From 795373805b1e05bc280bbba0b9dea3d0174217e6 Mon Sep 17 00:00:00 2001 From: Anton Antonov Date: Thu, 11 Dec 2025 12:48:29 +0000 Subject: [PATCH 1/2] Add cca-kata (Run Confidentail Containers with encrypted images using Arm CCA and Trustee) Learning Path Signed-off-by: Anton Antonov --- .../cca-kata/_index.md | 62 ++++ .../cca-kata/_next-steps.md | 8 + .../cca-kata/attestation.png | Bin 0 -> 50391 bytes .../cca-kata/cca-kata.md | 72 +++++ .../cca-kata/confidential_containers.png | Bin 0 -> 50830 bytes .../cca-kata/flow.md | 304 ++++++++++++++++++ .../cca-kata/image_pulling.png | Bin 0 -> 40990 bytes 7 files changed, 446 insertions(+) create mode 100644 content/learning-paths/servers-and-cloud-computing/cca-kata/_index.md create mode 100644 content/learning-paths/servers-and-cloud-computing/cca-kata/_next-steps.md create mode 100644 content/learning-paths/servers-and-cloud-computing/cca-kata/attestation.png create mode 100644 content/learning-paths/servers-and-cloud-computing/cca-kata/cca-kata.md create mode 100644 content/learning-paths/servers-and-cloud-computing/cca-kata/confidential_containers.png create mode 100644 content/learning-paths/servers-and-cloud-computing/cca-kata/flow.md create mode 100644 content/learning-paths/servers-and-cloud-computing/cca-kata/image_pulling.png diff --git a/content/learning-paths/servers-and-cloud-computing/cca-kata/_index.md b/content/learning-paths/servers-and-cloud-computing/cca-kata/_index.md new file mode 100644 index 0000000000..e3d2994a58 --- /dev/null +++ b/content/learning-paths/servers-and-cloud-computing/cca-kata/_index.md @@ -0,0 +1,62 @@ +--- +title: Run Confidentail Containers with encrypted images using Arm CCA and Trustee + +minutes_to_complete: 60 + +who_is_this_for: This Learning Path is for software developers who want to understand how Confidential Containers can be run in Arm CCA realm. + +learning_objectives: + - Overview of Confidential Containers + - Understand how Trustee services are used for CCA realm attestation to unlock the confidential processing of data. + - Use an encrypted image to deploy a Confidential Containers in a CCA realm on an Armv9-A AEM Base Fixed Virtual Platform (FVP) that has support for RME extensions. + +prerequisites: + - An AArch64 or x86_64 computer running Linux or macOS; you can use cloud instances - see the [Arm cloud service providers](/learning-paths/servers-and-cloud-computing/csp/) + - Completion of the ["Run an end-to-end Attestation with Arm CCA and Trustee"](https://learn.arm.com/learning-paths/servers-and-cloud-computing/cca-trustee) Learning Path + +author: + - Anton Antonov + +### Tags +skilllevels: Advanced +subjects: Performance and Architecture +armips: + - Neoverse + - Cortex-A +operatingsystems: + - Linux + - macOS +tools_software_languages: + - FVP + - RME + - CCA + - Docker + - Veraison + - Trustee + - Confidential containers + - Kata containers + +further_reading: + - resource: + title: Arm Confidential Compute Architecture + link: https://www.arm.com/architecture/security-features/arm-confidential-compute-architecture + type: website + - resource: + title: Arm Confidential Compute Architecture open-source enablement + link: https://www.youtube.com/watch?v=JXrNkYysuXw + type: video + - resource: + title: Learn the architecture - Realm Management Extension + link: https://developer.arm.com/documentation/den0126 + type: documentation + - resource: + title: Realm Management Monitor specification + link: https://developer.arm.com/documentation/den0137/latest/ + type: documentation + +### FIXED, DO NOT MODIFY +# ================================================================================ +weight: 1 # _index.md always has weight of 1 to order correctly +layout: "learningpathall" # All files under learning paths have this same wrapper +learning_path_main_page: "yes" # This should be surfaced when looking for related content. Only set for _index.md of learning path content. +--- diff --git a/content/learning-paths/servers-and-cloud-computing/cca-kata/_next-steps.md b/content/learning-paths/servers-and-cloud-computing/cca-kata/_next-steps.md new file mode 100644 index 0000000000..c3db0de5a2 --- /dev/null +++ b/content/learning-paths/servers-and-cloud-computing/cca-kata/_next-steps.md @@ -0,0 +1,8 @@ +--- +# ================================================================================ +# FIXED, DO NOT MODIFY THIS FILE +# ================================================================================ +weight: 21 # Set to always be larger than the content in this path to be at the end of the navigation. +title: "Next Steps" # Always the same, html page title. +layout: "learningpathall" # All files under learning paths have this same wrapper for Hugo processing. +--- diff --git a/content/learning-paths/servers-and-cloud-computing/cca-kata/attestation.png b/content/learning-paths/servers-and-cloud-computing/cca-kata/attestation.png new file mode 100644 index 0000000000000000000000000000000000000000..3719960e9a4777087ea4a3528864c474a05e1f18 GIT binary patch literal 50391 zcmeFZbySpH6fO=UqX;Ufgc5?HQUWR^UDDFsN_RI5Lx`wIcXzjRgQ!SJhYTfMGjt6x z_uv=$-Mj8Tcdg%Dzdx>Pf#aF??DxFqoW0NUJbS;slb030ibsZrg@tuhQsTKH7S;tF zEG)% zZG4G*uoQ&}bhyWGCB5bKue^T9Kpn_flb-w5`(r92HJ+;Ah_8An(|bH;QbPs#kuSb< zsb?1`eCshs7|h8*BIiK@&%vb2G~dqR1h)4J6MTQk(koaUzRC)rIrx0{p1uzzzxX^A zBGGbXxr~cm*!X2Ci=d$_Mu&eNVyZdK9v8f~(TgegX75H%ft4!w+MtF$(eSn0Jp*4F zqAZ9v_xrKRK_&k|Pl8u&*Tbnli40P3b}0=~u(p}T-A)OmR(tJ))e z+}!88b`paYahGd6u|IL)@;sz1S-dw9T#7wQ^W2r2pJuWCnH@avHqE;Z<910`XBJjp zm$@9=h_N_~3D;TmecE?RBYol*>2>FcUz?ICmJ8faJC;x zzL8qr;*GxVrRphhNRhMEcJiS1!Nue5;~J^;dv>9QEWAEBT_<&S!nyC~cvidcOF!jg z=l?9Ncxm7Bj2GL1-&pGPeNN`y9@rGE@+`{>r?A2YFYqD{cfxre>_=9-?3hrVUr0@zvI`h6J>gx36+NjrROY_PWyi}c-SR|7 zqWW=pDdZ*k9=oEs;%TNwOq^NGi0;Dr@xr`<2qK9$qt9r1uVMSw>kkd zBw0PO2K#}Rt=_KL#Y2ND+s{6E~q ze~Zl}j0$BT!Vwkjm#4Vz{aK!);yQz`RH}V0S$;sUP)-_tAA2sjJMNxHTOW@pM6C6` z`W;ojy&2KR7mPpg+u}Arg8fEYG;H}Bh?)H?X4-67J+Ygx4_aWG7Oq#I@``k1Qa6o! z^;5MKuyg5@A4$E|3}JX4m2NH{l*^$^yULtT!0wCw@HIWplzSYG2zbjz%K)( zXm#>JQjQx5-a3JkzLSAgpQ;S%%Px#Pp}3awn)NH!48+z_o1qx1`jX2nmpd+(INu(> zj`?IU!?bzlkgfqMC4l7%)u)uU>DK1YayJZd>u`94v3#Vz-6y(vjc^>d8rSc&Wcnk8 zlx4vycOMcuyfgYNHfuC{bJl~No}P(bD=$mYGmj$gX1v5Ey!lQc8{m^yxA9uMD6O$9` zDb$$tteYo9Yq1&L=gT-{+2@kyUCNEg^V?Q;gSka}`g(?)Tt8wyQh;*#f5Cf&cN>ow z&x9ClN*8}8NK`tVcrbX--Rvg*5XocGO%hApzM7fuzILL-q9&rr`f2(R`XRHgZ|HRB z&?}hLD+UfI8C84?+g4m~T!3}PM2RcUtE{U$WAJBaSGkk-DPJsKDBnWmpkPXwQb|c| zNBL$xQlUPVBVAU>MO99II?qcMrtX*jGq-hgEYD7Nj#$U%dnRpv*K*8qMtpv}ZoGbv zc@J}sBonMizKFNzVNuTbbE`Mbh5NF|Ye)sktCRvsmPr?r#OrW$-dH!FtS4nB?f77g zwv96GOztA+_vlBbk4`V1(q1&YK_fAMS0A2cvnlBf@(z*=at1n*h%${g?KuYMu7quRZ3O8 zLaRd2k)V+_4sMQqjwp_U+uI)mzmj}a(fUvnh`fkktx7=_A{CLrh*KjQ{S;I9H!st7 zXE&z8FGydcsGu0THhc{h?AUJFoYxMe4Qc-SDKAs(Qum(X=wSF&8HnunXC zSz}o~(u~nfxK9Z>udQCmzF30CPjvF+^MlN1^LDvHxz8$SKHR9{E#$Z4onUIX-@u}; z@VV|Sd01!I$+r!%Mdfyi?-ajKxLDx^WfT>kOR?`}sHf zW0yCVMf#Q2v7E1ZJbFW{bepx)Zee|~VUgRx#Xi98TEmU0F7<%1@UgUK0X39%ZCkQi zSz9!oYF=CzD_=EXl~1nvg8Ejo)tQ@_*@m9>j@xEFiPQ?VW|ipG55tqf2CsZdZGtA_ zbu7e0`P2RArTKM$O=TE^;Bj*A>Zpc<{PHWqI_YIFQJ*l9>0V%jyQ@$#_FeK?ODW;oRI(w zK~`T`FjnU}&9TnWS~Z1~MXX5~N`I8P=zNGYosyi^sM%>NR;e$JVrDKHmziLinp9iV z8mSXE>8;{ZTG(3PBW5O+iOP>kU~E6IKbZQl)KF3;Rg|A=K5KH;OOVf3kYKTEE_GmV zkb{KVQLhUwv3$^5C19X>#C@2hDvwYjRd&gn%5FLfT}_+4SR*v?*wgjsCqjH8xPl{| zO_j4h{(Z1-#%xAOuqf3UAIhO&4rlK9oaAIgR8DRVUP9Vp_hNtaVRX~Tw-MCfR1VMh zIzsl;9BqNT-NQ<3Lj0X1g(kU6-~j14a#ZI0>iC;~4gLkn0`5C{A8K4T1_q>cVqnaA zjk9(O`n2UcCn^C2CdEH=cwk9(jSFw~f)*20Ipt1`_Yir^YsHIN9MzgOh$-te-2oUX zcrXdyWfG-Z+g|6A(cYX>&slNMdb)6Me8-mR3f~L&!+nMEjE;6LxyN#NDV@AbuxxbU zqD$L!0=n?{`+oi2wCA0ZlPxThnLR3c_=~HH&D70wu)M90Uf=YWyGz?Qk!oGKSDQ$h zk}2p9mG*l(IWOACo-Le=_VmB)Z>>(Ro}RLDE7@(@Z<{5cH1IL#<$nlIq+mJ8+|5I= z&N(bSKm6R)u}eRp{DZWO#Yzv>#D5fhf=mcy((kQ+&>6Orm0>j$K)oq0W9@NZeKsmT z-TNR|j=^EYIlI}rKf|hjwIz%K3o?#v>u~WUmHvPzivAn!bCgITwxt>UZHLCq7t{Pq z#zEgU+MZ-OcqgN*JFzjLKa$Vt8!&l3_gANPo3R?saF2Q%t}Fr=t7@b!X)Ggy#Q;9z zVqpiEVc~#J*x-i@`~buo{s!w3`1=O<0TA<_Z!hSiUijxTWa|7vAtez>N$|IlfxVHD zwS%dRBi2KLJHXV4nXCmaI-zuYo8Nc*qo?}sp3gX*{Mqx5Z~o_=Dh@{W zA~sgwmX7?tSLW}|e}4IQM_!imC;ww6{+i}rtze${@pxJOT{C_>^#{S%u&@NNB%cc@ zyJD|TUT#p{!L)DnTB%8TDCQEv@6mVOkbK@5{ygktxkS{f>XCpK-3gP%$H>>u>7Q3g z;A-4_FHAH}ME}4lU(4le=@jX*$aydo=dmQq>QXg&uvOz?{QW3-W1IJ2$aC?SZ@S~M zYlj3bwKo>z_pi&>=^{cE>4~s$2nDhJ{nc`r&~Yo^KNsTOm-kL(^r;~V`m;MOxQ_Gx z^tx1SNY^zjN8RKfX!hDFD{{u+0I0r!GGw81VXT-K7#2JNWf&z;Uam9f`M zW#=YU%!Ok3d(?U15lGc)d&_hRf5BTmm5dx35tuwnE;IhwFMHP)=Rca|K%Xw4$IRZ| z!kdZzfE^_Ao_HpHLg@3J%6bakZGA$Cy|sd&seE&(SGD#=2GsL}IQQ@)3*^6!VB*NR zMB>*Ks5+yT&=L`YQ5-$pkzhPC+7TV{y(iqY4_y)sic7jNT5@6pN~dUs%2eqC+b3C% zZ^M1#bWGwt8d^2M7Y8AV{B42e{8DlD=y*9vL=wMts*(?q+58L<#*XH9V?B3Ki zJw0XN<2sc-AB=DD{H7A)ADaM|I#e4Qw4#-G{%kd@!4gt?lk&1I;Lj!RAf{fHDi)}u z`D57y-{2EE8XaEF_V~TC{-4qRyK@>YXRE854BKpFOAvtTeva-w+!aaSF>(HUx;3%& zGhk!fWx6NGBrMWjP#IE363wDz4lmTypo3ErmNIEojb+Ou;2{kzKyV|ATl6e2kE%Xh zCFfALwze)i`UX}y3|eJ9X->{j$g+>&*NH%59Ok|Th2a~>4M1`0!aeaEg_4{`-t8aG z5r|uMh?1sQRb!^FUO#Ae5Fah3TyMR!@!{94!ypzIZG#x?fwp+IJnJ5UNyN3o6!($3 zy|euht&;jVFSJ?HaGugvGPYbp52VT$GWL99ojMAO2wJ&LHB@;ozfq;d(pZI=%_5?h zRGbPHT4`P>mxim0+t+N!K zt+RRp(eeUN41q6hHgvkj%QG?7b)&S^EAkiorNFOo1gIKETcHd_;$)ekhvKl_*$|2PNMc4=ax|Z8?^wsGDFLcycDU)`tMqu6Dx`|r z>|5xXw(jH_F@2H7X~0zq*R+EUF+Mfb-sB{i!P1k=s^jC~+qq z9+`SYt}BuOtDC(2kOGYQLiX@Tp3-P>-Rks%{9@TjcjqNaf;t1Spz$sBbjY_4Sda%K zt{aWj6Lc}fKVo#^`Q>(D_`< z_^hjE()@URaEL)U_vJ!ol#3gqNA_tK{oVv~j!9D2h@|SUHZYhNm zPNO|l2aA;4|qFl@2((C=$ z#e5uqUxR93-Tp*&^C9m_w&BXB`t43iAss{&61iT^GmgvhxM6R^1Nr)i}(eFUxQqB6541WmxcXwB`IRdejlH3frt=nlbfHEZxv@K_I}CU0%Mx2XoEw5Z}cFhVu)q4=faVLivv; zlu%Bz8*NR%frcmj(goLNL^S8S+VOEd>IkwX72g@^ZHyUmQnuAh+sHVMIn6w97pL&b z#0+>)9mFSjSku-YqqG`)ysuAPT4_V>4)$LA6)PVP5Cd1uRfSiunt18gxqJq*m@1W_ zC587blG~kgpG9*wqTbZ;30;WdkB>%07Nd7iM+7^~4k75_%C*{7Z^oK_k8Ola*CZdq zIEVgc^#b)W{biJAuSxe|Un9!)6MZWZFIoAZP=iP8<1W2~(uUI4{tWRkVzu2Z=5ERq z4rZ;Y&y+h~Bh@D6xR$hMAk2+pPNU}5_IP%9jog$|De(fbIlBi56p;dUyxg+r6>Y>;!K0i#-RsqrPw3M#L$ zttR_v*g>^R4$Q2MKofsL+tbd4bCtM?n&Y7kfZ3nupCKzKQ;1&dWXqX))ny+~I`q=) zXK@O%d5pYp*_qADNj4j9$a7;nW6hFt6OL&1{m`s;9M8_f#wNX4t7>pOOm3_iKR=nO zt*p6NWS`-fS{p*MwDA4GCHakufw?i<4o%~pp-eOU!7kTW9J9NKv?Cxfpx^!7vMuKQRL_uae2 z(pWKf27~qZq7V$Rs~b%L?4~s_^$YW>1vd8eA~x{;d*qyxjyVTsyCxfVFb}PV7OpH<7O+5*uY|U+=6u} z@6r6=g!3d%wqQTz8V%+XEJrXw$JpzxJRXE>Wx%v-sypbGolO%NJ5s;ch1DxFv){OA zJI`^&yMV^X01%1KLN7m+8)(zR&{rHWq^lSaCYhp*?}O_EJ%xQC(QijNkVmv3dw z8r#;qI1#1}#M%F0B2ZB60UMpu3RpiB*hH^giZ`}1?y{uON-QBxTw9L%1ObN z+f3i5fR#<0Sh4(u1aDK#JWx4_q+VXpJA32NfFcS&OnXjxi|5ENanw%L!GY@YhIVGO zI2_<91TtLO-L-&*e}<&9W+7S#bqJu8eF#|;IjeD|7MGMzMs$f<{KlkSwuhO!+iA^Q zFucBrPH@ndy4(bg+TO(X8Mx7Rs)jayjj%qB@z`-5QfU9Ny&#S37pJnNBI}Obf|b%M zH5?P}QGLk%y4sU8aDjmL)t&}*n+E9n9QP1k((GqWHzpjQ&+=79=t{WV(uJ z)auT&O){JQ?48p`)^(A^Iz?3l2`4m6B!s-)w77<8EqA8UEQszn{w?%oZU@>p#X>v0}1-4?pUeqimx^>uQvB3=cDJ}|+W5Ckoxa6cv@zu!4RSe}oSb980rJl;Ul6F8zPf9rLD-C`IB_>i1 ziOR6-;-4%Dl(pG#@XgP!3<#(tHP|Svc-dw81%faj*=VTWd25KJ6 zNuZxh;Nm!*@#19&?(+w!#5PfmJ;V)PW!Fm$s@lt^Bw__BHw`!LMD=AFoa7z;jE*Jf z>2kpNs3BNg#rDb8H5N>-PD&cs&6#Kr-gl zjwk)%)#aC{D0G%J_qt}E)Izv)Gb!kT9v14B4SST&PfAy4`48kWTRWZnlwm16O<{4{ z#UG}HM-?bvEk-ZdjAld^>n;>AE7i+33QxBZ$FoE)Y2KD9AVar?b*dkXYO3WlHxh?{iO#rqx_2D%H?^h-f}!* zd#RF7IK#@t4KA>GJJ|iVoECvS=h_x+=r65Jk9KrE*r9tb>IlBpvHU7uPcMta5vf_; zV1S0spu4J)cb8w{~Ie@*ep>bFQz!k zzuIPR&4`_8XTSBPfNbZ43NFe01h z!H1V^Wk_r~*fkoibA7_Mh55T&p6uKs&JUaFl}08P?;5A?{pkbVf|dX#mDSo2{pnfM zgi*k?lwTPB?TvpczWO(*m*4jUW&EiDWBKIb;MS$<-@Ex=0|~%@r8R~BpRNf)s9+y4 z@y)pZ8W;lx^d08t{-Z5ZGXUqzjr|7b$RFeV{16yOAQ!*;hjU{=6o3vb`sMk<{~F)` z2F50y;r%ODpGTIrQUEtIJbe0J17*O#m&LCNf82@M8wg-HItow1F8|kn3^2gK8T{Xw zNe4ma{rh(>{%hd>+o_F$Le@r#$|oi!Do}ajC0?PwXEmG_$Thqk=CZGR@|1EkkN1&Q zU)~ebPjsdyRN4L%=K1;h=DHsNKOHxX$Mt{p{2L6Qle{jToSKj0wJOh@y|qyUko!(z zcz=h|`;y@4B{$=Ak()o;kP{BQmEbHMU~bqHwiwQjl1b+M;iQG#vp1?|(|*UJ@VIun zlTjw)X`0#hM6Qt%JpmW(9N8qx?${^JXGcp2If2vpk1Mg@7^dGP^Z+e@-u6~iT8!2q zeFR%{-4=*PuML;LfPz?Vg{Z1MP2jZQsNC5dl&iie$J=jRkK`B)rdP@yi;&}A*}g*Y ztdH_wM9XHOfN}SWNeawZO%GOSVKLnVv-9Yd!PzV9l7b<4Fsz-#aI= z80_&CcM};aK-nCz2UOH_j8yWK%M60Kz6Nuz(rJ|&2RUs_O@c`@4xn_7Jysx0x9W;v zap7k*`R?cw00CNQ-4CBjcT8!-K9o{<9kxQrIx7r2ZX7Sf=xw{@uZsqfKsValXW!AT z?;~tngnDk9B>wa*yF}&r_?9PKjr(d|j%6?3K}9r^);Lh^%(bemE75yv2(M%0Ql~0m z=1i$>qx;e7wqC9*)L74R%YV%e()pv@q<+%P&CU5}AqFv4W>5s6{Yb5Y$uYQv40Z;( zWEaf9Se!}n%BuBLL+u`F5;5tQB`7O-V2~$=R};;wW1f>}{~n((kg*;}bI!|Y0d-IJ zr{VC?OMKzKx1f|>s`iSSWYCZMeHr2eYtzl}(k?t-wgnj>Ww2`}o#8}FwM)qkG-58( zuxdo{OHu5YfzR)5S}pgbq1@P-i9&}eQidj?-;C0g>0%yw*s-Wfd z%2C}`Z)rCm&ZP$AMnE2B0Woz>?xzkD2Doc%n zn-ep9{kzYh!CvpPEd^LYeutqB;=_&ln)xcfaaQG2yScBe$)~3W)B8&)@VZg5VLTbU zk7OK{x3rn$m9D!yJfe{&Gt(@6Db$p%9OGM(%;!$F>{qEpC5^X2n~xaIRtJyMxCt2fQx5+4K!OcKV_l9o8_P zwdPA2wj(8Gk!pW_mSW3=J--QGMv*tsZ4UpQWImtqBloOls1gs&bJOla3e@K7)+<+I z*7>u;hr*T{G*`6`Om*x#9vtNlRB#vFI7F|N)TgeF>cO1~E}JXhPhzsn?C_*2AgQS8 zfm6j4_*pHvB)F#eg-;Ob-M|p|x-Ii_vg3E^9qrqiBWIxQ z)=BR>FZ|4N5T>_UO%luA}Wn~JHe*O?x6FiHMUc-J@WFXICtHkG0r^z zb;QD7@j!T3TJ|b;-sCAlgw*mA--S9Geu9$FFDuTZ&WPd*nJP>Agp0ke2v5t#HeYBF zxyJPws)(1b9K200FW)zNNk?-;r#0F)0ti0s`(p+KgD_?Eoe~f^YhTJ7_?tZtipppa z&5&f!LR4!0JeY=WM7yh{X3kZ_r}{pC(gAskHR$=uv#634Us4^%Fa(Kx{tM|j3&{h? zh=;XR`8t{pb+Kc{3l|pIVe+TSJQbM@t7>qSkntj7GUAu3Q!K+-3sb}2NtiTi44kxE zQyJqw8s#bQPL5`8oGMZx$1A%?8~pbl=p>tb+6!YIskrH5ic|A2L*X6)kZEmUUlya^ zi!Zq9QIku2d1K^|K;l{1@6>D-NXdva%J(M;>!XW+B-%>4I6gnfAgti^Sbp$~;6^qBn8!f+etH zRtMQ6Pl=-5b2sJAy=T<&Datnd<7f$|X%Qytu**^X*Gm9G`*s7sy+>UAD^oogA^hWa zV7m$yL%9ldF8=$!Q_zNSScCZG>#uVxT-Jv24A6If$0X`dYsd%3EX3`M#^2EsB&SsY z2sCr5Gkx@L%m9Ei^BmpQB|RAr{1cs;0dyOsniKf-H(mlLvJPO&|9_heje}6~I9GuE zYGk~$O#JtQ8a9Gw9Kl@1@)q2Ns+Q0j(PdmrF(T8Z~U zSUyQN)tkK<7Zw-C54Yxubn2Zs48IX-RayS{PTbl5&(sRy0YaYDBAI#_m%3DhnwGXb z$R1$4p6nNK`g|Vy71$Rpj!o1$-2E4252&VUk5}>HlTB6IOg~zFp!2-t5g~3Yq`0pF zcI=F(FpKC(AKas04-l1MDTF zvBl~X4=VuVVDQ%xA0&L6BG?tpgioB^U&5f0uMXNR`%;BQs;snPO!fwX{I@@1|J&CH z>^o(Co{FnJkBHt9SsLAi>WKZVVO+URz1$gkQ<9TV!Ufy6$Wg$rg6i*n_s%KHdF;ZC zj28rlV3BMR_fhusXw3!Xe;LnxbpWP^X=J?Oe?8#e&ocW6EWU~Sdy)UN3WJQlFuQB;pB{qy8NepS z@2N!pDHXwejYsI{Z@x+K&z%0+R&UF}6C?`JU;9rhE+{L(8=m=hU4QXFLKE-=&-@fA z{`665LcnK;^ILzPrRRpIzk?^RyO{Ot&)6YItqg{x?6>sK_WU(w!9?%`vsa|-ezk59 zkAZptPy7!KX7JO!nDgBR@K?yQm=}M2A9oKpKfOt~7jXHnxP`in+}1FSYU?E62yd8J zlJ^dYiBwWjXa@{xQWwDaTQyRog_!S%prIrgMgAO@*M{PgJSqj?a0tM06>ZhOf|g+( zn1kqK*El}Ag6i&JPZTD-s6M$n#Rr<5aG2~ZH?Ju%~U6zPWh$tRlOr45!lKHS(47^skb!l>(GbJWjfCHEf)4!<~-c*EAdh&i!#CanJyVknVvGaJ?S@wyLL( z19-2Qej;kbe9O{*G023^t5$S)Y3bc=jbTT4X+59_0v>zAY9QSkj9)L1OiojIH`z&^ z0ruZA7FwwF}Gwub4ssH0&s!IX~0Xp#=9v9 z(yR4O>tp?$F)SOap4%O?lVuk!U8}$&W>8PzhfSQNuhJI>1(LE<0l@o%XQRQuW4$bZ z(rHM+xnGp@M*x+VY1r!V$xbg4u$(6{#LBA!S%FS#BRyoC*6X^{4!wM+WV*&@$Lr;O zh$cY#UdD}TI|NbMeZFozJzi;n1dOdzj{oR0h-v!gyiUjN3-L&<0!=l1bEb79Q}QOG zR#hQLmiI@q=vjjkyqw&oq2GKc_vbdz331+4uQ;3L)2g+$2DcsU`r&|`?>xQ33Z;*3 z>v|w7vz?~^A5sM@S-)Gy(vNkn8FY?TIU%*psJ)dPPAGVt> zGZ}kiZ}o^``3w=sr)C|y6JgOG_BRUQ)wu7kuRw|$8hGnZw!5s>$I4X8jb+v*YRh5A z$ZF?>D7Enlvq9~gVBT$s1NC}mD;}^OMKTE-*Lmul)>KIy^Y~@%DnHJAX#m(WDi+Yn z1hIFKnw91Yoq#tddr;;jn~vvlvu!&9da4P6u1u?NmQ++>E}H0r7kVY9YE;)lV=!9= zd9;*LJ=N%u019r<~ol^xmbOFp`cn%8Pi2Ihu0A!t%efATFG_ylPXd+*w zKs#B_>*&iJ_vO1w4!iy0_3k-xDc0Z&ayf20eLr+@0fwv`)!wApX@VWsapZYI#eWU} z__Ba5SP93gNw?Dh1<(xRXBH#^_ zPmnx!*aWEE@Bv)$lh^2H?ua_|}6F5_?3WVjDfpj2oaB;7aro zl)H5)Y;{M>6M|35d}YyNK1^JjYie2D7U7M30Yb^`h}*QE;))&BwFbR!9YI=JI||%+ zzxVlddZW7&=cm0vIf2?yGUQf7cEge6;5GK} z4C0GjQH(zXIsi2)X#~GGOukbL=KDxBpP>u%9N$p|T4ab>vL(r9r~*P=e@YNz6y3?*8b6Sv`7w*Ab+qU zzHe`DKcUPgvjza3WFotHmD%7!7r8jG=}0y!g~4YFC}>3Xc2v{hEWQWW=ZWvc3Qv?1 zEtXfqxpTb6;h57&B^GZ^czi~4i1;rz+Py*d1GBj@%&B>f=OW`nu({}y5fst$m-BxDCz-#@ znD6$5UFA|f4oqcFzfR=7tCmvH(UI!5?p@M;|45fC!y zQ{Zl}&9l-_eI`XWXtnsDSkO#f2$`MYW){_C0Wn$R>*xZHQZ|NcZ}|iJl_{2@5pSh-GPvdkr z{b7F%%Ces8&aXqK5~?miQ`t*UBmzR$^}ZoinM+Ex{iUx&c2Gt3fqaKFPtWii&(d#u zRkP``Q{wI-+iN9u;qp? zSEE2fnekwfT}Jl6aOG;Fm_1SHvO>Xak{4ud{ioXFC3DFjYR=HbKq#2hN)+-y3Dx&u zwK9FtYQtlpOO!-qcZ$r_waJh7)|OC715#d{1x<9DN~PC}`HSux0@btDqn7QeO{*`| z+VKU=OLrt36OFPM!1G%zM}uSPsaiHFFZ_ojZPL70xNbWaFd6stBlkwk$dQ&_Y6o;f3^FJe8N@gpb%pu>6GET`6C|0}so z%`lOZT=e(K?`h*{SqoYfrV52?g&O5A1T>L~1;Pv~UM(OfPD2YdlLb_i@^vHfRz>Rx z>E2XfgpF^xBNx z5lX2!t8Fvx1P@1j84xBsqw7!hK&?z!uGKe2ikFDwppIyTGtBCyC8VnuOMJ0yvYsD2 z)bWY!EK)6sM-+RD2>FRw>?Ub;k{92B5vVFy4ZV$TvXI8kMrXH3P8Vc7*pB)%oYSAu zcrb#Uxfkiqb>^;vrHG;z+O54K2?47E4%ds?s~ch8=|}HKx;?zuq>fxy~d*rJTCV z@~R|NTBtOeJHNSZX>CYJj%h$;Nq3N)*m32KpujR3oS8}f5Kdoa7xN>3!I8_Es~9&8 zmwU5)KPff@mcl1hC<3JD(@lM#ddNfmcu=!f7^&iDy?-xM2a@LrGkyIvWi_Wf-Jh5Z zJeO(K z0w+{Ejb4#Yv{C_MMOXS^=*)I+S{GlrEUlkuY0sMeL-_8k`rA)GZKH*bXF)Xi|+UfnCGzoV2)mT zOLEU!kPO%KbzT_fY0q&u;-v-qmv!K>RS#w2ajLg){-zlp)zjT(ShM~TuV6#qw4SOGjPs)>vJ zKaC`SQX2JlWEcE432JH4;FQR+kq!E@F;o;ZYB+veVff?rxRFg@R4WNeG=Db!pAVHV zNU%Ma(rO@6vfuCl!MROAB5+#;>M-c9srIqF0l-A%RVw}ofJ6-dys7|ok|s(AE9dVV z5CXznToa*4{nubtSW3N4-Me~vD!1m^wd$Rbmfu3}g2481cjFe{Ib95=2J?jDnE(72 z2c@ROIfn>zqkvIZ0?si~ZX!qi_@y_{FF7gW<;Vdm_KCbs7xR=U?e6)&F5`fTPc7dG zLx7{had9BnN-f0kRW{Ss2^>}*<5*3`0ah;r*q6h&`xc9IR-ffx3>cTDMMCWs5y#&g zS`cDe=E+oviDD)Ap=(%M&F_3?_MeY0-X%7v8 z;As7D9a&+8;NCyaa4LL^{7ae=jK@o|6SIYq<&5`vp1*I<3p^K10-PlFi(8a%QKxl&vDRvE1yaT~CtOwhq3Ipwf|Gmq9 zv2}@ay+IiK*9U*Q(JzJJ<9U%H0s~nV_-hsa+JpDc$#z-;(SMYIAIxAxNI3THKLW`w z1OKEX|I{0NEJ=Z?vfqq_2FUdHuD*Q!z6l+R|DP&`VAc8iCdYbMr~ffKF1Ezr zr(*tN;9PKdy{-7{pW%nP`XCY2v`sh6!M=5LVhs|xG; zNk7z;VPB#OoL3L~Dqgi+mf_!aB`q*D)PMQ5@4tyes&viem@d|p&8vd7`!`iE^s;nW~6nV)U;E|eomzvTi!&G!GIAz;3c>Q(d#U?#qEuRS7vqW>BM#onU{+qSFDE!dZ8cz=5B zArYfdWgAV$b%HiW+Y9@j@L8Vul{BA?zagNqb}!VbF3y`iJwB+ObVe|#M@~fQRppDH zCURKCm!E+A`g+qbsvM3vo*rp%b8z|a$YXES=scebYV}2}6MW_Nkbv7cl>ouk?40|u zn+<$!ROJH6%9wGGjceEFP3A)a@Kpxb@zg>;m(l>o^k*xHGChDhvTmt#a^}3~tPZ{S z@4@s0*K)FM7%GKV!^UK@HT#7FCHaY~q~Ua00L?7Lo{Z-hHTMj8}{}_JERZX*Iydb)2VoY(vrMt4ieOc{!sdYzY!Ky|A3 zUIP-1txzhY_8Ot40B-kA607kltb8|;pn5~jF1TqsP}kDiz-rqA8J}|((AlH|4qrZDAS>c3OaZn zM@m$XMkjOVMy!B`h@b$dBd2@RvZnyvLd3nVL_J*60kUrVGmYGvHi}q zgwxSL-D(AVc+?lMd!L1+*Q$9TT5H?tz?Y`_G+dhbvMau34a|Mlm!f(S{~BZ}H_!tG zeP-QUmB*WvzM8<}V%?(U-?xzP#NZ8M8+pH7$({u$-T<7OFusBMt5q{_#Ytluw)Vz- zvG2Y=PPX4%C10#MPuwqTL84zK1L*jLJ2^JF+LK- z8M>6Dwl{sSx6?I=VL{Aqnr}(~+uMqSIz@wQS`*gGrw)hwn4u4w*)h+!U<9wvq+w{tw~1%R!t|xRaJ-DmxJ* zJ@Ny)98eP}O$9l6Mc7oMiS_F)f*PV*bh!9Tqg3w(e5pmVKbbF2qy z10VIa?PicMeMja?!MRIbXO5yWdmkdt^Ul@MBwq0X@FvU@D_w*Z&hJmU1Y#zIwHp>cq4z zVQQWcw|{#P)EH-*xyMg6xU3F!6gB0j9I|OHGI9UhW|$c`)oiD5_<$%jbL!0KCohtJ zWJbm|TF6&qe- zBKfH*H^irh?#F{cBUI^!BtoO%2PFBnt?#4N)dozJ8zQnT&B=09ZIwMLt~81junlB- zttNCt}KZ#wrDxQ3-^YKPUkl-S&EzIzHZ6=2so* z$hG6d^LnuAQa{wzK%*>K*Z`j)o2l0pT+U2K#T!2d$~0SqO4uu9+Rfrzt(5vw z1%>s}3z3@ox-{&XA5TCLmvcK~%cg3NgUu$*u*-QRh5ubP;;o|UDSPR(wP&#QSO`0; zBr^Jy8kKSmNnu|k7tAHf_vxfSHiv1R$D~?zm8p3a$+3KC9=&&6wWLs5__VT4_&@&_ z00}}qh5bfm)_N2XZ$3XX@GLh1aeZ4FyU-hI7nSv}6c>u9#G|O7h_XOH5kx@*6hXQ{8Wp6wLDCKokdW@~ z?ots1mF`qQLP{j0&ov2!@7v$r`;T+Z7(3oEWITg+aj!e(ocHy+eldssWg?TB{CA+9 z?7~q>BlV~S*$`Lq)qlI6M`JHu{n6rjAmBu-eJmJNuPW7C+a>(NYrS^m*ORl@5KdJ8VvRFma|HK zvE)=ykMHv)G1RcT#Ti7`u?fM?5tH4!ldKV@!5hZWces4FAK<8iMw!Gf*rpEP=ZTdb zbW+D(fzBCTg*Uvfejm-XUytn7(k8x4y)zGVjk@9P$o*w$*tbv@* zItFuH1PQ<5C8sNCez(5I_3B^Xhb7pbSC|NNh8m}4G@zA4kmKV0`Zx0(uQ?H)IN?^d)1 zXcZ3s@;+F#)>zf`AE1x|7W9XZ?)KkafffGVk)pMu{rT~g5g1o>3E}NT@D%hV2EO%y zJ9Eo%N!8&1zwM+CZ~LtWYQ9kKV%dI6egj^sXnobN{kQiJI=*PLrL)5Om5|eFROi(x zF<}*~caRr+0B@_L^Hwf%EBs)A7!5LkLLK{?x4i^KQ6+ z0#@0`D8-GMrw4dH?Q4(rq-)jq(q#x&i)X;+y(D%t|3!6e9HpAYMZm51WK^>Z9 z`|GC@)u?yi)`WxB-4FKpi zuuV{W+6UHe@|_RG{(dcLF=#-GAzqo8Phlj4O6k!bAntJsL(V9l#c4UxA1LtpmTDB& zEf{}q!qT>gsKKeUA!Z1E5`jPe5PP%u>_Z6>vA?6H>I`%nK5~ZE&prxcRKibfAJOMP zI#S{M9yM*9N=7- z>1NHcesI!cxHDPO{eRC59pyGD8~`Fbwhu@hm?#lGC#biLXwv&|fIT`#5KHs-eEHEt zNhX`$et>`BR^8_PM!N9~*Uy(m2_}k8bk%mn#5-trk^gh}@!vzD|Eh#CIwcFb7l*fi8KUZ@SrlaIWFyi*^i!+3AHeWV*HPuL7-hY zgizxn}$rd@GZ$a79KAN&joSay35v?m+) zmO%IO!Xn^JRY@CA*DL$8Y9RuLIjmqfCJ>ect(0e=`D*8$>-rXA4LWt%7>p41E-tSr z7QVRaz57vpcKsH%=17h4YQ|IxJ}tJfllw5k%+S&-2<7Y8?7r#Jh1DN(V+K>Zt`!W9 zU7aPs#wLOkcrx2H2}$vakFn`^AmO&#zxY}#rAnVGrJD!d?Z~ADftSZ1nQKO_DN?XA z*VsDpCUj_WK(^nE#1hqZpe$E$2I`+$5k^S&1-CM!;U1qqS9#=1h4L=PntRSpYSq=EjqF#=`iSS0bOjf+G z4+C=|hKx?^OQVB=Ftmhn%?7NBq8q)-bYAgrPXe2p4IL5Y-dh1VHxuQP?{zLwuIL2u zkY~XA$|#@@G$q=*j#_vSllUmiJ;Kk6G{L!bj%Tlm4Cq9qz))B@b!>mtO}HyBxU((x zY*Yo(Qe~mCQN+9q>LcN zp+K8~?K+q6fCO=qD;X}&dkOEdG9&})xNa-A+w&hn-wYZz>i9Om6u$-ish^qomAo__ z6P8jeSr-N1t*;Um?a9b=AVQTjwtC|8%BWgCGI`jvlt(2 z`oNS%?H{4gIs%T^GuuI3tVcA)u3$hFPK=pwnTIF}T2r8Bu8fKK-B>DPaUHCHI z*dTkg`$u%tik^i;&1dMpt>%1qb-EL*G80pN7TFcI1Kt=BO3TChN=stz-i`N-izrzg z>(2#uW+;9io+Uf0dz{#z)Q6(7j`fG|%AGiuoMFMrA+@+4DTSZ0tVlNrg0Mn4qGc>| z*440*eKq?E$e!#4W6a9ZF9{I0%&DXYc*Xhb%oaD?tf^pQ z{4jAz$523LR)u@u-NyK_EOHlqaGjl0dOfwD-hW4{=7%EO_m*YF1t}W&hNxT2Vc9&LC?NsQ}t=?KHUswRESIU!gG$(0w~gJM=Ymy=F(#h2|~+Q&@ex%xUHH+Ygf! zGv7}Sd|0V|c#g8#g-G)?jJ`*~k_GoSivaH&=keo>)en&XnfI2P0|1`m+ZIlWrJG8feu*P)^(kAAzo&d@jwtC!UQkGGqQ zz}hO}5&=ccvxZxnRna>+4N&!%GQE5QC*@*6O7BPF7PU!E!g~_9372k==;Q$1hem8e z;rT2i9-$A1d$_y2YV!i?iACX!a?GZWU=h$B^q4K>pqSp}bI5t-Q?RKA#U7{-+9uhLLbd_W>?v`r9sL$HAEZq{P)kQtzB# z(}fK_4MQlOqM}=DKbHfm@Z-HXOAH)PvIA!_qdo<&@j8)8_r%JH*$l>D!hgR>#AaSs zUcVnVq+EDuP)N^tZVI1go$5{LqiB*h$T@qaSa6$XQLW!DvIB9Tu0uvTNLRS?^2$OS zYLDb-)lk&H|5~e&g(yxca?0=<;Hd|cHz%9lPja;dSfK)=8y{J|{`jI&ctN3U*k9#2 z3oU;okP~(dDLllHKRZew(tWI+6$Y%vAbMOq9tSoCN0>7&aDaxOV2qL51N_51nZ9gT zS2|!tA@1*|Lw9u^?yA3&`|$DgyDD@rPBz|a@4siuKreR-a*N{SQq{P14a0Av`JjmD zYV5g%U2xxi3QCB-w{&AtM1x#cE}={IFPMOl)((D8A4Bb+l`X)` znKvFrr4Iv#&(=A>n}g`@&O@=KTSu^D0-SSnwV2k{UwRnAFWar&5C56x2uOG*z=MuA zlR310b?bldAD;gITBrI>NCTXorVLMSlU5nPyZz&p(&2!4q=GeGyM2=Q%g z4qTb%q#f$L^X+CvuC~8-qtZ@R&dmYJkfNg!=;$h>qUgP^uz4SO-(Vk+9M$8to2Hko z-NG7PU9`G;Eo$Kz<9SjdQUaC#jcEvhOWi1a(X{stK`bx6Y?Q)Q&4=z_r%qFP=(k#2{M}_pguVXW?yH zm{DLcd>ht-Ot^-^*10b8mq@G4&9f%wMFs(o?nc>j16jC9&_UB+C1X$e%Xjz;!SB6iKfgU)Y7WEVj_D1k@Q-jbN}P&-U}cIMoh zH*0jno=1++&X^sBuwY+r@q6{^;GR5WYlYh03#m3%mM5GFzfJ$BqJ3#m3q{XZ2grS? z=9C(7*-zdB$z}kwnNcUWzwV-H-4JL%XnE+vb!R+2W>+Qf;@>Z`g98KY-~!e}e%nv} z=PRLapb3>-IzoF`4d#PTs>>1>r!eCy2*20%kk;*kHUbXH3$hEhh%q0?z%QRvYBkp3 zoSVmQQc3&r@_|W#5DXY;Z*7y(zBqLL{lHAj^n75~H^bcS?>Y97BIRRhbptuw@QNWY zmi@$y9DUu6EHpTq=jw#N1QKckt^S>)Xfv5F3Zw7CK28Y&87pI+*cyH2sx>cB zvd08MS<6KyhHq-R;ijki@GZ=Q!ZEn&)IiR7%EKRI3gxJGyNH76qq;v+q<8bB(1c~H zkeH*#!vO5T#Qu^Y72iAmfWO|Se&buQ!9+ei5{!i*Fb z^jprTueh>=*nHh>4+yUNJMu(hh3%voau#ap7hQbRUt%QbjH7CLWrxy%38qU)l{{|1 zOH%YSr2A5xqJp3CzK z7buAGwS!_%l?oB;i{J%y6)B)hl9;=L@8g`VyEX<~gM~{V#n;IgdWwV-S=cc%C8Kbq!9*^kP+Z?UppM)d0=9*Vs_TaI;7no^x} zn^$*Da!?YIVmvaUhWh^Rn$)=U*smGN(8Ou=H5*|KCW?N!+Y;;N@k%XA`YT0C*1XZr z5*7JM4f2ieOa=QNG%jm`Vj{8TU{}?_(`7S0mz;>8ZEM4vUnV^nRTt$AvcVhvGJMxa zP0-b@l9EM@!krxFN&?xQ=7M7)G(Xy~@t(l14A>*H>sVL(v^*h;RR>~v{Rvd44bN?CGvYPuL5mwOr_|A zio=5Y+3W$J{7hsHkkjaWu;ylH;~ESyR~c-gW}3O8RZT|8Kb#%IInu*EP}t{6Y=Fd+ zy?bN&q#GHU6&zCi1iDl5zaM6V$U{#)Ki3Nmv6T2y(7!sqv~cu^Y^H3?|Hr>=7F3-7 zb{Kcut{maf~T)|Z0L%r&M* z;Z}MHx21$=l@5z*kaDcCbLg%*s_9B!>CJYAKTfKjcja!fV z25QZRGPkI`K0%3|E)Mc`XF5A#?^1IJQv{r6}!D|Z~v_c+?g-3ZCff} zUd$g#gZBfOe>Hp{{+^Z2-!JAB*!|z4G!mRFP8Goov7yY_QaO8&{#TSn6f;h2FPwhU z#eG?SsUpZ)`!8jb&&e`k69?em^kyjd0lGTyX7ZDZ1r@O_6rjkR5qQZw z1__x!U~~7*`xiemWO1L~|6-#6uFFm0nAl$^T6JbqLwVQoS5I20fm+j4-A1AtZ|2G(ss~TW`Zvl+MPbTJ% zKLfr@{5>@+pC#WO#Kcs+oIdKNPCEU@0%g_mJ z2Yt*K6iYXTtr{*83L{u4eQs)_gTX701BKjYGjsE|vkuU4zm+@j@qNSyV@j6^Uk&`R zAwoUSn4`3|QJH5)zAHCv*n=P>09g76)ifoQw;qfiF!nI;(kD--^hI0y`^E3lq0LVj^v|G?BgQm`xc{S$1Y zHwpUI7fiqME0^5MhtQzUMnyjb5W86;GpP`D;kQ-^w766DK_A3?Or9D}@3Mkmd4{G9 zh~WY{Y#~-vF__cxnWY18C1T>*!Ir*m|DJmz`||VfUXCt}T}MoK%NZcYGoI*dahmMw z_)YdqT22G79_jw>FYW1-$Mj)fnWw(obXMjTgROGh z5@Od?9p?v-ogh&$Gsbefs~t{J8Nz)Tfj-k^emPQC)%f&uhz^Vlb}X?EgIq?$NaKlv zC?p0>TCF8ZSH>QAoMhl?V#=h1_#RU4i4TUxYMdbgRS*`0V7sasmW>ku;oO7b7t67_ zsLCP!3MV!&1wK%g*}7}{E`=gmrkM*sCe@XDd7aebaKGp$P)>&{wf`K*OS6Rr7%$@d z#tVKhx2lWz$(E73{Rm*!SJ{zl|Ca3R$dwCNwN_Q@U>E>QD(p}-|HSmDXi7iZ{V}xo zco_8o3=tUxM3Nc2p&<0ad*EB6I1Z2@-Q&^dT<7a(<#s_H$s1gtrqBIE{1LQ??}#y7 zv&u&KbiG!_79S0%FPUkY6y~Nq==|;`iY?+;9iIoQ?xC)U|9R`ATXnveTG@9sm~`#>0HfAWTV zlJnpH3HRjD5Y6ftACi`*MzoE@2dP`7As>J3treA5269_{m`EuI-e&2AHGoj}uz4c; ziGkB%HNRw_PqA8Byy*NY;>O~|l{05G=fugkvs=bS6SyC-q~?(m7Tc@}${mlR8;NjK5Cs$_3u^}0PcxI4IRIk8sTKZJz5 zM5}O7RIW9z{*+sr4rjPP^3Hw7P^a|#QAVcbRP|mM6k0%=rVZ!ES3IXI6hXG#2IlV3 z-(ceEy3+hs;xIX^QoatL!CGPF5dQvhbYNg0Ki)2YHC`%mX{mqJyD3hQkI&_(ZNI0{ zv=~;WBO=DMx|{fv*gT^HpuRO_@oIUg!$gb0Imy!juIY`#3^9MCYdD`ZNtA=3mc614%t4y-AhEEnc2KhI9!pC@xn+($3^ppq!M z&6VEOIYbv`{$L#GG_u$?bL`&(P=^ZQAci`=%~RrOFX|Lf7M&v-?{f=;CtEbf&Pn2=7^Bw2uL4paloF zadbZmRWGRQf7C}lrn0QhRKQUz>6$I1q`<_>2QKxxWUVT`tnM~tN2;^HVz$mBpc^e0 zq(X2{$X+l()lpzIHbUVqng6r8QT7^E(e9XNO(^4Q2(Edh{9R3?cCl7;*glKw9sTRZ zOYk-g%6M^-C#?R!=u6vPe2lI;r$o75%%m+NbAi+;)xJ=w{EOu!L*F{YWp`l%a7FKd z#Pn@yJwXe`6YHG?%sEBSqvUso0CDc<0)fH(!G5J#p zZu}*PBZ_!M;aZo!(!{&^I%Z*5uy=qwa9XNPG*O^Ctm8PtZzp$=b{W}jgpa2iq%Rb5PhZ86PyNU#u zZ7d@+iP+os4`LgBi-wJd+jsf_Yz9@s+ z`b7_rCoAfxMCMlVj)ohqbJ#S7Z0i>hp-7S&Tp?>dG9ZO^yMWw9E8=D~T83B|JVNUm z{+Ph79-l;IVO{t&Lr`#B(5m*9%<>mN6)so}{aDI3Hy4u4D+A-dAxZ*-n$0)|R7i=? z(Rt{{_Xy5>-Nj|UPl{*#Jj^7^_T`Z2;QOj;YRq}$5+*gTkyxFU1HYyj;)M=+)NEWt zpA%+{VrHV9A1;vylLUJI=LwSAP7BQKG>hQpSJBSjm->a(EykOf%0w*q< z7~7BT!d$>8GvE@T>H%@!VXy3Ga%cA`A z$8eYim`XnKM!2orA-H&$v&ogZ+jzt%Ik?W`F0w6Moc}cJ*3axlB3!3ZK7Lz+>pNJ^Y3lY@zsQ(cxG%0cj;IvNwijxMmYvOYT(B*vt%x()C@!$ml-ypdSv)0W`=Q?+2x?`p`f_k( z0~eDsmeZ+JY&Ua(OTM1#Ky!FR&GC(SD}11eWtgUN?b}R%XyKYqqwl)mH;m_97TeKWon*SvhDO4?@ z3raGCi~I$Wk#P}O9ub0F>k5B^h?Xpf6Kg}FqfUcNx1(lN$E_e6v;#=bgT8Zsayw9V zVgN&&MKwP5=3|nh29-yxEhc~{B$*TS?g_GNQS@|Jov(E|VGEJAK32do7TiIpDBTeB zISUui3EE;q1m|m*3qJzT-DQ2RugoQ@~+-QpOI%8qKq`uG5AoBK5MybN)E?yYs_57c207*^uw%h$k7K`K; z24L)rl8{gnU~UB>A*@o}s5q<^L8Cd=W89JT0kuk~xb3pQ)m$ZhWnOa;h=ef!p1IIe zDKwXTBoN}xJ$nV&sj?v+! zigA{zO~+3bj3gu)fGpzYvvmOruOzl;aK{bBQ z0C2y+8K~QUyo{d)*qnh`TNg#m&${(P}ttIB9 zT{Lr`9h%cjncFv0Ye+Dj+BIG})ByoOarJCta1(;a+91et6kM0+MHe8yS9Sqlg^ba2 zfvBY@U0X-Jj;wep!-gkrF$eXU^iWC`NO2p}8>E5HM5O_WGz$y~R4TGbFYE{Mmtm~o zlY1@bJI7?Wm!hP?K^fML^mr3yk(w)2YS2juOo+w50;6HA#7e8bz$Y9IH;Q=ZNMi=x zMhbQ}nQ^tVy4C8#(CEmZRI@4f*Lhbh5uGoP${c@XM&>yMQ`dLMP5T)7eTe!Syys!{ z%)@+G^~I$SFrgJb<7!!GMhwpoxd}Z{eIn+8?5h}hhT-|>p{U{eb}Pc=?|~B10gPu> z{t&arIO`*KB)Nm*XpXBVip=c>RrL!(?s(C_Uz9&4W5pR{u-pO9;^KXudUb^LJ9xbw z^3Gd?uphaJq4ltz4WA{$5bU}ZC! ztq*q(`Jck7*p&zoxCt1e1Y_G-hJrADr>x5H)?YHhcFZ4F@AGg{8*)IOu}Jq`%>L6@ z@MdKy)$<8il-TVQiM)*?nmOYavb+Ej^BeQN)a&PjMOHG^>&ssW%xB$vL=i%7{4DuC zwMxa#CrAXqSe^Q^hyHA{>k-gFmgr}8BwiQuGG#I@&R@^8TfON{T5agtH<_@P` z7Ne8pjkqTjq%&>eDbO2}G>HKpD*bFDllHG&esWR53U5WF=9>TpiNN+rCrM z1O1hmQ~-k(>LUzlBp1|i!egh)*)D1&a>+(wkg^Q(&+PG$f13zzBmTDkKJ-k~07~5S z<#3nH!0=)0&Fb2HC#KbUcTuRGb_h?yWDPA;`c9N8bdopWcO+JM$B{6IjL8Qtr&*h|jD>wn31oA(VfRxmwt&hK4#$ZRZ^T&PFw*!+sBW;9; z)rU^2N!O9F{QIlcO(7)ZDHEgGF|FNUw>!uE)O%X_EhWzmrOLk6J4BZs6L7k9ttKTD z3Hx0cS*}NwycH}0&_YhIpUh!f3v3!vBx|RcV>aAYq`p8I7)8W!Yk+j~2O-MgtST1S zMoZFsgVOKN1cm_(s6Q~44>Tb-vx$ZaTTApRwCC&lLTB8ckDN{ zQ}uyP(CldS$B?2;WZ@zWCn8Mul@N4m*Eh)-WQfSW=`aG@Ev{W0!GWrMlFB*=25aDQ zkeCfDFuAU-80h?5VA#BVUI921Yqi7|z*th4^m5-&V;_b+LyHte8{mZZF09O~-^AnL z1ALgLu1q|O5CY@$N@4SM(a@s1dMj2EM69W04bdXWz=PyKsuqXaSt-YW+if7&;(y!@ zc8UQqgf`8-mkpqsIf;F3eQ@bY%tInV>9Dl4Iz*jDi%~b(g7|nH*wDNJoTw!onz5gk zM#}{{FYOO@A2fii7GM`VBG}!vWDRH#XkYLaT@R^xSe!d@Gz2i!J?A{`~?!Y{Q!v^>eXeE zM_6neo(N?Q53L^DvBRYgXE9UE@MjG8V)1k3;$s4G{cF3vFg9y+Z zfD`S&)*7sB8-b`q2s^O;jLdvcGZz#CC)<*tC4#V%{mzNvr-VMmZ2mf)H?g_JbsWABIH{B7$nMia1RUgEkFZ3fTkX3cQ5e{5fE8 zV$@frCD-@|9%me(%aU-_t265pl_(np1Wt6M(u6y$uEc0m?PG%sTy~@tAwFq0J@n;s zA()C(Bw1lO^*(z(BDUk>1n{2h?3^k|&StpTsoJcR6peX}0~tr#R)VRuZf=$!X0E^}y^z7B3w zxd$g~*I$IBbZLO%^LW1?)DE;m%jb*V_HZOb%Ya0F|0S8q4C7y$Qsy* z<+os5kefT${>4xyA(+}k*NN3uP(5_iN@$?y%D^Q*vBt5Sw4n>XBh7H*OR|u@>U2K7 z714E4)xF_WJ9com3i0#FGTN2^FXpMgq}{+)ZHZb8%c$VYtRs8NAosfJVEJvh{TXQO zVk~eGUOQJpA>PO{U~ltKg*V(mrto+ahEze~=bMYkm6aA6NK#j3V^8a#u>GFPH=xt;4LZ2S&=U}kzG3ag^K1sX zBORc9mODc|Pz>QS9cUvB7?zof^}kf?9*NiHq9#S#d=V;eSi#2PBjixM);=XlDnp5y z7%bD_aJ(6GJ+s&1ByoCK6fKe-2Ljp1rF0?ia@;?9$TO+U{Enan*#mmIYOV!4v2u|M zKC+*!SMk-_xem{FJqf_Ym5J2qG{d6tF5*CQG{miq7og0ZT%+y--^1&(-jZ;AWaE}G zqz0=ZG-c12IYuneo=!t{G1-hA-zI$ah|aFP9KMi2R&sJ6350zBNzmN=z51Gco zFwg4z%hF+i>gl_Xl6R_hsGp_eI7hyYY#Nj*F%S>ikq1p%oUXowzX4h@<8iVx#~O~l z9;r}KxP+k1?RXku z-N@h(a3zjcAMR^9NO;JAkAz3zC-NjGdP4=jlVIrfq6KNGIf#aZ-;$!bfPD0gz zvcx2j{Bi~n-+T9I%9i&(P}}231&zEB*B1~L7+CT{4>~+nHSZYvq)oyqjg z$)-8S_!rP7CnN4zIwpNogmEy^pStbir3vGfomh9h+$n`)3sR&BG>!WTz$rP=kvPyt zuE}syE^u0nuT`9DOw)cmKUTjm=5DnJt#-jUG#=Tp{=JTi$;2cxs;ZpKf(|?Z6f^W9 z%F7piA*OMXizU!5@}A{~UylY?=LY^AsCk~qcmox2%&~3rKgqqh+i5%+F23G!^wtLFG_@ox zza`Q8<=1x2a}FSSCUJ_a8Z#~|1)SMo-CNd;ao3>lO9?up$2k7kS7-A^N{2!|_0|4>GNCVQM_~r|~vC zJ%rQBZPfWwxVnfEq3|aF40n+f4*Haxz+tgU?X4C?8!`lxZ`qK6rV9g*Ap>m`hc*&} zQU#%bMd*pYaXT>Ca?k=>bYB-DBR4=I@9ge=5RgcvzzW+2u_efi-U8WzV53l*mGeF9 zqfArUb;*MOJ$3?@@$N$HFxhAPJ6vwM@HqAkSv4ogu+NfC0N4?7fv-Z!6GVuhz+RL{ zk7CCP3k19_nJDEDpKb6NqG1nTx~50&ytDt=ZuMG zXc0JjV zLz=&G=m??FcD5yz4gZe4EmclSGm5uIFF(kYxsXE%AKN6Y(6Tx(}fqt z6*hrOcSBLGMfn>FqH0Ge-qf-aVMj$WNvqO$9Us-iZiIlDsc9ha4=T4teYEq!6I%B) zWK}~=cKB!2V>_q_@|#gai6G_(4K*&%taM+RpTA!EtTkC#dv#^5bPToe(SM+_uLF|V zv>^s89o1gQZd(Yf%bMU5>bU$nc18(Mm|2x$Df#zMGOOq)sM$sb1LKtgu^Me*eD@6y zuLU@%icC^R9oYfnBHhheW{-;l+VMkeO67ce{p}dW?q0nlaJ7~z$Ve_@OIqi3;P~gHSgkYl7nVYOydJCbK zVQaiQ%2_&|*#_+m*>evLil^oF*y*271WxT!O6iIn+L@6XTtNsLc0fyJEm#AYx6s5^ z==M4zthaBCVr(G%cbGx!$+z{n;!P8#@f`s?f>s2>kjm3VYHqyS5GW#~a;HpFfrN?+ z*5fLaCsFSOdlOgYZQ&kr|1jiuBGE7QI#7+7aFZ&IqNGv>=t0L^Cc7AH^YtmSj?Coj zyMq#WW=jkVX^r`~6bPKym&@(AWWzOC_K&K`6u?5o)sR^%4r0wSt=2A4zTU9Am`^6>>5c?QAvI3+wra;b*356rXJXW zY^5olcD!*!uTwn1#6db~-`)4l{g}IolmQy%1miD1iM73gy>{amrUe{v#hzYo25S5S z8NOmqJ%mNoDV)PjcE~Ly&(Qc}Y#nh<*CoKbri(@Olyi=-{*4!NFpz(^Muj%%1Ul^t z*1C(z2R|+F`NZI5V2q7c!LxV*a=HhPD4b@gqMw%EZ&3+8(D^D;5Ri`j!cgW)492H` z^YB{#5ks5u;LcvSPdEG-I*HA?99e$jgE)*sI>+tQ=Bh5iJIrhmLMKOV&(9lc#(+*X zdldyfJbs1$1u^#)trD=8OKpavtsOy(eQ4DP3U+G+2jpe5;Eu2Y)TSB}(cGW!yqB=y zOxZ*c+kJ)GrlKsO3~U1%t-1@8H-Xs-?8!mcFy3tCP{7^TY2;OnH}7b<1l4$Jj4m0R zg_6;;z@EiOwse_a7UC8V7~!N8I!g_dpA}TF0hFMfi35L5c_ew(k;Z}!pplT5@NC;j3+-efFI zS@9NM-Z`@EKD#S$z%2h+6dJe`}l&~J&IS5 zR_dv=4?`f&vt;d8)AxKs2Bdk@fe-BjwW0?-ajtspb-Zr)J|11Z7eoEIhLA))n_Iff zv>>V3Nlmw?JAA^pSN+7INT*~Ev>W_TObu3DY4nzL(9fuR9N9d0kw+V&*D#Dy&dXeyF3D zl(vIz*Yn`O|9&RN zTaXl)4YR#B%i|YM8!ce2XMkFG74$ z@cZ%){02i^9cV=90R%3Pu+sT_X;mhu4I`NAydP;~>GA^e zFGP)|H!gOGPf)wv7{0_R_IO%e&VtqmUci=y&6lEm;-{d|XVjQg37hJC(n@q#k)Eq3 zev)_JX(dvMJ6qyC?(PgNF%!c9Zeic56PzqL>qD(ySL$-2sA#86FajrN%U6w(8sSVlq9z;Fw)mYP~kFehel3Kd`PzH8FGEy_U&o4m*14A zY^YcD^sgpaAqNHjRRjOh(kz8bQF>BJJx2t?PGFZ7pO@}tlx9C~d#=IfkhSod%8Tf= zv%t;iAX(d2n2@%x(;$~s%CdP60)LgVgT*iGM%iHxR|%nbNVYQF$LP_(I!6~hH27AS zvzF&nDnEhWXQ7yn8H6#8`F2b%uUlMMYpi_0rFjTsNC&N#xxBu+b#!M?b}>`$6|?@T z+r)P?73JbdP^G5_8wFnNUS?b8z5TFgH!>8je87?VHATM-G$Lse_k1@~j)#r?Xgq2V zgV1H)babtg-Gqr2OKtS#NhZ3nW<0A(g3Tz;|B%=c=m+0m0&AdNV2P=;= zkcHbp8_WSs2(Zc!*p&@MgEC+}XuDGV@r=?$ z!o?pNh&6$pGQCTiMon$5F!|1D2V%92TSRjnKHzT}D+?c>ap4Ev&H+>-r5`pWr!*e> z;YPnmlc9$>uJA_$3L8>DZXrF7*tt>Ivn=B6D5wU^a7#ZI1^ljk;*_iLKj=s6%$rn3 z&i&~9_*Vya+}Vj!f?V!;w4_$3iidZ2fX@X7$wAMx_Y3@R5yb%(U2AE&cw^Vppr=IB zkR0#Hep-W-rTHAIF{RGD^dT8*o^NX`-HJV2L)dLB#YeR<)-FSJisbm4ie}f!K9-iI zRXM=;Gb`PvOMnTd(19J-Q4RwNYC9cd;tFb1WvI`t8eaXjc@qlZZI_YA6So)EZTd72 zSGA*>9BqgJ^)=-^s631_JyXdt2R8{eAQIuWcn{~10#1<%gOa4B(Aqcgr|t{IAK_$%D2$sL&IcoZ1`YfnZyKDFYjbGU zHlyzU{pkN|ci@yDA<~E*iN`l@I749dp+|wQw%Gh*F08mNNK=64U&*Rgv1RG`L!z3? z_kkGuQ+t7o>EEVM264aN@_`gynnf%q|L%ab?MX2Z4)T(c8iGem9|S{76A2dct82mL zgnCDIP?N@U^?)fS5yH)*Od+8p07bMQaAf@%_E)=&;!?o$k=F|5zH)#~l=e$MD-G)- zuA|7J4tK8cp(#=Cxue!yx6a@FXrhI5l;9chru>^EO7j}#c=>2+T`nrg5#&TWq#6R5 zlTN9AuYQSU5aeI1*qg#A(!c@CB7m1JQl7y(SJ&3&g6z8O?LHm@xYlCJ;f4ywm3eJ@ z&~>Wx#f1F;0xSo%eJQw%VqYO6B$qf(xCRl7xo~YApd3>Pi`@f3W@A%dsQ=z14OpeI znd;Yi6Hu)!gdHUfU?1OhAUcg>dJt(%qZ+(mJQp4w$b^iOldP0{hd`CY7VNe zIVkgG7NRcN|L47txD0HG6GJj{~qEf(Mt<{yn${Hxw|8YDkB%9voI>8Sjg<*vK}|E>y4G5M!mkE z3Y1JD!962;j#7-S%dCb;RWjxuT$ivglTub1U=0Crp;Hr89}NDU@B`SrhLKJ6Xv!lf zh_Q-@z1(|<^&OiS$at3HopJBLJVHUK1zsAX)i)1`MfMg&oY$!fbFo*J?pc`!%6Ept z_OIldC~t?z`&~u%-*yxM$B-XmTsW4)Jk$_4+!$N<@LU!*Y})XA?>!tbv1Jts;GbJS z!H^28q0ol>9cZc!`F*m|J)9}p@7RK+p6eo6`^KfavPd>7>u6}K3y*R%ixVe(l@)4} zpJ_`O3c4TBMFeo*3J0*T(83HEwq;;Cstz`SxyydO4`9?6qtf39!e3-0vw@RryU=Oy zZC01=s@S0}2xPJEgK+4DnU#qr_4;|Tw0T+`&QxKaPrIIp)F`)R z>o&e8OTw#TA1th}jM4rT#}mrX)CNk+vBfgH9;^8v&-A*uquD;!VSXiM$|@{ovN>6~ z)nQKFKy5)ny|)zP*2T9I$pk`UJ?RI+C%!X?0EdDSYTVw%J4W?m^LV^+zlstz953Vc zC()`VO58E0U}6{InbJ2+$Mlr8&uO1R&^06eMBT=ipCs33b@|*gcB&NIjMR!A7-K2g zkAJcE@66-H8C>CE@c0xZ^|wGl@0!2boXxTYDlD{7xQ7MXr@yNsyrw?_jjQ!OSbAH9 zbrRN>wEUvw3=iXiuLkMZAn^&W@dIzQ$q=)}Wb zA}MuCRoiR^3=m6^`1MR?;j@hk}go% zCV?!mU6y-fn=1+O6I7-CZ7(@QWiUUJEd7u`q}TP21`19z1KB@1?M{k29Kb5C#M|21 zuAEBU_GMad1jUx)_05Wq-inrF*mQg>X1@US^PU#6w?GF7PTZz)DZ{DM-_gUr7VJxs<_VjT@oSevsCsF-w+teM zwLv7DftQK73H}JxNi-!s36z+{3CV7GelBHD7Y}Gqw!)UUc5~x~Nbdq#Z$+dSNh6m% zw6Pe$skoTH;2E&tv0hh3`F%?cTi9|72^HWL=Q)Vf{9VDIHAjqUz_5dH$k6d;7W^Of z(Wyq&$6|pW<&$q3Q?*dW6b=P38n=5{UQ!sekh@r_6w+*X^HT!h=$(JYU-qvOe_gp@ zK;E=SYxpcq9ZTA>|Z$!ZM0E?B~r;#;wTzZdq=`i6O|tl{cqXT{kc& zTW{WOZnq=uk%}wtRhNY3gn*UK>X|5f?!21v4IA?A)_m$C^H=0mvx|&|e65f6J{0vAo-IB6SwtyJxS1ixNVVf`)hX4~jF33(Bfk>* zf19W(Qhl2DVMeFa5dM{{jQh~8hpGbYwIUo`r66vFh-`f<78`i<4j}(1g}z*M1#hK3U|x;D&&D!y zSsWI>cgUEO+3Tb(H!^Xh`_;m7K1jgc`J0|xlP!;9x+Nj)Jqh-+bJ(qK_T{>EdtYFx zkWJBveL<%0&so)S=gMmO_CMr(iYZOG3A!4~tY9lW4JPH~3aeH9^RVR&#cYQ@Oa70Q z#a@;qp;ruGWMcenkCDFJOs}hdDlHet4yh&rvrf;kJ-~E!l%P zI%`P)W(AhDs;{;xQ5O{gN0$DM80>QgAmZ5I>7WUzOB!yed6CtlfFY|hD z{j+P<8sb(sdx6Lzp5u}zU9?yk%iWh1&BOFmC3aD2(Yhzvb8&gzue2#$KP8{dEXZy2 zKviwZh$I+BiC&dSh){G2ou-aF0;L~4sV z)skGAuFCTtma%pqim=bVQ<-8~d+Rjj7G+!3uoJb4j`zq^&FUAd;wRX`%84TK(B-zWr@{GtRN{fv$HV8a|j+8-!pi)K=P*IR7pwa{) zpj4B9D5!`iO^Oid(t-#Y2!tR=uc4PDbV4WzLP#_rIB<+p?LF@4f9N^x^Nrm$~4WPjrSxS#A%bATT^Su zl(+eU7$gsa6%g`zR>to({#E}YFA6xjf5PBd&TJMn8#WY3#bUv7ugg^DLl~q`W)a;0 zxXzWB5Z$USom@4qH3^Y048;C^f9lFQ7d`@{%iANKYzR9I^<9`UK@+Orn*L*-#%~mw zrk<=fo%_mGu^^m2%l>^5NU#pTe=$78i*SFa6F69O4t{AwJ86>DdhL4hdW7pS(Ymzi4{Wz+&i5B~YT=G}{WGrpX;@9)mJ3p}RTt znFt`NZk-<`VE3u?-&Np=N1BBF$8Nf#uhjlY_wp^mHMFiB-b^F8qUz+mlS69TTg~z- zQMRkJ?&;sy3yCP(;$+$7Vib8Q#||nNo|SoT5aSVgi?Ftk)2HFq-OFL&F&FC9-Gm=xA)Do#krt^>CF#2lb*@y)TW4&dZ+odqGqou_N(a0 zUl80Y)sJ6|M%hjvUJ#Es_DH=3m$U`oX<-0q&YzB2U`o~58WmQ`E%Wxqv^@OTBTd2*rEsr^i(%+PFCnc zB}sB-(NjYM+?&(=Hhj0$dCjGq5ZiZF7p1jcZr`GGx`zK^jDcdzAw%OnJVvm!ySV!A zFu?F+!RZxfXg*N(^#ZfAC7vLy9ia(Mq+ck&W;lnrew&Dj2(CIAs)6_e{;_>k8oBq_ z*pb^rCo#YQLbVQ|L$#|U!5RK{v#pP4F%&uqAU}e@5 z5xuR(o@tl>szn=`MsvMSIJ#JDmE=dll=I`homU(r%K1ttJTH~iQ8|G^;@nx?#*>Qx zkCgi3Q}mQuUL!f9o?wwl&mpSE9>G&FeTvms{L<=N~=r4qn^%?=B#1u zsV90=Dy9S>cgQ}*6OYt^HRmPG!^WDF=~ocpd!TJy9MJ8*_z@txDFKs&h1pEAcLVmR z&YZe3(0hQ@Z&O@3DRDihg9Ur@0s3{XHtW*uo|$WKI`5F?^=pBPK_l}37nN5RK)lHnV=xyUBMFK$q0iviT6!(q zOm{Ugc(jB2jsa-E-Oe|PJ4b@ih{#k>8DFdNCdt&2IX}Lh(2J1NF6v?vS6Y$Xqd~u} zFFNpx*#4v~T<++|5XiS3+rEXwK)ldx19^6ZP2L(HC-NnT)%0|0o{{#A25ydv(b_lK zwtO{Qc2>v*S^(qII%tkoTmh{2cm3$JgLPV^0^D8q%uv zQ)!oo)m(<0r;SI60dw4G1Wb1K7|~js&rL{SGo|2}wv3nmMQnSY!iG*Zy=0GU6hx8} z4bU3vOLbU!@;Oz)n0==f^*-bd&4i3wCF!o8mX{G+?;W1&li*|Rt#uMq`Splp47c5k z#}z9Bb<9PB(XhT|SOi!`fr+IQh0zaaY35A6!vsIq7p1u7SE8BmJCaw^M~yg=_5`{3 zhG6qu=Rla+>Rs>5v^sx2d74Sf^^HU?Q7hRLZtqOTxBh*LL3JQC(kXb6Ow#37%`#f- z{M;Pjrt5>u{bkbS6|)(onMf0K*a=dXsAX6a)|KUa!ak!8-rtM!I;@^2t@mX zw2`MKHt-Koo+I~z*-gz-mbQ!?MzHk^0}YTeBF$j*6j!;d`TJzr6Xn7`&opw|Kz7dI zcWk2~U_7Rz3B%i9jTfh2u<`l1?W^wYj$9VCykH-%;*`q*|fAr&&9Kw z;rCsY*aGo=Uix#| zvcSUg)gl&U`sL}-F!t6fA8P<1op>6+8frA>ge@ew7*@`+$!vJM-PL6y`CdV5S$o2D z=I@P{j25Z9F9Y2?M+Hg58HU19$?U8=)04TLBM7oO&eVJv1k4glAZoW5-uIym!m{(* zywI|U#8c->JVxP!O_1qjT9_CGimVCF4Vee2FWy|2z}BYN?_JVQqg`+9HWBMp6-D53 z>lMo!!Yy8XG0J+b^D(v3nxC$0lD76fc$J@Y^22OTBuH5!kH#;puB}vBDKnxQ0e2lu z&3w~rX8l{8+^6npJj&uPA|uDHZAG@hEKY5>@TzWn5F2-Z=(Zu?Y}*+y z(R@keRir9?5($}Orzhm}`%~Rm5zZE~M#i6Sqo33E^Je#EcRSxHkNx^<=uVM^sufJX zM?sNYBz*rBruLnh5ZxTB{ZC^0r7pS;`JmW1_rCM&IsOVz*KsC@VhEHAY=bi&>JokJ zGL2wUMLPzy-{Y*Q9gq<_|LxudVw_I6n=96`xZ3Mp9cXNjEGQ%FVEyS_q?c>@FR1K~ z`t@!lqKAcDIUNU%PV0J41h8McH|z!3R;F;28QkErHb`#@8cy}!0h-jF3@SKCS(I)m z9}h>;IcYjvoMluCkbOu+`?KF%Y8_BUjO$#_adGQd89siq=^o}NXj&-WRA?oK^94h@ zD>4hbxzuY-H0>7G13>1~K|tIY3!i>v_{r_PkitU$b=97gcD7e_w@Fl=od0?MQQl+E zcELRz4^TUS;S}n3=uv&&)}w6P)t)sUHEY1|A=vwC;oIlQbX^37DeXD8fS$-PrcwIb zD}$O~L??llqJw(!4+Td8BG2$v(AXf+^zC=#&afD$v-;!XM&W@dY?1$HXSSFY6Pv5+ z(d(fQb%asjV$9f;SVua+vu?f^jawqe@2V~wcE~DtNbiyh;Y3%iR6qvJ=^7)P}DYoH|G(m)hGH7#}Nl^VXQbBVtW58+xYuk(T{4(ovi z^5e4B7L?X1)wm<^XO7K-d^P__*Vn=HJjyF` z`dHDsKL?|fTq$^2pZ>XUYp*M#V(Bh~wfe1VIL_+0RA`HMSMCJ7TC0Z_({=XS!1d7q zVOvi2ai6IZbRl6r!3Yr*Mh|`PpwAEEZ>A(aPx_YeS6@s8_JBeuC^a}I;#zNWnCx4^ z9xQ2;Y-a^@?-N)b~+(iNeg?tve`fP=rEZLJT{$de}(r z^St*?le72xxFaU>B5QQS*1)mQ2%MM-u%1vRb$^MF9d4jkxJ)^-^U;vvB&nvA1Jkv4 zuQ&n>LXk73l78kV3O>~ zlCdRHv)>oRr56t&GkBKoX%P_CPHI6_K+efx$oz)9Xm?@9_m+5H<@W>TCrUs(shy8_JZk-RI zJxYqnwf$*PzjNy&umV@a{q0%wH>LmpAO{e&KMtE!{JUX87T>uI%$FDMo`~8^8o(5B z>wKEeCZr(=NJILp^WM!=88{uc#GRVnM3oi6fzA-y)xyhZ)b`1S9m~235{T zaobevcoVdWQ8r(W`@3_=KjM8lC_LL{pxN`+&*N;01LMq@f^M?BIkO@BJoUr_O7Pk-Xn`nE?jxQ93M{Ml_YQv4sef;%*k!+1w)EWx+sQB0;mkp#*lSN|n~?a|Z;S+d+HvZ5hBD6^I% zS1}kiWKNZ*$R%}6r?ou{I@UUsMyk4ALD0~2G;kY%-KaO;s5%52Nw zFwFboKAT99{EHDmx8NLQY|_8A68~KC7s((l+`Vi!le$A25hy9~-B0UBY~+Dh&z@NXR|MNZd8Q-1LwZq zQlW8M673Vk_dz!QzIo%#j{4c^=l>j{cODD{TH?KH^H5&b@P(WcSBluruPXckKIaTf K^)Y809{eBo?@?X= literal 0 HcmV?d00001 diff --git a/content/learning-paths/servers-and-cloud-computing/cca-kata/cca-kata.md b/content/learning-paths/servers-and-cloud-computing/cca-kata/cca-kata.md new file mode 100644 index 0000000000..f232369480 --- /dev/null +++ b/content/learning-paths/servers-and-cloud-computing/cca-kata/cca-kata.md @@ -0,0 +1,72 @@ +--- +# User change +title: "Overview of Confidential Containers and Arm CCA Attestation with Trustee" + +weight: 2 # 1 is first, 2 is second, etc. + +# Do not modify these elements +layout: "learningpathall" +--- + + +## Confidentail Containers + +["Confidential Containers"](https://github.com/confidential-containers/confidential-containers) is an open source community +working to enable cloud native confidential computing by leveraging Trusted Execution Environments to protect containers and data. + +## Design overview + +Confidential computing projects are largely defined by what is inside the enclave and what is not. +For Confidential Containers, the enclave contains the workload pod and helper processes and daemons that facilitate the workload pod. +Everything else, including the hypervisor, other pods, and the control plane, is outside of the enclave and untrusted. + +### Kata Containers + +Confidential Containers and ["Kata Containers"](https://github.com/kata-containers/kata-containers) are closely linked, +but the relationship might not be obvious at first. Kata Containers is an existing open source project that encapsulates pods inside of VMs and +VMs can be run in TEEs. In this Learning Path the guest VM will be run in an ARM CCA realm and you will be able to confirm it by checking kernel messages. + +Given the pod-centric design of Confidential Containers this is a perfect match. But if Kata runs pods inside of VM, +why do we need the Confidential Containers project at all? There are crucial changes needed on top of Kata Containers to preserve confidentiality. + +### Image Pulling + +When using Kata Containers container images are pulled on the worker node with the help of a CRI runtime like **containerd**. +The images are exposed to the guest via filesystem passthrough. This is not suitable for confidential workloads +because the container images are exposed to the untrusted host. With Confidential Containers images are pulled and unpacked inside of the guest. +This requires additional components such as **image-rs** to be part of the guest rootfs. These components are beyond the scope of +traditional Kata deployments and live in the Confidential Containers ["guest components"](https://github.com/confidential-containers/guest-components) repository. + +On the host, a **nydus snapshotter** is used to pre-empt image pull and divert control flow to **image-rs** inside the guest. +This is a simplified diagram showing the interaction of **containerd**, the **nydus snapshotter**, and **image-rs**. +![Image pulling alt-text#center](image_pulling.png "Image pulling") + +### Attestation + +Confidential Containers also provides components inside the guest and elsewhere to facilitate attestation. +Attestation is a crucial part of confidential computing and a direct requirement of many guest operations. +For example, to unpack an encrypted container image, the guest must retrieve a secret key. +Inside the guest the **confidential-data-hub** and **attestation-agent** handle operations involving secrets and attestation. +Again, these components are beyond the scope of traditional Kata deployments and are located in the ["guest components"](https://github.com/confidential-containers/guest-components) repository. + +The CDH and AA use the KBS Protocol to communicate with an external, trusted entity. +Confidential Containers provides [Trustee](https://github.com/confidential-containers/trustee) as an attestation service and key management engine that validates the guest TCB and releases secret resources. + +This is a simplified diagram of the attestation process +![Attestation alt-text#center](attestation.png "Attestation") + +In this Learnig Path the attestation process will be used to obtain an encryption key required to decrypt a container image. +Learn more about how Trustee services are used to evaluate the trustworthiness of a CCA realm and how attestation policy gates secrets release in +["Run an end-to-end Attestation with Arm CCA and Trustee"](https://learn.arm.com/learning-paths/servers-and-cloud-computing/cca-trustee) + +### Full diagram + +If we take Kata Containers and add guest image pulling and attestation, we arrive at the following diagram, which represents Confidential Containers. +![Confidentail Containers alt-text#center](confidential_containers.png "Confidential Containers") + + +For convenience, Trustee services and the Confidential Containers software are packaged in Docker containers, +which you can run on any suitable AArch64 or x86_64 development host. +Because the client runs in a realm, it uses the Fixed Virtual Platform (FVP) and the reference software stack for Arm CCA. + +Proceed to the next section to run a confidential container using the components and architecture described here. diff --git a/content/learning-paths/servers-and-cloud-computing/cca-kata/confidential_containers.png b/content/learning-paths/servers-and-cloud-computing/cca-kata/confidential_containers.png new file mode 100644 index 0000000000000000000000000000000000000000..fce7da64a45feddf907902e98acb58a64c52a088 GIT binary patch literal 50830 zcmdRW1y>wF(=IHFI|O$RP9V6uySux)d$15J1PBr!1b2c5x8Sb9g9LXCdS~+{-}jz- zf5GJpXP24j?waoEs^_VyAx1?>8Wo8U2?`1dRaQnq4GIbbhJu1wL4X6!TuHd}K|vwa z*@}y+$cl@TtGGE^**aK4LCM6Vq`_-o>*9s1Dfr1CU_^U}IfuOng;EnkH{@GDkPT5W zLwQ5XKpxB3lvf-b@->%{97#)LE=;GI`7M$co`tH)TwmDB+$R{~u$JfF&(9AxS==|7 z{5LD!Yl0WQmZ3uwtdS#Rt5Ki^!!%SAi;x8=+26(!!AazTWI9oHYk29!tW0uQMJ$w_ z4TY{jHhOEE>G4-5_;7I`5UC2uA4K+8* z_-NoNoyG>Mf@e}WjRMk#+l%)CG}j;MOa_-Vwzji!h+dYMf|mGQ;zLEUvJU_zx>UvN3XK)q~^HjJXeEf`&#n8rgnx6Fm|%>~bdaM$`hKy?1BF2=z!rbrXet30mr8Q9 {ruQ582Fx&4R}3#BqUH zh7(+WwF?uz&WR68)`g>iuy+c#Bxr$bbZ$Ay&{Vi>y;wi4^u-C*8Q1GDgo z7_I0H$9LX!kc)!>LnTxryf?l#sW&`#^!=N(Zu@oSQ_|a)tx!2ptbJtNIX!D#9lgp} z76{+K{9;g{@&nW_u+cCU5gHM~-^k`Mspjm8pit0axW`!bN^MwfU~l--)6+B4>z5R$ z1(Xn%u$O#M(=NCx5K7*Xk)qa~a(n-=E=5D$j!uxejV^i6&%)a61#e1gih**wOpw$Q zwPFfaij}N;0k@2{47dDRQjj=>iU+;IkenQD!3Vc6w^(*c@x;kw*A&y?^0bmfUS@Y= zD}_`Bdln+{Or{pe>%>FO9~8VQOBFo}+=_`x;EU5r!q0Vl z1AS8i!UB>WFn_cBR)yt_=tD9^B0$1Hvc|cyd6_{PCn=wYGaWzeXN!$IgUg0@itAuB z(X>7m<|>IJX)T#;_Sr1iEMemfmf@fwy{c`CTI`g%W!=}LbG2=c?ZBb56lsku%|lHd zh6sj!P12I?QmInWQhUvtvQ-Tdb#?6v4eZh*)s|weJSBB+EoGIpk|3o(o$%71#a;6Y zC9X!BIEJBP`E--RyJ@>$GDnFA|SDg-KMD~c8+93#ETua%C_j#Nod zNrXQ+e1iKV{S9mw>C}4cw4$`)Dj3-2(x&Lg>?eNr_KxY1=@IUc4$cCGE}RpN6Yd73 zCK9DbqNgpgG0udF@r%zFq%Zp4t840Ct@%{B-iVEeEk%Sya3Y^%CMtZSwWUR+eJp&f zZagh8jXTX9>wzoDyx3msKB>*YSW8_CW0f$vJ<>LMF|stWri-uZ!okcnHT zL9gA=q4i^<&)NpOmIkA6nW7enmT|dbx#V2jTn`r?*Cba8*A2n>JCX0W-!=8$Rm2{_ zEpasD9F-rb9mOv_S~{EM*aQy**~C0yt-gnmha;{dUO<~g3yk;Zx9QIzxzBq2X+eoo zY5Y_Dr{*#EPsZ%1>4+meBit-jER<>LESr^Hl?Mh(D=JReP7zLq$8N`;kGGG<1?mJg z1PBGB1SQ`-^P(TC9XQ3~Ozkc3`5yy~UN=h<>C z7A@wfqk4zcAW$ykAh68bO5Mt8rrP^0nkZ=~>0w~*rGbXdOjmJ@$PH&<^5#b_~-N)9m&!6ESn#Xv{y&FSH17^EkH+ z%_3KIv8}(`e>b}#W^Nie1zUnu6E{tdLV`X=RGMW1i zq^Uua;#}g1t{l@Z-Q9l;GbNN8&*ja#&3ReaTkTlgRGC+n8KGAs=&sd>`innBb`g(f zeKRm~GCOwmweqF$CF6>8b{N(k9v>vT?YfAH1nq%TyB-y}$7w31)WS zx*=ELrQ@XFDmwmjXnsomt!ybAxJ1}eU$*egXN~KStE*x4NNMRn&O-jH9GutfkYJ`3`0`JM{4}8$>(HhO5QLnkj1!d!*$z?uJ+A^mA~}48ugr)R-F!vrUH-Sr#~TkuN)gS_kZ*L(%(_k!d-XM^|*a=PwGO3 zBB{umb9@ z4)TtdfhA{Og9glYN2>czkFb0zWym}{6`wZp)KVgqwuXC88b|w)+ffk`%+~G{f z%%&ud=?4%bj>WT}9c<|d+}lnS)`Xa?;s#E7Ugf)oWFI>XK|d${$bM>ReJ%;5-e0@y zfNFh0_&w^5@(X~mT9!JpR*H&H48V5;DCj6#C;;L@K?A>pz%PJy-$z2h1D{yHF90$B zT?K)2Vg7xGS%KUrsxB@o3w)}ZyIEQ~x!X8J8uIXSt2n}rphnuOHf=D=Tqlr|n7E_|%4-rn9U-W)8>Zq}@?czJnQ+1Odx z*_nYmnB9GyJWPFcOO9n|lc+488 zYfsGKMUlrc`<43gvN9GO7sn9tseEKnzvNX45d>Ko8j8?U;Wb3=H?P%>M?W>+2#zN& zH*;8z{T@3R`Q*F9Kf3)5$%Gsl>pzE!9jH>t&<{5oEEDqQ5W#k#gU4b6h3;P1-g+ug zhcWmNb`h&Dtmkb#tot*jcWV*Kf~ZXbKrg`GtEh@RWCu!gM`P2UF;UWR2H0#W@ zW_P}dxzf19sQA|Z=D3q8L7~-gxwjW=(BgH}aE2cWnbSkXkg(2G&dvu%DRL?*m~-uq zDmoO2DXCa!js6qz8DFHX#LUDD=4_Y$EXfxv7w%Hix>#_ztjXhD3XhKqt5jT8^mxZD zhO+SETcx1E_rDQPP^31cMlWw})`Cd}2Vb2vdTHv#6zyAqYRi0rB3%-DlM&(6QI7HTWVj-lU zFEikyYJyN0`0I_f8za%@Cvn$pIfm|@d8=*Dhg-}nL4Upj|01Q8*`5~c)!TdIg;rmf z_wTVztL+F+FE78Zi+(v>@vf~g?b$EC{aO?JOgi%M6;6e|w@56m<7qc?!ls!9HJ{gR z>1G_h5VR=?N24=uk}*X8Iz_;{6l^M%6E6<1d4h#NwN`>LG1x`9QgM7d!N&@r>2>z= zy1uXmE@vCC<$ComY;A3$)gO_krqs@M+6{*?G2YbMrBkJyz>(-)BP^7rrUAnea z88n|SRJ)=^q7oH#%$I87g^F%}-EjZU1Iqx56J0NsSuVBy@VgeD&w~k<>6Q$xggXF{ zo<7YvGswloceb}$nUjoq#YWAha@=;gn0M#{s>IOtR{87vO_RR2DH^psqdb~ra|3)v zTTh6()^2~gmP>%jM3GD2bpHwi?Yb%aaH?*z+ywh;?2%Y>UzGKyLodC77W$R&^Rj2G z=2S2_g%H}*POkm@Dgvrwo*A=&^F6a$lHoFy3SO>~`%n zojfI#_812%WV}XA5b)!EczF1Ea8O0IY?ki9()#?Q`Yoqxz3ayZO5}eTvhA2a&ND}Odx8$ujn0l>)rl6--`dSFM_i0MWT{* zSD5EDOlOuXu%zo;V1p0*wJtDK&dC_)$s)1{5;@8}Ir_;H6WkPp4lKR(B zzLNm-My6g=|F7NbR08bVAvpWTdtlyyBP0ny1p~i?%Le(+pHPSkF;K9fpE^18|BeWV zfCQqNg>$6%Ym50YbIGf*eXQjFjwl5gF@G_a`JYI1AcNsfrScVf;ZRNBNY+MwU7Y9vE8;K#CFsmwIt^O}sc}M^Jw}NzY=v{p{C) zn>4Svkp#$-$fZDZ6o;FG>aP^$Sh?hER&5gu;TTOpk9-0G0w`vvqkk;Z5=1}}{lY^i zuz`UA`6B}UpFKN?sDi=chguszL%Y7SqrLI^&YN+zWV1f#$ej(GU#6lAZisouul;q^VCTH2jGgS zlvE_WW6>m}50w`{ACjN@n*PqrdM?lhah;hi)8Dy$i3E)lmN#K$P(;0caB%Qp+v+ng zTvjX~k^3ySygmvjjn$atyRJY4M1~PbU?~l*B<=r+L<@B15S9}2Zz-FBrTkddZc{;m zaC?8hM4@d3xIht5fqY0)(`BQg8yhL5uhfu zv-n3ee;0@d16T!U4ca{&Fwfyc&3fDZDo0Zrj6 z4RGWBN`eFtxH=zy+!nEVu+z3I81joHy|+$ca3-ipWV04+bpg$#S*j99$} zM%BmWaao6Yx~d8mjU@iw*Y{a2g#iHxse72U!{MMj{m;f*hzMyhbh9j^HgN%^Flcs{ zs290BJ@`8A#bDF1IW6;q>nmPB7CZMA00k-mUINphh+sIlJjbPmYMzNwt%|pkU!?h6 zVsu{vk8Di`NOY(THJn2SjfaQ#j!c+zdnjePU%$~QPOsi>n;?xJvQV9vz^d?wF@Htj zqEP7w3Ou4oY=`k)@k~=ZH_7{>X)i#B8a5v?TtNJ|<1rd6KJGZLnVC^t(>7E;n?*OH zXwNmAV83}g+ooX6jYV<6r)HTLm$ z5->HXz%(i7d%n*4JE`T;fcE$?rDOfw=fDlHp|)l5k;#7z!4)8Q5>G^Km~>8l^0 zujT#k=>hTnm>yeTM}BPBx8eCKl1>63(v=Q7&EFB(n1Kg%)NY z*EBO{`#>`>0jsgB_zxe38{_mpAOKU}`;I{UtsBxNWKV?50t4uf&||+Q3hjxy*&HN5 zU!HStCL^n}oyN@0Hu}?Mo}-dV{PEQvfdmnomN?vhDT3z6tL=AiAHG>Y19)MgJH?F5Bq9_>I@fkOmB+=T>WSa`_}!|o!>&%9!z}4qAU6>vX3^QA{kYk{ z`m18K0>WQG_poC*2_gq`BoiHLD&Pe4V-`Lz_vlzfvPAqFbx=@%5hQn>QNW_4e~@o{Kymn2Dk*4gEJ~wR675 zU`u0QyJH#$ULh_vAgZJ9u#Ncn!c`iNi!?d~sA`$eZ=vD=ThMZw9LgKBdlr%#(nxr+0IVZ^4^dW2VHk*_E@VO( zD;^rcjC4qV$I9USWMumEr=r!J9y>eN%L9dk+GS*-hwoU3oSd8zANRDUoqwqUv6U(t5>U8xOZKBX{fyIk&4%pR{9-Qe(4 z-62u;8h8I1J;0o+(QhY^BWk~-NSuV3dQK&5YQ_`F4K5_-IhB+jgm5 zw1ng*>DbgGj64DKD~$`0F_l6Gj9&E`k00YQ%F5zuZf0XIAO39h0wusa&m?h(+hf^G z)urse<{=LD-7tDbvV?cBGd}C|OqY`tgJ<-BT&O@&w*34!(Ih(@P+Ot;r2!YJC(={> z5j9&hM<`sQsIz`ZoJ}?M-N%nMv+zHQ_Zf5jFs+bNPb#^uTUz{0=E}WmtjE19)!_xM z7pRE^POaw%ekkX#ZzHa>vRNq@k7ROd`(ipN@*hw`+z5aoF7xH4HX<72i4*ztX^C42xca$V<~W@Kmg zR_Va&Y-(z1hD~aGNs{sWY|}p(gLvcZH^qS102XCn0bGU_b<$tkNlphKg)E8NPhjFVo$*IYuBYpw`GtjiGBG+R zK%e?p>n~ySrz{t#O{76aMn-mOg`;+7g(n!q#N~xnm2rHY`?*>bdZ!l`wO=epG61g> z4cOv$I*fHO;Bt{%+37+%(y(j30{5MtLSGe-?)iRP(4)7!LqNp_6IF@>WdLa#}f?z0|HW z_=#<;0JKtvcp=OBNgJ$cmeBL)F2?E%FsEPbH1%71^C0MJ{Am-gW z6p#HG#Lu5U`+nb4>Zc%ICBuY2_dZ;B)zs4R#qVmrSi36w>Eh!nFk`lZxuzf>;>GmWae_BqM~r&rdr7LXfMzMp zzRmBoZWs$K-mJJR2GP~kY=Upt`b~pqpffQsRLO(k(Me~%;7Je<4B+hL|7qj{G>Wk9 z`{;|27zDcbH5#6ffG+h8ze^YH!lc)*Kw6{~9@iD%`nGj;vvSJsX7XjRWz=B+w<7Wc zhhBGoC0!))5h#AH9EJu`T)E{N~E`I>=XZ0&WJnthKK+>3iY}J@Hkl&-(yu* zfso$%w6bvD)?o70h-;rrSW#jKJwo)n$<6VKU$5Bx_0eR5qrOI^!H*XW(=u2u=>gSx zkL7WCVJY|Hq~n=1LEt=^bZUFO&+<%01RHQg^CVW!x0~pQD`=+t-O1QA>!D8 zz1-br*8SPwwDJ}P9?fJbUzSEb+B!KT265n2GTlL5z_QKnN(_j1DHsrDD1m+hEe3Mp z)X9>5zHx&A)TvnA-Q=firFn0 z3-i8wsj(U*Y-^e-R{i2cx{izZ@dE&PWf{k`tXOrwf}ftAcIPTGE54e1qh415TWEAY z{JyApljd#pWkZh$W@NUf<=cU!tR!c3+ zL;zUl&(b;@*!SCp2eV~Gu%WTB$YJ5(uK+NfN7KCkc=QYa&R3{5I<1tismsV9e2*iN z=A$-20u-gNn0ASPeiQ~UF%#L)zL`m|`gSwLrY$Jx>=34FON#&6CJ`5W?r%3;h-x=m zy4^`*HAxH!x=_tpy&7f*tl^^;_KO#929xRVIB>G1K-A>mNECvwi3ybttj46+bV}4O zu-H%`B+yjTkS7opF|Bfu4c?ySD8|Y0`^I6jyNhB)BvngtMN0MP)EVnRfiw-Pr4hYPuKhs`PtXRBz?6N)#?1$9dbw{^LC78NX}d1u)1mlr7BOzWIk za0)klYhGZ(+fm@#kfDrR)*j?Vc7CrGd~XC6TY^pR)yuF|1i?2Nb>GsJc0~x;*qhb+ z>Rn)>fV*_AD9EQ_M{=p)8NQ5IV!-o1VY+8VjSjXS&o&ZvS9BiZF&k^?II)-EsUABoimmaJiWc;?@TFTgzNpXp2Y3X^1EoSgLS zhl5M%)y(+*bGsFd2zscleZ1E{d2k>E6O%UiA7`$GpcUQG-^!p;X2#aZN=sAh5zu+zftpV86gr`bRxfvQ0QSChhuRDv6MV+uZ@$iTAw{V zxYOaXJU|092M9)&3lWn9VgmM>4~nlPM} z?0URRaCyKDCgLjZ`h9_k&t`(p=XIFMK@>z6N{O9#aM&3txK9`>qA((fqB(C=q33ya zqP*Ipt~?sn(gHu0#Tx_k3m5!&fDAZh_+O)$$idI-O+K&WcIb@4sHD+NXNqI)?g5Ti zF&(4n{390kF?VX9^;ldybH&VfCgS4uDT-B-FA0)$@Vg?+4TkYN;ObngXPl@uH3w)u z>FR3x?e)?)MaLH)o_r8!wt2oC3&gZ>0a~wGp@(|eVvfL|Sy}3^>?_}%2Md^Vx5w4q zkKypoy{sJ%(QeyA<|5Cg#Rdh0?ax8+au+X*{Eu`|2n68hlu4$;Hrj$)-+CQ=GdW#X zjaJ=bHoWFg%Hk<>=zuXbU2(lWq-WA^P^taV=1;WhcaW?0;kwfc4QhLuCueD=hkp=!-XbcleJF3fv1J%W(at}IiE+sD^; zug4AhaH1VKgVR1v+sIdL#f2Rb(kM5sGQeOM81=nA4E`L{rs9cR9tkkFFn}w3cHhbV zru%a!g^`c+ISGh`4}_l|R6U0`ICf8b^OSBauk2&DgmDFO77iywQ?o$z0+ zx8+K7MgPQJ-`w=yTt-cd+Pgiw*?$16bpcrNmwzgPwXv~rz;*gvQmM<~0>vYDz%9?p z2-jvw313|6d7IB!*i##)<04X3d&X~ne%B3zr|U-P%br$)W(DJ|FFrJ4!a>l`RaW@6-iz_%OXFq?U$k(zxNabLup6~Blp=q* ziMbhdOBd0xO)s6;Z@*jSjEnvmP6vg0Dh9l&60=8t7jf%_Dl9Yubp zWq1VKSNB!tfmWhs>^XZbXCqo{p4cgg#;tEtN_UA24z!LuTM0O<%zC3^?i?kSvwnof z#+J4J&NpuRnK}@}mgDHlF*xutAk#)@(1jauSxh9OZcEXyvJX%JN`U~928Y#6iFURBUtz3h{xv-}X{ zm(Cul3l9StA{X@)Jx5LrLKqwz{F@ZLS{uOh{#n^VI#Gm3rmZamcW%DxaPLd=vHE+J zA&8~;Ug4V^7OEubbamy2gODRaPfmMxrcofMO8ML%x?VqT?H<1{|SV;#);_2D_eQ2Ql?f^b*^vgEZj zj5|g_+_0g@=p_`!{hsU?hR=k3TBALz$UGS5_TKJy?2N-YH01{hlw2 zzOiRbI;9A@*r`$_VKM#=Pu5y_rRJw z?-5D(ZpJiJAH|5yDXMonl6D2^F85_t7x7pgj0A7nTl*+6>$0rf< zwp2bWbz2z@H_l*m!pr~N+0&!$54O0EWfju+0wbm&oHe;Gdi-Uoc`vuku>Hpc77=xD zEL06KHhO4dV}7P@2d49zci#q_$_}wb%@3+wRjJ|D)DeHYwK-r)Z^uEH5I2F1mXhse zUlh5D7{Y=v%ap{|IUHfl-fjvY)J3sqOkM(jvBmECH_wg|(%*Ilj`4|U_=zuh`$U57 zztUL~h$aRa2Q5*;QOghoUPo1XYz-5ff2FY|9=>^SNPK$nL;PBR`Tk=8#F9q{AlG7J4)(vFCmWFm2IgAGYl91^Y%y`e2*%g|>4TQq%|6tA{p z0ZLS;u$z8FTUs#M68%M`i6M%R;L{6M?0<<1cOV(YCM`HA_ZO#DL!3$`P)qy|hN1y5 z^j9&R-k*dWaFUA#z^Ur33jeY>`FzHVPBeWc~-DJoK|+Vjy>a6E$erd0g#unZ4>?UQsQ_A z2eoC*EWX6%!z!w@WXoYia@|?M@ZUh+3%O%T*#a?&nOr}&Vt71CmeErfwCY4z#xgCw z>9rm2XgY7M?_^#sU!}tG1F<|MQIp)^Ji`-m7+v*mg~a@RD0t?1lQrT|Q=<#y&Gkn( zy(ws@YIu^b!ozZ3)*(eRq8C)?H`-CG0}K&}%a}df;=*QiiTBa1N9_f-;Bi=IOITRs zf^B6s)nToKu%u^8UMnT#VfC*33nKScvc z$ThPV1kMt=GeQ|@aZE=cA)&_JpLkf+IMB92AMBmC29g?v!uH<(Nr1fo+1lALa5*f5 z#1V1tH!Ary0mS_?hBf=!HpKk=d>d18&-prA^*0d_p8@cC%@zBbpC^=r-)nuj*&V`F z!_z+WxkJhfU}p+1(Qkq9N1e7vD>M){4UdYFhPFOUOhPB5Iu=cvLAYA zm=rg8;`8{9rGl}gdNAc42;83dGd%GAS`r}67twu&Rx|*dd&P`0HFMgBW~ZYQi%X1Z zHuvpy=?YNLP(iS$i2($H96TftWTr(VB;JtHccR(;Sm#+UyaXH9TA_|*3&t9?`MILO zz?Yl*($5WpvSwt7aJYJ!?e3_6mB!M2SgE&Zu5usO;2^(p}cjuGMT6-HRCWmb;W?~`L8NOkgA5J(t zx>U2<_J|gE(cT)ELa$0FD`O^*5*-2%dMO7GRqYCi_p&OJjldu;f(&-|MqljJmQ?ITE!VkGc*q;P^*#iOtk(^|}!q@UYB|41I zQJCPbv|SUQ#Ygqf>z1~_7Dx^R8$*CU0YYXp>lk6=yu1WJoOAQM-l`3Wq|+%lI9Q{~ zh@{2)#4BW~8UeU%Os10p+;x4l)GU(3Vbli4=nm`>3ikz$#1M?cCmIxL6Iu|OYac0( z3zR|WoI=_s^F;85od6MMVuV<{Y%M!xxFLu)>h>Sa@vqbRa1jX<8FMQ4Bo1B05U9EjhCv zBjO^xwgCaHz9@wSfRxlO;URmlqH1bbKtYzyXGr{+oh=sP1y16S@>jl!2&Jc)&h@*;&hxhq(%mp^(y7GqUClMTd$VxSj zG?AKLA=^U)uEs@>mMhX4CAC>FNuyQ#)WeNl`|Fc|k{TsoibWRpT3cJ+8o6bQg1E@nkAESN zIU6N#iP)D?Z?|u4j!r5UmcAxLo<;`k36qPX6UcNTfGdrLMdTQ&q^V{i1RWFa)#U6l z1QktIsZ}gMg?L~|mRFF(V>MD}U7ZItts53?S*HahwFwjmjRL_U8XX1^KeY4eU>>!l zGLl^pewZO3_2jqf@IjMh&WDS=qP4D6X8#NRm6Drb!I(yxqIR%?u1^%cB{?@8;Br9F zz8LsNeyu<(1o!bPoV}K_)YX0pkjv9;eHb#o-R)`i`MoX8+2DJjooC=eaJf54nuKRo zZS&KPnBR-gdwG&zrKPbiqFDa+t}JJ^Tk(~j@$W?P!)0HnG!`0@gSj@J>mT$|ozD0~ zTZHS5gKV>+;z+Wc6awG~CdMyGA?jE<9YI9x_iI=Jr=2ocyx1{!sCE=IG&uJ2PJxMcWqKzO6M5S(am{Ry-tMQcpYWr`CdfsE*Eer z!|UNR^($+yc`r4$w|YvgOc`AExe1*1t5Bk$mKcP3L@5j@ z{lcsFSVY{%z2&+I%RFhLo`e$d!EVNK+KQZi3`5}+MsIKL`alxZP@FGmQc{wiz7U{Q zq~PA!psfM=thi{2%RZep64&c6L50B-Yu>AnD(x!TEecNgD}vpnMvkF0!C7?TmfiGIHgZQ33pfa8_wg3lX+r%v~Ucc0ryR?V%=@? zNb4s0vVi35EGB)v>&HujcW=37JXPcnKE}l$HWib7rKfp%Pa_Z1)3RDz?WUS7d#?rh zTuzQCsnJ#@W2Lj$6G%u`{haBe$scPVGq+1nv$g9kRM>iKoX3?CG+V0KOP4d& z{ne7_Y>hQ2tTDsG_HY4uzmW^HR!QJ#!Cn`Cix0zS zT;M`vPRM#8u_V^eu*{ViCRww=7FN{EjFMJ4`<;4`lI<1_gGMKwaR5+n%9vS>RBq1# z8|vwc%f;zCu^Rjw%j0v}BqX^wFZ|nrmaufp`xI-S8I=;SLe|G0szU*qBC#Y9ogq(# zv$v0&c0ZQzmj!K$P2bKIxHEE!t?Nsaw4(LBzm7U}{s`gm%fE`#hqh=)8k{OMZR8sn*l^OtLEe zi|gqGBDg8C^k7ovdKjY#gSg{m(?vs>o*>@s?Y2HiB%cXW1MlSR7yTtn9xnk9>7FNw z7s+znY!#DA0q%(?cZ>^T8u`N4b1bnX>uV7%m~0lqlNl=px=`Eh!9c`fjUHs^?B>(V zLX-m2-P9DPeLW^)LS0?v1YBmgJW1r2RVlOYnNr?RDpPk&->}=wv8Ei#Wev`0R@yAE z6se?B6UpVb$@G z7)3+y*sRx)8-m)aSQ+LeDNj4_h|7nxsM=a@7JKhBaK}foUU^SEP)^s zK?uW47PG92E;F%}M<5!3M*g zc=FxBZNIQlPZAY8ag7TTHsW$>$SADnpG=55>hg3t9Gh(Ui|t<0p`5Yp4aQ~dmC%Z=jQS8 zpvzxg*FIlAJ>HM%EK@?;W4%mKikO_lJA1l!E^f>OqY!bS0o$mvL)aId!>Sbp$bn|@ zx?=&6AkMoRvdFa{{qmcF{QO+w4howo31*h6u;Odu;7{n>+}f9iKgbj_8@lhV7=aR& zk}=^>faI542)Oo>gijW$au~E{y#q1;1szp-_24!?R1qMB|8&#A>asf_1Qc6 z*eBmzswsaJr!|F&e1N8{t=)R|{laFR1;u{;DKZ9|OvS6Nj@G--(i#MP1JiEW837+6 zvfX*EO@dZstSPS^3`_lt0PaY%HQ9bHl?>&EPFsZ<>Ol920L|xxe(Zp;ZE?dhdwvqU z{k`){!E%fRM2aIs!=*|O22p{kf$sM-!aZwiWI!oPH&InE!gC1wLW3uEDzh;HW<}d9 zr(S`bXTaT_f3be!=Wo|qxuW6U@r42el!%4j0dFD1+}_Fqq==E!|M16hy1Q}=LNuN0 z$tnqg=1nBzRglx4f%{J`1UqA&CU27Bh~_sQfcH@F*-!vVE3V-20#c4iNj09QS$4g< z=KK;g^r5dry}!n061~ZT9&T_@_9NSq&}+vz!li}?^WW!^jWeD~;T=zR>OkF|`us4N z&B`|zAZ?3WGdwy)Ox#t z?bm@2Ixciyw77;zCA}J9QgFE4Pi5K@Iosq$gA*r~DP~ZyGbU-W`JGcwW7%^ahOaU< zHr5OCtq4As2h*?doY(?+yyC_dl!vE#xrej<6MSJO_WfCPWoWo4iuDyk!PBDBs0U%^ z7qXnl)D;?HCiQ;1!Ub6fq$1sE>HTKHgUjtfih0C&jCRK( zkbx^nOS1)dtPr2~ag1(lw#H2=c9!(6x0F-cY1H4_lUDK$38Cq0<4 z4e`Bb?^UPX5H`f#xx6&d#dT|DZYXw2XU{uHTiOUIM z(Tr^b#FApk-gJ(l%bo!9TSCKZAkmQLf77n#iM}hW(RRc-c~m}}`dIFqWeF3mT4@j+ zuU~8B_!wF5xI}w-EQkTTx^p#p-R@5&3Y1=IJhC2Gd!>cjrmaC}W3PtV0z~AboV*=*474N@dnBt^!`^FLSxt z*Ssq9MFU>Im?A*OXEX5cmw<|%?^+WUc^(X>^}k4q9|_i?P-&L)1PX%p>t3jr%)xS2E>aToSau&O zt2Xcr-5M3Ht(>mc7Twn~dJ8Plc95Frc~V+t>d>ajXEPd0arGnmQkBo|+bcb&pQxaT zFkj+`n$)cH^=S$lOwW!gJ9%VsRrFY0;j(axH=nvkhJ-*}K_y7$-6aj8=hfIDC3Z-Y z1|gY}v>fbGzF_*?x|r(Gq3Uc{Q}fDZsUdkAhygbq;^jQ&JAI2fn-Jf`B*QDaxi87A z0IS|_{Hg_?@vs5KGFR6*ekz=pmnz)GlfL_K2A&k_^OC+OLRv~8uVHO$kEe!5S$OU;NI+cyQ0r~b?#nXjEHCG4<( zR}~shW9%4+cwFANLAUJLE0P|k9^75c3(Yux`Qa9oV;o|)uO_vE@Vil4-|TdH4lE$p zR)?pW5o$G>Q3?Fp5!=s+85wz*D2p$Zd;Fh$aL58q`9QPCF+Tj;K_0c0nLTRrl&9=f zIbOO}X~<&%p-HjscbDmlOP9;;3H!ey%VmHU`G_!HYKkVV1OX}Z-7g<*h=PNS8V6%^ z63Lx{Tw7%Mmw~!%O?7eY*_jEsD+-?I49u`Pp*h)YpY#{h4+70dkdhdy0C2+4u_IDfHcxwA|=fMq&uZU zK&4AU8YGqOl8|nt8x)X~M!G?emTtbqHCg@j-7j9itaeOOktrWsgEMG>8 zqI}_=m?R4jA0%)qZ>H}{%Z0vOB@^``-zo}$OGq?ZNh)iWTiDC$e{O1OYR#bZKDK;R z_fb&ha)?JgKzy!GYn-e&Gt}-=*Hmrt7#?==GCo6z@c=_*aICjoZbz zf+X6r238n2G(Ig$W#w;ay1(@o)Z%3wpF@i$$w?(v_w(~~HY4G+!dvj%*BVF{Fce$L z>nJwxb^54)?;kn=HbVFU1EuDqk>8dMzv(xGaI!@lYc1o{f#{nvn%R^^RBZC1nNJ%m zNlq#gPt+O&h)b2>d-y5T*0fRkPGXJ|I9mq?HO22X=x!va7o^_$y)rlG-kMN2!TA1A zYZ9~thF#cyh&F6rN+0S{#@5pBZ=Y+s=#h)HiV;4}C=eoeDYc4%KIP~4!DB3X)?8cX zSc*;%N8@%x9c^@>&0+bhujVvwP)QJSd$}##e0}J7DMOuuQi=LIJRv4VAeHLsHhp%* zqNifs_&sY5mavGulKxz!z)^onc}?rS-lK?9ZwM}I&902DYBVhDM#Cjk?_DsKo$y3u zWU{^42oc4WUg=BT4vf@BonX56sPKRfR?@9L7vF1>E;X-Q3M2$xh865hkD4zP1U?&d zII(IxL@BIACjb@dw4())*%8$f7*WN9p&M2ww@O>U&%PQq@n#J?u>u(d%7H&Bsgr9@ zsqCz+0Wu3uwLu!w>Sx`{;#vjk5#RaYx395gEmV8rEzpYQG;+~p_o!(eMwZ}GCunK- zh10w}`ax84_G%zmPO$6Kcuf~npnK+o-O^qM=AVs|t6%wLYXg*|O12wFL1oKg;!R4j zExOKKn5L|!*zNhFb%=hp^docE{4ePYTl{SwjD6l5x-~^-5=S3#jkRfE_S}x*A;l8C z`-7&_>8JA&7s*5aEplZ@sk^-Nhi)G#ZLHf7l!*$S(06SeD+l>kM)A!_V{)A zSt;5yU+%Q{1#ji1u zL4NalY@o@e_2?>N;1|U^ivC%6O$#Up(&9!BmK*!te859d^XRb^515GQ+YPq>m;04= zCmpbrNhcnh1pZGKZAu9yTktJiTu_r>yolwM7r+gDf_>iT3tW-MR-?5bPJf3GH&`CYbsq|H+BqkS+iRQ^kD!mtS{Zqx>KKfnJ2ZdmM*e zDRSfAYzQ6(@~?Pe(-C}_IH&!But=Nt$j~p6|B@|lkZk>Y&sG%Lezo`Ip# zdt@L+vd!maIA4iuKJXsbPw3ibKsrhObL`)yq6~Gk0*tQ9xT^@MH&R_xGLe?!*H2`r zzNE($+J@=DyR&txc}Yg1j!t@X$A6@&z+ult|Ji!lx{G1EtYQ>gjqk zAJ3Rsqs{R^j~re;fsM2OiMT$j+g0C%^y=IESmnU)vI{ny&j=fX9j>pd{?h{ZsL?+c z`7BRfDsAs)jJA+)^HpLHzkQJTusx$nhK37KUgD&-HESB1X2k}CQp}myw%U5t1La`s znt+%umr+=l`*~w^bi7#`hi*uuDZ6T`L6*gtt(dJh`$ZCR@p#`A#T)%qJAD6=M++#? z;y4?JFrL?zu|fgj{(2py%N-%B11a3+drkYQDkr@4M}tE4y3jt-x5?BIDC{=QRh1Ug zaTSa-e7txstLGC9NhUiLR5Ue8h5#880Q)2n` z@F$jUPYpZ2YFIychK_}T_nG$|bjiE?BHy^h!$tT{CqBS(XevBw3jiG(LT>sD?Nq2i zLhzr%z8h60C9>q_zwzr~Z*gm^pAT`b(uSyj>O9`n8D&@hW8d^w>DR8V53Gx{6_2}T zYV?mje7m7D;RVx1ThcNu5ade%uQJ}Ec%JTj1!-Y)bhJrYcyh58nt7piBUyfV`|JX zm&e&&p)@wHM%!$`!I;WjV5af%C9e4fm%D=sn{h4m6^C7%pBDPsmgeh;@swmGv^kLV zzMd@q*!bl-_mv=^{PT569_-dFe!BA`1?>yhUWL()%;CR+vf@>0*B zMH3dD`(pAnq%mC~>9+g|2{7YSOP!K1I7(9K1GJ8osd?-dKI>Q>(BUzKB8WhdN1hyf z$;zTqOyNQXjZPtTb#=|A69P7adKm7jL9!{URB1@03>7u?7u6uE@p=w`lu|3KzmT$G zvn*sl0|vSWrs}J*=kX-5=?2UUT!)R)GYK~ zDE56H{$g1+QDXT;E)AXuWdIF?Tm2ZoDobiRf9W#F;rzl-Ynp)NiT#5Wm2IzuuHeTm z@9k+9Dw6URzq6e^`#l1gC?T*VRPUv#YLlRun|qLCoE;8mF!ka9x`^8N5Hy4^L@-j3 z2-2je5u5N}IR3u4(paFAfUS^pZN!$=#l1wCl`rx*7lB!uLAdvx7RqlsQMFV{)h-IH z&9VZb9n`xU`}(hGySS;8Fw<_Q3^$$Ga34!|f076~Osu%3LoB(+`LZZ8{Mvy|g|uIk z`vrEI%g*|!eLFC1`C_|mB+G5A_HBf=KsC=vR!!N|0FQ|WECq?27l0lDXvs=cyzB2t zb=7&qsfvzwXXSo8s-$xZK;DT7iX{#H$w7sJ69fMPhV?M>(a=B8;@kq`AQkH8oCA@p zJk{8JMeEUSdxFW{ZmqLi27lCTgspxSrrVQKQ2ED#x*QX_NQMGL0IkO=BqM`D;PkMB z7GGAr)nG@ElBWaa|UJJVxaYL3dz(2l;bAb-y*PsVvFQXt{gn+G~a# zGrpcJC($mQ3blIrQ}Fd-x#ca&0UEka3|P6^fxWr1@O+L_=9N;H+?Pg>-@kvOF;m)1 zK;FDw#Eh{DTOAU+L(iGgG|{S6EHwch82M;f4UY*AF{P28{zN`z(A4}05QM^j<15ue z`2Ey@Zv`SD5dd>}^0U~I`^mk3Ko%E&185i^fOtUVpoI>)nA+0|P80I%OoYxDdz^i2U#f(&fZ_P}Ut<|YDXeP4h zM#(4i$lx`75u zsT?R5r}CsEj^Ra1y)wVlP05nJ&7C%xI~V$x7*h4{daDML9&JuubFR#41f#gtERc+nZlyyJQ& zt*r~h-1(G3M1o&ksJICT>neJ_zUz*OPY&-r!(@HPoYH$x;oE|GcfBzg^nOT|PE`}w zR*L@nIbAf4e=2WrR+W_?@TDjoXW0FWgl-M>Vl^Zh@ap6ZBGo^rD(mp7Og-)na%XT~rkH$FzY zlYab`pQ8xJlAP5gUM(+D4zjb8+Li>|T=AVn-|FEE|8&=$o_8OLhx{?s$jh45L7R^q zjPEDSZ@S;{7e868}$9&c4d0+za{y40;l+|`C_iC<3-NILiuf4h4YRwj0U0agWSmh z27?s5m{Rc=OR&`V=@EZxGIc0oJmC7RdY*3>+6Xf&9DyR|B^*tiJ0g8%_F`1d6v(`% z9Kd7ly(9^V3YGr~K9gP4@ybRIx2+r%tt3DlE{4Fj^b@(1l^eseB|T?5<3lJ&qbgbr z3JG-^ZQ_no3Xgyza>!_WDYvT#wo;Pa*(gADv~;ZvoYwyUZ`_iMUSvYTMH>AxG~0~< zz*Lpmi4CK;s9oVCXF&I5V@>e;qyIy5BRaybKEOG+`BW}laR^SqxTfg0s3g^Hh$S#! z{e-n>f4Yh&OZns0=0aK7kN&mY-Jq*I$}m7H&`;aw!X!^ZkRjo>o3AwIqx$T&ZwiQ2 z%3@Hk>r6tBk(kG9GfZ<~lHc@g52kmnk6Wq9JM*nfv z21W+FCkM+R&QDC>&s(faEvKKCSxJEkzPO=%38z=GZ7QRD3EM!oC}8h@#&P>)r4CUm zets5=H9Jz`Cd2buhYY8%D|}E!dbKA;1GG)=K-q3rRg{j{O~ngkvfQxa`@y60wZ+Bd zL7}E>^>tWWV(QBc8Tb~zCnba=_$(|T))S?Y1nKvF%Brf-OTVdEF)rQ+gmWs(5N3!m^FAz@9|8!+fPIBUl z-Bwwd%5T!XIU8lT8_Sy?%@N;?cwwP(utJ@>*=X4e=a2KxWXoS zw<7~IdsYE&`HP&9l-!%)tUas2cU2zCxu4Rz>j&=zs~Wa5^B$x4kB_rPqxui<*BO@*vL934Bq^1o{MC@>I9GKMvA`iV&udkT z8f)XO1(7mNt8rskZlZ+GdP4VcafqbWMmf&H9jW)_Toj)zX^EVT!)%xhrk+h|!aKh= z6vChH_=`2szXA!a9>;NFV~faurwive6uw@c?7njaYgKCGkGs16GgQ#kCi}aW zSQ+IG2pndVFT6Ih9h12%swtA}Qd*Q#F&5lcD~fF|)O1!zYfX4choR3fz0Pjb*$-?4 zy5ZSaeT<*bh6^$pRnW(yT%4svN9xm{JcxWG2NG2NFJK3UhXY55`{loC>O%c@det$_ z3rzQHaghMJSu8O4r+=yNrbmuOwweO{5uNaDQq!Norm6@lnq4k5u!FtRg#O?}^~Zjc zy4tW&kkX-}XXyeNRXp~+I}1yF_35cz4dz74#SxyL_E3EwdT?QOC|BS5(U32Tsl4!f z%)PEljCGPll^`OCGLtXnpv=;7itIp&h_MpBSLPli4b*%pyQJi>KaFa?Cxy{IEPFKZ<}+hQVvF;VMeOzaQH#exYnDl6r6C@q3x=302U6#>#MwUspu9 zw(1|No`Wfiem>$KJTqnpz=@(1LR0Vip^A`EW0UF1MaP{f%eji54|+)O@MG;tHDZoJ z9ozbCQY&qaq4)?dE(W$@_eQ=CUg3 z!fy#HZ&8rYbCzws!08Fi2j^WX@;op2*8G6WWs7(q?TqY` z*~+2dfVVOb@M-U5N$&!ZJ3VQB&Aax~jYJ9)nqxqYEWm_!b!|6*hc$UZ(u8^T_;=i& zWz@w@A7nryd!q~?cil`svD;L?6GSb}A*?ADVJT8)C#v3k`-4JvmRIHN=f}@kHH?(y zCb*Ree-i8VFkKyX2Z;>H{xRq4XuGj}fB4=jUq+3%mv2VB5zJQkq^HiTP=8E%6hW*a z-O%Ll7q$>GpGXHmajF+fM?)Lga$_C}LcyAu}<2OCRl(2BF=%+R^Xao`g6E?vu0%_T_ znt&|{#}R+>_0PQ;k2C&M(^+VS89b3a@#)$MO4S*4kI|l>OEIm00P+!0X=muNcO~UY zEj}zOq#d0lMGA!R^>Xl3H0|=azxqJxJI66@bD=3IPTf5I{hbKH_ z4nCx)ZOW4bRERdAAgc?jXw?g4wxY?9j@WuA;_o#G+LY9pw2@yt$9r1OkA`UP@g`;u zL-UxTK^*Gu?j8+#_XE(}Fq0ptKhSU%vp0y)9$7TvdCWGtsJgx|!!Q zr^MOmRt*@xeneF>-4YavH(uFk-+Cc1Q*9UC>Mb;#+qpvSFs>Z*7SZ$aH|oJcle5Ea z>d_DL6e1j%IT`V#(3(E37(e`bwI+Vi%T4|HXT!O2B583Bxo^=P1kmGiik!`9Hs42*;SvjwyuCrT`xW0nk0a~m_H^vAU3`@RviI4a zKi|hK%?=jCTG^OLqf-8|t0Q0jg9)X2VKSJWc>-(qWWZ{9+a9bxY95{FIuR^D%>Dbl z)#xWvNzdh~As?Q6|LWo?@EYDnL^8&L0F}J$?5%j-;~!>fL}q`0e?u2^u?n*@oQ;3^ z(@IPE=&`Q>xd~U7W3t}W^6VWu^Wbmc?t7sxOuZ*O{mIZ3j;^_%pF0EH2huO-)YZw& z=$mH=r<8Hmu)H_Qkc;^)@^{@*L!;D#%Px9z3#(Sl(O=99rqJb~rzf6TVmjIdW}FK-C+Tfe-fG*gux{ z_dhK9U<_?@o~48%JQw284H}tS!Jld{<4)wbA_2^DfN{nT#>w=DAdq-QEOKWhqjL-W*egMn!eNTow-3F%rIVOx3cJx3>C#oWfeSeewG_XDy99* zHf$Q)99hM7nWMCC{?mL(5nN;K+tC?@0~G)ClhzCy4xhW&1f{-OKmvsH$qmBHP=TR` zPYxnT@r|2Yc`>z}_qeB${Ma6~ydEL7!CVX*{HQ~DS{4zzu8bqzd;Z5J4pvW05ccZs z6z!fY>A9B@933t1A$(Ge+Fi7;>AyLeM`YxELP9R)^X$Vr0PV+_sl^)eecW~!Phr1M zrf&=g+KBiJb5S!cTVKce^;=RdO*%vWOl5Zk3twkkg;S#X2g0fGE4U zU;RoOpw1^@&3g8BJpF75>RTvd2(>A>l|K8%Z zJELE-=-L68HrawTh7Gvg0;0;9VVy@qZ52>W&mM^IDbC<-(U${Cu3QkAM`|kZqp~-h zTi%P#FqHD78oYsQk0Uj{8oC9NnmiJcX_kneRYanZ{;DjU`0bVp=AE?v`q8%C30SkA z%)0IRtT_$Zei(-emm~(3K|%5GW%ode zQ#Lv#M{1*hZ-D?b!7}uW^V6q6YZdrgdd;nuyf|~I0mqgw9Lbx@i0JhA!Zad=#Um<+ z7I(;$DK1f6#ybC^x_bGhoWs^cNp`c42-fq@;g}obt~#nxKzr#K+x1(aSUm0^dvV9N z13JJNg=e(YQP=+aqBTOUxZ)VZO7Ux2jBQK zV>M-#14v%f;vslzW%^TC&0TSC0}5JW58Rhum5!P0I@HP>IWH)h%n;a#f~?R-5fb! zl=ra~OYX$sLhajbkQs`?g3Xm6Il*Zzwwf3Ui{(XQ9v~XAFlF9It1mjX)PF2Pv>w_2 z3tD6JO|e%L`r^f%rpW4Kmgzfjz9&>(V@;b6Pji(a7bxb(8rnLA!6&%0tTQWP)KJmAAio-GQ&;H#JaYbUQrk zdneRH3?n~;JuW4VK0idLZ6;`JTo8UvF)A>Yc#e#WODKg!_=IXhR|E6m1h#%B(UXI` z)Yr12wl(Hocy|efNDdj6ey?XY8~c6*N*S?k&^=yq5bt+rp<~e?Zcs}Z0MR5ZNJUhtwOK9q z!^v@rTq;hNlM#13PDcN=HBGOxc|1D$Jd-}8$EHIIwC-C)SI0c{FPUSi37^Syr*;`M z%}i&BBk>j&B&6;hc{a^_9l!vggeoT`1qhZuBl;^@#b%pz4{pZie0t$9kQ+BGO9@f% z#UnFuDx}k|wJG{FTv(njV6>*X?v(rOA3c*wHaZhL2&=Y@W)4^R*5ErX-YT}pqwR`q z#TPeaFV$gleK}e79|c|1tzFMwOt5r6;?P&Ui169@HN~2vFMoC4TnuQhu_m$dy5z04 zAt}!HFAtWE*e;ezO(l6D_#yF~BlZNYhY3j!ntZY~5}ud*#0&+*e6+dwg11f!(&dz{EIdxT z{6)4z%ElevgK(AgJgx|5f3SD7q9n7qol<{R4nprHGIB?J+sj z2LUv+tLU{12ki>Qj)b*_jzd2!IBhQjGW?-Ca5&)u&%K6?aSy_ZRUlPV_YQd=RtcpU zC0qthA%9(kgS2Xh6*M2-43c#4lp@=VgAeV2WaUzA=wChTLxy&Scg+p) z=Jpqd>p=VE_4U=_9fus3a2@e|bch&H089XWrXu}H--59IF(`E>)%FK6Z-AK}je+iV zf4Y4ay}q$A*~;bnY*LTT6H-2#P{6!$2cyVt~f3}F| ztNso^s^5XwnQaQzSSw(D`Xxc`Zxrokie7EMNU^uKr_62<}mUV$A1bE|*W~K*Fi8Qdjf-+MGiEz@{=4(e6OJs*0$~;Zy@gTrU6m zUb~kBt>>^Cu=|t0YKBz($qu3T2Dn^-o13pgSkpu>p8bb1Zm))#yY!r&KO38|ckQ^l zoNQZ(QxR2DP-RSOVG90|8PLwDB`yg@0)8GSv{y>30Odu$aLn>iT^&2*t{f_+Q0%CC z=}@>Rw7y#FT|MLxFN^$7r4c*6WXsN}s4W z?dFHM?#&L$G#C;I#s!lnPT@p7*AJTUmrY^A`hdf)C-60o)*cpd6`|mb=ds zrVhLI^*lo~mP+9Bxt7}pB2z621P|5V?;j!x1zuQ8XTz4 zW3)ttpi%k3%OG|0u4!NkQ#jq3*4XAV^7RjF-)=*!rbL92(zWxVk#-V}e*|lp;^M6B zu51un4#$ezwJbfby<9}n0FBDT8ZaJVa*B$dUBaPm#ei=pOa&t8)V1|>lE>wGHS%0s z{N9>o(XjN(t8b)G7(7eaKNc_3+`?kA;St%CLe@@gFPN*?h3r zB4ph3d2juBY!Oi*rwkZj}JP34>{%h0^8|y-b;ax!QkzH9uHOCVt?`PA*kU%;!Kzc@6RD1 zGNMPr_>1a73H~0&L1obt1M+mBFo!z7)(ATto#ZAmxou&3xWrP?Uj7#}Di{-@cR_P( zY%H8WMgR?J=od(}X$VIEGZO)V1~mqU=iYE=IX>rxU4+G%o!cWKEC~ceeY9xU)F(2u zZ|IP2uF-8wZXs5U46j4P-u|(t=nrPK}uGp!@fOBd@MKhE8?KPpBf*nVSOoJ8~ppLQdi8%{&Z zx_B(Tui+xrvR|~VY@^XKfIs{G+^dW6tf;88vg|wz+ya;XWWOT6tqypY`$GzS^f(jCEps`pJj3)Sq8mxE*#4+{wGT z)*kPR$(A=CdI-3iWO|9N;>)Rsu_YNe1s!iq$N&wvoZGTQz~2Tmvk>#0JJv*jJiv^Q}ntcJ*yI|MVm_dg|Hj<)oPG%U@4Oa!%8D zt&6QZL$41yUW7$N#95a&sLj;wnuJq;mL6cmnYRLMD4k%OHq{o2$3r4#fgYl&t+yVv zis|l6$2)I-GP?q-XZb@yLeeWhuveeAeS8^jtK*LVIl%{huH?@dDP<;8iS`Xu9Ag_5 z^2OUN5wqgW$zZG|RTOM;hOJJ#nt2}G>em?_IImd&0XKTPqDd)V=`Jdq*fH!O0YUH8 zejBqOI!LGr=G<35e)sIo5D}X2>|WjSHch9aqthxXk@}$RbTaW&_Ug1i&e8Ep^YN&L zQ}=FLY<#}uiS;vt+LwV;2%!&6?SbSpc27>!JngG=$J#lsBg5FlpWl)n`Ap8^(=iu? zrMoSly}kS`V?JB^L)z(JP{=n9z^6&?@~?kUpZu6(lngPVDk}Q1cDZdI7x__8A@`Ch zQY{DZxuMHPwx_XJH_MM%ris}Wy|`!Hn_adUQuuZy8&=+<EynUs#N|-lAkaZ0F4$if%b*QBrySnM^!;MsbHV?6;RcfyQKvvO zI*mt8JLTdT?GYu<>w1t0KypOpo6cfE9jaLE9czUB5h~730{H$3**9;hFW>FaT29u3Mf0ZZ@za|R9HgwQ&u^(@CSC_F@KI-nmFl$^tgNh< z2b1P8k$H^UOTRkZvu?)qzW&p62&(d0>r>{Lq8r7ztHKR8wZ?tmTWk1t%eeTWa9;=d zQFM)=-~BGgWM6|o50aGwnRj`q9aZuG;q=NT=MLL#e}P#}Nqsyi z2!HX{Y|VDAG#dAK;SwH+z#$$j=?(I;sI`O^x6OovZBpJXt_0Ziq%2FTF6Z->=i!#m zSV`+xLoi7M7FCS_6t}(Bdym;|~UO@@1w0ZNx;O2=`m(+Kwo3d;h z-PRrbi+PMVi_zQ=dVvPZ1f1PUTb8@<4JdHySr(->mjqh*7dnP+Mb~9 z^d$=+=`(tKrQ1+`x+_$q7OZUbW|{S3t0d*{(s<$V?7(4WI7~-bIY=7=lhW1yPlziV z>-TS*b-*i;%@n<{=m@T6mMvWg!r0BzVpGW1O|{^C^he4B%?Q2*}#iRF4L^)WK*2_9(?UR-0nT=GjubyRvZ<&S)&uZLDj2GcPD=_ zK=tzot-R5y{`#~oDwN{aSR8~=sd3~yKO zdJ{5^ddpfN{5Z*w51!$BI~iNfKoSxZOyau%in~dSnI3Q>FUP*#M&;&LHnWXt6yC=h zPP;XX4AfiZt%gn5EMF)so82}qBt1Skc6oM&&7Tl`n42?bSPB?n?8g|4g1O8{=J^jV zLB-4b@nyvtwSPq3$v3+2ZV*}jiA^#eZbyX>IbhK%d2<^KHhr?is^GCp7@Rw)@N{?Y zis2GT8QNey@tiWmA(58pCiWfn$b}~r;IIRCUhI;s)mP3s(^ANkoEA}?mSBj-<;w*SF!Rt_)IkkQyBX0R$EoXDH9Wu=Bwaqr3??N*oaS+GE7ab zk5xPNZF7~jaS?H3Z>D>X+bE;Inkik=mp!bZ&|%!o;?wG`&1z!yJ;UDKv51Bt$|%R`r@zdFm&Kqk zPOYrN#o0y|*7eD@*2(1P(v1VK-wc(|Aqm26cH2C-vL>JV>< z-A=}vXO&X;`ozM{b2|C{33@V!h9|L7M7_TVdO7GEUuUManvW9|8Mlca0tCYrZ==ql z;Pre)V7oDMtt40vEa;o|0siOkLQOiHM^srGh{#SW#EIHo=1DLC?;(~4!$Ee-f4Z5OD8G&1z z8b0#_nSu@2=kOiB*OfN6=6odp6)iB<|AEK0&%hZsZg2pKT&hmdjxcG0_==`!dj}O z{~IU$r5|i=!+31_lw3)Bd-nK12>)5_73={7jbA3KT9Zyhq(cA^pBdr;V&!qf&i;R2 zxj1+q7%hrq|GsibzrZYPDx<%nY{vi(X|!oE6Z(%C;E%we3&J0+dz&CYj9^sM2NI9R zr2mQZpLipQIDwM+;0sK5YvH#{5cna3N1mOUpfFswxIS z#HXT0Bc?~D{>SD^2Earcr;lQ2|2c$lBH{)3sj0*M-ffV8irT?$5m(^v;s5wiI1E{0 z{3fd7+qVE>L@ipF4!BCYhdL<)&HY)H=KNiKZf+-SSzgNjJbI9-90Y*ZPvnup_jfj^ zhQQq)RUC0a5;544328!3gXNw*3te~dZ21;FjMs4eO0Km<@%dtTJV?oW5e}jdnnO=Jb_*Qyul=FAAf@Sf1V2HeT2j1U50*1L z(Om7zjwZX=oYC*U2%MV22I3SZoOkJw(jMcpf`9Gv>3_jcsT6Q@A|BswlG`8F@7k#)^@t=iLZ z7slEmf$#F3BrZQSjk@@RK{g28qHV|8*v{#yjU?3haxHZ6;+HSIkdQtgank{@)fRH$ z&nlvsf5IB&ewa3_#j@r;uMn;DxgkBVui2TclL7TtI>hB_ohzaauIGk*|73boP>LspOEY;OW(Eb0LOlcDw zrKhg~-+mX3MfOu(PY4PqtX@2>_I0fqW6p`2%&is)G#1~Xq*xzh+JAwFiGzy^{Wz>Zz;KxXp`*$Hu1iyxoY1F39wG21Liphm7&7r*4shQ*;x29S_K9-acIZ@zgj5 z#D_hdWP6;k(e?G`akB>j^V?YXhYh|bx~*@v~JeL~{JC6F)D16gl^k37wXeMeSwrWHUd{oA=TNIa7c zxqwDD{i1K1>haSvK)mih|MOI#K)zxd>xAzz%|}P4K2_hLja(}S*F#@K;)~UZQ`mGIsvr|4X6{hnR9Roun2jPplrh$2Bxv-(hMWy|^ z+hfH+N1xe^ZEF^lv6GW?_++EYHuL{W=->ZmM{!kEGLC`ZNs@gJ z(!HCAfsk{(rlV>Sk~BI0jImZy@v_hV#xoqpLS$#5K*e`e=eo6}iT+3@_=zB=LwmFy z*+a@qlL6`;Ey~SH*thoy3KOP*YFw{}9TH^8xuwyq<{L&a*!63*Y4MqzK%2&W4f(6`n*TWiJulk4ViHL7GHJL;>I(`rto_iX;m(_aMlrlWvR zZyhrX8Wy7_&p%bV4|l`w!`(-=@`WFgn(5x5fZF!7MbKa-Db1sy*R+mu{$ii&06mF@w{Yim`rx{bTnl@^tvYy_?2E6e*66>zH6- z|C*1d05%Oa(|kN|0(jG%`<-C_mRj)dAsa3g_2I{tZeF{J=d>1ydOQ-Hnq#>|`j>9O?HQT3-_O+#}VMMl}cF zjH@svDB&D^D8LluWF>3fVb)#xzHX?zihP_tnyAP^?ef;mYu^k?Xzkw0eFgWxl z%oF}=5^^T6t+p%E{=3UU{-=-nFJS}*2g};nC>|hDL!f~0C;_9AeGiOfkG`2k26QUl zmW)*YoB$Uu-!mc&`Mat5g2P*ZF9d%BpK?O5U%Q-*^8dZ{H3*>&hQiAJn%|)YSgNEc z={vQbpDyI`yR@mP=}Q8Y1~eTG@D2q82x$EL$e_m&5%Ti#bHfj3{QRil677#6e=m)O zhK|?<{Tr81fxqwnbARybzrVvJq2uWia>~k9J>@&^{MeEC%}x64sF^_M(Bzk@!9+rm z;))Y@4m;2X@711#@7Z75wSWiM+tt?#_QOIRpR~G^U?{vk!79=jp%#vza{) zc$7S}f$t3%Eu}>*jFpvVvT1xs){B16frn)RR}eRKv&%~|K5cYRSFbId98)#Q@I)CeNP zL)}zd+#iXC{u%Td-vry=SJ@`W&lqBwO^ru}zdKoL69^vqe^1UxBBnnH@^(h8tFz)r zU@CZm!7OY$>xCmg5Mje^LgxP;lL3`S6n%rDdwsPdO!g0=VeVCnmb`xruLagyvBLq> z|2ukN93~w@s`D6GLC*rHhGT;0)dWawSR;=!Rj#c&+cjDXB?nV4y#O&EksF5+n4L#Z zi3tZ7C>{?b#g-9)wYiW^iVJT?22V*{C*~?HGYX^(@B*A3P*A~${fAX=OChv!%pk?d zL)bUaw$eyqgdRV_(Y>EQ1^3nZvhGkKM5qmQ)?>x-YRgLY7u0A_2(Ts$O{x!`Wss%$ zt)n6AwLr)R%FU)n`30})>w|cHSOc3FZ9C3bSHeRd5)q{tpmyCy@%~^uXwA&@VA`QV z>lhL7Y@?6 z9|K1<8oifBC?j*zqsoR7Y!MHssPA`2T2);*Ba$GqiDR2zhGg{6NA~%}5eh46bpH^+ zwETa4Od9Ypwp^t$S%?s;hq^R0_3EZbo8)yE1&;*F`_byLfkg%V+)4Z|(F)bfnORok zgHE0}Z`B$!P8EsB%+;VDXyx;f{G?UI@!#1Y7jWk^JlzwZlEJ1-VApq*d!ra%Z8_ge zk@vYM4w@{ymAgQr?F;6>wb~0ZkVj3`TZYVePim~=KLD!r_#{HEfdCgM;>glKc3>cgA;gE62Q|nc?un|hB;2Q7wA8}|kHEJB8iH_Rvpd6PMH3O5guiAZw22Qq ztno!tQ$DQjA?wfNr9jDURcbR2?ooOXDTJ$ekTpV+r~Am-p;b@b00-u{R#E-)?~X(cH_FiCZwO1xij zL+$Zcc0D_h3!FY!u`{0*rAF#&l1;>;Z%U#R6){_=T!i_pf{`tqbL1lavzEMjfFfVc z*TPgmTuv$Aq8@5L06A102FS>EMRrHs1NMhh2i!u?p2~71GXf4AYDF*{_aH7V&dU2E5zHYK%-AuHaCfi} z2_ctuA;2@%h6Yi=&;r4{qI$@Tbib(}AckOo1=oy(4tlErv{{S<(m*Mzz{yIg9SYVr zzA7^wB6RL?R)wUhj?U(7@TkNP$dugkODvhd5Y^!-EQ)fLcs(@C82(wnp+FNd`@sE* zz`|c1$?5)Yikxxr2L%$K0i0g3C@za}nX=ep{o^{B7+6vBppNrOQ00&F-zJF4LT?;4 za6KZxlH#rWjOU+8*u$U7!QFbUX;;5|8b_9RUsE^#HBc0rnaQ~NeV(o(*pLb!x_m30 z)^Wb`88&5b;Fq^ZsgI@Jy;*MFLc71f`{5YHUYN$#xz##|ZV)_}Lx4!-FmkK(NkI}?! zY{EPA#m~_+LE>}o+o9KZpqgNQc^pN@!lDP7<}@G^NC0|M#rn&9aTzUxu?Gj0VkP(? zu$fxh#~UA?s=qK>Sqrb)Da5z`{V_dLh zsDVip*&?A>3nl|p45XOhq%JAxvvW5IP>g4F;V<2 z8R+EE?w6QT2?=TJwcYg|o(MbC!t(@j2kp>CXdTr30{x7Up7{YlF5CjC|o{4Lkk9~Ks zD7pCU?qB>Wg}+sR=f9W;AxjkEJe~smDCCy3H}6T}j3OP?Dh>2(iW!Iq`z}vPBIJTS z4zomaRWIT@s$a6N4+`xkh~54sadBx1xYX>ettI3fd|cxa2n_+XJ`k$Ne|ZFvH~Ai} zvVPd#-5ZLVM0{7?wx>M}az{49Mx6}rQ^%7T6Ww};3?MIRzDkOGDTr*5L_sX%+MF6n zoHwZKPNa~87JpKvkSfV7%%RHnXl50YhZ6A)3Np(v7P5REr8odSTF`k4G8LfyomgKV zcxap9v6Xk&ZECuFIAaaQx8Yv}ri`kSQ*0HP_%WI$o=IR99tsZb>r(i-dDa(;FKsQz zAPA!4=AK;;$9n`hxvyTK68_gCw+jK0)4v`B6t5P8c)$`5pjQ3F!AU^)UH>)bPSF@S zqEFfn$2?6?>1%+?g+&QKIrhyec%uT_twoeQap6={5D>)2CM8iuS296C;RjSXvWY?w zK?RmkRYw&dha=t?%t6E9w!msNz2Liip|Epw|LbcAUO?u-GX2K=Zd@@GN(^>mDpgHQ zHpf3-_(B6=_xmQgxCuEkG9px%A=+E``6n7$;h$Ei+b@CFczVWR3!;KCXk}HTf`ml6 z<+=tZL>u@S9d>1J5NAK|-&uVd8!aob^nNfGHy8ngd}wI=x>@7BUxkEDSEmJHd(ix= zgkm;J&>Wm|SjdGP)7t+iX71=^uGYTPvQ)Wj6_&HrwjfYpgUPChG4wLe&GkU6ia*PO zsZaB|7(KwRQOkRAxvO~PU7}X2^Q7o>)Ba~n(&5=kL7@|v7&+nOy(yZFFz8?httGVxvr@H_D&T-U{ z=#Y_B_Fjpy9eahDxGo!woa*NfgiTQob*6T3od6 zc^-b~bFP1sQEyGc!2sCi2o^g!t~#{(zHew`Gd_%8!OPaKX$@8j4iBrFf0u-Y`s6K1 ze#Vf+a+t!zrYYua11gtq1_1lm3?FlgwKMU_{xI(d3B$UN+No|wMkb3SQJ2-4uxMG` z%g@fnrJc2-zy}8Qrwe||Y)jwKEz+U7eK#uZ(X5vk?b_k_zH+taK6BF}2fIW+A)#LN zoO3Nbsz4__pVU$915cXhWwtW6{@AV}N5^z!rQ;a1E}(!O$%!{YuijE9GH#!AQsrV0 zqLxUDk-XqW6A)-@1_Xr)(MIW_=P8PP{1`WV9o7Ya1C{1Lo zAV#AEIvxe8^;dq!g=*#2+L9#}ekQAS>*w6rjKiYqh4V+5paDEBd3#=?pmJ;6dH!Cl z3m4)dXoh;1Nyt*P>U{(`Pn{YGzWYc8!vpWUPL9Qt;ch=S|2o#>*j6zqf3Vj64q0;O z3Fg#|x2U@1u7^#B@d1<~upJV-F7o}%A(UO%vH$Xc#M>`k22*`AyKm3T5YKC{4OWy?vZ6{q?d^?<$@T2UYy2X z2PFHR4*f@69rlQxYK?Wj?2R}KK0Enq@0h=344}uMmNDFBV?iGlze%S3;%an|+|JzQ zkCqb(bP{n#f&@U)boa(|B&z_X))MYdiVTK%Rvo{Oz)(a#Bo%Kg}5O*3H!uKuRKO|rF-THeEW#MZ`$KL&eM?{dZ*8L z#zK$~xEY_^XPK?EWh{Did~&INw4q5Q%B{~tihjK}Fsm)p^HU<8IABmjQBjeA;Nzab zyvzW){`ysZZSJy3Tji%+9f0+$CdD71^&qM(eX%4w^Jwab$G4oZ6=Ly2CNQpQce@uA z@KxRR{<8&v_9HKTOw4U)$@18ia?Q;hnciUj)@&mnTUS!vAQj;x08d+%nBI!b$JT;4 zfkXK0Xlnb@m)RAj0@-RLQy+JXm(OE>&{Qz5R(~deDpVp^!K>pKv}O(2{4DLVWa|zEva)Bq4Tw;>kSlm->QO!^ zB7uV#CX>_OX+}_#Ow2s7Nr2G0?s-F#Q^w01%Y*JAd}^O#-yhQ(;$)VtrcgcJ9T|F= z8~>Q={E_;0OiVoE(?;!p2O}B}{HIDQ{NA@N-I_jHF+}9|_R~n42iH8(&AguW#pGo^B>L_~{-*(@PsneXte? z*&2+9PsMWEbtfG)gE&7j^g*_y&ahEoU`@=@`ZwQeo;im1O~VPi(BMz*m7$0NNu!yi z6<6nFdEktjzWpa zC0%fe-E6v6IUx2S0Db(y4={zHFXJP0ZB?COMva1!8 zVY+A^p4gg^P1BbfQ-|mS->TP{x6`oDV=f&%S96TyIIG9SQp(Ej=risktZm693G3^} zJHL0#IdtYsF13d_h`a?WUYp?eE>G{g;!L$5!F%tiDrR}+_WgGi6NDzO_k9T*ycb?` zJ}fxcaA52Z(%B(iyCNQDqiVH|V8p&H0(5~v-FREi+pb@^Ab$$Dzbe4F9k&oH| zB0-!>`wt>W9#qHT)UKp(wg2W65HMQqVYai&sr5*(3y8%nAo$GM2{t)2mWNJVzt_g8 zbBHlQy_K<@7%f0Gb`P)8VHCcf=Vn5lJ3l1-283(~<)Q+^fmXqgd>={h0d%O$^9Po3 z|MFkC(mtls2V4{3V}p|0{-r6vPqvg|J^LJ_ts|^1(rXmu`(&IgsCxg)kJcJI%nXd^ z!(!rblj+&FZcMW%K3ctabN`wGNeFeN_8>>?n+wdZ^Mt@{4xd=pkNxIDs9kL1dC%)1lgF%Vn0{J>;+u^V@mZ zuFOt~Uiu(0)0G<$wEk6o(zkKThWM+WPhPS4ijw4Q27!AHZ7-9ChBB7CWgrLJf_ZJb zC U7C2`5V%-(u)JLE@oui_ov$1wRckZDS2g^0pQaRC!Z#cV3M{PGIh20Z@#7K5G z^ih8}@3=vRe2W@FyXB-~sEAzAUZNdZ!P6$X2VDv`sy;v0G%%=uQl~lw>3Q$JzCJYB z?|4$a&bh$;(xvVy#yM!RW@xfAi%g121Q&?@WW?37oilqjgXDMx1n%YMJJ}6#=@?9m zM>QXh)yg#jRjWp(Lm3RGJ|xPq-cb<4pwDM}&-ox6!sFUnb)DnUA{Ps0u;3P(;}jM) z0RbR?zu7wuHa5kNGty;2TP-d5+125YD`xMawE2n~=>u8D%<&JER11%8%4|$O^38<^ zCt1jf_v2zbfmG~V1ljeq?V_b| zEyD@ux2RKb`dM;*7fIvxHnP%HV%ahR7yV&>%bc8JXJ;=$Q!+4^Pd-PVx1Jz{$1q?~ zCO=e|a06;G-@EQr!X&wr#Xg07wf2{tz8T!Bl>u1yEMYnVKNRV@loY0`>INcN8%^YN$8P8DoT%=P-7~Le?Wm9 z8eE=e3cLROjq(0Gs5OUn>>1YjwvVCy)PqZT?rMZcg!le$0b`M=I+g`93PBq8=WP*8 zW6R+NF$&~Y4nT5K>s9^-hYTi>@il!Dll?g9V zB~mxki?TLmX|i9|Id67qZ}irGw*Q#HIsSWNLbz0(b77!5-$Zg{RKj3)`H8RnP!gS1 zQL^*OXr?SQgBLVes;)K(rcVjNjI1CjwZ#{972ChF3?24%U&p5&7v_EMlHU|InV0^q zRl3l6vGxklne!|i2O!)#m|aeW(xq-`Z%wp4`zsj5C`3Dk)IL@g? zGx0z!oJ7-e4rJ)vhJdR)uyu+o)H=B-d@J$nL+`n%$=DLVj#76$UID&% zI1bU`9J4n|C{7mOvswJxJdA`D%jvmVIO18+I$(p+&fa#q!&AV$tH;EO<+FU&r-#IC zlLc6SH=tddPg<)G#8I2rrurX2T*us**k9jTO$sUM4Ey?e%VOjuoZLe%`nWV``#n?J zT%IBt`w!kjI1eX@2lG3w%&-btJZ4zvl3$7N6iMFQ3D5vw8N&aw$9oL9;Xzoi8NT5R zs0#qzr*fC=5h%?XE>)fqwY3&p;rH(=yAJ2ion0A>ECJj`40`&r6Yp`NK+Lof$;lnZ zJj=iZ&Q;8`J@w`88_j1fr?t)YFkYsiYhoEY5AQ8qm04JgCX93P=Ndk#u71JNK~M;` zuYQiBBKr@eG$xfRTkVismYj`Hy<4iYw^-g7M1nIx=F$LU7~0*rU;{WT@GA-ju)HXu z`olp_b$`^mRmmpcMJq=fy;E+IrKHGC!lR&pt6@?9X%rROkJ@}dvbppoyr=9%W(viE z1^t>)U*%eM=4*~KXiH(BLNY-aluBwV= zOY=!dX%6^0waZe->{w`h3rBdC`4idKA>YY9cqsbonzf@BnaBGn+TLfbhc>S6oblv; z=mp&dvZicf25TJQJ_?|_YxAbnRp;q;u6E@d3u{mJk>Itzr~*9-q|2->LwIOQUb}Rz zR_|)eBd4@@j)xZ>URzhc_3a|JEqVx8k+ECWkI4Z~=&KBDT%KNxt|a5Td0A$@@YR>iHA}5C+m0TC zC_(k3d}AZ~WvXtB0%*Y5?YN!L83NG86C>eQc;TASm!)iJ}lvHY|?;y?ph0=bq_x1DuWA*Y#ga5GBO7wA{`bN~QzM$pbYN zd*Psvu_kO^v6$&V2I_(+0VL4(Muvcy;V~F^tl4S?Y;3RY771;ZOQyr(3H~k&3axPp zKynGZviDWCrz%(pJxxWzN$8c3#J+<>XaO1?{ojY~L=nqh=5K-GCM&Wm!11A#(u!IFRahaA5FQ55hM#DO)*F`=Zr z(5L(WwICP{>)26x+zORz!!e)sP%TrA3`J;Y%dR*vVxqI8iHYlgI$d6@?0}Eb0ek>_ygNOb8C#ZuYwq;&|Iu((k5uzdKE2I5ms!U4 z-A~99lhJYR%`_h}DZRPx{>mW?`JbM66gzV6EHPhU*EXDM@IIP8t0h^Gv9S0%L^dq? zP~$>Dhp$+Pz>1QyiPX;8je`l?R^g!4`sm9e;?s`1CTU_CfFoZ@F8vM>9gF_IXeR;@ zs>nnzAvIN^?(3~Vht>I+Ny?M*4@#)Q3YLB<8BRc%0q-G|>leRW1mKyat$IihRQ(0E@F)L%nXI{E?S z>A92&C%cF^uaP79liLW`O;K(6-FW|U(7oB$n1GE>AtUG5 zG3BCxx^JiPzfgNf%FqLyRfzvdP4ooZSJFygV-P|d0Nve}L<5$^MP0ub^_N{Jfvr&m zF_M(%B}56IaOI%Tb*2N!CC&rgP4XHzNJ1p)^raxaV_e(Xs?oJ?Fnh%#!IQTlQ{F$x zddbbMW^Mk``lLDH-qCeqI|VE4O=P9LXh?&?Q~PZ#=oL|?bcyNcux!6CoiFJFGJG8&Mg_}^ zW^MsHBr6#iT1lmmiOUuAke(Gc6Q5@8BxSK>uPUH)4XKkg8bCMc~X7@IJNap+K zp)o(77`4EAm)Nl~&`4wbhNt%%sT!eubxg3B{mUjq4f;SikkiRK*-=x;m zYJZ8VFuBg}#EseoEPX%Xw|xjWoRCmX)>q(z$at>gzrHx4^iA63|`*XIa%37(W~w-xjNJ z^Tf1cnv*cmqK{MQF2+{uLk9&*UiclpxwVQcio-jJ`reE~9WjOsQ?oP~Oyfg~oQSTq z=eWO-J=nWOc|i?f{%x+R`3ne(YO zR9bTz;y??{ZLY7M5p^1i5^|+!|7F5*=2EWm4R@nP;@-{rD8ZVotHX@fjDLLXs`GTT zXjaq5)Sd$X{mT6L0Yv7&0MnEWWl@Ldc5gh~MmT6};<7eO5EOtsXujgGtEB?bB0MJ~~*4Yim87L9dI-=wh_PeOo6q@>Nrq*YyMfbo<|X2AL1e@36G{m&WijrUg1ykfo*I)YUNwhj-#HvZGP3cVH#7 zU?ZeO<>uyA-+pvT!Q;v6=IL@_6giAmr&Pv3R$DEio%R88Qv8+hD`XIQn<5)drnoq( z?Q@)yQ@$$|YM2(0yy%8DO8mi!J|n;-AV43M13o-u5fwE6g|0CO#tY#lj8?|zVezIE@02veW)4TNyo%)?z-XX#mhqJJeN_lp6f zItJgajmuR>hjGGTP8?9>nvy%~UDo~kyl>yW)#f|$MVN9W0GT3{R(h|8d9ptZ>*?wy zKT?a8s`dv{75I{<-!RQ9BNBuco^GfdDjqJo5Drqz5u!LMHq;^_ zSvCpjVn9EJBi1T{w|vwz6B84G@vMKW6hRRao%LTrIRzFWAzi35GfBV`i@$LBab7A; za-r(;JTpfp>zDx^>uqxC`zU`;Zl+S@Ja?JjdnG=et-bffmj0$WIf}Vzv3aXX+mW}u zhB`YRb~V&njZ?&pIPPkWj}L4scfYt1Dvf?M+sLrMKAe|E-+q&LYb1|;`rMcC2)8!JvUI`>&yDNx_C_NC&ElMgO zFI71E)9<6C<$H0}Ro&DYI+xijs^IeoMB{#5BD(BL~*dPiX8gl9lx~keYB;IUzOqN zual5Ns)bU9jnx|RqmnUDYFa~Az9Av{xFnA1*f&lY8SN{nesu_W!|~=_a_sSG+vP)^ z{nsvXe0@`S=iJR>gEC7kT1z`?t}cDMZ!pSc^qY=vU(z_3T(^?92II5X`QOX~)n8|C z^j!9f2~7gr=g)*jD~zp5H@|=3KdSLArldzFwxav~p$3P!FT+a%HoJlvd>W?JZkh1a z3rk-tvRd4)|JGuEr6-rku45SgSgV&}>7)FU)~4{8YhQ1MbBYU^85f(D3f;}%)Jl1p zq;|5w>e{s>`!6X`_DyHyTOj|Q$RRtVVPK$GGRJ>x`o@KswW7%ZSK)#eY42e5Ljz&KUKQeIAikA#kM9OJUQ7<~XB)syx;t>n!uuV>FQPC#id ztGUgk!@6?o2Aot@=er&r!yuji6zTk(0%jsDv}&xJ4M48^Z{KoGuDoq-ZoOP%#p(E< z|5=dL%Aw&N)(9}9@&d~4(Bkh{#Lv>q;CaZr#^n;n!3YY+mhrdz9H)4#jq^Vr{5F1Z z(op=l$4~u$yL0?0A-KCz+qKuzkDMH7Tyi-9`}RFhfM7ZN3RMW2M6$7ECZ$5N`b|%l zTr8exCUkV%`2p&Sjb_)RJgSx?mmHfY+JdEb^4m(_Z4@%h)0V1hkCY_xuk&x_cxycy zed|ra=+a8i&FvRq481AmpB|<8koHWyIkvIZjYb}_pB5C&kAn&nH)a7(vBc-;Byb1_ z6mJipVF`=R%(OE~19QcCf!?0?(OgwFM_^#yc((-E!4Qtt{f|d zB-#iJHQ#wu86P@>+Vpy@n>o;WRI9foj6}XAhIwmZp+;VOwx{<%?cCE}*V+VQ+q`>a z^X1mH?z*oBSU1(WE+)M@5p32jo@&cMZDJ{@ITGmp99+;*Qb)?wtb=~BnmwhU0|dQc zd)`s6CGD97V7lXpE1+1v1^D+~%TS$`{ihKnmp!7qn)`=g*A5}Na%BR+7+9iGhKd#) ze)7N5ocKJRm!am#05JiGX9~K2I)m_R`(HjS+4%#$Q+XB;66gv^=fYpVK>I zL8GRkl3Zdix=Y5vHPzilF}HHTrE8qoS3B8zuKM_+BgeWq-hxBhEc2lAk4MR%w{v!; zQ`cOYnOvA4LS3P;y+J6E)vCwlb7eQK#GVYviaU}~%dK=UA?YI=%)8dLNx2^*F3ES*^a z77@@F+aJHA_6D1hVb71i)mIDlc%!)5;5@;9$Ope-9@3X8uO7b3$SKfslvuw$UFFK{kyHn1sj zkWnoENQh6@6H!_knj$4C@*Rrtgi|%fmP$=oQp8Y`34?m5POnSpG;Q<5a6l~sQ)``V zRm;ZdZhJpS)VP4(>QI9c^y6K!#e8mR$rG0O~p-JbL ze*d-~s!g{Ce@5})lmN(^{^iO*53zxB*wDCSv&re>fH*&($-6?Ody~QJlBSiH>SXqY ziVQ3b1mKL>RFHm{MBcfR4E1F+fzPnv5EJP3Tcjl$z=uNZPt1$%!73Vj0A^x>DP^?b zr|ZVXr;~}7+ATDJBr5kUGQOPa>~dN|Q#1L|j2Z`rn6g37?>{0mj}e1eg%5d{KF!cZ zYYXo~O@HV{lQD3^oT4DN^k|x1%3j_?BvnwOAr^7rf0T0!g?b9=7ca(xH6ruc;N=9w zq%`^aXsa*GD#S$zdC#Z{`gZ6F3Jgo}KN@Wym)ikP>}CF=I6bx(Q?rrRdac&90yZxo zj1I?{GrHE-Hw0&T-S4IOdej81_8*!Y{0-rH24V@zc*$k}^jF8p?Z%DvllJp{q)W3! zjiuLo6b7rA?Fpf*ki++g2CjOs=YiS`fg~nDZzc@9bF#x#15m#GTfpLqUd{;B&3xW^ z_v{ES9L<@q@!K(_M(5-iiJ<9h0rTZ&19?%WYHW8lduAQu5Q*Q#i{phH*h%RnxEVJ= zAXF`Uk2bMFs(_7*juzvKiPgJT|KmCi%2lLHW>kJUKc_eW9E0YyYZXwgLA}mryS*ZC zP1k?5A4>auRRYLP*nbTF{sSvUwdNc*>L1bX*ctrkz$|w6h81W3N(6#fmT!PE2f-Vg z6^9C(+b1)9^T01({pKxaV#yTX-4fc6^i#}2I#`PmT$R3+DeGtF*RH;Fs0l3L0L!YI_M?F}E}AqXQraAhC=@6lIw% z3kQetuuH8vt=^!sS+1ny29%^Iyy6)&9&_8+Xz01&ZJHkaL#PJ;TKx1{`|S4wYzj%O zlk%TS$`%8cqv=OAErW`WFb?$21igtpfJ%Z){J&=!cFM;2`K4ZM$;Q`L0s-A;1j}?D zvyv&M?|gP`tuhosv3kue1SXJd2t$a!_K_2n9#&RWRaZuTj(st(S2g%=qW~`=oii{p za?|Xmh6V56&;YXd*)l>m40@5^S;meK1uqaoWaEL5Yg?O%w5+y;IOhWIUKx>Rtkj?k z|2N`@^w|GEcMpz1s*Wd2vr)$oq_iHU`cO|+)jH#u;=lGyL-?i#vsW0R_LK2;xD>B1gZeoxlpVdSW2^6;jg>JF9fHo3sQry$#@k{* z81J$5&9(&?rYXpmQs=a0_VZ&21O%ZRR=$VnQ^RHXw6GFyEgy=5nmYKOI2vV1cnWgF zWmB7`MgaI@5j2qms~rv3KaYTQf@)?8;eBA9{&84YP3>x~;twBrLErKN->wTSTBhBC zBtTP3OJ%REtu3XaO#c`7csZ22&z(Fe3wt2KtGH zRz{J~iF&KTMj6+6?c+^Brs0^1F*?2BM<)tZk)gy1Z%P(1Bt_AZ9`7Y7%NI&0y5L5z zx4om5od(gvAH4L>QX&lf=vUtB{1+Mf2Tc8c_@aj}vGA(YWmRxM0QNyeWpI^SW#@&P zWcl;)XB8{k0R4Oi9rpg#5yo}zs+bj2>}%ItNkNq26AvR6<85}AxbDk`=;rqNfq`6? z8ireBgX#y2sep*@$Pr{)vfo}$=LB7X57b=&NpIrz;zpyolW9JnuBQwift5JcN2XnsV1w@| zN`^{g8ABeg7m(e{uI7R4r}#H-IQ)M$NjtQsO&a*i;TtC_m|?N{M@-SDi3{lnfm%!S zP~t_hX3xLEsnaAr$zS`T-9Osx0)Mn`n`2h6ZBZ>LkR!7|<>`l>M@Iz2P<Ru$IKg zWz7ZkbdnplCsiba*6%^4t#!iB_F9rFbzg(k8*r69fzg)Xf>d9V;Dv&GS;pn+&S_jW zLBATxuXJR8jZa7ryn2=NeDzl#F(eFOAN)9fHb)geFb?AC>4Ra2vKbt&7an8(3{P|h z@UUa^yX*n`mnb$s&9JJ6_g6|nKfL$jqI?cuOz`^u!H*Iej-Xztvts(xv%6Kx#YCv- z#2(@W9nV6=IJhC1Ko?b(G1OMgR9pPEERk@{H9RM$+&5>_RDa@VDOUAS3!^%7$X7$( z!~Jp*8_Ga1`ldN*X#2)4kN8^na+ENwx|=2Jf&nq-bsn7nKo1A27|Om7N8rQX!}7cE zCEdgBe7f^IAG{sKR3h#lJ{8jH9|b&+56jHVNl6)$QbwKGihQimh3sAd3f3Y>#nesx zQq$9vEwDHosfZ$>6k&mo@Zlczr!?|kulX=K%MyLzG#ClpgT}e7G8i zG`|`JlY~I|)$$7e-@4B689dGf?{!@cmIIb12z~I309!f$zCm)qFX1qi!1EtP;0TfU z=o7LpW^c)Wd|&M_klb;@svQ_pVUHOHrQGvHVt<@k0NEJaBA;^%X6c4CH4nx~>MPBM zm|DGTmEU6Y5@oShTOaCTRPQqIkdj_qbmb9LBs_v2Jh9-Hb{7{+vi$7!mD&qcRc`nB z;PA=#tKWp5x>LGAOm~JBe2{mgBftcsWBa?%K-|k_uxP48Snx9EPC!iZ1Q%(1FpJqv zA|qE$4iOEeI$>`=qN>2QKfAHO0n z_3mVs!-tZLRa3n)XVkKF0jQRW>;vf?=^O3{jfe*$GS?e@wVv-t-MEeQz{AF9*%2uQ zJ_!g+@Xatr#EkFl>~jn7Dk+{!DvoP^26Q0RJ(>?!{2hHl2sNz0-Su~TGw|b}P@=-> z{>lT6NZ?AQmDBd870wR&lYzfwcYnUsBC{D`^Zy1z#W2R~Ncw?JM*ctt?OdCE%=s^O zc$a3(`rus}`w+Ax+t}}oRtu_}E4lf5Gu{s$(u^`{YOM^DuVm6H-R)hb2&iwBUpd2F zoxr!nz=&X=egDu*rrc$LYZU$)lTUK<^TGF>Fp(40+)59&rO`$Sl@qmlz42*ZhA@{F z(k4YOZ@v?~zO92~WhpS%ojY^x9$}Qy+{_3@>h86?JGrL?mEZVJow_RO+{NBiZs$11 zpa{fPhb{h2cVm-E8OSF=83k%U@EQr$jIL@SnV`(t(62_D1RKkPZ86Mirc3FJdp{2()Hgq5O25vx2-(Uy{oPY?Z#(Ml_p4Wb zb(wG;?X?L>hZ>wVU))Xk;S^NR0nc%P87ZkL{8P$fE)H~_FB1(5mIZqHfP%phlr9|z z$&!$S_fK(-3WxCJ1!>$Z3VL3Pnk&@7>KAS@5UCqRP=KG&Y@~a9oUI?~I2K#hbssl7 zF1M{{1`<#IbIdM%rSZhFqX;*e0p`}R=<95nXaOuwk}xpmA=}@){nx*a{;4N;OngG# zmY}~el`h#VFMCn{Oytj>U&F6$OomV1q~ihvZ}?I)AJ_%X?{02xHQ#t0$TiFZ=gL;F zTq%U%i-VDaR*VycagB3x%h=xR6>do~vF1MQsC(Y=@N^}GB2v=89^6u(%on!LPm?jN zo~}cmye?uf0^ZNMnY{W|W399_!=EkeP!X5w`meX$;17c_83-9cUwz1J3Zga=F5MT1 ztS)bgEF)Dqo11=WYU()qfy;v+*M?(U6{))ENt05P4y`dp9A5q!0SJEKY4VGFjUVh_ z8!Lwy^=IOjY2r>E19?|V#Q5r_uLlzeKn9*4}i&yqzsQ}a#n$#h?;ul;Jazv2TOItVr-ve}82381B81V0&V$fPF+@HDY z&rBRF+RXk^bfu~V@-Z%CF%Q*@160%FqeyT~WB4T#ySAlIlB3BND5+5~;HCBmqU$;! zeAr7iz4X2HyzfAC=zU6>a;g6=)RC8E&_gC;_)L46bM5uPs8f?p*t70Tev_oK}a`tFNO{FI^^;Ls7n7g z{isKcQiK=vg#jp0Rn;xmgpG_uEmuO}t;5kAPnBM!viB<0hX4=JAS5Nc=zfoT9u}hhk-AG7~pR?OK5QwoQ4!La~3} zVLZ55M&+QwzwIFe?cp;+I*vRNM5edlQsK=Lm;Lw7v;Ev7GDu@#n!8;ia{&I)P|;O> Js%RVb-vEapme>FQ literal 0 HcmV?d00001 diff --git a/content/learning-paths/servers-and-cloud-computing/cca-kata/flow.md b/content/learning-paths/servers-and-cloud-computing/cca-kata/flow.md new file mode 100644 index 0000000000..0174862db3 --- /dev/null +++ b/content/learning-paths/servers-and-cloud-computing/cca-kata/flow.md @@ -0,0 +1,304 @@ +--- +# User change +title: Run confidentail containers with encrypted images using Arm CCA and Trustee + +weight: 3 # 1 is first, 2 is second, etc. + +# Do not modify these elements +layout: "learningpathall" +--- +## Overview +In this section you will + +- run the **Trustee services** (AS, KBS, RVPS) and a local docker image registry. +- publish an encrypted docker image. +- on **Arm FVP** you will start a confidential container using the encrypted image and confirm that it runs in a **CCA realm**. + +## Install dependencies + +Start by installing Docker. On Ubuntu 24.04 LTS, set up Docker’s APT repository: + +```bash +# Add Docker's official GPG key: +sudo apt-get update +sudo apt-get install -y ca-certificates curl +sudo install -m 0755 -d /etc/apt/keyrings +sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc +sudo chmod a+r /etc/apt/keyrings/docker.asc + +# Add the repository to APT sources: +echo \ + "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \ + $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}") stable" | \ + sudo tee /etc/apt/sources.list.d/docker.list > /dev/null +sudo apt-get update +``` + +Install Git and Docker packages: +``` +sudo apt-get install -y git docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin +``` + +Add your user name to the Docker group (open a new shell after this so the change takes effect): +``` bash +sudo usermod -aG docker $USER +newgrp docker +``` + +## Start Trustee services containers + +Clone the **kata** branch of the **cca-trustee** repository: +``` bash +git clone -b kata https://github.com/ArmDeveloperEcosystem/cca-trustee.git +``` + +This repository contains configuration to run Trustee services (KBS, AS, RVPS, keyprovider) with CCA attestation support as a simple cluster. The configuration is based on the recommended settings from [KBS Cluster](https://github.com/confidential-containers/trustee/blob/main/kbs/docs/cluster.md). + +Additional Learning Path–specific changes include: + +- External Linaro CCA verifier in the AS configuration + +- Attestation policy with CCA rules + +- An **affirming** resource policy + +- Docker registry service + +- A shared Docker network for all containers in this demo + +Go into the **cca-trustee** directory and generate a self-signed certificate for the docker registry service: +``` bash +cd cca-trustee + +openssl req -x509 -days 365 -config config/registry.cnf -keyout config/registry.key -out config/registry.crt +``` + +Start the Trustee services Docker containers (as detached services): +``` bash { output_lines = "2-9" } +docker compose up -d + ✔ Network cca-trustee Created + ✔ Container cca-trustee-rvps-1 Created + ✔ Container cca-trustee-setup-1 Exited + ✔ Container cca-trustee-registry-1 Created + ✔ Container cca-trustee-as-1 Created + ✔ Container cca-trustee-kbs-1 Created + ✔ Container cca-trustee-keyprovider-1 Created + ✔ Container cca-trustee-kbs-client-1 Created +``` + +While running the demo you can also check logs of the Trustee services in this terminal: +``` bash +docker compose logs +``` +Where **service** is either **as**, **kbs** or **rvps**. + +## Publish an encrypted docker image + +Generate an image encryption key: +``` bash +head -c 32 /dev/urandom | openssl enc >image.key +``` + +Publish the encryption key as a KBS secret resourse. This resource can be obtained only with an attestation token with **affirming** status. + +Learn more about how the attestation result is used to evaluate the trustworthiness of a CCA realm and how attestation policy gates secrets release in +["Run an end-to-end Attestation with Arm CCA and Trustee"](https://learn.arm.com/learning-paths/servers-and-cloud-computing/cca-trustee) +``` bash +./publish-key.sh +``` + +Encrypt a **busybox** docker image with the published key and push it into the local docker registry with **busybox_encrypted** name: +``` bash { output_lines = "2-9" } +./encrypt_image.sh +Encrypting docker://busybox image with busybox_encrypted name +Getting image source signatures +Copying blob 5bc51b87d4ec done | +Copying config eade5be814 done | +Writing manifest to image destination + +Inspecting MIMEType of docker://registry:5000/busybox_encrypted image + "MIMEType": "application/vnd.oci.image.layer.v1.tar+gzip+encrypted", +``` +By inspecting MIMEType of the published image you can see that it is encrypted. + +{{% notice Encryption key note %}} +Annotations data for an encrypted image contains a path to the key which Confidential Containers workload needs to obtain to decrypt the image. + +You can check it with this command +``` bash { output_lines = "4" } +docker compose exec keyprovider skopeo inspect docker://registry:5000/busybox_encrypted \ + | jq -r '.LayersData[0].Annotations."org.opencontainers.image.enc.keys.provider.attestation-agent"' \ + |base64 -d | jq .kid +"kbs:///cca-trustee/demo-key/encrypt.key" +``` +{{% /notice %}} + +{{% notice Docker image note %}} +**encrypt_image.sh** uses [skopeo](https://github.com/containers/skopeo) in the Trustee **keyprovider** container to pull, encrypt and push docker images. +Without parameters it encrypts **busybox** docker image which will be used in this Learning Path. +You can use this script to encrypt other docker images as well. For example with this command it will encrypt +**alpine** docker image and push it into the local docker registry with **alpine_encrypted** name. + +``` bash +./encrypt_image.sh alpine +``` +{{% /notice %}} + +You have prepared infrastructure and ready to start Confidential Containers in CCA realm. + +## Launch an FVP + +With the Trustee Services running in one terminal, open up a new terminal in which you will run Confidential Containers. + +Pull the Docker image with the pre-built FVP, and then run the container connected to the same Docker network: + +```bash +docker pull armswdev/cca-learning-path:cca-simulation-with-kata-v3 +``` +```bash +docker run --rm -it --network cca-trustee armswdev/cca-learning-path:cca-simulation-with-kata-v3 +``` + +Within your running container, launch the **run-cca-fvp.sh** script to run the Arm CCA pre-built binaries on the FVP: + +```bash +./run-cca-fvp.sh +``` + +The **run-cca-fvp.sh** script uses the **screen** command to connect to the different UARTs in the FVP. + +When the host Linux boots, уnter root as the username: +```output + +Welcome to the CCA host +host login: root +(host) # +``` + +## Inject the local docker registry self-signed certificate + +The local docker registry service was deployed with a self-signed certificate. +To trust this certicate it needs to be added into the CA certificates list in the guest VM image. + +Inject the local docker repository certificate into the image: +``` bash { output_lines = "2-6" } +inject_registry_cert.sh + +### Injecting the ceritficate into guest file system image +[ 2250.576395] loop0: detected capacity change from 0 to 518144 +[ 2250.588006] EXT4-fs (loop0): mounted filesystem ae947b26-4cdd-4e7c-8018-52b3e1594c9e r/w with ordered data mode. Quota mode: none. +[ 2250.862743] EXT4-fs (loop0): unmounting filesystem ae947b26-4cdd-4e7c-8018-52b3e1594c9e. +``` + +## Calculate Realm Initial Measurement (RIM) + +For a successful attestation of your CCA realm you need to provide the Trustee Reference Values Provider Service (RVPS) with a known good reference value. + +In a production environment, the known good reference value is generated using a deployment-specific process. +This Learning Path includes **rim_calc.sh** script which: +- Runs qemu-system-aarch64-cca-experimental (used by Kata containers to run a guest VM in Arm CCA realm) to dump Device Tree into a file. +- Checks Kata shim configuration file for guest VM delpoyment parameters. +- Uses ["cca-realm-measurements"](https://github.com/veraison/cca-realm-measurements) to calculate the realm initial measurement (RIM). + +Run the script: +``` bash { output_lines = "2-8" } +(host) # rim_calc.sh +Running /opt/kata/bin/qemu-system-aarch64-cca-experimental with dumpdtb=/tmp/kata-qemu.dtb parameter +Running /usr/bin/realm-measurements +RIM: rBD3xqcqqYHrjZ1Tu9aMWqFmwBgwT+NvLxg9jsozZm9rMDhjcaEM5LOQ+qJs+SLdG1jyco33EDuJ8+1/oMdFIQ== +REM0: KSzpB3Vo+rW1bSAJtAbxhN+dvTv6e6SqSwQSKqXFR8vX1mYHlKDA7SJBiHUBx/4UgZ/PLMmrxHrIuGzHaUi6aQ== +REM1: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA== +REM2: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA== +REM3: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA== +``` +Realm Extensible Measurements (REMs) are not used for attesation in this Learning Path and can be ignored. + + +## Endorse Realm Initial Measurement (RIM) + +In the terminal where you started Trustee services, run **endorse-rim.sh** script with the RIM as a parameter: + +```bash { output_lines = "2-3" } +./endorse-rim.sh "rBD3xqcqqYHrjZ1Tu9aMWqFmwBgwT+NvLxg9jsozZm9rMDhjcaEM5LOQ+qJs+SLdG1jyco33EDuJ8+1/oMdFIQ==" + +Reference Values Updated +``` + +## Launch a Confidentail container in CCA realm + +Reduce amount of kernel messages printed to console: +``` bash +dmesg -n 4 +``` + +Run a confidential container from the **busybox_encrypted** image and check its kernel version and RME kernel messages. +Because the container is run in CCA realm on emulated environment (Fixed Virtual Platform (FVP)), it will take some time to launch, be patient. +Depending on the machine you run this Learning Path on it might take between 8 and 15 minutes to run a container. + +``` bash { output_lines = "5-9" } +nerdctl --snapshotter nydus run --runtime io.containerd.kata.v2 \ + --annotation io.kubernetes.cri.image-name=registry:5000/busybox_encrypted \ + --rm -it registry:5000/busybox_encrypted \ + sh -c 'echo; echo "Kernel version:"; uname -a; echo "RME kernel message:"; dmesg | grep RME; echo' + +Kernel version: +Linux 4ce958e5e51f 6.15.0-rc1+ #1 SMP Thu Dec 4 12:55:41 UTC 2025 aarch64 GNU/Linux +RME kernel message: +[ 0.000000] RME: Using RSI version 1.0 +``` + +Verify that the FVP kernel version is different to the Confidential Container version: +``` bash { output_lines = "2" } +uname -a +Linux host 6.15.0-rc1-g916aeec68dd4 #1 SMP PREEMPT @1764597323 aarch64 GNU/Linux +``` + +{{% notice Nydus snapshotter messages note %}} +When you run a confidential container you will see messages from Nydus snapshotter when it loads container snapshot. +``` +registry:5000/busybox_encrypted:latest: resolving |--------------------------------------| +elapsed: 0.1 s total: 0.0 B (0.0 B/s) +registry:5000/busybox_encrypted:latest: resolving |--------------------------------------| +elapsed: 0.2 s total: 0.0 B (0.0 B/s) +registry:5000/busybox_encrypted:latest: resolving |--------------------------------------| +manifest-sha256:8b72055942ded7b1f7f31959ab8ccbee4fbc6355423580275593e5ffeb578f33: waiting |--------------------------------------| +elapsed: 1.1 s total: 0.0 B (0.0 B/s) +registry:5000/busybox_encrypted:latest: resolved |++++++++++++++++++++++++++++++++++++++| +manifest-sha256:8b72055942ded7b1f7f31959ab8ccbee4fbc6355423580275593e5ffeb578f33: downloading |--------------------------------------| 0.0 B/1.3 KiB +elapsed: 1.2 s total: 0.0 B (0.0 B/s) +``` +These messages can be ignored. The docker image will be downloaded by **image-rs** in the guest VM as described previously. +{{% /notice %}} + +{{% notice Failed attestation note %}} +If you forget to endorse RIM for your environment or make a mistake doing that, then CCA realm attesation would fail. +In this case you will see an image decryption error when starting a confidential container with an encrypted image. +``` +FATA[0189] failed to create shim task: rpc status: Status { code: INTERNAL, message: "[CDH] [ERROR]: Image Pull error: Failed to pull image registry:5000/busybox_encrypted from all mirror/mapping locations or original location: image: registry:5000/busybox_encrypted:latest, error: Errors happened when pulling image: Failed to decrypt layer: Failed to decrypt the image layer, please ensure that the decryption key is placed and correct", details: [], special_fields: SpecialFields { unknown_fields: UnknownFields { fields: None }, cached_size: CachedSize { size: 0 } } } +``` + +By checking KBS logs (in the termial where you run Trustee services) you could see that the ecnryption key couldn't be obtained because of an AS policy: +``` bash { output_lines = "2-5" } +docker compose logs kbs + +kbs-1 | [2025-12-08T12:25:39Z INFO actix_web::middleware::logger] 172.18.0.7 "POST /kbs/v0/auth HTTP/1.1" 200 74 "-" "attestation-agent-kbs-client/0.1.0" 0.001568 +kbs-1 | [2025-12-08T12:25:40Z INFO actix_web::middleware::logger] 172.18.0.7 "POST /kbs/v0/attest HTTP/1.1" 200 2952 "-" "attestation-agent-kbs-client/0.1.0" 0.420476 +kbs-1 | [2025-12-08T12:25:40Z ERROR kbs::error] PolicyDeny +``` +{{% /notice %}} + +You have successfully run a confidentail container with Arm CCA using an encrypted image. + +{{% notice Unencrypted docker images note %}} +In this Learnig Path environment you can also run confidential containers in Arm CCA realm from any unencrypted docker images. +Please notice that you need to define the **annotation** parameter so **image-rs** knows where to pull the image from. +For example: +``` +nerdctl run --runtime io.containerd.kata.v2 --rm -it --annotation io.kubernetes.cri.image-name=alpine:latest alpine sh +``` +{{% /notice %}} + +You can stop all Trustee containers with: +```bash +docker compose down +``` diff --git a/content/learning-paths/servers-and-cloud-computing/cca-kata/image_pulling.png b/content/learning-paths/servers-and-cloud-computing/cca-kata/image_pulling.png new file mode 100644 index 0000000000000000000000000000000000000000..c2fae549eb1ec0904f25ac409b3f2db12e21c73a GIT binary patch literal 40990 zcmeFYXEJXhV=39Adp1k|l-hcLw&v6XPtaV>^zwYzAu5-OpSA9-N&Pa}jhexUK;+ZBM9^nNZ z9)36($**sw4F>V>$g6E+Wz`jAW!cnSovdu^E%ESPyh}(T)uuII2%J~;eL+U^*8Qnd z@Qolm&8O60(FrnzK=oHw-`wM7i{Pox%zqnLnZd(Gt}8trtY6Oip4^kcLPLGLGx&bS zB_UIA6YdO$yEsV|K1mTfnf02NI9Qv(4^+0M2vsP*iq{jYt?@CBLgJ3V`>5L_&oT&J zv|U}V5aD`iWtPD&ZJ~+-OCA%vHk=22jyl>!;EKMx`fxGfWk|m+ZWAt8N8vPkzB* zujM?lxQWj=Ymv)3cFuRG@xkXLTqY}YZ(cKMR!Lpg!@SU^S!R9M?T`L|yV@Pm@)Y$c zZix}p&85&@EV5QP>(A~IdjUZ`N!J_)|xO}wW7Z1woy=Y{K6=l!!uk(^r5)cMS zepAvUJ@&s8$9I#oQhdWM%!lZQ%yDWj@hf}86muw($Dba=igO&tSDW?BXs@iM!fxL$ zcu6oV<{TBo?@W3bNcA+3xE%jy8`02<6>Ssw%|k0=Jqkg&i~3V-QCblfaZ#nVN8lHA z539-v%+4`?B-51ffh_xbP1?p-2`ZY+&@yf%HZE8m~P`! zrz&gS4a&CKL5~_S@2qPipU}Q_-S~i$U12KXq|W6 z)t$NV7UT+qVK$mY4%+$gQQ=MV56oeq@7lh-9DYRnNwZI;kE_p8nc9lx;95lIaQV6Z z?P3O@>nVZYh}q!T2#2q==1moZ6OWjv^4c~RgC}cj+fUQek z{p%i$+dIo|@=KOWv`cobu96^>V5Q)eBm6?|g|O0mOn~fP>h4_1KNJ<| zbK+ftT_XhU$bKA(b4hsFTbxwzQH0mc)Ji##+m7!xTgrnbx#N%9pvk{PQd84Yo0#&YM{Z4b z{`!70OQf7qCf!KXh_4MT#VGwlhCO**bzg=2NJ@CFy`rRnG-&q^*#Hc5WfZ`;q; zufPi_Q7;iMxmS`m^~@p6v-ntbhiXTInUYy5%|4AJ?Rg^+ILxsb?KrDC>mmVZac)uZ z<@J?4e}Db}`v6OV3|-$Wz5$MQ9b> zzuMQ*f6zDGH*av$!1)391GGUbufzjk{aV9TuzmBVI`8=`_UX8-0|zgg>oiYLXsjvp4g<()iZ+_IAvV zn2Yb@_l>pnN89r&EYZE5ytj=VYnsh`cFD1Hw|GiRv`s!&?{9Pe;65&-9s0Dsw=O%R zwTGvRvPV1K750};LwdOTZH!s(4AFAf-bG`cE6R{Ito`lykyL9|i{h9OguD@P@ z2+ko`@2SpL?^n{V9G2>`_p);>{9WDmZGuwSG@NZ}&Nn}d%|11M8C32RIhzc&lb4gs z4B=A$@jiZB+b3J2kxPgM$A(sOQ!aXeiDyX+xFahh`_V;kZHuPw8(_IB-&uULdH+_GOV2mk=khd%JCK2$;Zlv!-rKU%*no2uNTq7dfI*v z9!9W1pwW(1IZi1Ic!v9qtFWtDU6V+G)4NiXF?^;=pjUBNv~ReKJ5#fif=n|u)f7!M zdd~}O3$@qI?Wj&~DOxC1Dw24f?!2B;m^Y|D=qS}`Dox#zC=(LN))Bo9oj0Mn4jeBKwa3j zrBVDJOgE{ySs#d==IE+V>oI7170l(fUVhyCvP4oZGxN~j`)qOg`Ak%`Q1WA4;i2UB zQNdYDS!GdjtXmRjx8`M{N(RBZvJE=Y`~+7q5AB%%_|e zV+M|!j^_PYE-rrJSuY&1azT|T*WhgM`;da4l>y&ht@o98@9pUInozdVx27|3ooXE; zeh8B|sa~#LAp3{j4z<^1*3Hj3_>>*C9(OEJGn)sQBP8!ZQ*SJAO7n>87)}_1>moixvQn6quXmI_t2M| z5Wp1DMqA%qUqxBe+{uCOrG?WgOFnN0=U+we#Jxp*u-5etVA`R$^WZ3@Snt;*Y57l zqWt_`US51&f_zS{*8Gn|L`3)>3h)aE@B&Zpy7@S|zx3vHbi4acBmcJZ%+k%=)yCP~ z#>tWGm))1IoIKnm?%erR(SLsa*-lGuoB!72==QH}0UhN3b%*~E-$VZY*anJ<|N2%` z-NxI}-r$*y128;59g>0~kHr7+{QunfZ;ii|)cGNdP@Ml)*MA#|e~$A%z6Azal3bksKa(a&{?<+agNG-Lr|?Wh+Z%s- zmegNc=N$KwlkO?S8+y_EjhQ!)1VYBoo^^&%QhY6}FLg)&`<+edf+@ItSvC%lo?%9Ig9ss;#O?HOPzl(;qG5}? zB)^=!*nr)1l{{WQB#di3(<3=2JM4ssM;POADt{UF%BUuD5Ns5&^^n27F_&0#B(~V6 z_p#l_82wd@oh!Km_WTYH_d+9h1f}j#W?DzMK^a%lP&&=E*y31bv@=jq(`kIS2t$+~ zdc6KgMv#N zs2$$tG)QS)T)A;0X<`YsUjjjrB;NRHhdu|%)p|x^UcLTkWwY@UWi;=WYN4RJGEl)m zvCrG2B`O2uP$MJ8^fEB$+sb;)<>|QoWfh@@&p^GUU+0+gLIK%_xOx z@#?v7Jwb2ks$62GTk$oNesh}n52trLc?N5(rqlJi$Z}Hb7s^u#aLLGKLg#qCT!^Gy*&0`6Q5$`9mD0!E=cmG@ncNYg|H{j4=g5fhgOAGd=qW0$mzRtFv>ti{#xeXJ@T z)D#>x?tf0UTV0n9S~@Ax@75oufLJMUuA-qvLPnO(=T7kd2V~fk!@T4|vND z?{V)9pLL4RN25L=+%%I*+)Fs7J+ID-(AzLhHMP7#21|X&X^rs~FG~$fK41tde;%d? zRe1MT27h0$f0VUlv{g(In8G|F<;NQAtnmHwmHy^;LNulZk!O1f8VG0 zT6deHbWC625x)Lul=7Hce0-{X=wCa>S}VH|B8b8O?T(r^hH>9ylRgZRTr7&Fu8{n` zBY_PXbb6g_A-Zf?&hgKkk{=K3pqx*i{@lp_x5WR`SV`OFti8JTyL-yl2=WLYU*9b0 zDFQVGjI)^F50vb&q$CgA0$qT3`_BJoya@r%#GP4Y3ZDx&U2Nj!tr0*m7*#vVBqR>? zNnM_Xlo-|3{^+g1Bk)gC+S<_LCz;iIgdg^e4Tp<+jbvoi}g4X^o{dQ{N=;-Kle0yBf#4S+i zUbZ-madu=b8mVv9LSOQKR{eE`l z@$&Nai+XO``}p{H_VOYp^h_Z(+#cA~B)ZxW)x}1#E&bf=c>SzT@M$I@=L(P6TIVas?V=^|-Fil;wf%hnZM)QQ}mc0kTb;Iy! zEQaQ(fF|G=unnlK(PL{nO3bkwJ-z!{C0R(Y1&4snIrS#;RwS96mofWo_vmVBYNA00 zNp!tC^XTS_T`11MZq}!4D`x=y{cz6Dso~(l1iI7v!`9}!X{UAz>*GHUshf89D)n?j z1;pJ`!CJ32pf1gqyCf_|a#bp79i|P6bW5;yUAMoW>-2VfHByTfkX3JCD99`gE1!7pyfGb6d(?6&&}`MUpNP}Y1W54P55 zckF66T>s9pZfn6PN&>STcPW~IMb9)8+cgc!wXt?x?36&{0( zhq&v`O$xUhJ}2)C>_QVfZ`pVhi9vK5;hpGIQAChAqt<$bc|L&~H`d*h=D(by^}f`htv$+8Ry_6Rai;#4 z@8C|O9@-~y%u`;6CwZ&0&_plXm)%8uz$JC&=ia)Zbc61OK^6U?Sa)?q(Ri_7=UK|U zjLygaGHL9?tphKwpr+1qbVD6(__AB-vdkWtRR0vOrEEb}fz#b&&KJia?z%GMiAobb z+Yr^j98C|kUi#)japfJy2Mj7Wt8Y?Ad5kN`l$#{=8d+VQi=oikI5o)`sPmy=K|#~P zCZQa8UE3K7<_J9>d8ezcuI?MM8&xpefQmY7e-=S+aE!a0@9>=YNs8HsV8GgEJ%_y% zo^wyIv=XYbD{GlRUfs;RwKc&rh@>=?m%rPzSvVxQx6k8>bHDUIT@<^_A&8K=_!7vq{8s;TSl(7ueO>E(XuXCxR}Krz62DD%;g$UW}X z=Um*bmfmZ1!;HrcQ_qj3P7IM#Moul`zkEs)m5@6z1!AhFgZd<5gXAg7-VrV8Rg$)t zlC^29rbyiedYhdOsVUC*LE3^FQqI3=Ee!*N(wc;wGz*1E+!rVY-mT%R_4c-=c% z*a32hr?kG!(G@nS4;vXB)z%|RLLF-NlMPxgJ{Gq=HrAP~BN5bxYMGGZ$IMP?40q+J#w;)}o)3)}bPD8URPbe7IO}5G z788sAo(bQn?+<8_spq7rvHDmqTsYw3$w))POWAa(dB5Y$*RaN&PDS!sRgu;EClY%f zKz8FZkp-3R5eTK?)lc-2LD~#vmh-Cw9$q%QCaVOeZv6ts&IsXp6x6+aVq#dF=c67s zm-}vsi`q^p$?d*630qO7i@Ogx%&jWW!2%g_a!HOeIp`YPbBr)6Yv#GNnLTb+( ztsEJc;*v*@#K}yAkP*!BK@uN$yLG|ZNIpv*o$FbDv^(FMR9Q$DsEEi+nzScwCJSwQ z!0=G&Xp|OB^3zi6bYa-+*)5~xRx_O~+_{~W!->RkrIwmRZvYNcdPxELep-cST_m`W zzf{tx*+&|?ML6MKhivmVZTm8;&s!8aXa@xvzF9w7Xb(TTeqsjkZC=mBxtXpYQ_iI< zt@9@1qvsBIbzh~~6-HhiK0vhCFdI|Qa?I*e-4^pF!$-swi*yx?IyGeSgO4frFQlModH%f! zJKmhpy4_a3)7B0t>MorIRC+gfag0su^&pMdYiB8`K#QVrhZ(aXk$_ewE5-@Frb8j{*3o2yN2G55XWPJ#tz$jY{)faK{3_l^-;>FHWMDpQ zo2RUK;ou822G&&hPP{-6zvi{b%E!BqNdJ%TBxa5&V+j$*uIfSRk1G2T~<9Vu&%#X9WOMGRAk>=&z~$a>IuYbLE1fM!K@7*Jjs| zl7jwo$*GZzZc-YG1x%CMdd>^ZNEpg3?L&7kDe zZCeY3drebL-t&#C@Js40h9Sr*M^b%4WA#i;muB)p>GQ^2^`iXeEDha!Er+6F%O8L( z*I{~rX@@T~HXRJK%wT&fN^_Q!S~HYNwCB9dGvPS0wbcqV@f3H4lf`irfcq$7UY#7B zj?Cqp*)EXBSMGYC`V`P}hkqfjd&Y`+4G3UXf2f?LLo@u)1F}auPJVfIF|Ng8$eANZu-XdUJrQT7L2?acbEr1-F=?sh1o%l&_DQu>OLu0zZ5*icB^~Ao6k;c z+$FttqJ+udDhqvrvz+ZY`^lp^)#I`=lohe6mk4kieL?`b!P*OV5)Cz8we8u59PE7e z$nR;j{eFy-b&{HY)XlV>Tw42+m*fs=*{7bk6b+xrfj+=VL0&_-4b^%9(ZmTJblDAps@NIU3}r% zVPVnbrlgpG(0Q5l>4wzhlW8e=+%yy?Qz~@qQ`9Ha*jV~Vu~Ek7pkE>2^MYI9y}1Zu z=R7{41O@W#c=@zPeWuGgO1ZlP9vd3(FJ{hwb(Rxos7qY%*{-#W@0Q|ba9;H|B%0r} zc64-DjrYmuk(xq~#&}u(_K^}zqgByI9q_q(S;j7|X}2|J+hj4#%j5*57qxXg^C>4* zVn4r02?t_!ZfkEJAxErMe)hgDia)ku$JQF#tYTp2{>cF4HG8%~a26&pd-(XI&WA9+ z@^hR~!Drrp|Z{j$6%K20C3F=7;?K7X{Dv(R|k zUF8azaCB8|HtxmZwHH0^C{^kt*mZ^~l;aP*>F)kUWe@xdhn$gNubD%W!>Tog2A{l7 zHGbdH0vsV+4w;pC7Sb%WD%48V*@|qa+1c*%sjl__ennJ{fw@QhF2%ga0__zs^b{=?*2ybHa zCqCayDPGV9Meocq)W-&+*R_X0TD<|slT3PXhYV23qAn?c0?z|oz59FZq=FE^iwHhR zv3&=e_-X381|*Z!qkRywi*TN$loYNh#0~3=9g1Ycz@bNGrmbS{0>RSiUR2XEo+Y8X? za~4orq|wl@Zs|p*s_4e!c`3uH8SmwZ{((rq3HDD})p;$;#h=1)7&w%uXn(nuh@bnw z=gQjZBXI(bE#sFH8sQ9EuO42c#PCI<0w^8xqU3}A{5!DYydU7mJFFmG7jY~{u ztIn{q^Z1rk_CK?8ZX=!{nP-uOw__VWf4r{W7D}gNtQ5n}fM46#;4YOC&Bsfm?;R|r zce%ig6;Al#g#X15+qc~3Im{=ZA5{5Jh%LQczE}{qeO0Ilo&97h z$w8@|v&MhkZ(BpIj+cK~d>-j`lrr8J|9Bx<5tkQm7%*9RNqHHnD!nXmUs@L?OiXX8 zifgXkjkP1mTUeJ7W{XQEExPyo;AjU`noF0xZq9n+iB0)K326V=9*+(OTiLpC#K3#L zdhYV!j0cS6iXkO7<@YtQwCl^Z)nnfb`X|DvSywToMLv1KP|Ah846ra>qb`?@d%rfc z)j$wu{hVb3&29XCTQw8OeRBj)%V9=3j(djOmh#Y~INO2ylP0UqSUtjh>+%ex(%xWu zbJS1{>2$;?ez9j>)JzHC%qLNvZFyY3bvJs(A)MK>`gVAROP^h}AzMBus>^T4TC!f~ z^@7Y!Sr?5uR9|!HO0j2&*=Q!Wgv2bhW3Gg8{p%psdY%5=F$+WCZ#e&LgZU|?6LMRZ z{k;yavxBFo@B!R{FC6rxFuI5gswa9-1X8 z01Q%JVKlZ+U2A+dgFc^YT9DlF%0WeRy&GJB*fiBM`srP!j(-_tGhN+LK+lLys5qh4 zJVIY6-j;Ml%r=Y$jX|**20CsFRQ}0r@4k!1A)ZMYwgwIT9?~MO}<+ zg%C;+)D!Sgn$f3al0K!F`^Qp@NEGP>k!mkMS2RdZley@WJCphKrJ{fGsLzSeZpWN2 zaWO;OZRWit;Ad-o*!}9^lm)L+?S<{~Vkoggr5GoI1 z%I>Bh{kqo3N(T;34E}?$ZbNJZW_zlW7*_?RD7V8t7=memv%*^SPG zH9jape23h1mfvQ(72_H3QI|3|N7p0jT zecbv!Kc7wx>HST@!%}jCo5@uplbrOiEi?t*#CL~w zhU=unZ^v-44qAC=%=2k$P01|?&LjR-`Fw6fUve|Owq;8-&$MnxIvVE&*UvQd(yy{g z;Qz)Xc6?9o(cq|FppHAvUL#pjnB}gdP%YNMIM-_(r5t@^ zt3FbhH_uHMl@Xk=A8WgsRrYzczi8t;m1s66*b=mVc8OtKx6=uUIk=0w*2f@Hl8HKR zUTs7KOLh!#ox2sD9Qo*_-=Wxltb)-QqEtO>zS7_9q&;WM^Pdu|#g zEJeP2NpzF6hDV0!Jsp*Bda#o4l2=u@4fE!xFpCIolhu+;Z46qoJ{LBV{rdhBxWX0-RNaKG(0NuTSMx zFds7K`Dt}Nzdci-;ZYpX#}@x+(AX8=Ta*do0;|!30KDS9*8#+ zR1grX>VhCTDns3p0`NgSSce-*V4a!mN_3CP=YY@f$ei9zYt@P9I-Yc>3kdkOX&x=n@L&R&{+v%s=UriXuMSx102vh+U{&^@ zVW9}P^Q?s`7}DYiYLqG8HI*lF_GQiYcY^|hgnTBotO|~x1{Pf~~1etc^d_UEPppQ+$yTGEad- z`E>>9+1cYs6m@_-Yt8GaX%C}Z=}N2UhxpL`^GZ*^G}|Jvwi5K>XWqBf0Fq^@Zt}GMTxVi3 z{Zy~PdX%!FVr)Wu{2M+~i+n30_k69V-jtWTenyR~#&ysL@I>N}&u7N32Lh8|R>;!z zTeVubKhB0ujBO2{lreB|b)7gTM87_zzwh!$ReT1T8x~#q__@tSPvX#%PN6kAeOuqx zRkw6o)mN18Jrp$FCETDlh@+>Jjmi72ysjisW%<4Y9Otw_IV&Q6MT=d{Se##?yYD^4 z`(mGz!}{-THw7jEsYQvtrddy`1?Z~C9cmCqMn<6-q_xIA?&dt;?uG5r?Hd}16LYtO zxGss@oz#oBJcB^Jjx;|mtZP(jKt%_G++=npiUpx(AU0x5=gG+&y2lcl#sQh|0>-)XTG74loIu5V*KDK z66o|su3uq!-akY>?mMG=+h@w(FX$LPV;|l{8rG;)71xfc-dmBOYFF*|MCn`U7S?Rs z97v9*p@|9gy;E+cnqGic+#40S*~3zm;=;9n#=>FgK!{$wR7VU=xwLS?O+fYkdX!qmk9{|Wa}tx1^z5d2oMb~oLu<|2 zgZJm=?9ZEh4(z{w{Hyl$P-cJb0m0vV)LTwqy1YdVT@sP0sZ0QR?@*S3g7bj*(=-rm zTU4~n^4J;|vY&X^`{PI9=tbX~zd5ou8f>5spYN#EaAp{81Ih5Q#0LhiW}CcDK+}a+ zV2{khfWrNAJ}71&gogcgnIJtSZ$?OB>{&;l*dwImr_23ber&14 zUK?Sq2bcc1I6%89VCgY2i>$Xnwkyai2D*}N#Ko2rF{UG&y6!oP&o?0b{gS*`3U}eg zbN_xhkT{&Yr>wdYKig}%Xl|v98q7wSt`>!r+U);_Z47b#KnrHkfQ`>Gwu=t zk&$+Bsfc6}874j8O!v-&s@2RFYV3~WMN>!7sTb`wCGYY~=tKmDP>FtbgkwF$HuJNJ z?U1FpM>C$&4y&czWv56e_f7SWWy$+%{V7Q;IbVs!lGTzQ_mJ)tYQRzHe%mu{h@*p4 zm#$l$;|A8B&$oALkS4jwSbRc~Q$`3e?ymfY`$kE@=lW;5ZUH++7LB{D80DIC@;OfB zPi80>w6#ZVT0JOm7^n_KaX;9>eSNUKn(6QAtb7V!BQ>g1_Xz1|K@W$XclSjG>wr4+ zG-=A#_6l19HVg88tl?&N15hxYC#=GbsbvbLO`avxwY^sFy(?>up7q(HaXI7 zZ$UuFU1S-I`uNCD*f`Wo2KPZ2m#c%s1kgtPGR)6OlnvV95M*R)Y zNvlxUzt6VyRVtQpCt&n;TKe{`b@GBAezAl>Zaoq$Fq5v?Wb{|-$LhS;1E$bGLnCIl zsq}2D+C*h-Y{i5Sukb9u$||=27x3_H`uQNhrq&(Mb@KtO8?A;^uRpeOY2{AzeHK(1 z3CX>jiZW!%?+JKlB7Nu^jAYzaGsnx9HwnSo1j^*-pHU@FPGynYAFaoql4|JD^x^pH zH>Zq8@RDYtnf&oDWK(l5qjim39mxF&z*T_YfEklP1hd6jvR!FKQCaKMgYc@`(srJH@jnfWnp;D(j>kFW=z z#6a8Q8pjeXLP8Rsad%3-{2Pcz>Vy@jP{6r2mI%k=1xD zf3NVNtmhbmYHC}X4AUELQ~6ze((nGQ@iiR(Cj7PbRA8f9`G{#QJ^{>2`O+F&n3aLU z$kvCaDzjtT0d_SjKQhkqiVA!~NGOGRcL8OOze8*Ce9^J-0g=iSXsMN8VIgmu+Yn*J zntEHHv)UwYxf#ixshqhWPIDkY&0Y$q*;|rjR68y zI@i8pm-`Q`$9?T)9#2*_#b5S0Goc9#s2bYT=1c10N7=XPAsc0$q2f(fKDYQ#(5Ec< z+n&KLQeZiCE8eM z+|5Jqtuo!Jm}~3%^rE8R%NKuNsGo?|J6LnGWK90HuYi*@{~oaIZG$a9e|sJ{B;P0i zOhx&5Nb{fcLS5w-Qz7cH{nHd#9KcjQMUnXYNiQ;ze=(ISv15OlqWM+%LuShT|6wYi zUrdFTz35LF6{4qi2Z2M? zsKzz{0vvV6Cve> zkm8lT6yY-aR>1Wc)j6g`GK-A^X+dis^8JbOwoqToe6>AG`rqteuK_Hzz2egU+*-(T zbA@K*&4X_#(y9Y%#BzYw($&_s;L$BESBSf3kf)kfj5-ckcBuQ#|NEJ)9Rkb~h|O_} zn@Y+(KT=!=RKZSEcyI4~t86+!&!l1UDYK}1xy12Ahx~_|FTqWoHIss_!hSG@-@@XJn88%V_Fz{M`jfa{!@fo-3X9WB}v>g7w;2 z^L0+9wIPDmkJ;l?=Ty6Hfrf7@eSJiyYF5$$m$F*JXh< z`Y7tIpN1N-fS{lXl>Kj~H=7}wh%dqa==i1CE`i1@<8D^|&&vY#e@VB&iLcQ9KI6Y= z_gg5iP*0`8w();&=dXD&0v3*w%vYknRSXnaG6kA;8U2^v-&`3mf^GD`0y6se5dZg% z0QCi(G62~`ocVW_->3T*S}hO7!^hFHEC2C2!vD8!e4*C|PH$f0`f|gAdb4(d-rnA# zagWN%ePTfIXQ`C8?@+p;2iUfs&wf?HVWWy#hG%uus{sY~247SEg945+NCMG246r62!DCed77OH#}$dTOU#=QMEkbk4e z28wUEqeaH{v77)<#r^`_Q`?hOB|t{jv+q$i5KQhb&d6w+^IoP*5pl}}*$jU}COXy4 zdRkKX?*4+(zhK>XnW?Fe#Q8hh2>{pW%oDZvouC6GR8oYFK>btb_jEk=NnpqMPM-Kx|jv)3a8J$~C%%a#f{-*~EL17_%78x}6b1wLh(< zs5opCz$%5=7K}RpP_HfE0glqAN{>xv@l~HJ64?!9hQeUb|2l)3yV8`>xTigu(h7COK8En`rxzuSn_L8 z;`=ZB4*G>5G#H=@7&EQVE1WR@$^t(bU>F?wK0P{aBcwhZYu^9C<2kIrIk`Dj1UZ06 zAU$<%W|)Zq4uwAspfYr;E|Zm(#{jrXCVzZ*5q8^gZ(5zk|KIRGm|Ubfn*09Ee_?+~ zen5ULwevx6V2_xD`@!3*$Dj~HCh?OQx5Sv3mw>1_8?pT1mf&`(+rUrI2Dkl36hQH? z=l4{SEu3185~=qA<*p}8s^!ZC;494~*YyTV{Q;He6hE!qZC_bp3Yh=?J0RqBDqbip zt8mt^604-Vbq4UEo%-ddsstWAU*Q(kQ{qsf|HZq=;JA{64mux{}S#` zfk)h-NS>P@d3kEi`i2`%7q5`<2v`=~0}?03xYpq9ssYhnQ!>7BR&&KZB z0I-As2F83{6ChE0{zU-bCcvKYH^ZJE9q`gUmhWK2oj!*{BF*;zCU-`Eqr|Xg|Lmry zdpj_gecBmAeqFVj_VL%*0HLol|7B=P%4yuVw z9wjZ%$dYd#>1Tmop4(wMSTD;bAGfG41_f&oV-%-agLOeZdgQr9^59uKAX}|%!eZWE zWMfO0F`A>4RO!&44C-Z&zE3tj56IYen*{TZf@71Hlac^|l;-@3Nhmu&x*R9%W%Te> z*2haycukro;CXyBcb`WcmfRkll7S~?Ad<2}MgouCI?4#La`TeJQcY-;2)b2wsh~N*(kG9*=6Novm#a z66@Il>=mlLb1)v;Mez2BHZV=hi;p6>CTf9mO?!bREi+}PNKE?Uk6!b=0H5fX{z*_i z%(h);n&m7{7f%tOHpY1Xy~qhX?&N^d zyUdX&VN$+4qtP;dPc8`hQTqk0$nn!+f-o}^mj7ZZTU{W^ZUr$ABRDdVmZ>2r(AsIT zMNC)Qm;(Umq`!O23yhy-`⩔q|F$=!gdahL5s0w+ufo>=SiZ-osSN@Rw<|Qf_~mp zONF?v-ee!DGoGvbMLR4UQM zi&6k(x_Eou&gL_vNB4f+8apZl&&+Q9S-7Ydiv;3Q;PKVJd__Ds2ZbD)c7(J{u~|`~ zKNwQKmwWBb1$cr^^cLR*Lzro6uIB#`s=j`NMOIwt(o;9RT+kz}E@K>2>((3@L&ARR zt{;Jd8;YNMW6Gx2s-z|<^t>r&>5lLo@`JJ6m}GzDRN^sjDV%ZJN99W2zhk!gE)NZ~ zrm4pP$!u3Yf#KL`;gtZ3hs8dia?`eN<|1sqal zL+)HNTgbkueM z9}GVvjop9vj})OAB@~od$xTFa-;_;MI+98tgySw@$9FS*V!~C*afS!C#kuP#N%|;q zH#FK`>x4jf8PbsZ`}saRDUa379_pJ}CJp&l92aG--X%R8xqMEt!rk_Eu5P}Pl9$%z z`e#;$vgQ*&hA8qMv?+Z=F&GX%S24H?d_`j$w7qSQi+dvz5vp#T*!N$cePM-fdkPg~ zrnm#Z&YxTvfw<}s)d)mi+<)JG4N{~~?=ZFDwtDuTL+78sk}Uv0^vfvy7_C3CEI055 z?f=h9kQKH4!f0RLT&Z=OZ7jEn@&C`D)bIhV-&(P!`E|x-G!g@FX$L?C<+Q3#+JA*E z0o+xFRwe5qJQT^>Jl7h5rc_dHglo=Eyi`R?Q*^c*(Bc)9L3@ClJKGlOkaG zp88ZxWc9|@U?alnVDCR6?HBF<&v+*Fb(@tym5tN70rInxLH}R4wlz$Oi>tt%^~e}< zZrz`}N(j8;b>+0z+56w*`RFN7{r}K|rLXq(LO5k#3Og?p9PJ z1f)~xM!G|!yWs%@q`SNBe)RPXfByH4@r`ls7z{-p4(FVG_TFo*Ip+XZ>S<3DabuwJAMu^ZSLS@7I8+ z^NC#l7!wRvHWFM;P7eOacBSE63BFD&~Sh3{of^p zV0{3k1uW~cvVvERa95y~d=c+2cw;UNuCUEiofUelkQK^{7cV9NZjepY)ts|L`s;_j zKcV1evX`X!8B4N-gnG|L<^HuL6$4_zClaCm_Z&@v5RBbR?hl*Dzpm`pb4dUbn@fH7 z_FpIXb)er%kV?zNigbqllZyQO?*HObe0?Vblz`p@u6{7jE!ex!@EMB12&nwp-#O^P(kN}nC;c%pevI(mfF3HvyS!lkXuS79 zdBU$=0J@dWn5xquW2%Ee&nXlq9RYTqn)qx;&&zx8bLGj~Kna50kH+FZALJWMKbKjr zaj{Sm^|hX3Fg=bzxRUDc5B`}*j1c&ZoR_3+(*AsSpiWi41&x(o9L*b z#%sto_YFpR28J?dz2W)MhDolB>hKL!=;JT_yhdGjHUQ}k&F}h821GC?!^O$WZZ2kT z^2Ni*jzNACA3qI9$gj>5`mcM($m`yelhy)PV>Ng8nk_)l0#A1Bnb*L6DQLw4DiNfp(*EYZYIR+rtd)-F!A**E~wByI-U!_)Bt40)gj2xAjCFx`p;sR${V~c zAil7-^7UH+y&J*mHmcpO$?G3}#$5lr@U_NsXi`#PIr#`GLtS}iW@g4~eb@mT-6Zc$ z-NNjYNs3p+ggDL5$%|zJ6r1)bY^uf|BWp*SDs&Ci4`B1*%n+J{6)Ex|n`Z|r7rxpD zbXBUwK2uheXF{67yMXO7FRDL|*OeBAf_ZC3&5ANr9XF^y_r7MmdwEWOLo)qtnCz03 z_yJVV5uh07gi1XZrwd_M-%$%+qZ1n!HJs=6_rFBJ{iLdSd=3buN>H!#g+T1V>G&fl zps$tl0|6;IF3ya(Zr4A_<(r##jsG^Wbyc%X?O!_0WDBOCB_Ogu3O2uDHeL0Z!*rlY zFooSLf>~bvy$@i5rqaR$*0VNJDvqGU^!SonHj7AKyy`~dT4sXf;p(7w+`mOBvxKdw z%9G)<*FQEmp*j%!$alowU;dz&U+M_Sj5J>EKhtfQ1$&_`o6mkH?S*HaiYFL|eb_9T z>^8Uk#ZCc2P!GJZ38e}^d9G%a?Z>MX!JE&(downEok!CMvI=iflSI3~B&RWTfr+u2 zvS9NjDkZlmg?DfW{gA@*UiuCnz?w^QOv~}@y|htC)v&9d%~7INLU(smY|7U-1CMcd zq)tErh!ID^HK?@iN9#)mh4^UZOIYa_+qM1UBlN4PeqTV*+|EHEUoasnWo++G3MyJO zv+nk-W3E}xVFI#jYT*~KLHKW$KEeg!(W{(3LBb;utr`q|d?Ul|a=ReJLQp?{R!6ToPYTZ>oyx z;Dj&$94^(ko5h@3B>b6W9pbSPR&-#Olso85|)NgpF z^f__0@sk$yQsHOExZYP>fF!wrMxfwCOW>%_@hMz zUCyMpo8&9P+>ffloj!!b*EJtKU>2Sas3FGMY#(|- z^dqkDL7#EIcv#(!XZ-b*FP!#hB1jhfS11-x2b2#;(p%pVTnMbXdx2aT0;rtzSw-|3 z^Jbvi*xzVeT^eSr9_8`+DuU-{>$4ETb6p%EF>3DALJZs z7r^)f6a4HAAkEHnsnx3OGw7uaUnrvat(t}J9FY9ne_ioX0|j-$NX~vZ4BimKqGM%2j1clrgGN&XB!n3o z{ME|g<%M$n4nB-b>qwSw=6b30mW`z?UkdkDrF=~Efig9{2M7E6T^eXlZN$B%qSyyg z&ad-8%I|s9GVaWgnvB>z>>(`UeYiZLr8|Sh{yr5ItBia-I`v5)rxj%4bZ^1yV_*%k zsQ|iwnu4NL?Xgn%`M#pghY#ZXH(=ws+)!h@dr8cCy+)W_JP%awG9bDO%6`BuLLa@QlTF%HGL^BDS^ zqBF2TThk`m`uh}U*w+i3&IMdqT;*jOYix|1!V>K@)@^M9EZe|+12_RIknS9Kgb?hG zs_LGFALAWbun2^Zrhf5P%W*qc=5*dvQ-blDwrfB0J~i(vx~c`NkyoS7*6^^L;1<#z zn)wXXIG%b-5nqn{LJwR2q0YnN0T>UWukwP8Sxwrn;D}-I*#s+qfw z$Ta*Ww@JEtq{=x-iC=Pty}0cM!BS(P1<_dwcv&)T&5X8jrd58VxiU{C3+5v~YcPk5 zUJ4L?6mXT}m}#E#jL$q95$8XhtkY}QC*#;}FmF|MO@02&`7qK65;~UWcIN|$73rgxv**Xe%Z_WYjc zgUAiPy{kj5?k?FO5Z#OH_&vDZcQK*b!!T&zAifZ zwDQ)QG@pJf4Jg%;g59d4>HYy7cjCf=7^q_2dKbcl3?N<%#w~IDgaA_ygd(r4;9uDN z0_MN+l`ju~>#i;BN%Ais_v3khKPJQg0{nmC2)_|4t>o5!*p!EKEOy_YK9iCv0o>DU zJg1dLXGSdg&v`gYBh+*=HLZsFYZ$Uigk)ty0hsX`%akFW0)KCP#g!{7)UH)=<7fB@ ziiL~-I-^hf%J&m}0W{8me4mz96Hq=-;wsteSlt7(Yk-A13VGztj}Jb4qZ|4k4eBYz1eqGmXT|m#ZtL`F$O%KL-~m zdp7y_uM7P9V?Xm!Soh?KZ(B%NtFdk z*~W*IkpC+3phpZFm;xLNT^j$)(VvI>|92bLr<13^8CF48I#uJT%%wBAg-1Xz1q5Cj zC=sj7)qMG%krc`Xw<6-@`X!tjp#_k#m%VY5V@r88^SPGH+}x9a0KHDxGwfxU< ziefiMUn~+#IMJPGa5)^Psg1dxq2((K-|04uzzLd3WHW(w+$cQ;=T7jS2S8>*1e5;- z$P73~1B*1uyFjkMo51T*$PZ;~yXcG5baaxPHYWxZm6WzX(P%|yB(0{kbs_)RVx)?i znkg==?6kqzYSL)UtmlD@$NVdT&C-5>(y}sk01uOvR#v7Q`uR33kb38iZJ=|z?Pw z0933#kk;s?e#DEas`Xj&n*Z{uL1+QMlL|2I<4~{JbqJ7oY;2&VCQ$+V8CTUH^dYK`pT?`>ch&p|N4Zg|v)4ewIKKiJlh@`;T-jofz4jJSox1dLjH@+z zUs=w2os@%)0iz>uLa)eyfnfI)#>2(Oi|<7?LFhO{KxnoPzaWub!2T6ue(avv^kB=X ziNKt9PT;UG&Q(ygx&T1%>R@}Ow!J4OerOg@*A=dN1{UAysxduBJ#}+{Bx}^{-SaAq zCYRW6C>cmnle|B&fSELL%$sZglnq#{AnZ39elG8Ud&d~C7sxu+d#6A(o2s%~@ErCj z*FoN|X$`jakH4gM+Mb>id^n)`@g=Irokb)`HxyLz+?xJo9@qbJo90r!G*=wd#915A z^wZ1AIf2t^^Ke+M^3$hJjK@!hnQB%kLGv5!Eue>$<`veMm%5FlG(5}!CJJxoa{M>a z!h)_L#Hr~5hfuF1aIHPq>?_ zysh9{bfs(&I48#l`vF{-_r2@CS;-%J6UPHA-Y2=u=q2m6Xr>eb2xI0%MMPGkfqBOo z{mOYosajr}QGl&Ly14{S&)uRJM$KjNv>Q=o@~ejU4GTR!bd2mdt$-!7Il*!!`Q`w` zE+xhbTsgk^6~KeY9X{mrAg$*=YE)J99?w@_xY%Jm=&lk_c*w2{LN!!LGRPyxi`96R>KZdsla@R_W~*4Qq+Xs-3?(TTv8jZEtGWQ*6KniZ=a27@0oI`_fnK9 z1P~jG7d_A*-H_mS{vD}&Cwv1XS=>g>5QoHRM8O%X?x`lfTQb`4>=LtpIKX4TIbgLX zHt$UpMj-dtWF-a~xwiM&5~tU>W24rhC#&k$r~iqMsTlAP%YC}fhsu>|c_!Es7@P~1 zd}6~b3LshPDpQ98zS*3*R|{zg9eF}RR3r3rDvG_;@g*Cyha^pkUv7IIR@`|b zp4l}8K%s9`$ z8hPu)H%a`TVFbvm4hB|`_J3Mlq5u${;)@ie{f~D26H)p4ra1hQbE+z z)RSFN^j5(2!3q4+-FQ@K_X)9d!KK}Mtb?oTHJB-#MB<RO&h`8WC-AqS_&BH1{e+_C}&7c^nn zjwf{}m%A;PoG#nbv6I%LxlwCj|5@utQ2HLe-K%o;q+Iy*Cc)3sx`Gh81qiymNhUhF z&j9yM0`IU1lxKumNW9NC?^f?sXfFO|3grp|JW7P6jsWLG{T{e6Ktn!2^{w5yf(BY= z5MgS%FsA;EF#WKA%kTB7-g`Xw+=l~oZVnqWwUyeo%?QVUv~9?J$0qpid%Ir@a4;OX zmNVlX0^rAt04jKPNos`oZv>j!1=p#p+|dG~|Cz!=F>$PYpc7&(C9jW-b4mLnsjq zocav*{>8taICSEF1-8Yoj4$l}oe<3=DXgzpo^$6>w@h zZ$1^YdQ8qN-GNgV%s1fgepLk-5`*(ErI{bSw(qvq#M`93nz5NczE&5kwMmh6)jf;dA?|z>BezLFs0oOOz7JLRZJ+Je_ z&wjU%Ab^Qob#c5r-HT32vdT(wj_*z49q-S2;`=Wey~2F-p$9On=lk4TACGC;sDq&2 zrGfaAiJUPj-nm!Mu>uI~Q+lc^Mbj|wN?jSuBsCIq&wIIrVLlT4$s zE1QP1w&PhJA1Ls?x&-*V>{s;#s1>OM4z8$#Sr81{%KAk`MM1Yf11Pd4bsP}RbOJrW zMlb{~Z7smc>)(d<8U&q4Tus>Ma@k_Bi z4FPoijo4#+kslL*LU9fhmmCXQ0b~qK7@{L04BQJr@=9d^$Z{V6v!VOssq`HH`b}*? z>mY{lb~nye2h*-LoVOsYTHhM)?(O{I<$+(%i{b_tw$5Duac@rk(!|&pg2r5@2eSU; zltO>MzYwxPZpQdwj#8Eeu)a+me;7wZCptar?k@88Tyg>6*t-@}@Ul1w>`M&;!U$N+ z-j)-^&6Py*4U2ZeGF(yhCxEkTXM$H@`^ym^fih7 zn-rJUAUsWmo!Qf)6gcD2>{;McZ!i+t{RT1#ua94#az?%TQ3;f>4}JU{`2rB>R}6sL zE(4VJq~LfNFnfKiye)4L0F`%v>lHh{tE+nlg*H(S?4p{Jp6>R)1LaB>`Q4%`d5|q| zm)St8KA0aM<2OL7LD1gJafJP~%;ovPq8wf5(D<=~tXDSyw%Htj|Ie8Dpq52y_PHQ_ zC-|p6IBgM>cZuh+*}kPa+J_|ByGNg}+!ME8q8xeIaR?}s^B8{j!`(1*#(__wXkaeK z`xG?sN|?(QStBoH?C9<0cx;3r{LL!Pozig6=0fo?UzESG7m3E(r9a zHeEzNR{i?NCZ^g=16&$u7J$zk2SxGW7d|1wxgWWVdq5?q`eTTN^Qf|_)xC^Dm_a%< z0e5$hhF#u=qT(bTr+wy886iopRnN}0Gw!wZiRbQH_zTIL$7;dqdWO3Ys9hj=zT z0n2967tBHbYr9X42goAt?uXGITkVLPUzoso$BCvOK*FAaN1#k)YG`Q4^Tv~7emwh1 z*ZVAkyja$2_NW0)A7OHRg^V6t7xpn#WDR^UaCIXMK(@iGvjKc`ypt2X>sm&Pr%tl> zx!EvNP~DGt!u-uEbrv|dm@{Fl`aDu!pM!3FXC*TrFX#5Q)`ieyX@I>U~ z^TMLWxq7|0j`r0hs#&z;JOn>)3}&7;pg;rwWO9CfHKwsN(0Jp`xv=0>E*N8;Q4Jx$ zHzVZ0`QeoAWUXkZILDWpx7Q0JDAtvu|6{!A&fMdx(05`80v73ij5isLDy6NrrL*n) zeiTPsGKx>B#0h7fdDk0?exGc{Lwt(`5p8u^8R|X(LW69X?uf5`L7(5aRBK%K3?SH|pImpTy zRjMZme~<9Mf!p-|`8HD95Oh5EM2WfW(`AzRs@p1C5dn<41Xn*VD7N^+J@XTafT9I< zi?N=D^L6^#>+_8*V7ILR$Pij(DW78$2R0fUIRIYvLg_sIL7MV%2oaHyjC6FJfZDaX zzB~i{LtP+HwhpRG0#*__DM;VnM6NAQ5vB0A!y1x?$%gYDVz zmj_sry1E>fAU=YaGu4Z^I9{O1m9oTLI`*1%V-bw1Ie1|~Bci-I^}im!(>*{U&tL4i zI3ir39zrceXmD3G9hg&3Vf<>Kb6C@-;$Lj9P&rDO>EIU(VDAO>mv{WU%X3O7;lHbb z$K@SH%Ka~_smJCAh>i(#u4!PB)w#Sm?z<%$M0v4b*K$F&KG|3zEHqypS^zWKL`K)X{s2!>Fzi(IaMSK%KP8Ge3QUuQ|e68c>nVe z49dtG81!qRdBYbt6tKU46-UCLd-Ha`%Ax$9k0|_zuv43LsXT+F;qD9l{^g95+H7M| z&7%CjAKjOyf@43mco`Nh`S->D{Y{fB_-u=TAT#I>w{QN`7ttqVm-W#f?qWjH7qKyE z>C5x*-|ij!Qz!&^V6F&TKny&Bf8S#^8XO>-qrQCkVy;`0xkpvM2XcTsk|p5Ti2}5k zGB@9?2+&Rf9LvPrM)ljVxNyW=)*pcSffjtcE+MlZ?%odo*3&-VTYo4HEg{a3OA%1U z==Z%3x?XG#jtAdONQzRJISp351t*Zw(N>-j5kDXO!O;c1@N4#ctYjER25xHEp+^fX zNZ;?`n8L$XSUuB_hc$%0OoJ+iwA5rxW#ytI!`mwJAAHsf%`R{ZQf>!U`wj|tS(V4L(y*+Ft zVQ!wAo{fu;XGs8iVocBl@(2OEX9G_@Ur^r2TE_*j0gx6@Y;*tcUet*b@5 zy1IfthGHOf0K%RLv^9^+&u19E%VIwAz=4mMS#G=TK-LW~)YMc|BA^go-wilxT9@pj zW--k~S77dIx!Yl!JfXb>Pf7?S6)Y!9L{;+D^eaFX^bq7wZ5A;4pxG*D=g$`gTEM)P zPJFBY(jI}9EHHe_8kZt)&G4J6V`#E?C%>%}A_UmrPc0H;tOhS1w;chl!Xo%QQkF*& zT4DcK%Y7|l`4S{y!LY#!HneSKT|wc1|{h+xw}ap5w-H#ktt8V(jiU)9tp2@nVx2}1bPE|05cp=^PX~9W-=A*{WC;Z<%O@166 zII#uU6up<@Ou7J(P8-S^dclLpzr4RN?T1A604j1oYu#(9(Uf5QTi=p<@_~{a68}n} z)W-*NtTHhE+=sDwmay<8L(T;2< zW`-rY45{3VbNJ7WWoiqjhP(s7L<~@7W6SjH_FTEISU!QFft_4EVZsUe4U?#La zorm(>542%2?2rnv<@<5p47BhpX6xUX@nC z6;vUFqvEu1_&Wj5IqGY*ZM)sq~Ws|I4Yz-{T%MQ+jPOrm5L@%F6+IpJ!@zFA5 z!b^jG0E7co%**pFN#tqAu`0e%2dpM!x@b+5-hJ7%xa5s~RF_ada+`=<0=O*cpkA7@ zAQ*h?d@1*qkdc-I*mtM`fN+0gJ110qwwz!D-VQ*6;&*}}jaw;65$kKwxv!<0bzBe- z=Fmun4Bpe_)5rWikrQR8EW_uUEdO+LrRfWJ{G3oDj*uAqtxNhg&XP^G+WYdddad7| z?74dm*%giK8%|TeZXmB_QQgF9QpjjhOUPPOpy$)45K0bwe>FwTNF}S`Bwaxxep*H< z)|!O3o%9k9AD^g&=-rqwiz4Q&yNIBj^4=`>%2$+2^iXowzR5r&So}FO&QG7s1*X>n z!g%+dTp0`s=4bCXVm*!j24)^XI(E{XLCS9LS*C5*n6i!UH;^Y~>AcZH)sC&^eo2iN zLD-)^JX?PC-(9fD9j@<*Ycq=pG7ms(U~Twb?ynfyKjpQ*_GSAMwBV#5V=XqAxBjb%LtwCBTn` z3wWJ(+%-wO2k3@-lxW~mDvRY~@BevnxfT(=PN(Q=>lP22=V-37{|(r| z!$HjLa?8@y4B%xkw*qKRH-X)a@jqAa1`h7^;kwnbp181L+|zF4e4Tm?po7u(NeD)) z9Gu-}V;d&Ch|#itd&jDRVKC$|H~T5E-8|dIzn@b`q);Rc_fUahZCjk%a*Y@~Fnj8d zkq3H%de(G6YCbafifjgyRqjg5gX4XcX;U>Y>cr84JO93&AJafVgyP=4=HS&9@G7jL z6xKrrd;3o`S0Ria!Ov^HWo!KRS)t#93jejWwMUMt^3XOZ0|P}gU)_Vn0vgHm4^)2t zS*%`oyqZ7oEDVb<;15t-h#gE< za`cR^?0=XDLNCE|6-N$k{w>}^CnyCGSRi46iUve~`tS)D7Ap9*x!sBhgh*cefVC;^X2>ozw4fJ(H#Q!)`g?di~5c8 zK!Ktg4AJ;@nGLCpbLS)PtH&{Kcm-sKN@tF|cO#nOz)W0d6LiJW}=rs0v(+Xg#o zrapQ`2xOY`fidY_udecELE1WDW!t7EQ$mr(-&)G-oasukA%1ZSj7Jj0qpUH*N*3xE z(S>S^#Rmmj(Yw)a^ZO4Zq*O|bR$~)8kgGCYc*I!_hkw1@?XEGnQRQs(_P)t#Hw7o8 zIUG;s_A4ej$GGrfnqFLk2dYjnQBD>?)c3d*c$FBvL`Jp8h?k=HGpyAcGeZi-~#UMK83GqV^++wHgX{N!9s>vq~M}HhpM} zz`59;-#g6;`U+tuypS083euA%AedA?iOPLVH{0S=bj!&LY2xwVu6Oy^9GA8G;X;uG ze?iQKre<*4K;?m`JTn5WA(t>!h@vtaPs|JisWjJ3uPPTuNZqi|bW?(1iP~9;dMHtk zAN{gYhDEtY-LSKwjFlf7NB*cpq5VCY675vhH8z~FZ56U1|Lv((gMe9QM``lkV+P2_ zCjee*tT$@;@Q0uY2n!HwIC;eWcT=H&^?>gFm6oxO{;&wMIl<~36>ERAQcp{pSe) zGnl6tKK;X86vqIP!J|8n?hmlQ&m0$o9xKOSiGPK!ANxJHTC zN@sYsU~1!F{TL_JdQy|qDd|z@?l_0OPRbwdn8+7g9P&q-*#_C7i)`}Hl!iId5Ek}prOSV8mVL8FmI~!v zgtW2W*wEs{XsfCgUDk}6ZK!xF2b!9~4bZLPXY2vWgj_$4IaW{{gV&OL&y`O(^lZ~X zX(>p7;5m04?(S-u2QZv_u5PNF)|w95;3cngPEcb>PR`o4;Ms$>LX6S{Yg&^sh6x-C zC4CDZ2-AVf9&fnZkIe3YS@#;bam9T4u({t%T|I7XB;=6iwhe*bT{fK$fKMMOe9Fq9 zAeTDo7@k=v7LBf&`=-|Eh257|h1mrgNA62DK2vhvyiR&;2i>L>p%<%?9#L$Q&brRU zH=7l8klC!uO|>DCI%E{ka&C|t2`{E`d))C*9S zK}TETx<`q7e9(VG3+kC-fSWPiA(Cc>DgZHw!DDN*chhF7Ml{*ezNBui?ODY8_Y_+Y zr}tmJJgMGk@agIo?8iNep90X8WxKDH4hX5oI>B3P4U?;yyxjyFSZW0$E(R*P&5-Vj?Bzil2N6H2@-ZL<^7yU})AskfZ#WCvffU7hzTb>gy4X(M7!F>r)=lQ&$m&i)urfAl zvIwM_=;dC`=nb6*+AYt#zfF^0nhoaAgsnXg_zr9l%HEgr#Az*P1btE54h?K)YvVf; z?)1h*?X>4G67JF3N22wxZ+69|IAh-OHWw_d1U;ZxZ;a^7=K{F8X-)<8zqqEggLKfhM_GGD#7U5!zlD#U&G=G0*~>ZC^JFGw2++!% zoo3cdulX1?4r{^N=ynp$?>bquhkC?1G@qCbrN;rbM92N`aR(m~kbz4(4eh0ZP{P(2 zTxsjB&wY&Qm-T18Fp<^8sdhnAffth{)EXv5k%wiDW}`I)dn6u9Q7bb1zMd|t1Clu9 z-pD7@aS1B(VV|N)48mS;gj}!O>UX~$J1?pf(HG;tf>qKg5+>egD9z}SRzEO!0bG--_y|(5u)+BzY zNd)yf8Gc^J)wN|32=V~&ss(RB`<~^i2vFQ48g0(gaDDDDnn7EJ{<)|}wdh0BN``uA zqP)V!QLO3|q8(F8x{=x#=fH~522I%gO!l4w#eIK?<+JmiLhQ*x*<{Ijr?MNG@J~gf zq_yuP*hn*aYvi@B%Tej$ibOLpvdm1@Z>XN)IKC8IV?nmWFyWs>4mUH+)AURK`U35K_~PPhOv`XEfHv ztbF#y-?~U-u73wFGO%$3-uqBUrfc_V<@m<%dD(&Wk;~lGhCT7otNw+k;LSj~?x6h& zC&M^1pBhRJbXCVrss7dt%kEQ^+}WFBxx1a!x}zqM*SZBf98yP{55q@bb5*;`Bs26s ziuAUdsTCySV9H}gRJhBMPAkd{6^~mW4Vw`aK23KFzZq+;dFArp+tuo!m)EG5vw2Yk)(ldOAb&;@It!f1X`S`Y7`IbI_ysdBSuXzH6S zM^JtiXTuN^_jnJZU~W571ar+$2XZof5VoIRG$;#`_}UK1?+F3EH5cD+h>e;g^bWcX54m{OFo8Y&g?@AYV17&)m^SRyf>H2ikBlkn(>W%HG z`}FjhZK3twf^UBsx~+W7ayU5mOj0sx%9_~fHnYRMt6NuR-`|DxGTnZc7P_v_^C_C) zY}hjG^Ih3-EVJe>ZuSSgswkO=P4E4M_Xovyy6oCdSP}7q8^}jav%b>!+43l~4yy>#^mX=0RX{)Jjqfj%X!H^&4s|&otS<7hLLfdS1+Zk>f@)Hr5kRGA9i{TT9 z+1!r&`F3s5BJGU0HYlesTq+wzH0O`aCq*mj;BJv)9~|)Y?ZdybXrawJTb1@?{GP-x zcrjgpyRM$&=?A4y)!4nZ(wdMr#&E z*B-^8A0@W6w_DI^eX2%W-*TM^oa1gk2r)r(YP!CtU%bL0)C8?6BN~u&qI-HQwUvyvtoxs3 zyYd;6`?+!yYw+g>)~FPG>osrEy%%9$Y)!Cse3Qe<*_mQYxR0e9mpqkA3^|luE86b}%_VzUxF)|YV%xtBVhaHGVVAbUiPdHv3X?^|_it7zu+ z`RM|tG}di{k27yD6dXDAeP*xRpHE!h9=}FD5kQxHW;k0}%1enVg@A}h6myesm3B8S zu2IkWRgS=ZN1D_2VLeUH=^j^{*sf8GwuRUV*ykT_CG8V?t-cjU@My&w-?HatX8>lG z0_IcEh=};y5Xij!V)%>{+|DtT!994M~tqQIiJdtH6k%8Qa7u%*F!4& z(iEm@$#!jS5RnV!(njSFdZ|qu9MMUs;;ncIsRXC3tShDf&~ z43UmG(Il4HZ9cv$ux6k49_>?ht?d~TTLpa>j6y?5+{(2adKudsHu6gmJA2fNHb!D_ zd#dG6z}teyd-xHPY)cNuIZ*b;3d2*%6-s3Z@)CJnsyPiJUNl}|V2vEP9zPi!B;;;E zE>^MuzGhE9g_E&_lnz*a_c&~S@NgSHF|*~VDq5039;ITjPZvOWIIp$-ux5P^LJ=r*=JPxT z|InMvUPATYCfUP!SfK=Gp@GyDy=v3&W&Vx=Qmid#BNtp#SiwSe%WuBQipy`-`+%!w z0QSy<6tfmAd*2#Vk-6iS`>%LEP_a-_XxDCA@rflaG&kzz42E)$vOrF+FKiNIZ<#D| zJZ5lLy|;Srm7o6_UDO&8QAFtHuy7@Ic{x5ilM|*w(YM-gA025J8D&6)f&BtpP+y+9 zISVH5ktK&e0U=iV8U#C3@37`koUNdi*a1*(WX*RQK5N=a6Et5j)$OvMUCh4jUY3Dq zOy29{btKx(dd~q-2nrtt#T#NNNtut%^wTjIwCqR_P^V4~Hpy&Rz zJD>2)&N_@T*<&X0mimHuK@}U{`Rf+jZj9(|rh2g&7r}wx9>LQ&ZDW`wl!XzKSfV#B zUXSh8wN1=}hB2Bx2ujO+nhiQQl?Y~Q9JyK|5tGvgyiS{D(i7v=~4<5hF#Jrr?do%bxR$Iqcc z7bS^os*kAznezm;F}&H3hz7B$LLz~qQO&aR4*ROoNB|5X2@mRnkTBmgwvIDf(&pD6 z!>T)3WLfto#B}Gd2xpoV6_Vao0q3Qfctj!lc`){kQ1j~Y6@+g0Yy~Zt_}Xb)7vB|P z$=i?O%}RSt#}NpMni^!eP8H^q@nrQZw;Fvg*+NoFJm7WG-W96)Vrz&eTJ@Nq(}Lo$ zrK~v&G`EYbe&?Kp_TcJX5=_tS9@y)*8gQ{C{znYnXGS4?PGk7T7=9S~@II@OSB^75 z#wBLMh};*OXuX%F@Sww+WbJAjFsacpYL*WkQF<=l2wvNTInb3_zbjRWT4_b;*7ZO> z-7ja`6Lb3fO$nWy{pfIXRx2;yd+YV!L|sy;L^m$!%1#T{1ta;mLcL@7lKA?~^^&mj zlxgNhTBZMlZ~6odXN2^g z3vRH7hd}DIuDM7jZyYNrmSKV~EQ(0!4BKS~%6q(3nVU$hAG+h~$gyk#p)pTKUL@oM zXN)T+|LU%5R?{(3C{lymtroi}IUwwDaLi8_B6VxK2)tOPH`H+qyX787um1wMa72kL zsj54Qbtqs#ZF+OkgnXPk{pvn_?c3XT?c>!Gk(e@9kHlN<%u}dkqi!>w8gtaa>A@HX z&^OqHx(!$1!=qiNp4@B{3DAdG$nJ(Y!54qKb^Aq+TYx^R&34#z^|N(Eq=i)!?e{3# z&4iu8RU#f1RvLcrG4;dqFI&G9UnPg`icqq4&<~Z*rKf%oeT|22)amXArPH$JJt-$P(VDHDQYJ62WBWQQ(cn#r9X)Hp@M7%&vI&94;$TkDSy{ zO)vKq6Z_jfMw1bkl_x0MD2AvG&so1W2o=@aFUc;DP~F~D5xxpJdr6!8nBlv}T#_#~ zi}cBt?}fk(5ZxRgH|T^s^ki&sSICzOW6YzOZD#~s%@ymcl?W~t^VwT|IL#3>L^9>K zZ{Hf*u`SvvZ=;sl(ogTqKMFzIW0Pw%sH-1P@onz}9pEhw;m%>NT-GnTkVVhyo;&j= z7m>qF`HZxl2;kF=%;GN`g0~Q1(j^!9lpQ6z1x`kt9$)J+G(-=H%NecvkZQge-p#OZ zoXeK3S9raHJT-Ykd`jSi4vDXK3c9l{>6##K5aTOO$`sT%Y(|N>I_<%+jeC5&fj0KG z>AM%o#oC+tV?o-oBen;^KDE!BHXieT(`YfL#YtbKpHb0%rgG3;Km57V2WQ1e!44Uc zrpAVJaH3kEVa>O_+@I6xx?3Ga&&_B7 z-UKEe*)7n-w#x2)Z<~$)#foajN?iOVp9NO-W5a?L)Y9R;_w3bP?z65(yT_?dq)#;z z^h|r_LolnsTONaX>4{S7%M~t~ZYdqzB$dcjMnfnbD>V#`-rSoxDiva>3B1kUHQk~f z+?BXUo`=jn81+^6vR}GXL!e>BYiu&Wam22IH59z^Su&}GSDS!ouRqG;bUrI2&nva> z9$R0>gNlIe26+N9;OhCLu2v+IaK9Ap@ogpsJ$!~{w2#~?&^cE|(U-A~f!qS!4SGB7 z@MJ!DO@SL(@KicNd%))C4+UKIW^kL~j+IX*Ke zSxZnK6g*Xmuxa={F@| z`7;}C4suWR@RPF4!Ec#9)+R70xFlOT33|tdre+Yzv21wqxHygI=H19G%X}1^%fwHi zpsy#}NN;VL-d=fW|6PX3c+j(CC{*hzqD>gdiSu2V0V|`c8^UsHHLcGU6_%E)tB!xz zy-`(dw}7~=*G@`gqs_4SMgBz+sY$lLBtmR+$MKrnt4G)vg8E&0u$(TQvzOH!_Ns|Q z%_Nzl4@qj5pK5TaX~VV_7G?F)RD4W3?Kql9i`)FrChlWe9uGNr;rKQU(UXv}{P64d z#IzfSbtFkRr{RJ1aw}SS!ZF!wl054Z@{#XGVl}gp;AweOXU=$SuH}r;qxny|Saq4J z)dZ^v@9O!dVR#zLS5OSXxttU>}2NhnV)=*LNTrD_ga~Z^2o2ST8^1L3Adb$Fm zvSnlUS{B<)NqL)VMwR)Jv;V@W!0~P1Gte217ZVO)hd+NQV9iY1k%zRwI^Y$V&k%F; z+y(|Pk#Hu(0y41R)~&n7F!`U3O+>fC=1$D?c&fH&=QK+A#>aE&ohQ|3s6}-;yBVWC zEr0gl= zl97II{ef6cnK?Ni_^ckiS=7jjz9ad>{8QC}MP)w${l4Ld`xt|dNqQs=VZrWmROORb zxop^&JZPjZvG2&TJS5jL2}FCh;3}KArYNhG@A<8Aht>G`s5-acE|F|ilOdkff*bvS z32eV@F}z^b5*2yuzY`8JMHsRt(VUX(`!h! zdCHyY$~vg5W5nYtCG!iOjdeNg*5zO3sSU+*_8dg`JZYV@rDIAFZ<%XUnP;-n;HJ+> z@Umhu;PJ)YdeHRAtMB1;Av@_P`uyX?qO^nVBRlcU>>J^!CQZeM1-y`PPPILgaLD7% zw(^DsA=O+>^W?`hx3u>VdiGrANg5D8r?EZUtxJnsV{_?8S?A2(@^vABWEO`7m2Hb? zkGZ#(H5!&VlSWGR28kC{E5}3pMuzP$6FAu@l+tUcv zP2dsSN207gwE9o<`ucZF>^?NvHn;CKy?k_x-EP)_*tSwp5C7yYyac1zIc3yb3Giv&ccKYRE6siM_UlA@ zIb2HQTvezro@f7@ZSzXN$zJ{|kBVD6J73X`>R$6Kzg)4g#1b-*)k{LTnyS*T-!pH9 z2!JvYPI?tgVrSXv&tZv3ZErt31rK2D=x&2I@*JDT(x*06@IkcP&VFoog<#SfPZys1&Nms&jl8&I_kL*WZ+u~b2^ct?UpCYwkzF8v;xd)@ZgQ*y9k#miw{C@H3h-FPkw!Ra zeqle|h-NPO;TvF;gGoCC-E^&=FAuA`P&~x#f7(vs$7wZ{z~N@VWY{Agg_7Q=xs-Za z0uCFyShSKw!nY`R@0lSso^A--_%?hW5%sG-xmSJR&EElB4WaDZ_}zjFlp$YHAdqQ3 zCzMA0gFrTd59GRX(TMS%H~&+C|MllPs5d5?CHBrA)U#|xpwe5syI&;o2ZanD=uI{X z`Yd#R5D4Wp!R3tOOX|G-gCxcPT*$MZzUV3bNd&Bb+G!ah>M;IrA8Np(+bH^~IsFd< zAY=t~3~SzZBmKjD6a!13_dC=8$v+H$9|UTOu8`R0`NMtaVZ(Z$d&j(?m%WiU@b#6` z!pEnMcuM*X_6QP=;8IsV8fW!kVaD$Jkk5xU;ie3{V%~dVUBqs7?Gidfug_ogXW$zq zh8UrczRL=I#ay+@gKJ|p10)sB2crx%ALyQ%E4J;9J_|E6hvI0v=8B9lp z&Y=p}^+n2p1iC?)RJAEZ$(-XxUF~PlE9X4rHdfSD(uIW2%H#d%DPiDtmr>gPo%rmr5l;LaA$PEa~3d1UNV{vK*r|^?P&;$ z72yblrMlk?n>=NVC5#yD4r)!~Yz%Yu8HvihJNmrda*VRMs~HAq6%v)9s1oQ$TOmkF zqi~QXx;%tv>imCpxx(}Ow(Yqa5_4CIh*cQw^XznD(wpvYWOR4Z)a3WSOJ8pW1$%3xWaKV>%D&@qHCErx{bH{8s~K-qMeJ(p{CTC;KICk*4_>x-$(Kc3 z=hel|9Z0NAHmGwJ=(w&Kkt1!w^7B~n`HW2I4Syx~T1oQ04?q5( zpDEZUcJ-Ck{>1?oe>=E1pIVuGF~G|wIaj#D|AL}Gwe_-W>)m_edISxE|0n7ApXrNb zxnZ_pwM~+t>6MKUI-$QmvGiwS%bgP(dO$O`$*iZ|U`f{u!2GaW4vT~X4{+g>d~@q5 z9W1l{z~uf4b1fJH=Me>9NnjYU;*1cM>^0;3r-#zD*vbKg#v6(cKCL|BS2jZ!OZHM= b6!=kp=?2f`=u^D93_#%N>gTe~DWM4fTZ?eS literal 0 HcmV?d00001 From 404172773270e7f657d426bdbc6a8d4305ba90f7 Mon Sep 17 00:00:00 2001 From: pareenaverma Date: Wed, 17 Dec 2025 11:17:31 -0500 Subject: [PATCH 2/2] Add draft status to CCA Kata learning path --- .../servers-and-cloud-computing/cca-kata/_index.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/content/learning-paths/servers-and-cloud-computing/cca-kata/_index.md b/content/learning-paths/servers-and-cloud-computing/cca-kata/_index.md index e3d2994a58..faf7aa1c5b 100644 --- a/content/learning-paths/servers-and-cloud-computing/cca-kata/_index.md +++ b/content/learning-paths/servers-and-cloud-computing/cca-kata/_index.md @@ -1,6 +1,10 @@ --- title: Run Confidentail Containers with encrypted images using Arm CCA and Trustee +draft: true +cascade: + draft: true + minutes_to_complete: 60 who_is_this_for: This Learning Path is for software developers who want to understand how Confidential Containers can be run in Arm CCA realm.