acwl@54n15b46(1cc0{GLphv)i5*NTL)w$I5>68W^dBY?17 zgE20PR5i72XD+B{oLwu2#IW3gGzZ;tw8me;TD*oa=;wx8G+(Zz4}`}1wKDDu_OR9tnv#Q z&mL&#_tg!9A>X&@fv7tOJ z{es-EWIR{I`1zfkC@qCo@v=7EU5_)C=V!=$>Nmgd#D{-DX?v)0ETk*Mj$++N-Aalt z*bGX%_{5M&uTH*1+MG|(l&Z{sD1 zuP2(>RFGB*$clJ=9Tniu3D7$Mv@m0(9I`jrK~6wc*1qK{&s_#58OV=wMgC9P#7iv) zxM}Y?^)$s^T}giJa`PM@HL!XEo_D|}Djz}~*!cr#R`l$P@$*8Mnyg0`OQhrgy8~fr zT_mRJ-<5?1M)$$@n+kLwW1&p))VYb~2CFPs+Q(S(`2rxh3X*hNrV{#HeJmse?3v>z zd)h0he$PkabEXHJ8=lQH~N76gp1{$J~Kf;OkDYKSUUD@s9(;ql;B>Z z)1-=?Z1>rjQj~5I%_jFbnevZ4Nb1nhX)VVg5)dqu_k1LQ#Prlv zQcz9EIcYXf*O#NafW@*YhKsZ-hd_BPDhth7z=B|Sl3h!ponhFJt3Nf)ZMN)^-Bh6g z$C{3(9PKmg!}ygAs+casY-IbT&~F`2mvgIe=l|c z1tYY;7?f;2Ne^WJ6qN)RCvc~wC!;tuRX4!7E@ENo;0xv8R1@IJ(0cu!nE?G-Fte|P zf8hSlJ*^MjZCh(WtY$oxly!y~pl01&sK$+KH?t%mAA7NvAv;()11RRf_{PuN1I$aT z+0@0e^d&z6l3Sk~sh9Dm7KPux{{bq-VzapbZJ!5F`c9vqWkR6a_3KRfcv?n(EzA=r z%;A0sQ1>?KbX)zFAsB=!|W=^ZP#Wx_d>B%nSZyq!5A$|#sxJzN<W50qwe zCB)sQ$947t$tByhSWya~dAnjv*l;9!k8=?5m@Ia{9c}9SnaGcsplk3uyRcNg%XcsO zTle>OwAbPDG#4y6vL?5p*4Lv>9AEzvOb#V?pGgR3m$J9NbgV|bf3$OlC!D6pm0lXr zAYdM_b=GrY^&@&Rt5rk6<4zm2r(;YSLp-e3& zfK#EL-0p0OXo20olD=&_uW#JoQ{54(^8`FQH$!0ErlGgE?-rvp6yj8}YjW&xK2 zKsk1>dt}GtwS1Ua6*YS5f{+jeRQQ$x?wX&*f=4(wW_f-A{$I9e&*AU;jT*wQ{NR3i zn*cfZpJ(j*1lTTSR4EcrvXy0=dZtRn?EuXgyu1eoYQh*pTbu#; zr!}q^&@Vp-TKm4_$;otq>D{RnmKnR_#_tnvzyt7Xe+$Q{yGY9Q^;D-lnZ}|W|L6N| zP}x(Rr7K`JH(I?;DhiDf5I9;PwW&liY~fsDgzDWJ*U75~sJl0~brDC~dk_7eZ>`^! z#Ux7q-7oo%t?!}5sRro6K455ZlQVekZAv0ghkqP)(AT&eJI2~BPuoo1!2OXI{gn`> zk6U}U=6GtWIlFKw{*&+Tk#Z_|fn1uL;68_CaepU&(i0STa&;!V10aFegthCr{{q^V zE2jc%kNE>!9Z*1&ID7Iw5uXSQ>_ZD+wkx(Zfu|+io@4gCvW`TA5*OB>+i#d}#NU`w zxnBfKFg4c2Fs*-X(yRX;xXYFTo@XapG5PH$N7ENNcmDbIa(tisK4m8($MhmJRetzD zA%T(Z_0DlmN%dQkJ_La0Jj$gK8k#zs+KQ9{fXc7ZdlAC0&fVAz^4nBs-^HGKi;?4?p=NAHYVzdN z!|Z2Wf9=dVBDUO@Z^#2x&NXr?4f9hTD=RP#?5+yMd=I?{4XRufaoy^y@0`hZ$YSn8 zA5|Dp#>|A0+!}8`kRw*d+Mxva)rMHC{?lA6;1hv$4`vd#^ZgA`7n`fHYIzC#Gi*3+)`eeTxlNusweMmb5_b^1%Bi8a@J-egUP+Gch^|EoFPPws)u5Y5su8(o;Uv22(7Tldl{Z$mFOlF$nsbAB>|4j!6%gy{!?S@dy$i{2yYm`>)?uulBS$+u9&yZ?z1wFI zYMJ2+$ic%ULJk(zkKK=Do5$$1mP)a%>|1i1v)OP%>59wsCyv^HD!mmRX?f`M0yVd} z>l>R|CysP!-UUoQjYD@a9&-e3Oa+UEwAbNsW04GxpAowa zz>f2k1E@6Tu{^OmUFtExS)qsU&*WdP-lVf}0WlnTd^A81y;HS|#j2?zzxyYqyQ#s3-qyRzo!d1A70d%v4iW&>a$fHZWv7tFM`5a@%9l z{SBF)6!eG_nr69d7tGE@-e2xNx#1SD_*vM#tuU+TnIeNg$zF3Cs^4~Vw8Le zWlzqkNr@wHzciC2BCansbpB_{VBN{DskcRlV5cTRgTJXS{ylvOIoD>wV?THJ=xU7- z9!er1vfQ!*Nx@sY#`0t9jrJ$O9I^O?Sap2R?ACN@AZIASH`!}zs}UCiy)tGq3L6W+ z(1#f)Ng-kT`it zIR$^QX~2%W2E0jtVE7d!_lu#?z=c+~J_XdIJ)WmWvtQP_uOh7t4?`)IG^8+r?kPHa z{qQD>9RtT( zX+e++U*BXP$e-^?ga)*VraN-_sPpTj_XP82X)Vh~?x6>7FH5DyYQt+jkm-ejUefcy z?}9}6+Ur&)4%k+XVL^OD=4T45)n+s>Mbu{6R(0CFSpVXeBUn$kILJ##<*70}UD}=_ zc{krvzR}r=ltsIXR>Q zN2Vk)^XDVM+_()Q;D=lmiloV_*cz4Y!;@!8drK-1SN;JAa?h+YXLl9Vy#!E=Wsbw- zqN&4n&i=)&(Z&6>${sEE@z1`QN@tX^O*qz8#K^9%ULDo-uQUg()wRz>ClTyNrbKpY z{wgGr>fU^Ay7wn^cN<+p%vd$wHZiCiec0eiT>JCO22qfiuT37DPT~ryV_ zLU)%bzFe&Jx&3dNLW(&3N1Bf|_DW_4k3n=k)7#^tt*Cnm$u2cpFc;Hjhz`cQC!X86 z4y(Z<50_i-OWDH~=y4-Ex{i9hx((O`i=L)$3B*=5(u*@xi>1~hJ60h-3al01P4_Cn zUqjB>E>9#nrO~m}`Rro_Ted$1TYtr|K#m6FMtru0muIM>=`O*qNZc?qc*X9&m^vH? z%BUFAnJG%T(mJPvA%6I_zHe}&M8{kCOYtj1@R#7G_F>r(*J*obB+sx^tF#c>5khP> zSUKz=9+^ApJpEEseysnuMBQ&}wr`j$DI zA*g(~kMGghdjeJ3lN8sb?tq>O+n$6EhIO3#3#EVbF*&#p+QCPBS12}IQ+|vtv zH61L>O4)ZnTT;`&bK^%TpXoaJy2O6nd@}IgJSVM~Uwwcza@)V8kuPyj0NEo^FG&tZovcmkNrV%sj$p9h>whUHu`Y7H;v#f>AN+&_TsYf&QcitI~zkqO^?v;<)+R-C49nocAi}y>Z-(I zU4o(wuFg8;u@;l!M-_Zp4tRZawapvS%=2_toyC@1(3WL7Mo|&+5batKcwA5{M7wvS zTtz^e&M^%a@H<3WyR(!|H54*YpCv&23X{K>61XYC}aFPD+#9F>YH!>PVVrh@Aspi}M9# z;P38M*E6$CpKY6#KR3k@yaxk=<-`D~ba}?{;UmvM`#|%N8S9X6OojJ|Xz$ueD;pJ+k4n|@p|Jd4y(%#GB?iJ}@Qj4sQc2TcSJU3% zJ#Ns%L{Zk?LrQxvD^HHi`r8kv?0vkkRgwDxy|%3ogYc3Z&rZu%L40AuBR{7jvtICD zUs@{R*PtMx46Rx#4 zOKP=r_Mi|e+CfneoK6bWxBPR?&&*42A+>;B(~ksm0DnJOne)!{&Wy@xFT1N?(L9X$ zZ8~Z@g;EqBmIN-IcY5%a9|`NVh)M_tD_InI!5Kp{J{3o0(u18rx=@8z{e)LsYzlAA z9HPYO8d%e7R=;;Hy3gg-GUj3-LYJj7&l-O|; zr#=!9x8Chk=)^Z+-WsT4A=v(=Q@3q3i#F20)=?ue5MljX`R}{bGHenEM%Iy_-wULk z*(g!}l=Y2F5Hzrbrt>{{1S(8LxfN6C=N91je8mL6fdcrvt~Z!F4xq2snoq-c@Cmq} z`l66SHx5l~j(eT3k2quvCNIi6-fIm0N-e2RyR@bY1Cgp5|MqHzU>i&4of)x2tW>iIeSKgxO-^0t7vir<( zwJrV_tdj*K(?}5L}4m8;VuoD3awE#hSl4 zztE~pW}}~$p7|f9G@s(T;|t|^>J}#EC&wCCgW8gpqgZpWnQi3#mpvh(Dc?NDAl|?W#Ww%JdMB5hF z{fqW7{j$jc?ODLO%DcQ&bw0H01vbGqro)5A$zcnY#Wx@(s7TqU6T1An@4AANbO`)1 z;jAnSw=<$2Y~d{*zId_aL!gB*;Z9~0YQ_=Gr7&Es-s60$itZWch&5pbUHs(ikDYQT z>3!V?W4K1<$IvX(dg(nWW7>=If$>BsKVQMTQC^yBb@8^WT!}HHR8-oM={|M@{(MhY zz<@P9w_npw@tr~uD!zQeyUWtO?$r`ompQ+7A!8o2j8aCU-)59uBpklzu97Vj?7NMS zcPr!vD=`R?n%5PUCxHca4TkW^^jTBJ{e)Q%|Hpa%8LXrnf6P-+L4SC6*5&kRM8Q8O zmLqspj&Wa|zg3>+gN9Y2@{8BKwUb9Q)!`q>nv9^|$3lK(aAi0!kSY8Fj%Ivr1~-V^ z)$;N(a-ittdc+?UvhkwsV4i;}o&F#$Z&|H`4#a`@05<;h;k-OlCgw1!?3*qNyS!-e zZ@s65-dHhR&lOZ}@e{+gwR%n%s->9MK(}CZNoJU7=7b66u%)cr_$KUdhsX(SR!1_% z6ZZ{0h^$al#iy)rBKiQVw5Ljh-h^!oy1OoZ#@ovW2ECz^^FFcRgONd9z6 z%Ubz%F!$}7yO?pG9m@qe@Qj1DR8wDLUuQYO|M=y8Py_Ro*7PLa<}#2b&csGzJ9W*C z_Npsn&lHb6C@J={y01?=*a-C}(8J9ss}W!&$o;RxFRrC?U2xW==d`+E`oHy4XmKC{ z#BZ%m2!4k~vG;%1)t|uJkVCFlW94nxg?YVj+7k&j1-|GB=TJE?nk^@lvN!cB->DZ4)?SlwV> zQ-e>HAdzC1u)42&w$|eH+E$by%&BKDji?szs-GJx%8@*6Avin|n5l;B&$4am(?WXR zXWoMi&uo*1WY>P~V5fr}$T)F&PfaOlK|=C+?i=iXHsTNewGo#psyZAoddUtWrcPqc zfEofyOWcnxCbxVt@L0+ai!*+^I>MJzRA%)l8=>GXlweY}H(sIOtUTt|KfBvqTTy4K z(r$+^F65d2Txc#INJW(sbiJ&CVM|d^Rw{gvC4pY|*D_o5u)vQNV;1&cqGp4+q)u6E zpBZGY#Kwo9jVc?!_b3qzhe6K>Rl}fy7uw+&ptMkuSg5L z8*BjkUw01&UJ*u>bK$;`1=oC}IW6$^FsdgEdjE;{85Mw|FwQS8V8JO|Uf^)xh)P!V zKlkzKP*h#>+`u=$B%U8D4zpP@m?93C~Y+S@6$>?R};HxgMm|2ow;dEH_j;4Qh?1D__EVRhy8p; zdj|NcqxY}XRCksCZyg$f6apBsU6@)Ti!>3>gl7O4=i+7p!*DGp_(Uy*r7t8_1iumkb*N?QpzZS=PN9bq|uV~DD-n?t91|9dn;$d zi8u#6`dVObUds?_nqAD8-Rj&FTz=b>Y}Q1)QdR=1zbR}V;B2BvUw>0?P}+d zA!*|6e@u7n{HPB@bK(MJgMlrN(k^B{la@JOM0qy87yL}43XHAGSe*WhkNr|nL;rSS z{@wkp-pM2Z4x~hx|J$1)E%#mJbAu38a(iN5o|LUdVu6RI0|zUC6;77#*G~V*F}g1M zG`Y%zZnz?xQKhqrKS`S3$Z!BL5i-n4-qgIHXA#w<0$=~R*dVGcKs^(X=bc$^U1n0V z)gT*@s++q?=jiG%IuzqeNm`tY)Xs7!Diiyi1irQk%{=*am#E(Zm2AmkrU_H?HvLr{ zLv~dUhcuJHe|M`yepN4~)I}qS)URWqeVe_$sOV^g*JcnL1gC;27!B6|D`E1M+yeU+ z58=qqiik+fG^knT(Ltym{sx;u?a5A{c3PU;9X-5$nCI)RWFqUbOnN@~tG|?cU6>PU zw~4YCyc@D4w;%;^Q1YQz@DnnSVPA-4#IOB!)4aBJO%BfYp_Z+bIC~}+UqwE{ z4F(rRj`XVGxqxX`P=aE70*Pf6J zQWhVChvOMxclA6GvqR!6UnjCQ?jP4GLwmOijhdqA3_%kWVMZRFTW-tp6U>uG00VSg;06->e#PpDk07(QrV%yTWx@qMkNePGB=tfOxc`&x@pZmZ*J#c;rJaIY_V20eVa=j6eC9gTIAJ3pPmjF|e zw*J#5VN+uSg({b%$VY4VpvkVoS}Z|0ocBg_7Ls?zQhRoUm8qhLWP04_By0SnEGkvr zefh{x++}GJgdP@nZh<~O+E;7wW|;2}oi&^h=I2EeG-<`12Q?9p#1hhz3bRj(sIpEa zgkdzlQuO=2r{#ndB z#$f|cnp+%2{5gijrRnjO#5CSljvn<>{IrhIud`6lEYzN3&>Os)99Rjb2yA$+s#wG8 zO)m>86a#mCR z=X(*3_w%w)Y;8(4Ej)75mU62{xGb=d%4!(nSF>Pu!;8%<_JMqxO6OvL673+g&ZD?N zpGwEW<7}!TpYRAl#fH%!WjQ@*QoNlpuV{M$VY`5{%uT;5qJ}!I_7H3?W%#_JPSePs3q>Besd2D=vm{KdhCzs8bhwI3< zo4n-=;M6pAXg=eGQkx;|4$B8Sr(yz zl<9zC@k7>$ko@IUD5Wss1iFqk-$M0F`>AeCx+nj2FJ6K{V-c;Z<%p#gG~#fzI#*v4 z(YD&UX{k|F<*k80FSSB|uhqH2#}~dR0TSnuaSg2%JSx9Hc}GZ6bof=SNE{j^ez;hZ zR2Whs{e`Q_yEVx|AVR}MgQCzJ^0tGbIvsbhW|e_9qQ_4h(R38tGj=mdAF-3perSdE z$c#Q8E%E-Xu|{vFkVbETkmjHLt$X6u&zwVC#zYeu$gqTlb#-ZZG-by2)_ZF8KWz;8 zJ5XsCA@pX-`+Dw={GOYjYiwCZRzFGa5Yl#kdKd~c89LMV3N(qO-%BJkT+GQIb%53< zCVZd=9~!#cl!QHX4gg{keJnx9o*21s#FaunO|0WbQ|xMEOw=U`DUUM^Y-k4&^$v$4 ztL9Jd;F=Z2eg94k6Pp!Puis-Tnik!ti_J_zlv@If-YdU!FJIflWviJKqBxS5PwHvpGPH^d^-AgYDQdI4&2~|xWH9QTu zbo%(j!%sIPv0(eH2q4kNi6nomN9^!V2FO==HU>lRmEVzRjuV9xzw}&~_sX{B1+4;P zO#r5=utBc`mAAee@%7d} zu}!|oVWUrUYnqUNW+d)`ajOS>5b;Oc<5)Hy=SMU)@OUM--|F%fIAkYmSO zG47OX)({YRpw_DEn^l3&m`h(p+Wk#D@I4%+DO;5!reJzsxO`MzDDmvjG?RG&)1j8Ml05V!5~Jqp)wcdpa^Y52}Ljm}B4hbO$4)`&{? z1Xzg&Wh-9w&)}^|>8)O7T@M-Pz{`)mME$;AlDEGg(jfR zZ5YY(%hH}6+F~TE+b{qHt(ro}164$G_nVIf(Z)}7b3A$)1vTiH+47&vA!YANA-e3+ zSD-OP9)$Gk&f=sdeo)p?5+nQ)&AAq%0UewKOGH<{3o^I6*BgMTa6TGR#=4IUJUkX2 zpys8xS~!L6QH01Qw~5xi-s$>q0WeCaK1R(Ko+jg7kV^1%B6+)gE&lU&0zq zSj)J!nuZb;2c;BO#i4?s1WtuK7>IU-*cEfn6GLCJbCeV}wokK4sHu%v93wp3zaDX& zZ$)a*7g}-r@TS7E{@8ZKK;bB{uXPwVNWVMu?vU6G9jJ3fkozCa?xb7r*nQ+*v8Xk4 z;w2kao4nCNUfxC>Xc!x>v3jXRZ>Z_{0!7}ds`-Z4mlO41~HOy@B^dPsMLMET~JT_HRju+NES%Kc+n zn^}2-OC}`AwVSp+y`<^W2Y=9lly9ryGqO(4YfECl*Xh6^v=MFUf-9bebIz0!;EDH8Q1jn~=((drfC#;fDqbs!w`2z(zBi8vIc}6K7 z(@YU@mtD!s05Wvq!R33@)fG5YBsAsvr%A9@o9*$#G$aPeSiByq>E;GO?o|A}5w}xk3leaP`1sRz%36WxwG}DpzB)h52P9W|^RO?Cevfjmcj$8g7GI2> z6&K{X1p=g!&;!Q|hq_!pA2Q-O?Yz-_C){zm1jc#z<9o#2R`y%s!Jl0_2cd9AoLz69 zzT*Vh(JRx&cojB`Y~K(CcC_(R0_&)~J~ z@Ax;jE`pt}daRAqJ@2fwgi5Csx#{M4T#uC;ytS@jbAQ`aKjdYc9ort>h!)OhTpXqF zj;IBSU<}1i6w-^MjFu-v?@2AR=~DdwAVl?Kd=~XvQ`1SAdZ9YxgLg?={rI}9eV_g= z4fkp?76#BYA8 zvzIrPSm4{N+E9Lltp8X?qQE;lZNK`g)0S)UJ$IdEQ)P2nUEE#JLDhkotGY^Weyf%M zKrO);>J)fY??17<1Re~$T)kGg#(S$k;ayjCt!6!;=!lVtCVyB;m)6t9a!5f{Kk(L0 zy;X;S4`F0EKPhW0e3?~*hKlM#K0pkiIn)X8ZA0DCA2lBm683F$4vTJ74y&dBhH9;z(vQ z%Y8$rV=WeIgP(zw3{?R|JO>esExvf8J^sve%QA8jn+^h6Ks^m-WVy`#G`Q4r4S)G3^pGD%nX|(Tq7;rR*Q^%^DN-)k&Jf zdsJ-K31}dyTTeiW6_R($=0aiF z=f5S>g{aIWb0E!eX@E9i(kd#9Sx>G)f>rQ14t`tN6gr#33^A-ZNbobK`)KfG}G^{Yl zP?#qOJE78mE_TGBSihH#UZm{4D=c%w`gWd=M{Y1!Tm&y$B1QT7R*@218lcw{l@Yx6 zP@Uf1ebBaGIPbZJhpbk#x-5KkFB+aMkY04WUc%-P^K1+xBrFovi3uEa=8ZOM*WfY) zHkwN<42ti%#ui&*W!D&QD-u_8T%>Ot&3sIFi^kN4CZs96M`z)#RL6dBgU48&l@2Md z=~5o6Vv!7SP?{B5dAU*ixPJCwbMTi*Bj|-1{+Gq-iI=at0=R55g>FU!7vJ`c9=x$r zw7LPMYFQ*k)S=tM&c`{>fhStuyz4U-kVc9Xt>S?YBn=aCZIvh>&0HuA=0;P#u38ql z(_@WqHF@6Oxa<&rc6=>hgqsv3DdqvO(w{AFp9L_gxDRw-i-NG1p6D}5V z<0`;EJvEGs%Tg+rbl$jFbQZ^t-U?byuLl+*y4U}r?3^$EFgvQ}AO5F@4=g!=@KX7; zn$lB)|M`{w%g^!&hGzsH3T$=no!HAAlOWP5tpO?%)pLL5pI-Y_-FrbZZ*Tn{qV+^u z{}b4jf^NbVCf8WOyj?vGoA6zQy{8~!Kw9Y~u(v5PWy^S49EaX-k=*+wCgQdHX1F>1 zLW~54^HqEE=3xE&QoWpn*~du-0Cm&sU6T(;^I!i79Ylo+_oFFrlj@M{Ou4{u`zC=< zd7DD9RG#Vm;o2owcCcUabEtHuRBSR`A63&4+iz*8Xg*JtI%ra)vBl-r7wL73Jxdy#`Nt=*uM~ z#6bo^C@EQh8w1iX0}I+zQNIHJ6I`fxj|5jW_^I-VG=%c9NvTA7c-&#C8cqo}>G>7i zN$lNP3voqq1>UMVzJ>^~-pxii9>$bPh@?x5xyEFo$Bu&5&uz^}gg$(W>3=TJbjNg! zL~p!GB=Gd5srR=!04U-kn?i~4TLUPv)>aK3>N=)FTawv0JSiT4vIw!B^$IlCEDv1S zt;~l#!c!S{lMt{@}2vWKRm>s(<3^I|(%9iDbzS#ymkaXV>*c=5w&fG<30;tE?_d z0U#PK?hu9L4}IG`%~HsB_GInNc!%xO38)Yz_}TiEHzU%$cZ5P-Ldukt2w$#qZd;z6 zl|S4?=+XvsUQsZn^&r~Ofdfu{nYGpuknEcJ^s)2&;rk1NsD&?=Uyvx86czlOI~RUn z$@6q<&V9M9s9HgK;U01y;HgRXii(7{+;R7XCp$jYhrR=+_a)rC$>ww z{DO`wN(YRIU4gBK4%omk?iyd*MYDA>o>j&QIqtP@iMQTpb3g7BeV~Snx1|SE(TDLS zEnBZXpiD=^Mezr8V8Dk-Q()SJwj1_e-GE};T-SF`+X-A-7A_B&VHJ7#%SZZ((p!{8 z*?Y$zxPoe7(piDMeSWTVfk={?rgZR0l#7`{*V)+Zm> zTk9e@X~hv57G$jWP6+#--@f}L=GCOYIwdsA)(Bo2$`Ao#IBPO7@Y@}VR$wi{% zIDffUJHMTh3Wbc3%vp;oUgjlT4clA0Bb>k54zG7}H@t{65*yeMW z+ag=}(KKb?+j3RPqX4miccEJ@)!P7O?+1$$9Rk>GlFt+oPK`^Y|qQ`XM zT>!U7+Pv_|m?%1_Ljn8c0sB9wNDx@keBdG1xHIO9-}Ud%&&zW?s#4tJU2v%XSaWu$ zCYVw_@31^^cfztT*dA}}ciqeEbhth=fYII;tt&3R`%IqhM&IesiQ`gG1<>7)U&p?Y z)4}woSK;TjbqJkp=SUfhVm6P&JOEcYwS85lJ z=@Z^Ci!3-@sf&vl^#GKhmLz9Yj`wz0-Z@Pmk3eQuQh{|^+YAv;p@dc0|M=cjyVNP} z+x4f`3I52tJ3yo~#A;%j&Gj&^&VIXA*$GR($`hwwd0YdkT&2C-Cu*IIuYkV;Aut3icMS+FS5?ULMGHd?->=vBbf9aO zfR5K1fybe`=5`^n?{~79%RqLWqaCATOPWsjYcP(~k>)nw=?w$E*ExzChSD|TU!zAY z03M?R($K~1nRZ-*$D|gH66|+kZ3-p%ngbZpZHvkVGEUhJ^g#|`;hX1WU-HB=&Frhb zH(eDmrFJ7Dh5i&vEK>`FiBeYal+HkkIg_}#_zLh6uwgfqz#xSmnATvK8)oxoGiChX z7FuK<3;#zP#;-VhC)`%5|7=fGP5>%N{RaTlEP>pE5(qhV)U#_CC$1 zlbH=_s<3547+49OX<0_=4UeJI1WB7(8iYA4Ga#s|(d9o3t4eq3n(2hf^KYBde5NC| z>FO5G8APMrm4D_nl0edd^>J89gS5={zKIz3o$6_=}>No2cKdzl91(?c(5NFI|MK8IJMa znv$yRbL-c{1^ZxDA{ku+Lu!Rq^)b~}(-yw+fFQ!gNOjoj@?c}bEW<~Y+@CNgR$TlU zeqh%ih5v7i8!^7HKMw_RmW@#x+!Z4*fDc`GgO*|YsW+}#h)8JfO}qB=vbY+zVd}2) zJwO3S_~RWpmy5c>-U}7|28I0}`!Moy@YE&Ea^G}1lf#TKH{Spw3ZAA@4pM&e_(WOpsR@ePIHp;?Af?sz80-O)?G2gy2yqYLJr*Bm({9CAq+C4LHLG^)7isW>ob7NSq7Lasui=F z2VicQ(7FdD%D2r`lp8+0Y#}|T-Dv&9C-c#qyt|j&{iB5b*I$4B)w*FZtSG2MQ1l&& z*Nz^1j09e|=gSh6WL)+xlwyG^^56jNEXRKt4f<#}uj1&o`Mfn<~<|f-(WB%A6dUYzo=qb}0u^4q26t zv|zrJ;ZTCCztNemMH4gPY|W&*rbgv=>FD`>i&}O7Qkq7$2k;NU#$QST6HTAhX3&Mg z>W6$lLCb&s?B*NMf?_Jn5_zvTB+&!HL-xhTBNtk0Y%WFZxd6Ic&jX)T^UzQW`Iu{- z3kVxOqnI8@Z%d)UIWx*(a&$P{u|uWJuUS!E#=Uh zW8~35dD3T%azP;RegpuaE6~h*xpdZM&Im?0``$RPHv@{taK;v+s-^QzWtCpa#o9nv zMzE{TSJ2TOB*^SQaff+-dg@*lJL=Eyh{x4}bkizU7cbWDN;(5s3(_YV$@Uq?VhPXM zE%~E~-^{j$re!^WW{<}{d@xl5k2A;2VaKkyPVeB1*Q;?t6BVf6`xfsrti$8X$ycI| zHENsX87+XeLnBPfuREid6t+z<6|=hE23x#Z=dM=dLyPh(EXqZ-&x`=zpiz#`-XKkU zkixtD?28hbGtUK_NWrQLg@Jj&hc*h;97Xeu{RPleY~4@@p$-6m$NF7-7=~}>5etR< z2eyU7i|=~O9yei+E6z|o*#S_AAr3yvt@|F6w-!ADDt2l#joWT&=`+%1+b)<|w$FC^ zMj!k{azPq`TNp0LBtOsHD<}H3;CmKWeUavc!Wlv*#|;&FnUq46ihhrZ+3mdon=A5c z2S1PihdQve4FnKZwqsNSsxy}O4PKLU=wnRZKMEcP#@Z9f+u@00J95Dn6yR=mfe(1a z|1YSg{}5B96O4HfvakH@A}&j;yLWic^$#IS&7pWiAUNrERA9yjId;BGtpqo=0t4Z3IkO`BH!4Ay&?U!A?w=Y>BF?Q)`>s9Cl2BTxxx-`|79s&yv`yc!A<;3?VnlA$Y66jn5d3 z=7O!Q=NSPV-@AG>(=ADVddWkDc1-DYg8rEkQ#_>5{_oHFwal(ig#{Vd(hg!r0XfVs zK&de_FBwAHjRB$rqsJ{Gvkn4c`t#))>6Q-;t~)g*b&Db5fp7{lY4oP(xIhPJ|IdCa zBrrNqk*H)6<$r7LyQ7-=)@@OLD1s=8fP#RrB1n-gRRe;BDj-M*5kY$B0qKf>bWo)C z-Xx(VbYcUPBGM8_2$3Q^AT0qxc{_N{d1t&g?j84>SO42=vRBq#Wv;Kx`2_)s9KEPD zzLs{Sg_=J*Xp=vS=#=1uRCHhZ?r;A&JTV-l;G`A?KiW&@(#-v_Vzsiq7 zmG8TszG!r7k&Uw-{w+b3cyD}Cq? z%v-IOn(eqIi>#fHHLhMC|4>~F(X?{CqGVR;lUSbE^+o@}U!Nyvku|r`Qr#W4P*JQ) zw+@lH8?aH5oJO3dWz_Kx=tlvO4qy#t;;Uv%twrXHJnUN%`_W!Rw|Nvm`T5Rw<5_@x z#de3c;BpLLLNZeu-YWVct2P8Ua;7Xtr_pa%7@NE9_#zqT8j3;TpMYNVCr}aq<1AR}DvYJN)s!cuY#R8v=i@w%wS{I9d zzQNfTBN#W{c|7&YAwiSn%f9jbM|35_8)0(G&t#06UB%XPkYEJ6n@rCGvA3Xe+OjRhHoXy zuO?>jz(xe*4=^c1fY30PurS7OV^AXm3CrKu=8#lky)Hbt=Cc@4PHi?n5f!nK1Bc#r zLkAbn7=cPY>4hXloagFDEm{;0(4RIiIV+F+*z)LyYY6(F_S~7=O<^5((Ir8w;02E+ z;qi6TJEOrEq`avH>8auKxn%SXA@s7{ylx7%W1yD#ujnlOHv-&b-q_p=eH6`*0%9yO zl3M0peBN-mG>|LCkjVj(T6>_YOxYAh9EjG|aLG>~E zIc`YfWM{xxvR8V=YRc7FPo3z$d2M?RO)Zxwz|XZ!17wWnjw4=4%FY=*)I3_jrwF8f zVbA^jWp--My||}%SHtXjhvSKC+j2QV0QLs;3}tJT zXzG@0Hz!;u!Qp&=ln*`kr52rG>~T!?j4dB4Cy-D-S9>xeD=73}0?Ee1f16{fHuy`M zxb0FV7xYzXJN90vbcVr?Q@I>gsQB-*<2+Yn{d`uEO=FV3yuA7rr8XdrSfE zk?+JOMT&}M{hiXgYZPbSz$&hsfpg$bijl#u41>cm$4|uIj6Rl*>+1d{N$w6YanV^1 zj%`6skS*1MaXb_h`D+RPcMBK8HM<6gM(caiW76VHVleLejDWu4Gg*8{D>`r z?Ju^xr^dSdMgt9r0?UAHYH7&gDrzijZ*-;+UR;Mqe@6>y9u%88T2N?#`s<2!9pr0GHpKKmwW7&y>oLubw5B`>2;P%*MsYVU>26ZZ-rAjpVJI( zU(ezguN4;7s(&%jc^YgspD1K|ENu6R$MIcd9A<44edZ>nnEYH9@V#4wTjs&^nqs|J z8K)W&%06?u{kWydK*tlZCJ{51Q_g36WT#yNG-k|SSd#D|ltWSc?D>bQr&)4;b2^w< zwwL9@m!|90!c0vc5`AVaa`Gh}^QfFHYeHHjId+DbsyRm9^;lrNhB2Djo-SF3n}i=U zvB%!_dOwt`!3nGB|6+VD`cr4t!|5#1;QR~&a&O^OFRUQuUVE0QX89f2V+C2NOxZRi z0Q>H0o3M&uU6^^9%Za2;Zm>G@#FyeH1|KIgz(&Tifuw@yC6sA^!*}7=REc8JLDM>&LXPpJ2lU?cAM1Do z0{;;jDG@w`)X}dzx2SpG(jeDYPcD0y?#G;|WoIJ!L{{c8c7wz#S>s2DRk@$cM0t0m z5ihF%rUchmla%wY*kj(2jG?{fThxG2ZtzI014$NX$ujJU^oQuP%*se_Zmt2TsQODW z=4ep~+(`E~=Y@wX;RoMBRAs$OD1-z8iU)jJWkBXZjwr4|7Rzxe)8KUeLcOgoE6APj zxwxUB1brEOohiG$w3s9Jf@VlI?0HlS>j$j~`Kk~O%_ML8TSHU;R;8QiXnEOHGLqb!s88eJajHQo zYGA)Q{BCfWO`S6fI8}47_@|LYNv`RVQF^18mhcnO6I&>c@-O2Yl-^{+fNf^Wa3|OB zFcNDU6&92{k1T-C)sehy1I22Ja}&Jx;S@}BS8NvO-%lfomf zAyW%i^>1fwo3*!fSGW3=DkhqW5Ll^0UsDRFR`A~dhhF-c_w`qVwrus=x69=``TdCl z1Cz>8-DbpJ9Jz`7d}4$}1IN)st1>kk&}0X##QCpkOPkcUq!GtjbeU?+>p0Adc!lG5 zAj$k*EZ_|<@hO%iyS(7CF-tG`e&H>4rkS%qtgpB+1~wGNDyjSnD7j?=&`r&Zgi4D0 ze%jK|O^fq)q}U~ljX3}U;>pt7J_O%eGmtvzzTvUb4~DM50;crD@ceG!mM5+N98Yr~ z3Q-Q?ReujAp8)Zum#_9Om&QHd8X5(DfeEnIUj0O9S4E?GKRknLGM8ayO;u}JBJ80& zTr{K!w=x{Bpm2nl&G>_L<8CfDGn8}BymUSellLMQVP-+WOnd@kEW54-PZDBv@5Ez7 z3AG|IGPsW`ZCZZ;!X!mAS6r8-?~N=ZXl{9W;R2ZJBQ$x-hj~Ot_O#i4okz@ zb8xx9l=ZITria+IfH@nuZ;cA{h($N;4Yu$fE3YL53^3no^%~!$DJuELvZq;RQOoAv znkp?YEgWT2bX2nxTX-IJ4*MzxPIx&4#EH%jF_|@h&GMU-EAimBNveCT#qC!eg3ncN z&iLCx@TIms-JE0s#dbsk$O|YhcGHNP)R7pKG{?uYmx90GvoLt!N3}x_vwtLWGqbP< zdx5@So~w7ZCSArRNN|Cr#aRug=^ib;XfKe6F^hhf*9k8me4u+LBo6FG=045Z=(X`F zJN^XMBj{sPS!dbZZqKgN#g?6GJaR9T(giv^yQ|7kcF5%8&j^X8_ayxzA0k%)2Af^u zW(QgjhIxjxA-{Fl8%Da?RQV@XQLZK}3aF_xRFRrup@-^;ncr>l#~aGSTEqyt^4+s( zqxK2z%IpWRqk>9?E*)sH7U6K#Rd#LvMx%zDk5w;`i#$v}EZ2uPf>v@9nUtRu`2ysd zTk98tv#(qEJ_T5iFXq(#OWK5gNyzXoeVB^}9N=dVxC)3dDv5vqgsC*d-fXbJVh0lK z(E=!Se}#r}kWRyC&dvf>KCx-eTTw8EH*Bahh$(e7nx_Vzf2a>qpVgDQ+GGdZza^tr zUY08N{#BVapeumKb2D@!h9ZLvt;Knr+N~jRzcm=?zrp-72#@+dQjur>#`PNYXn$9A zG~0W{Lh1Z&ahZMpT~C7*su_D$zRj=Jqu%bE%10mPv8UCxR#1Xlf%^V1cihdHn<w+00CHE?=qc@k(4ipF4E|xGF*f)@lF~7D}$07No@01iE|Lg}e_yi@Ow?8#RtoV15 z5=5ehD@M0{Pb=*@L(4X^aOf%3Jf^2ORCWL7Uk?h}gX6As6T3I3RV9G5=G9e#`0h8q zjc!=iD_xk>MWEg`gd1q9PM`I$rbuvcs~V|7T42&}=X!NLX4DTipvCgd*h}qe6jx(6 z5lH3A^7{{ss5~plkZrO^sHd-pOeN^<_F`g!=Yd9;5TWw9s>Hr31-c11kOkPPS249S!Ly9U=E|N#9BMee>}eG1^gh0_r|bSKaP%%C8hLN>oj`0~{)j-u)K#fG&$Nt13?fo|^XY8z5*Zs7gkPTzovH!Wg_`iD1*uJ9^ zQ$-{ppcC1=#W+z7ey9_0SZ;U6+INvhm4qnP`njXUfu~;B=kV5E{fnb_GjtP_#3uj-KF(zLUkl9r4~+5BI*w1V zT)-;J=3TZ787BSU$W6Em!xXyfjEE5Ka5mmEf!Res34G z=O~6n6D>~piAf@Q&DG%ad#qcKpX`q5H#|Nejq1p~0c3X%kfXg$*3<%$ZwOQzWurRoA{ za}jkG*Qxi)wy#>Vx1JSx6Emjz9tZ;JH~6N`Y8MffvWtl92ZycBlwl=~ECJlpE5VFj za{LY4;y_lj)cC0#@^&QqS^HtVugMHq|L(3YD%m&d`RA7J+~7>#CA_TPjLiOq31L7K z$3vzNR?vE+ zXc8u>EmX)PDj7|1Y@P@L4vx+eZ?WLIb({A?8LUFb|Iv`o195jH3wTpW8K12K>ocm`hYtEko`+1_Hvc>4u_=&0Roh)H{iabf+x;VVXLCv-_3ph9M1mRmoN+vJ&iwK_^(~30lJCi_HNzA zKigQZ9Kz@W00En6f`iG}W^X-0H{*CJeQ6IJY_i}tgEQc5qj1-=vEgP-7-Kn^7GsQ} z%S?@BoK21xrvbD-09-tZDGXE@1j{(-vYgLdWe4=Qa!QPGVJdd~m&~!heb~qq6f7tL zfX^+N@pjhg#vG8k+#TYeE@8fi@;R%KVW$bdv4;%Sl_Gq>93_B{=~0}!v1fg%(#~PH?Do?!FE%_ZOk}+1Kz%= zq(4hu=wb*mul?9L%N9t(i1hKSC(X4km5-&X#NhQ0|A6$fd_Bb4U>oxkO2jy2&!oC- zn?^uW(Y|{y_>!ufy$%F*`tPv%Uog2egX0*+Leui_k{0=BWZ%>`#u>~&w0%`BQ^BLJ z3Z@`+QGvP8g5~o?b2cg6==G`ULTm8dmIgjBqudPpSvENV?KC;S%F57W7>T!T3R&@& zb6lv-<57HyIx)5S-Sa-<1KbEG%iv+z!qThK~{fPFBNtZJ;#H*X93&`Zg;4JuPD$AjE$}U)cWwf_%&7#aIjweuJ zIxCReWrh|{uRtsbL4ScK;Ud!{#80l%W1 z)t!8^ykwS@oAoSYNuCVa$API95$9C9POsDgqHd}KY`d3HAnCi}_D`v)wLDZ|BEMvF ztKS+0*1f^Z*Zn)CtP7wxU3LH2a#ee$D#LmjnnY=^oJLl6B1gSY-t;oTE>aS#k~sQ& z(xQ=kP2c5c>{(#BC>sE_C;09GGhLR)zCTs?1gM$bN;3YVTc4+X2?cAJHp$o?wUgPI z=Pnw}s{0*Ozd9aCU9b7o2q5(C696%)mLQ%Pk_-g&Z{FOv=|0;UtFS=Nu^FvAa2Le| z9;FYedJR#3C8@|ZE(YX(2J$paGxY$5OI^ulLdpe8zaMcpQryUqEoMyAF_T7ULllDJ z4#cNv_fJh&(@HeEE31tu&rgONm4iVW8K{U_3S1H8Q(4>EUKJdAHfTCN(@f0+=x@3( zde!GjyR+!1;C6tJ@FKJ1e=;e33|V^TZOEI1nC>$&zU7q60x`n?7X4fGD{a%B^$hbA zT4)Z~r?QT9loFX=Gip7l2jUZxy|BCS{A#(g_JcosLr!UypPTC|0KU+8bmQ4;OJFwo z_jh?da7d3nggEauT^PPB;&CzXW^;Q;9OAV=1+;LWBL_7#D6JaYWmb>(`<({xGv|^D zaK>_CweKOj2>`v6j9H%%$;vMjaoMoAyzkxIvSA=%ng9@(5*yvw%AznW50}x1b^$Cv z{hD|R82#k)NySCA+iIO#AoYQVE0bwh>G|U-ajAusmkHETWgAD4@WW*=f0}X0qUnAQ zJqrJ3OR57EFoL|rSdT3F%U@9^l@IXd0$7e;D4jPt1IA=ESxujCFd4S+>7P>Ua$njZ z_-&K01h|0jhP^$9;{K77v2P^-+Q`}C(d>Y`a2f8?vNqVfTl<7@6l@Cpuh~=ou`LD! zz}E!iR4ISF&Rc&oB>af7LhVH_2UAt z^#Hq+@JI&vPsc%+Q$$}525{b)4A}2mWam?)2@(3A+X#XJGd9>Pr=XxJ_ow{Lp$RuBf}`60Yv!C8}zs ztnz8HM;0kSo;0VZK$t!;+kdh0+5_#UOL_cXyv*-H7DIWJzOBtEU-0)iiCAZJE!*uR z_+a=ERV^{q3Ng6(Yq*zGFd#XU4fh?D1vu}-Zqp>pNc1~EL&;f|ktN%l{Er@p2d@b_ zJpDW;iumjXx&*|JbgC^bJ;1*Q230orORb6(ki%2_jz!e5vn?aM(uVRc+W{h&r=j5} z`KLfWFWLOnoZIWT&$>n0y0da^hvT2mL$BZ}FcVE6gWPpm@Rm$8^_vawB`s{vY}jXR;LIC`YPjI@>}V9Cg_@k}U{R!r z?=>&_7#~kJuafi5XcNC{Uc^jXT}({GHv3*@x{ zRzS*^LrY%iwevyu((AcHqF!BbolLPZv10>O>Pu;NTVii4M+5zv&y zl%nH5C&;F|+id#5NaqU^mu-H}j)MaM= z#4Bx;8P=A6+3eAFTu7e;##pO6VacGJSs2Gj!zQtUmPtJD$RJ{(sTPn*NG%Gq0kW_O zZ{>fhyEWIRX^$`BiAh+0Fi|Bmb>sUgKg7IHOqcl>pO6lAc=Qt|zw?So-bB;ydUip8 zkhH~+Y@qVa=eWEfjDAfi;f^^@syvJv*6S-qFB zluf-s!Rsnkt>5c#Z|(+Ql+#(6?JH+~Q0zWzq=PQGE|kt9h;^R+npdac4R|2Vc^}fg zs5Wso_vf2boK1d7{Z{)7Szp$rc&PTJHLyiuTA^%>(Lyx zK0KZ6Ih@EU2gpoLi}?v%4g5G1nOuZz%>cz zPaA*;?~obv)6>sIm&uy9F94a=HqZ7xlhd^)n(^|{7)r4bxIIo`QRr4{nrAH*FCWh- ze&tAZ`idaML0lJKpmgZ=60-wHm}NCq*k{WAw+_w!bJX_# zS1lXr?-wv)vN{D6S!y^94)8Eg1%`)d=EZ-i+WNP&Sb$};jU{Xr;&HFF9GCKJ^X7Br zPnnnbu`fz}IhQUmsHE!aWF=6Q>VS$z8b4=WU5`J2ww_5BEp(#T8Q^^m{}OIcZP0Ci zjVS{&iAMob&q}cx+X)M&JP>d5z2wU;P>E{fR5#QstIL$KirRDy-Lx&5&zsMmAIvzP z8}z7^B5FC6D!2#TtJxG1{L>c0s$m71x?9D3>9NbjwXkNDF`4el z+8rpl-T-TG9`j&ga`6`y4?bV?I~Ac}$^Xf2#>@+u*2Wv$ueV$0%*1qB0N63X`1ewz zYlXed^BOlGDgU3{HXnQ)=iY<0F!!FIyccW!U3fMSZ(uk7%&mX7z3b>e=H;g9p7*^do60#G-Q9O2}*Crs`RV(Mwyx;-#qODKeLNxcE z-r*Ep=T^9ClBDSh@e{pGSnMXX2EkuWH>(*L9Cp9B>iA;#vEuOdj;a-`D9-vgFFas( z^`%|^>R`q^j`Wn8Sn1yV1zohT1!8`?Ymi6`qz?iiP%mC5PHfp6G;MJa=+<1e_Lko&YkKVJiu}CDL|GH2UXa-l6 zS-hv)Euq{mtJb#azkE`P1SL(_n-54~OEX0<@ExjZnhg7)DN2=3byY+EKx|VM$K5`F z4075lYh${2PC2gT#0`B$F_*ij^J;f1PK^r|MTC`}bMmcMru9Vy(j+X>g6^&lD=yRc z&FM?lup!}Z(VE!QH-SnO#Mej_37#coU0dQa zoB5_Sc40Bmgj+d1IUJ|AkChPY=_l0kFs$yKL@)2oyL~pD>hA&~C6g&i+cc98XXMjs zoVES2v&!Drq=VPe>uh~uvgFF_Ptkq7?aFI+f@YOg5K6&9Ytpe<5rX}grJ8FFL?=^P zfJILpTm}+LnBaO+qiyi92HK9MD8o^MP4m?oR1bJi2SG!t|GRGYmbPW#XL_U2o06IP z3)4@RoPX3K*!?jGisFK&w(-2Yv_)dVz!0tTzQe)*x^D`;j6oA)(mEEK@8Q`wf3+N7 zda=fOB{<)dFBe`CgYb8C`2OfV#`oieL7%v)a63Mgn7!XaHR)+LG@X=W-Nkop?3?1M zoZJX4$c)r*!M)|~B3Z{71iqH$NL*eLBt&#gu1WD(M@%2Oj~P*6<9sGjemhVi?AQSM zDt}%?nBc<^|F^=ywh;sHrIFIiufr{%#?ky|YSqK0WG8D4uap+T5ZcFq(A9HMQF}g= zyE>=oWBTmbwU}6T`F=EXk-4y;;|e`M*S)Bu#8zv|F(s_edHA^Xj&LY0u#T=i1~NJ7 zdSqeuW36K@3kpF0ZWkZZk%6G4x)QImSYXmflgp=6H zVLy<17*m)-eq?>0_Xzxa-@uI!ekh7QRKJm$UU{mSTwSycVkP*Woccg7c4lq@Iu~YkpD4`WDx{F>M@}AnkOo!7161v71?p zB|w)rQ3{@D9+sAE@9#>>pS~Ex3iBxq2TmI0qGqy9Jfpr zfTYOxjyllf3}sRp&GnuaNmIKq3l6h222E>Q6+BN`_|L@X(zfDx#5$%#Ko;=JutH1G zcYO;MnZtybqvYzP4X4I(LC5yDutGlN0hH$g3>swI) zG8Y44c3)A^Dw@O=aZW<im@Zs>pFceHR>zczkrsBs%f9kkGiF z@2==)7oSy1ttjto4E0S1-|HW`igKKI$l_Y2QtDGInTwBBRJpJ4T3Dj=#SFr`{rNVa z(>5|A*{R*tzf<;@sNlF4Kub+|&PiiudQpIU0=`>1YqD7LzJlYF$M3d_5H9^+xlZ0B1msK(@l0`tnI_(V-5{@cM zTkz7T!uusVyNSrUi*OPZhTWvqz^R@AZw=v<^G~OENT_1_+Q70PBYdNQXId#J)w6JQ!zjh^nJ*a#3DgB0 z1#JKTW>>+V7fsODY18ADInO^{Xw(~j5n{SFe3**%JYVlKL&}xRs3D{97{(y%Kd-5AS!FH;n3vr^BX}Rs}#IkWkl;EMHg5-$kUno zVsLTCPaR_41^2+){-v_W3XZ30(NYBu<~0o0f0Mlg!pmX3>uct0ltFWYo`<5LJ?a=> z3Ymg023xsAaYxMGXy%*F3M~i}_a6HgIG6A#G}E!5=$YMELn%M2&_|$BniVu~uOtUDT>HMmU&xhm@jQ5@7g0%&RmKQO1M2%t@7&S5OhK$B(&Qm z<51yqiu3%5sy}0JSS@VkWOJ%U0fOJh5H;%HOQsvYE#+u=!g4a?p!VlJQ?@`Nprlz( zYhUn2KZnkXt(kxP1~beojTX5cJkx%LE3@W26mJ5>JMc6*@FoT}ag#-COSW=ob0RxC zsZ|9WQ|3~f!=r#0m?MVc?Z+EimEe%$<%fF5J(MZ;52)+5^aU8H)qF4`qW4~9We)v3 zbqth>DR9Y=5nS9P)0e~RCzwy7@wscHm!89J`@6R0G^$*N)BK4Z-B5C~5)4GkoozAj z^&&8!MD&200(zCuxms*t^H0aCA7 zRF54Ulv!I7rS-PX6Exx2nR}+YvZB^_OMlY*Ghrgba{MH^$??`nG_2F#3RU)njZb^p z+HuB(wn;Zo{v>B$DmCuZnfS+$@Go_nsca~f962XY9r*)&Slyt)+~`0!Sht>4WmdSj zI9~xSa}f&ZT@&?!T*+O7U|v1;UtQ7#nd%SQ<6UhD2?xV*o->d=u7qAZx=GAAN#+t9 z;#gl7D*lg-Jhc6Du14GLv^|kkbp`gGiC=Ks(zbiY1L$T{Ph3o zhc|h^2eGm-FE#^Q>DRj^DwprFG>!>tFuK$0f8hla({Gw!mKnM}69x(4~^CcNmF=)56dGdd4iLnji1VvT3Owt}S1A9{i`qu;ZXC-;i)v z64%=mHQtoh9LqY$cX@1#hlCt42j4zpdb6+})MC2Mv7gbnrSm7yKl!&{!T-)b0jo!j W`|XpXF}}dpGu^wRqmBeW3HooK?sHrK literal 0 HcmV?d00001 diff --git a/docs/concepts/.pages b/docs/concepts/.pages index 87d7cc2..b144267 100644 --- a/docs/concepts/.pages +++ b/docs/concepts/.pages @@ -2,6 +2,7 @@ title: Concepts nav: - index.md - About access control: access-control.md + - About vulnerability data sources: about-vulnerability-data-sources.md - About notifications: notifications.md - About time series metrics: time-series-metrics.md - About component policies: component-policies.md diff --git a/docs/concepts/about-vulnerability-data-sources.md b/docs/concepts/about-vulnerability-data-sources.md new file mode 100644 index 0000000..fdeaa93 --- /dev/null +++ b/docs/concepts/about-vulnerability-data-sources.md @@ -0,0 +1,145 @@ +# About vulnerability data sources + +A vulnerability data source is an upstream feed of known security defects that Dependency-Track uses to find +vulnerabilities in your components. No single feed covers every ecosystem, identifier scheme, or disclosure path, so +Dependency-Track integrates with several. You pick which ones to enable based on what you ship and where the relevant +advisories are published. None of them are required, and enabling all of them is rarely the right answer. + +This page explains what each source contributes, how the data reaches your findings, and the trade-offs you accept when +you enable a source or turn one off. For the procedure to enable sources, see [Configuring vulnerability +sources](../guides/administration/configuring-vulnerability-sources.md). + +## Mirrored sources + +Dependency-Track can mirror three public data sources into its own database: + +- **[National Vulnerability Database (NVD)](https://nvd.nist.gov/)** is the canonical CVE feed maintained by NIST. It + contains over 200,000 CVE records spanning the early nineties to the present and describes affected products as + Common Platform Enumeration (CPE) names. NVD is the broadest source for non-package software (operating systems, + firmware, network equipment), but its CPE-based product model is a poor fit for open source packages. +- **[GitHub advisories](https://github.com/advisories)** is GitHub's curated advisory database (GHSA). It covers open + source packages on npm, Maven, PyPI, NuGet, Go, RubyGems, and others. Advisories use Package URL (PURL) keys, often + appear before the corresponding NVD entry, and frequently carry more ecosystem-specific detail than the NVD record. +- **[OSV](https://osv.dev/)** is Google's open source vulnerability database. It aggregates advisories from GitHub, + PyPA, RustSec, the Go team, distribution security teams, and others into one PURL-keyed dataset, and it covers + ecosystems and distributions that NVD and GHSA do not (for example crates.io, Hex, Pub, Alpine, and Debian). + +### Picking sources + +The three feeds overlap heavily for open source ecosystems. Most operators do not need all three: + +- **GHSA and OSV cover much of the same ground.** OSV ingests GitHub advisories and adds advisories from other curators + (PyPA, RustSec, Go, distribution security teams). OSV also lets you mirror per ecosystem, which is finer-grained + control than GHSA offers. If you want one source for open source packages, prefer OSV. +- **GHSA** is useful on its own if you stay close to the GitHub ecosystem or want the data exactly as GitHub publishes + it, without the aggregation layer that OSV adds. +- **NVD** is the only mirrored source that meaningfully covers non-package software identified by CPE. Enable it when + your BOMs include such components, or when you specifically need CVE coverage independent of curator-specific feeds. + +## How Dependency-Track uses the data + +Mirroring is a background task. On a configurable schedule and at instance startup, Dependency-Track downloads new and +changed records from each enabled source and writes them into its own database. + +Vulnerability analysis is a separate process. When you upload a Bill of Materials or trigger analysis, the [internal +analyzer](../reference/analyzers.md#internal) matches the project's components against the mirrored data already stored +locally. The internal analyzer makes no outbound calls during analysis, which makes findings reproducible and keeps +analysis fast. + +For the full analysis workflow, see [Vulnerability analysis](architecture/design/vulnerability-analysis.md). + +### Turning a source off + +Disabling a source stops further mirroring from that source, but Dependency-Track does not delete the records it has +already written. Vulnerabilities mirrored before the source was turned off remain in the database, and the internal +analyzer keeps matching components against them on subsequent analysis runs. Findings already raised from that source +are not retroactively removed either. + +The practical consequence is that turning a source off is reversible without re-downloading, but it does not clean up +after itself. If you intend to drop a source entirely and have its findings disappear, expect to clear the data +manually. Dependency-Track does not yet provide a built-in workflow for this. + +## How component matching works + +Each advisory in a mirrored source names the products it affects, using either a CPE or a PURL, and specifies the +affected versions. The internal analyzer matches a component to an advisory by identifier scheme first and version +second. + +| Source | Identifier in records | What components need | +|:-------|:----------------------|:---------------------| +| NVD | CPE | A valid CPE on the component | +| GitHub advisories | PURL | A valid PURL on the component | +| OSV | PURL | A valid PURL on the component | + +A component with neither a CPE nor a PURL is not evaluated. + +### CPE matching + +CPE matching follows the [NIST CPE name matching +specification](https://nvlpubs.nist.gov/nistpubs/Legacy/IR/nistir7696.pdf): the analyzer compares all eleven CPE +attributes (`part`, `vendor`, `product`, `version`, `update`, `edition`, `language`, `sw_edition`, `target_sw`, +`target_hw`, `other`) and rejects the match if any attribute is disjoint. + +Two adjustments reduce false positives compared to a literal reading of the spec: + +- A SUBSET vendor combined with a SUPERSET product (or the reverse) is rejected, because these combinations otherwise + produce noisy matches across unrelated products (see [issue + #3178](https://github.com/DependencyTrack/dependency-track/issues/3178)). +- Component versions of `*` (ANY) and `-` (NA) are handled per the spec, not run through range comparison. + +When the advisory specifies a version range, the analyzer evaluates it using the +[vers](https://www.packageurl.org/docs/vers/introduction) range specification, with a versioning scheme inferred from +the component's PURL when present and the `generic` scheme otherwise. + +### PURL matching + +PURL matching requires the advisory's PURL `type`, `namespace`, and `name` to match the component's exactly. For +OS-package PURLs (`deb`, `rpm`), if both sides carry a `distro` qualifier they must agree, with semantic equivalences +honored (for example, `debian-13` matches `trixie`). + +Version comparison uses [vers](https://www.packageurl.org/docs/vers/introduction) with the versioning scheme derived +from the PURL type. If the strict scheme fails to parse a version, the analyzer falls back to the `generic` scheme to +avoid false negatives. For `deb` and `rpm` PURLs, an `epoch` qualifier is folded into the version as `epoch:version` +before comparison when the version does not already encode one. + +### Practical consequence + +Most modern BOM generators emit PURLs but not CPEs. As a result, components from package ecosystems (npm, Maven, PyPI, +and so on) match GHSA and OSV well but produce few or no findings from NVD data, even when CVE records exist for those +packages. This is the most common reason operators see fewer NVD findings than expected. + +If you need NVD coverage for ecosystem packages, your BOM generator must also produce CPEs for those components. +Otherwise, rely on GHSA or OSV for open source coverage and on NVD primarily for non-package software identified by CPE. +The OWASP SBOM Forum's [recommendations to improve the +NVD](https://owasp.org/blog/2022/09/13/sbom-forum-recommends-improvements-to-nvd) document this CPE-vs-PURL mismatch and +the industry effort to close it. + +## Aliases across sources + +A single vulnerability often has different identifiers in different sources. Log4Shell, for example, is `CVE-2021-44228` +in NVD and `GHSA-jfh8-c2jp-5v3q` in GHSA. + +Dependency-Track records aliases when sources publish explicit links between identifiers and surfaces them in the UI. +Aliases do not de-duplicate findings: if two enabled sources both report Log4Shell for the same component, you see two +findings, one per source, with the alias relationship visible on each. + +## Mirrored sources vs. external analyzers + +The mirrored sources are not the only way Dependency-Track gets vulnerability data. It also ships analyzers that call +external services at analysis time: + +- **OSS Index** (Sonatype) +- **Snyk** +- **Trivy** (against a Trivy server you operate) +- **VulnDB** (Flashpoint, commercial) + +These analyzers send component identifiers to a third party on every analysis run, return findings inline, and store +nothing locally beyond the result. They complement the mirrored sources but introduce an outbound dependency and, in +some cases, a commercial contract. See [Vulnerability analyzers](../reference/analyzers.md) for the full list and their +requirements. + +## Vulnerabilities you define yourself + +The [private vulnerability repository](../reference/datasources/private-vulnerability-repository.md) holds +vulnerabilities you define yourself. Use it for vulnerabilities in internal code or for pre-disclosure tracking. +Findings from private vulnerabilities behave the same as findings from public sources. diff --git a/docs/concepts/changes-in-v5.md b/docs/concepts/changes-in-v5.md index 2edbdcd..bbe0199 100644 --- a/docs/concepts/changes-in-v5.md +++ b/docs/concepts/changes-in-v5.md @@ -168,6 +168,7 @@ remediation steps, lives in the use for them), and its file storage abstracts over backends like S3 rather than assuming a local filesystem to serve from. Dependency-Track no longer serves this endpoint. Fetch feeds directly from NIST or run a dedicated mirror. + See [Running air-gapped](../guides/administration/running-air-gapped.md) for hosting an internal NVD or OSV mirror. [CEL]: https://cel.dev/ [Protobuf]: https://protobuf.dev/ diff --git a/docs/guides/administration/.pages b/docs/guides/administration/.pages index 41720cf..93f98f5 100644 --- a/docs/guides/administration/.pages +++ b/docs/guides/administration/.pages @@ -7,6 +7,8 @@ nav: - configuring-secret-management.md - configuring-internal-ca.md - configuring-http-proxy.md + - configuring-vulnerability-sources.md + - running-air-gapped.md - configuring-observability.md - configuring-ldap.md - configuring-oidc.md diff --git a/docs/guides/administration/configuring-http-proxy.md b/docs/guides/administration/configuring-http-proxy.md index ba29ee9..ea5787b 100644 --- a/docs/guides/administration/configuring-http-proxy.md +++ b/docs/guides/administration/configuring-http-proxy.md @@ -1,9 +1,9 @@ # Configuring an HTTP proxy -The Dependency-Track API server makes outbound HTTP and HTTPS calls to mirror vulnerability data sources, fetch -package metadata from repositories, perform OIDC discovery, deliver webhooks, and reach other integrations. In -environments where outbound traffic must traverse a corporate proxy, configure the API server to route those calls -through it. +The Dependency-Track API server makes outbound HTTP and HTTPS calls to mirror +[vulnerability data sources](configuring-vulnerability-sources.md), fetch package metadata from repositories, perform +OIDC discovery, deliver webhooks, and reach other integrations. In environments where outbound traffic must traverse a +corporate proxy, configure the API server to route those calls through it. Proxy configuration applies to the API server only. The frontend is a static single-page app served to the user's browser; any requests it appears to make actually originate from the browser itself. diff --git a/docs/guides/administration/configuring-internal-ca.md b/docs/guides/administration/configuring-internal-ca.md index 8a74ca2..960fa38 100644 --- a/docs/guides/administration/configuring-internal-ca.md +++ b/docs/guides/administration/configuring-internal-ca.md @@ -15,7 +15,8 @@ Common scenarios where this occurs: - **LDAPS**: connecting to an LDAP server using TLS ([Configuring LDAP](configuring-ldap.md)) - **OIDC**: the identity provider uses a privately signed certificate ([Configuring OIDC](configuring-oidc.md)) - **HTTP proxy**: an intercepting TLS proxy sits between Dependency-Track and external services -- **Internal vulnerability sources**: a private vulnerability repository or API server with an internal certificate +- **Internal vulnerability sources**: an internal mirror of NVD or OSV behind a privately signed certificate (see + [Configuring vulnerability sources](configuring-vulnerability-sources.md) and [Running air-gapped](running-air-gapped.md)) The solution is to import your internal CA certificate into the JVM truststore and mount the modified truststore into the container. diff --git a/docs/guides/administration/configuring-vulnerability-sources.md b/docs/guides/administration/configuring-vulnerability-sources.md new file mode 100644 index 0000000..6ef4cc3 --- /dev/null +++ b/docs/guides/administration/configuring-vulnerability-sources.md @@ -0,0 +1,103 @@ +# Configuring vulnerability sources + +Dependency-Track can mirror three public vulnerability data sources into its internal database: the National +Vulnerability Database (NVD), GitHub advisories, and OSV. You pick which ones to enable, configure them through the web +UI, and trigger an initial mirror so findings appear without waiting for the next scheduled run. + +For background on what each source provides, when one is enough, and how the internal analyzer turns mirrored data into +findings, see [About vulnerability data sources](../../concepts/about-vulnerability-data-sources.md). + +## Prerequisites + +For each source you plan to enable, allow outbound HTTPS access from the API server to the corresponding host: + +| Source | Host | +|:-------|:-----| +| NVD | `nvd.nist.gov` | +| GitHub advisories | `api.github.com` | +| OSV | `storage.googleapis.com` | + +If outbound traffic must go through a proxy, see [Configuring an HTTP proxy](configuring-http-proxy.md). If the proxy +intercepts TLS, see [Configuring internal CA trust](configuring-internal-ca.md). + +The GitHub advisories source also requires a GitHub personal access token (PAT). The token needs no scopes, but the +GitHub GraphQL API rejects unauthenticated requests. Create one at +[github.com/settings/tokens](https://github.com/settings/tokens). NVD and OSV do not require credentials. + +## Enabling sources + +Open **Administration > Vulnerability Sources** in the web UI. Each source has its own configuration panel. The following steps +cover the least configuration needed for findings. + +### NVD + +1. Open **Administration > Vulnerability Sources > NVD**. +2. Enable the source. +3. Select **Test** to verify the configured endpoint is reachable and that the feed file format matches what + Dependency-Track expects. +4. Select **Mirror now** to download the feed immediately. The first mirror downloads the entire dataset and can take a + while. + +![NVD configuration](../../assets/images/guides/administration/configuring-vulnerability-sources/nvd.png) + +NVD records describe affected products as CPEs. The internal analyzer skips components that lack a valid CPE when +evaluating NVD data. If you expect findings for open source packages identified by PURL and see none from NVD, that is +the reason. See [How component matching +works](../../concepts/about-vulnerability-data-sources.md#how-component-matching-works). + +### GitHub advisories + +1. Open **Administration > Vulnerability Sources > GitHub**. +2. Enable the source. +3. Enter the GitHub PAT from the prerequisites. +4. Select **Mirror now** to download advisories immediately. + +![GitHub Advisories configuration](../../assets/images/guides/administration/configuring-vulnerability-sources/github.png) + +### OSV + +1. Open **Administration > Vulnerability Sources > OSV**. +2. Enable the source. +3. Select the ecosystems you want to mirror. Dependency-Track downloads only the ecosystems you select. +4. Select **Mirror now** to download the selected ecosystems immediately. + +![OSV configuration](../../assets/images/guides/administration/configuring-vulnerability-sources/osv.png) + +!!! tip + For Debian, select the **Debian** ecosystem rather than individual Debian version ecosystems. The Debian package is + a superset of all version-specific ones. + +## Triggering an initial mirror + +After enabling a source for the first time, use **Mirror now** rather than waiting for the next scheduled run. The first +NVD mirror in particular can take a long time, and you want it underway before users start uploading BOMs and expecting +findings. + +Mirror progress and errors appear in the API server logs. Dependency-Track does not emit notifications for mirror runs, +so tail the logs during initial setup if you need to follow what each mirror is doing. + +## Scheduling mirror runs + +Each source has its own cron property. Mirrors also run on instance startup. To change the schedule, set the +corresponding property: + +- NVD: [`dt.task.nist.mirror.cron`](../../reference/configuration/properties.md#dttasknistmirrorcron) +- GitHub advisories: + [`dt.task.git.hub.advisory.mirror.cron`](../../reference/configuration/properties.md#dttaskgithubadvisorymirrorcron) +- OSV: [`dt.task.osv.mirror.cron`](../../reference/configuration/properties.md#dttaskosvmirrorcron) + +## Verifying findings + +Once a mirror completes, upload a BOM for a project that contains components you know to be vulnerable, or trigger +analysis on an existing project. Findings should appear within seconds of analysis completing. If they do not, check the +API server logs for mirror errors and confirm the components carry the identifier the source uses for matching (CPE for +NVD, PURL for GitHub advisories and OSV). + +## See also + +- [About vulnerability data sources](../../concepts/about-vulnerability-data-sources.md) +- [Vulnerability datasources reference](../../reference/datasources/index.md) +- [Vulnerability analyzers reference](../../reference/analyzers.md) +- [Running air-gapped](running-air-gapped.md) +- [Configuring an HTTP proxy](configuring-http-proxy.md) +- [Configuring internal CA trust](configuring-internal-ca.md) diff --git a/docs/guides/administration/migrating-from-v4.md b/docs/guides/administration/migrating-from-v4.md index 280e24a..ec714b8 100644 --- a/docs/guides/administration/migrating-from-v4.md +++ b/docs/guides/administration/migrating-from-v4.md @@ -366,6 +366,7 @@ It drops analyzer and vulnerability-source credentials as part of the encrypted- After the migration, open the **Repositories**, **Analyzers**, and **Vulnerability Sources** pages in the v5 administrator panel and re-enter each credential through the secret manager. Turn the affected repositories back on. +See [Configuring vulnerability sources](configuring-vulnerability-sources.md) for the full procedure to re-enable each mirror. See [Configuring secret management](configuring-secret-management.md) if you have not yet set the secret-encryption key for the v5 deployment. ### Encrypted property values diff --git a/docs/guides/administration/running-air-gapped.md b/docs/guides/administration/running-air-gapped.md new file mode 100644 index 0000000..fb2093c --- /dev/null +++ b/docs/guides/administration/running-air-gapped.md @@ -0,0 +1,65 @@ +# Running air-gapped + +Dependency-Track can run in environments without outbound internet access, but every integration that normally reaches a +public endpoint needs an alternative. This guide collects the relevant considerations. + +!!! warning "Incomplete" + This guide is a work in progress. It currently covers vulnerability data sources and vulnerability analyzers. Other + application areas (notifications, repository metadata for outdated-component detection) + also reach the public internet by default and will be documented here as the content is written. If your air-gapped + deployment depends on one of those areas, treat this guide as a starting point, not a complete checklist. + +If your network only routes outbound traffic through a proxy, you may not need a full air-gapped setup. See [Configuring +an HTTP proxy](configuring-http-proxy.md) and [Configuring internal CA trust](configuring-internal-ca.md) first. + +## Vulnerability data sources + +For background on the three mirrored sources and how to enable them, see [Configuring vulnerability +sources](configuring-vulnerability-sources.md). Each source has a different air-gapped story. + +### NVD + +Host files that match the [NVD JSON 2.0 feed layout](https://nvd.nist.gov/vuln/data-feeds#divJson20Feeds) on an internal +HTTP file server. Dependency-Track requires the `META` and `GZ` files. The `ZIP` files are not required. + +Point the NVD source's feed URL at the internal mirror, then use the **Test** action in the NVD configuration panel to +confirm the mirror is reachable and serves files in the expected layout. + +### OSV + +Host the [OSV data dumps](https://google.github.io/osv.dev/data/#data-dumps) on an internal HTTP file server. +Dependency-Track expects per-ecosystem `all.zip` files. Dependency-Track also requires `modified_id.csv` for incremental +mirroring. If you turn off incremental mirroring, Dependency-Track re-downloads the full dumps on every run. + +Point the OSV source's base URL at the internal mirror. + +### GitHub advisories + +The GitHub advisories integration uses GitHub's paginated GraphQL API. A static HTTP mirror cannot serve it. Forwarding +through an HTTP forward proxy may work but is not tested. + +In a strict air-gapped environment, turn off the GitHub advisories source. Use OSV for open source coverage instead. OSV +ingests GitHub advisories along with advisories from other curators, so you do not lose GHSA-prefixed records by relying +on OSV alone. + +## Vulnerability analyzers + +The [internal analyzer](../../reference/analyzers.md#internal) is air-gap safe. It queries only the local vulnerability +database and makes no outbound calls during analysis, so it works as long as you have configured the corresponding +[vulnerability data sources](#vulnerability-data-sources) above. + +[Trivy](../../reference/analyzers.md#trivy) is the other practical option. The Trivy server itself supports air-gapped +operation by loading its vulnerability database from internal storage ahead of time. See the [Trivy air-gapped +environment guide](https://trivy.dev/docs/latest/guide/advanced/air-gap/) for setup. Dependency-Track only talks to the +Trivy server you operate, so as long as the Trivy server is reachable from the API server, the analyzer works. + +The [OSS Index](../../reference/analyzers.md#oss-index), [Snyk](../../reference/analyzers.md#snyk), and +[VulnDB](../../reference/analyzers.md#vulndb) analyzers call vendor-hosted APIs on every analysis run and require +outbound connectivity to those endpoints. Routing them through a caching proxy may work but is not tested. In a strict +air-gapped environment, turn these analyzers off. + +## See also + +- [Configuring vulnerability sources](configuring-vulnerability-sources.md) +- [Configuring an HTTP proxy](configuring-http-proxy.md) +- [Configuring internal CA trust](configuring-internal-ca.md) diff --git a/docs/reference/analyzers.md b/docs/reference/analyzers.md index d3c3cba..6e16275 100644 --- a/docs/reference/analyzers.md +++ b/docs/reference/analyzers.md @@ -16,6 +16,9 @@ Matches components against Dependency-Track's own vulnerability database. This i vulnerabilities mirrored from sources such as the NVD, GitHub Advisories, and OSV. The internal analyzer is enabled by default. +For background on what each mirrored source contributes and how matching works, +see [About vulnerability data sources](../concepts/about-vulnerability-data-sources.md). + Uses both CPE and PURL matching. !!! note diff --git a/docs/reference/datasources/.pages b/docs/reference/datasources/.pages index 0eeea08..ff4f8c2 100644 --- a/docs/reference/datasources/.pages +++ b/docs/reference/datasources/.pages @@ -1,8 +1,5 @@ nav: - Overview: index.md - - NVD: nvd.md - - GitHub advisories: github-advisories.md - - OSV: osv.md - Private vulnerability repository: private-vulnerability-repository.md - Repositories: repositories.md - Internal components: internal-components.md diff --git a/docs/reference/datasources/github-advisories.md b/docs/reference/datasources/github-advisories.md deleted file mode 100644 index af53574..0000000 --- a/docs/reference/datasources/github-advisories.md +++ /dev/null @@ -1,40 +0,0 @@ -# GitHub Advisories - -The [GitHub Advisory Database](https://github.com/advisories) (GHSA) contains -security advisories for open source packages hosted on GitHub and other ecosystems. -Advisories may or may not overlap with NVD CVE records. GitHub often publishes -advisories for vulnerabilities that are not yet in the NVD, or with more ecosystem- -specific detail. - -## What It Provides - -GitHub Advisories are keyed by PURL and map directly to package ecosystems such as -npm, Maven, PyPI, Go, NuGet, and others. This makes them highly effective for -open source component matching without requiring a CPE. - -Dependency-Track automatically synchronises vulnerability aliases between GHSA and -CVE identifiers where GitHub has made the link explicit. This means a component can -be matched by either its GHSA or CVE identifier, and the finding will not be -duplicated. - -## Mirroring - -Dependency-Track mirrors GitHub Advisories via GitHub's public GraphQL API. The mirror -refreshes daily and on instance startup. - -The mirroring schedule is controlled by -[`dt.task.git.hub.advisory.mirror.cron`](../configuration/properties.md#dttaskgithubadvisorymirrorcron). - -## Configuration - -GitHub Advisory mirroring is configured in the administration UI under -**Administration → Datasources → GitHub Advisories**. - -| Setting | Description | -|:--------|:------------| -| Enabled | Whether GitHub Advisory mirroring is active. Enabled by default. | -| GitHub Personal Access Token | Required. A GitHub PAT with no scopes assigned is sufficient. Without a token, the GraphQL API rejects requests. | - -To create a token, visit [github.com/settings/tokens](https://github.com/settings/tokens) -and generate a classic or fine-grained token. No scopes are required; the public -advisory data is accessible to any authenticated user. diff --git a/docs/reference/datasources/index.md b/docs/reference/datasources/index.md index 6864d94..2c051d1 100644 --- a/docs/reference/datasources/index.md +++ b/docs/reference/datasources/index.md @@ -1,34 +1,33 @@ -# Vulnerability Datasources +# Vulnerability datasources -Vulnerability datasources are the upstream feeds from which Dependency-Track populates -its internal vulnerability database. The [internal analyzer](../analyzers.md#internal) -queries this local database when evaluating components, so no external call is made at -analysis time, only during mirroring. +Vulnerability datasources are the upstream feeds from which Dependency-Track populates its internal vulnerability +database. The [internal analyzer](../analyzers.md#internal) queries this local database during vulnerability analysis, +so no external call is made at analysis time, only during mirroring. -Mirroring runs on a configurable schedule (daily by default) and on instance startup. -Progress and errors are reported via the `DATASOURCE_MIRRORING` -[notification group](../../concepts/architecture/design/notifications.md). +For background on what each source provides and the trade-offs between them, see [About vulnerability data +sources](../../concepts/about-vulnerability-data-sources.md). For the procedure to enable and schedule mirrors, see +[Configuring vulnerability sources](../../guides/administration/configuring-vulnerability-sources.md). -## Mirrored Sources +## Mirrored sources -These sources are downloaded and stored locally. The internal analyzer queries them -without contacting any external service during vulnerability analysis. +Dependency-Track can mirror three public sources into its local database. Mirroring runs on a configurable schedule +(daily by default) and on instance startup. Progress and errors are written to the API server logs. -| Source | Identifier prefix | Primary use | -|:-------|:-----------------|:------------| -| [NVD](nvd.md) | `CVE-` | CPE-based matching for all component types | -| [GitHub Advisories](github-advisories.md) | `GHSA-` | PURL-based matching for open source packages | -| [OSV](osv.md) | varies by ecosystem | PURL-based matching for open source packages | +| Source | Identifier prefix | Matches on | +|:-------|:------------------|:-----------| +| NVD | `CVE-` | CPE | +| GitHub advisories | `GHSA-` | PURL | +| OSV | varies by ecosystem | PURL | -## Other Sources +## Other sources | Source | Description | |:-------|:------------| -| [Private Vulnerability Repository](private-vulnerability-repository.md) | Internally managed vulnerabilities for proprietary components or pre-disclosure research | -| [Repositories](repositories.md) | Package registry integrations used for outdated component detection | -| [Internal Components](internal-components.md) | Configuring components that should never be sent to external services | +| [Private vulnerability repository](private-vulnerability-repository.md) | Internally managed vulnerabilities for proprietary components or pre-disclosure research. | +| [Repositories](repositories.md) | Package registry integrations used for outdated component detection. Not a vulnerability source. | +| [Internal components](internal-components.md) | Marks components that must never be sent to external services. | -## Analyzers That Query External Services +## Analyzers that query external services -OSS Index, Snyk, Trivy, and VulnDB are *analyzers* that call external APIs at analysis -time. They are documented separately in the [Analyzers](../analyzers.md) reference. +OSS Index, Snyk, Trivy, and VulnDB are *analyzers* that call external APIs at analysis time. They are documented +separately in the [Analyzers](../analyzers.md) reference. diff --git a/docs/reference/datasources/internal-components.md b/docs/reference/datasources/internal-components.md index d962545..2aa8f8f 100644 --- a/docs/reference/datasources/internal-components.md +++ b/docs/reference/datasources/internal-components.md @@ -1,37 +1,34 @@ -# Internal Components +# Internal components -Dependency-Track allows organisations to mark certain component namespaces and/or names -as *internal*. Components identified as internal are excluded from all external services: -they are never sent to external vulnerability analyzers (OSS Index, Snyk, Trivy, VulnDB) -and never queried against public package repositories. +Dependency-Track allows organizations to mark certain component namespaces and names as *internal*. Components +identified as internal are excluded from all external services. They are never sent to external vulnerability analyzers +(OSS Index, Snyk, Trivy, VulnDB) and never queried against public package repositories. -This is useful when your SBOMs include first-party libraries with coordinates that could -coincide with public packages, or when you simply do not want metadata about internal -packages to leave your network. +This is useful when SBOMs include first-party libraries whose coordinates could coincide with public packages, or when +metadata about internal packages must not leave the network. -## How Matching Works +## How matching works -Internal component identification is configured in -**Administration → Internal Components** by specifying one or more namespace and/or name -patterns. +Configure internal component identification in **Administration > Internal components** by specifying one or more +namespace and name patterns. Two matching modes are available: -| Mode | Behaviour | -|:-----|:----------| -| OR (default) | A component is internal if its namespace *or* name matches any configured pattern. | -| AND | A component is internal if its namespace *and* name both match. | +| Mode | Behavior | +|:-----|:---------| +| OR (default) | A component is internal if its namespace or name matches any configured pattern. | +| AND | A component is internal if its namespace and name both match. | Patterns are matched against the component's PURL namespace and name fields. !!! note - By default, no components are identified as internal. All components are treated - as third-party and may be sent to configured external analyzers. + By default, no components are identified as internal. All components are treated as third-party and may be sent to + configured external analyzers. -## Effects of Being Marked Internal +## Effects of being marked internal -| Service | Behaviour for internal components | -|:--------|:----------------------------------| +| Service | Behavior for internal components | +|:--------|:---------------------------------| | OSS Index | Not queried | | Snyk | Not queried | | Trivy | Not queried | @@ -40,9 +37,8 @@ Patterns are matched against the component's PURL namespace and name fields. | Internal analyzer | Still evaluated against the local vulnerability database | | Private repositories | Still queried if configured | -## Use with the Private Vulnerability Repository +## Use with the private vulnerability repository -Internal components can still be matched against vulnerabilities defined in the -[private vulnerability repository](private-vulnerability-repository.md). This allows -organisations to track and triage vulnerabilities in their own codebases without -exposing component identifiers externally. +Internal components can still be matched against vulnerabilities defined in the [private vulnerability +repository](private-vulnerability-repository.md). This allows organizations to track and triage vulnerabilities in their +own codebases without exposing component identifiers externally. diff --git a/docs/reference/datasources/nvd.md b/docs/reference/datasources/nvd.md deleted file mode 100644 index 839cfd4..0000000 --- a/docs/reference/datasources/nvd.md +++ /dev/null @@ -1,51 +0,0 @@ -# National Vulnerability Database (NVD) - -The [National Vulnerability Database](https://nvd.nist.gov/) (NVD) is the largest -publicly available source of vulnerability intelligence, maintained by NIST and building -on CVE identifiers from MITRE. It contains over 200,000 CVE records spanning from the -early nineties to the present day. - -!!! note - This product uses the NVD API but is not endorsed or certified by the NVD. - -## What It Provides - -The NVD mirror populates Dependency-Track's internal database with CVE records including -descriptions, CVSS scores, CWE classifications, and affected product configurations -expressed as CPE. The [internal analyzer](../analyzers.md#internal) uses this data -to match components with valid CPEs against known vulnerabilities. - -## Mirroring - -Dependency-Track mirrors the NVD via the NVD REST API. The mirror refreshes daily and -on instance startup. The initial mirror may take significantly longer than subsequent -incremental updates. - -The mirroring schedule is controlled by -[`dt.task.nist.mirror.cron`](../configuration/properties.md#dttasknistmirrorcron). - -## Configuration - -NVD mirroring is configured through the administration UI under -**Administration → Datasources → NVD**. - -| Setting | Description | -|:--------|:------------| -| Enabled | Whether NVD mirroring is active. Enabled by default. | -| NVD API Key | Optional but strongly recommended. Unauthenticated requests are rate-limited aggressively, which can cause the initial mirror to take hours or fail. | - -Obtain a free NVD API key at [nvd.nist.gov/developers/request-an-api-key](https://nvd.nist.gov/developers/request-an-api-key). - -!!! tip - Configuring an API key is especially important for new installations, where - the entire NVD dataset must be downloaded on the first mirror run. - -## CPE Matching - -NVD records describe affected products using CPE (Common Platform Enumeration). -Dependency-Track follows the NIST CPE name matching specification with adjustments -to reduce false positives: matches are rejected when the vendor comparison yields -*SUBSET* and the product comparison yields *SUPERSET*, or vice versa. - -Components without a valid CPE are not evaluated by the internal analyzer against -NVD data. Ensure your SBOMs include CPEs for non-open-source components. diff --git a/docs/reference/datasources/osv.md b/docs/reference/datasources/osv.md deleted file mode 100644 index 99ed8d2..0000000 --- a/docs/reference/datasources/osv.md +++ /dev/null @@ -1,53 +0,0 @@ -# OSV - -[OSV](https://osv.dev/) (Open Source Vulnerabilities) is a vulnerability database -focused on open source packages, maintained by Google. It aggregates advisories from -multiple upstream sources including GitHub Advisories, PyPA, RustSec, and many others, -providing a unified PURL-keyed dataset. - -## What It Provides - -OSV advisories are natively keyed by package ecosystem and version, making them -well-suited for PURL-based matching across a wide range of languages and package managers. - -OSV supports alias linking, so vulnerabilities tracked under different IDs (CVE, GHSA, -OSV-specific IDs) across databases are correlated automatically. - -## Supported Ecosystems - -OSV data can be selectively enabled per ecosystem. Available ecosystems include: -Go, npm, PyPI, RubyGems, crates.io (Rust), Maven, NuGet, Packagist (PHP), Hex (Erlang), -pub (Dart), Alpine, Debian, Ubuntu, Android, and others. - -!!! tip - For Debian, enable **Debian** rather than individual Debian version ecosystems. - The Debian ecosystem package is a superset of all individual versions. - -## Mirroring - -Dependency-Track mirrors OSV data from Google Cloud Storage (`gs://osv-vulnerabilities`). -No authentication token is required. The mirror refreshes daily and on instance startup. - -The mirroring schedule is controlled by -[`dt.task.osv.mirror.cron`](../configuration/properties.md#dttaskosvmirrorcron). - -## Configuration - -OSV mirroring is configured in the administration UI under -**Administration → Datasources → OSV**. - -| Setting | Description | -|:--------|:------------| -| Enabled | Whether OSV mirroring is active. | -| Ecosystems | The specific ecosystems to mirror. Only selected ecosystems are downloaded. | - -!!! warning - Disabling OSV removes ecosystem selections from the UI but preserves previously - mirrored vulnerability records in the database. Previously matched findings are - not automatically removed. - -## Alias Synchronisation - -OSV supports alias synchronisation with other vulnerability databases. This is -configured on the [internal analyzer](../analyzers.md#internal) rather than on -the OSV datasource directly. diff --git a/docs/reference/datasources/private-vulnerability-repository.md b/docs/reference/datasources/private-vulnerability-repository.md index 44e7a24..1a10ab0 100644 --- a/docs/reference/datasources/private-vulnerability-repository.md +++ b/docs/reference/datasources/private-vulnerability-repository.md @@ -1,35 +1,35 @@ -# Private Vulnerability Repository +# Private vulnerability repository -The private vulnerability repository stores internally managed vulnerabilities. It behaves -identically to other vulnerability sources -- findings are raised, audit trails are maintained, -and notifications fire -- but the data is entirely user-managed. +The private vulnerability repository stores internally managed vulnerabilities. It behaves identically to other +vulnerability sources. Findings are raised, audit trails are maintained, and notifications fire, but the data is +entirely user-managed. -For use cases and step-by-step creation instructions, see -[Managing private vulnerabilities](../../guides/user/managing-private-vulnerabilities.md). +For use cases and step-by-step creation instructions, see [Managing private +vulnerabilities](../../guides/user/managing-private-vulnerabilities.md). ## Vulnerability IDs -Every vulnerability in the private repository requires a unique ID within the -`INTERNAL` source. By default, Dependency-Track generates IDs using the prefix `INT` -followed by three blocks of four alphanumeric characters (for example, `INT-td11-7hzm-qzot`). +Every vulnerability in the private repository requires a unique ID within the `INTERNAL` source. By default, +Dependency-Track generates IDs using the prefix `INT` followed by three blocks of four alphanumeric characters (for +example, `INT-td11-7hzm-qzot`). -Any prefix meaningful to your organisation may be used (for example, `ACME-`, `INT-`, -`SEC-`). The only constraint is uniqueness within the `INTERNAL` source. +Any prefix meaningful to your organization may be used (for example, `ACME-`, `INT-`, `SEC-`). The only constraint is +uniqueness within the `INTERNAL` source. -## Severity and Risk Ratings +## Severity and risk ratings Severity can be set explicitly or derived from a risk score: | Rating | Description | |:-------|:------------| | Explicit severity | Choose directly: `CRITICAL`, `HIGH`, `MEDIUM`, `LOW`, or `INFO`. | -| CVSSv2 / CVSSv3 | Enter a CVSS vector; Dependency-Track calculates the base score and derives severity. | -| OWASP Risk Rating | Enter likelihood and impact factors; Dependency-Track calculates severity. | +| CVSSv2 / CVSSv3 | Enter a CVSS vector. Dependency-Track calculates the base score and derives severity. | +| OWASP Risk Rating | Enter likelihood and impact factors. Dependency-Track calculates severity. | -When multiple ratings are provided, CVSSv3 takes precedence over CVSSv2, and the rating -with the higher severity is preferred over OWASP Risk Rating. +When multiple ratings are provided, CVSSv3 takes precedence over CVSSv2, and the rating with the higher severity is +preferred over OWASP Risk Rating. -## Description Fields +## Description fields | Field | Purpose | |:------|:--------| @@ -39,13 +39,12 @@ with the higher severity is preferred over OWASP Risk Rating. | Recommendation | Remediation or mitigation instructions. Supports Markdown. | | References | List of external links (changelogs, advisories, blog posts, etc.). | -## Affected Components +## Affected components -For a vulnerability to be matched against components, **Affected Components** must -be configured. Each entry specifies an identifier (PURL or CPE) and either an exact -version or a version range. +For a vulnerability to be matched against components, **Affected components** must be configured. Each entry specifies +an identifier (PURL or CPE) and either an exact version or a version range. -**Version ranges** use lower and/or upper bounds: +**Version ranges** use lower or upper bounds: | Operator | Meaning | |:---------|:--------| @@ -54,15 +53,15 @@ version or a version range. | `<` | Less than (exclusive upper bound) | | `<=` | Less than or equal (inclusive upper bound) | -A range with only a lower bound matches all versions above it; a range with only an -upper bound matches all versions below it. +A range with only a lower bound matches all versions above it. A range with only an upper bound matches all versions +below it. !!! tip - Dependency-Track does not convert between PURL and CPE. Use the same identifier - type that your SBOM generator produces. Most modern generators emit PURLs. + Dependency-Track does not convert between PURL and CPE. Use the same identifier type your SBOM generator produces. + Most modern generators emit PURLs. -## Finding Behaviour +## Finding behavior -Internal vulnerabilities are matched by the [internal analyzer](../analyzers.md#internal) -during regular vulnerability analysis. Findings appear identically to those from public -sources and support the same triage workflow (analysis states, suppression, VEX export). +Internal vulnerabilities are matched by the [internal analyzer](../analyzers.md#internal) during regular vulnerability +analysis. Findings appear identically to those from public sources and support the same triage workflow (analysis +states, suppression, VEX export). diff --git a/docs/reference/index.md b/docs/reference/index.md index d96dc2f..a15640b 100644 --- a/docs/reference/index.md +++ b/docs/reference/index.md @@ -27,12 +27,12 @@ For background and explanations, see [Concepts](../concepts/index.md). ## Datasources -- [NVD](datasources/nvd.md) -- - National Vulnerability Database mirroring and CPE matching -- [GitHub Advisories](datasources/github-advisories.md) -- - GHSA mirroring via GitHub's GraphQL API -- [OSV](datasources/osv.md) -- - Open Source Vulnerabilities mirroring, selectable by ecosystem +For background on what data sources contribute and how to enable them, see +[About vulnerability data sources](../concepts/about-vulnerability-data-sources.md) and +[Configuring vulnerability sources](../guides/administration/configuring-vulnerability-sources.md). + +- [Datasources overview](datasources/index.md) -- + mirrored sources (NVD, GitHub Advisories, OSV) and the other sources Dependency-Track integrates with - [Private Vulnerability Repository](datasources/private-vulnerability-repository.md) -- internally managed vulnerabilities for proprietary components - [Repositories](datasources/repositories.md) -- From afbfa427b641e350cd100ff92937bace40b6dc4c Mon Sep 17 00:00:00 2001 From: Niklas Date: Thu, 21 May 2026 23:23:54 +0200 Subject: [PATCH 2/3] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Niklas --- docs/reference/datasources/private-vulnerability-repository.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/reference/datasources/private-vulnerability-repository.md b/docs/reference/datasources/private-vulnerability-repository.md index 1a10ab0..a21ed25 100644 --- a/docs/reference/datasources/private-vulnerability-repository.md +++ b/docs/reference/datasources/private-vulnerability-repository.md @@ -44,7 +44,7 @@ preferred over OWASP Risk Rating. For a vulnerability to be matched against components, **Affected components** must be configured. Each entry specifies an identifier (PURL or CPE) and either an exact version or a version range. -**Version ranges** use lower or upper bounds: +**Version ranges** use lower and/or upper bounds: | Operator | Meaning | |:---------|:--------| From 82120840aea809c7d82ac3ccc1cee4ccef3a7967 Mon Sep 17 00:00:00 2001 From: Niklas Date: Thu, 21 May 2026 23:24:38 +0200 Subject: [PATCH 3/3] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Niklas --- .../administration/configuring-vulnerability-sources.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/guides/administration/configuring-vulnerability-sources.md b/docs/guides/administration/configuring-vulnerability-sources.md index 6ef4cc3..e9cf9d3 100644 --- a/docs/guides/administration/configuring-vulnerability-sources.md +++ b/docs/guides/administration/configuring-vulnerability-sources.md @@ -73,8 +73,8 @@ After enabling a source for the first time, use **Mirror now** rather than waiti NVD mirror in particular can take a long time, and you want it underway before users start uploading BOMs and expecting findings. -Mirror progress and errors appear in the API server logs. Dependency-Track does not emit notifications for mirror runs, -so tail the logs during initial setup if you need to follow what each mirror is doing. +Mirror progress and errors appear in the API server logs, so tail the logs during initial setup if you need to follow +what each mirror is doing. ## Scheduling mirror runs