From 5af03c7121b39aeb5d2c09f95451c2ac4dd82625 Mon Sep 17 00:00:00 2001 From: Annie Tallund Date: Sun, 24 Nov 2024 11:19:47 +0100 Subject: [PATCH 01/17] Draft CCA attestation Learning Path --- .../cca-veraison/_index.md | 40 ++++++ .../cca-veraison/_next-steps.md | 28 ++++ .../cca-veraison/attestation-role.png | Bin 0 -> 104039 bytes .../cca-veraison/attestation-token.md | 121 ++++++++++++++++++ .../cca-veraison/attestation-verification.md | 98 ++++++++++++++ .../cca-veraison/cca-attestation.md | 22 ++++ .../cca-veraison/inspect-result.md | 81 ++++++++++++ .../cca-veraison/veraison.md | 16 +++ 8 files changed, 406 insertions(+) create mode 100644 content/learning-paths/servers-and-cloud-computing/cca-veraison/_index.md create mode 100644 content/learning-paths/servers-and-cloud-computing/cca-veraison/_next-steps.md create mode 100644 content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-role.png create mode 100644 content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-token.md create mode 100644 content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-verification.md create mode 100644 content/learning-paths/servers-and-cloud-computing/cca-veraison/cca-attestation.md create mode 100644 content/learning-paths/servers-and-cloud-computing/cca-veraison/inspect-result.md create mode 100644 content/learning-paths/servers-and-cloud-computing/cca-veraison/veraison.md diff --git a/content/learning-paths/servers-and-cloud-computing/cca-veraison/_index.md b/content/learning-paths/servers-and-cloud-computing/cca-veraison/_index.md new file mode 100644 index 000000000..d3fd2946f --- /dev/null +++ b/content/learning-paths/servers-and-cloud-computing/cca-veraison/_index.md @@ -0,0 +1,40 @@ +--- +title: Introduction to CCA Attestation with Veraison + +minutes_to_complete: 30 + +who_is_this_for: This learning path is aimed at developers who wish to understand attestation in the context of confidential computing, using Arm’s Confidential Computing Architecture (CCA). It will provide you with some practical, hands-on experience with the data formats and workflows associated with attestation, which will help to provide you with a joined-up understanding of the many separate documents and specifications that exist on this topic. + +learning_objectives: + - Describe the importance of attestation for confidential computing + - Understand what a CCA attestation token is, and describe its format + - Inspect the contents of a CCA attestation token using command-line tools + - Use an attestation verification service to evaluate a CCA attestation token + - Understand the purpose of the open source Veraison project + + +prerequisites: + - Aarc64 or x86 computer running Linux. You can use a server instance from the cloud service provider of your choice. + + +author_primary: Paul Howard + +### Tags +skilllevels: Introductory +subjects: PLACEHOLDER SUBJECT +armips: + - PLACEHOLDER IP A + - PLACEHOLDER IP B +tools_software_languages: + - PLACEHOLDER TOOL OR SOFTWARE C + - PLACEHOLDER TOOL OR SOFTWARE D +operatingsystems: + - Linux + + +### FIXED, DO NOT MODIFY +# ================================================================================ +weight: 1 # _index.md always has weight of 1 to order correctly +layout: "learningpathall" # All files under learning paths have this same wrapper +learning_path_main_page: "yes" # This should be surfaced when looking for related content. Only set for _index.md of learning path content. +--- diff --git a/content/learning-paths/servers-and-cloud-computing/cca-veraison/_next-steps.md b/content/learning-paths/servers-and-cloud-computing/cca-veraison/_next-steps.md new file mode 100644 index 000000000..8a0646476 --- /dev/null +++ b/content/learning-paths/servers-and-cloud-computing/cca-veraison/_next-steps.md @@ -0,0 +1,28 @@ +--- +next_step_guidance: Now that you have gained some hands-on experience with the data formats and workflows associated with attestation for confidential computing, you may wish to explore some additional resources and specifications, which go into greater detail on some of the individual aspects. TODO: structure the resources + +recommended_path: /learning-paths/PLACEHOLDER_CATEGORY/PLACEHOLDER_LEARNING_PATH/ + + +further_reading: + - resource: + title: PLACEHOLDER MANUAL + link: PLACEHOLDER MANUAL LINK + type: documentation + - resource: + title: PLACEHOLDER BLOG + link: PLACEHOLDER BLOG LINK + type: blog + - resource: + title: PLACEHOLDER GENERAL WEBSITE + link: PLACEHOLDER GENERAL WEBSITE LINK + type: website + + +# ================================================================================ +# FIXED, DO NOT MODIFY +# ================================================================================ +weight: 21 # set to always be larger than the content in this path, and one more than 'review' +title: "Next Steps" # Always the same +layout: "learningpathall" # All files under learning paths have this same wrapper +--- diff --git a/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-role.png b/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-role.png new file mode 100644 index 0000000000000000000000000000000000000000..50b5c18cfa74b61f34da5853e86d31abcbf80b73 GIT binary patch literal 104039 zcmeFZ1w$Oc+AfH@WzgX69^5@>aCZ&v?(XgqV6X&tcZVRs-Q9ybfgO_b-M#nhKiFNS zXS$}RtE#K&mFJZrLgCA2WCUCUFfcG=DM>LUFfhn)Ffj0TI2h2CZ~aj^pcA;0(q|E{ z%3t_LpfACu8d7F*a$vNeG8`B*H~+5>`fnKwOd1^Tf0dQMssD2i1Q=MD z1sK$S?$H9B-~Zx4Z&2<3oFReW|96W(i2u18G8_o`KV|Ut_iB$7mwccTyuGBR6Brm4 z#rqpvN{Rde3`_`2N=#VA9sD#K)*FA|c4$LSJ&pcekGawx8HYKqDVWd`k(?yP4C3#G0MFXm z@6+V--{V=F=i|{7q$qkwp%D3-GirrVTz?eZTxpjz$A2F;NnjrFtyzO?*9KD$p1H2WYbCTf6*cj68I?D z`is%!1EkSVL1K9smcus`<(GXdwnZ-@8eE@Xax%k`jO$qPQVvc|_`&~BT|hLPg76p| zI#~i3d^{NZE+8QPPh4sxl^$bfFMwK(z4mt(r;N$cH-gAR21aZ~8pTXo-w3mb%d9rPFY*|Y9K$1^xhb!NuS@V35pk5(+PZ<)FZrp7{za0>Qui_ zQdsfw6p^W6CaLo%Kf0;$GSfewnj}q*s6PHUy@V|~N$aA}jct*%#P%k(B7Eyu+^V2~ zo^OoFKU|cW!iIdG4$xr|1%}ygonYGfPpoK?pq;WvUcvsR!qSmG6T^q$sKSU9kfvSt zaBK@ayp&uALXyvRibj;NVu{A=Gn_F#iVjA?Vo5g`aA5KcvU9*KEPB?QST>5+5NOY)uo0Qcbk|xy zUyG{96b?HBkqC~XWYmBPCtN=Mfyj!v6^kvU+>RA27*U6sx&!~93;n2UAy z-gmf7OB9S;(fu8m&=8e^=WfgNTNbAb#E3S8?YACVpMk*q#@+cU8TWM)cw`)kwXP>J zntF2JeMA(1<4^0zaDLUmAYI+cUS{clrgLA9Ng`A4QU$)NL)V2;>=)$9r2XL-yka! zOd1}MH@&92mqN2}<-PTyzQ$U*>E#FLwhbr$I6XuxG=JM6UuA+GOdAr69ECfl)7rIwnN4NUQgwKv{!lZ66KynfnIOctf}1Km9# zNiI)6sUdvEro?UHQYO)3qZQh(Bn!R|kyOTnD4iFdhhdnSVXeO5RhsERdC=?i84< zJ4H*bI3O9kn#{|A#7h0EpNPFc8qO?^ zL7DQeay2)Fc(whr+3NvxNGsQ7l_~w+L0<&x`*CCfj%NAXeCg)O2k`3MTHgG2F#Wum zi)+eU>zQYr`M{;d6Y@-vTx?6_BN`b>M0s01S>bg_2=B*%9Eq|2MsUyGoQsmkkn~D+ zLiHloZjXNE_c)%o;1`^{vuZg;Mc?h>VGr4GLRR~fpl?`{-c)3;;jkUVThi*!V~@^2 z^rjkN9FQ@taM~*)z)_`;>qAlNT4U||tXT4B0!SX^Ir5pRlFdN8=a;14Z2&}S#VJ?C z2j;;V3hXIqKEGrub!{sfFVW-p7T3V>*q6BgS23fx@TD&_w?B7g4n4uUbyKj*d*=F8 zDB6$4@yXNv5TIfyG*)vPa4B_`;H2lIpA}bUDEA1uOEc)&QbE&x=tMGE~o>(NDx=ON&X~a(>mTl!POLy2VkB6iN^z#T!6c`1eAFJ1w~j<6V}-e;Ws=x z&ql%lk+wP{Dd^PCL)W$we%m*LfBi!j}xNlSh!{TBgIY7EVtH|Fd4HmzuZPI$ZFm+ z)8>u7x_4?CNK^o^8V|zhv*-q%iO2}4e{{Z(mSq3I8gZeg_y3H0ug;J)FCVlQ&^&L$ z2lU_0-7P>lrYuFAFZVg7Y>xQCp8ID&w}^>8CG+#T{}e#Cpt9Jq;zr7PhF0_X9Ip`O z5u?wsRJx({pcGok+xLSq=XgxOUjhSudIv-q=K?2R-Zch6xWCrXtkwZMW=~|J^wlP* z1vKJVAoH=-QIMC}&j2bZ0yQufWcC)n|)^aGm#p-E*n`k2L`uX zo1wpvy5lUg63X6`{`wGgFrnY@>6UrEg?E3A!ImsEL)P=h&#Sv^7Gq6Fu16LaqwaH9 z8aQbo7J@kjUFz@W3%*Rg8h=RbpOO4H`o^@8ka1d^o=PV%mg4m?UdHC%!5yrw|s!Qz+Q<{E`tB*BlPfc`P(F6?kJVo%xPGS729+3@&lae=6}k!JW2magJC+ z{H~%2nPeBVoe0VOkI`Z96(kOSMFvytHEt&ezGvej?Ge1B zh@CApt7iCHp9ZV1hqln(?acSet)}+)vi5QAIfkwzhJk}G&wGpopGj&g$X~GFIbqGY%!ph;E~r<)eHjWdNoj1BZZ+r z!J`oEni#RBv{F8=oGU`ZI|dUd7V|bje^Z^YJV0 z>9YQl&of6s`cY1>D?}twd8V0*QuE0CST60}VrwrRZ9L#KqgY$Xdf+xwedKqBqX)7v zqX~55KDFSJ$j<&UHeG&c5sRie|GtwMDY1Kr!cBJ&Ub^V?1mJT~pRa~Y9Iz)@V zLFZNh-*{2a2pMB+yN1f(IhwUO*fzfOW0lMY9TEP;9MS-H+}>--(bBL=_Ofz>JEd}M zo)ry&lRRcy-)loD1BVPKHT^l@i0zsZeflSSy3EuY=4+xIOe>QU*a@5vkr3HBs+t+#P8=eQP@6Km{*R8nkG_t$SSL(*N>G5_&qEXRWA zyU}?3+doO*80p_2mr%ziaQPszjl3H%ga^YFB{D* zWMtwDOi6R^6es?W&ZTwdNESerP@JuwVN%biSA};53WQ#XLx4NQB!x#1RG`x-kwuu} zRB1_V^M6E*BB;XVRqWC&>2HWh`I1EP_RkWI?62$*v{kAZ&83jCr)-OnB^Fm)MR27u#Yv8+Hf8~xXlsz-3YZd1 z!~H%?llAQPv=rk?S>ptMO>S6{t?uZ7y5T zJK3mv5wtY$QFjqZ+kn$YoBEJXx)nn`BPVTkZvldP4;g4fMrl?x^Cky5g(KFQCGyL# zge`O^r^XfV=@ul*UC~#S4fj;a_8UE7Y}8Tr#r}CGNZyfHd{a!wKNPbV;I9Sm(h2MW z>Oh!wY?g9^%{P%4xtt@1R7YuqRR4kw+V0;m>O)8?UZuaBlOgYPOsMG|D4Unz%eO6X zk;q#nxx|0ip7BT!ZthFHNma--1mN=FRw)AfQ>N5mLO9Wa+h~%PXf*^E%9HyuDU`Y# z1H=}X*b$7&aivWl=BI9YxwsW5u>JvKVouP*jg3F|D*ao06OnGjfuB*2!Fj)fC}y3C zp*&GACP$Dz*kvW?&S|YWVQq;AfTV93kPV?)-=elRH6RPP(awJ$&{@f$>7qH zS9sxZt1XP%y(OaXC_qgz*zmc)4Q@$J=RLYNwl&d7)NYdWUbBp-ct9E<)hj!YG1)O{ z&bJMz#rc`>R89QPdBQCY@~eJXL%|CD%kl~>JRPJnOH^+Sy!)0&2Lix z{PtWZPgFF&g`918!&_CAX^s(6`Y0=PN#{%a2>M5jV<5c*ojRVlqOQV!u!bbDoIe67 z5%gbq9uO-m)RcS?CQYHS3~QU(N5O0m?Cy1oZYPCJEh=1qRH9Pnf~iOyYRM4Is0|iH zQvMY$O|sk;aUZ?$*EVa5Bt05^lEQ*;BB#9{&7xg9)cw*1btG2fRJF4Va<|mH;WN^h zW^`|<2Im`O1bsHc6v9|rv~AI|1>?F(YQ+0=Ea$w7zpuaW|M`70KX)ez>7^wbExM6o zS$-rDpr76DSrtJo4{3b^+8X9z^_UGvFZ)KtLO&0vQs1L$U^2YEI&-ga z*%0>wia}8DQ~2cu71`gUk#pUEU6#41GL$LgK(Dw_*Y&5yR8#*-8Gf+<=&{L>W&y>F z4G9Y@+}ca)`v0w0g(zsfPV7x+|9xE|-VC9$C@#<4Ma8G<5hfdey_b@gvaqxzNyaa~ zkNAVoq2UfwmQWdhxR>Z*Pm#@Vo0V#4Yv@9y*D(Xo2MUQ4`4ri2Tq@ajCjfAL!XK(5 z>D0Etv4>8ti@i7~X@S&?k1D-R>q!@16)>9Ug_G?$Y^i46uF#s3P%z~cf4UAZS8N`tq5h0nguS?yXKu1>tO*<-v!`GmG5)&S zXq+7*&Y}_Ng9$4$Ra{VHFs2AtbrZboKAVjg0_v9qB1ajq2BhdVNg^?}%n@}`ZiSr7 z_?+>SpQEp_2>ZT625`XQ3W%{*SI(JFKL549VuYBx=2Pm=KLD6tMXp}!J ztDkD{uYNI%xOG=%EM8<{fx%w8pi(C1v&s)vp9slsenmXG{0Bn1^d+tRO6EzXXYw+!>CMm#92fQO{!@?-!?+&jAv;(wv`e3=Ys+I;B={(+rO zpkA#hnI-;32^K{m2&?oF+TxOX9ezl@<_$$Q0gDsnn6tsv=A)}LX@nvOiR#-zFBXAyGKgxwqa((?!H!IJj^lhi=-o#%ZK~Dn&4rmXbZC*ChPc{GmID zpj_L%1_AG;vCt5Ofrq!!v{y6+p=ac73_m_XSf$dkaZ%wxe*Hmlrmna{Z$tCDLO;91!~j*s)uOQp2`ovN7dQ`$CWm68k8gI~u34GD0B} z_Ak5}c2YEj!UdJ;YP8=+%#l1glbuayS*@e^>XbfEF6Y7TrlG`xf;4?K4N!^Ydsi5FpTLhiMpSo!@-1sEGFFSg}N^cA6D*y<1Y4n=2un6EO zKCEed-7Zk7vt?w6u(9_`7r%o$L>I(5G08q|C`8I#>1C|+fgoV;CEps>iQZI_QXxh< z18GYmuMP11jUzaWg2DSR`X&E+)SZ%JJn#f@K<2oifJ|k`O&iDYFclk_Spr9rZKRN% zg&)oOn;3k|W1>bLU$hb%i)?_;eWFW)66cw2i6)Egwlkd#f@v1M4EeEv)QdtncE|R~ z^jdS)F<~-tP?Bso_I>T)aMD1m1o@>|!>lU31x`q=6vzjUgS>YU3Z!tEToi~l-h?a~ z$}5M_jeE3@PWuDN`n1dQ`H(3=byb#66r?vkK@FIbPijHUdKN<*tV*uLqPvFNUQ~h0 zgc85WYn8FehC#6sqYa;shKLTy90JJ(l(ixa9| zDx|u5^96ZeXQ8t1Tl!o{^~a=iy{uB@u{W&b!|zYe!>e#OFq_jjkV@G+uMr9l<9Emd z&R7$P=A`M{;bXp0IbnOQdLi?~O<6b!SoYyRWXmIbZid4z$!AzrM*I=Ugos&9q}9_82KR8c%A6~Uq*T>3C?GX#07aj&cb z|M<%_f6>+XC`pX{9;FOv>t=PPh2VKb;jXoD)(x2u+?vjJf~<-vA|F+pBz=Q`cR?ke z+i;L=v;XWt-$FzdohEMW0qbKe_k&ybdKMJYtH%UKl=tv`B&Olo#JRj9pvFr6@B_Xq zW$#wXdQPb%mtV@ViQcws+ojbTP{Vx3SDyO9s7ubZOAH^&)2{&?GiQsP%1iZe2wzO& z9th{z?jiRp!4cp9kFu;TJ@FE|$Znq~>ea9URNIl%=p|~WWJg^8kTtSpo4_J+2Y;A! zBG3UVYW_;GoAA74`vj-Q)9!-c`Kt+v|0>8+o3haK(lGq~+&fMuI$=HHV&1}b@5O2+Qo;v?8I&S2D*#!Xa+V8Y3FKIk zhQlb}syDOJ*cEHkA(z$e2v_9J{YQYqIYD;M+1Yl5CTerOQ+EtoAn(V_UI#?1K80Lx zd*g8fY6RrGSj^zBUlLjeX2{!3BeKvpq=35cY{^NM6FKl9@}{+3IvwuoeKi%aA;u*I z$8(=PMvav_ku?BeyzDIy9d{_mtF1tza~lu)Dg~T_FGf?Km^z~^(>_WmrQm@3MB>j_ zwQ;$KfuB_idyU2NU~yH1C<8h9lFkl6C@*y785chp9yCBpZ>z-3meCiPtZ`EU@@rF0 zwT^4jp`x#UA%>SRnv1jmlxfgSvC9;hzmz0$f?x_ouuFBxW8MnW+AWp2x25T7&7S2G zpaJ)DDnopvI$`R?_mD{}w|sXFAMUtBp?SE&>ywd#BX{~AoQV_XJw*pT!`q?qr)=IW zz^R&j427@(6%J(q&M@2^vm}s6x1Kg#CZB`?&mIDk$KXa|Qbn0Vmw}FaRILOE_ba;nB!Va^_*|82Wr6N-6ngTr6d{5! zgDjzfPMNZZa{E%j6;8}jO~!i=>eJV1lfEM*=HFcK&gaN(O3ra^W;E6z`NeZwdNop| zR2{?(GJ>105f$CZQuQd{DRC6>Nyd3448aET?2yC)UCjIiG@7fkHL}u03rE{*=@z8g ztS$Zyl0ak-%UMGXj|D>E0yH2Efr!&D3=?EdDq!q<8ATJN{-q+Vgo)-M(!4N$VN!5? zA?)uT8D53^`jr-xG*U7VP(sB3GFZ|kYa*?w9MHwcu@s4h)-IG58sRm-Rw$(fo}()6t^@=7}mO)Kv4!ESt*k~BMsD(I@NEkQVUnmDGyqZg@zPs*jt` z+%Xkgu_%>&z(F-Vz!*LdDKv+nAaR@JxdX>?^uWedtbEE@CQ#gv${0mXh)XAU}u%S=+fiY&>;h(E!%xzCkXi7G-hibAboXOF=nvn$<} z5x-_LQ_~fc`LGjBH=sT%Zj^FjdX~f~J$@QdZ1($^iyZwHpvNl@XwW8awT-~=J3{&? z_)t7cTVF#>DP2HfDLm;B=E}!7X9qG)QomrYIR+V?lL2c_n$l$#AXSyS{9EGHTZJ-- zCSrcydvTlG4=e^=E8=^X9qs4o=9$X`|L|V%1mgjg22EYt8%aGKtPl;wN{w!(a8)ii z57eML$f|SdR={R{v~T%|ZH^;JO!cn$B38OZOr$sAqNQIkMm9tqj^7ApGV2{G2L@>U zRW5%v;nRGU;YGQu3?}9wM82DgQ6nB@tFj(YUdrng8ZEnWpzd6aOXyPvPWsa6s<}XS zAmW~%aot&X+Vv+XrnS|eZl|PoKiFwVxotOxVPv6X=I*aREX_Fw@<~I)z-eeCuxU)o zKtP5?aS9UsjyPUj74xr+*J;x;!b=sg7*^HxL*M(g8Q)d@BN_j})cT$oBWp0M$Y9eK z6c3XudA7#o2&x((4!MiVKlwDTUX}8&xfrw_;sx^(I{lRqK2Wo^-s{TYAcBtI8=PAJt4B@olHMo z6xXrT%nj0>8k622eCfB@v`{j|A70gZ-Q)4&Zr?{exq^>2NTRynHQNyaHB65$x$eMX zbwl<~^?3j*V?vLsvIfyPE+7R|7n}aE9xH$;FRv4PWQ)$+`z=HQ6rr)fSLrJ4x8f$B zhKSz%15cLGHN@T}L#G+D)3k6O>KaTzU1i(cRwV2*oA`jJVrCl@P6QNKF#34r22|bO z?6&gCGwEy*>%Ni($`IAG-Y-8&25SKg7@8KU5{6Uv9u`;gVs%O{ut&Gy_oJ$+XHT(< zp9M3R4WCIx2#@@sVik(ur8mx4v|odA>rqxYP-t^iZJAi3iny=P zk+y9IPe=&1#`7kt*_4T`tNK%wuSxvYQY~voz7B7rI{flU{IQd-zq5D}J_NFOAwkUS z)u($3<#HIvqZj#zbe!l&6b)!wDHX=MikouOhmCN?PVS%BY+@l=i1nwVGD)Hr|6$7U zYeyjq_OJya+hs*SMwNQPsd85;O`@sG9b!mls~`+}Yms%fLvi*7v&~O=tNiFlk^&Om zB*=g0Buz+4{t^rG%=uTQ?f0DMc^Pj+dX)xD1*{8$-?w>ra{0!p^PrrhFuBtLBAfWd z!IZ@uqYjK%UbPnr-Tv6px|d3b`4Z%P!}Tr45}$L55*i|KQ(Y*L;$L>eU+tn+ z2HV7S+1xNyes{tMs|EHX$*4$)p;s@3B3eFuWhD~v)DzumD(lyJ{5JC0r^Qjtw1$y- zp_qdZ<_i;n{#{`$WgvY+nksw%IWk zEtwX+jXDOIRHle9_(qsFs4)6|&QB@ZB5YSehNo1R!rW`GIl4C(-f0O4)A7jrjHO| z6!72Q`Z#Q!VrYYT1Am6X?E!bphQ2q`vuX`XK!z9bBAt-dy2lzX#E8~S_EQL=MUFUp zn*eTf!@E9zoIrK<_m9@LG3jM{tEEb~W1RufgncFmLhjX_;i|2`Wi`663XzP|0{U|- zcN5yH5JR>y;k_6$7MN=Rz0kyR#0}Oznz?`5AA?WUn~DIG;X z3ajB4OInz?J!){?4@nn;(16@PXlpe;N^vS3YG~s@(Sxw*js8F}HDYS^B)!DUk5vX= zc5rvJz7?n%*WCGcYoZzPES5e$b5IpiPkZ>F8po^M!-j@^hi|<)+ET!nqb)(~(gD9u zYXoR7%TLB$&Md-SCe^o@r;68Kn(zR~2I2w+mN6h+sRCT7grIBI?7$JLc_BKOGu2}k z_@Ws(lwZ>eT}+%@3lLql+igQwP@ND7{fQrtkq8$G9BjEz?cMe)j~)f$Ia*nlH4Rs& zt(LF^w7#e&qXu<%U{p5tbvyD`gfn#bwA+4#0unz(*0>sKE+qf-q`I6fVpBv!G%AdA znsV)>PD3qYXVGfYqZRany?3bVS7#b@#nH#~v%nscS+y0cg#a(nf653J^hVa!8VgQI z2m){M*4Nf*1i)2yDr}nxM_5H@D7wk{up_m0^wUXNT4!F-zftnm2F<|Fc&)?LtOX=MhmtjmZxBmfjh1wmogE@*loV~Ay(f*1}aOs-a@ zc$D3W(O$HCTWkk*tZ)zfvN(c}v7FCDl!!~G3gWsj?GPF5^Fo=H*?3W1vT(Tsx|?Yx`ellKqy2mV0bt zWFd*owxA%^_1zkg7iBL6+Jq1*AYs`pC#jTz$fzc((Rq8~qnMYe@C|l!&7e)>3^V>> zG&fR;W^u(YIX)ukZCH)h8|dMEPTb)!dXuk-Dv!+{t{xf8ZGJmrRXFWn$vsoYJR`^r ze2Or;u!B6lmqFS*2CLOl{wN9Tcz2+k^LD?u5d(i0_Du=pptvEru+WHpE($NsKra?CSDk3R7##9ySf@MRfA#Q|r_P6(~P; zMoIEsm=C^^4?XX&!j3*eDede|&_p3h!ow|#nJgY`|MuzSaT`7u*ZKR6lpCb4`9taF z_8QLu;>NR6(k6UwI|c}j^1y~H!8G%6i3sDap?tDm@x4LSUybwvW;@?PRs49QjH)>t ziGdB_O?Eu38PCF#(VY<7Y=lhKCS)BX1z$xnl$H`>fb#=>y=|YHnmqe%g~uf%j@VS| zORs)hX$Fm~i7E_1D+H!}$7}-U`d(SZB!t!WCxo?s&Ue(xV2kh*yvc(+?~Y}Qb)NYI zGqwa-z!+$v#=c=1n`H>G;I55ciut0(oFdgHzA;||tUnP6)y<#P*I~|P?|H(tLyXB; zPqvM#x$+jSz)l|upVqN`2;4idq!s5v=shrOo`3lmcnQ-yUmSI4LA}vY?VLm8x=V2( zb&^QwOZirBT*(BoRbar^Ag6Xv4G$psOcx>YepVpeeEX%^NBiBGdu&kGJeO@}s-o6q zOB=A!E`3^&)vrD;YWe+3d@FJ;`yc#zd6tY5LbS=4&8k3a0ldr^a`PY_H+$q{O5Oee z$TAi_);g>lF<)#lGF8bH&jpq2%u6Qv8BeRR#IF2bv{5dKIawr8kkn%xN0?u_0^L!! z7ois^Z#0LmQlWq#=ioOIA!wGbw&Dkjk^-e~x^P6gS5LL!3^Ob4I5r`)W*Xc!T*>SN z@N*tft=kqHfe7Go%W}Su0xuXYYBJyPoPBpWnYBvGs!N5Yfmx{f&|3x1tnBLCvnP1_ zB^w~3R0U)K*QHlbo>5j=5$QzmQ-3G(Q^yhv{UU+^*-*8aj(4t`d}4|3#mhguvg+A(q#$L@ z$UQiL1ws}}q@&KCD1pe^m+pWr7{nzCg=7`5dY8$RJ~d#-D`sO~u~0!5j>r~ryZk^K zqxnpxa0;)BzC)6#@I4X#B60EbL$hTma$xFtCswR%>rbJ#@0e2|J@;x922}YGdli}?^Gx8efK3*ITXiY19PopfHWgdg0C`~I zj*1!GcORjWU$U+x?bx8=OG7h!4u=&n9kvL^3Gp$T_k7RlJW{4kU+g6-zQ(-dkuvsl z8{SVN-3j1j&3>}XwJP?y>)|WgkM!u32spME0_S|oy3!UgAXvyF2U{Ai(OCh0E4^>b zt0j$&?DJ-~6k52Sf9(SV$Lk-mP-MI#yWbQHo(n#)#0R_hFHfmGmJz~J(Lo5P?(4YF z%9vI@XN<+0Q&(|4u7s@=5&Eu+ z%8ZNK&s{B55y<9!Xt>!7{QNPfk2~*yAE6&q%mBoCq1|ELm~wL)WC>Wc1yKnmp+P%g zLL%gr7cwOJDq$wI1L{V#bi_w4c*iSzb1SMJy4#=Rw6T|FY**+y-Pv0Oglx1Bd$eg6vctt)%y*JFa< zQR-YwV$m-jK+mV#RN#d59d1r-j|#gF4~P8^%c_veXbgM>mvo5>dlsaqh1D1TAw;Z+ z8WR?%?eF_K!_EJKwd9jX5T%=J>Qa^xS6=wHWX|}pArzMi8r*53l#OPS+#%y@IpPGT zssc>Hn$9bpKu>_Y6!SRBn-bM1n&iNCeZB<=wSeX+!A1 zCrft9BY%a9YJ9<=OW9MJ9Q;E(mf#KH1hYc-4T+{0eV-jH!8wR`yozNa4~y&v#ltJt z$em8*(_tev+rG@-{Eq4&DCZR#mux-)R&zo%r12tPnImd2-?!P38Np2Dp-;rQOuc-P zYbY`c7>5vh7d&v54Ys9U{;=({9(zI}kxx#6%=S}rH)|&Ps^6impP(i>G?4bm*&6M3 z<7=-!vAr~;e-|i7q3k}PEgb(CuG-@b1ywhahD~Cwa>#|lc$+87WBKGqy+LAd$C}Rm zwNPoGT}xcML`yQ_UxtT)9T_mHiw}0m>ErICVmy12lbC?j!7bm*b@#KmqtOJ#M`vF6 zEs)A+XO5{<@kAN{);??)6xQ-bFlB~n0pua;M1kF%;TSHwRkA@NUv=x5nr1I$WhUIc z5Z_I_(d^UB+w`EjKQPo08$-h@TyQ`yL(G-w*op#<3r-cXx zAt+b$JE26Zp9e*USCKhNp}vpQ5R7pppKD9j2~LaEM+ed-rlgC#eI{=-@lyJzJ1Y5a zk+Y+^>2UJK!e(0$YR%|(7e(VI=FY-_aJ9ePmeu`V+8Wof2u#+Kfce*8FKt+K!CoZ5 zPjdmP0z@bQo>U0THB;iPdjn|IPlO}fI2K<)hV9Q;kKBd4jT&2d+5sym1Jw86si=Q@ zy9-=#PJU`%j5&rM9LWul?29&1kpqQZ>uEi$^%BZ*=ZSaUt9f1+X&>{|tH4MBT~UL? zV)zZAzrkFJ z{bv^yNZhJ+JLhi8rN=!WoAXfhrYWgEzTk@#cLvCgnB~RC7>udGi29dAuSY^I6nls2 ztjz!|PG0*_fw8WGeNBreXbZqL(g6k9IitfnWws6@e5L^o{5r+XHsX61_C?u12~p>z zOevE=k^p*8l3KcWvuvvel*-nW+-j9@SsSXBlaMd_ zl*O>~CtORLQ*AP9VNyFz<#daif{Sx&xV@bVD^+!6^wSucZHDmQ0w;3JL@dn| zwIIP~{>7p}i3Tcn#VOW|P;pxQp~kkaom?=Gnq@zS*9;X=ao2)hP1Ap`_j$=#!GA4m z`&iYaO)M(k&3@1uS*&fdIRUlSA>DE)!j4)nNt9o{+-3d+=xvL_FgOnLuKIx^Z1>^* zwqALW8NZ&dMQ;jMR{5nr%|xlLoA;Fm7H8BNHEEhJKUvzkWAsH-3GADN47#<$TVLIg>#dgATr;TSl46rsl|syJjFu`Mpey8TtLwOS1%M2$e_}} z`u&yR0C(i8g27?J-*2M{j}%$F{)G z3axno_?v9>H<{$$q=F*CLZGon1KkLE4ThklCcT-LBMk(6RbF>}# zt4KikmfYaFU;&k)3|og-BOJ zqkneD+V3wQk4J{EWGm?-B#mMYY{ReBya)LJ2;W!Cc;z(NYxC%h@NT9Bi8lwe_bV!a zf7Whc;r(st-Diu zPsUnK^*8>B6}{XE_2`Ygdu{E#Pi*UI3y#@;YH#CO+Cgmn8(zy1OYe9^Ee@l)0R^-# zO9&6Wdh(jCXW~NV)Y%)2{&8WJ_X^2JYx#kZnHMlj03n)(whpu8-TK=%7A?R!v;h2H zrOBEMrI%+O-#AzghL+m()Soy#MTv_~oPnT3r%yJnkx$)kgn#sU41@YTX0hxA( zBwaordXS4zlNAd}mJx+uTRGhnW4#p{3&qNX&k<&&w}R_dR_TsiL5r zgaNChn0Q7_lD13cA}yLR(^lUZhVCVxmRv8SjGQO zt_q+>2i`LC`j-%!h0!Tf{O{ZbDhHr^1~FV%n`w4?H$Lt1A4nmIwy*s-|5&y{#=rLK zJ>O6B`)C|8Dma5bvY{P`{v0A+Ny?4$R50>RYxGKKWz#N0HG--VB--@&VDsZOYzDdQ z(W6PNM)z;pO26T71`_H~{_LLc4*9#HX0m|j8+2&N3Yn^6)KW#dt>HmsrG3TMB0XT0 zS{3$iwgWIkc75FYNq&~vUo)jX8RLT9tl_mzqOw|$@)b1e zMW|;BSsY`;&{?*wb`ueLp@ z0qZ3{hI|BV)zF63(nC{6eSiU*Yq|R%A^ER;IioJl4-;^}X8QOs!VsI=4bj*(+TiDJ z#hcd1scj=s2k(O>#)GOSDC?04YTW3&7sT!UpZ^6=uVdq_v**f_8L=|k#bJT27*4LI zH708!x8o@COY0d4(`pvS0gJ)kJ14FlcX&DUO7odQ0FI+VoqzWmtpm?t8Ny6X{o~Ji z?|Ff^?-f@bl7csg#E?yD#E|$_F+kI3gD@S2raR#E%)P6+h1F8KZw(5s0^f7Y2d^a~ z2Q%OBrvmgQDi_!5*{5R}QLCTNDwe#j3j(o5-@VrpM)jT;f~dThDm*?{VkJ}1{HE>P zc-4B57hs$hhTZubW$f8rtm5sqN*VAbKr`PhTq5D8?lLDK4lM$w^&MN(&z7vN%qr98 z3my|&sYg6gYGd(HXgT+hm_mEqMAD>R&WDZrDnJ>~*=r4mBjv$)xpD6X&v%)wvG#0~ zj535D=N>Dl2Z8=dwVwOJr3$0|)8flIu6oNuAkN2-`UN&(S$^Xosf+P@iiiF>^BV`$ z<787ObX$BP3nA_s{3u7kKPsiGA-YPp7WfTY_k|SeNnesC`|rsg;+`q&PYAZTA1;!o z+lNd=Bvy{&4*FLGuB!~;wYEM@t88IG7|XC5|J^WrXaJ@15e_T-?c7b6kROG@lzQ2& z-ex&8)#by+njiX`D5_B2GBzuugWH?{o<}s?BQ5WYv})OoPz&%}GAFjYkrvO-`+=SAt%V+Qjh2b5oeTRj1_ZHU23g30j@;)^aA%{)9|pa)yN;NeVG#WB^k*h-Rv*6Wcrp{P5sp~Z z&iLWj)OjN}im7fD@{P1bom=T+=UyGo(+%`qMt*%`+2*~rzRY%ofkLZP7A{84nisuZ z9VE@p?QC(GzYfJ)&vS>(@e>W4=%i(pgy!8Q;g|pDj*0nWT7s=lB%^TD=J>lstMCc1 zoz14A>AT%kw*&H1=#%>$5nZPf6WX~0Rb)u}c*opBW}~+2pWiS;R5>$Uv}%R{nx$W%{{|^I5bqkm^`KXx}6+;FF5CsKFpapQNS*9^Scy$(uZ4tr(Pi;ZT>;2 z_w>@p+TyanW649w-#>S*6&u=95%&DDsd?jbJ_N|*K<&NJZYI1RtvIiocFI*Xt-O@g zfsOz!Sn1vr9sEtzCeDIV8N^5yLeVE*k0OqPK@wZ}aYlhrl&Ey655es+aq#se_`HwD<)q0475$b#0s+q<$o0BzHy^6rhoWV~d z*`1Bgo;uJdFdY0}^@;O-&J5fi@G=*N8{2A^95vU9Zmc=alw`PPros@It5H=yb@gFUK7k*Pg(`@?;5I zN5{V+^oV}=CDbA>fIMVB*@3F1re1l}W>$LNSqh@^m|@rgS}Im@=y6f^N^e? zb*?Yxp3A3c$DQ<1;TB?|jVjy3$wG_mj!nFh1F^VsMt&cdwU<@T?Ra?43c{H*U$bEv z2+LoFAlxh~n)!bLx?*20hbR;Tu&$&tHiU<5OJWCIdeb3NMJuRO6M$HgoYIP zpuw|xqe0rV5$UhPxqw)M2O?e{k*aF37cE3VqQ>>nyWf6jaO%V}YNXgJkbiA88U>sl zG*~?S`ifIiE6!pZudao#&_)+^Deo$tq5F!nW-X5C=-AEz8W$~3K9tXf0>%A|`kSEn zAsuUQU$J`iMtSPRUW~d_ZN=yt1e^+o@-p!#Gv%~uwaCh4;u$tdyyFf<{IGZqI8bb` zv*&*z(eHgjoMcj*d9y@%lt4K36KC~mv6RD52r4jeJ_iE_TA$X(UGo*=_gHWGgsrzid z|DM>7JOo!;xU`HNAx`C1BbcnBLX;V-7sT1cjF!Dg*K4_eHP&ajxwLkh$oFxk(@G$z@1?jCsdeyj3 zCcS--UR0cAOK`3$p4A@WY}zcIUU+8VzT_-GJ!|W69Os7M`2}}p8S)0Rlp9qVFW*Rj z1W2H@324XJmC^dy4f;6&S)@uu0&TpuxsWwh9oj(11LLL%_dRa&X=g#@uuch4;igK88&tNrK{4r9m7T)|i`ApMIB*Yj zKG(j2_6Z>9RM{vkg+e$I1I0d5e`n?d)t(Jyf} zZ8Fwds~_qH8LIsR&oJ~WDk>p+AS?8~=qr$iw1!!ANu9U{llN+pkOV(Fcs;YVAML#Pg_( zLVC`}vyFVTMvQ>$>W;KAIKFhb>4!-`>koFt=${OSQ6Lx)TV>kHwWvS(Z(|OCob%xR zq7N6X!+nZ~H3I2w*a-QI{@lQUVr%;F&@uOaHRS2m%9OkZ7pV)Q4~Kq840Y0U5a0A? z@LW2d;yLL7X5%2AQ8o{}*6jBtgCCwN)YpOxc2=)IdU$4v(0}NgP7nPWs~74~P=x2F z0ygKyPdi4M+^bNq!UW)s&4)VD<^H&W~{>vr-Jl$q&h41ae;eYuaCtB=r z!kNCHtJMt~>Leyjax_G~agh@)u$(a3%kap7PIA@C)bV2ual*Yyoy3x5PGadYC;rOI z=D7Y#y!nPxH)^O8x%^Vcu8*dUClZd0Ptosu-HG1tTgTqK#Yued0V3mgRkag7dc2cZ z_?cr@RymO|`#H6KpA-H0j~zRSYyN(>6Yi4dME`KTW7kDe>1kTm{lba<=>{iRSz(UZ zNJ}$`{`ALAZ9%}P|I>|5a!Y0ET+(*p6DK-#V@Eq-5A=o;j&c&SKTe(7TIJYl)|$_; z#~yL&`gC`~`KWIRxCOxDz!4}{DxJt72Z4njJd2#@FRwP&B;I=62^aaCy1u=f*xh$I z$(mYoT>m9z&vxp*a;y`ET#bC`U?(wi#xs( z^PKq9_nq*lVNU&}m!z0YeA`JbSYYDY@wgNH^NlD=&WpQXwjf8`}7+@l=#16-@Co%n?39eeefRNB?GPW?}RgnRFG z60>HQd#5K%`S5Ji|KAl(a^oi4vxSCDa_KTBa^~qy?6zASyEbgn(0|E|Tb%mKE^)#^ zk5jk*2q!UZ`nI%^Yu1=N5}(db#n<}dQ~ckLJCTddcM>yZm}ernZoN4lIp-`V{_N9^ z9g92lKfV(8(Q@jJIK;8RJGo?uVGu3~Inf_|-;~W-*?|+@xlTSKMeZ4tk$MMW1 zlTPH=@lO1?XB;P%aO!{b1M^(e9f|a6k=~+3PF?o`r~aC&@eIeD1UTBbKJoD^Cp=~} z?&*o<-nx}Zu3BZv94^MQQ3TEz{@xrsWAh3<&XIUN*jAFk?w)~A-(k+s-#zb)d1|Ax z|GySHW1rsQ47l=M$6wlm&rdta*xlW;ot-a4pZ&=^%h5KVHpBKJjB&Ma|K5(hX_IMs z>P|hu$f$53r~bO1J9ab%*)!G1=j7^DPTjd@I*Cu_K%UHT>JC20sYTgi_uOI15LG#W z^kVS(;WI*KTW6bs8qM#G|``^s< zv47m@gi8yZxUussH9B zPU7>=ocN@7oZ8Z2)afUV9S%FO2@{;e;w2`YT~!15e3R)r)eY(E#GiW7$SyspvP9)r zY{CoZZ$Ul>)BO$9J^nY88+pZFe$lD*p#OIJUvNL7PVCv|9D7wtJ}1|$b0YuuT_-$r zkQ0CZJ(HjNFLvjhPVA05oFw`*i5WAI7UU|pYd=6`p&hPsqdG=zqi>yA7W{gYYS z&Luwj(DW}7pUz7iOFuu+fBeI#JLSuc-k12S*-moZ26Mjt;)|Tv!w;e_fxg2}e&j&y zb|UAT?j*q>@#;%XUH@K?jX~3oOK#k}EuZLJccTCJD!|6fG40pbm0O+2mydShk3WL+ zYMlD3uS}(P-WewS#0$?kbwkkKx(m->#a77YIi{Y8_oq1Fp5=IsFGQbU@wPk?ix)eQ z^UhB9gEH$6>u=J*Ya!%wH$3k<`yKOmi`ba4bg*OCYYFIxAx3n(g9eK4m}4dR@yBKa zN8KH~7k>>4zAVS2a*XC6=m?=bW2V>`ky8tz!0;?o;$L$h-jbidRR)aIKCKN;&4@?J8*VfZ)IL z9tpnkBHTfr72oAoqz>wcA4c4~-};vLfAB-GP{zdb6U2t4$vb9@1b%mu8EN(X@F(Iu z@E}RNJyD|9{nA*mjFoZrOf#~l);xROTybX1z$mH@qntgBHPC`p%gld()zN$0v0`C_ z(#FWAg;7EO)xW^#B3w+)JYW29J93sSli01dVuTmgRJerNYE`SmNS=-+HyJQet0REO z!*}KxkP=|H1eU}i%yaqWZ;W-(`RJq6=p7h4D^_9x{0xjFTjJ@~RlI6hM6lHYTvCM5 zzp-L}I!|J^-zv$;lM$zj_<#Bfae{vFe&-5UN)JZ;rc3naKR2U<#`>(!O$?){YKdO> znb>na!Tp455AMGgBe7Z*D6YoBXPyy1DpRP|Tx6_lP*1A_uDBRY^&tJgEq@bFagik7 zdry)xreVYpqv05_wqdc>;H<|8@RTVSq1=*k6Y|62h&05uQt7G1Qr(AO(Nv4LrDfl5 zv>7$kvUyPFz;(Yd_cs2}gA#xIG1Rl01a7`9HM*(KA_EDK0131k0klCXLyR>G7BEigtI+ zO7Wd_4&=f$#;O#*K^>9MFZ=sW-(=ROahx})rY2;RN-aJ?e z3&sDP{}Z+3d5%6FZowCd{mI7?fAB$g+SDRGwBkN(M6NuvI-8*hL`5b17&b#xIdm1^xwB*6r-8uDFbqUke? z9fN!zYv;ndCj##wzgYY~y4oB|zWy3m&WBZUH2O0O z1xAC^HFyT?sdyIg?5Q`Dk-=_yY5_)nK=})vQPI50P%l_EZ7k-Ogw@&_HA?({y&H8K zEU`QPD)C1j7B4J`f!psC>D>)=u~Yf*f4dUcX_vHJOU2B0Pe5D!rb6R>uXcpB@r4^> z^rk;Z@^5#E|MpwZa9v?sB5W*b62J9k2|oN78l!h4_Wdj1lCVX*Cwv(ShR<}^qhGrq zp^FNu5ame?(~;~szABw#OHD)DQ7F3C4uMjCJ_ z#p-EJ4EL)ZuC1qGE(`>YK#{bHAwbi-FzjqP1c?Xl5vw{P_FJ#vejH*N{n*u4N%FNf z#QWvrzzgPE}nhV9*!W>o4kAEVG#~zl%@2>|#l+%6I-1H1d zJ}ll-(JsRsFaF0{B+(Db*sp&r33S%umtTg?Gn&uS&~75wXfvZ1oePCyJ_cwpK!!z1 zoO-z4yKScX4#mMt(NNI|xhNagOYG|Vpmc7ABIHP{TMr5TLhyNkr=Fpa*Am^_M&6Nd-O3-xS)XQ zbO{WInt=P6eB(7t`}r6H!;sHV{;V;O7^6AN

RM_Q;Qkyo4*3;J{N8);jQkY+0w|C@`-nYffq0#u z2PoROf2suPy@i6F$`GH;M}5~<>bMTN$A9@V^ea9VKV-WO5UX2s@_*03g}H|~=VMT$ zdpGfp*iVwH-bT7w_*9bo-#!F(@x-@JftYKC1dL!w{d#oHf%ze#{nI&a=B3G)IO+7z zNZ7Bv0^t$Ch}e?UL0#-c^&uT4GXd$j3YC7xXj}5VcVSIJBUFL;a{6O;gQnf!$8QuP z`0^+I{TLdVLJ9owW(iH5Dc-Mr!!*DGYnBN*Us6Xmk);Q795wj9a;k*hdRzQI`MIdI zQs>rLSS-haZ@aS&BUS3hABmxX`ozRnC8NoZJ{p^F3fhJN zUv3EOP|U`e`HGJE-s4v6wlT!K09CM6 zSgDZHIh$_Uk`JbCd7uQEfcP48USRUAi4Y`FlfU=WGqIZ5s}h>|i3D!=BNR+<(Hh}7 zN<983gwi5odCPnIT?sw|E0Y~WJCZ4`&Fwcn! z2*lOk!D2dHQujTn^EK+?V#Uy*`E+qgY2Ehx;rW7PFm+k_S_25jji65@m-?SNpPcit z*psFrJzR!45BgkN!-h-nUyoq%f(MZvEZ-Ov7CT*+hDq=<36KB@v>E}lQ}{DMA^Fzc-h1^B>C<;#$p+~_W>+QGfg~aoQ*aa@gV<9aFvGq0<_cJ%^}}; z7f9Y)?_rS{cpTMWK3-)Flm;j(uoxxP5(aM%se+QCUN)Mq+t#O2-2NZRjk5s?9ITho z(@%q9dmfbDS5oIucB^+UaAn)M_d!k_wCuc$8^w8=0o;WpdYXf3&kj3pwq1|61?#*rc9cSgMsSgi!Y!*v{<|+o+x>fr($sXQLzRMOx<^VMznvm ztv`qFVBoBWbrOTO7Ob)ojpLZ!a1H4Pbem!a*^bqBt)en>)?P3V+yMrCKWE;8)Ll*Y zDU`E$)U+>guvm(^3uw@VWvmiR5{_<3EjWXb8O#@eD+!c3^DEX! zc;&(6Prsv6p9<+8w4T#|709emLHhUZp2Nuy;_Fvec;JxL8?KdbWwiPaFqdjW=WMBz z_)RxJiTP0c-~6_Ck3ClWSN<5v$-8JdQ|YNIs-+!uGzLal)nwt)64zC|)Ox24Aq0+v z3HF+)j$|1(PP7?jRaVW-2qFE@ba39C2*Cnn4CV9;AG|G+j-&||12FC&J+*;C6in*Z zRY)BjVMV&hH{X=#+DnZ4tN&Zy72gRbigU%462Ja8COtEG8wypL&bG9-eZUEIV=)ux z?X+NbPo_sG9SA&~n4LtulTb*V*=RJ2Gi(%9xkiV=3<|jE>bu^@b=q~7F=L|2=^7e1f#jmj9F5D!B@qHRqcG2eZyEJoge;K;7Pba+WWb`2F`nVPBf+e8k~`^XY74 zu58lf-!U0}BLNa1ftC}{ro0}CRBa79!f^2)H(nBNPDXQs?Tbe3kG2jApsc}pb)Pqb zZD@+|s#s{-sV;n2L`CY*X>TY4wP|-17#ue)rsd_3ZRKW>H&YQ^ zU3C2xiCy&r@t%AtwxocE1+0OA8*i5SXP<+hOtpn7o6SyCD23ZjC*OJ#1BZ{Klt`rG zV3lmo_`^-IW+9a_7i-`?M!C}d4Cc*a>cl*Wo_mH_sondv%fyFiDys0Q)lZq2#o@G{vn@1H z79AK@Ie~tVrE)-7s!T2KX0Fl&`P3~{-8&O^-+_T$D8YdgpKZzRtd6d7ruTDOK>EsM zCu}TLP(yg3`koU`mcVbW$MaJ!u|M4?4%{gh}Svi zN^;6%v2|Z)^v^7n%~0}EwRX#lZ)&McKebW&td;Wa5`JE#EuYbq5gQ{ZX z!(KbO3Z?z-yBL*RiywCShpaz7(?FrJ`dNc2iWto?tAD~}!>g-*UH$*;eFuP4)!Ftt zJKK9>J8Y*cy-E|XAYwr@8co!gSQ68tF{XTe(P*NHpD`w;M`Q2)D5$82fE4L{>7CtW z3)_2{@;}d+z00ufBFpZ~4m0P#?9AM`_muaZ`#$Hb=O<$M$5Rf#;`w9(EW89+&jhY8 z0^us)NB4;Bl6(k)cd4J%DI-UV8Cy!&z_6@v|L~hO&Cv!KU<0@x+VF$>fd5Z^i1>#$ z)p_Pg7a#)`00u$>HIpiPXbUWdJ2r`mQ=B+S{O^KG=Y`X;b;s9KTg>*=F_wT>=2I3h&%9uYm0TmdH~X43HZr<7-xmj)R|{p zEM{gBBcL#|7X(bY-Vj_Z&}K?4+(OAO>Gr`sk*;Kv94~+1{|@?raUw>O=h+L2pfTKp zdk7691Q}Cy8Z?=OXs7+YkTDwf$apsZ$8a%W<;Hk%x+=V%{9Uz=BhK&aA4^;;m@m)~ znmXIM^bt6lJdf;*uX-rc;DO^eY80$scR@jn zc(u!}P^a0E(b8|uWr)qrg%uI_yapi?tdG2tutQ}siXS{K{D1mWSOd31(YqG-co76z zxJkBPK@TgTUmoJffPJ$Jr5!W}XLr&%*I^E*u-j#r{Ij#WyHsaUQXV z1@UUkCQeJLWMzy0y+0RgdJe2<*C`ygZ`q7EL*Vm|e*{ZfomdusASU#mapg+V1UB25 zwKW6ouW+HX+n}j5+*dp3iS{{O_RoL-Vmpr!gK~$ct}xWWwtWjcnTl2aR5sPhvQzhm zXQ_LJ>kNGFz~}a{tMTG9>!$FF5t|gP+xwvE;BgdnEhvIM8A@={mIA6j+=%5n=uHZ7cHY-OfAs&IeR`XoJ3{O`USAvp`sxAw6qLC#S>CXTYea=!V`or@S$ z#2iA%RQH2(5ExJFWZ^a~(%7urN(HW;Ex>(dp=U8)Hpj6BU9?ab!oo55L-AnZJpIa7 z)j8@9>2MltR7=P^uwMLIz6}L&6y^lh1&0gOTEmo_EJ((5I;~IDra!rv0`0Te&8_O@ zdPe~Y641g}UU^Yz?f9?;{ODd)ryUkD>*h_;`shPgY}dh31g#@AZ#4T`AmETsKs%)b zLuzqQm3{vKW%V;podz&N3>Vxw2q;X0tpqzVQwjj6$MWW@67W3)iqF0b!o^Gg1ro79 z1I2btNIxBL_xDBa|0Ue~5Z?wsWbB|YAK`VDVle+zW_t1Ad4*2!4AJ z+C;zLR%k&&k+%01D0ff4EC?is$FR=^Ln;J#(5;evGZy& zJB%576Vl~|jJ)lU2LO!Kjy{pT95Yiw(~XfG0kgC>fT5zVcF>+_uld<;5a@-VaBf>+ z3JR6Bm!6llAKZyHa1Df3#jV+23Z)dRc|FEK8q)%*tY2`+VKM{d5=@OC3))pyW4h$< zJNl!Fs)K|K9;)?VY#9Hg&p~vU4Qx*AIb)yBym~Aijb$p*yPO zo&Se9bh!lH{|j}UW%2vy3tVUr!(ql28dO&B)x6|AxW_=5FnKEK%RN;e+=LY^I1fl0 zw9h%K3fD|XghcDCKVoeI9(hy(5aYrmH@2PmV*B_#+$Y>OJ`B2O3TO&w3iKrfC=ft# zW_j{);6$>Dt5eCu&<6Reb;UBo{XYiW047jy1Wub^Z8T!4JNOuR7A!Kh^=lMH`9Xm3 z`ycRA2xm5IEu^r8yq#=}O+o=`eINVOW@kfDi)1MXZ?HoVC~1ShTY=9|cKY9QKN6e$ zTJb)fZ+YfF;K_(L-?&a$bGY?W;3JPo%l{&#{Q2j^I&FpnD-miyJfR0r%Y*psPyZ)Y zY;bRar%=FccPKYdC0L|q0H49huzlh)X-0g;{h-BFVMsYJ1%>hOrq~!Iu+W;=_VBO8^7NA!BgWOP#8q1} zaXiFL)J1Gocuag|LBDA&rAsa(9-P3ounuGU5N26atSB%~;W}vn+_J4&fn+jJVngs| z7zmRKahnQt4(^j5gkr9->@}zdbBFPvwoMzchC>1wy5*)0gaZ3+tUk=b*hxFxO4&y$ zaye%B(%RsrYDbuf-%xB_oCc!Z6=jTh?uaJCX zF|=tAqyRNwln{atXJ9|L59i&GW8ri64YbKL}jZ$}wvhT_zZ_ zVSW2GX#wN%%NwrZ9Bc;w>ar3THnf?j_TYhnt3 zszUrRPSUXzz-xQ=J@LQe8xnBGci_f)skBAMsP>eA2s+z7Un#8&=st1)^*1Pn+Js-T*_JPZ_6}|%NP1(6jOOi9Oxg0sKLA(}dw}e$1P$9p0Kn=Mpfy0^AAb@1k)z5g zNA0qG{~obC{S+$2wWSb#K|j*n_UT8MU-zkfnHWE!GO+=Sm~~GH(KW@=_A|I1L%Z#V zMGF^1)M(qW52t;3g|z(-fN&J7*>E|sA3K8kjf4t6|5=Ug834fTqBgQy>KR zykn=d-F=5xFS-;-IFiA)aSQ^R;&uCgM{snJ!sB9j{C8lk5EhHTTZ6#Kv2eESIUx4c zp8~fbAg);6??QtWx}JhG3!kWOgDEaN2&NK-wO90Cl%O5Iv-X1mdxE z;X4?2so1uxRS8(EZ@q?dVNJq5xTbi7&6LBEwiXx+A;=VB20lLsOhTM_EPg}gREDPz z=ct%$`{VC{!CTe-g0`g)u3$}V`@^GH1J#14zztv{_ujJ|JLus5u!a%um@`2tO2mK8 zFO(q045rN98StYYLg0iI79K~|s5tbC0wTtRH4_DK?p^O&4@5`Xilx%>y>C0#X>fD4K_FH87E%DlORXz0-)vBzt1yxJTCskDb({%UzTge$ zt>Ma=m5uoZ0T_a*y&PF_zsvf@LWswBcJ5Rz!bs1-Z^Os?YA_x=Iz2C73 zc(GB4j7oC^Ws@op5R?mI`!$a9&{=AAn(*R(ya-Y%sJ<2NtT(j1E_@U)2ZV)*9c`$# zaJf2{ZE{dB;@Ei%1@f5#2*?ni{bIH>rRhW!6ikI1qBh|R+F^a{E)$HXdH@E3crl^U z$?+5ZqTqDZCyq}sJarVu@dIQ=RS3Lv=U_3$is~c`$BeO}YVOsp`p8pRA3?SeKY)gI z_78ngO<*%Dd~(#qzJewygpKD=VaT6JThbo=C0Hq%@pv72&jG}QNbovjS{s}z77B6O zkY#PkWEIO{dFxGSz2jyF^JE`*9sA9?NPqUN1(lFC#=Ye@jQeVgw*l9X=DdGcSO~O% zcH9q>(H{!bypCCA9sd~?g4YKkQ66S=Y!35c@CRHXX5hFsE0ZTc9&JL+KssX zhw(iR-#KM?O*vi$iMnq=|Kd#)z&?mF@Q%kNY}gdBHP(t5Ngpa#z9lDKdQjS`OTB5R z=hay7NJ=dJ#NmAqctRDP%^hG7Q8+dg4=}^ba7g{3BgY}|nB6$=Uo6~j!jFV696tNP zlMQ?$AIEp<_Bwbt55V(5VF+st#fuiIMjYdLWIV*kc794;$qp*)B>y8nW4&Scf#6FN%O2Q|+2K9fGqG-02KPdKdB7{(Y4yl-}#uYO}+*jM5cKkzpkBX+1b zN**TjWmm|MiJ`z8H8x`{K%ByVQzk5@?=MA$Rb*O+Fl5^WVHb*9x&XI9@M?SfG4u<7 z%lkuy--Ll0coL3d#yvCc2R(|2S?mMH%RX?eK>85V0x^E04g=HG$>R^q+jIV@;W%@N)|_LUd6-xr0? zI9=USt|{8@qoO~@!nweQg>>wyK8}?%cb?Dqs=C7Y!}TKj$+mHxT2~nNljog9;WF$b zn!gqEW|`G4+33zV)Mw?8QTWCoY(syKCzht@VS_c zhvZ^R^lW@d!ox}cI*iGBHv})PNB@l(ITl(G@+cNg(7)p${2^xNo4pYbSsCh5D^p_e>tj)z&GE70FR$Sk*{?pEt*A)Vt19kj%JBie z87u!U(89Q`o3VGQspBh{pZ7)Qx;*Cx1c+Di}z{MZbeZW|{ zqBn_r#_^+XU!Y5;{;E02dx{TdI@h?j>IOU2q59|4&e_)IRE7Geu4}(%1kujzbUweE z@5IfwAUuB?LgICJj(>*-I2Ka?kGLv)o^OMI{vsAA&tWk+8LtBTb_^%%05I(aJvZRp zkm<(oYi{! zMPT>$aL!A3xX(#IbSA@@@Xh(WGksQdfYF?ZpBmS9V4HEk>74?CVuf8`SZBU#Tz00m z`CFGbVqAQV@9d|cbabwQedMbve%@XGov-iwnb-JZdxyF6#C*$bV#>^f5Dt8X#nrm% zGqJw%0=%6LIE2H_*ShMv8VARSdxW>s3l5wSpYi+I+z+;)<^leEp^f$yjdRqAPQB=A zJ{ae6es))%Qx)nX+viw#ZCCfR^ZDI;=NkKYU^AcR?_wSPIM&og7uW=G_kIYF@4!Oy zc#uhELA!el)9V1*-h=n8!0D~PXG5OurWs#5tn@6tHt0SXFAU;x4FG3b`vkiZlk$hq zG*)4TX*FRW651|Nl9l(PXIqxv&3 zpflCe-EU`8pYg;SedyIYXw_X`$P5*;>Z*Y=UDwt5?Z?27Z128}{S?>1eKQgK8!jV^ zS1dgNmkPMRP$TQkqQ>6ceEG8RpG8O2oIHy$b$1UsA3xjrI(N-@HageW`MfiHr-Bm^ zFOrYC2q1g$e7^vVXc+2*jaFTW+-%Ak!7mj!R&Fy%E{0Da3V@39Gd%zE0Z>%fr+~Z% z9G9tU^&d?EO@Y3pKs=tYSy0;U!?St}&)N-m4!;SdO$9y|;n-%23D2=(9b1g1UsTUC z`*7;P+<@~SNA^uQ6TY2o3q7ghO#H4Zq08t)ch{Y%?KAym)O#-P-Sv}w?6#lyt*3=` zA;YJ2;akc@Q;5$v#`r~hNdc@}Fmusz=+2_Xhkl)!j!v!Pcwekf3>tRXMtgI{IZmys zk6qn!dV*SQ{^%j=A5JO6$b--*w)sAp~adU_|`{|!$cqaZyHjM7ll;(2B>75H2S zGwV=4JB&I=RET5Gz>YM;xIyMI`n`7w5U@syb*2z7XftMhlcSRaASBK znu$X25n2fhBRUS1?NE|=y=|#t2E{?=BF;+P62Wza$bukZtR7))c^F4yBLCDrgz`EN{f;9ne(r88&c)pXs5+@+U4f;p#=#wJZSnc-&)p zO;L+^3o5$@3)Ka9_+JK3IIOPFe>4R&1^R*l^k};g&)D_A=L@j%dm9hz_wlU0jOT3& zuz4pIfpq&OKGXB95}%QtLw?u(JR5x=CgbrGK)o)$KmiIo5EvLMDafRXTkpVUVm1;5 z>EgK*poi`eVDe(%Gu~tk{%nRdQQbp)H*lI5%scs4;PZ>XXYMSPgL{4<_{4fBa4BRy z2yC8(d%h6oyb7LCg!6s5aQf?VmK2zTg&r4omjN{x%diSU;Rl#lENcNi8!&gy=4xe#Dxzp81ii~F+?;CL;c?1`l)CB}!VVaD2@N0M* z%muRj8>`UQP@#@f?23~5n5MwlQGg4-Dfn|Ao-0}fXbD(~hxB7$G9Sm~z~>eCjJGa} zq1@^GBNv~#_y`3wKA(3tn$I@zneUJZRXGzrQ-EY{0QhaGcu*R27GoVxWe|UB0Y2x! zay=fJrYoUnB0j&0-+i@c0kH>n{`=4*-2`{B4FI0MVHU2y#9^STF?~2Obv$TA_*F>6^CR$)Yw=>< zkYUi?{uca%9tXZww1D^}cRUfl=U`>WY@`2$S$Z!(=XEUdn1G_)c=#nX=$|zOGzByT z92!cxnbHMjH`JYP0gQeHiwE7@43N@v(iG4XIC~02;nZnx5u- z z9A={K??GevJQlZG0Z6)N3TO(PnF37s^a2ztm%?&*1D>M~fz8{X=|?JnJ}oA-4^JOH z{C(OxU74nUrT~2e`sxW)f+GHKz0d5X^b*WL<-dR|@D%tVGCIK=u;3Xt(s7fk_80nepC5tKuH z?a@aMgu{6LnQZbZFq}KUYhJPj^Qe2fBI8X|68DTxmBv4H4I%D;loJOj6u90-cfV&R*v*QCzm(VsO1 zIw-)zF@MEk?K-?Zghrp+$8aI%ib93(Qs6VIXObyhGzByTJd6U6Vm`$)>dHir%sKM+ z7MqL$6L>DfPm(>11g`3i77#m8mg};+;Ii_+(ByA{X7YZ-3UMP%SC%DEQ?9@Q5$i%- zGzByTJct5VgTi~jF7G4$*wvXve+mKdRlLT7|NIlofbmtjXbNZwoKAtqpt!vQ&&OuO z2;BjEJ_+f~Me?D_Y`7WE|Ke7g!e>{tbNUGNH%$RefiI%~pT#iX^C9qockyy1KGS>f zr)b~}@PWy&CjJXTBDcKr_M&4DJKbSUx`mi*1K_K&4ZyJ3#lj(*XA?gJ(7lU2)ADdf z@KF~{0ZoB^rT`KaE4R|8A+#~R$sOfqv?3zu#wD;MjyBtoQO$LWUw4d0x1lM}*A)0C zl&RrZ7;>L7#s|5&aNorLfhjQq*@lPX*`yn*8=7_Xuyp;J0_QaaxaVml7SBJ&g4u8} zcjbU6fZmHgx!?m+pv0ZhVv^;M5xlu*0nzF1GARv{MQ|Up2jIHm&Tq5vK{^}JCYBB*${^sB~+Z0==WakActJ7UmbtHnm@wD_zRE>M64q5}z-I z#^z$+b0QZFD12OX(G<`Wa4iLh&3x73Ia~{g@I!d|RlByyFVxOweJ}p(Lt=tUfX{jG z`g;MM47Fc4(>o4m0kQo)4#Ld49sp#;`%Y*E+$|hBPp1`Ve}y(1IFm$w))eq53Q#lo zWRRbX!-wtlHth4}Q^VJT)f7050(rpYD-nBGi^UlQwf@rD)0u!d1D5FL@wEG+zi0~h z5(SdLj~+vUf}xNZj)5O70#ES9(yjyZ#-W}4m`H?4D((kX184(Y?=SQ@`!4G`K((~=^r!&GzDBt zflA1OFM$_DKv4WT@EM-xURksS5x14G4f7FK!0nDGAl7*0t?t>N;s*?nnCKWWn}N!@ zXbQN40(k!HaNTHZXq3{@5@~JqZ8JIn=ngQY3&EQv!{vPyG?lt&3iuiY(!dukZ?_)4 z2e&frOXlk(Au&;+qoc*o59)32G+y}nE%wOq+cDW1>KmlExLB-KsxN)BFyvzqhW}0Q zqv=pyO@o1HnHO3SwSb5l&4dtxz-L$BW-s$`)g%SN3#LqwYp$6uLx$x^P!M$^8i9P1 z4Z3^OCJ2Z&DJ?0LrAt1R#UH#cRaI5)?u5s*M>qFZAS6xz0No4|;wl}8=rQ+3cf@@Z z$OSfs0D~67tWNh*UoI2~XUv=>*Iaw8Was2aKmc?k`q4LVhFG^Dr6U+N%`23aRQvcNFm>8AdFYYfN^)|tw6;NFhR202ngZ^mKz4Sv zOqeiHLPJ92h3B7hXVV_l7L#PH25;hitVpIRRMmK!&y&v!h}=tMJiI8Yz-W21eYpg} zT6pEvS4(DQmekkR!-c>qCKJr7x@ZcxkpdJ5!^6Yn`WtVQ<;y>nLkADKv31XCiYfi? zz~Xqjm+!aaSyb1(@e~R${9`CAh$rwI9QJWph**53K-|eKC|* zH$#;-6>$!_XbSie1t=W;0oZ&GG6p92`1B783zsZdZ(5q0eVQlw(){HfY0N+P@3|>A@yu-B!L2>U_p$+W!(SFmx~|b5B>ek8hm_t z5_rnkArvtl){Ob+>t!-X@N|fue8uPeJ$!v8_}=&jVlg@ziV;S_`)*1M$9*S14AA`0 z_Z|Wd9kChlu>JwQonM=fd z!L5`w3-=dlr5qMZ^h$(fVp)1pH0|Ki~S?*EA@>BN>XhJKX2hd3{Y; zU7x2@AR2iAz`djp&j38Re7ZEltHRz-uI9vGE`NCo*azcQ7+6Lg-I-52+H{4uWM z2WLFzjb&Zx8nndlmi{WIkCkKY=(S6_6c`903-oIRKA%s8_q(;#w=<{lj#XiLgyH$f z@v|#MmN!wv=LN(_aJ^vMd8|x;Eio)z9|2kii=_e&6N#5`gGG^>JNzX`^h=@oD z3k!1ycDsoqCzD+C@fs;Ds}c*qCMqIa#*WOD;X^WI&;DbwX5$Wt ziHwlx7mSj`gc#f}KiRT#zii&IU!uZ8<;vMpW&fc9*|cLX1R+{M?GhUkA=h3p6F?K7 zm~cx=n{3#&L$>VL2WD@TaU%!I)QKY`BnY{uFbBx2odJ&D30edP0u@1vK<5x*sp<4n z8D8s-2E@aW%(5+9-`C z+E<{3O8rnbftbHh=w-htF!LU=e?}p=HDlbHw(pgb71i>UD`!e*Tr@Pd5Kh%t?CM%n zt;VASarT=)&i2{?TJ5!kO4*LP3dh!rdHCadf7)w-jx@C(<6mQAqtw;asi67;`}fPb zwV%teV@I*j>3i_+OFD6J%mDaEjKhq3?Ag8T%aQB4e4PSO;8PS3E5MS@hk4H!{t+Wb z$~a_UW~R}osAyzk4w0bXAn@zn-A(d%)$Xe5iIWQBVt}oa$LC2_ zda7*Lx<_{GIw(=VvCA)-B*7Rb-C(!u+$Wp1?F9};%H)ia^M4REYG(6|kKGpwwvlUqQs9@2pA z8+d%`nEU1h$41=z$vr>owLr&PW5qqMt*uqtW|Wnd%HF+uWW)M(QgHlu2VL2wCl=;d z=ZZNL_bdP&4}fT|DL!pMB+G#7uwn$Btg|2knt9Pha>bQbNlxxy2ywAWGwEQQ4&g+- zb97}*+$@}&aAMoGHL-0^Y}@vUZQJ(5o_J#0$;3`3ntPu2z4!ap`FF2%y7%t>b#--B zbvd&I#VKc2GCTTpj8A_p5?iohqdgn_d24+EOqgUDt@rkfPHky8c zzgYwKYHLSuR87@l-ln|=X9;Zm#Zmy|@p-X1d+TAl*+#79{jazhRf1Z}9K|zS#=BO7 zM}G;B>#8~1p5{>a!fY()N*c#6zC-H}Z~x#yMlULI3-aArF2}-Hn-i4^A8yc}QCv?!hSc{=$Sz*uGO)WWcxjt6fwnnOuRrD) z6J;&TDYdnBQPyLYOk0E@BD+sp+mj4*ra8fgzDCDn7Ut#Da)P%V&DDy19@}Lupokq0 zVxDpq6DQ5=SiJm_TbuQ4MwgyKaWv?W@#!klVCQ4y1FT7?!*CfhaT>@mnzAJd^D{#6 zUstF2o&fX+6U2i7;R72Q$QfSX?7;arORmB(4Ms7_!ufg5(pF)jj31R@g=%Vuj$Dj_ z|4C=AP^*FJ?NMj=oLp@}G^`q&sln78D)tKze>n>^w`-wY=&kPV8pEo-GijJaEqohv=Uh|Upyb6&EhK)b^zU{T*YQfnJjuy#NCiKL;cwP+S2|T=+IEx3 zrOd8QZI5~-VoJNJRX?w-1J`WBgTx_ntwkQo4|XsMU{q&9ouyQ4Un5anF6?(xf3z@# z(^rLd-ogmV``sDeM~C1irQ+1o23Wu{Vw_aloU?GC<2YwF`w$9xh+03yW2V#8Q31u+ zyhE`9j3(8n;}XH0n|MyZpbvlAu($)@I73`56jY~k`s+5Ei)u%{@$Q+WzH@ZHoqG6>wHMBS?;_E=#VW}z#&Bit5Xu(tb}Z}^2_(V1Eq@Y zRoZQJX?;rtRpgYI@_4akOzKsVRz4CzNsHNB3XNrVSstp&WdN*@UOUll0!>gc<`Y|P z3n7U_Vb{sMwd{be`(Q=&)zJu#_j~BIV(&~gyY$sHKn$zc#mVRkiKNN9oSUMkAh<8>jPA=sboZN9bK2wSlY_4N} zKLBsWsMF)xZ4MJ5H*iZGq0Y{b(-Jmk5G5d#bb5^3{KM<=kK3_^))dT5KeJ>1-*9zJ z%|{Jae^ulc?Jit!?bylrA>)EXb**CBIcki(fV$nDPoyjs=LK43qFX5l&n?Eer-{N` z`oW=$%lzxFAM4fwL0Jn3=7-=kdR3KWEZF#j^{LsLp2W$l>6-ErXz><)jD4I zz==A;JaS@YLu9#Q=URrwU+bBqE`NaNsRN?{)lDWn5Na^v64>!-`GW3G>KHktwLP*} zfnAzNgp47W^9<;u(*^ zzd<>r>N!uC$&B%6)~-X(R{9;+>#Aswi#0D`BK0>}bzTAo6o5{$LtuX=HP}a@6?=P~ zI(5X9?{axaH0$0wH22>e_oZr#e=7tpyN99CDAAUDCtJl@-FIyaqX0^i@t;u1=hA2y zvKwMC`bq8hzUa68im{biZrMOKiF;z)b45HsJVfoSdTkAohBiJjItYl&S0^JQJBkqM zlw#`lV+u=@{slXZ0L#Cljialgt;aOm--I(H6NM0*n1U2kL~jkr89$#isgRs5p@UCe zs1FatgOMRx1DTu{tVZK^_d8+vROax0;C1Y$?WsH)4WrBtd~7jcURC8<98OLbIW7D2 z!7OVw0rOJjv(3Ku!mzD&D6a;7sJYJX84%hH(fLvQO&v`QiT z)?{LH>+bY=^MXxwug<@WRiA){;D)5{s%%77`g~V_5-tfhmvK`MV+gJJrtfMYa=5X! zMrO->oxDVG=?xU1m7Am^Ir}l!H~y_vp)fKoPTbG9X@O2L%)*0G&veCcJI+~hVqum` zHP8esM@c%slBS9q2}Z8RY@veD?rH=~(d zU+wT?vjH|=9GyMZ$>y~szkr)(Q+}aQz5>dbJdV zj9xu*JOy8f#LTu)6H0}xd>a6;D@5w5iwj4ao`G6Soo?;-C!}1yl!Ekj?qQsl0#14c zweQOD0M~Hj-|Ct23E1Ibr4)#XpAqn>su@MZtOK@Pg=k8&QS$=n222ef{YoS>&=W`B zhRx|PYSj%E$hash6IH|dzJXhx_6^Ib$nB>TQDc*}QXn$rH!!`5qaB(SUB-rjb?BGx zy_JS(Q_81ltq9XdtU+Ikk=MG9oNB^Ww0<4m2vmnPHm zBUTrPwcsA?NAi^dolmcaWo3Mti=njz6}>5YfqjHwM*J{DauEsniImC+>>Q;?hh$WX z3uDJWRGfiFW<&H7Xyj5(25c;T(hgmhK||iVMTg2W?Gtpcy%WljHSUOzN(Rz?@c_YH zrzZyMpxe)lkg{fom5rXkKQ5QzRd5kmaLBav5S2#)2qI~=nWl|P@xnZcLH)zs6QM*Y zM4rC}%n$Q0odS-Ij>i3k-htD(-bwsVN9fJ;Lj7az-RFQ&5~f>Kzh`Ukq^>$o29I?Z z;`-0Xm;2P@q$E=0f7dFQmTS-!3wc<{It*RBbDV&hEd%%6qTel5+Kd4GKn!>sLsT4l zPCY(Ld7=^qQ+v>*Urg(vs;TMs4+`BV#L9H&g}o&g6W=;4o9Eg>J)PF}5Q=Q6Ao>um zuo5anay;Kx>l0^J9MqanF`%p5OQ>9T2LZI=eo*=fRg|qdbg7)zLlY$!5Yz+yjb?Qw z>PV{WCtygVuR|S?EZVCUvzbAeqx<)7d{@Bf<-|Q+kX~amg~Lv}l45Ea{c5TOoF55_HK+Z8b|>ClZjZY~0sd7O=IO9u--@A+TzM(p# z%GWYcD!|YzeGMpBS}Bp8W5^DFr-WqcN^SpPmz}nzB^^taT#zOk*1^#&DXz==YJ>R4uI4&i8H=+wOPC~_g8YHY zt9Fy>^MXbihvnK>t+grTcT&autB_v>-y4%U5Q0Ol^DepHu?f&1XG?LD^OC6k`9BGy zod(^-D>z-5Ep$as(%p&a#seA{9@F49QBgv0(X)`Jtk@t`=u}`V5kt`2!%D^W+_|oGg;t*j zKPK+utk3JbK=JosF)*e7^UB&ga9@-YJ9qXfVRpS^w|`Wy4p=yh9(h#d@*v=JoawJ4 zOmV>*E;MF@d7sK=cE;j;KdU6;<3n{Yiu2{;Q^W;KCuOn#B{>yx(x*UE?2s&8BD(Ii zxphu~ZqIXP5*3K8_<0G6Q2Z(zembgoU`qbi^FahzF2KgdjPI-!Pr=|Oq);E3;*Nq+ z6+As5uK|!B%XEgXD(i8Y1PNi^E$CalTOXSmuglB1j{EMPE-c8alvuXZp2aqQG-Nt@ zSVSZICW17!X1jIdI*uv4#CwIz;PA+T?$1aBRQHSMw+)LrQH}5rBYdR zn}I^i=z57wv%f^z*USy65W&aD=)H*=`Z`U2Ll2(zlIl-MUb-g}S5CejC)PdQjzd3w z#0eLyZV!pP5Se8_7<^eN(b?6AM1O8turAc~=?D3OM|FY=CtSL+xMv=wHtO4Wh0%bFRPHX@idr(s@iN5qdGwEmZ95>J zUzNf$CBg(gz@m+qyG6}LYqYk&yMk>|+}*Pm$fhsk6rpfu<4+)NX-7KaAVXy~jU%)8 zh}ZW3XSgx?u-J;)e_XppcMNwguPWT8`g5gWTum1y7- zVbDz%7txO68w|^CZ(+B@)zk=d2~cZj5`Twa%Mpl*3+|>iymEMRZkn*M!&$(w2X7Mk z>F-yW>K7h72@A&qn?4XeVG+NH|NEVsOwb_8qzw~zO58PO5K-!Yfg$vIMRB83(%-%iem(CzL`oVnM%xdddBOn;Yix z*5AOKPC%0~W^|#djf0p-a2zKbP**J=tX$QWgW#4=FG8|572=Ek`OHw zh+pWFZrf|l&4*~wYq8Lfq>*X)F88eJouc&zB0(Xp^1<)=!%T*KJ=sKy2w9r`&2T&n zsOxw!Q1{ajF7^Ghe5>Dy9mVhu`2AT`C?|?=XurUGZ$QKljF=4%j%;~ZquG55>qoam zoZVK3NOX)638&Mp8KHUCfe`;4WGe@@Uy;Aotan#R<*)Bs8l!`lN1sY7bl6fl4K!!K z2;h(chl=KKv&0oSXN0_g*vX`5xaevO)D3gQY#>-`j&bB&PUV4UWszR@cf(&8XjW%v zc-VwRVI6eZo0&}v;G&ducBGM=rj4I(jNQj^z=CQo7@a4!1vKFlEbl+R6H>cr!9%vD zQ0OpHqzqvOF)cP{ASU(G{h8?-#CwcW#Yx7}N-{oT>Zl7j{l40MIjzzr8Nu0g;x>LQ z(_j6WavC<)EtP^kAj7}SiggAz0mrSK$%Ji}yEW>D#K(eRyhMXgjv0K_6vp>G(?&JH zi#L^rNaI7+_mR%2&W1i7t*#acT+@VMbWUUvpROOpk+DcM_25lAlWaSB6Ux0&*XI9P zD`|GWNEftDT-ks%!<_y-ku;%JF`3(`RmsSaxxe&7nSzn#i2XTZ?B7#Df5EeFfm?Y* z+U>WSoQj?Z#EV5vsJA455FE#Z7Wh)XD9QDt1A_bY8PVVQ*E{s1!3a`hJ0w&eh?Cm>E!rDG=eUdVQ5RT`=XPg47zc()eXJf>cvIVL_r*4$n!|f3r!dFhZ{l2W>*2YYd}gy;6#X*cIu1UFF0GYG^Cel(Mo{9%;PB@@fd( z3VhqA8Tm*+xgK(!lSsXblIIdTW@n6g1ejz-L9Bb&~NTjg|+n`2v^|7Jzd zYy29ml2qXyo8eFWzK=P0J>k4uzFeAlQ$;ht=41h zOvGFl(gsEZ*%xVkdK9k2i(+%ynK898x!@yqIhTu?deQ2MN+C>yoG^;6ai#P$I@p}x zcuG;}7wd`at+04hE~Kl1nG-;PCxeapkdbsOD5PvGNk66;VM3EWco{bl2pALt9@d4} z+)HpoZa})(9VV#-g07YkaS6H%)UG+Ul(RB+YLajkF>oBtI83lP{t-Nuc|{K&Heq(v z&PJpO#Rv;dwBRq;5h-G6;^$CjT#V>&viuYo=li`;u~h;aOKW%euu*P4atU*#I`B#h zQv{6EZ{o4TrB3T%BjEBq=)sUY;b7LW!)Z5qekzOagD^KTDk>@k91=kec6NzFLx8ql zzanCUgol6@xRI7jaIJ1wXtY7>F}6Fm`wNk;i+OyWk21tFWoWfYKzQ?zIYZs1Ii3vJ zM^1;5pg^-8@wgnuUcHMK2S`=N^(9O4fL_~iGxUB}G>p(F7t^A#O zQD2cnWAEYPrm=rYXU2M)w%Jxy}rJrZaOx)i*9hz@aU$%V)a^pg0gJa*c` ztEucN`eP~?fh5EhXHo(wB{V(K8aTf$*JJ;g_7L60cgWOIwX=d8pP}*}k~O$ZaX?Z0 z_Z`UmDO9`?YL*jdMjLvinfG6ZoTl$x{a&CE+d9; zf*!QyYM?02c_IGz+IV!uiwHS<`-a>Q1ngssFxu&P%4B#SHlmQAVL~WThy<}9(g&(- zF9%y)`kA{i$BHdS?TqLK+lB&=l%)tvCOAh}m}>Y<+LB)I{g7Q>ik1eYW3A7HPlRx3 zhLseNF|Q||9k|*OXqVCdpu^_iPIPW5fZPNf#|0JdnEia6^Wi;pM$m_#xm*h17UMMA-- zjV$CkZP$P`@ceR$MPqy9+5g?JvlcI1c9|9X-~OwZkx0*>?$3!g_Y1`mLql$bj5Ok1 z*M{ld16c{*LxVd3oDdgdkzoF}+u>%Pr^!Btx7u^~;ZGideQGnMPWLsFL+Zd zkj3!v0Y0LPMq{;+6>a*HNSrFYzv;PNe?+Wn!Z$OSEER%v>;xGjyJ&=36QU;DRmaMuO4bsv*?W=fdAAs09K%;b*+;2C4Z73Zs|0x zNY6L~u|#l+zx$s}J%2y_uBDR=BBd!{u_WfgfG{f3ryz*>y)m%hy6e5$<&H8VznzpP3rQd2<#MO4 zneODJ1ZtR&qv&ad#>{OcU2S&)hY$*3@h=ZfoAHL0C|aMVmNtxGX$_{X7LEj~SHPfi zR~HVjDd1d>h4j$-^oCzj@>;Ls6b(K=Rep*mVXR|J<#b`0HD3(HxiyB_s84e03=k#= zgVJ^vqvl*6GgPXQIsm7O{tkJ0P1FAD!;puiJM(08LMunR?LiewbO5GJo$aoELP^}g zdIQn_0o3`}_F7!Uu)-Jhf#3SEu()^}p5u_(`~EEbSLWp=ZJf^_p0*rHj5*862j>(K z>dYo!IF5T#Lu*#;&(p-eI8jacqC^J|kwHC*g16s1WB5CrC>1E?7!Y!Qdm*xyPZ!aH zRHCBTz3?E}Xhd=p#}uB#-igKL4pvXn)lPA}A*DULI`AZn8T$7+NX^*W;NQ>yLU}J*$}>JJ*LU zY0t;IvYrGK(iKM6!ZPO@Vol^mNkpr#Ei1?3J%fqvotVqNpoN~7e)kT zp{lP>u>*7K_s<==gnwVG*21Hnp4c<(Y;MmK`GMRqXH3M^AdN>OQjN>x^N~w-!HTfX zhHzHkw!4uF(*DqEQg#_g$RW(*r+x2v&4G0BVxT$zhJI=@?zn{LBv^@5WvIxvvHVn# zH}`dHH+%7>LnQFho_BH7bFSA{>xj^&B%)f#m&6hjo5|Fzcu_pF?ETAg;Ydk|zuqL~ zy60lkMjp}xYcw#PklUbKF^4Lq5jmwB9xY=MGpiuC70>;~zwyGd0KcM#LBF(`C&ZF_8EoNA67K+yvr6)AA+0MV+UJ zN!N-ckA8POnH=)m5ebO@>>T+SWHsAYc>5C?DA`9HLFVr=>a6X{?3#4qe~wj3Ej!dCO#qowPMIsS*V5Be9SWMgMsIR1Hdi;QWQ8 zP@$W1{c{wyb@uCY_x@Sek*uA(!<1DTJjuaAYc_`&H&VpKb3d5_b`L!^1EkvN6Awnu zy!Qo<+X~y*23~)y3VY||CRg|P@`i~qz=rN=;$>_Qrw<2^gmr&w*nC%oQ-)Pd*Q35T z%P?>wDj0ZzZ2=#nXscWkKRxEX`%cFzd;RhJQ={C)6B#{!V8Ftpb)llW+dHHEbP+(N zFdS=}iP*oNq3F%rk-9gNRsrV4lqH}`=(6JDL|nja;45J*mOJbDbef)S0cM=C$;nbr zlu`e0i)N3XdbTdywLe-Gt!sJicqQ-CN)qALb(Wvp_vKQgxHvJsJ&V`>^7YP!xZIU^ zxl@0_AH@)vb3!gMEj%<1)J;LL;EJSFYpMfet(RfJ$U6w=@wQce3A`LUzElal%!O=J z%++uT+*k-tZH#SaF?sE%>_h}9kVZ;%Ag^PM^H(P@X1IF&>BiqTb=Cl^86bsdl{P?P zHs;RrT4~vW>dQTw`CYC{iy)q+{-V1%xePrFjJt7N)Z?FvyRJNXI55c-j_>XE&qxB@c$7IN1N-E~lOA z$B-ry9Ckt3KZ%-^IDs^imX}o&^e^CKPz@EeUmFEPNo`5vML_*ReUP5@w1khw?=H$& zz)(gbCET%+Kt}L5RU0Tz>OtBZ3zHzPB7O}~$?S;4`X|TKTMN+=x2yLVPoM*rlQPIo zV4bPAUHpE|t@p9LS`5=RGB`WPg`KdE^pA)Z@DI|yj1RsA$ktun5(N7MQybABt8ZV& z*L`3GU)chSpHOaDIt666FbT}LjmKEJzKM01*P zQWrv7O(2COQ}E*Iz6wjbRy2p$v#KEfT(zo|fY!Opg0<3ol?PsrtCVPXN%!KXEGvtj z#HUG`%XeC((LM@F)D5&q@79CRof~q_;oAx)GPEw zAmAgO?{lBvfFt=G;2Lp_HU0L(U4bBy&8C zeH^w(O;NVwxWFTn(D;Qro31tTuXi|yI&1g8ga8DYNqEKC8NPf(MqE2NsJXSE2hjHQ zK8(qB+udu_H8gmMJ>E}44#$qoJJ#mQ6tDiS5?h@;t6V_8=Ky4dM;2ziwY(X7uD50Q+LV}Fc=EP3Xke` z5A6FY4_5^Do3IwvD436|wUyOvYW-ONNST-i07?K|9>-B}Iej=(qg<)5%&9R!?C;w9bnQ z>p4c~vXcJ%?>8E##zjdX?3CzWv!O~Z*hoLTIF`iAT)UsoaarjFV1gNY+n?PmT^^N! zj3h3qtOKbn^wVu_U!qqkNl9=)xq*eFC5^Wo52T+z{?qOk&LmE?>41Yia(FRGfOiEcOjzhuRkW5v?r!-&U26g0Brx<7bjUM zc{xPhz9fP{>D=7D=I^%e>NXG$UNsuv19Sa_#qH>d8so2|P`*ew+JW<=rO6l44g(uy z;8yUY%mL*i3$8QA=lFhrf@12UqtP&<1V!J0`09sdx9{HZzVyA}kFSR7Kf_DV5`?Xz zduLgbGZ^u68@X>$(u3pF+K8goS+HEl7L?!7Q2_8@khj13R?4fR6*E#_upRIE_6m{p z_yQ)(=oP36AL%czub)S)W`v9JbLwrdA$wE79XOi`-)40-!7lmoTZ?9H+Z89say5?< z)u*((ka;KWb?=3Sq^rdl`=@(X^z^SdZ=I)H$qb{MnA4_-V+}7)+dDGGP~AV}_=^}$ z*iaa9uVjWizt3;N`x;@^64ovNd)vai+aunJ!41ay5`IKuFavSG^vG-3mwq=-pkV!f z9uy|H+&}B?8pMtG2_4L5BN`>ICcXa+kXy04Q!J~~u@2mzJ}>%5)c>p)3c>ZX1LM?v zZu1zolyLG~IjQfOKBq?HhGZc`HUH%TNT~&_$^T0FNt*!TTsbTV%*A?N*(!^6|JN?_ zKd!0*&}8)89IE+8TjN^@YCs{alLcJI>W`Oc|39mSoM2D%f87uNGqqS225p$iuvf7w zOaCkVp9lYYc+UWCZW1eO+{_UHVjfWJdz$Q^02;2K0V{=J6=K9w0lqGWdOFufubWW6 zO8wt=`R@n%HnGGnwzJ{3ZTQcixE!&cXS{HizwGl?%|M4BRaLial=UFk>1Wmn{6=i{ zKi&+G%OehOq#~Ie*gJCD+FkN~=mO`pUOaXDxPa&d3H8xfeH4Blfk#)0t4oC#k4FN& zCco$t4k=AE@4OvFqypBZyB;k+>(9h=561Q`niXVwrPFvp zLr}{H5HW<&q<%mWFKU9#e@J$>lXV53bbXsG96--}WCp8Da4M^dDIf3_1!qsDYtym2 z7nyhP=K800>1m(ACuKnP03C-BsExt6k?obgHNkvyg7TXAMY~2JHCRk!g{6(!8=(b4 z5#zeML0YH-5jtT1fA?aYGsEoSAKh5QdO0B6%|fc4pQctx^45eO4+hFB9oYX4NDEh>>t?Boe47T?$eJ_N!we zL0x<8xuR_O0(u#?%aklx%iR13pM~@=Es`Cb$kG2_3lae=1a#)<28v#LzvuN`aG?Ui z7%Nwdpgf9ZYnt^XP4u0aX^cYlq>APcYDf&RY7{&)FsBYTg_13QGA9`=<#8J&#>z}% z)RbxD@7`5?7{8A-*HuezkdS06Shy2zt31KAVsjT0Gn=nTxpw=OC!v!q61ZjfncX;-K>2i zE!JtrBtRFFV3#(O?IHsklPF_7d=!2uGgCT#C9&}C%V7wCJaN2m6 zs+BtXgHhMe*XGhwF29mNkeb{D7lnk7*3^ijsEAKTez;&ZF@L3s z%)K}Tjg%pRdUsFTchkU-8tCw;Z6ZcyrgM&h8~cD3I!sARqnA8vO2Gg&6K#Mob@Jz> zmHV@#ngl1rpJb=^Hyo%qnmAGc`&NF^3KuyUX;vS_;gbFNZk?PYpbTwMF72h>L56?} zB)lwct(2F2rDI6j-h7_w`w&yrQzlc0i?jfFbM_c$f(Uf(aW%))O{{V67+}kl{&N7% zVK{+T##j=VOZLiTR= z9?`RVS{vB$Y^?{yf{T%x;p%R|(|_|u!Vjz}0a@hJ8{2IYv>*TY{4_rRnjQ^JQOWJB zk+Ol3BOxOoY3&Qj5Rs_c7klRpp~a^n@5F$s8fjWnefkk*r=#1=E)zQIEuTTH9QeHV z58;qqB@X3a=x$rF{^>LX=a8HZRDBNhhO`4XOb0EBsB;ZJMYxgR68}M){^}^{QcoY$ zXob=otelg^h2Wkq9rv1uB_L@kQW-bcpqol6Jb6HWFY9dkCTdt&yqljgR$5rEXF;Cw zrxF~Ojh|F((%7G&rXjV2llquuNA9A=e7=a$MPh|#0wHc?U2!%v%M(_v&(XNWr2eDB zvWXkB01KrmYd5s}jaSwBX3n~`*V>@lj9~%-{kR&RIi;qLSC`EN<{Q*ddOB8B=zFCo zvJC-mhUQpuzI8oBD8TF^RfWytUOJ1_vfA(Y?zDOD*GuV{w#;eGqo+bJs8cetL&VLM z2}UxHYzXH#6<;9RW)|QAeBq8Ik61weX5}x(r@mUD7KTxBCKyF5siV2WJiEQv;BLqV z#0a3L-+0Y!0xl+rt|L30b9rjTl+R3e9kt5QAyHVUCF~8xJ2>1oEcd+VP@Kw^dF{f)Xq- z-k023#Vck{xlO9q`NN+ZhV+>8i-|F8ba#2!)Y-?Lrku2As0w>C;0lQaoYyxp9Tk!@74rni4 z2ghM`I&t#{R@9H+o#Z+c?ZTlW+h;MIA5?=x&ocJMjdK~jc1MpvE*{l zAZf*27?lkSDI*e(s2IsKfz@kCanr2Jgja4F34$lzF$z&IV>(fQo4>Tx9qHr;4qJeL z1B{Qqgr)!Fz(hfB+pT=ycvYW4$oqCPIXAr$ZAw|Jk|Q!ti9h0o>lK0Rhk}hyv)>K& zZtD8#G;f5?BPGbw?KN0K!P&>6DIlo;9tv0`dAB1c; zZ2R&weXHaaPJ=}XPEYbFv=d^>M8JzFB)PD#J$|8%{5P3QT4^#TLQ7)=hFEarGu4g~ z9+cP*0C>QcVHZ>5AZOZjRY}%}g)lFrynEcbUAmbWi+!^W3CV_0@MDH@4}r>QFJV*P z&N9Xxfz_~lp?_4tfBHbEB<|#Ru(b#+m_gsg+Ut_0*lZrXfcu;qX?eZJ4C)k8%K`pk zjXB6$lEk&d#&FTX13dmY1!D$N8_DP`_uaZlclYgRh3(ub@+j z49MTK@Dr{5I19W|*j!3yOTu`0UORN~xLbs#=#eP6=BjgWrgE#54sK+0< z@6q0b48D!XgVEYC9fNQqhz8k$a2-Ts&*3&zc9luvw`+@$qYBsdJj5|zu(@m1fY%*3 zV;4W!`Ypb57gn+0k00|)6wTJ^P2m=?q_1y4hnGe_CldpK%I_N$C6etF`ITdCtjrOQ28L4RnbuZv*WdfO3R8 z2_&50edNMEeX3i^Tm5fwW`_!q|7vciSHF_+5_l%f%}ONKt&T2*&Dk&n^PGK5wE6}w z9^C!Sj>O2ZH&{PXU}*-keJ zhO)_&Rzc2~t-a@UH1bDtvr~c}oCpU>f1J!@(!1m=kiPmy{zj8H7fB55VYd}!Y|sE6 zDh5@A&D30~#zJvQs%{Nbf%}~woKsFrchKx|Ccj3m@c$}7xD1Z7hhWAOISt$_pOj~^ z0OZsNDe#s`;R7qZJJ~Yk002Z|#(seJ-y6rt@a0Vs94?x{xt%_9xNSME+6}UXFWX@G zZnxwu=h@%Mz$?~lJY6t&!y^jKR%|@1ViQ#Ex^<>a?xTVSoJZh}7&u&b16fMRe_W{~ zIB;sfvMUR;nm93m3KSMJDMAx58;Y)KsZqnwYoZh8m&gq<7M&F$($qsJ$r56WY$7Qt z#L~@vfXKKFTnq`?6arFA3Sg-P+%_mQ4d}AjScQg-#hB)<;Y9m1oIeK6MnJ}xW4rHlU6y_fPY#+24fPazOSnb3W{lC+{F5ZoiY*Q=EIA~acO((dzk@b~Kpgp!_x5o|b^{DG|y>{?Q* zMp)8~T;Jg?19>RTVcGI^67$qcE1Sgw`kj+nN$~#+qn}JTQt8*2;QwoNjjCl_TO=ho zQ18gsIUY(Sm}uZ9U5;x*LwZ@zv&%De%ME7JmF=T;2f_#md#E2j zAord61BgH{so+7I%>{Z=nxcZWHYkt2SR-*|*nNt7!c@ptRyKN)w_xGe6D}r}9t0r+ zlQ4Cod2rh^7Gf!s6Db0mw+AOoro;@r}a-uCj$7I zK9@xIT$|F7eWkzqcZq<*g<5>TOV%1n$dQXPkD1J7s!pqJ06b@U-H)Y-Tt(?Nv(to6 zVQM{dO+yAo{n0L((t!Ogh=lP9*M~!`Jkv_23*(QYLYa#%8AN6*B2z^Jv)b%LQdZ zf<6OeKEW{Jn1;*WUMG5P1$3}@OiD*ZBWY<4)K`jJ?9W4t z9Xs~_YvADGaCe`?O<;w-d+GPmnVh1dAStv(c9g4;Xbv|U-%IMWtd;wB#)n~)U5d4f zTTfI~9#lN=vac)amw#=)PW<@k4iD9#ha9ZYSlK4YrGYVy85&Mc`r9h^V5fYN?C<_$ z#&JGp!xRKQ_N0ZJlj--Km$fQlpVz9MR?!`=6aBQO)*3m+IR;5_pbT_#wg|>YwS5I5Ce+=SFf!)k3l#;SDmtAMh84M2eD66^Rt^GrqC;p%EZm zPrxB-PTXcp{A=~4A>%I!3d{hR^hY_#_|q{sY!p7cN6isOxYKw${)UbjS~KW=hMM!_ zlFc%-l?gj-N@f{cXyaiNZm)7s_4||pFTjq8m1=sALwLJ6IZNM`3$8qq#?4HF9z|N& z0n$Z|(N9$$4SS|PRhzmQ`rkZJx*T}XLJDs*@nN=J!TdHq*%Lu4z*zkw^|_2qD=c~S zFuj58*pra3K41<};h#(3^J*yru5+8oasmv+KN_nsOtG<}b^aGtLxJ>;h&SiZ{&(VH z?S@6bCWxQIBHt{0ghZ27&q0=$c^8Kl(U+JgnQ+`>vO`?w#ftjvu2Rm71G011PLG6H zOt}+7jI;{;KMDgybg<-%rmVNN$g_4#gM?>_@qL07Yj zX76B8)vvd?Ge4_^1g$}lvCJ#@ndFK~NEpGp}_|9RR zxx&ryuEmzJ%E5U~EiDz@FD>Dli@NDV?2YbDF~qqLto*Vy`bGiEZJZNhF+#?+VyMjZ9?RF4R`nVCyF8p*#FSKMdy*yJ3^X>s`y z@*n!A!K~=jg!a1t@Azh_qe+~muF(=~Mbf->BJo(Iw3 zc#w0XNcrzzT{V`iB&sA25nQu&&+kK1$Yb#YG-oN-EY`o%-T6j{bXT3xf|Zc)C$ zsp2>J?PK^4c+vzhrXSr)cI(Au7^~dn&0i$Fu|Xl|aXD>dSnpq%R-mP`2Kt*v6^$ur zgFSPH!CU?CXM`M3!YL?9c;YjB*#hwp5oiHk5Hiae+!GLR^fr69ms24lJ%zN z>Wpw_nIxd_Jo=rA0~@{^$9cc>oN#;}Om4=-5Hqb@oxIYjWdwDi7Sh3Mn|nm6_Gc(G z=g12f^sMp!vH*U|OhhZBZ$c|2jR%o5ptB%sct5-wY^`_?oD^_uhUpr3seRvmzEU9P zi)p$wa50tJ*_-sp2x{q&FE}W}XbcU$+4V-z)eGZ!7Uq}(98$W?RckqQR4Pf%cG*;) zmm%CMkgj6z1i=Qa1nbJ&q`0Nqmct=K^xN7 zJOcY$Nn&VGj*yOW3^(}+W8eJq9Fi@SOOBT<4X=kAtiHS(rR8I8cH-Rmp4 zujwYf8s}K)WX3qhJICWA7Oc3z;0X_@Rd4DWzn~fLN7)?}jAYzX!8TUn zv6p!4(yfJALWKHSu*tAA-m3~3lE=O&4H~wv$~g6?OB8l3oR*zR8B~c%4*Gp*yFy7Dc#c-n8)AypoUA3!Vu*|s3A)Hdj9l1`Sda;Q%)hh04D0ZrVOxU3i-_SD-|GsiT1==k*W zavN{=Rk|MmZuq0d=@-yS>DnWB0kGg{=_B+;-*e%DpSHzv%-56b8y%o06vQgVOFKj= z*HOfL*<}6esg+5v%a8vV5s!o#sl1RieNMQl+jtFW^S%s%ULaa1szKJ;+#`;IgTLkZ z*^Qt?aC$k`{uCilb9hNa#>rG-RGkHbd{m_^uJbHncOBayrYOcyEeLBwZ#u$a8s5~B zX}3I*sJB6x1S>@d_jN18b0$!~Ck8Oeh&b$l>Ncq7;+JC=hRKBQkdcDkVvZKpt*(7H zWPDW;S6&CB$psf>PZbjjE06I0vh#kqmHewD zkp%e$LsAthV?lwO{&(Es9C@%2)83^f_IKJ?S$UOWU%~_RuTnX3NHOwFZ}ue*L#c%< z%@~QDaF#9{tfA}^=)X4CP;4Y*NMpK`_p-x|{DhGZK3D|`o4HJj-{SUMCr-vK+omdcV=K*FMN=Zbw3KVC|N3#dxnNn2Z zQr3paR36#OQ`Z_;S67u$9)7YIuwdwy0)TZ!5kU8Q*m=LNya5y3jq62m6eGDd@p?aV z`BDusV7D+L{5NlN)<}SMS%?5^n-yYFCnMqcK`MX6AQ<-hBw@1oOdJ)!BMn-beeS{KQ>PJlNGov^_Rn38-sbwULu3 zdKk0^YrbqNu?0%o+^J{SBClFIAtUFI#A~9jYx$ipWCa!`)0GZAc-{%7YgWtCE*5=3 zcWf&yjc$jO7-;t?{XE3UNlT^)x{L8H8+74rM;VN$qtw_FOhOTu#1PgrmYu_a`2i`E z0Wotc36;oOLRh-$e<3d_B;3qul1g}_b-&}m{?1%23~9R*%U9Fe^8PFB|GzW=BnbT> zjtm3oN2nz)1VT%tk9V06*zyzq>Figp8`-CE*-;tVS|_Ef`4pp07~tUqu5FM|+e|rQ z^;%A&t@LS(Bu$!pSJkI07+`cGsEu0OFU~>&XTrU%5JBlefZxebiNA~eJ&uKkj~1LS zLSZgS&?-4a$QbNqo`;iBA7F}Lf)6QH58IhQw(G3`38_t0Q6!PH%ZI%pL3)=?s+NlK zdcULLQg{%?-|O8JEmUh&nO+0|J%K1K?fT;!g;M%?glwZz07NP)t-jj312-!y2i_qRLZTHsplr z`M(FvoDdJi!8ia6AT6B!mn=@JOdTdEej{}H5MvAMkP2n;9D!|RvQLM>N*mXN46JTk zfH|zBz>F?*%$AQGV-i{(2{&>UT?PfBh+aFZm?Cwh zah19#(OXM*pZGmJ{Bf|%gE0cELGJ@tY)!|;v&xSr1BQuqhN)hB{2UvW-k)Ga<%yDLfKn8+`&0OdjAzQy z7f4Y&PSPSE5*IYW+S=aE@s8QVdGGbV9xa`gbaMfo6+h=X031hy> zpxeZ^_w;YWT)uoR4Za`^{XaB)Ral%$)9pqA1RWr_TOerA;O_1&!QGv~ZE$xR+}+(F zNN{(DKyY`?Cku4j3{fC`^x z9oQTSB|I;wKo_}5{J?T^e5Y=oU*ZRHFK{|d9{?%v?vfG~Ij}Bn;;AUJ3VQTlcUG>s zp>FuAIdWseaw2D(F|FuoBWww;P2cu!p3+uE+O>#6rrBZ>bCtE7|wXn zGO+xwM_EWy^wi|T^>-Mga+p13zPn}Y<8E#o41_N#$vuWZZRYmkL99*a%8<^ILm4vf#vK5H`UYPF0&cYn2kb7B|9nI{x7ZD zD(^j2PNY!A-%weh>SZfynsE}1ZZnk9{uuMEe9BBFdmY1MNxmBMi*42OQP=(1m-Z== zvTkWPS5n$44IFvqv!B;W=Vp{S@JKBRqUYjZiJx>6mpWutLUfg%^NWva8m`_l(~5nn zCc2t^-sMh@@H(H1WzLG%Y8p=0>8&mK{jHGqYxBBiHi5vhvt{M=DVfvyEg}R9r&p@? z5%FI&nq}+m8=XALj*gtL&&1HNGjeu@(9MISy&>2RgP4 zFEA|)_O-IXwVzy-5y;>l-6TJei6}{q&TF^=glOY|;ir4!VRE&c)oj&w`pcroQXxq~APHZ*sN5_7X5q+}UJB#WBS1Z)MI{B>T_SoTx=w2&UY zG7}!xm&}W4*h1nSa3Fk1i9%mpbA3;T{WD%w^ga%GU(xMMCaF*jGCTIpu3g}bIDohO zK|IRxteEmce4~UTxKvaVQ`A)->8W8Fh5zlH>TLYe2ws{g_;D7+?S804M_PLpYBX<* z^mr#i%=+|91LyvLysh(&6#AsF2SI3_E3C&EwhlhtUFwblnyHR9f4nV6Oz`E8k>c-p z`A$U19rF7N2GIj2EclTN(FJ87bmm&F+1V=3a$X7^Lz8^{%Aik~$5-M1#71T@A+OE7 zz`^I)aeb#6cd8T3==BVmVG$1sRuE<2W0`rCi@razwhIo+tAND0r&bPR_%75SuMb9K((_R#r@f$7`YqJ~|ALJZ%=F!fO$%W~Zf z&|~aBWvrcr^eE60vFXly+q4*ItXu^+mRaW@w)RL2AW~XtC(d1*PEv$;dzB{vgr$D%a^{nxNp1g}{LaholZz6ldQfNneIm8@UErQp z7@+_cW(#dCulO4Un^OC@IeVz_Y}~9K7qsiFPyqsXR|>P~p?w<gE<3C}hj=91|}RfT%cQm1K+t)3waSEPgO3dcQWil=AS z%OIVtg>Hu4FV7GKVR~z3RcEt4(agZ68Ey+Jcsv(a1=sWS0Q70~Cd~|~Qj{6U7MfOB z5&H4>oxGa4?0_#cv$!4T9QaWK1_ZY|$ERv_K8{p4NSVf0S8=ynQTJUKjp#t9-M9M{ z_q&)i#DAFG1!U2u8-Gv44m4g5v@Wyelb@OmAK_^B>LC+3R==PllvJ-S#1l0Ko3jAhN#yisKeC>g zCG(iP$7D9sG-P(6Yit=e)1lCs#cQI4Y|WbM6xJly_bNyjK5PUH#mIWKVNE zQ1Kmjr~7i%|FMdu(7h@@Nn1N=8RW5gA;nRoPPd?WLP9=*@x7IW`0+v_ zH*Y}hnCm3jv>rm1>!_vMS_}Vx?*MYxR$s}zHu~L==vsoi`Z7$9-|q&yRlO&ND^6HK zXw-oB2!DdqSheSdB|Nv7dvj!Y{WPc8yS{e7teY z8G?aC`_rJIS@M?|y`H+WOn11>^%9YvXwdbCxN_!2qe+kxbr9-}p4!lv>sJ|^hA&&) zRJEmJKD^!^9%_!*BUx3NNn&Hh@Qap7AmnglLL}!v7|;8aSM5m)Yxl(};~PLsije1v z02LN5w`C@c7Bpyq&QFgjst;jA01=uCn|;xo)V+evedYGn+dAe{GuTIfUfk&qJr89H zOOlA>U0xU!mPAueI4joD@)eAP*Ae;R%^DY|H=dOAn=5a$jEOXKiK3IC0zjmUMNi9% zBw&A@^5r&Fz-T}mg>Rb~J3!YhZondHwz8RI^GSwIyNzu7fS(8&2(b7m?rcajjGngb zLU_>mYuv{X;otd!g8k>ey4vmB7t;bWM2-xCaZ`+k=H~K+%dtnPN_;{SHmMBzoVg1x zZ#$LTSis+uGL1EBg=uR>dt}!<{>v@5+k8=>#aX`I>v0B+gJ_pFu@J*SdiOW}{!aJ=x(_By!drbO%`1#e9M`Xb8ot%TX zptUpoI_75UyCGBw0S6X(kLAYqDCR#X24OF_pSb}#oDG);L=|MAGF64e$P3b_@fVaK z_!XkB`DCgE_3&$+pAu_{xd*TJ=HjCtwbHBx026&J(u6|ykOqD8?NCQ&_F;=g=09vv zGmRe2Vmy=u(Q#`fEsS+qr$6XzOYdR|Ia_`P>PdReDupB$DjyJrQ7u@)AfBbm$(*gP z*Co}7u;10P?n4LjL31w}@!!kLHw)W(qgn@!bh`tQ8yatpADT%_SV->e{b9D_0JzM} z(~PaxHi=*A>VyvK9xhB4JMufn-XHgRR#eb>YCk~hdLTh+=&Ro`BnrJwBrr2-cSObe zM4S-A72KxQWO{>#aYYy3&*E``g&wTM8?d-=v>CXOM8-MQv}TWX-OTCWj2b~uD$~zb zJkcWMGn}^QKqhBrVSqo@jgsih_v=YDs~<*HmDMt@^Qc zW(L>tE_r@lMjpq|1zi(P`x9;m!h4A$Zu@@7Gsj$aJzy6Dg6#`J>enUdeG*pxC~XW} zz}%F;N@y&e*R&6a`^aH$mEpePV$=HOuoK8O+E!~A=&#x&Qjp)yXB8;qOKFz}n!r_(>m4k>LwcBTKtb`FjgnDp)3 z?%`lIFVzDz&F#%zbJ{PaHwXk59}*vnlBVMvzz!e5K9{EfbbcaO2bMMrRbPuOe+*{4 zMevP1ScPvw005ozyUnd4&%r4sJtOlZz7@f}wHzhBlcsX#TK8QDiPlVcv_xD45=J!w zDd%mBjT@h8YqS3){R0ly&(l5R`IdTamhp)-v}FWQMD{;_9>Z<#lJCiBQ>N^6O%^mM z<-%g>L=EUuBu)FN`geVpIh55Ux#V}(`;2V_Rr9GCY(l@lJ*ReyqN@F&8EfgPUeDQC zALx*8pPif{*gMO%nODM=MB~bvS;~-D<~Iy}_=}_d#M)%b1ziYqxuFKu02g#nBGnPoTfaq+DYO2fljgD0m=) z)XLQNzw9B-<&WMG!KLM*`waz9FBvK6-Rx_B08yyrJ!`vo?N&ivci(y2-ln%@GympArMp^W{IXpberdWq8DX~E{q@kOf1b<`Pqm@t&mRUf-Ej2#|q}gnPCiMI$P{xeucg&5IU2A z^Um7wz;dj7-hwdVmRnh9d2G0~xL_Z7z;X_7Kp=#IRxV3Yt<3TXK_ca3veP$0a>Lg8 zf>Ha0-nH4tR&}=av=Eucu2+#K(#K7O^@brY5qI%{!U)%2V%WtAQ~8vK+IQr=!!Vw& z@tL8*(yCTRe4^1x;c4^KWL^>{*`^V+)MYD&TR9r=eX)gOWv?`*IcViG7sdVWZLw+% zjnq}NO`pZDq;g%(*H0WAd^o$ODdf;;9aADAf-eO}br=otQ;H2}07!yvV^C=jV;lAl ztq=k#vychcD3@Mwd5j2e)EOT{2QQXeHG#l;Xq_&XjhwafNRe$t^y!R&Ce4}I9z_Cw zR4kYWT@P}=lGf=TMV$_bq%;@~cCr!(N33B&i&B^y1pspq3bhdz?zf^db%wu5+ z^`nx=Qw(XRct%pEl%cMh7<1^5T5aGo8tOpYq%G!Dog{c_vrqe&eW1kCoah80Cg7^< zew3N@w9obCtR`;IW8T^t|1Z}VMZX>Kk2&!|lQXVzkuN~hVc@J0=Bdsv10&1du-1JN zK9vw2G$8bo2-364%x_KhV?N3xVKjOJ8bMqo38lqAmluBjeE;tU)+F-YCd^wE!>5LZgAM^zazko9-`>W2sYi+1MD+ zwTmVt3f8G;43!Wcjxp;6cFjZB^^>Qu7N_-nWo(S(WF3<%?^;TVZ3D}skZf3Z(*>dWIz=;=t7A0Id=CR zeh(9J#$&Kd%|=Ag(gy?oK$t8pF6pP`@i*+VJ)3U~Y%V)tGyE~lnk^x%dK5h5{sX*m zjRd}!u|@oYb90=@?gAaU1B7H6uZm*Z_E|xX{~@*RSp3v22tjR&J(BI;J=6x8FL?pI z20Bg~*6h$vnPkO<7v~ov_G>qWQE`oMNSS%b2#hVSEG1c2D~T%#^Zs-yC3P!`TN`nz zX!h{@p2Rh^t7miIqIPdA38fPta-WF`R+3-TcU2H+6ppVR*7^^WREKMM{j3_dHUk(KQTNow0G3l-%28DWEo(u39=|EV z&T@uYyBf%LTb*X`t=*MRx&j<~P(MS->D52Y{gE>kwz%agob3Sh<3UyZR@nCnzw%VU zjh<3=jS|ULRW&m_PzNUL5n(&UfKl6H1Lhk={7$qpYP-{oOO9fjoZ(`dm?ft~f%w8n zxF>vy2BpkyhAY^T^;`0U-wB^cDACZ+4=i$~xkB%<$1P46*rza4X1psv^j1t}w6hC% zFcO}>0(3b&0&!~oYC(;)4TuY#TxikrCS8VOMGT;BrNRV5jCM!iU`k<+{Ol#Gp)qYi z`d@Ms>0cP+_pu?s6J&|-_e2xQKBaT@AIm1o^$E)>Y zB37Hj4pZtCHZN^Sq*1k_`##GG{AD#_kkqBqKDrx6m=o?gH}effFpkeqQj3Z?%Ghsb zwOu(AL##9e1Y{=hFLNvn+dpWQQXG!CR|2Ma*7ENUo7#<&r7s2vASN0o z<3pFu#b+D`@mUJt+^(vPjJ7Q2|IvHYfO8Q+aVwWWncg(rhoSWcqghdvU*G?1@kpY4 zsNBXd&~E;`n?O0-Q+(ir z7nvH7V?G}HgBw~eWaolK)*MZFyE|&Td33+j)fgbdMh6kQSOe`)C1fYWQHxI?z`pkqZxRz-$0{iE1T?l^yECdTuJ} z*eN)36h2Yd+%KAPa5GFzl5lP&)LGDCtmMr! zFGUMQfv`v{&Wl%(Zpz!fF-NTvKLli=bo&D8nA+uKT%Cr_kwto)tq;TT~HMuvRS~@zx&Kw zvI;_sZRmV7nYt|=iFd{=3ZMk~y9APzQ|J3YSk%1S_}P~AW}`)A)+XnniOlx;;7^v) zHn2z?Cg+2rDnimMG6{mx3l)UA9OP~UKsP6X&3(bpGj=Fsl^_(W!78SQf#=gQ}e(YlI zo_3;T8*;%koK|P{*i-TF+$Y`c<+oQpKtsgSn!%Lj$~500^g;bns8kbsvRYiHR!-Qa z|9s*Gl<)ibTJ3W93>teWSeZ+cnsb#`e?L0jUzXjM)s?Jl!%nj8yK4l_>D2TvYpULfC58qCX9Q9fazF^CfZoGP zW#>Q2r(NF4mIh4pgdD7$oqx5sQwk4hiAT`dlJ{*8=f2^_10Fdy2*4af%op!2x-K@iZ%<2Z?!MM4m*oBbOZ zE?#uI9WHa%SX9)b;Ebv-egw1uD9%}J&pP5j43rT14Jkmf5R6h~>-N$9<7|uW$jFj) zmNhHi`2_<)^mfsym!k(tv}k7s;YRYDQK3MBA3}n{#oEJ%8301?00f%ZWMIH=C0gxS z_n%;;Biz@D^Q$;)ek)E{9lu`}`b1Fi$k^Vr+rHemJrF{}i}_Ok&N{h!>fkrCgFF-q zv&>7$0Jy0y1-H7MF~P`ozqpU>H9F0lxwgJ@js3dvPWala!vWgxGwGM@Fq)>^{HtE^ z(8A3SplID&%}W;BYlXX8bmwaW`&dOkC~35eIY>+ELV>0GCPbbaXMb4jFA>;VeOAQr zaPY)&w=b0f;baqXz)XyI!wkrsQs7hBQe{5dfn!kj7&>#s%BOl2u;Gq~%avTChsLD}1JbH%4#Qadf)98CCQ&I}dTGFp~F zC*AK>0%Luue8_Z(Z2Ao04*>Q~p2$H{vuQM zUjYP3*W03!!{yvOPq&3%jCH|-k9^spCMLn`KU!AD6{hO^UJt>=U15`V6tJBdj$02` zf*0p?v|7BZzkXp_$e0}1P=*7Uga|8C^*T`lHYK)G*`8nUO5GnWl~lO}E(Fhe`H9H# z5eSBQsFHb3OD_1$GwIwk6PSq03^T=?a(0qB(eGD2o3FGE+Em>9@Z1}MAM(uYY<)ou zs1@7(k7=TBbHg|w8Cmx|T*!+LNz0vWRwHDZkRMV>!< z#Rkcvrr3Ai5#ISF5-;nU>%k*iL73{%LB=CU5~Sp&%c-^P?M?{6w9ry)zR^?c-qH*0 zCAu=Kh{k;|&ZLId4z)I-dCKK}_DOcN0u0%vYqXKf;+O+Zp;g#>kxi^{u?-4QV9Ow5 z<>i(^o7qtmn2~mfvl)_YcjdhMXyqfr-51V5pVNGXk(_V&b!w_`xV>D21z}7_r24;~ zKmuXxFU%#1AKEgveEU|`R+Uv%wilmi=wk8k&S`>)%LDD?ip%O&-fv>fZ5CN;*5V9< z@E#~C8(V+7*)g0iy6Bqlfdp-ADvOGXZgT3`!sf;by~0jTtgP*hwYZ3N2o=R3#2cWG zu>Skeo7J4mH$QJ9=R)XHRCzhAJ(N3BqbK}YBf5t`q5NCmaO29+%kRjf!*ERW8mS*d`PMW2T*U9Ta$)K;{K0C#xOvqce-(vI#79-lphWMsjp|5 zyASZ6Tic3h%x@CgN{W4WfqBE=vI#)oZ@c0HIxJ+WZ_WR#iyIhT#2%NHZ~6Nx$4mo- zOTO-BR47G!V81gY#Q2MBe@C~l4c{l);8BF7UB@~&0B*VT#NY<_$JbKCa=(y{@xBRspZ`nOnl}kWc)x4h!Z5Gre3;+L%p4BT~{GZp?9}gGjnZf0@~dT zrm7wmv_n=Nj0qiJn%2v?p<=oP8B5UO-(l{3xRDrNTKr5yLoC3(B^E!>8fGzK*zsmQ zAPmHHTAp72$sd)--psM)pM?DKyU_V`AZ~!e1X(T%_(y*)r(7&m{ttO?bFDan(b|g) zgYxI4l(@UUOAi)x1(FQupG<5ukl2N>tPYN6LLJ${v9PeTt|qgAXXex0pzy@6JnVA? zP>Ugu$OZ#_C5c8YpJ8HYX$g!%8pW?to#OcZA3J+q;--jvq=uhS@vFJ&b_adhy&|eE z3u?fn@XwpjX!>2dJ9BPRyI@eh@q`q6@x*u z%f|~Smc9)QSxs2NfyDU6@4Ls!RwaX<;!b}CX}R9e37SSfJlVp;J5`69*34?tp*e}s z&tzpqkMF0uY`>7?=?ivn9q6m@pQvS`;gq6o8nffbP?r; zM@Ph>ib)#Qeg>l4yqt;Ea&mG)JLsp{gOCYWid?CkOB^+_IVx(YNws zI@_ZdqP|#?n~UY++BMD5_7JW5d98mohy<-rM}94$-)GwOou4U909?oA6w4-@fP^<( zS{Bv}nPOXEYh4dooNO>(WT+iZ`3hldmA00(GwDHR93wkPzrC?tYCY&@3jXK!N)&)N z;zjkx%BF7#4-FL3UB-@%jvRjPYw8AD4Njf9*A8^XH+RVMn}Lf;sr474|3s=6{6p5u zbrd0QIh#7r#(JB*rj+HeKCF`YK{U~i$?A@sVdBYXnMug*0ia>v_Lmoy^g%hEp) zjoez}-2+3BI9jHrA?`IL?;{Dz*~o$h0hFO#YIQl#8%1-}01xb@DtmH1gN1?ig$#$u z%!lT)<+crz3C`uF#Uah(a~dFG5Zjck=1;j(_AgwO;$1FLBRl&ywiw_9LT)GAsH~TB z04Fyr^sI;!AShL@P``X=UBi58lhuqwPZ~tbjfU;Yqc?~WHIw&s@iT-5E$xF7Ea9-#4dqS9|psPwZ2nV(${ zVa@^)Ox$KV{KvaHopy^|%?+TdD-19F{?7gtZFca=>-Ya)6PJQi?Sg6RO0DDcnywPc z3D<$S8@HmSqCvyF%SeaA9&!D=P9Zz0{Jf0N7L?O`xNIEa@|g?vKB)IgOzt!E-VGZ+ z(5s%@Hs{yJTN;Bw`@Bh`^v$OOBf|}RV6lxnNC-csWjaSh3e_I$5F;l`@<&cFd*4AI z`PdF3a{{2^2h`^~#@&XseAt2hcPwt)c(I8Aza)q~Mn@+ZKFrS2KQzFjY?_rwzAw^o~9` zbeXWu+~2K?6BgCqf8-~@QEZBRY}2ZfDq?%*&(9WbydSSO%{HS6K8;tX0MnLDc?ym@ zg@gTy0VAOn@vVyZJIJG<6`xS$b@v@8fCS~G%Z8*gI+R!8)Wj{R23{*`CIndmv6R?f zmfgD_d^-N@$^><-yF=n$ZYBVCL<{urdV1tG5KVG7V)%0_FMnzH0p)MxX^mg^5>H2C zW&&@eMPWBNgb3)t4G%;N@|^s8jBqJsJ`vmu)*hey-KZpQM3D? ze__HHaKhBGIqZFjO0(&pJR>I{=8N*AOOJM7vJ|i}V;uMS0u?Wk&8J;YwOKyyL$n?T zbkZJ_la{V8(j<64tMRj3SXdw;=6lr8QtCh7RXKa8cc?3=Py)ayK zzh?i_qhgSuP#BkV-Mf7DjelsFnT4_!6l0v4q!kwz55K=H8#g=j1^%ode(R3&JUVVV zQ(r{#QHjN#r#gfbg#^DHWve+V>^Vd4IlD4-!Xzgr-$%mxnkGtsO%KkB;zYm_s44}l zXXU>mZFL86*Xp__c9kb)>vib)kA1iVod5MiK(riDQcYJ?+MW5 z1n+-~fT4h7*IHiMq0yP&H|6(mBlk+=M4~gD$Ko(ts6h1*#Xg{iEk7{dy5c%YMZr}1Nwy2!h>=!djp}|CMS`d` z!Gt+koB>jXbmg|b6$7`vKFL!U$~p|pMGLzaYs=jISDczPf4+F#3ZLsGKzcj^{El zbjWj;S}M+o+NJ+XJT+iF+#BQdPVy~}@lrA~|7Kg#+|`+FmQ~B|D~emazc2MHzddZO zEp$lu$yDr^ic)u^8|f=85jz11y}rn%YW9fyL@~aW``v58V&%*fH5KnTlj8n_FrLjd zxQb5}_$m`7)r7=4SvQA4ts?_ubsxdKD5HMcwkA5FTyzqX5J7Dd#pwEM$F$$GrPey` z@JQC%K_LYM5@2wKrO+pPA<@3}vGwxHAAMQMm48kI`krP(=YHDUbTS^@0)Ge8qB;So z2>>!`ae#ka8C;;HMdcC}SmyKte=Jot@4BTd$z39Y=LDa>JRjDW)N-rF=nOyEC{TjCH=@{=-KHQKJL6V2LZn%A=QV8SY=j7V*sS9G4O3 z>JEFF*7jC6*ycI}>3!8UwT(iuW+m4|f6GH}9b)%NLXF;mn4275yJ&+jKQ4quAdMlX zk^cH=@+|_&G)#C2kw$s$e-|OOckst=ea|OTds(#LzsCwvXw=ix+5L~5>HN9egClvD z$iP4vK)q#F&miL9w{C=v7`10lp|`GA;3^hYRl}6ep^Dqh5x@D8F{g;xy=lMPFe|jE zlIQG2b-5#7wnl1>NUi_{sdA}IbzR-4dbOtA!^VpQ(0sF#U#YU8!oFZX<#;{MUNC+3IIcb&oj@Yx~7knTXf2EDakZzn5wTnG9oa z*O_|9ZT)yxh<5aNfVIMASkMQN-BfBX%EK{))_DV<1Fp2dcXxNq4m;2t7qNbgSmUWa ziqppDOlLVrT!9j+C=GaEpw-Sv8V)@Tlmq~(AbrvgUIU8q6!ELc&2z8eS7pbS1twp^ zo1>{;x9_f-zGeISCXu53d39gY=;0EFbK6}Fh#>gGhyXj1t4?vJcM*fF#bLJ`236X# z63N6n#UIw)Hym>$))V$_K@k|?SDNSq$sI!xM#diHt1C3Avqy=ksuqFDZN_0@yO(Su zJFqv#V8PVEKvSd$+dXiq*CFCK?Km_20}Sx*M4Q_JsHRRT@hcD;t0(|K8WG^gb?J%R z@HZb~V?bDF;|6}1Ej1e3D(yC>5Wef_pe!-oiluu3IG9SVN7#2=L?PV~mmNGdZ{ZoP zK*_2x>D8WEGCw`pV7)_DVAjl0c8+EdZ!k9dMOBOJ(zjC{-iyu~+xgO&l*Cl?aLu2$ zWOit>ExI^WT;CC#q+*MH-_Atu%tw~@@G5}OyCr`dfDO025tULe;j zEc;g8DCehTX4`b3qJkHi$qH=lx>~h%J6tgbxL=l#a zP!kB?7ZvkkVC=6Bp=1<`SWdlv?PPbaJ|6r1yRmL>c&%_Rra>qOPD@(4T&f-n^zxuVXfz!f;?SQ01d8_rmqHe_&eY$vLcA9&RcA z9~H)ho+1|m4*(t5VXvIRcEOs{eAu*lN}p#q_9^!0%f6#HEgPZF#4l> z!zPz=f*N3IVd&@2pW_BNBk$v{_|vu+eF9#N0e>7}JE6j)bdiptIXF0orzPcL%}@XP z{MGS8RGm7t-s0|QvoX!p|FvxmH6TY^5VIa$vo||fDC}D&0sq+(7u?=PZ-uzl`IAUh z7nGBv_8Eh1^TCXo`qN|{QElFpC-yL_i_``iBmd@F0gdfH`q#eDdix9mO|;h#^^5%+ zui(Y08)okYWBAB^nmVN38J4-!Ep<9*YfN&!*Zk96wR39W=B!5c;5Ek3Ux;f#t_*x2 z)N+`%kW#e;{msPPZv}@tSU|@A^i1l0_JRvI(yDv7k*_>dq1AV4A|lzi{$ZmY3RLG{4Ox+-S;A3e|gpvd(-iaZVJ#zXqGWqidk-vneM zajeFKBJy~G3mU*zhqE&eymzI~Jb6U=cQO#^Re{ujO2%!ga7(JtT>m1?P(ko~_763J z1%w1>egC%8^~iWJk}W&mZXLqoCK!n2YXl8imGBa`BsVUoI?c{*KIluf3n>OSqNU1# zdh5iuA=9wBF>x$yWSUV7b1|m%-u~8ArxHgCB#sH7m`oO7vCSZyTMone#vb-Us1-zF z#)Q@eaSsr9lOscg`vfhNb0wq&VnLimy(X>{rV;qXzOCOP9C%F~@vxu+P_Q{}et z9s}h5NmEO6=A=O7n(9Hk2ws`v|191fRy1kS$opL&X06Oju{-n1vl;FL;4UB73P#)% zhI#x(K&U?ZUw5BXU#eD_?DCZJc?v`{fSd;^Y~#_>i=^1F)8)N;VSE3uy98C zTY6(lAiy7~%AzTcGkrI#FzzqzE6IXW{*??Zl@zw}f6H-TL)f27^^Wcq18<2L@3@za zS%Q-(KoUXaNCb=syeLxi=Kc5ZW{w8{F(P36?+#VxusvrNt4fsTX~{^UxUk#Wjr`q$ zDksbEGwl|UPU`{+3gQlr9 z%jkF7c=5+Bw5oLbyA0-jx_Jv~9-TpUmJ_y}JXijK<(_pNj*B;l6*5jJE_hVbJhGJz z($XWcy^ZkuV52SO%99TKDQe2k)Y~^QWMiv-`C5pjH_I7`-qnbMz~}9hC#rr}&$am- zO{TJnF{{`g{@2nIH*EhWsCG1a9SK6P2D7AJ$dxB8ZISh{&h9YKkt}bC$XnoS^A~u*{YVrreIB|63*L_Z&5;Gj`rgAC&|*UU3p9 zv?XQi?Emcnn3D?%_1bjIPhVwOA;XR@#8-VGQX_ATp*OP3)6(hCK;LhT$BbaK_} z;1e#uQ`n0aE6`dl5U9W$iW&%m%m@7EZT!%yIP4+sJI(-MpIKW?vQP^*ma;e46GyQ5 zz>Dxmo(dhxTl2QGhYfn#5YR=)wu5izkv{)%Em#s5W&QOcGYhpfB~lVncpVSb(M2sU z(qxE^h^;?Eim2L`OYzFKvV@mBuYu&!fH)L?ytsZHTrm8MoJEx-%iEAu)U@t^?nlKf zRYfaa^fxG{eh`}#Cy0`;}B45>z%ktaHByGZXm3< z{;aK_nT?e`@(};BFJt=%2>q9R0iddu8*Uf3pB5)I8G5d2G*bH z)L?8iiRIUwpakqNYe-~^4!;=UmD6Os-Zfe4(Rh$n=Fm~wCDUcTh_vrlBvb#`EqSY< zxRg1S^io)N4MwR(@`T@AG-rM%rwF=I)Eha5yn-dz)_M*}%xPIoX@=~!c zPG%~9rfjw_M0+B9g5R$q1>b+-{KHX(LH7AA=yIMP|Vmz9X{l_g^Xii*+pE>_5Xz_0zfG>YV_2P zE2r$>+sg)I#DUF0Y>N-uUxj(&l#>T>Bl_i0`euh4>%Nwn*t ze)!sF;mHe<rge_lkd%8YHE+8n+MX1#WS4-XLVIQ5hgM#k4L6Al3|$c76d5 z*OK>JBhw8EaMRcw7$Nzdw19R~XQ&KBWwut8aEwPZY!o$z^yJfjsF+O*z+IFuE@BE{ zO+}NRQ|_wk^GI(pPnPDeV@D14SnFBvu1NX!i5YO^|NmJ4kEZa+>0tfrs;_nvD9JV3 z?TW8z!E1sZE7gi^`R)5aOy7)wGL%BMZ#R7>!j2V;^Y2cNdG{s2*W1;+Rb>Y~N|$d9 zhi+DW8EfCpw!OdQR6Sb0Yx^5Og5=|I7Y=*{5}u1v8yiUFMP)MZrs%%pLHLY`i^i^~ zg4y6qVbJ7@2i(%9mP*_nB3=rXRFU)pXve>NdYGk1yD=2!y*x!njXym3b|f%QwHuMy z!1z-y{0T0P_8or&a}JAo3cItL=b2lSvUbjcYdTOdVOGvF+9{@=%zi1@D;sLofD5I*n< zKjU39<;e!PzZ5Fz-yKr=0_3$^9upX+?-vQol%?*s*I1TRIUlh1p z1A>1E_+JvxIFn92LrSP}UbJ&m*{gA?1^ zOr)=qq@B02m`gHAT2JjlribpNl}m2nFBD05F97}QPcL+_e`#2e5Z=qmBXc1igYx>W zVxHc!(Dd7~5&hbg-0~3M%WkUf70{@23EoPtiEK~On)io)8BOgdU;Vgm?mTywD`bNij-F&J{QxQ-1p8#mJt%%%IOUOZ$xPQ|ANc+Bxybz= z9_L63?jam-jzJPH6233rJ{)6H9;x4oMg$J(Sp52I{cc}oopd)I6kjw9CU%p4z@23C z^3eA8BtKkq9k0C8UGPi^oUK&6mhe82eSBl`UIsgkI(%S$z8&g&L*7~tC@0xG4b(o$eK|a272EMe7MLphs#g`d=fQM#cNZr|4};_G(J-GLEp?|Kr`hf9j1emw z#r9+zx|5oR$#$w7zbz|VS-j3>3Gby3H&r`YzpAX`qp>r>9mzaez0Px%Up3M#;=8lI zTM?>v-(MfK4BIw+j^4wc3ff!rsBtvd>p6tdyD54Kye@hQy2jFFoM2_!n(h?2iTx=s zRNxtLNSD!K@s2T)nlp!+=NYrBo^AP#nZ+~_%cd~vEp<~YsL4lB$=;)!&bEa(nYz2! zDeIc&nK4|n?Qu}!nSCOB!#nW+?FfHefm`y3-h;qBW$9f1^l@@F)fWs)<O1gj>dY&W1dG-d3miA?4niJ?lhGMkCV2gcSs;jC1c2f zG`P@^c1!oVC|UMtw5;!o>!D0V91}*%b-|xbg&YPe4MblZ`CN^W)YsNCsr#|k65iu@ zt-1p-E>&@Y9ygy_Q}3OqBIe3h#|IfoE@>OopDCjkHpINm zoJ3;(w(P3sG_j~l_8D~%yZIv@|;()^Hg1k6q@}mc9D|26_!r3beZOX5v zom4Mb?R}FPO-h)dB>}-4(~;EfpdtyVJ*vKboj5OhJXWTQv>&iGibbgYG>f?JMy!5| z^mzLzS<5Op!D~#RqL~TMat?{jolF?{QaagzUxTuM*=q9Y40qUR?aSVUT#fpJ1$)~q z(_bue&c5lo0vG{jnV)$|-D=okV-eUEA-QRDl^0z!H@Zu9B9zv8#ag$`E0p$lWT*N9 ze3G9X@32k;7J5d?dOV}Mg&+Pvch;WB%nOWmO-yKWbKX%QRsA-| zUEmtu=~!A>Yb7+1JlrPpyRm04!c3z+^djj%5-E+4){d&24$$k3xcEp z-rrt;L0OCXX&0wDy0rtn3Q z*(Vg#%oY?#4IFUj8qW{67U`gfxzW>ep<^p(c-&rP9^R|6}ScquOwS_2ELH#UW6jI0SchcY+po zC|=x(Tan@#+>5(waCa%Lh2q8C?G3+s@Bh5{l5>)^ncbb)d1iK217g#JE!@i;b`+pt(8$_T$Q)pO44%VjdLNhCDhU5;%6LTGd73BYqA%8^> zcmmu>O;>&X-(aCB1t?*GKlf*xooZ86WG zweLU9{12Vb^bdXLvb8W4Xd4)fu0uvaoJq6d7;ZWQgS!83UO!4hxf8gx<^BI3rZj?# zXNse-LC95gYJ80{bA?vhXlc^viFAR3whPpbhjJkV%9{3&cDbeh`1wElvXdfZ;-31D zq53z|gJ$1I)iN-#v%MFD-il}OUxWun3v`g5TU-uhcQMW|LU-+*g0zvcyEW-Lv6|1E zm?SVh%b4Lf^asg!=&`;9+l!dWCzwrqHVwO{ou}F-6V%(8Rw>id^K4dz>_I){!6I;8 zU-LG7)_61cBG~W1hQ+*-0W7CRyOG^QQn@XkSb%grPE2^_v>8ftxS9CYH6CFfGh_Qq z2UdO{BQaXq?22X|f@gjG=$^mVqp%H`m}Z!RNdA7-R2?q6D6hSSFX~{ry#OQ$&_1S^ z?qPi4rP^sy-HWK=u=Qh&ey73F>zJ&cmMz(B zip6?OeckeNscluRWKqBN#^Aupu3u%%fn=-A;$959p;ctX(}eEso=n;^q|c~?>uw~j z@%Y?DqgA#pl-v!N55dLp)PbLikh{U_%~LlB^`42IxR8?2TI=s+pdw#$6>L2p!a5m< zWnDt#I>N##|F>44(F@daYwZvXY;9Fz5_((S;vy!!u8X4twt&XyNmb=0{E>Vw*7ZFn zd)n-VKO8>@k+ysPIlkbNSW=s~bO^V0qx5tJMrMlg{-{=JmU5~I3hY`pH(p(cdH1mc z{rgXWtFPWc3a5LvJMWPXi2rfHNg$|dD=0C@)Z8RRgUshHR3-!&P8vD%B%pVcq<#oN z94#`{8UGx|iEA%#E?ZqgQ+^w0o1?B+wS*9YS>uA0-Q=6{mGMF(w$U0G0)+&YgS}0k z$OiF{MI*<vaD0Fjc!8?Y zhsI={HD4*OFXw}OaASh?ga?B4xXqP3@-V%V-ksYmmptA4&EF@5k7AZ@puxe%=h7hF zE+M~l!t5g-ocQ@2;mQLpZD>O-HW;^A(Nu&F9kAwySMED~)I{aEy>%b&A=TSs zleN^v9)Hhhx%oI*%xZz-;?6X_MQP02!-A>TH*Rm9>P z>ekK{CP#kuN#l+yeqrMdeXn&|KjIbfDNC{0tnZr3l1}NpyD$FjI`E_pM4i4~b^b(` zwbzKcar=4GJ>+f#GWf+>_3R68Xph}H>A2&$Ap7mq?jPVbu=lY40tSngSLP@7uJy?7=jy=b$R;~VYk83Dk%lM|i@#MoS^a(=JE@&t zP3jXtKb&zaHR2#Yzn0t_Wr#y1x6F=JSL!`ZNuyk=t!RLX|M$ON<0szt@0{?%wIIWQ zE@Un2Yg{QzAh_sF+m5M?hd-mT)b(A0!^meCa4rDxgeIWg8G*2-Y+rsytu%FJ(H6;O znSAZAyqSuI@?rc&4P7`}K{K%=N)%AdfN|U;CWS-I+S-aKg{`IPNB2xm?9#axbAwvTq2zDbcGy7fP1-;Uj_jdbVr`DG3IQxp&Le;p%ZB#AM zQDb+wE~*3THxJAzgtj#yry`Z(nWWRM8<84Md0 z-t70yam@yKD7en2tpc5a-WKNqpyeWun+Lv5TdJdLjIOeOME0f(c@ei1S?lD_BqHTM zw{Sme$&4^j2@e7m%KE(UZ~bDvtGO4;yTuk|lg~d=zL%<=dFfKZI+4rN3RU}q5}j>p z(*(bLtO4YSswYoi4lu`@^hkI$ktl7!>=sJ(rkhv2d$DGF6^CAi_o99=v<-;Gnk1?* z#{!ZI)|RvvmX)Z28y+`-wj7S7zD{?7=@!D`tKQc#OA38t4HGugO1ls2W-mg?v$3xv z9>g+Q4cNI&6tJ1$I5VdBz26RG%^y2mIz|sp`aFyZP>PRUGu~Af-*6 z;rkx(34Fri)E2@Wo&~H`e9h81@sg#n@u_`Ia{lXRr(JnJ*?73(g*F^T4vteSm&XsY z%s6|w(~MrywO#FPqL-!N#;q`*HC;&^83~bnY7xrC=5$sws-M9DV5IF5N$~n066>Q5 zY<|9{**!F*(yAiRp3s_i52XPoRQ9`Z{hX*d*OOzIWS$t`m1;bL#&+~Awe83|dSA;r z)DEkJeltofXN7odZ<_$yyHPgl3aeUW!_1So8uQKJ+bAi_h22cf7WjZ-9%E9Y`yg!p zsnY}1k@9~{ryko%KEO^fFuVTa1SZ-Sc`dc&3%r&xqN_ zzCP*FU6^EjKe-jYl8^?WinZ-;Bo=$yoymNkfdBcGcYxgWg5)YEF28A!d$)4FxT?)R)UCEBsUQ9hOb@-r11tlR5+o8f#XI^uC{B20 zQLzgRoqAstRt^~s^92ap`(-Yj%cFd1V_qTE*_z&wx0jVgcaZzT?PjNPEQ zQHt&`!9Na#NQY0#4w^3puQU60ib$VFZT#miBPGQ6+)vT*)6Nb#-VYMPa{dC0zg_2U zSTWRc;KO}26miJfZJo~^V5KD)Xjk}t(j>~XX2L))+};X+Z->`@62iJk{k|srG8>xM!s_)(2l}&BaW_qckU{1!q zP+|<}IXto5Cmd8F>}Ml(#(8DK(AU}^8!6$QuQJ1%$F_b(Imu^ug+&Kcp~pkk19NUx z7=Mjn-3j_zyhyD2b-k`6Y!RMFiWQGSkVt*XQN28PBfMD)&hqncFXfFbh%bj<5ISPQ zZd83c$8$2QyEoS{UI1|zEEmn-^=xXtCNbB^@B`B2tsvxuc#M^hls50|dLBv1`Dv9%CQF`(Yzf`TB~GS()W|;`}w* zp7@{nw5Pcnjr;ba6<2eNNpAZNF*20DDpNQ(=8T78hH_={DBg~n%GgnL6#3wE5-m&h z;=V@G<57#(uY7P$$5rcf%c$yH|H1)Dfok^2Yup3bS`3JTVs!Lt^feW)IwtQY@Qr!* zaNIGg&GQq_1LMnGO*l;}{-}_0B9ZqL)^2C$|2<}3y`S}zQHAxQP4A-aHqF!u_H`ZC zj^L{HMC@>k1k3c-yV@Wb%fxYMh~`U)E9{J`raOE%qfK*it^(&)^ZE(dY{b zF(x;mCK#3W;doLsh;O->*ev(6&rj)$nK)<`ifInHow}es719CQSx5GKEhbkHfs{ed zZDu~ofeU44Y#6=AQ8&SoO#~bS33>Gew(>m5pP%z%`3+Z1DXVN6H@KB9pnT(M`Up}F z9ChPa$9woMTvUt*rsOv2*L$2WsvbAf)G{|Doo$!*q4`V zmMqhgKRrPPx4s|AVoQIi;k$~);zR(>AE~JBj|xRh$a^}*;9l{kX^fJDV=OqjlN0{I zn?G8+Hh~~DUgO9>AUPTFgRV1%AwDbGuL+avD#HTVr_N_In|L7jCd`-%9x!6R z$i*e@K&G&YLrJ#5gnbE?+`$9vc`;#K_pU2aN|YhehD5y~l`Tk?(ya2Y0pD%VxclbV z*5j!%drLMCz!-=cEuypEG>K&ae~zts+M_+bfpn21o#J`0Ka+3?4d7_Dq@N{tQF-s1 z+~$`)#O-K^IsV~-d5CT(1L0{)E%IOxx<@~f{Q{L!*#d*X9o)60hFoqdAK{%}poX@% z$U!=*48|d;nr$(`2uPBHN^ruJ6n^FUi7Ey`g7T4pSY51yd<106ZpRXA5zEF|lgyfR z%J!LD{des>e??`nIFWKb8BU1~{GJcjFP)`1miU{gotjYK#b1jWWjKn*dT(oyQuU^q z5irsWgAgvZ!p-@-2-o}b2e5IQkLU8_N_`$0CZ0Vcwi&$8xMZhh(U78Zzs95#PG!8G zCjiEf<#Z-6t?(5um_t{(&bN+Z*uI`-VAm!((SrCw)UsZaAw{zDIxTKg%kOfPu|H*C&jmLO4uY9caHN8wT< zb1IQWKvPs*MVal3qSoms9+~{=Xg%b{E|~9ueh4^Tlqq1w*bF?gf@r)HF>(o zFb)txQ$pQk@E1i%B}!3fe?J}+Qg2qZ+h0nGz1!yTwa=;ZRvUv$4$Hm?s`$YnQ%X$@ z(xu9lb650Q4!)3opTB`G6GEXh3AiCl2}0PQd1Cwbq(SnvM>rJ?%sRSuL=h5hI4lp$ z(%bZf-37$LQ=IA1IfjXpq|bK<0%G6?MY6u z1?oWtE)N(xtD?(J;DgFOrQUOyP1zz}%AM~MWM}>e-_AE{0XPw|=~NlMRLaX! z(9{kc0U`p^EG2PP>$+Vm;Wx-u)6BrBc}q)8a8GlFdztZMs@^B?pc;i)luRv!M>##+ zZK&qOKa}*V_|&8*wJ%IKv?kwm%B9h+(T;ZhsZvJCNw86ss88(QXK~cs?I<*!>>-nh zxo9B8EeYBep+a0Eqh8lah&|K^&*5WdoFXCLPckDcvP~Ht(cC&A<8os6@qGD1G36QI zk^K&!0K)}H^2FdJN_TMsm*+Mh@pH_RM<0Uv@WVuV!1Ynp>QxsV0;bvH`F@h~%NORT z&lgO+s@SKWyh@XnFR6iaKn54(P9*1dZV7C@zGTXBEWCVaqb zSy(X~wONw+Ttga~)cZ!rDlLr%Xq_@@a$6rLb>_e-W#k<)h6(**6Zu@L5*}tX>J*)X zury9I$vwu2v)}0vu~??bOMX>@;nYiW9TR9pen_sxmuzXMDeIDsf)~S|=3T*l$EosS zV%i}Rn)w`#T1ZxnaYtr6JhE0@mdP|AU923JMUfN40vHB49~> z@8Fwf`>#aWiYUJ7h8N_1rzcB2;k{PKW`wJaQhY;s@df{OVS{-%Ep%z;iWEPX>zw-M z9i?pxvU=~}R|L2@_rLl;auZ3GyM)gMbB~}AK$9udIPoenXOa5|-l!3v%x50~MkDWx80rd<}EKa6pzR?X% z=;xlKYr%(-%2$qy6qNWxjkhaS!|;vZ7ZQ7*O(4g z?-TnNRTzu-Is%-Kli~YvcqIQ(@Frs2Cw%&jYLrkIT8i*5X@Y0)QrGlpZsI}B>$iaf zz#~oz6hT714xYYnfhNFl6mNjU=Fh&&R!S*PNRy7r`e4484&!_$TU>?uNUG6c*+_Gq zLyqgYE4rFEIK1K^KE&U-p*VKv4+{IZsUv-Hq`i{Z*km3G6NLg7nGgIis=oy(*bgbFDN<3j42|it}Q?OJ&wsShvfGScwfWClO;M)gk@bDJUq8BM&=4E%t?xWhelW0 zzNd>x1iH1+8%(b9QVrb=FO!Tn9hmi&$F@6yzi?Hrvl_8Xi%^8~@kuE@0(8@LzWhA; z3}f=;bxdkUy|iW=V^|`x{##WZN<*=DOxLtIey~1%m>gKFL?@hdLEP0lb|a{bVue#T zkHCaSrSmwZLKLWNL*D5v;6;fnkS7RSV6(~-^mYQa;ENQ%(wnfK7wg)&yC-4`*F@LS zXX`!Tk}bSQgIp0qC|-xP8q_N;*L% z6Pi*q!oY)-jbiTRYaox%H0Lgc>;l0oLaKrw?L->38PP$`b{S@(2Bi6kV)PwuoE1QJ zM>}W*ImT~bI8dOcBjP9Y#lm=LvMCA5CRbHyf-vzwAQgMJYmU{jzT#Hne-}DJ$-f|+ z%j72Otn=Q7q`M#Z7O@R4m_Ah%^Jc+_>W!D{VM>97@HatvuW~8Y z2ze(mrRkg~-|(53iVO*5?_et<$WWHisgrx%K&hsm3u4Qx_f$pQ?=1~8^KGE0B&e`b_;UX)OmZ_Frx)kC)c{BZsYnGE0*V;GNOg60Lg7lh$M>rWD`3ys zjGF{mTQ^G!-UdJA9c3OybEsDc8c1Gp^mAIM@@Ae35u+j;F@-7x>Vtd0gax0~bBdJn zF$T-RQsk1mNP__H6@yKHEPR+TrV1gDm}WDi{1BnUEfk81X(6#VHbzz}bVCBKt7YYi z=s=sWcOcKAcJJlZ&qoQ3G6pwc5Ut;l=M>Sy#ZIz()NCpKvZiX7@8Ou^W>qQUBFxVz zaj<3aB0xWy4{W+{rX!*+jr`eH;;*8bZRvujr}!(y>GPKfsKqFeGgaCNz309u**3so z(j-m|6mc!d6G!^o)+*Ay=Yp{=TOOqa(gX@t zjL=)$1T?z{ftlUzE*=XWM1u4ycHKXOs zVJR@F%2xC2&OuYx<^@R1MOnZkUeMWrxDS}JCQLo71BOGRR09y59K z>EnP|7U^-!H*uXR~8;urWzk20azo8l|=a?&p|UKgs}U~m5p{+SZqJ=6OG ze_T}v?ISmtdmSa%EEHG!mFAt@uIhA8Lu_?dHD`ERX=JS(9rbX<^yJpkI%X$Dn-lo! zymF`Ra2bLJ&I_2KLs-wBf8RjF=oRT@BoF+`>#^V~4sgc%r7T!Nyd!~-h^`$#B)bZ} zcuu~8oufj$l%2*X$%nXmk(OZUP6z^4JF!j$zp_OHsU_q8u_Lcu_8;1#vMUkVR#PPX zqdKA9w^4*Dknm|AuM5HyTYOvpxP`Gu;4gne08&@L1SlYw;jHt9h!~2Ae6TWYmiz!R z%~Vx9_yvAQXm8K!&9$@$wq{Wyf6q?d!Gmpy*=OPv)qhq_;pFI{)$(-b9)nQY&W*F6 z!}^Hpk|4);kYwvJ&b3QFQ*I+#Q*qyU?^RyJHmfDLoqLz4@HqnS03cQ(%LRn!-L^`u zWi^p;M{)vc|J~872)ebZ=N2-Krp^&s$2l*5y}3rM-&s$yhWhW8^0e%Fh1tW}JuBu# zhz}aov;*^hwFL|1J68nB@!S1CEG3c=Hv1$E<|3N=g1iLgU`%cIRQO9a{A;Kx za&X&_T}qNYuH5!jI}oX4@)AoF3y=`ey;+1ZCbPMyF=M>)(z=F(zA5v`S80-(V6(|3Zow~BZe#2#cuwZkiX9iTqNcB1PG1V0Q&#ecx5!ma zR?otxAT!H|G+Qrpz|=-7>BxMrJn#qYk_knWaZQdM(*kb7H^on&jQthlJo`zuZ582Z4VJgtGgoRaU*@4d_ z@9Aj;-{id@036gGHtsi8Dv`p`fZ|*ax0<8i70-3-9bABTJI<(+Lo$7UwURCl>u}rm zkT2j5v_igtiOXlUZuhMkdIyX#DfSPQL}9zE9#XXa{&R!f>SnHZU29yj-9@Tb@X9K) z%1Vq31|^7czSs=m-g+V91PcHNLD<^h)2mt7#*2!@`61go_AE}E3y7r|)3x?SG_6P4Wq4g>uGM_V!N<3WU zbA0~F`_q~9F$+s^`j0T{g}h3KJjO)b8Nupka&!yh-VT@BYsv;e3uiPZs;OtxC-IKg zjx?Zvh&|=ZqL|)m<2loG!ebpjNj+Z3p4J|kC83^_WplXQRM=*0L<1#+cps*RH4-_v zFF!XsUrEnV8HI()xr?Y#bm8h(ba%jzK=o(vwHhq|)=0R}1kWjEjobtE79oo` zMEIzlQwq8;!*XYdTpE+E8VszLEQ}>l7}%*kKB?MNM@speB%|`Us8123H4feI2_%x< zGc7vR?E6y$qBGQ*KWm>R4TKcD1BcU;6yaw8>sms6ON2kssFg^9y4_^s}C=y4ns zPowAwXtkxtI>vrV2#C`C(-C(f0^kmPT8KpEN#Y$5`ie@y#3l|h8lb(Y+;B=X;?QKO zz|eo7%t67Cszi)5m%z6qlrGn&!Nt55AakZQWmI4bddc-xj?GK>v<5`Ukm#HmL{-*$!2-<#{)f#MEO2UN|e3+#R6x z;nO$WhRr`YwFD&bKireYbZGndRo>}m0}*&c+v?W?)AsBdk89EXCjFGtuQIMd>$tT@ zcEuD*g9hgCz#@wM;2B!pvqv-&9P*aENW+JuW<5N?96lw@PC8k%!!e?oHF85^V;tZn zBHo?kYkfAX)C&4uK}aFt5i+!4n`~OacY3Aa@=jX^)N_$1ja^yBH;L{9N9eyT@k`83 zD`&qcsz2{Gx^X+Bcya{V3ZcI`sYn1B=7pM2&6@0u+K4Q#ZIPN>?c;oWayVhIHlL_o z|M-PCA&fNXX6-!}#0=+OcMo7VGf`*gD1P`XS;7ib8vmI&a<;`cyMnwr4ucft!*x$J zF=jmnCyQM#`i)(_+?BN>w4YHFm`%FYPM_75PG?~A0(hK5xqzMtPL?_pHz0}R5K6lR zg%F67hlQ{ZSfjw1;nNY_RUq<%;&Xm{3?vz>2Ta;IQ;9q^;emxRzuFFANX{C<7j?+B z29Cy7-yVOX1xEU>F@Q8Sor0bs?0gs6VltY4Zl+lbTH&}__9l8e?_1Ts2<1dD)S=dc zzrEhbAN>qd8~IW&qOn>&_o?>ZTRZb4Fts!|bdo~XgAU9E9r*CYZ#BCfNMp&YeRh~R zLdMb$*#mCV<9)9O`)ldQcB8I$ablbM-Jg%S%ZCx&!lrEvarr^MDHOSDKX zpxE819os+|vdF0IAxENVQNTUR(BW3&m!M~8ZKhPLd%gcDysEii3Q27wz~eWKcFhiV zWn*r8%!K0{(Stv2NEgydZ9*$fcJ&+CurLQ#nPtiZj{CVH{#Wa&Ic?m^$}h0X(|Kg> za)TWP0egZ#O-*JZ4!aCt70ak~3_1PiE=PRMCu7_Fl(uL;^jZQxfxYLnwI|hf2-L*c z8$GZ2puurKi8j)HEK1pR-p37)fAW+5+76&uR%bH)tj$v_DmC@ZK3YVU6oWY-*U#dU z*-BEAo=Lxocb`rRgX?(JiU~H|VuzmGC|}6m1hF~yzO-m-&tu}Ujsn`7iPXuQ%|EI3 z%3~cn*P20?$fZ-n_?#b=o<@ZTS{}zdD=kw?BN-^iWf>WLh3JX?WmBTU9u_1hr6FI1 zLFb+ycBS4<*f8Rl5^ zJ2#2UDb+CWkYe@dt9$tnu;y2~dxg~A2^u6;f6bn0zLluD$0vHU@@Z6^6johl{>>9| zy^5RJ6nyoz4-Ugc(y&V$-13K9(#B~I*U!YW+P~|Q-A*h7y@M;+Zow~WgNT~tPTR<= zYa)%@KG%=es-?6aSSlo`W?3h4+tw0dYmlh;--HubF?Mzgv0buP+>d)z9L}q9d01&_ z^y`#;K@76V-i4O)OWSV+0z)6l6vE_Jr-pv zi>n!;07yN^sJn*GSLXByiH@R9&VRe@4j&!MklH78vIgkmcH$}M^~AFf_WnNqnZFbl zO8#}7bcOIOV(V>VbFsm;O1i$t^qsthTGTG76{N?Lm~HE0n8RmFsF zA5E2>!4S#GXEtZdjf!bN6Fcm~Q#dR74dQ3)(*ot}KTVZ}cD!;RcCJIS!zQ&D`@AS$ zUvp{yi$45IyL9;?z%3ZdhLepGg;*lM2tyf-P3(!JV6Pj2MmHC@{BuUdL?z;!3c&X8 zDkqrcGS<@*U^~CqSzx^km^0Qm;G{S)ABT6k*BC!_yYfi>Y}I6N3Noxl5!~8r0X++s zzesa-T3%l>jPINDiv|YOvU71^xCQ2?H+HaUNG8Y8AIMsWzY(gLU=ca6wB^p`&2OTxV<4O{Z7RRVPU% zy<-^UFg__M-j1?zsI>@cz!a-6%S&*J$C-e3_I?T;7o1l_{53hqTX>ynex zgrM;)7e&w~aRwKRj#CguyJX)HuH>&ZQuBKs)&@-r=0$6Yb6L)tirP)V+?Q(km#kgR z@|wY|lU~HkSACy5a5?-V!T7Vmb(qVg{((|57Q>Izd5^I@%a%geb~hAI*@tuM-x(b_ zmz=g1RB$CzaSM_ZK+#_~QC4LQ#xC zv#ztgl7n_rf9-KK)@N1?E3vP7@gK<$q455^@|$Y;DhL=#b^($r2`fIYI@%M=4J2<) zuMzs2N{}{nuwXO|XF2k}D4~C@OzXQy9L40J2ZlJAJY9vF;h3+KD4o`M0P5g}la0;x z$18^GRI``tRr$D;o;ljS7ex`{)#tssckXZ}YF)<@Fz8aS>*r%dkk4PuGZWX}hw+Xk zG{kHx^gepMhY`GnNZYh{F+|RgUT`h(nuomXo}BSp`ToInvai5cQmrj|e&$-@EQCE~ zcYV10Xd^qgF|NO;V*IDpz2_VE^E4OznyS&qHNRxkVYX1YgPZmCHQCDY+6jBYy4BJr z5ib4?pH;=@72mSvl8H2fx%|?hsz(pL6a{2`yz-Pe6(8$s4WKVfa*V5}cX-MKD&%>hZiL%wO(K1d zMETjMiOvw3jgw=7QtpoV@g^OpVYmR(S+>V)MQr%{JvbEkpD$|}7ZHDMXEM0lmakCy zSvXfZIocm(E&q_0a^v12?b5P+FvD#K80vEVwLZ{1^J5NwF0azTJxrW%c?8J!)K*~#mONZ8ec0CfbzsbGse_uX%)#on4IH89d#ww z?13C%`?q7!3&JNG+J-9zUr1a#6@d;^^VR}Ia+CG6(H?!BmIq?cC9PIK=JNFsK~XZz z#XF&2qUfilaJRzpv*j3{`wLnC}lbHq)rDkT{t$Ydnmxt0%JWoS=H7 zDnI;4ZL7E!Ih0xNAQu+8j5=U%s*}wq(;ab*R<_x9E}Bk|Sp%z0f0-U$e#uWQ@pg+cB>39`&&i`A0lxNiFLVA?__(_u;l)DQ zTujfQMMye~-PNj(ufvDo%5s07i<`a5dIk+xI;1fFxN{j!`WHvyl?pnwpJ8McaRg6r zVZ!@=>lYXb+GX}Vw99*y(=yJxh5z|iE#m4LhF}yG*nBP@JY|Au-fYga5WVlSs-$z} zo>U%Za&W3@?8L~|ti30OP_u2+ZJlh>Y&a->PzhKno!|N;B&_L`F|?~3MdVBzcy&DI zwLZstJQZ(xh8$F>`G+vPww}O6K1pV+q?q&pnRQL|0fl>JayMO2`X%S_3V)Q^v`&3b zETamO7@DmYtNVB!;{V;s8{wetS{t%SaT=XIiOg$IMK<@a_okwlU|=PeX+Dw%X;h?! z;X!xoLOOYDBtk3<2Z@^kpt>f$*C?Eq6JDdf4%qh$$V)EK>VX9`&KUBy(1fy^DvYTf zt)0Ed>?ff>{Bec?xTjdni429U*lVxG4_43TKDTR1}GnEdn+g-x>}U5Lh3 ztJK*AfgunJe$Vd;nHFmcR1;Tk%`k~RsG~Ue*Cb9AtD-*b`A}? zze^Jf*Xao+5N*Lwtpf`CVTy{wE67M?QQ|XUPXCRm_Jm~Qf;v~q5?N1TFy=-Yiy34@ z+oW6`U11m<%kl{r+qYDseF$kEH}|9_ZrAgX3BW6NJ~k92G{$RcKgQR7z7Tu8cY&|P zA&wzb60SYl01K9xvh`W3(bb@8^cz58nB*sQ{fG3@7_Kmu;kBQ?{nQ<`(U>1Zgrx5d zFQ+m^kZvaru!CG>(%4DMfWxk}qfQA4g>p&1AzzQFK@<6#^t~w?46n>f0Ed8-Be$Ww zJ%n-?7zTG2oi=o7(C4bAu*FrT9xgJVgq~rVG3=`{o>*tuZ5DaYm3v&9AzpU!qiG+k z76aaySj8t3pub^Eoy0)l9Mk<&>5CzQifd~S^i57<>OS_ylGmmoEACH}Rtwfglf#1X z47st&n17%AC#;j6kIR5o@A28^jU#5_v7gSSGTcWiyqsa_~HWNd&-N@4MlJcv_yZ|1a?5}eavIDl24d6L=2$g8x>NVGj6X}j#e__h>JDOwX98Nm7fma^ z4tD=~>cZ5_qu}7(@qj+Q{%-@O%*Q;Uq0Q31ngOS57Wq{4NN3HxV0`jx0by;6g}uhu zW{{qSG=n&63q^5>O1ZJ3cBKm)mBVIV_0Eu0vm~AZUZ)D4@?K)-2RBvx9TPTA*XM{P z?Wr3T=mVv3e{1;)4z*&-4%J?R7*g}*FGlo}3N8puX)3^@mXCfUP2FBCfE8BV|T&O9hA zBt!y?w%_h6Xh>fhIJ)=a!yQq@zF{OL3yRA>gsOsxxR)O&j1^oTc)cJK_On{{0Pft+Re1503#tUo%(*(`Fyhj<3;VW&RYJJjk_MU;p_MA zxez0|Iix?weu&b(a365o6^yzTG4Uk zSYV#b9@bTj_S|6+DN)U&UlH$cBDtL0ejj(+=h_7V4s#8LD@ zmq0m!Ji3f5$TjY}xe7)3>mCsoBl6c*qGPfbdmW842JKZOt}?wK1g&g_AT1L9fl*Va=DmXvG%}nhCn=+H=51LWe7Kk=6EI!GlXoDG@itp(@I9~nzA*-jR^V+V@ zRd_+51wR}ro20f2gJ}CWVr1RBqsE4Vt1iP#Dd6yPJgGlUzVzA6Wn`JzGV1I)=?LM; z{>In04E)S>|3v67=hAIm{(rdue!RmG99naVnk2O!jr(PYeg9ysy}w4kK87A<+Rxj; z;QF%wt$jn~PtJ{dcmK8C)-;S=H7ncDp))5A`$GhEYK=)hk+?3Oko^VT0=A#+m8ATp z(^jtfmX;w8d_Yqj#*pozWt6>dC-#wVz<3P0u9R}>_3L)T{7cp8ym`rC`POq3viPrk zR86hkh{liO*w-6qFV}+e*MGKf=fg;j5h%!Eov<2;<@PqOBs%0Z2HDewsDdubZwvmR z1b`@x%NzC9Er{y3Q6I$R+EiLod^Hayh2?PIri~v9O;ckhd!d?@m>f<6Xu0=rgi}-C z7XJK)4t1~SS}U5+iPscUzmk#Ce3Yn;5Ttv;)3@lf9cz+I9$X`o^cdMO!Fd812)*8$ zd^=zHB7CJKyNT`7s@sxHo7y-JISgsM^#%d7WYO@vX?eE=5&k++I8d@R>8)QisOXk- zE_&e3*dOWnDO$m0kWyVApAYlG4oAJyXjB?;y3?*HcQ)fyIH5mVf&xq;rKA{aVk7Fd zqDw*I0r+zfy_^&2|AB(hBF1k5T1%jvTl#OU*k6s*8FzQ*H@pi9wG5Sx)S>j7Z5Sen zW+=xw9#nb!_fHoVTmHFUuAy5<20if)bSR@AVTpr3NvRD{sB~o4$2Wy9QMn|3lMTw+z5o^(=bh6k@iN zi}fd#IgS5==qT`^5M7wm?BoB^^435Qd8~GBX|b%LxNb@+J5r>V=yXu;5fR@TsE2VN z%a8KEl>GNa!3m28N%be83n>{ddC?&a1qqsDXZ+W5N!X8Mh|KuoZk;Q%Rn(w&cFv|2 z`4cNovl-)~e49yesNVyhRWJiY%(EI9$lfWt^hjb@NLgS`SGjFM85P|H!H}6uve6i0 zPmSLzGPm`8xERVff;-n+NAO$!k5m^4QbztiZ$?V4K6cXjmv7qryh)X}g&&J-?7Zit z(5_d`$e+1~Le_jg)-%V3997IT#yCh$14Y&-v(OyLlyZpf?LYF^jkf54#(}{~tK20XJe-TGz5? zU(@y=mY$wb7Z%M*a7w7IH`j*bZ=tJbR%yH3Fph7KX7^tBv^LtFsO}s~+?r^9(hW|9 z0Or%}W-x$0S3Zm`>_0e^&|d=h#X~M|PS7pFOnrChX}dhCDMnT(2L4{2@VlLUPNIRj z?KSh7(X*Q?+`T}F373v@K=af|v0)69-xSbv>-|gfXBU|oK63FY8o75R|G@NVQP)ZiFt8Y$w? znVU%~mq?P@zU(9~UW;heu|AfKl#`#aXP ztz8rBj8(^FqRK@ZwUbgFEVwRghFY~|wzBSfa_>Jf9(j`n&_M3v(T}&FMq!mRN0OGxU_oFBFHtvZWnm#mVG*# zaJPC$TG(fM0fO!{ky42zoX&V1*Qk^GqGyMjllnHxi>F0GbKy1eN82ww-!2Jm zb<9f+x}k!Ii5jjC{Ugai!_^oH<@b>W7~7s9n*Uu@4W!lkk}KuzNAXm6u@!4nJBgN7n{P0OP!gdg+~>aVbJ9*LPr{_4YqY*Ud1;?UFr1P&Mk`M zKRAyO{+5(zu24(m3GI{{j<3UM@uu?>ZROU_*GgL0+mOb^5n}Xr;myquCQj<-95yG= zzVvYNt*N`URm^oeV&6w>gS4pAq3Z%aqI`2#0e41nI&%w-b>A*bY3OZ{pupA=;~dj8 z1uz!OdmNs}0&E!CQb>_MX$86A=djNlP+*7X#Ptzc!!-8e?0vbt(?hcXu19V zL*FTIVa;O7>Nw_jkJ^vx$D=E474VviMuSOC>cG~eQ9;}#YZ;`44@6h@Z$wT5W8>lh zLGY=+L;3Zr^G;T(SC7~(YQ<{P8*cXY_+g>QzF7VTLVygpr0b<%8iLfOiddf zTgA&?b*P(uc>CrnxkN=U*sD(Iw0ezAb_yT@VNN_T2tEBhnp@)9b4D2%5xG1sVSePt~sVp=Q&s}A(1~yM~fhl|B5V#88J_ur1hruIrwjs zs=8mb>8Ls9`REQe;zqT@AE@!YEueD&q#lGPL$AAXIu!3 zt|i!~{#;7Z2U|mJN+>$Wc3BtTnnjRN7-?Cz#m>deYQf$+!&OxtsM?OjMN|5RB9qbRw~|vS9T~UL#iab0ysD1h;PPhK3Hh0VP@o>HFIk0=`dZWh_({B zszlu~U~6#UCE6evH^r1qGNXGG$PWt&5i$2Q|01D)Ub32S^Az??_0QHON}a!EzC|Ie zA|LBBm9ZV}@?bD^=%;zgEyJm3Hv0CC`HKT22HoqSU9~GGjeL6@?GSSex@8B2Yo(>D zAvFw|cZfz~U=ic^WbG6)kGcCKL)~wwbOxCvz93a$Cfn}Cu#H$8w_4lTT?`q-hg|)C z<5ycy-Af9==n6=wxVA|03<&PdE;&>R7_{gmdsedCdce zQ@!uGuD&Y8o-<{?|NfE<6+#I943HFH-X4~zAe`C|nJJbDR#q67^NW+luqQhglW4*f z%{SUch0f-2q{d{~Q67t}!H*Ts>4P?#cd-iB@^EZ!%G^@if~^dL7p7TEtLk?Bt#suV zpzEB;lhdr~?#C9OAvoe-Rq4%D85Qs@3to$7nvwx?zWya&?lP4oIVEU(l-~(XBkUbc zFD%4h0g5wY+cC$7OuT8r+W9KtT0~kssN)jlG$X=F>$m`JVnywnWGj97cl)1n0(naV zx*~p3+darr3|go{PZ+-ClaPWr@R3qStM4 zuHt1AL~E51`G~I0apfD0 zL36r*0;DAnpppE{*kPi`__yM%`Q|Byqd~y_lCY9_w?8_VZMnp3G782e@-A<%{iqX`&uhx-w~kc1Ze;Ex~T~Cx@K}l$T$FKAD~G=}7IGS&@y@ z99hm{Nr)AHopskTl^nE3vW(g@wbg!lv4DMj*#T)_R5hNi%0cQlvj($Q?RCKO!(!GA z&Fr80!we6^*k6CJpw>*O^@5D8p4I2k10` z)S5_HHJg{i*T;Y;&P$a}e^?ASmY0|Vo>8(9hO?vj)7Ej_EjC9u>w)})&^o3EmL zHN%>O7byCoqD3y~9V-%L+`lmrpY=aE9n=F~Af_gIE7mu<#GYlt(vb%f0BIhCeHV$V zR$Ke7Ay7^&9W?%?`{Qn4WKCJ^A@_L`c2$6h@Zf^Wg2Hf4obnYl)ugG1%UY99TU@OrvG2zV8IGk;hF(uLw>mU9qc6{P|!1O6_Cxx1`v|4%PgSqJX z`^;BV%aqa1P~z2aw(6f6%EW=QszwV+*7Y*Q=jUBjoF?D9;$N5cw4mQNqFQv%*t5ib zws2S~#kaNf?fg5!TpmvxkFi`ij)Yq=rbK)^+o!p!;#so}Wg9DrP!H3ZDx>Rph|yez zz{e^1KKJ4>^JuPIWg7T}+<0FEyX2S`PM8%uYAdX2sjmk4{Vj|qu`iwk^f6pHM>@)+ zMmJl^w&-1-PRIgtt!V^r^Atv@SJ#SR@sbp4PueokQ@>=@q;m2+G!sQc@IkeI%r!K| zc5NwEPn`_5(fm!P%xg+0;@G1JgPcpORXvv|B#!lSx!OP-9z^ZN>BsJMh=pLQZAC} ztBEosfi1!%7jlMGE}9@NyZ>Xfi`zsux&s@^c=CzrvUlrgCv#(Onaofnqjy2EjTed( z2Ty`(cXC9k@^%zE)mPAP)>7RhM%F3C1VsVp0GAN==DWW~nOZ>#$+|B(>xwgyWq0_} zO?W7@))ZK+5x2a|M`^eto^+^Raw$PJTcuk+Vs7gkf?soUUY_(PB(|vs?&66CA#mzE z(y$0arqH2cL;4ApCy!D+ZsG*z4R+m+g0hla66ROt6*5&43EAKz|IkY0Pzv_z#AwB9 zNmv*OtYC9xgk;pqSA0o=-5Q}-nO=^~pR^$_d{-6fYWaz=U%NY`0H!#Z4{6i^tT_GT zo)I+ae|oafLEv6wYkHS>R&@+Zir;b+i9K6sc#sMZlv8AV<8jaLOK(4%7(T?fz;zrf zI$NoP@FulcuoNy2Ftv@?+VC2OYu)YB(BL59HXylb2wIOJB;rMAuH*<_ zryX`X+ta#Gkuz%{C3Nc_Gr~9ot1U$$O#nl7dCKQ(9UJK<-@0dfyla&!UkE zMzv|{=FlSbs1wp>DCa39%ZYFGR31L-4mW0-%F(42>kJJ5Ov_^_WN2ztMM-Iq*(o*a z&vliSe{Fnge$cE*F8+RFO&+OSpI4A~*3+Rj;JREE@YxzG))TOiS<0bLY zJUsahq-I&;XzQsYhZjIs2R^bA5tN%WRFDzxcN*C|fo?rN&z$>{nA)v6@ddZ`(=wKL zC`+ApDx6rC>@!|@b1t^5;@dUJZ_Isqd!F{_=uSoqp0#XGg-Sr8r;4+e4p_iXek659 zru=rkRcL6Sn*N+yQKHnxL(Pji_>k0uAM~{OOhrLd0A=))nv5qqTI8a~JQ=C&NuI$aH{41FfArd_RVY#XY$8$T9LOe;^CSrHXfHAC zItoX#k?Kl(HR|x*#yc4d*+>=}>9o0@QW){_qi>=^L*j}Aj&(X|lGTm%oiQY$`b!hu z!evI1hOmH&6BQpCf5u-`bmrX@=~L?{$bO7IcAm{Or<0LtLr|WHy%HX+3s?9|(pXKF z%`fI06wff{u%gTY(o|IML%ToB*myqnz;NkQk z{rD@O)ZK@ca7=pk@? zL!>FUL?`z~b6tZ~v>p7+7EO2@FAnHYh~k37D2g$4Du*}->g#Z?=Au~X3-zdK5+d}bs+hu|!<2vr=mYe_B7mzfBys8=YpC}k z|8mf_Dr#ubhH;{EpQKkZ?CGNvWwB&yp)P8SsO_?^ya$@^Mc@H}(P9(7$&ccL`ViVC z%rbitl&~Js(G2}m%e5?Pk3IBaCM-@zVp&gK4XuO8B@g6XO{;Nfy@LeMow&YJMw2HP zl0J9o%}tbeYo~G@vaedRT>N90pkHlO3Jx)mwe(+FSk4dd7tjKOWB@4Z`gCW?!Yp5& zl0ZoO{Oz zfahQ(l{)@$MZe>`8yT5KmDM4t@O2WrrB)3)9aJVvqSbyh?K&+SHdJve2`4R5fKgqal2<$oEb}-mLX~Yn8PTAp@cY&vM z(`nME;ona`J&3yRRwtOe##vJ;Ea%3XY#oAI+xbMZcKFgc$IVD)L~d>GxP2&zQ3 zLo4lZr`2NRdbzs&p7NbARK3vF=A}gnzKt$fvRL1RN-XoW-P;nc!B%w1p-&^o7$97*{o8DOM<9sQ>{IESDC!giZbFrIjL%-$G^US1dB?q8Lo_5*r0a8 zK9WGs-MJ@tP`{e5D|=NA2SYh59~>58I>Vqd(wDw)hIm5Ha{h!@SgZS&hk zo_exy2+NBt-zc5ZNdU6#+#6ebmS>sfkYy(uQn_5%a__Imoxz4OoGTKpWKd}KDZ)p6 zKV-D;;zd$`nzf%xO<^j9bk9&6MK$Ih+j&orGP0Fcy-i}QT~%so6K%1=q0gK=zK+D- zxE{C488qDcJNpJtG&I3qgT>$Y-NFb z;>zBSx@9Dve{QVjo`#HGkm>^j<9CdB%&M(kVP@6r`+N7Qgn?=GM^KALOX2 zGcGOC!kwYR7uk0k`x^hg(@a^p04ffLSWX%BSe6`0BXp@8&k3nn+w}d3E-jcV*!C7p zNX|@LCuo!EqU0X$`PM2*HN>euSLqgEvS1ODb{Av90Hmcc&CeSE_fE2{J(ti2jWc0A z4B)yx&&RVhoqqybf~hObtC6_1RL#QfxJNon^#+={z7;vzfr}+wKaA0qzXHWG<~2=U zmiWn!+?jyZ2|mY(tncgdntcwGTNf4T2lC0OyV=zSP*Am6a2l&}eFiFWHgS+ZUbU%9 zXXw|0j4SHbjgkN#I!}pZS)94JF-vg3euD|lQ_bSr*Y90IcoBN}jz3+PV^4_#cfr>~ zYG_WQIpxYGRhJ7Lj8ade-TJ2h-q({d948vl;|4vt9Lp@fGZ1k?3*Pl=g;zhRvB*>V zzfLr|cD^7)9r+m&MXf_2oSv+$PEBJl0{14`S(Hvw%O8!8FFGUo{Qd8eUP$)qH1ut0 z!?d?xmBfBft{z#nkED3kX<9sVIj%tUs^fK#uLvPw7MNWl-}%~Up%znUxwQv2^%%KHw2{_&TuvEKziptlXdg_V2e^y8i_-Y|)kL>Ff9Q{&r7koSx~pCE?pX4n zm(oN@S{O(!TNLs+$qW-8x6ymeZ_g?r5s&XC<7Kf#!mTp!HH`GM>Gq8uCeumgD6hAm z>yDG;b<}fizbPc_?BScw?-L!3LmvB{sC46WBKy1d*)#E-UuN2JI@sVH}R{Ru@O zXD3p&|AY;e_t6B_i5&%IhfL>~?HeSK!|ZTvF^CSQPgdT5;#?yx<I z&!QXs6ZV~Kt^6*}cdW=ze&k&N**=Gmv!}T=u`3cIqS{xdT-lo0yS)cp8&UY^m`@oj z5!}c3hpfcO)6A>i2#xk7G4AM@)Tjp5+R0h+709X;S`(IJS^FfNbb3T^nCH3xs0ckB z-Y=m}R#(LusVNd$KNVl9XRK;WF7?xpy-H($QA@t7BuA;bDOW=>Z4LkOFs`#v#X`zJ3*viwa=$08M{o>g0B_AwneGG5Scj-{E5)3$Z)->djsMC6q-2d! z^i&9;fMRP|na~o;ML~OKWz|ql9oZrZIvZ~5m|W6y<>(hN5leN33^JVVdcAGBS=wSU z;zhNJmuPv$_zza%Cm*j!DosSx>L#MX^M6zAhweQ!PW^s;E&qPDR@4?9zC3&XIS^_t zuu7{bZKzAR68HHug_=cbFJ(i^`sbFQp-*H)C`*Cz`NNFm$y41>swS4R-NJf_xb(^% z%PTC;;J7t>fA<5iFWANXq{aYNIFIMrPf*TvSk8E}JP$_Y?EX=Tj+9ibs}zy9r1KM} zxYu)Jrk&qNf=0Yq8fTUwZC63Z*b7(pqssVFr?O-&_DZG(14ITWVi$Q%)(CpG=mVuJ zV;%g9zhyAIa5zMpbk``g9y)uwFD1iR)ZJ$|;U3w}Yzh;87|ub1-zsZgzflbr6O}Ex zf3M459q!jp9JwzOFk^*a#KLWDKge0&KHRr?by(RLwqiw7Wb&_B5a~Nm=rR8(5T7g* zH5o|@pQd2*9YM^jY1{A`+yQEv{PNrGLjS9G;mFZgB6;{sl>#z9|?&@$Ym-~p;bk&yqPo5A;P&U%2 z#C6CAKqN zP5Km;BVI*6{Z#b{V)+r*Od4+DFL79wYS=k>JPSswRlK}fKighqHlpZ!V&zWa8wVMf zERwa|r<(&$#E0Fd|Cm{k(gVcT^P`HX&yzl2!^LEwFg4p`>-e7i$wT`3kP$|C$wEX~ zNR7R`j+W-bS#z<6Siz#rsyHM*_Og4Jyf9)&oHdw-Dz^u^5?x_eH z@(%Lwcpkm?z)#PN2Nu0&63CJNRv>NpVz7n-O>zr0MkSd9kl_3VKLk<7LQ|G zCh7?|wWnlI)__@?dSh|B?1x@Zm_*tM(iQlQLLrs(mOOaL1geX6@=aQi(rumK3-kvh z9C{7GZcE>t$e;Ll-bT+g@!^Ek`o|G>+{X``#)z{u7f6c}YO6HceY}xUN!2kIs4~yW z4DpDC*K5Q5-oVC?wf#VdVB0-5U2(Y!U-eUBwazr7!$wAhKs0Nhxb&PV2IG@G)&eM{}}-1ufId;)ow=)$TQiqbvYFUvPY(VaRJ z$VXFYR^y!x3~#$ql7dFJV1#{*>9epM+>QkmyxR$6LASaLqAl1!V})}}l3wbIA`|SR zUL<#jFSGe@E#`{%Y1iU1=R5}qo_xR(A^$5`gvVT1m`;JP$%7J$Dl7 zjsXVj+%Sp6kB*rO6jDLY2Qu;BSNhR|HjhJtMNG2MeXMuBL}1lna!d}!(BiemPL~7> zJ28qaDd;%s{YdA&OlwuksbQ_5YinY2BNBR*u?)B_j*+;Qg&;2SjCze*vXdn)Aw@}T zfH_%Tyx3#Vu4<8 zxJW!wPk9PO<_(DIEr}s|1WEr>4ZfPbg0=AkETb4U)T^e09)&-nyq9CM*76vX2RJf4;gR5HA?_*3h(uR{u7iKfF;gR&HJU>KZG#IbehJO@QtlC|c5`wq zx;JWB6jWL@{iKwUnx~NBsa_XNf=i$9syV|AJXa6Z!v?Zo>FN7y0fa5!?w1Bmn%byu z%)yx4a}E%ee%e}c=-+1w9N;(o1==Sur~2!0`X9S*RmgC+!>2!6{eo2YL)R%(1^>RF z%Ho|-KKvYt23Qj@L@2oiwhm>9z4TP|IGNV=k-R`(tWO!8Jg4GxaOGMCn@44Xxnj}e z82F=5Yw*Ys;PAphj8^ycVpJbf@@*|2FyL>sInowC770Q82`N5Vtl03@e|7vUcmYh1 z|3M<56+FlZ`h~}QHSXeiX&Z~41)Dv@Q?D2jQzNJ#rwLDnoFZ*b;rAGjpThrdNeGiQ z3@Q2V-rV}vBNaIO6VDNZ^wh}+#>u)uqp1|9%W{BVn2=Kq`ubL(dxrw}?YSz!*BFuU zdc2c-0V#rf5vv3{nUzAr$yURm!B#Vy_FM>e_BVC|fkQzLfgW!hn0^Vo9vtWU@0DEM zfqV7!)|!$fm@@T^nF`xKeiWS!$$ev3D=UEo^M=aBzOQ3kC3A>lV>DwYBVHM)H*K(u zV`rcQ9{6dU>R+aNCZ(UBL9J2!U&pD4rW;pFz^^7fOHQVC3s;K3|qnC!bb_aZGKL#GuOQ3oURzU5YwbpWjpG^k1vFPk2Z6 zE&A~Tp)3f$4z%lnjU8PqsJ(FGWo+L<{ez2UFp*Q#%g`O}lde-NKgxhV>yq|dw}kO_MDP_Jtlr$lVG{XOU}v7LM5y$Eyf9ln$uz2bVbrd z86Q1d^HTh}5Wd^Bxf$Y(%@F@K{34%d0ggzIv^y=fc<=O{IDYE6%<3y+GpCjNP|A$e z{rB7y1LiwiMyjqzIXx<}s32&USW%cn1sHC}0}ZgbP|iPKNF+9E=BSnScQCKQ@V>sc0)^ z7ubu#R}X{q6a%v_?6G2xYfHY$zUo=ip* znzft$UEyA{IrOZ5TCnfhC8|#*_m8f;iL}i={fx;(KR~~$DmHFZQh$rhr&=5=G>#7! ze1cs^FgRO3Df1oi^nh0$8J|eh`G{g+1 zHK5_*W6Ze#AAB4M{0T#00%ogk;yNQ_0l8hZk6O!MthxdPPhwG(=)|hi=J?goI$r1| zl9QNPeaF9#Dz)+ZOJZ@|bBPXpf|t-$n|_3DcmpvHLt7Ps{lJ5v0@X(>3CilDBS4It zB+qs6fPFf?SG3JYsLljtB{AzG?iEZ_Tn;cHKz3ACP8(5;^!Cr*=a7*U4hPo_2k@Il zZDYsb>)8YAf0JeS;|xN<;a^5Npro=8ALTFC4?IMpc87zW5l%VrF;>)<71&GxUuE({ zmuCmg%Bn0?(^JF$eu%P8?yWbcfQ>crbyvyP8mtVP#@uH&6!)vlK#uxn-V7J*qw*T$TXflI z)%r>{(UK2ye_uDT#08fcHp@3Uci0}`N{8m__r?e_QgE1Bt#K*!gXg|s|vc%5uVNrCblM>tug&Y4= zMRiU?l?b%(ICj11vyG$2~IwbxiNvpnIV3y`h-A$uY@PFY?MwD$8c zE(Y^*|Iyf_%>bcI64~hX^&-nw*)j0x^*4PVsh)EeNtOpMI zLQqBNW630^+r!Z_-lbh01;|Xm#s+Bs`vwR1R0E%&lS1x#4p|aUsDQYgUjmi!y3hr` zYYyrP9;1y}qtp#$bItAxI_ySl-gn{t5(1Q;!=-+86|0$I;%)fc0GRSi-_#=feP2Ku z9W=*JK*pMG;`!+lwM2gmM_Hm4+)wXoT|jN`vXZRY==UOJ z8ClN-s#$+-@chJTGkYmgcwe37_Bzc>QxA9^obI=5T*a+v7 z7OiI(PN6zAckgCy4uVyVN`y5!VJ%@IIYsB4vb7inepj#W(FRFTGWz|g9czd&b_v462^B+@iJ5-Q;;-^eB zg&q^6Z=Db2UEQ4!lj&30p%Nj&SQV@!qh`Nf%anGz`rN2yzul9G@=&yGRf_IYnXXZ> zaj|1ZtbED(+Sg=&;uU_LBjjaN`xkie{-X-PN1RACI@5a>GLQBfnbbs9SM|}gpFLhd z`}^*#OIZ8q{KGogg)UjA75g~h_5*%+71=|ZZr1kHHKex;CJmok8w5;#*!oT|8Mbi# z;{kD-Bu?c2E5(6-X-3k;-re!#E%bgj4?66Qp`Cjw_Y*1`;93hZ`mUH^3WFW$#CQ3i z)RBA06IrKwn~SmUdJIO}lw(WOQ9P_dMd6WCD5{eMtW)UG>(9urO@kE#qTFwM&p3Fj(DnSVyeF2hq^KG!a-%MA}m7U;cVJ=XY~d!qc@Z zk35(Zd0rWip^l!x&)}Q-`eC(9RnHw9Y$8AMom{06a`ia{LW@CH?if^vYr~9*x}4rv zQbf#Lu=%M@{c7p(ab{EmYd9tO16$CSYGH)%Dd||TKtf+Fpgu-oQQMALVwDMdql`95 z`TN140Evvg;dqC~-3$H~3qpE4r9|f4tkQqmMbcy%4npZW9aApk1i#-qeV&^)!#hB* zrZxwx^d!IQG-Axn?Z_t>N6r}uAm$-?ptVOuUw^{k0JI*qN02zX0_O%$}f zI0{Ct3i%WCsV4HsK4v&l1lCAKkQl0ALK>fD6HH=+L_~x%(*%#&{7KRQz$v9E%eZUz zbxFMA`Rmq$2vTg^&G8g|=)1dcDjcl{8LE(wY%f9JQWf$b-t|vl1bjrf^jFrJ<;)*1 zV43iNmoIf11fuYLi8nTz=vx|H!f1}0U@vd-!*x22PFjTsHf`eO^Xi5Z4Zn@;Dx~JHrQhQr zk#%}B-Fqld_(dzRBczC?9qG?`zJquhVI_CRf$dT#LARIRi5DQlEjDVx$teQKU}ft?FH5D6PQ znx@;lcnQ0NF8)GgHh3Nyo~USy2&W(XxoVZnx+j3AB-oLj?Jt~gAMzMP)hZ(RDJxF? zbJ79331W)8v3pp zQ9(&0$HG_dwx(J}?r@r5H!%6YOuCu7C}@nP#A%yFWY8nE-#&@qw|!n4r^QR-*TswQ zH+zp%9h55`!9NZ?`=!qSJxUT&)sjE9A2FwMA`f!Df{bmqFh?1coHK9Hj~2%J)5;mj z%$?>p`4u-3653pz?meX!C`gNUN7C`W9h821NS0iPOVALHLbH1ZD>{Y}hc<_hEfttL zGTx!@V-b1|AtwWZL{?}EZoR{3so zf|t_YpCN5+deNX~732Ah;(in<4XsML@00a4<;7bYI_N`73#!<=LGjdZ5>62PzGyH# zGgZ98yOlp>aYJ8%RXHndTk#7ynNqRn7l)9GQL@qjwy~ZXK@FOV{wZv`)vlj~?9O0P z3_U_IoYpn*Z0S?c<|ERDW>Yav>brZW83>gAi9A!UJaN@0 z-*KpHHtbL*x>jnW(KCycj#9~m)>Hrd8MVM5+DN&Tpu2NoVGtLj1>JX9G44nN``-cmxZ z{<6i=d}K|12H#tD92olfjbssqfGa8~{CLf@8Mr8QuC|_DO_skj=%^A}(*vGA|3`ns zGf-z81>CLYi&Ha3uB}pN_MTnsD-Q{`1sMfofXm_d`S2LIDwC(aJVZ-`MW+u~t1#s` zM0LvU3$EnP-w3Fd*nkRlS^X2clOsXWw2sq`Q zprE^GCnb*!GZ>R`UZHr{St-vI-LF{wn#U4Eb`H@C0)%nw{Gt}&^7vzyH#U5DXwz3*aF9F zn9)&xDIR3dDi!n?ikbu))3P>J2QqwkZ{pu)FKV25ScpmT#sH^E`=tl`hM z7q0$R`s%1HKNZTKfl0&Y7LdNhg*sKrbrzoR4Hp+th^PeFg1f^MA`gl|a92DKDZ_l- zI6|tDsTdio!e!}X@mK5-%EMTxFqGP`?@kYuN1#u5tX2u0LZCztnUgFr*2zZ|s&Yg# znD1$zOW}8k(wJtBRu>&LLWZVUd4tXmXv3yK7jM;4i3P&rp8CB@$ z_h?pIXDqs$j3{4)a_*{fCadwcC%c!a$V74Vc+~I{R6x$g!v4MfGUDo%<0K;+258~J zLuI+76Q>5kE|Hj=Xa5yOQ@^H0FAgZHEpbvgCSGw4Se2X1j{i)Lp(jOxv0GR!^HKZ6k)QKyt4f)8sZRY}mv*x9xHtOfaNYwU6QsfqPxXHwS zK(cu?^L=&oMMkF7=`eDm762eeR_UjA)lOkMLXEN0>ix6AQ(*&4-7Ts*LGh`L#SC%NWoeo zuy#~p09+#eu11g)JfU;K6qS!RWVQAd=?QmNQk%O^RCa#?2FGC1hY6pw4~fgc1L7eCM&YaF3+DZbxKDAAl9R=sP7`#7%62#HVdveb+Y>sYsSEGz$w(_dIrQvP@cUma_a*|wX*HKBc~SWf{Zh;5e7QFr`%%w&XJ1H;8hnnI!#JV z$9xW^w>Ce?h$fhnL+DzZ#4}=)=vi_QxCZDR?O9E`4FzWqfWoavS%czG^YxKR4J4nt zj-2l)6}rS*jgvr@>LseKDIcxCW_8m?=o=KPsPya1!mQ!bVf?VH3Z4Y?j`)|-eMqC11q z{H~c6epGl`?GbrKWJkWE7!eP^{u6H+aYa~{3QSY@12|Zy)X&os2U`JW6rbUaczg$6 z3yxGfvrOPxW0-7PTL!pe^QYY)`f8`_kUW^rLtV-rzP)&qd=*r=9*^QkW8Lp_IzV$5 zvagNHy(IL7c*$gN=&0!uKyC(OtZsT|4SbC^GMNcbfig_8$)nw(j>9I{u`p*PzAe4l zx{0rJ(I+pzwxi(DBa6Nq@?6ud=mi6Q*lfxtz) z6NaHptpoN!U75JG+X-W^vs_S0MXjsBJcnX#Yq$#3<=E74kU`B1jD4KPIFTmdEbpTC z@#4I`HlwRVa^DVgZ>aR!hp6veB|N7~nFJ@WWd;TjXnghM_s+@rX(yoxt|YMa2qsXZ zd!K!XwI#jx&B;YWnwF)y-A+vQQtlz1JyUU{e59qG*eb=Sl^lokOv7r2Win&qr(d_^L1*-{6Vzh&WtJ(Aah2JPf-y%?kz~l-V~wqFdwuMY z?5oMxdz!{55;dwyVbdyT`YJU(>!^kD=PrXRKBARLpe1U9dFdz(oqiKecOl3rr?k}+ z=a=!Q9e+_e)niff@sGD)^yf}?sKcYNfl8+oHE)?)#Wf9;0pj@?IIuI^TOm!(dc>s( z+}gzvFCeNEc*RvwiGKC%njTEZw2Mw?uWSmy8-v~KP+WiMH_kx%q3Ds5c%e{XgLlQ_ z^zHK@tZkecA+oWQx;yp7rk)$y5*-wvFjI}PppXn_O89=<*aIDQHjARoNhdnh^=-qS zOOu&M9U7rn&x-orOJGFfIGZh&l0C@Lz9|Zo2yC5AhR&n&M&U`rOwO;pk&f#cr$d6-Lc1RXTUWc)m&IkM5&uTwQndiXovBVCw(Qr=lS zld0dthsA4(ripS1f#MXT<5g(gEpByk6`_4O@cj?Lu#jrots{-EozKTszg~?t!nIWw z`Y{$p|w`#7cc@6_jj8%clk&1}fAxlQw;*EHupp~jvi&_A!?Q9$HP zbw0Du0ziuoew2CAEId*5H z5!EM68A(m;w<%sxyv6Am9^Q~V&K|os>1}mohJ5utBNoUkad52gp_94=vFUk)k`M#} znFC)#@QMevDpWZ~Q>!PK4xA%vY+Cjz&g2CaWEV88J^D9U$ijhyEB&D~nZg(cY))zD zv^@`?1BBo6r2Y)&CNae#RuMnfA=W^KU8Za-H_Uo@bqto0!;RG#H3 z*`8^UOT$QGo_WIcEg8KzgVl8U->53r#luXjf@v6in`gCg7|$MN%D3snTs0bB z2VM;~bn9dU)tm{JX4P`B;BYM0Ue}hiANKy7?wjA~Zv8x4{9ACQx(yx~`?7T?L6lHT zoAbB~L_q7CD`?J`FSxCt|if;J94(1lI zte=g?NmD@b?OUS&$ZIZekX7vFXJyVhRy_&jNu2`|I=c4d>a&;>`3M%2X#{!Gl`cWV zz#6M*nZ40(*qV7|HIynmy#^LErXQ?X*2xjY6&;SWn5zij{)W`&q zi|Ra}yY%{){`)IDeWg^E1i~=^6~( zVT1;Ly%&y?-nb=CKPpz4=QUt@_YRjsMqET)yw;^m>v#H4;SJQbL^Ti|e_=heKzLu# z?=n7SyPq*&^Py@FOx+jbh*M=;7tD|Qi z{Y_So`}-fAh6~4K*r?TeZqkF{n`=1v><&Y{<2d0TiLl9ZshM$AyY9ATn7Ds$x{OUK znEj>j=uD3Id^lFjuC~wN{+Qjr+k!)iLqA9nrcI$AY!N^5WA~p0Qr54Df1L;k7@Xic zr8UuUr*^I&%EXRmB0hC_Fa1mZ{!!k~&WICLW2nYI-nNtf6iJL8Dlca}Bhb1JuSo`V z3S7+~;?3QkyHC}9Ar#yB`A{3Lr_ zF6G0`yay8V5=Q^f629r3u4s&qNb0npS)$M3 zgvDp1;mY?Sp@*-xGK9e3_u#;87#13!ZYsnq1z+aAU{J0{okFK#qrY^gB->BxMu4o0 zWH7?H(0i8L>aRUW0hwm0@EqtwZvp zv9^Nv$|rDiu~x~G=VH4yIHg!V_4S6IWDdn4x5BrrNM;VD)n?+b3KcI$!T^xf%{zV> zCPoDm=*8@%IpV+J!@d9h?SGO7*!zbJl}B#$=|xhX>+&O&m-J#{DM2S}gy6x0n0sF~ zgF!rn(N!7pXVFja$dR&*Wwm00duAEnbh;G=LPj1EY{B1pi8TNt)@lUSV0~q=R)6tm$c zgnCaRfuTvc?$CDAiS-+%l;uRx4P+x63O^?VCSwGyFCr$zi-B28PVj`HNHJr!6np0w z3z8#^XbGL;vX+DzlynVWhuI{er!mY%L7~lzau>#?V&wTZ#*RN{3;1aYg7PTl@JGJm z?N{*d;UUADtCUDU?CUiAT(%&8O1VG4EdisBmJQpI5eyT|K7A_`(ZZ&jX3|tS4BZwc z_6TK3RPGJq5gZDS4&lek3Re5;yy&8Eqp<2fd%Yy!)_`>Bjm68UWRJYWQSi%yp{l?B zBQ`+~3*~M`iWz6mG~{w2cT&p2?d5M#Q>Sl@?ZcV1triog=y?(^_U9Hao-~)SquvfK zF1RXF#dw&4iE{-s%O_BTW~pM>^i}BXKfMV|+p&Em{En~`QJ)#ddboi`ET0H!w!0gy zGA_zBrkX~*l1Tl*w#0;NSQrVY%MOxO;-S{-qDkIxer?>ZOYTyuhbUmutsUKG3odzi z4h&Ncermc7KqrJKk9rTCsS5@fw)K51uH4sbH`zIC(IYYXB;|rm6%m!z8|8DtOL@hE zbnCET!i6q-xU5@`bd|a1&_XR*R;>it65uy?~QZAIwr zh83Zv;PU!@@0*>Xz`sFRRvflWfkx`()xc(|GfNnC(C56;)I=m>+!Pa>J}_f3-Y>IY zp5eDpz5OU#pSf7`8ReV?=v+8-fs-*ftNk$W7#~Z_CY?=F&19lMV!xnA-B_9eK(GIH z_gvKrzd~ti2jc}1&>f#S@3;O>xTev-LpAt412r)v+4ouMGaNqBdEy_iKdN*oMY%uy z4f_`ZZId93*~SRVelggeZ`cwV=Ch=*)241)tii@HAubv;`Bxi`kJrr*lFf4a`%=Ud zn5&oE8})6p{i~;XMn|z0hQeGSl}0;?2XU$t=cuv>%E;GA(u3t;(#BAHdrTfAszd-!6~=YfTrt zF^eWc%G|ivl}FN$>|Ey~Rj%&ai*S0<+YxLRO5=u4!xYi;%x!`)B?`0|^QWHO3vH4C zoFd_(?HRVE1Ra#zqwat0y_I2Or?XSCnO-W-nv=m0W(rpH8Eeazz5sG{-f=i;!9oEJFmPTzjEJjYjHTH2ht(rhO4*#g561S`-(bT=Est8?}@pB zj3~CP0c7xv#EY3fii09}SC`!DmUah?X!YKBo_kn4HcE*7(aq+x_0pUg_8}IR%F^on z9kA|l38%5Z@nwMQ1m?B-Kg&)gLRcPyiJgZb;?hN8?@e&e;l?r4J9c#Q-dK5ma&Sy@ zNFrg>xD78$vs3RIMU-aZ)a5nubt-Z7|1T!r1+>pnf>W3Z8pRdWeb<+JfqvhOmYXFZJD)0rr`UT5>9Trg!Y=I-_u2W$2o z{H{O8o9uYqA%f3j*f`Bp_$D^LYjlpGMSqy4XpDy0M# zwUx0~r(e3%WT9*}K|&W_uR(ZsNao#VHU9~hng9em)1_1~vZv|rG07Bv5oIsO6{&Kw z?qIn+P%PaFXj)EwD!z1Yw3~8s->tkCCk08!>~QG#g9pm`UuW;KJ5nRP@pn+uPMB9r z7|hs9h?TAyYO7|{(0OP?Nx0e$kg)9@iYpHeC9O*>b;9J~d;oQD5RCE z#pkh_W)e`WB#=Es@g+Kq(wT&P6Y!nCA{OAV(DmK3s)Q*FOrvNe^&sG_;gHV}GJI-H zStxF)x-ax@I-%o7DD7HjOxCeQq~ARTd-GrWlFJFi zPhuigD-SELuG=P(yj4_Hol*-!;=8cQ^bVOr5>WkCqCB74*In_TnRg%B_tO;YDUky6 z&(?~Owd#TgXBPhb9{yjL{`b?;V6>rZsLyHto%S_xb?tWg*A&9ZK2U`*~S^ z%52J?lo%apdvf32s-H3w&mQ48{-k)BP1UFE(;_-2ofKW^_h5m}%jKc-GToAa2g!hs z!m==D0uGE6?c~1vc@^`PctZ~LwQqh&*=DW%bn@%MHHSmq@9_QVccVvcvR01w#~TyA z%{00AF=nC#>t4UpLWXB1o?dk#L2bzfgWE+}+&cBa3sc3?yED$+KJk#z`p@_8H(n@D zOxpFl?T$V0h%;dla(BB&#$ciwuw>HL&eR? zmlxhSJjcrJLjlsCoW4VZu@s`t^SrjyPSY?LvDwJ!$L{F9K@ReWu5@WkM$JMPaY{K;(i^VPl+(EDO6qXlyUS+;iajxlW=gei_A%}gXHXcZI z6*#|Z@g}K9hYkTx1Oz2BaC%l@XL`ahL-LRpSIB|N%;`^ob;F1y^pkM`!riu?(3VlEPJc()`n3p31JX$Vq zPW8)hu!|ureVDofvw-Kc?NIyiCj}Nma2tV#8u2mt37DVT`$Zd``k;vrNG14!W^#pV z>NX*~49{oM?7;Kcq@TzAnhF8-on`)f(4j^M1HnOl;Fu#Y^p5SEUZ;vC1M=}2PSBkWP3QfAXSyL72(~}r zu>vsk9^diaFN7r!uC)LiWP0$qI=ucv7{8$q6ncg4md1Bt2?Ua&^MRqe!dV^P{tIG< z{%7v#+bjC_$b6VfG0w(wIHhP{Z<(}N`R}xOGjlT|EvHSJmuY->ubI8=%%ba$grT0? zVFNrCu%hx_`Ti`3#~Mo=5_avs{44+eq+Z#**Tuxda=sjxYgY2T{`Q?8AFO(w#lj2m zPIrdo(>wTm9{v6%2TP8Pr}-L9BKbd?#i!ofIy-mQ-wxk7H`2L_ji<}<)g6Qei)N<- z#}wdcgpS literal 0 HcmV?d00001 diff --git a/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-token.md b/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-token.md new file mode 100644 index 000000000..82e7f1b3c --- /dev/null +++ b/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-token.md @@ -0,0 +1,121 @@ +--- +title: Download and inspect the attestation token +weight: 3 + +### FIXED, DO NOT MODIFY +layout: learningpathall +--- +TODO: CONTEXT + +## Download the Example CCA Attestation Token +In this learning path, you will work with an example CCA attestation token. You can download the example token as follows: + +Using your preferred web browser, navigate to the [token in the TrustedFirmware-M tools repository](https://github.com/TrustedFirmware-M/tf-m-tools/blob/main/iat-verifier/tests/data/cca_example_token.cbor) + +Use GitHub’s download button, located on the right of the upper toolbar, to download the token as a *raw* (binary) file. + +TODO print screen + +Place this file in any convenient folder on your development machine, while keeping the file name the same. The rest of this learning path will use the notation `$HOME/cca_example_token.cbor`. You should substitute your chosen path in each case. + +### A Note About CBOR Files +You will notice that the filename extension on the example token is `.cbor`, which also denotes the format of the data. CBOR is the Concise Binary Object Representation. You are likely to already be familiar with JSON (the JavaScript Object Notation). JSON provides a standard way to convey nested structures of key-value pairs. CBOR is conceptually the same as JSON. The difference is that CBOR is a binary format, rather than a text-based format like JSON. CBOR is designed for compactness and ease of machine-readability, but at the expense of human-readability. You can learn more about CBOR here. + +## Build the EVCLI Tool + +TODO: setup section in the beginning? + +Now that you have downloaded the example CCA attestation token, the next step is to look inside the token and learn about the data that it contains. Because the token is a binary file, you will need to use a tool to parse the file and display its contents. The tool that you will use is a command-line tool called `evcli` (which is short for the EVidence Command Line Interface – remember that attestation tokens are used to convey evidence about realms and the platforms on which they are hosted). + +The `evcli` tool is part of the Veraison open-source project, which was covered in the previous section. + +The tool uses the Go programming language. Make sure that you install Go if you don’t already have this on your system. + +Clone the source code using git as follows: + +```bash +git clone https://github.com/veraison/evcli.git +``` +Change the directory and build the tool: + +```bash +cd evcli +go build +``` + +The tool is quite small, so this should not take long. Once it has built, you can progress to the next step. + +## Inspect the CCA Example Attestation Token + +Now that you have built the `evcli` command-line tool, you can use it to inspect the contents of the example CCA attestation token that you downloaded earlier. + +Run the following command, taking care to substitute the correct path where you stored the CCA example token from the earlier step. + +```bash +./evcli cca print $HOME/cca_example_token.cbor +``` + +The contents of the token are displayed as JSON. Check that the output matches the below. Some of the output has been removed for better readability. + +```output +{ + "cca-platform-token": { + "cca-platform-profile": "http://arm.com/CCA-SSD/1.0.0", + "cca-platform-challenge": "tZc8touqn8VVWHhrfsZ/aeQN9bpaqSHNDCf0BYegEeo=", + "cca-platform-implementation-id": "f0VMRgIBAQAAAAAAAAAAAAMAPgABAAAAUFgAAAAAAAA=", + "cca-platform-instance-id": "AQcGBQQDAgEADw4NDAsKCQgXFhUUExIREB8eHRwbGhkY", + "cca-platform-config": "z8/Pzw==", + "cca-platform-lifecycle": 12291, + "cca-platform-sw-components": [ + { + "measurement-type": "RSE_BL1_2", + "measurement-value": "micfKpFrC27mzsskJvCzIG7wdFeL5V2byU9vP+Orhqo=", + "signer-id": "U3h5YwdTXfPsjYsVouLcVkFBnD0wYM/jIjjA+pc/eqM=", + "measurement-description": "sha-256" + }, + (...) + { + "measurement-type": "SOC_FW_CONFIG", + "measurement-value": "5sIejSYP5xiC3r2zOdJAKiynZIUpvCMD9IZJvOA4ABc=", + "signer-id": "U3h5YwdTXfPsjYsVouLcVkFBnD0wYM/jIjjA+pc/eqM=", + "measurement-description": "sha-256" + } + ], + "cca-platform-service-indicator": "https://veraison.example/.well-known/veraison/verification", + "cca-platform-hash-algo-id": "sha-256" + }, + "cca-realm-delegated-token": { + "cca-realm-challenge": "bobW2XzHE7xt1D285JGmtAMRwCeov4WjnaY+nORMEyqKEZ0pb65qaZnpvz5EcbDOASRdiJQkwx6JeTs7HWsVBA==", + "cca-realm-personalization-value": "VGhlIHF1aWNrIGJyb3duIGZveCBqdW1wcyBvdmVyIDEzIGxhenkgZG9ncy5UaGUgcXVpY2sgYnJvd24gZm94IA==", + "cca-realm-initial-measurement": "MRMUq3NiA1DPdYg0rlxl2ejC3H/r5ufZZUu+hk4wDUk=", + "cca-realm-extensible-measurements": [ + "JNWwopbMBcvYBoxQZ8W9Rzt3Ddpq4IL+O6MKvj+aarE=", + "eI/AkL/GuO2QMVK6hBTnPa9bjHux55rVAqsGmbZZ7RY=", + "2sRqWEFdw6ANenQYUgCOnK5k9S0DufdtdvSzZE/vxBY=", + "MsavxiflVYXAMVU1nzMaDiJfaEDblH3Zbvq4G+JnGTk=" + ], + "cca-realm-hash-algo-id": "sha-256", + "cca-realm-public-key": "BHb5iAkb5YXtQYAa7Pq4WFSMYwV+FrDmdhILvQ0vnCngVsXUGgEw65whUXiZ3CMUayjhsGK9PqSzFf0hnxy7Uoy250ykm+Fnc3NPYaHKYQMbK789kY8vlP/EIo5QkZVErg==", + "cca-realm-public-key-hash-algo-id": "sha-256" + } +} +``` + +It is not important to understand every detail of the attestation token right now, but here are some of the most important highlights: + +• The CCA attestation token is a variant of a more general-purpose attestation data format known as the Entity Attestation Token (EAT). The EAT specification has been established to create more alignment across the industry with respect to attestation data, so that common tools and libraries can be used to process it. +• Specific variants of the EAT format are known as profiles, so this token is adopting the Arm CCA profile of the EAT specification. +• The CCA attestation token is divided at the top level into two sub-tokens. These are known individually as the platform token and the realm token. +• The platform token contains the evidence about the Arm CCA platform on which the realm is running, which includes details about the state of the hardware and firmware that compose the platform. You can think of the platform as being like a single server or self-contained computing device. A single platform could host many realms, which could be executing as virtual machines or containers. Therefore, many realms might produce the same platform token. +• The realm token contains the evidence about the realm itself, which is running on the platform. It is the more dynamic part of the token. It includes information about the realm’s initial memory contents and boot state. +• The top-level data items in each sub-token are known as claims. A claim is an individual evidence fragment that describes a specific property of the system. +• The claims of the platform token are labelled with the prefix `cca-platform-*` +• The claims of the realm token are labelled with the prefix `cca-realm-*` +• Many of the claims take the form of _measurements_. A measurement is a hash (checksum) that is computed from one of the firmware or software components that are running within the realm or within the platform. Checking these measurements against known-good values is an essential step for evaluating the trustworthiness of the realm. Any mismatch could mean that the system is running some software or firmware that has been tampered with, or is at the wrong patch or version level. + +TODO: rewrite below? +You might find it instructive to view the token in a formatting tool such as https://jsonviewer.stack.hu, where you can interactively expand and collapse different parts of the object tree to gain a better feel for the structure. Doing this may help you to digest the bullet points above. + +Exercise: see if you can find the measurement of the Realm Management Monitor (RMM). The RMM is part of the firmware for a CCA platform. + +Next, you will see the steps involved in verifying and evaluating a CCA attestation token. diff --git a/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-verification.md b/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-verification.md new file mode 100644 index 000000000..d077f50de --- /dev/null +++ b/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-verification.md @@ -0,0 +1,98 @@ +--- +title: Use the verification service +weight: 4 + +### FIXED, DO NOT MODIFY +layout: learningpathall +--- + +## Attestation Verification Service for Pre-Silicon CCA Platforms +Linaro provides an attestation verifier service for pre-silicon CCA platforms, such as the Fixed Virtual Platform (FVP). This service is available publicly and is hosted on Linaro infrastructure. This verification service can be used to verify CCA attestation tokens that come from emulated Arm platforms, including the example token that you have been using in this exercise. + +Linaro’s verification service is implemented using components from the open source Veraison project, which was introduced in the overview step. + +The URL for reaching this experimental verifier service is http://veraison.test.linaro.org:8080 + +To check that you can reach the Linaro attestation verifier service, run the following command: + +```bash +curl http://veraison.test.linaro.org:8080/.well-known/veraison/verification +``` + +This is a simple call to query the well-known characteristics of the verification service. If it succeeds, it will return a JSON response that looks something like this: + +```output +{ + "ear-verification-key": { + "alg": "ES256", + "crv": "P-256", + "kty": "EC", + "x": "usWxHK2PmfnHKwXPS54m0kTcGJ90UiglWiGahtagnv8", + "y": "IBOL-C3BttVivg-lSreASjpkttcsz-1rb7btKLv8EX4" + }, + "media-types": [ + "application/vnd.parallaxsecond.key-attestation.tpm", + "application/eat-cwt; profile=\http://arm.com/psa/2.0.0\", + "application/eat+cwt; eat_profile=\"tag:psacertified.org,2023:psa#tfm\"", + "application/eat-collection; profile=\http://arm.com/CCA-SSD/1.0.0\", + "application/eat+cwt; eat_profile=\"tag:psacertified.org,2019:psa#legacy\"", + "application/vnd.enacttrust.tpm-evidence", + "application/vnd.parallaxsecond.key-attestation.cca", + "application/psa-attestation-token", + "application/pem-certificate-chain" + ], + "version": "commit-2063e7e", + "service-state": "READY", + "api-endpoints": { + "newChallengeResponseSession": "/challenge-response/v1/newSession" + } +} +``` + +This JSON response contains all the information that you need to use the verification service. + +The `ear-verification-key` is the cryptographic key that you will use later to verify the results that are returned by the service. + +The `media-types` entry provides the list of the different attestation data formats that the verification service supports. If you look down this list, you will find an entry for the CCA profile of the EAT format. It is the fourth entry in the list. This tells us that the service is capable of processing Arm CCA attestation tokens. + +The `api-endpoints` entry describes the set of RESTful APIs that are supported by the service. When verifying an attestation token, you will use the challenge-response API. + +If you can reach the verification service, you are now ready to use it to evaluate the CCA example token. + +## Save the Public Key of the Verification Service +One of the properties that was returned in the previous step was the public key of the verification service. This key will be needed later to check the signature on the attestation results. + +All that is needed in this step is to copy the contents of the `ear-verification-key` field from the previous step and save it to a separate JSON file. + +The easiest way to do this is to use the jq utility, which is a popular command-line tool that can be used to parse and manipulate JSON data. You may have this tool installed already. But, in case you don’t, you can install it using your local package manager, for instance: + +```bash +sudo apt install jq +``` + +More options for installing the jq utility are available on the jq homepage. + +Now that you have `jq` installed, you can save the public key by repeating the curl command from the previous step and using `jq` to filter the response down to just the public key part. Save it into a file called `pkey.json`. You can store it in the same directory where you downloaded the CCA example token, so remember to substitute this directory path when you run the command below: + +```bash +curl http://veraison.test.linaro.org:8080/.well-known/veraison/verification | jq ‘.”ear-verification-key”’ > $HOME/pkey.json +``` +You have now saved the public key of the verification service. You are now ready to submit the CCA example attestation token to the service and get an attestation result. + +## Submit the CCA Example Token to the Verification Service +To submit the example CCA attestation token to the verification service, you will need to use the `evcli` tool once again. + +First, configure the correct API endpoint for the Linaro verifier service: + +```bash +export API_SERVER=http://veraison.test.linaro.org:8080/challenge-response/v1/newSession +``` + +Now submit the token using the following command, once again substituting the directory path with the correct location for your environment. The output of this command is an attestation result, which will be saved in a file called attestation_result.jwt in the same directory as the example token: + +```bash +./evcli cca verify-as relying-party --token $HOME/cca_example_token.cbor > $HOME/attestation_result.jwt +``` +The verification service has now evaluated the token and returned a result, which you have saved. + +The last two steps in this learning path will be about understanding the result data that came back from the verification service. diff --git a/content/learning-paths/servers-and-cloud-computing/cca-veraison/cca-attestation.md b/content/learning-paths/servers-and-cloud-computing/cca-veraison/cca-attestation.md new file mode 100644 index 000000000..ea1a7b5c7 --- /dev/null +++ b/content/learning-paths/servers-and-cloud-computing/cca-veraison/cca-attestation.md @@ -0,0 +1,22 @@ +--- +title: CCA Attestation +weight: 2 + +### FIXED, DO NOT MODIFY +layout: learningpathall +--- + +Confidential computing is about protecting data in use. This protection comes from the creation of a security boundary around the computation being performed. This security boundary creates what is normally called a Trusted Execution Environment (TEE). The data and code that executes within the TEE is protected from the outside world. Different technologies exist for creating this secure boundary. In the case of Arm CCA, the secure boundary is provided by the Realm Management Extensions (RME), which are part of the Arm Architecture v9 for A-profile CPUs. + +A secure boundary is necessary for confidential computing, but it is not sufficient. There must also be a way to establish trust with the target compute environment that the boundary is protecting (the TEE). Trusting the environment implicitly does not meet the strict definition of confidential computing. Instead, trust needs to be built by a process that is both explicit and transparent. This process is known as attestation. The role of attestation is described in the figure below. + +![Attestation role](./attestation-role.png) + +All confidential computing architectures provide attestation as a means of building trust. The exact details of attestation vary from one type of platform to another. This learning path will help you to understand the common concepts, while also guiding you through a practical exercise that focuses on how attestation is performed with CCA. + +At the heart of the CCA attestation process is a small, self-contained packet of data known as a CCA attestation token. CCA attestation tokens are produced by realms. They contain evidence about the booted state of the realm. They also contain evidence about the state of the CCA host platform on which the realm is running, including details about the hardware and firmware. You will learn more about this evidence later in the learning path. + +CCA attestation tokens have two very important properties. The first is that they are cryptographically signed using a private key that is strongly protected by the platform where the realm is running. The second is that they can be evaluated remotely using an attestation verification service. The verification service acts as a trust authority. It can verify the token’s cryptographic signature, which ensures that the evidence is authentic. It can also compare the evidence against the expectations of a trustworthy platform. These two properties combine to allow a user of the realm to decide whether the realm will provide an adequate trusted environment for confidential computing. + +In the rest of this learning path, you will download a file that contains an example of a CCA attestation token. You will then use command-line tools to inspect the contents of the token, and you will see how to use an attestation verifier service to verify and evaluate the token. + diff --git a/content/learning-paths/servers-and-cloud-computing/cca-veraison/inspect-result.md b/content/learning-paths/servers-and-cloud-computing/cca-veraison/inspect-result.md new file mode 100644 index 000000000..9dc03c488 --- /dev/null +++ b/content/learning-paths/servers-and-cloud-computing/cca-veraison/inspect-result.md @@ -0,0 +1,81 @@ +--- +title: CCA Attestation +weight: 5 + +### FIXED, DO NOT MODIFY +layout: learningpathall +--- + +## Build the ARC Tool + +TODO: move to setup? +You are already familiar with the evcli tool, which can be used to process attestation tokens. There is a very similar tool called arc, which can be used to process attestation results. + +The arc tool is also part of the Veraison project. Change into a fresh directory and clone its repository as follows: + +```bash +git clone https://github.com/veraison/ear.git +``` + +The arc tool is in a subdirectory of this repo, so change directory as follows: + +```bash +cd ear/arc +go build +``` + +You are now ready to proceed to the final step in this learning path, where you will use the arc tool to inspect the attestation result. + +## Evaluate the Attestation Result +You have now submitted the example CCA attestation token to the Veraison verification service hosted by Linaro and saved the result to the file `attestation_result.jwt`. In this step, you will examine the result and see how it can be used to evaluate the trustworthiness of a CCA realm. + +The attestation result is a JWT file, which stands for JSON Web Token. This means that the result has been cryptographically signed by the Veraison verification service. In a previous step, you saved the public key that will be used to verify the signature. + +The following command will use the `arc` tool, which you built in the previous step, to verify the cryptographic signature on the attestation result, and display the result in a human-readable format: + +```bash +./arc verify --pkey $HOME/pkey.json --color $HOME/attestation_result.jwt +``` + +This command produces quite a lot of output. However, you will notice that a large amount of the output simply reflects the contents of the CCA attestation token that you inspected earlier with the evcli tool. The most interesting part of the output is towards the bottom, and should look like this: + +```output +[trustworthiness vectors] +submod(CCA_REALM): +Instance Identity [affirming]: recognized and not compromised +Configuration [none]: no claim being made +Executables [warning]: unrecognized run-time +File System [none]: no claim being made +Hardware [none]: no claim being made +Runtime Opaque [none]: no claim being made +Storage Opaque [none]: no claim being made +Sourced Data [none]: no claim being made + +submod(CCA_SSD_PLATFORM): +Instance Identity [affirming]: recognized and not compromised +Configuration [affirming]: all recognized and approved +Executables [affirming]: recognized and approved boot- and run-time +File System [none]: no claim being made +Hardware [affirming]: genuine +Runtime Opaque [affirming]: memory encryption +Storage Opaque [affirming]: encrypted secrets with HW-backed keys +Sourced Data [none]: no claim being made +``` + +This part of the output shows how the verification service has compared the attestation token against its expectations of a trustworthy system. It also shows what conclusions were drawn from that comparison. + +It is important to understand that an attestation result is not a simple yes/no answer to the question of whether the system is trustworthy. Instead, it is a set of data points (known as _trustworthiness_ vectors). Each data point shows how a particular aspect of the system compares against the expectations set by the verification service. Each point of comparison can lead to one of the following results: + +- __Affirming__. This is the most favourable result. It is given when the evidence in the attestation token shows a good match against the expectations of a trustworthy system. +- __Warning__. This is a less favourable result. It is given when the attestation token does not show a good match against the expectations of a trustworthy system. +- __None__. This is an unfavourable result, meaning that no comparison was possible, either because data was missing from the evidence in the attestation token, or because the verification service does not have any expectations to compare the evidence against, and is therefore unable to draw any conclusion. +- __Contraindicated__. This is the least favourable result. It is given when the evidence in the attestation token specifically contradicts the expectations of a trustworthy system. + +You will also notice that the result is grouped into two sections (known as submodules, and indicated with the `submod()` notation). Recall from the earlier steps that the CCA attestation token is grouped into two parts: the _realm_ token and the _platform_ token. This same grouping is therefore also reflected in the attestation result. There are separate results for each. + +How is all this data used to make a single yes/no decision about whether this realm is trustworthy for a confidential computation to take place? After all, making such a decision is the whole purpose of the attestation process. + +The next learning path in this series on Arm CCA will answer this question by taking you through the steps needed to deploy an example workload that depends on attestation to release some secret data into a running realm. You will learn how to use policies to govern the strictness of the attestation process. You will also see how the workflow steps and data that you have just been using can be orchestrated together to form the common programming patterns of confidential computing. + + +TODO: "next learning path" section? \ No newline at end of file diff --git a/content/learning-paths/servers-and-cloud-computing/cca-veraison/veraison.md b/content/learning-paths/servers-and-cloud-computing/cca-veraison/veraison.md new file mode 100644 index 000000000..034374c52 --- /dev/null +++ b/content/learning-paths/servers-and-cloud-computing/cca-veraison/veraison.md @@ -0,0 +1,16 @@ +--- +title: Veraison +weight: 3 + +### FIXED, DO NOT MODIFY +layout: learningpathall +--- + +The tools and services that you will use in this learning path come from an open-source project called Veraison. Veraison (pronounced “ver-ayy-sjon”) is a project that was founded within Arm but has since been donated to the Confidential Computing Consortium (CCC) as an ongoing community project with a growing number of contributors from other organisations. + +Veraison focuses on the verification aspect of attestation. It provides reusable tools and components that can be used to construct verification services or libraries. + +Confidential computing is a new and fast-growing industry. There are many stakeholders including hardware manufacturers, firmware vendors, service providers, application developers, end users and regulators. Attestation is an end-to-end process that has the potential to impact all of them. Good alignment and interoperability are essential. The Veraison project is being developed in parallel with several standardisation efforts across various industry bodies. Veraison demonstrates the effectiveness of these standards in practice, facilitates their ongoing development within open communities, and makes it possible to build functioning software from them. + +In this learning path, you will use some of the command-line tools that Veraison provides. You will also make use of an attestation verifier service that is built entirely from Veraison components. + From 6b7973fa4f223fca14644ff79f8c2e8d15082c76 Mon Sep 17 00:00:00 2001 From: pareenaverma Date: Mon, 25 Nov 2024 10:52:38 -0500 Subject: [PATCH 02/17] Update _next-steps.md --- .../servers-and-cloud-computing/cca-veraison/_next-steps.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/learning-paths/servers-and-cloud-computing/cca-veraison/_next-steps.md b/content/learning-paths/servers-and-cloud-computing/cca-veraison/_next-steps.md index 8a0646476..34fb603bf 100644 --- a/content/learning-paths/servers-and-cloud-computing/cca-veraison/_next-steps.md +++ b/content/learning-paths/servers-and-cloud-computing/cca-veraison/_next-steps.md @@ -1,5 +1,5 @@ --- -next_step_guidance: Now that you have gained some hands-on experience with the data formats and workflows associated with attestation for confidential computing, you may wish to explore some additional resources and specifications, which go into greater detail on some of the individual aspects. TODO: structure the resources +next_step_guidance: Now that you have gained some hands-on experience with the data formats and workflows associated with attestation for confidential computing, you may wish to explore some additional resources and specifications, which go into greater detail on some of the individual aspects. recommended_path: /learning-paths/PLACEHOLDER_CATEGORY/PLACEHOLDER_LEARNING_PATH/ From e7d1593f767fedf57d141a5ddfc9566ea28b8750 Mon Sep 17 00:00:00 2001 From: Annie Tallund Date: Wed, 27 Nov 2024 13:45:30 +0100 Subject: [PATCH 03/17] Technical review of CCA Attestation LP --- .../cca-veraison/_index.md | 13 ++-- .../cca-veraison/_next-steps.md | 2 +- .../cca-veraison/attestation-token.md | 73 ++++++++++++------ .../cca-veraison/attestation-verification.md | 27 +++---- .../cca-veraison/cca-attestation.md | 15 +++- .../cca-veraison/download_raw.png | Bin 0 -> 38258 bytes .../{inspect-result.md => evaluate-result.md} | 11 +-- .../cca-veraison/veraison.md | 16 ---- 8 files changed, 84 insertions(+), 73 deletions(-) create mode 100644 content/learning-paths/servers-and-cloud-computing/cca-veraison/download_raw.png rename content/learning-paths/servers-and-cloud-computing/cca-veraison/{inspect-result.md => evaluate-result.md} (94%) delete mode 100644 content/learning-paths/servers-and-cloud-computing/cca-veraison/veraison.md diff --git a/content/learning-paths/servers-and-cloud-computing/cca-veraison/_index.md b/content/learning-paths/servers-and-cloud-computing/cca-veraison/_index.md index d3fd2946f..04fb683c3 100644 --- a/content/learning-paths/servers-and-cloud-computing/cca-veraison/_index.md +++ b/content/learning-paths/servers-and-cloud-computing/cca-veraison/_index.md @@ -14,22 +14,21 @@ learning_objectives: prerequisites: - - Aarc64 or x86 computer running Linux. You can use a server instance from the cloud service provider of your choice. + - An Arm-based or x86 computer running Ubuntu. You can use a server instance from the cloud service provider of your choice. author_primary: Paul Howard ### Tags skilllevels: Introductory -subjects: PLACEHOLDER SUBJECT +subjects: Performance and Architecture armips: - - PLACEHOLDER IP A - - PLACEHOLDER IP B -tools_software_languages: - - PLACEHOLDER TOOL OR SOFTWARE C - - PLACEHOLDER TOOL OR SOFTWARE D + - Cortex-A operatingsystems: - Linux +tools_software_languages: + - CCA + ### FIXED, DO NOT MODIFY diff --git a/content/learning-paths/servers-and-cloud-computing/cca-veraison/_next-steps.md b/content/learning-paths/servers-and-cloud-computing/cca-veraison/_next-steps.md index 34fb603bf..18da1923d 100644 --- a/content/learning-paths/servers-and-cloud-computing/cca-veraison/_next-steps.md +++ b/content/learning-paths/servers-and-cloud-computing/cca-veraison/_next-steps.md @@ -1,5 +1,5 @@ --- -next_step_guidance: Now that you have gained some hands-on experience with the data formats and workflows associated with attestation for confidential computing, you may wish to explore some additional resources and specifications, which go into greater detail on some of the individual aspects. +next_step_guidance: Now that you have gained some hands-on experience with the data formats and workflows associated with attestation for confidential computing, you may wish to explore some additional resources and specifications, which go into greater detail on some of the individual aspects. recommended_path: /learning-paths/PLACEHOLDER_CATEGORY/PLACEHOLDER_LEARNING_PATH/ diff --git a/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-token.md b/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-token.md index 82e7f1b3c..a6479285f 100644 --- a/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-token.md +++ b/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-token.md @@ -1,39 +1,67 @@ --- title: Download and inspect the attestation token -weight: 3 +weight: 4 ### FIXED, DO NOT MODIFY layout: learningpathall --- -TODO: CONTEXT + +In this section, you will obtain an example CCA attestation token. + +## Install Go + +In order to run the tools used for attestation, start by installing the Go language on your system. First, you will remove any existing Go installation. After that, you obtain the install files and + +```bash +rm -rf /usr/local/go + +wget https://go.dev/dl/go1.23.3.linux-$(dpkg --print-architecture).tar.gz +tar -C /usr/local -xzf go1.23.3.linux-$(dpkg --print-architecture).tar.gz +``` + +Export the installation path and add it to your $PATH environment variable. + +```bash +export PATH=$PATH:/usr/local/go/bin +``` +Verify the installation by checking that the command outputs the installed version. + +```bash +go version +``` + +## Install Git + +Verify that `git` is installed using the command below. It should output the version available on your computer. + +```bash +git --version +``` ## Download the Example CCA Attestation Token -In this learning path, you will work with an example CCA attestation token. You can download the example token as follows: Using your preferred web browser, navigate to the [token in the TrustedFirmware-M tools repository](https://github.com/TrustedFirmware-M/tf-m-tools/blob/main/iat-verifier/tests/data/cca_example_token.cbor) Use GitHub’s download button, located on the right of the upper toolbar, to download the token as a *raw* (binary) file. -TODO print screen +![download_raw.png](./download_raw.png) -Place this file in any convenient folder on your development machine, while keeping the file name the same. The rest of this learning path will use the notation `$HOME/cca_example_token.cbor`. You should substitute your chosen path in each case. +Place this file in the `$HOME` folder, while keeping the file name the same. The rest of this learning path will use the notation `$HOME/cca_example_token.cbor` as the file path. -### A Note About CBOR Files +{{% notice Note %}} You will notice that the filename extension on the example token is `.cbor`, which also denotes the format of the data. CBOR is the Concise Binary Object Representation. You are likely to already be familiar with JSON (the JavaScript Object Notation). JSON provides a standard way to convey nested structures of key-value pairs. CBOR is conceptually the same as JSON. The difference is that CBOR is a binary format, rather than a text-based format like JSON. CBOR is designed for compactness and ease of machine-readability, but at the expense of human-readability. You can learn more about CBOR here. +{{% /notice %}} ## Build the EVCLI Tool -TODO: setup section in the beginning? - Now that you have downloaded the example CCA attestation token, the next step is to look inside the token and learn about the data that it contains. Because the token is a binary file, you will need to use a tool to parse the file and display its contents. The tool that you will use is a command-line tool called `evcli` (which is short for the EVidence Command Line Interface – remember that attestation tokens are used to convey evidence about realms and the platforms on which they are hosted). The `evcli` tool is part of the Veraison open-source project, which was covered in the previous section. -The tool uses the Go programming language. Make sure that you install Go if you don’t already have this on your system. - Clone the source code using git as follows: ```bash +cd $HOME git clone https://github.com/veraison/evcli.git ``` Change the directory and build the tool: @@ -52,7 +80,7 @@ Now that you have built the `evcli` command-line tool, you can use it to inspect Run the following command, taking care to substitute the correct path where you stored the CCA example token from the earlier step. ```bash -./evcli cca print $HOME/cca_example_token.cbor +./evcli cca print --token $HOME/cca_example_token.cbor ``` The contents of the token are displayed as JSON. Check that the output matches the below. Some of the output has been removed for better readability. @@ -103,19 +131,18 @@ The contents of the token are displayed as JSON. Check that the output matches t It is not important to understand every detail of the attestation token right now, but here are some of the most important highlights: -• The CCA attestation token is a variant of a more general-purpose attestation data format known as the Entity Attestation Token (EAT). The EAT specification has been established to create more alignment across the industry with respect to attestation data, so that common tools and libraries can be used to process it. -• Specific variants of the EAT format are known as profiles, so this token is adopting the Arm CCA profile of the EAT specification. -• The CCA attestation token is divided at the top level into two sub-tokens. These are known individually as the platform token and the realm token. -• The platform token contains the evidence about the Arm CCA platform on which the realm is running, which includes details about the state of the hardware and firmware that compose the platform. You can think of the platform as being like a single server or self-contained computing device. A single platform could host many realms, which could be executing as virtual machines or containers. Therefore, many realms might produce the same platform token. -• The realm token contains the evidence about the realm itself, which is running on the platform. It is the more dynamic part of the token. It includes information about the realm’s initial memory contents and boot state. -• The top-level data items in each sub-token are known as claims. A claim is an individual evidence fragment that describes a specific property of the system. -• The claims of the platform token are labelled with the prefix `cca-platform-*` -• The claims of the realm token are labelled with the prefix `cca-realm-*` -• Many of the claims take the form of _measurements_. A measurement is a hash (checksum) that is computed from one of the firmware or software components that are running within the realm or within the platform. Checking these measurements against known-good values is an essential step for evaluating the trustworthiness of the realm. Any mismatch could mean that the system is running some software or firmware that has been tampered with, or is at the wrong patch or version level. - -TODO: rewrite below? +- The CCA attestation token is a variant of a more general-purpose attestation data format known as the Entity Attestation Token (EAT). The EAT specification has been established to create more alignment across the industry with respect to attestation data, so that common tools and libraries can be used to process it. +- Specific variants of the EAT format are known as profiles, so this token is adopting the Arm CCA profile of the EAT specification. +- The CCA attestation token is divided at the top level into two sub-tokens. These are known individually as the platform token and the realm token. +- The platform token contains the evidence about the Arm CCA platform on which the realm is running, which includes details about the state of the hardware and firmware that compose the platform. You can think of the platform as being like a single server or self-contained computing device. A single platform could host many realms, which could be executing as virtual machines or containers. Therefore, many realms might produce the same platform token. +- The realm token contains the evidence about the realm itself, which is running on the platform. It is the more dynamic part of the token. It includes information about the realm’s initial memory contents and boot state. +- The top-level data items in each sub-token are known as claims. A claim is an individual evidence fragment that describes a specific property of the system. +- The claims of the platform token are labelled with the prefix `cca-platform-*` +- The claims of the realm token are labelled with the prefix `cca-realm-*` +- Many of the claims take the form of _measurements_. A measurement is a hash (checksum) that is computed from one of the firmware or software components that are running within the realm or within the platform. Checking these measurements against known-good values is an essential step for evaluating the trustworthiness of the realm. Any mismatch could mean that the system is running some software or firmware that has been tampered with, or is at the wrong patch or version level. + You might find it instructive to view the token in a formatting tool such as https://jsonviewer.stack.hu, where you can interactively expand and collapse different parts of the object tree to gain a better feel for the structure. Doing this may help you to digest the bullet points above. -Exercise: see if you can find the measurement of the Realm Management Monitor (RMM). The RMM is part of the firmware for a CCA platform. +To test out the formatting tool, see if you can find the measurement of the Realm Management Monitor (RMM). The RMM is part of the firmware for a CCA platform. Next, you will see the steps involved in verifying and evaluating a CCA attestation token. diff --git a/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-verification.md b/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-verification.md index d077f50de..40c0df51b 100644 --- a/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-verification.md +++ b/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-verification.md @@ -1,6 +1,6 @@ --- title: Use the verification service -weight: 4 +weight: 5 ### FIXED, DO NOT MODIFY layout: learningpathall @@ -9,7 +9,7 @@ layout: learningpathall ## Attestation Verification Service for Pre-Silicon CCA Platforms Linaro provides an attestation verifier service for pre-silicon CCA platforms, such as the Fixed Virtual Platform (FVP). This service is available publicly and is hosted on Linaro infrastructure. This verification service can be used to verify CCA attestation tokens that come from emulated Arm platforms, including the example token that you have been using in this exercise. -Linaro’s verification service is implemented using components from the open source Veraison project, which was introduced in the overview step. +Linaro’s verification service is implemented using components from the open source Veraison project. The URL for reaching this experimental verifier service is http://veraison.test.linaro.org:8080 @@ -49,30 +49,27 @@ This is a simple call to query the well-known characteristics of the verificatio } ``` -This JSON response contains all the information that you need to use the verification service. +This JSON response contains all the information that you need to use the verification service. Review the different JSON properties. -The `ear-verification-key` is the cryptographic key that you will use later to verify the results that are returned by the service. +- The `ear-verification-key` is the cryptographic key that you will use later to verify the results that are returned by the service. -The `media-types` entry provides the list of the different attestation data formats that the verification service supports. If you look down this list, you will find an entry for the CCA profile of the EAT format. It is the fourth entry in the list. This tells us that the service is capable of processing Arm CCA attestation tokens. +- The `media-types` entry provides the list of the different attestation data formats that the verification service supports. If you look down this list, you will find an entry for the CCA profile of the EAT format. It is the fourth entry in the list. This tells us that the service is capable of processing Arm CCA attestation tokens. -The `api-endpoints` entry describes the set of RESTful APIs that are supported by the service. When verifying an attestation token, you will use the challenge-response API. +- The `api-endpoints` entry describes the set of RESTful APIs that are supported by the service. When verifying an attestation token, you will use the challenge-response API. If you can reach the verification service, you are now ready to use it to evaluate the CCA example token. ## Save the Public Key of the Verification Service -One of the properties that was returned in the previous step was the public key of the verification service. This key will be needed later to check the signature on the attestation results. -All that is needed in this step is to copy the contents of the `ear-verification-key` field from the previous step and save it to a separate JSON file. +One of the properties that was returned in the previous step was the public key of the verification service. This key will be needed later to check the signature on the attestation results. All that is needed in this step is to copy the contents of the `ear-verification-key` field from the previous step and save it to a separate JSON file. -The easiest way to do this is to use the jq utility, which is a popular command-line tool that can be used to parse and manipulate JSON data. You may have this tool installed already. But, in case you don’t, you can install it using your local package manager, for instance: +The easiest way to do this is to use the jq utility, which is a popular command-line tool that can be used to parse and manipulate JSON data. You can install it using your local package manager, for instance: ```bash sudo apt install jq ``` -More options for installing the jq utility are available on the jq homepage. - -Now that you have `jq` installed, you can save the public key by repeating the curl command from the previous step and using `jq` to filter the response down to just the public key part. Save it into a file called `pkey.json`. You can store it in the same directory where you downloaded the CCA example token, so remember to substitute this directory path when you run the command below: +You can save the public key by repeating the curl command from the previous step and use `jq` to filter the response down to just the public key part. Save it into a file called `pkey.json`: ```bash curl http://veraison.test.linaro.org:8080/.well-known/veraison/verification | jq ‘.”ear-verification-key”’ > $HOME/pkey.json @@ -80,15 +77,13 @@ curl http://veraison.test.linaro.org:8080/.well-known/veraison/verification | jq You have now saved the public key of the verification service. You are now ready to submit the CCA example attestation token to the service and get an attestation result. ## Submit the CCA Example Token to the Verification Service -To submit the example CCA attestation token to the verification service, you will need to use the `evcli` tool once again. - -First, configure the correct API endpoint for the Linaro verifier service: +To submit the example CCA attestation token to the verification service, you will need to use the `evcli` tool once again. First, configure the correct API endpoint for the Linaro verifier service: ```bash export API_SERVER=http://veraison.test.linaro.org:8080/challenge-response/v1/newSession ``` -Now submit the token using the following command, once again substituting the directory path with the correct location for your environment. The output of this command is an attestation result, which will be saved in a file called attestation_result.jwt in the same directory as the example token: +Now submit the token using the following command. The output of this command is an attestation result, which will be saved in a file called `attestation_result.jwt`: ```bash ./evcli cca verify-as relying-party --token $HOME/cca_example_token.cbor > $HOME/attestation_result.jwt diff --git a/content/learning-paths/servers-and-cloud-computing/cca-veraison/cca-attestation.md b/content/learning-paths/servers-and-cloud-computing/cca-veraison/cca-attestation.md index ea1a7b5c7..c9fb9f95f 100644 --- a/content/learning-paths/servers-and-cloud-computing/cca-veraison/cca-attestation.md +++ b/content/learning-paths/servers-and-cloud-computing/cca-veraison/cca-attestation.md @@ -1,22 +1,31 @@ --- -title: CCA Attestation +title: CCA Attestation and Veraison weight: 2 ### FIXED, DO NOT MODIFY layout: learningpathall --- +All confidential computing architectures provide attestation as a means of building trust. This learning path will help you to understand the common concepts in attestation, while also guiding you through code examples that focuses on how attestation is performed with CCA. This section contains an overview of the topic, building a common understanding before diving into the practical part. + +## Overview Confidential computing is about protecting data in use. This protection comes from the creation of a security boundary around the computation being performed. This security boundary creates what is normally called a Trusted Execution Environment (TEE). The data and code that executes within the TEE is protected from the outside world. Different technologies exist for creating this secure boundary. In the case of Arm CCA, the secure boundary is provided by the Realm Management Extensions (RME), which are part of the Arm Architecture v9 for A-profile CPUs. A secure boundary is necessary for confidential computing, but it is not sufficient. There must also be a way to establish trust with the target compute environment that the boundary is protecting (the TEE). Trusting the environment implicitly does not meet the strict definition of confidential computing. Instead, trust needs to be built by a process that is both explicit and transparent. This process is known as attestation. The role of attestation is described in the figure below. ![Attestation role](./attestation-role.png) -All confidential computing architectures provide attestation as a means of building trust. The exact details of attestation vary from one type of platform to another. This learning path will help you to understand the common concepts, while also guiding you through a practical exercise that focuses on how attestation is performed with CCA. At the heart of the CCA attestation process is a small, self-contained packet of data known as a CCA attestation token. CCA attestation tokens are produced by realms. They contain evidence about the booted state of the realm. They also contain evidence about the state of the CCA host platform on which the realm is running, including details about the hardware and firmware. You will learn more about this evidence later in the learning path. CCA attestation tokens have two very important properties. The first is that they are cryptographically signed using a private key that is strongly protected by the platform where the realm is running. The second is that they can be evaluated remotely using an attestation verification service. The verification service acts as a trust authority. It can verify the token’s cryptographic signature, which ensures that the evidence is authentic. It can also compare the evidence against the expectations of a trustworthy platform. These two properties combine to allow a user of the realm to decide whether the realm will provide an adequate trusted environment for confidential computing. -In the rest of this learning path, you will download a file that contains an example of a CCA attestation token. You will then use command-line tools to inspect the contents of the token, and you will see how to use an attestation verifier service to verify and evaluate the token. +## Veraison + +The tools and services that you will use in this learning path come from an open-source project called Veraison. Veraison (pronounced “ver-ayy-sjon”) is a project that was founded within Arm but has since been donated to the Confidential Computing Consortium (CCC) as an ongoing community project with a growing number of contributors from other organizations. Veraison focuses on the verification aspect of attestation. It provides reusable tools and components that can be used to construct verification services or libraries. + +Confidential computing is a new and fast-growing industry. There are many stakeholders including hardware manufacturers, firmware vendors, service providers, application developers, end users and regulators. Attestation is an end-to-end process that has the potential to impact all of them. Good alignment and interoperability are essential. The Veraison project is being developed in parallel with several standardization efforts across various industry bodies. Veraison demonstrates the effectiveness of these standards in practice, facilitates their ongoing development within open communities, and makes it possible to build functioning software from them. + +In this learning path, you will use some of the command-line tools that Veraison provides. You will also make use of an attestation verifier service that is built entirely from Veraison components. +Now that you have some background, move on to the next section where you will download a file that contains an example of a CCA attestation token. You will then use command-line tools to inspect the contents of the token, and you will see how to use an attestation verifier service to verify and evaluate the token. diff --git a/content/learning-paths/servers-and-cloud-computing/cca-veraison/download_raw.png b/content/learning-paths/servers-and-cloud-computing/cca-veraison/download_raw.png new file mode 100644 index 0000000000000000000000000000000000000000..6dc6a0e481f07c1a8cd20696a2cba878027fdbb1 GIT binary patch literal 38258 zcmdpe1zTM^*DY4qMT(W;g*);34nv835$_H&*t~_is>TBVJx9VP0Nb zDQgP@BU6145aLL?h!HYAX|&$-A)wBW&-&aAQCW~vsU-Fo(NcqE5#gqz%MGUm4@@?D z&~M)4N6N~ixdJ4Sp|LTpdWMnu&_IT^O;;7kNinM_) z0sjO0_g@fyBM^u`;~*eJ@8P?NqWnOh-b1AKk5mTOKdIm$8Q}lKL1zBQ$Sun&Ec_nI z>RRjTo7(^_Y|AB+A0bz4wd5@au+iK%F znwgs0usE{g{h5R1J^sgIN<7>@v)G!j<0*+t;qqEo>*F#|P*G6faX{nZ;<8!m8L-Ik z3H&Yo{uetQ(AL(Hg_6?2!GXeomcqi?kdm62nVFJ`hLVPc{5=P`jgz^pwj;T@4gOz+ z{8J8}zKyQ6k)^GXg*omY9of{N1eg22%c!LPc`eM|1#LP0W0t>#|2y%23;wB6=|3u&shIv-<$tC8m*gK!V3D*ode^4?2ZkKf zY?S|c_IG|Z%0B@9FTnq@=ATdB&B+1HM)^Ok!2ylQ6C()%!UZDC$1UdwdaV8-1!V@6 zV+gY8N2TbynE_rITKHO^kdKO${8Bl*Ec`6FggLAbpom5Xr{?zBO>cWm7H7J*7dop| zqWjEGF05Aur_1-dt%*-7$aDCfzI+g%+*}9<5dS;CgqWOnjW74|z{Lds!2Wl@!v)B; zh4`&t69AxH0~3t(`Cmo;k-d}H?RVO^+bO^_?867Se^;cZzZaK~62uCik$1kgyEj)Q zaaAKNreiI<>VtudD(wd+p%^(@Dq)P@$jW^6gi*AR8DEhaj3U9$y}Ki{D4(7>=;`j2 z0V)x!G}^?2(dOm5GFLa6Mj!~pBM5{2wh+*Wp7Va3Le2QaK{v@tR=jYj+E z$%i~UVT>OC3D5v*rGLZdIn4vIn?L@8!?Y^k)*~fLEhgNV3He*d=y;^f|Hkwk=o~Px zIg2%Eg93QjYM?3PpfCE5!woSXDi&VB(U1Q!0&WB}z{f|BIK4-%f6+GXJduw*B@jWt zaKE4VcdY>RR0{J;N&+<>mP6mk{yNGB$fmX3PWg>}-?SlQC=HI>(d3L8|4BaA##jPmyQ=Vdv(?|e(g1(nED4W&pvq1&x9d}6Bo9}G6d?)=;A##Pcj#5t>K!%vV{Vf zkr%e-DLt?CJl{AkubeD*%z!|&l?F^6W*a?xNy#w+die05eD?g#LIGj-OOdN{o^zr? zKIoqfU$A&lEqbJ4@eZQ4F;Jp29%ItOp-{Fsc8JxZf@SuHN|(4lBO`a+8%kzk;kYpj z7|EKdfu%MfiYwDPN)x^1yqrtd5Hp)Oe!h7wk99h{Mu-0RG1J3COs;~RdzAVv`*wBYRLo`-BfPEoY+x@?uvxWj<=KpDKmlGTc(DgC8QeZv!%?X%qVnRD z*X3WQm4tP@d1XqqLC)95;>uNene0t<=#uOVPvc)3@w~)UTw{bNe5p7X7$r#Y{u~yB zA(mylYg27KgWR0C;J%t&;j~^S;RTP|*OtU5YLsIGleZ&X%V%B#imnQF=5T}`;AQq- zy#f2&F3nOFso%sHfiNl%9L)ER}XgNd=F_wFZ8}kQI@g({B z#CSP$#?x*h_Q+w2vc;HTQ*4bm47U^Q`VQ@_?QVST49PZ7xk6*{$2#>VL7CRir2hut)*3|7u;vQo zSIld<2QRD?wOBB_6V|Vo0!tY%+{i;l%uV9X^TRO=Y87S}Qg8U6&w%MEK|6!Mpbeo-!iASJm6-ZNZZNn5>F& zM^ql1n5w1c%ybc_e*cc$LEb93{sW17yB`W|5z9g`c$j)CHm?oi8qvKz195syOS|r! zFa!Tj7TTTBWAO{q(C4uMszKEE!Yf%W_uYZskR{H=Yn135oEaQ?4`=SI*#8LO!P_h_{mJR z@6&K-B1pkEx!B?`{X&_r z;(r)3nn470O4hyWk;vfV=QrsWnhe|Zd_@!%(y<#<7GV1KeG-d3(EDHx9Z-QC@tRJQSR%Y`%TV5HdEEWTj4 zb%Xmv-N_P(MH-u2u>oAs+c0emMJkTjT4l6CxpMKK`_af;p`38A-_v+z7oGbCp561y z-D)P!2N)SwS2l9Z$|(EeWq!lalw39^YuSb>{lbSOi>Uhgod@g7ZIVa3TP(X3Ma`cQ zSG$yQI|iSI#c*nz;|Jr(1l=uG1lmSaxwyHx=k#X@nhYmdy-WslZ%v+Ty{~U38rT0P;xrw&0VQqlX9**{^fjwVK!eA$Y8O`qoI)| zSF9jz+K7@*2Z4j#!5m!$awleB(mrBL*S@g7Gh-7T@oJ-EWU`v-pFhYK!C> z!eQ#nq%y(IR)E(9`x+lDcqUCf8{WMv&08AJ@pp+^ygIWyqv%N zvv&77&a0k^juT(V8QQU~lo6Z5tux(5G<|lwXs2TuxY52zxJ^Y$7hAw|RU}k)dTYdp z2(c9w_Ex~_p&Dc?vkm=V5@VU~$8Up!J>8H#7j)_Ft$kL-V}z4hARIaib{Kd3 zpe8Gb{rSRc(LRqx-0al2Kijy!9A24!b-Qmp!6H)O6st^-Ka9o&$R>hN9%;l3p5rb> z9j)L{(8R+ zIJXx;183?V5b7nMjlNg!ibCp@n4*~Y@W~Pa4mVtSzbkzVLCEKemK>9ziporN!p%=O z4ae9j%Qb+0RL+aKOHDt2HN%QR^oR5d_C7Z-YM%^B&j{`*KqpXa?_}qqeTRi0s@3GKlqCd&yqv*Y1kJ-lx&9TNUxY{!LvoCL zi3_{e?tFw6T4*t6K-Or&tHJ!K-Lt=L^ATO21=+*dE%(;Ao7*MH%SE4nt^%FmDH}gtzT^x42V3rn7|ma0 z2oVrknfk9@zS9@}XGZNA-yS3I7K;_jb900DijNda)N+OTJi(z*sAoQI6a%itZ%h=W zD|Ps9HlFIr7LT^JY}V*+Kk*6hDJ^+k{jva}0+0c^a&n(R!`l*xjV8=qZj;Lk)R!0@ z&)t?Z4M#F1)Ef)8y8J%L=v{2~h+dOEvG61p>R&|Z4~ARzRPo2KDpJ_ZBXT6aEp~3Z zf|{+?XsBmjRjichlyJU04-xoFk4_)Z0()x)gaJ-+dIYt=ht@-=M=*rh(Nvak!_u=G z5`-hf?B0EX!!+>X{G(~2Ycq&P>RXs=+7}nl0eb>~rFT2M$}mLZgpoekU(HLR6hNoZLR8j)AQi_uqJdpD6>>jf>#?p*1J=7a+wRghw^8zhTE$RNf zu4(BR2Oh2ryI9fMLm3anR(qv-7bdgj5=OESY5L;OdMxnM+*()zR74;M5vi%1v01q* zL8Neq07g2qQN6W}u0Wq2tT5!cWhuQ1l<0YU-J!`=MEz-YF5JY#Kp)+sbr}U4?F6{= zbhXu7WfPX!pw{*z+VxMR5pgzR+gx9)+%r%xtM-fVg4+%5Dkg0$<~xf?^rG%s|SI2cj0)p2FM@g%~DMl-Qjtw}q?OLi|?^x0-#z(LkSY@@$MxyFZR z^dwp!UUI4e)2p=Q(6mdJkRTT1bdL%jFNdP|RTRZ?XfhslyJ>yi)Wz4ipgCB)_M!Ey zyDc7V){+H@)@*;dw#n{%soF&`>FUUqpEzRgJTm(uA2kC-m`dwaD;_q0fW~=y%orEW z>~oHr|0wB5Dyu_@-bIUp>SPrm3~)L?n-nep0`m5>f5B$2M6YtdqM0Fg>-;9q60>ARhd8_dA;8Fyh0V|0Fzi;vxo^ZFM8PYKwpq;821;j7WB39Sllns^ zyYQRE19+CMEy}V%TdxtX@!Fns&yeOw;OLNYw@V(pjOz71~Djt5h|r9 zt!H2ymYdzeWXe8q=ma?TS(0g-?w)?|II-I_+YX1*BzA9*R-EH}Et+qh5Ipe8-AO#+ zUsM^~RcF-KEFzSE`eq+qU{wTSLIYt0v$9ie4{pIXwn+O!vt74;{k>>?0$_1CFK_S< zu{p7b1OwS7 zfPSO=Qywx*n+i^rGr>|q`|_hK>$dWvXz(nY_g4P=^u#9b7qel3ldffCl^<%}oPKja~%_G4r)_m0~U>moPU>mysHA^?V%{K*3n zPjHTREX2J_Aqf5Wt{J+Vh|ydMd6VZ3o%wRJIDN6a!cO7?l>ro39cM>|FxAbf8(`CtRA7fsn-nO460 z18~=86VFS5T6nudZK#4edE!I!rkD@nkBu3P@%=E;(hh`4=ts?!*8>|9`f^UrJdlf$ z!0>Q_N1CIWI@Rl^7kp709AVv5y`p}V%REyVn9yfLqLMnI4HkGsGY=y3lf^ap%Q{nq z`!;yh!k0r+33P0fk!XBB{yhIlI;%q(y_1vC zQJnapOIZptiFgv7T&Anjqiz?G$}b@GiM9==14Ldr!uHKn1h?t#e(o@Q<>#I|PTL%M zHHU~)!^0W*JkN2E+XGgQEGHvWq5MxLg+h^?#yEM|1%&CGj$mB#j3(oHIV{l$U?)@1JTn_=>52& zal;}|-xXC8>cJcUbfu-M?usW}&8R0{A(*UDTCXr2-8?Oia44Cr_9xCr zQ*zhAo-a?NQ{w`mY1wv1uTscJ?=xoExy7e?v!_pXXvmPbNuHjdhc2@v%D~GQqeJHi z#cbF&Ct`ZnQ)RpTgM1U&(#4x;4uDC6wZ1ZMv$UH(QKLmV&dfGg|Grro2qvpJ7c`W^$z}9(@Lr!Fhs2j4`{D@i>wAALi_5 z$0_uY1K6@Y6M7nVgi8b9BfH)bYYtc#jH;p1PPZphV4d~hYje12;QWptb zA*ybvy;bh>I}&YGU(r^v~|qH2FA!S5}m~u){3GNtywO#+1h{NAqegk+zxheVeLkq zYx~3jh>FhHeVL{f*In1v%ErZJ)fS*@G|r2QW6>h*5cgJg$YHd7J`(nS=%=j_80X?? zO?Lez%+QYHMPA|ic`TZNzhB2Vw#lJQziu_sPny1Sl(YKADKDj`9C`7;&V^UWJ6YPO z^vFtc`ejAp_7LF|Dqtl)dyE856Z|xO{F0T{qSv=<5dv9Ttla}vC##n@!O>GP`wPEy zgLnC|lmB`)CKg8VV{#%07f_QWZTkL*>WT9!oa}4(InL~ZAnV8Tts=PbK_K!}{`{I) zFluyYxzn#gVQph*?w8D&;TV!=ys-BfStXJxu$~T)M1YK;|^Aga^FmZ#PfdgbmwN{+W_=hyZQ-q{z6MOVWW z##1adTjGz}C29>>GvNp?rOu(oBH&m920396cW_`?`2%>ZUBh2+Ty&;Ez-+EHfdF`% zN-Y4cgi)FTKZCx=kcSeF$;RiwZV(J{puh#_fUh#XSI>O(i)k2iq1N~Hpq6VUNb&Dt zM&EE}nZcYQZ@O8&Uz*sBu5to7hR^^_64C7KlkAq58T`J1RQ<$M;GjPCh) z!AIcfh3BptcRn7eN7xG3JucnL70Z`Qt77wUqFFDTR?E~1Ju&7_({%N2+Sc3A2Swub zJU`r4X4%kgJl=|=C9KAa4PGQky#lv>wbix3>pE|7JZG-$3KJ+HaA|$acp_<4&GV{o zX!~Uh?zI90eXt_HbyKmmM0;8J^})&H!kmmp3W@yTYHzB^+`{5gOI_5lyJhWTKaLQF z7%VRj4~jN~XMs#^6^(okJ->1_AT;L-5FxqVaZDs8Lh$x@^r^VT@JCIa0fB6u3$lSw z`1%i()72LLd=9@-))RV-y;F{WsxR)mEtWsrAcuU`&4{K)AzI^-a=zV%f7x=I?6XYI z$|gtFdrT-VFJF~c)x1TvC3IjyVj$qv!B)@hb5czo14&c!z@-GvQ=@}&yHi1X-2=JX z7=qF@CmS)x8Wt6Qh8)iY?Dw#ERkoOX`pRs6R)O{BV8?|(<;hiu)C1tVxS7+C;Q3-@ zM9blKg&S7RC~Pdeb(|8Y6HU;-2qtVj|A1P$VUreA@a3tnF+MRVfCPLhD!w(e@^}Om*4S37hJKxv_ihIUElA8zac$MOCOnpMv zlmXV`Xz0#g=V!RH2+EL&XVXJj6a!<@lH4+$J&PK5avP(UqJcJr(&kK1bHA)_SmaB$ zf414>bBw3m8Llb2YGtvwF3@|;*0DngtMs;(jY7O2;9M&v1b5z@w=45uwFWaM z5hEiZO(gIf!?Q{7XwA6jgvk3O(+Ge&HC(|^Gzt}5pkYbQV~jU6f+8bbks{xy-j;e_ z-Em7%m~{>x;V?_}tU8((OtX}Qjm%n2*0}jG) zBM@GrELt8QXM{uUnXl#+f_{9VkPFC@NCd*QdecK^@{1TPq!-xDJ$&5?s8r!HI03kO8StfXW{?ln)4%42X4N=` zvK)?RVQDYat3R%bGaflHae|u={FTiTFTVkO929v?S`C*we~laf4|K~pL6H~yr`J=P zv_xv7;ej`xjM03VE=}T=V^}u1ZIwxw3QI82Q%yuqUU0wP>d!$73m*gzC<`Emx8r|dn+Bd<6$OVby zBI%U4eHjoS#IJ<4@=Op2r>PYNjXaS=_)-dSQQs|;23aP?5%}thJ9r9k-3{8ikS8j~ z4W*(a@8Ooj9p~yC{@e{VRD||{TdOtEQiB{tn=K9L>3!0<(Vb|i_!^ASS3P&O0j%Q) z0D;jd04MWg`?TpH8FA!CFX86)<68KMZIdm4Fz%OU-lv_+bYog=m!s@W3|g~J2wrUs zB=DD6v~9?|k?2_>Y&9Jtbb!|hunM55f1+6^amg7PSy`UCx!)b(tUskXfEQP)Jc?lr z=ucv&o`U3apVr&R*X}y7&&mUMA1Z3Pq^eZaAwXow4Is_pJzit>bA(bGw{zGn!sbfz zvE0LHwAw1?de=dANNR2Rd)^hvo0QBoRm-M{!+)dt<|7~q^L)ALSp1=7?$AA`#*3=v zEi;;BrPfBU_-w^t%^`z|f!8<1kXB4+RE@b*50QYDz8`N8bR&)G0(G{8ANl#N@#fgK zOQc3K_qD9vV5xX2c|k`R86c!URW1udy?W;f?oX^Kj|DY)4(=;gs3vR{`leE6DzUZT zfB*(}Hn&zI-x0>uS`&iBu5gAF$I#){3DrG~-GM~h-AB_Uw~-)YEsqr&K%@inwWy?ppTyCm~#Sy~5IkRE4I;Rrw$6D#n z>F5hlxO{DLa_O6Q@x|aX#d)N1rXyk~9N;P0K}q&-d5X-zhaI(pK1MyGKOy5Kk;T1G zsp9+?0;Saf+JjHIOn?z>L>OS*3&70wcO&7iNi=hbqsu~MH1tpSSdpL7du_KrJ3~YZ z0Vd~>tIZDYzCM+FV&cbvWfd*Iu)xkMP&%6cN`yRbFn(O?fpgL%Oz2&1C=3=90CWcwX~|d_ZaZXcO!Lk&Ypp(0&wZFLq;I!m$5}ffO5d@ zR5*BZ^YBm(NVbT)F|l|i!#D;HL1nE}Z4+7>##wI#in$5Q>(gh2ql*$pg?LFYZF4k9Xk7xY3Btm`OrX)F9 zDOveg_}dtu52pg=x_xS1@9}qRU`mam4J?Q{K=)kkj>E)@pySp&0vM>}wd00A{6Tkc zECBqX59-r`KN>OeOi%yf@=E=fl1NU6RroFa++(>wdU`?{#b}!loNC|S1ER|x7W{T# z?Q@OsK}JX7Xbu`oH80l}ZVJR-P)C>sl^16`7zs$+3b#Ls;=7$BdgR&tiobXvAvy z@XFD=@ATSydloL?Pfq8uPfNxOeQe>rqL4p44b}FIFCsKdzZATDBY^&+Hgpi7zAb@< z-t7AUU2XRVFz5~}wC<8Q)`nP;D`5?Al#ZYp5}H%aIMT}R21`D|{u^xEU~h^DNw4S@-t2A4t;RO>z1yAXse~4g+fQOyV6n?%89xISMOB2d+1ypu_2*Za1 zfcF!`%?pLKYg(RXyc%;m@O|&OL_wR!fBU-9D3xr{nnkYqs(`2z$$1EsP7ks5u<>MH zBvjG_C5{TVo&kq|fWQ3#3D$aBX!wzAvFYn>@|x?7@6G4KaG{#pfCP#@F_%*Gq-9X% z$Mu)Hl0w9XFJA4`S56}$5H6k|$m@@TLzEN8iBqwf1uWY4@x5J_mK{}iBS{R>h7}Nf zqv}o5Zl`PY^)w~|8c9F0OiT0&mI|t?XCMx@(gNYB5>D_Yf8=18Jm8Kiz0v96y3HTD z@gLJEL)0m??$q{{7uY`Hl%+H1N73V82|o3Pq8r^<@M~o$)8E^0WbpoG}XZ z&HS|km6YWqJhhEh9`4z>Gka@>&x0JDK^7;$KHGxj2=%@+^9-Z5h8UHoAOKhdPQOrW zX}##IQYM>czD%glX4#_Knp<_2i}Onm+6i17Jw>>FW-$RCp^#gIT-I>G_P; z0#Qv+*gMS#4?jDKuZ1qJ2mkW%22+fMW;I`&)peU#{g>8+7DjnxJ-kdds%xLqcHo-E z`&LKvjjG^RCE3efIHKEj-50$@oW@puMtyO*rg%`Cm; z`Vm)W|rEVWW>2Ya`7 z13eEK@S@k2Kf&2)0r=tk9+FJkwV zLGmGep=Eq`y?;ZvR>1j%FImsr?SrSMz@hd>Kob5BwV4hLmnQooBlWBCnHwbsns84l z7Ci3p!9~^GF8SB6QPoHPp1Wmf4B9?vO+mZfo7?lscuJv)L>G{e%uoAzlsFFIotW{A2TXTO6Pn*-s3>S^hJSYeJb2={ZzIUFR6o5Drky-M#b$H5{6y}4Kz z9J=<_2;K{L!CXAgxh26a*by#mn^yft5CP&V7HBeB418MV_V37exaVhFT!5{%Ee;W~ zf5;*KL+V@q$OF=Gq{9UEko`I4j1>A8La(5ce~#&2IQ~yIE`)nYy!EsAxH;!A*Bmp! zhXQ|E#Lj(KZ07I(uwwqh0^}majUbeDZnWE@C?6PsG35l~ZXm|Fu_WR_OU=aJ`&S*f z5QIKJ(CDA%!ydREOx7mDr_y=7zv=(v!YM0sp|e;^{HLw|NPEih;IgnJQK+|xf7^&G zIT-36QhJE0S3D#yhf3#9$mFR8R3&_OF}S?Auv%pK79z0`8T~s--B&Q&PzT;F5@Lds zPP{B)1`3K9XkHJ@`yY@7LW1a1`8L8|q!GV`6xy>A=>7{71PC>Jggyf5xLWs%i;FU3 zPOTt1qsa(V6KeKEwxoA41F0yw-)LonfIyO=288+h`!A6Tv4bnu7vrJ+2f+U!Ri3X2 z;4&?80@7ZwJVZIk~S>~`c34}{+D_q)O~f6iV0Z>pw{ID`*X9#Lad{Xay#|MCz? zDli_j^!4QL@~HnNW8%^yB6KDs?Tf7buKpeGEKXN1i!?d)-&kgvj|-q{oJHpJ_e$Wu z8+HzXkLz>svDHb&?l)-4AcMX`{r^it*JD!}{eAeyLo=Fu%*0Ght*atT{&C;`>RIpo z7Y}SzL*sACs+=k4F#Lm_i8tX&WKITfa2rt^;1G@ZXxeq_Y}v>_9d%D z3QTc?P;vSiNcV4U*;VH<{Kf-*d4t5buiLFVtUHZ%(`oyR;SEdiSMS40{BA&K-wFqD z#JjZ65p>iu1%`^#>d3o9dLq9E=uY*p8NLYy+^#M-l?kmeJcN7y~WGJ z=)Er``H3L?M(O$5JLP%H{phEt$!~fgRcN~|KibyjCIIK}7u5e{eh5#&aF4m{5*|K1 z0$*QWX#$Jv?CfZ{p1wYRS2wqTwYBtTN3!1oW{K!X;Dg9V%|sk<>a(0{6JI{LAgZ|k z7>fDXc8le~2P#_d5jLh+>+4`D{`XiC1wSwvgDj7Bu5V%R^%g=#|1#`3j^KJGa&N}E z7PL;)FT3|$gu8v_AW__);LzNRuBU!Z(h$;EGBH%*Gz!gT?k0Ql+#Twxf(;u=nbIUX zk_cg4Ev|O==Q!c3f1v;Zz+!U^+5MqZ)XwC1U$7WQt{ycQM=CM0<|ytK?+)+hAqWk0sv1tbV;?0H0MWpr<; zL=c1v@h&Ax+gph4>8KU{q}ghfY;8D}vYo)HnW5Zl`#|$jX-~frrsdv4rx8O0*SDq1hk+6JMG|^UhQz zxEuHwZ77o`hVGPw_wcf2yJ1eWTxIsXRQ>I{e3{ayb1wO(C5IOqO$-wqMtg&ox&T+# zNt#cd=4$%FK~9Bm$@P;-c92rDJ{Ld5$U()@Kxfag~=^*!Pd| zD858ZLW6pO4G^B`2rqegar=#ufs;Ieo?V|fF`VY!apGp_8{ewYfcF%kBhTAD_rde? z04q(*sRpZLlfrNw3wfIysMRoJ*Fu8{YAUl$*x*I``(|L&p+X9WjUSQNv#-X_1AgbL zP=oOO+nk@3IQ6e7b>>TD(9Wj|kk?L!s78%G#9xKTl^au_WWNfZcGR7)?td}KhR0?R zqc@RbjMW4xG1Z>T%SJ}(@Ixa42J^_5_QN^f6!eND$ZZ}nD$@JJvTVgbnp;}-`zw)a z%(pa)J`o0?P|L^jK1((B!dF1rrPIW|awCnXHhYbxHE~(cyZO=>40GLDR)|M0Uv_qO z8MRAh11Af{kmZ1z{^vJ z*;X^E{tH;jJ2Qwufv%aqECsvY@A@r`UA7jq_=r-B_v3Jj!%MI2h(_!6CvK4o#rJ+91EO>+$=* z&}#fP2P>6yT%tO|*IwE_jh3DHHh566W3%nMJ*zZ?q2B1+T4TA~XSNALNrso&k;l;~ z2{XP&qJp|toCQQrL6X{7g@fA<|i13*qM|pJzI5|_N#tqrZ0rGJJ$Sph$BW7I-cO4j2fpv6_FnqkfDX;lRsJ=&UBFqX1H@hS(# za7&@GgoI({+L||lYY*Jh={0Ab>DYZTnLo5@!8X+e`2@`K6BqM2%?R;P4|P%aeMkC zmCCaFaZdPW;l_u#))7OwCIkA|y(LpGkQ3epnmA!F+LOhbF%FiWmvnH)GyH^owJnW5 zCHY}c>1-NAs;y6OYRvXd{b?MJZh0{qoydeD`9GV(LoLzeVd_MmhZ2>K2hqEa57r(X z%%EZ}rr5pOEseT=W`5ScMlk72f4tKgQ9CrrD*2GNE^*h&tCVe%xcKwoBMNDPCY)AW znVP7qd#WH#y>X-$p|C<>AV?azx-%Ss5=!%Y1;OvKJe6wkj}Z2uFm{pc3ydF zLD9N|iuxXXiL}33gL5h#9^Sy%m{a$e|HH8qic83AM~xUfNVF{Zg{;UY#>sWdh$+s(spC6^Imh}`pjk0pD6c6a<%-K79^Zbw=)8OOOI@0i5-WM@xa zUaJS86M~4NgJ$EV;OLHOaBd9RMGrAaaB0u;_0uHqjO`F>u$bY8QbmAn-gL%hPcWfT z?{P!hg^#dCk@^#fO7*S78&cE$VkznRy_9O)))Wn%6s*Hezq)49u^M&*` z)7Bl~)eSMQg?MTTyns%aDrJo1EayrCVhVKu=x~XQaaP5FU~w>Ta4?c(O1K_>2x&AE zGR9F(?wv!r3;=SZtd*{0Dog3GVlG? zNxp7hxNKynFF=KZlauqP)^IE}8=KXh#AXHT!=>yywT4*o)TP>SJm%%)PJzYt9>58U zRG=5Qd2O4z$TqZNG}5*D>2js!VD)(Q6&z~+u-0UDG}QT2Pqqj7yCiA!^82*KMk+H0 z)He)^U8Kq3EK{}KLYA5+nV6B+4|aC5Oru4>-C{{#Z%k7Qxr_zIis|6(v~2DE@q*1~*Y62XR*H_06SWPS z15<`Zdz>!v8XXQifE@V6wEY4g17)x@A5DTL9V#=1h1Jh{LoqtWF5X+*w$JZq8Kg4% zG9XgsA@x8PKYO^_+QRx?;nJvYx&?=XWOWIKPsN%r5^JWZr5I{oiYF`NuDPEFB!zaP zPUGX^M$@FXb}Gpi%5ek|LEQ9u)aW<`3u6zmxZSdCIFc}A`w~g~aTChcZ>*ykY>)aX zFi{1Tr}76}H{z#WI+nKW7?ggqjv@CIzcw*s0WDvsC-E|OhFf+>q6V9tZOKnwe#%3Y z$oVrc<j&VOr#IVBN+4+r*+?ABYHyCn zk}2fe)biQ;>m&z~FF{yv#lhN5J5DXkYAg}IX%LmtV0gby%O>90&bUbT&E?E2jc~08 zJjgu?L0~uo$AFw30AA50STCuFl+^ID3{Pu=DSGvz?o{-VEsaw!EG+}G-dq;+6ggMq za}y=}u*Vs@Wq|eGFgM`?|DFhVi07R4C^BV#rd(Ha7o=<_v7mbZ&z4NZINPw z#V*F;FJ8fLk}COG1BAjO^JSL9F2^|Lqi`1Z>n(RjJdz;yaCtbQ`A4?8{yo?^oM;Z; zdnc6=A@1NKZ|X>G_s5clqF0=jHLs^@n_1d-D&G6RbjDM?N1oYB$zFbL`<L;}J0}m8~@=Ec1Fg2!en)$rgvr)u$8`!ZDqb+}uP@Kon_%*wY zflfGK0DizuMtUFV$a=bJ-S>gd=0X*8Xp7}8QCp8NX%9yaZc7JE<r>nGe4W#u=O0+@8Zq9&v;!@p)4NoHi^{vI&qr69N_ODa zt!C}$Ifmk9kW9d%r5)=!2ip}a#eqPk@CR!mW?w7NAM(xf{6~|q#cUh{x^5g>POzp_ z(jnx7bkL)^%{s~7Ej!qKGbkRNESeS0wibM?wFd()B1$ttsjB;4_%W&S=vy7IYlj%p zWA4ND1kxw(==>J*CswaOau5v)@8_eF87*Y$zj97SaD$)XhqSodW%ri1W&!Z~^{Vs4 z9iKOxT_5{!Fb`N2LWWc6w_4dwW;U!i;tqWfkA7&d)P>VLJxSGFGw*j#@NS=>@G`g1 z%5INb$#tJG=t~6TK46+p42{v{{4iBO9ZRZA$-kZIStr{*8-gIj3)#f$N(4D~4vn1n zEb`O#@cbL}aMVmLrEcHoN{kb}dFLex*^J@LCE=`#^~ENk^Fb`pEFIIuRmHdIl0d>D zq<+2VJc~>ClcF1pW7x0r>8n4F;OtBvLo|(g2Ib|-Pp4`Q##{)@CZckmwFY=Zm0pw7@;6-Vj%Ly5ixi(x&7DkHa7EF*(|59& z+eW2w5OVIb!#U-_C3Le6WZg6WpiXW-oy46Xy7Gr!{&7rFfY=4>8%>?AU*kF=nLhK~ z!zAfsGV2vnY1T_@gf{@-e?>!!;3krIkvBsfd-c6N=Ip0Uj|N_kw|?$Zxoq=Z-M$;DVuoS#_GUZFqW}#Jpgq!J~YOdamAK!IG>&FjC(|fOY2Co z*}?93&&2O)`DsVH;&ymSaw4FzP3o-dq;ydtW~TNI_iG8Nln)}M={oOny6M!gB70)!*^p|tmQ;Bib_3)?V`H)#^_B;uGXgJo zo(5(!XPAz=we0#sNz-G$*=R}8A=_6dgV579@Uoc1!_NIB@|Q@~l^o3}clqg6Q8q+rYN4fU4&)f#I|V*G{D z4z&Kqoz8OC(@y=v`e=F^gV`(%=>b2Rx0h}2xMxg91vf#?9uTCPNidylF|3=7U-!iM zZa7ZHQxd716(H0M&;e{U@Mu&FPFcF^!WI z_p?Me6F4O^uJ=JPmJ0ptYs`-0Pd{(8N63T)Te$1?=r&9`wD24ku4+X{3>z}9!odc`r; z1l6sprE9C8l1?1~6I|L0N5r-n%QP`Bt<93FaPVn8{MIdHz=>WV692^vxzV!>?_dY= zn~L>$Hw^@`VqKO0cf)fIn%AFNzTRuFMDgDeeqc>E1v{H>-OV=`y3?n%Gf!6=?%B&V z>RGww;xyjrAJY~DQnFoLU_Cuf!N=ZA=damHMXwJjyhz+@m1OVaOCy(_A&cF@Vvfs- zM|cz4A5UmTvgY)-Vb2#w+abwmhLfxDBWQBL5RI`^6nm{h==}4)06qYS(w^2F4$Rzo zH&;&*x`f)YAR@@My6 z=R^5IY375i))RBwLrR~U1$|=xU;LFsRI0>7Q`G-joh!W5(z zD$m0My8<0<5Y33E(JCxthQM#Pq(U5+J<+h?!e`Q$muo<3p=c&j`yn< z6O_n((rc@nMY@071FEjy11#461cxlteZLz`5TP`zq}A&_xm|e3bP1&lA-#0D2l;5T z#d6BDgF>>>>obx_XMF!dJlXpFlCwkoXsTQUj`)|h=S^A_I(LeeCkYt&(`1YKZGUZ_ z$!B2IFUwV|#o8AOw242T(6FrR0D<2hDngxe%;n)&X!iLx@mB*VNleg~PLxrWl4# zdKcoiFJ0bPULZu{YRp&iYTX@{xVQl@1`^xWobvEvGe-YN+qTVj?eCsb_ny7a|F5KDwUX z`>yZ@eJa1ddTqT9bT*VQKS7+sfv?hi_YlT89qc1`n!t(o>K=nC;hwq+-}T`X?#_BT z^yMu{EG&0T#lVhU^pDH0_C*zd0l#%2&}yCNG{PDl#Z=t_l83bm_KX(NFzZV}OZp@f zMPv@U3KYyp?|gmX8Be%Yj}~eZJ)A_B@lV!tFSyQ|kgU3*4@|PMV4f77Ok<8Ejlw7a zXHYPn$S+*JMDdT46MQXtg~<8ZJ&MJaCv#cZv5ObNaiWn)27!-G?D%YpZ;?Mc9m3yk zIx)xa%f|PNDC-+2scI8kig+3xuSeEQ8^DGk&wfn=tG#y3rJKa~KsLYGvD1*j=^djp zlVAd`eSsf_*LI6Kp30K}0m=OY78j%w@$Ecf<{#f0AKRrP=hJhs8LeAAXJ13AJa8MQ%HITgz_R%o9GHI(DzUNX&U_N@1dn{({WpGw6;{EtmM2yYcvKYK3K@M;tB z{G_*CpWqfT4B>!xt~4(;wl#!s8A2g3?rzaZt+P*(c`a_p8`MjS#&jYK@8*u}K^r5E zk%CG?2b#GU;JP`X0^n&`yZXuT_goTn1rVPq-*;skUmAr*pW63xEBcw*MYG@T78lY7 zB<6WCj;}=CcYZ5FdrPKltJ%Hf;@DiJFTmjGQ#mGn7$>E zgbn1>iIrX_Ex)gSo@H~~V@?5lyx=TVM5^4o3D)#zS%3ha6gf|e(`9kZ z`&I73Tz;w%9;&y|s7iqeR(sKmN`-QmbVgm9H$S7rV!4ct_iE&bQkl3^O8c<#&*{4! ziAqvAkaLq#$~nE>0x9Ft_pW34bo!j^!eoc{RudRZvOLcR+q$xQrHfKm!(w5mH zz&31t*b2hloi3zQ&g8^?@2I;MvKx0$aSNQjgiB`x8Hr0kNS!#RV*J@L4trPpU^!Hv zBMCIQl5jC_Dq}pCvy@}xN^So zWv9gWrk4WFYKvp)%89qtiiZ$g`x8j}Yz@0oxw)&4=j-`mTjX9XXw9z{K3dJDEMvTf zGkyCBCNjmY#BbO!x8h@ig1z=XR@1}udVJ#3d&27fHi(w4Gy1Tuowt2|U&K&gUy@Y=Kv07STiHSz4E4rK2fhr- z@-nUb$djsI_PhsUkrh@f_w5xf?Pdo*Rp(p6Z!lH`sC-sDpCQKYjN&np(R^bi1blE~ z{5Vj?f)>i90;$V}5Olah;18=^_iS*nztn~bD%-M{W9g^eUy3o!yBh2tJBXLPu5GC( zlX$Ja-9`~ZX?nO$)i8hO?@r(+{&hNcK_&Dn_IB#K^5d&Dk5WM8Wi%oen^sXscqx}2 zC6ofO=_CEs=jQ8pyz&*u2mWD_3{l@h3zy}XIhrquERU!?QgcQH&*zc^fA6@yc4}`g+vwsS0EdM zwU-EQ4+JTuT!U8qKKzp-M1)nO-yvr}nZ_PdI(tzbfF5mJ>M(sYcZ(X(6@A`x!Ey3H-cc~cO(Vxcs^L?cMeu97^2QH80hW?Z zvbcOQH(6sv#kyb0t55mD;xOTxsFKba^&SfISSb)1z=#4J4gSij4o?@->Uo2C5LcE% zm`IRiU-8|53OkbCObRmbskk(B85{lAA-9|(fa&_a4p0(&`hU`pI$yaGRnuMS!hnaA zb`*Wf@8UHDLWmRi{loGar$b!5Dyq9iIyY+cyAfhj-$C5e6G0Q2CX_B^F_>3a5@^7D zAh&M;o&kj9jn5CykL%Yu!+v!mME|=a$eE7t7q=$Qtj?3iJf5G{FwVXh_NY^6X_a1d zdVUaI3EO8IpbE04KV&i*qH$KauGWP4DBqN|pgbt9BQM_G7p0}xH_cy4+;A7lwG@n? z@C3OM9g*#mMslpGjJsdKCOzt&M;FTHYDJO6HQ$&afO=}tXqh3;{9kt14<-2&uW2cU zX=z;O(hgt2#YPd^{8e|u@P)U_kh?%L+YebbAd>Jse~~p$)(U@Bmxd%=px5&;!Q6<) zpJ;M+A+=ywrA_ClZ;XV@E@c2a0TY6a!yAAf7>vv_spJu7x4T&)Q15g?dA>DdTwB}N z^GT6~3;nZCtu(i_PA6|gGbOXl%h1MN|hYB;d=Sy^atzA{tXoh=|_)ph-;}1w~ICgiMq!AP1k+WSfZQN?)^aKdw4%|2d zEPjS-Tn8>Gw_mz5=xFhL3{YlA(wI6Nql*Xk5!q{Ho}H@b^?Y!^?!9UBh6 z#h^irnr;pipm5%(lG$8(k9*Dxibx{8u|<}6A^e6)224e#ZpM>2qdbeK`=oV#Q<+G& zThzY>i3KHubMg5f1#k17p@qUhS!K6RsK$@WZ+pPpPQvrN{Lq3Sd;$Kgyd*E^_O?V8 z%1#s6ji^%Ee!Wf(0gofELxuUqoXtU}Q;{}<-=p&FplXUI5|=5G!}+{|2Yb?4A^zEgT4w8wK$#_B@FR88rkleyi3+~}wpb(eIiHpWWK?|X8kY87RI+R73-myCi zt)Rr*EU|B7y&bFM;cC~BcnW(wshuzRtXmU>Cl=k|q~qd}!X;Nts^5JB|_)}-*nS`FW zh-m!O3{?&!7kNV3ouAcWMy{zQ&k-rh0E7I}d=)3vb zo%>9u8P_fT#7j;G4@tww;1B{3#24NtHcTOS@cRW9=?4Wk;3V_iFEv-(7EpTEGnFC` zD4y7Rz}?$hPC&fgqVzJve$iXY&%KSARCf7;CiH{a)o$rGFoOYTq&vFT2FQ|UTijb? zop8t78n9MqqVQ!3bzR&BON=_yXje;kt}M0n37w3cS~}f)wgsCq%hsR z6kN6R-+jA4z<&9N%^D+V^7?R(N#4H-lk9lo=Ow)bsBvU`4(tc&+ClL%JJD2SP3t#k zalHFmrq(@)N}(=?Ih8;WjICXZO}vCv!Og7*GTrw*Z2{2d0YIrN=88nB2WHc21o-%T z$x(y}&;zeHoHq3RISJSNtqoR3s|}mA_fxL>13?zNA4k2!hE>NF5l|P_TVJZCG&=O- z?b3UfUiHLEz6q~~SZrS-Cr|r(dhZNPuKL$J-{NzoNa6LmWJzW09cL!I?Gg_Ep6qwC zrN^FBZTXfObo1ILC!L9Ya}XSpm5BRV2YDYJ^9E^hVY2`b zLOfLqyA*CkR$1EUgagP&BRK9Mna<Efj*^8wQfJ&c>NzMsM+gPMx&#a}@A_No(Decv5MDX41G^#c#s3_lp@y`8hF zGF{FKlZ9W(uiF8)6IfLiJ+V%}r=~6x$u23ni=$*p{bZA62d>HOptl8>$Fypx%F!Bq zP)=oA1X2Z2(olLgOIg*gH=~QU(Jfxwd}d+86}z{dUMP^R3QqcvynJ~V-y1&|jSVvM zL9MSAd{0_tEP0rUVEVjAQl0Bdhxxnji!KP9Ar_)J|3?H!4{Qx&B9^L+kIU(>D1y-5 zE!u0>DHO#I|HWAO^Oh>n$CC+=C5p8AgldTrsEBcgOWX1Vklj*Fr zduDvNTb$+0@D@51Ny6QXi$yQO9eC~-QHJ)!x~DVhUeh4|$i|!BkHhv3-$5 z;!iSfAtL#OrZS9p1zrmhk^vntQ?pMsXKRZ2o9gpy*d|k;6VVzr~aaO4yRwT~iU<4p30O1EU?cmqFU)Rwxy-RrL z-TS|xhoFWfmjKMrvLK%<7B4A`-GRmC03dt(cSNQc@1GwM`w(_&kH;M5y1X`92>b9Q z(pS9jy<4FClFVxJhYD^mj0`?fa@WxV{_u2Yrj`zUOx$56%#F+oz)Xcnz+EM_(x}! z@Cl3MrnI^J&ABcnc(e_Z#{0{zQyf!^@Lq2scD86R1>Ie(j6Q!grnH-roY4>ZcP)}g z7?19Wns5E;nDh1An>DEy3sNAi8u^7^iM}+f8x}N% zhCtol#Rp;nlE>f67am*`&-1yR@f1WaU;(!FhJJj0QXt8XV5gKj)*+51u}P(z*Rpsl zLk?B4bq#SncxzQ(Q_%i2(tB-KIDg)iy;VdAiH6t4+HndedS~4oUVXGzlKo}#JMI{Zc|JO|$7EerFu2ugK0DLkg% z_&4ZDyWK~_yI8+@ozXjr^x3M+%K{wmq~#sgZEBkcZQ))y?TQJ`mWd5pQ)oRN=+TzWhPU#v zOW|-#DI%|r;S_A;uxP?S8fCgdnapb1+d>sP@>o+ugZ7~+|Bm&X{#9nZ9%5X%cH z-bUaSqOm8fk=`^EipZ_zc3L`6^h7N?NmE{WCzyC#%BtFc>{F@7Bpx&sUN|dj zQGdYA4%>dcGs6Y)=}SU1ed75nV~M~Slpecm$PtdfoIzCP?5#xP@t)*f?2`QMG>c57 zu81Qth4VvPXs=(*{(w}>JsqlIVI&(DQmf7B{E`wjp-?o^=dPy=C1oTLi&bgV<*hqK z0uqwE2Xs>}HfJ<2nW8QrOl=;nc(BCAw2f3IS-9x6%v>qHLGD$U(E6+5c4i1h^aZzD zwfegnX`VL;LD&#XL1`D_s9oEKvc38BgN8V4lzlOQ%hN8z`om}x3e@XU>7^1gKd6MS zX^+b<@1X}!^{-rW4CLiQA0d#guz1h_?J{8am~Qs)N?okJyhAwzC|H+PwPlwEt|1o; z9)vo^mt{#79D7TTmgzU%0tvdiRZh+<@6ZGPC`bI0-}jC@-JKe*UE_@SvutMN;bJ^U zAY*PlOwe)2F<8WO)D+Ni3IG_vI2DlunNE6*^=U|Vt4u0f{)kzy``_%(H| z?t{Yo00_QQaqO{%^v&m+K-iZ_l|Q|6d)2;OY`zFq(hUzgdsO$I-SP6}>&b-lnnc&+ zA1mnZLI>eB%-w1Z*<{Rs)wzDJV^ytxJhPdXallAY1%bPw_{h;RF;WkLtbQuzIlAnU z)S0^%ooJwbJcJ+!$4{eR2a=S=`jA?jGx}^EwTxhLnqj_o7g*&(_149+gnZk(n%>#P zDR*MB>l60G{;iRigzt31&X?Y6|78^Z_z`2n@u<{>|LN-1$-D=G|EO+1U}9D9@(Q&e z8$ngv^c2ox(7Mf_l`cMW4?hwiT#TiylwW%rJQjPp+s+|QIUT}-Azg@b;rPtzn$xfD z{R9cKYtpMt1mC3tR{vI;+qMXf<2l#_q^|iXeHFZ;+8N^w?%L~p6K%72Hl*tV@%438 z-0?dK_y0HF@6ySx$lKv~nlfizRBIy#<S*8vBp<+kQF4 zH7O34bpOQw1~c88m@f6!QwY`ia~z>#E&+Oz!MRaRJrmz)bcKjIXM?5=&=t1=>33l@2ecNvn5329Jo1B~JQjA#&` zlwQeJS||LadhpQ^%(~SB5cVLxEdcUcVKO?P>$$>$`ttWpZ+O0*?u|${>tt%rRetgb zsoR1adz~$7(eUa?9qE!qbgwCsbz82^>5w8MU@Z?xHitk&Xi-iq!-gYrtjKT(zbk{zT{ zsb(<`4%|3_!#NdoM*o#}P^;Cs5L)j?D!ptl#bzrP-&}{}RZK5FvcLEf`c6kz-s#lz zs}8-}0jwNn_H$1!rXO1H!=^066P~2A^0k{1dYir!o7IDFB8a5JmSBOu-jPLCgwKJ~ z7tZ`sU^0-j0OH*vph^Evg*ZcYD}vtI;}kGjZx`L z5J;n)^8#IId8Xp{YQfjepdgXP^!ZZo(dQgKKBz2aAk0cxkT$xlRSe)WajZBjCfA@W znEbNt4)}0FR73aK>%dX@p|Y}rx}qSu;Q-OQs<0_GUwz%_VamjyU$7EHyK1NrzP2C~ zLGeT3hxmnN!G{=z)Br;5xj7r_;nwE5`@E0*@p_NlLHZ?M^0=bG`L^N&ez;)PP@(yG9riiOOVlt>LpwAClRQ;qjC&P#O-L z_+T>sY+!M@tXGh^r9Ow@*Wuq0?28Saha~)!Pz9Z{g_W|m&l}*cU?^{W<=7zrcNj)I zZ;VT`*vEW@B;TaNRV7*>4asVUg7YK^iKMaZW&l<3HG<2z?3q)1Wb(urg33uI%tB`l zc#6OPlW<1|8`ap}6}_5B;=jJ9x#Shj5WX3M zE2mSxwG3)`)zi&o%6J*)Z0p1~T- z+83#ld)IcM_N@z`Sua(Tr3IK6bq47fb^RatfIte}k2XpemGhZ>t|Qb==Q|k$;iROL zbZYs6GtDNd-^wEI;D|#617cspBdU>gf~B>Jw{H`=thcZ-z06%Nq>gNcsrvMD&O)I2e<>+5@zc12U?nS@#CKTP^_-v3Do^R|~~q+|HNQnhJg z8XnYGQSZzkI%1suEZ;Yj7KGDKj|pNmn0ut_45p&i1UL9roiBl&yip}c`j)-{A86{w zj*)M7JrO^sc#SsJP0?8H zm)O>G$ync1oh(O-@l&~Ox-aTHrl}sYFC6LFj)mnvl?To2+GH7grZFwuLm3Pz-juAs zB{^s$JFaS+6CiTn+-~n1=v>o-ZNp5U!2MhtHTTO*{mbu&eea$y6`g^!OQjW{>*MfMx z?!9zU-<=*;<54nJDqJ-b*ZVlTo`;*8YJ`9j0xK-kzmJxizglAySzV`Cmq1=o8 zSY{TEs0Bq*?%#JB=1-5=mPvseNMAG3Vz{j{V(b9sV4X2hJF&Lpwso;DNb;r@sB}8z zV;b067IZIpR_bF7BqC#b>1iJ4TD#I}77Nyj>Zz6|D0qnim8uexnXlggcqDhy?E_sM12^6D-ta+!@IcRO0mQe*LfiTHAE0f?%G*!1aP05?l36tO!)`0+o#KN5CJ9P-b~*saP6ii*UM_HxD?|nP zH=1f6oBH5`ULBmAe72rqitxgBzpn!Bkg$0T%3bVM7a1vri09*mNUPl;zU>UOL-}fI z&F1y$gVzh?8qD@DamZw0#wRg=aI$zv-Ez$z`zqw7ui7I?`=lgQf-LMWZ7Q#tBCAvm9hl+(pWg|;q6*G)6$<084 zoe{e71Xk&I<%|Q8_MMq+?8zp*B~}c`q)T;qCrA-+l{FZMAZmF*@evUJApCsiM1U61 z*lQNW-u)yKvc~0D%!o-t8ge|+P?D+j+)qNEBaJ>eoZtA%)wJ_Ow?*VH6P zL4LOgpeTmOhaVHBd!vuGL#8U1EOywaLHRSDe?g&qKS@ERD9x=15vDqR?d)1s@N(Jx zR@9Pu8tLmt$r6^@%%*t35m*|N@X1yob}&P8$|DyhyfEJsR}LW z|AgsoszIidLeXf*FAJ1_RGZ5h`4>9=Picv#C?X(z@;&-{j&1;0WPX0oFYe0KwZV~> zqtO-kT$Lj|r$^9q@N#rG%o6~zpP8{D{gv2jP-NM>gFMa?!DD+^w03(bI~_Ex)P>Q0 z)i$Bf@DC)_U&ygy|1Lq2a8nRSytk+~%nm_Um*xnG*N>cA2xs}e2qt7K3`wsx+-&b4 zYUCtN2o!Sd80f@OevB_Q?bTJE{7gy8NQcSvmM2^BzAXN z%7?pB^J+t)JxB={{o_fw?}6l)F){y2Z1x{uGh8^3r~vwt0*alXJXx59J3p=yg!dMn ze=Z1sD|Lo<5s`#9biv5g3H|8!Z)naV1ea*XGd!*Ge8c|&wFC846ahd%O9ZLG{tJ%p z%8(EM1s!g)mbdsX-^%0s1qFqxM*a^7-v7)-*Y8jtv!0{#eW7WFY8hjy{DuEI{bC3} zonI#HNeiG1z`c2);h^jj64U;bt?NHwvMvJu``3o9aEEhc`u;&Owo#e?R#pRmwLF0I zS@hlXJ!D6k4L}@Y!uRJ*?{HBP&1L$r|KAE`L@|Kihy4YXtY8kug`&Qw+wYlA9bskx z;5wCjq8jZ}Rh(}U>i#PY#r{AZsCq%rsC(b_enb-JAvzEpRjds3iQ{7@ zl1uz4OS1KO4$y9pgB6t;vTD4?0R}~dh+|lx5vgwrb!; z;~%X90c!!;X;F=a`cD%6qNqE>B-sU+&nmrx^uwB(mz z<7vX~2}@lMPz)6R*3VCpt<{DKjaMp3ljK!>7<;!+PF8tUGy|Cok_Fd>H3e9R_HFjC zv!Gv~|5$3-H>juQ`1oowORZ3X?xBtf?5&_fYC_+CtTD1T$UK!wmSy&>C5fP4%$HRg zQ!LP?>cDSCe;W+GtOq3ev~v(Bkq%?R1UU~YE)m$@7lH`%?3k;U-#XkOh~sac=coFR zfhJN&ce`-Co7pDoayjiVpRc(4L}qdciVag_Ok~UM!oWf2smHJs3C#upuw6g0S9*s3 z)(ZX>1*j$=y7#966AqVM9LM@b%EkF~XpewD_r9AJVhd=u9HnARX{prj zc4E9F*>ZT+*3ef}BKv~=Vb%q55 zf}%d96SK3Vf9rGCb&8}g6*YfhDGV=XW0{dOse;g#8Ck300U+e!^A&p8)!w9shgVm_ zMuGtW6+XL{2^B64Wm;OcTiL8mg)qXXVTni;GpBTLc{LsR1{iRtednvph05bt(~T0| zIZ3??bJd<$+#C5kQJ-1bqeFR2hr9c3bV^k5boY`#e-3OHhwtq*lpW2Lcs2pDHbb08 zAf&DE2(kbvJ4yNut#&~)pLdD;bhUGA?G6_z*2n&c+>d#2Tpa9JFwNeUn29dqBG~yv z&X@gp>>XOo0{cW-iESOJAMea5d$sXt!tp(6ua;`3o3pN}SdH6RtP7Y^2enw{ciXvl zdqj^3nAJt?UZ_LwcpZt6FmQ#t6Xs!6nG#*AqY~=qRM0W$DNa&vyV5{d|GVXk?*^0+_+vh38ze;Hf+XDvBX$L^`Pdkst#l zj0O(K8+|Z1n5@2C$s0$Z0+`yLos*vgq;dHz@IJWQS$n6wTPbw)fTxM>Vpdz9bq@Jj zp;ox5y@cGE3HYyWpKzDOPnJtmYFi{SX*3LMM3Uuj9|m?5yIlZKVRIV^EqBj^Cp%-C zm$Bw=-syque5es;?in^L%~ev{9{;A@_nR<20fSl#bc;MSrQsSxD~Vm^!?#JbyUBD; zlSBYKXW|S7`$~@sgO5{0`~n znhr%wvXI0VEO?-Q5v3apB%=id?Z6chnr>WX9mkmnw3%wj z=^L~5Zpr=#jbkBo-E^^J=4#GqvS5=zY6}E10CklnY$C+Tv_WP5hw-~`0DJM;9Ha@k zFOGU*c#`SS6~|@_NGFLyz~MHyCrg|!*jR%RJr1l-Cb&cGol9Mlk0HTyCnZuu{@+XM z7nHAz$yglGdWUDLYadx2n+IT^CIu`hIQAdq$6K0`IB~@HpD)immT|n~e zU5DH8dva#xIkP-(o!W#3tEimT7Ux_iD{k*&nD50VhKA8HKOxQN^kQyNPr=m+bW|!y zKY_eY=89{L5F`2joU5!pMBQpO`vYoMEi3!Y;|8c~Hr-X-+j={m!)y3OZuIs|P334D zqjHL&=Kkw6h?j>1fuVyX?M$YHW{)#K`9}K0b6Y># z;Tb&B3zb`nmo5HVN0y&!Aw0=9)yPo?V;~on8*T9ibZ;r$skfR| zhK9uVXUk#WaF{=+@!88&tJ5d}sg`oUh`i@D>KxeL+pQq9q$G0yV6*9ToYmQMoS#f> z4{~m99OKEaEa$u~AtS+o(+2SO`KaS5qCpy;%hID>Z$cLq-t*z%St=Rc>Z$pyo%@wm zbsqEPDQpkix1MsYQM_w1WioDoUK*|Z85+uC>y|S`!1Wfhu_tpS#jCiCf99$TNf&s? z&t}{2`9NG9u^1(IwZSSE_zMJ5B4_W6=>-C3euB@pFltM@GiN#q2_oy~CSsC8@OBF7 zBpu~X@lRL#0OYWk7}n`8kB>wf7psk#E%!~S4F#WL-J@b(+VV_p`?4cKUSYNmFK%J3N>A`++V;JUYjS?@%**Yx zym2Po*@@A4zSY_K#B*{T5II~v*ZKMTz+*Ihwopc4EQV-r|D2?(wo$g;e11&n;c``^ zo1h!{+qb`Pr3pD9@2|`E_kbMr4o_1ACF=E*ES7U29{nq^D-OpqBrC1XQRJ1Rg9V3# zrRA4po)?Fs%L>Js%QZE_73rKax4oNr<=)nbKVcqTnq98H;qZKu5CrFvUgy{(D35J@ zyeQOJeB+;la}`&AsaxnsZ+#pgb$4j*-q6M?@wn_TP2t$J*SBRm8Xi<^SbJ!1Of*|< zMT7NxhE=ci`kj4!Xa)-Lhrd5Vjtx1=jjPClV!U~A{9F@3Mn@L~)J2L*OOvD~v~J!< zO}SmREKw|$M+_J5lyE8xpMbSdm?<-OQPI58Btc!S8L~%vCVQDewD-x19hx)%-R%_U zvMEt${SJ%w^IN2crgDgXjCH%1nLdFMsy+66NZ?u_lkqg5l1%e2c9tTY%mk0m2-k_- zp32UA=S@5-TD-?;(2~upj%U?#kDFu36fUC_j<{7X&&%B6-(<%VXk!Z1kZ?;g1I6gxTt6lltZ(|ZcRW|1WbgKo?E74j zA3~y%^gKZ0Jz5iT!W!VwF*5W=8K@HX@n5aFmnF$4EsD)}ElxQtI%zWC6lfcKK)TdX zQ&X$6+o!~2abu>@=t#@J;ZSs%yrz^+=OEdXGG8pA=`+e2>jbcow`iSgKQk!!58X_n zg2R9?3emI*&1S+)vJ#a_+9;S8iDvndTP$=ahg?cdv(kaC+fV8*>qRw}2jfoi)?n7c zRH$m`j8yT1j=E3AF9@Np8)X=<7-^q@I_am8G@pp<#ATj<7%lv7-o(;rTm&>>)Nw&v+&`Ql(de}E zjCkMpzCgg`@cToI@{$_xzWISBt>AfU@>7G$WUvuvlA$X6 z_yOwq+>chL+wH+Ys|v8YsWc4h+x87L9$&Ox763{ZPL=isPY)py^|j4bIt=cNjCtoc zL9jnHXn91S=ca8KY>bTikQ}qoVYM5|?VFs70c*1pMg!c!+#G8L?sl= zVOC-A3@M^zK@r&Qy{5&^Dv`*LZHW#xEDIBp1kS;--4#|jy|L}`>xTPrW#>nZ{ozEY z4=;=1dn69$j8)@0>EmU`D=r24>$*4Ze3_cU!Tr&)0`veI!B;iW1>-u z`4S9GB0v6a+6~l z&BpFKO@|AY*4{+LLTMU;g2@@O+KwzJfDA6fEd60xhj49XN4syw@EPm>xTXZus1ghj zg!C^_EGqy(wxUoR`^M;+XHriQRpf)dqI?h}mL}RQLBv^CkEm;s_mjHSe7+=ptwO6& zxv30%DwZUSLb43H3vZuHGKn0FsIyQigE6o|tCh4+=US0Snt_2qu~M6R1s6rgADm;d zYMb_&fUai;?Xg^wOD)M(pI|g}w2n~TxaB!9Lsd~fA$SM6dgz=M>1$c2@WFnC`vHSr zHGm0>1xlx}Q8YGqov+nvpt72+4QbL4=73kn)2lrN;URuT!{PA|j;=JASw*T2>o@^k zev8mwteKfx0J0AC@vhWK{TQb{*&{lDzrhxEdfn^uW|oGe+6uVdJ#ID$p1DEcg-#sX z^61^8v!Du`zY0m}O^S;n2E$R=5zVE%#{Ln%bf2goDjG7vI0?}%y%@T#>m0%>ndb75 zC;pZnHaoqfYChir(BO|BYL4vZmH^tN>Thi~r>gA^HcHAuGbY|b5urJGCsrv*@dSJJ z`Uv{m&4r4>f(Wdnb%DD5hX;`llccwuK43@Xw>zqJ?@d^3kDq`Fc7{lffwFrcm8n7w zN|3_tigIxO(%MNuz63zT+i@HDn$nz5zzharIxBgx?%b-f+0{5@6r&x!x(K+~rz7CqPli3#VYg8G9px7k$hWSp40D{B4P2AB zTo8$r^inlDZ$4!Y*jv?R=}@sc3B66dQ?-`v+CDCx&XDb1*}D`ikM0+?w0 zQ`ooZ+@-0d2r_IS}JAv+&gwY{Y#`1f3cR_g2zr7?NV zP$;%=-QR4tPjPAez6gaDm4wyJW3Q-;I#;1wr#o-3WTwWa3mNr!*V}`2Hg^eeQeSQ0 zz9T9jAWCn#+BYq?E3dBKE$e*Kz+ZkTLa|^eQHq~eC4abB*18zPMY?FHmqJyVANV*D z)Yo@|zCT(}Gh(mX$LDWTgqYORY_TM%H(S;mLu)6PsE+`9dKI(C`wsv5N32+YBCj@8 z^A9A3xKa?P^70p+IVp;yIc+^{a(}#-D{!RRp-?(qtSnsYe@%Vi>$Ke^b(4@h*Sl89 z7f0dn{%CVmZT$7f4VP4_;WB>CYva@6a6!Ep)o8h{|53D=CuU&pX>vi1Cg;>V*P^BV z(A}*)plXcCrJV4i{9cv{vplq)47_uTF)U+$DqeLKn%P+uwSKn>Ibx;S^t9RTGl~A1gA?1AMJ*sP)-Mma+MX6Fr0FsELQKFKSycHP0oOatu;kF+LgC^AO z*i+)vi&@A$i1d(~D`n3UPrndpwpfvV6HR1KacXeaZE6({a=vMMnC|eMR@&pbWt@6W z)#p~F(#OXKr2cqF>`eY;BN&NXD5SYiC{F>UZ$QLDwCVo9?Vtb-kDYRXOLB;8W+?}a zkg)e=Fi_$;kwUyF{{{jqGO0wW)ce!_Er9-TpA-6b5S&{q8}#YkaqY3ec2LPoHW343 z2olWfk^x!KqL!8-BEYZuuM-7EtScpoTE$+NzR;p1akAQ2SqEOD`)2s!kiu>dWa&LK zhzBFsHGY${xokXh3LrhDU3OGPae zOKxHMpkS4RZu20nTkP?VGy7_UcX33Z!hB74xp8)npGUK?-S3{SQ*U5864OsxL{SQk z)taC%g3^_3cYbR(dB%}VZi*qvwCip|4K7e{qkUH6$+uwRI#2bgM3-err7FP*)bIQ+ zzdAowYzPS5)iZV$3{dWj&sXYeHjxq6?FT1t>YT=1B8i~w4Ma0uZ=929!3gIioxPy?p>kY>|LUtiw{C>3xU9}Gb0S9-p#?zIU|SgzC+zv)gY z4{mzBrVB^7@yckK;4OXo>H1=>!8)lY#xCop9IE21fl9+}PE(y=RKfFr-aUl2qUAyH z`~$S|*?a?JrPi75{qC0T<^_xO=MOv?Y#CVl#J-U5w$P4OW1a|Hri71|S3I@gTX3%B zP3$~US=F|KU#7*@owpffwYIaFjC^pfUH}jyg=_pZV`ihnwewx~lI`6qCc((Ukfm9? z;?8WG0&}Mty`9@9_wTOl_n{%t6QT}9+b)cA%#e+Zg4N}E3zd~tlc?~N{+QaPk1)E9 zIFshD+9^NKjc-Zl=&bEC5)+FBk~NjB0yEzr@H|9e&}g$3b=;K}cJtXj$f%RgC{It2 zNpn&$p^CW-M%YRPi!m?=`uF=Ku8|27cB`H7fa2)WlQrg;J$5-BHHXF&X#e>6Q zl7sEW6)WtyV~V8UeVkbAxPgl&&H+S*sS-^h$jn(%XE@_TTCF_Cm|G5~Gkh?j!F?MO z{q8<7sG^>Sa_WE)bJIL-jf-mG308HH2r;2Z8uMyXhqa0l72&Z(rakAfa-=yRAVe^+ zAN-0K^}Iot3lVkfkqk)2Qvq_7t7QgtS10qOjBHYX4ZkOkwlEG57esS%xYe3kMq^^#y`X2du!$^ z%_oPRXiillyKB;3tsY#^MlBf`X?et&a~aV{aM?34D6&TfBS|#?i0jdqmxq`An}vuI zHLICi>hKl0o3%DlsWXW5>)TrLn_wGwvHj0*lL*@_4j_V1PY13liOK-#qrJ zd!jSCtsaIv^mz=Qd@2dcQmoBOq=JHzESL=l{@efh&P<`6T-*`qiuX&^QZ+O#&O9%| zUhCo&kKi|2%saBnKeUt%%J{xlU}h4XkGLC>352y~(ufRPp0)gfAZkYR8m`v1{4BL8 zqp5BaLixpGnX-4XRZLRC!4y)Yr%v4QLn{e}_CQ^j6zr*)r>6uaD3bJ#^-NQ=OGfo3 zR$)eKNpPc}`7aan4*88O8trOn&tXqQntw8&v} z0Mbk?GWc+zC0fsRy~`eEsT7Vj2J$v4H!r>)HhaaO{BKJ&YP;06?~eqpj0h^-%oX(Pn+yj(u+!P`Wb87MYQck?unD`)o^h|* zx0*w@QF=lyW6JyX@4h>K6(jVlF|g0e^T4>W~@z9QPJc{rpiiG03imw=qei&MP*{j)(n zKlD1jVeagj_LtEcZ{@SaZn%jvu5$ybx}&axAq>>BBkl;uYU2cgj!v|8N@e@k3Qb z!yxt$(Pv>Baf(rwRJ*`TADy2YEE49Ql$IkCcXS|QViT{c+5>bNeyniwp7PZ@2gIqt zNlyhIbCpW!%1NB}oA#@lo!6uDDNn^mdg3JsE)B1pWxMn$CDzs7u0;$dR$8R!_Z))% z=}~7B=c58oBNFr2vz+ZAAZF7klSI=(`KNy zyj=((Tpe=>;{UiQuS`KEyfB;w`rUSt>K6BpcV{E(iyqdyhj2Wb{4!_#H=6XLO_Bb+ zrT_Q{y52$Y(bp%jx&Qb|{>4xEssUbgRqCHe;Qw&9Uy%8*hhLaP;{IU(f30)Y4}>XN zB{@P`NVJ$JAnNevX#6k#=*|b=@!w(pV{QBMGDV`hM8ZPel?m6EF=qw(Um^(lqkvAi zG={5mC8ecu0k_4nIm|yCxj-QOA$)Tm=&8AZ5+zbx9E+EdCup%SxX=AT$NA48A#p(aDbKHFg!J zPTpFECLuSLav4b}QlIJ0DNcO_CksMcp7(s; z_dV}>&iS0lX`i}{UdB5A38OJ2N-Vd-SREcr-^U3X!U zO4v?ly|+7rn*jg*MqGMYs2p$mMM$ZS_SmA8@p+M7lh|Q*-6mV=GH@mzFvMlk7q}@*p$r@@Zc#mXP|2Jc#R&SpRKAbdBq;%XdeC z@*D9a$`$O@%%xZtU*uFZ`pb=k;6i*gvWA1d;-;`GIhkm>#u5f9v8^W$hYos$U(;LL zxRPLMD=->A#(**Py;*2pLDV<$Lp^vy)bdGrj!T}F!;4l7O@`wy2R$C|sL-OG+F%oC ziezlk!*FS~M(|lI!+w3~bq$YnZb5(J@w7glX+=TQ=lQlbE1FD;#{bOiOI(v%#VT3n z<{nt!qk8+cLRLP6H=kQ2`L1tG5Ef|JYGykm{b`z&(>8~P$*Gyb647bA^Qi!$ZAodF zN*Jq6crVs~(!!3i$w?62E?q#ieo&F}b36uIQQfUAbyu2cUXPp*npg{cRSd80oC@k) zx2SXXz2plTN8bJ=BxdT2*MLj=Bf{W^16{#Q%Rx!Nh|{CN#l!Z_BQzMbyy#EO&r1gK zD?v!srjII*8Wmz}p)__hU!(7$3gnrckLe>2f1zjxY|U)AJrH$(zB8JW=3=k&^AL!^eL*xaw1Hi2b+_f8II8*F*}kuz~h@)-<2 zTyZ_MU8IH6m>#Be@YiK0r;+zzc*(*E)w?-;8_|+L`!~syIPO5(&Ez?>TjC5i6QaD< zK79E{G<_6}%GKd*7Qm=AI<1*u`5%1&i-pK}_1%Re2rT@(xKYvAWH+;P-~~BBasj7q zB8)}Yei2VQ!=ka3Qn>KttsG5RV>-o?bss`dV%rlN4G)tz_ibWULRDmyy>AoGoVqiB zYG)ZPwFdDPUG=`9Ej~P6?g_@;Y=TERARFZ0xZKTnOEy3zKxH1}1;;rqv${Ph#-;M1 zk?nj!?B|s5W_f-c{~zXxF!BMYX)wF*JFCEz!+VP%Bw9cvsf~-J?1CC?8qsR;&Kgy< zouHI>)uybG(s{r7AF|Lv*{AI$@g)FfPR@|N`PJpq*B~6qPoVANQ8Y%yt@Gu+#O@)#_V+(K2?o0#noqz7*XafuFEO$%Gg^ za#2vLh|*@y_hww%fDq(N-IJNE!Btdb=EDdKffo$r`* zqq^uKb@OsqX27)Uo@_};LLYQwq{G&CTXWY0q25C?+$eZD$LH9cHOM_yF~4sD++m?in0(AjXmZJ+QDgVR7&P)?*qX03NwVmUpqEH6CK zo1#%&pLR6a$hpgM>ukmZygqRbxw?Vjo6D3;1}2ou#rsjt*HeytSCIuVM9_w7acE z+8KG=$N6vfcTA>k;)2$W^w-X-{gZ-4mEJ8qdTtgk&aWN@-2aQ$5m&!rgXH3;7M&yQ zpX?VehTR-K%i0&iQetLiCcP>x09N|1(V{^_P{D>sg+e=3pRy-eaKO@DM%3}W=$r2JVhdl^UTm0BazT{0nZjMW9&i|1SENGs48$U+_3vwO$we zk1J0ogeAa;+sjVvQ{>|QjyN+~PdB}0OhRK%jIR(gp!U~vrRx9b%C9B*U+K!7Z!gd< Uby|T7KMM&yn7OT4CDb+M-(tz^l>h($ literal 0 HcmV?d00001 diff --git a/content/learning-paths/servers-and-cloud-computing/cca-veraison/inspect-result.md b/content/learning-paths/servers-and-cloud-computing/cca-veraison/evaluate-result.md similarity index 94% rename from content/learning-paths/servers-and-cloud-computing/cca-veraison/inspect-result.md rename to content/learning-paths/servers-and-cloud-computing/cca-veraison/evaluate-result.md index 9dc03c488..e7a92d6f4 100644 --- a/content/learning-paths/servers-and-cloud-computing/cca-veraison/inspect-result.md +++ b/content/learning-paths/servers-and-cloud-computing/cca-veraison/evaluate-result.md @@ -1,6 +1,6 @@ --- -title: CCA Attestation -weight: 5 +title: Evaluate results +weight: 6 ### FIXED, DO NOT MODIFY layout: learningpathall @@ -8,10 +8,7 @@ layout: learningpathall ## Build the ARC Tool -TODO: move to setup? -You are already familiar with the evcli tool, which can be used to process attestation tokens. There is a very similar tool called arc, which can be used to process attestation results. - -The arc tool is also part of the Veraison project. Change into a fresh directory and clone its repository as follows: +You are already familiar with the evcli tool, which can be used to process attestation tokens. There is a very similar tool called `arc`, which can be used to process attestation results. The arc tool is also part of the Veraison project. Clone its repository as follows: ```bash git clone https://github.com/veraison/ear.git @@ -64,7 +61,7 @@ Sourced Data [none]: no claim being made This part of the output shows how the verification service has compared the attestation token against its expectations of a trustworthy system. It also shows what conclusions were drawn from that comparison. -It is important to understand that an attestation result is not a simple yes/no answer to the question of whether the system is trustworthy. Instead, it is a set of data points (known as _trustworthiness_ vectors). Each data point shows how a particular aspect of the system compares against the expectations set by the verification service. Each point of comparison can lead to one of the following results: +It is important to understand that an attestation result is not a simple yes/no answer to the question of whether the system is trustworthy. Instead, it is a set of data points (known as _trustworthiness vectors_). Each data point shows how a particular aspect of the system compares against the expectations set by the verification service. Each point of comparison can lead to one of the following results: - __Affirming__. This is the most favourable result. It is given when the evidence in the attestation token shows a good match against the expectations of a trustworthy system. - __Warning__. This is a less favourable result. It is given when the attestation token does not show a good match against the expectations of a trustworthy system. diff --git a/content/learning-paths/servers-and-cloud-computing/cca-veraison/veraison.md b/content/learning-paths/servers-and-cloud-computing/cca-veraison/veraison.md deleted file mode 100644 index 034374c52..000000000 --- a/content/learning-paths/servers-and-cloud-computing/cca-veraison/veraison.md +++ /dev/null @@ -1,16 +0,0 @@ ---- -title: Veraison -weight: 3 - -### FIXED, DO NOT MODIFY -layout: learningpathall ---- - -The tools and services that you will use in this learning path come from an open-source project called Veraison. Veraison (pronounced “ver-ayy-sjon”) is a project that was founded within Arm but has since been donated to the Confidential Computing Consortium (CCC) as an ongoing community project with a growing number of contributors from other organisations. - -Veraison focuses on the verification aspect of attestation. It provides reusable tools and components that can be used to construct verification services or libraries. - -Confidential computing is a new and fast-growing industry. There are many stakeholders including hardware manufacturers, firmware vendors, service providers, application developers, end users and regulators. Attestation is an end-to-end process that has the potential to impact all of them. Good alignment and interoperability are essential. The Veraison project is being developed in parallel with several standardisation efforts across various industry bodies. Veraison demonstrates the effectiveness of these standards in practice, facilitates their ongoing development within open communities, and makes it possible to build functioning software from them. - -In this learning path, you will use some of the command-line tools that Veraison provides. You will also make use of an attestation verifier service that is built entirely from Veraison components. - From 0505391d54117058db59de860ef1671970c13ee3 Mon Sep 17 00:00:00 2001 From: Annie Tallund Date: Wed, 27 Nov 2024 14:49:00 +0100 Subject: [PATCH 04/17] Update CCA Attestation LP --- .../cca-veraison/attestation-verification.md | 10 +++++++--- .../cca-veraison/evaluate-result.md | 1 + 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-verification.md b/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-verification.md index 40c0df51b..dc92c94ff 100644 --- a/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-verification.md +++ b/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-verification.md @@ -72,7 +72,7 @@ sudo apt install jq You can save the public key by repeating the curl command from the previous step and use `jq` to filter the response down to just the public key part. Save it into a file called `pkey.json`: ```bash -curl http://veraison.test.linaro.org:8080/.well-known/veraison/verification | jq ‘.”ear-verification-key”’ > $HOME/pkey.json +curl -s -N http://veraison.test.linaro.org:8080/.well-known/veraison/verification | jq '."ear-verification-key"' > $HOME/pkey.json ``` You have now saved the public key of the verification service. You are now ready to submit the CCA example attestation token to the service and get an attestation result. @@ -86,8 +86,12 @@ export API_SERVER=http://veraison.test.linaro.org:8080/challenge-response/v1/new Now submit the token using the following command. The output of this command is an attestation result, which will be saved in a file called `attestation_result.jwt`: ```bash -./evcli cca verify-as relying-party --token $HOME/cca_example_token.cbor > $HOME/attestation_result.jwt +./evcli cca verify-as relying-party --token $HOME/cca_example_token.cbor | tr -d \" > $HOME/attestation_result.jwt ``` -The verification service has now evaluated the token and returned a result, which you have saved. +{{% notice Note%}} +The `| tr -d \"` is used to remove the double quotes in capturing the output from the `evcli` command. +{{% /notice %}} + +The verification service has now evaluated the token and returned a result, which you have saved. The last two steps in this learning path will be about understanding the result data that came back from the verification service. diff --git a/content/learning-paths/servers-and-cloud-computing/cca-veraison/evaluate-result.md b/content/learning-paths/servers-and-cloud-computing/cca-veraison/evaluate-result.md index e7a92d6f4..a4c366fc8 100644 --- a/content/learning-paths/servers-and-cloud-computing/cca-veraison/evaluate-result.md +++ b/content/learning-paths/servers-and-cloud-computing/cca-veraison/evaluate-result.md @@ -11,6 +11,7 @@ layout: learningpathall You are already familiar with the evcli tool, which can be used to process attestation tokens. There is a very similar tool called `arc`, which can be used to process attestation results. The arc tool is also part of the Veraison project. Clone its repository as follows: ```bash +cd $HOME git clone https://github.com/veraison/ear.git ``` From 03cd3138754a5c80276df3082ef05c6ffc704ff9 Mon Sep 17 00:00:00 2001 From: Annie Tallund Date: Thu, 28 Nov 2024 16:15:02 +0100 Subject: [PATCH 05/17] Update CCA Attestation LP --- .../servers-and-cloud-computing/cca-veraison/_index.md | 4 ++++ .../cca-veraison/evaluate-result.md | 5 +---- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/content/learning-paths/servers-and-cloud-computing/cca-veraison/_index.md b/content/learning-paths/servers-and-cloud-computing/cca-veraison/_index.md index 04fb683c3..e8826dba4 100644 --- a/content/learning-paths/servers-and-cloud-computing/cca-veraison/_index.md +++ b/content/learning-paths/servers-and-cloud-computing/cca-veraison/_index.md @@ -3,6 +3,10 @@ title: Introduction to CCA Attestation with Veraison minutes_to_complete: 30 +draft: true +cascade: + draft: true + who_is_this_for: This learning path is aimed at developers who wish to understand attestation in the context of confidential computing, using Arm’s Confidential Computing Architecture (CCA). It will provide you with some practical, hands-on experience with the data formats and workflows associated with attestation, which will help to provide you with a joined-up understanding of the many separate documents and specifications that exist on this topic. learning_objectives: diff --git a/content/learning-paths/servers-and-cloud-computing/cca-veraison/evaluate-result.md b/content/learning-paths/servers-and-cloud-computing/cca-veraison/evaluate-result.md index a4c366fc8..7956d5a10 100644 --- a/content/learning-paths/servers-and-cloud-computing/cca-veraison/evaluate-result.md +++ b/content/learning-paths/servers-and-cloud-computing/cca-veraison/evaluate-result.md @@ -73,7 +73,4 @@ You will also notice that the result is grouped into two sections (known as subm How is all this data used to make a single yes/no decision about whether this realm is trustworthy for a confidential computation to take place? After all, making such a decision is the whole purpose of the attestation process. -The next learning path in this series on Arm CCA will answer this question by taking you through the steps needed to deploy an example workload that depends on attestation to release some secret data into a running realm. You will learn how to use policies to govern the strictness of the attestation process. You will also see how the workflow steps and data that you have just been using can be orchestrated together to form the common programming patterns of confidential computing. - - -TODO: "next learning path" section? \ No newline at end of file +The next learning path in this series on Arm CCA will answer this question by taking you through the steps needed to deploy an example workload that depends on attestation to release some secret data into a running realm. You will learn how to use policies to govern the strictness of the attestation process. You will also see how the workflow steps and data that you have just been using can be orchestrated together to form the common programming patterns of confidential computing. \ No newline at end of file From 7554a726052392ba3effc7704026c473085fce02 Mon Sep 17 00:00:00 2001 From: pareenaverma Date: Wed, 18 Dec 2024 10:12:12 -0500 Subject: [PATCH 06/17] Update attestation-token.md --- .../cca-veraison/attestation-token.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-token.md b/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-token.md index a6479285f..2a5a54eb0 100644 --- a/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-token.md +++ b/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-token.md @@ -88,7 +88,7 @@ The contents of the token are displayed as JSON. Check that the output matches t ```output { "cca-platform-token": { - "cca-platform-profile": "http://arm.com/CCA-SSD/1.0.0", + "cca-platform-profile": "tag:arm.com,2023:cca_platform#1.0.0", "cca-platform-challenge": "tZc8touqn8VVWHhrfsZ/aeQN9bpaqSHNDCf0BYegEeo=", "cca-platform-implementation-id": "f0VMRgIBAQAAAAAAAAAAAAMAPgABAAAAUFgAAAAAAAA=", "cca-platform-instance-id": "AQcGBQQDAgEADw4NDAsKCQgXFhUUExIREB8eHRwbGhkY", From baef2dab636f597f707678e6c6e1df4a2e190016 Mon Sep 17 00:00:00 2001 From: pareenaverma Date: Wed, 18 Dec 2024 10:14:12 -0500 Subject: [PATCH 07/17] Update attestation-token.md --- .../cca-veraison/attestation-token.md | 1 + 1 file changed, 1 insertion(+) diff --git a/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-token.md b/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-token.md index 2a5a54eb0..28bf688b9 100644 --- a/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-token.md +++ b/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-token.md @@ -113,6 +113,7 @@ The contents of the token are displayed as JSON. Check that the output matches t "cca-platform-hash-algo-id": "sha-256" }, "cca-realm-delegated-token": { + "cca-realm-profile": "tag:arm.com,2023:realm#1.0.0" "cca-realm-challenge": "bobW2XzHE7xt1D285JGmtAMRwCeov4WjnaY+nORMEyqKEZ0pb65qaZnpvz5EcbDOASRdiJQkwx6JeTs7HWsVBA==", "cca-realm-personalization-value": "VGhlIHF1aWNrIGJyb3duIGZveCBqdW1wcyBvdmVyIDEzIGxhenkgZG9ncy5UaGUgcXVpY2sgYnJvd24gZm94IA==", "cca-realm-initial-measurement": "MRMUq3NiA1DPdYg0rlxl2ejC3H/r5ufZZUu+hk4wDUk=", From 09a8c0ba8403b3ee54d9efb35455e79a74f9ee0f Mon Sep 17 00:00:00 2001 From: pareenaverma Date: Wed, 18 Dec 2024 10:15:35 -0500 Subject: [PATCH 08/17] Update attestation-token.md --- .../cca-veraison/attestation-token.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-token.md b/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-token.md index 28bf688b9..5752d2c8f 100644 --- a/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-token.md +++ b/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-token.md @@ -49,7 +49,7 @@ Use GitHub’s download button, located on the right of the upper toolbar, to do Place this file in the `$HOME` folder, while keeping the file name the same. The rest of this learning path will use the notation `$HOME/cca_example_token.cbor` as the file path. {{% notice Note %}} -You will notice that the filename extension on the example token is `.cbor`, which also denotes the format of the data. CBOR is the Concise Binary Object Representation. You are likely to already be familiar with JSON (the JavaScript Object Notation). JSON provides a standard way to convey nested structures of key-value pairs. CBOR is conceptually the same as JSON. The difference is that CBOR is a binary format, rather than a text-based format like JSON. CBOR is designed for compactness and ease of machine-readability, but at the expense of human-readability. You can learn more about CBOR here. +You will notice that the filename extension on the example token is `.cbor`, which also denotes the format of the data. CBOR is the Concise Binary Object Representation. You are likely to already be familiar with JSON (the JavaScript Object Notation). JSON provides a standard way to convey nested structures of key-value pairs. CBOR is conceptually the same as JSON. The difference is that CBOR is a binary format, rather than a text-based format like JSON. CBOR is designed for compactness and ease of machine-readability, but at the expense of human-readability. You can learn more about CBOR [here](https://cbor.io/). {{% /notice %}} ## Build the EVCLI Tool From 60b4f9c0bdd243ca710e2db36dc0d4ef1ff97fa7 Mon Sep 17 00:00:00 2001 From: pareenaverma Date: Wed, 18 Dec 2024 10:17:03 -0500 Subject: [PATCH 09/17] Update attestation-token.md --- .../cca-veraison/attestation-token.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-token.md b/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-token.md index 5752d2c8f..560fd6b83 100644 --- a/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-token.md +++ b/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-token.md @@ -77,7 +77,7 @@ The tool is quite small, so this should not take long. Once it has built, you ca Now that you have built the `evcli` command-line tool, you can use it to inspect the contents of the example CCA attestation token that you downloaded earlier. -Run the following command, taking care to substitute the correct path where you stored the CCA example token from the earlier step. +Run the following command: ```bash ./evcli cca print --token $HOME/cca_example_token.cbor From 087fbabcaf236166a54b1fcbbd28d336792ef89d Mon Sep 17 00:00:00 2001 From: pareenaverma Date: Wed, 18 Dec 2024 10:18:11 -0500 Subject: [PATCH 10/17] Update attestation-verification.md --- .../cca-veraison/attestation-verification.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-verification.md b/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-verification.md index dc92c94ff..e4c150073 100644 --- a/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-verification.md +++ b/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-verification.md @@ -7,7 +7,7 @@ layout: learningpathall --- ## Attestation Verification Service for Pre-Silicon CCA Platforms -Linaro provides an attestation verifier service for pre-silicon CCA platforms, such as the Fixed Virtual Platform (FVP). This service is available publicly and is hosted on Linaro infrastructure. This verification service can be used to verify CCA attestation tokens that come from emulated Arm platforms, including the example token that you have been using in this exercise. +[Linaro](https://www.linaro.org/) provides an attestation verifier service for pre-silicon CCA platforms, such as the Fixed Virtual Platform (FVP). This service is available publicly and is hosted on Linaro infrastructure. This verification service can be used to verify CCA attestation tokens that come from emulated Arm platforms, including the example token that you have been using in this exercise. Linaro’s verification service is implemented using components from the open source Veraison project. From c9fcf5518a18772fb87988cadd7ba028861e6caa Mon Sep 17 00:00:00 2001 From: pareenaverma Date: Wed, 18 Dec 2024 10:19:04 -0500 Subject: [PATCH 11/17] Update attestation-verification.md --- .../cca-veraison/attestation-verification.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-verification.md b/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-verification.md index e4c150073..96df7ee44 100644 --- a/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-verification.md +++ b/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-verification.md @@ -9,7 +9,7 @@ layout: learningpathall ## Attestation Verification Service for Pre-Silicon CCA Platforms [Linaro](https://www.linaro.org/) provides an attestation verifier service for pre-silicon CCA platforms, such as the Fixed Virtual Platform (FVP). This service is available publicly and is hosted on Linaro infrastructure. This verification service can be used to verify CCA attestation tokens that come from emulated Arm platforms, including the example token that you have been using in this exercise. -Linaro’s verification service is implemented using components from the open source Veraison project. +Linaro’s verification service is implemented using components from the open source [Veraison](https://github.com/veraison) project. The URL for reaching this experimental verifier service is http://veraison.test.linaro.org:8080 From d9dee5fc59afa936c52ef663abb5eff8ce125714 Mon Sep 17 00:00:00 2001 From: pareenaverma Date: Wed, 18 Dec 2024 10:22:46 -0500 Subject: [PATCH 12/17] Update attestation-token.md --- .../cca-veraison/attestation-token.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-token.md b/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-token.md index 560fd6b83..862450165 100644 --- a/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-token.md +++ b/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-token.md @@ -38,6 +38,13 @@ Verify that `git` is installed using the command below. It should output the ver git --version ``` +## Install jq +The jq utility, is a popular command-line tool that can be used to parse and manipulate JSON data. You can install it using your local package manager, for instance: + +```bash +sudo apt install jq +``` + ## Download the Example CCA Attestation Token Using your preferred web browser, navigate to the [token in the TrustedFirmware-M tools repository](https://github.com/TrustedFirmware-M/tf-m-tools/blob/main/iat-verifier/tests/data/cca_example_token.cbor) From 12c9107c281c6f719e1304d51deb05737e892a68 Mon Sep 17 00:00:00 2001 From: pareenaverma Date: Wed, 18 Dec 2024 10:23:45 -0500 Subject: [PATCH 13/17] Update attestation-verification.md --- .../cca-veraison/attestation-verification.md | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-verification.md b/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-verification.md index 96df7ee44..076791c45 100644 --- a/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-verification.md +++ b/content/learning-paths/servers-and-cloud-computing/cca-veraison/attestation-verification.md @@ -63,12 +63,7 @@ If you can reach the verification service, you are now ready to use it to evalua One of the properties that was returned in the previous step was the public key of the verification service. This key will be needed later to check the signature on the attestation results. All that is needed in this step is to copy the contents of the `ear-verification-key` field from the previous step and save it to a separate JSON file. -The easiest way to do this is to use the jq utility, which is a popular command-line tool that can be used to parse and manipulate JSON data. You can install it using your local package manager, for instance: - -```bash -sudo apt install jq -``` - +The easiest way to do this is to use the `jq` utility. You can save the public key by repeating the curl command from the previous step and use `jq` to filter the response down to just the public key part. Save it into a file called `pkey.json`: ```bash From 9392c95e1d6b6e51f79ae8411f4d638d3cb320ca Mon Sep 17 00:00:00 2001 From: pareenaverma Date: Wed, 18 Dec 2024 10:24:53 -0500 Subject: [PATCH 14/17] Update cca-attestation.md --- .../servers-and-cloud-computing/cca-veraison/cca-attestation.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/learning-paths/servers-and-cloud-computing/cca-veraison/cca-attestation.md b/content/learning-paths/servers-and-cloud-computing/cca-veraison/cca-attestation.md index c9fb9f95f..021f5a78a 100644 --- a/content/learning-paths/servers-and-cloud-computing/cca-veraison/cca-attestation.md +++ b/content/learning-paths/servers-and-cloud-computing/cca-veraison/cca-attestation.md @@ -22,7 +22,7 @@ CCA attestation tokens have two very important properties. The first is that the ## Veraison -The tools and services that you will use in this learning path come from an open-source project called Veraison. Veraison (pronounced “ver-ayy-sjon”) is a project that was founded within Arm but has since been donated to the Confidential Computing Consortium (CCC) as an ongoing community project with a growing number of contributors from other organizations. Veraison focuses on the verification aspect of attestation. It provides reusable tools and components that can be used to construct verification services or libraries. +The tools and services that you will use in this learning path come from an open-source project called [Veraison](https://github.com/veraison). Veraison (pronounced “ver-ayy-sjon”) is a project that was founded within Arm but has since been donated to the Confidential Computing Consortium (CCC) as an ongoing community project with a growing number of contributors from other organizations. Veraison focuses on the verification aspect of attestation. It provides reusable tools and components that can be used to construct verification services or libraries. Confidential computing is a new and fast-growing industry. There are many stakeholders including hardware manufacturers, firmware vendors, service providers, application developers, end users and regulators. Attestation is an end-to-end process that has the potential to impact all of them. Good alignment and interoperability are essential. The Veraison project is being developed in parallel with several standardization efforts across various industry bodies. Veraison demonstrates the effectiveness of these standards in practice, facilitates their ongoing development within open communities, and makes it possible to build functioning software from them. From 8264a948fd84533a6dc782d62fb4f9e585c59477 Mon Sep 17 00:00:00 2001 From: pareenaverma Date: Wed, 18 Dec 2024 10:26:08 -0500 Subject: [PATCH 15/17] Update cca-attestation.md --- .../servers-and-cloud-computing/cca-veraison/cca-attestation.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/learning-paths/servers-and-cloud-computing/cca-veraison/cca-attestation.md b/content/learning-paths/servers-and-cloud-computing/cca-veraison/cca-attestation.md index 021f5a78a..a8823a4dd 100644 --- a/content/learning-paths/servers-and-cloud-computing/cca-veraison/cca-attestation.md +++ b/content/learning-paths/servers-and-cloud-computing/cca-veraison/cca-attestation.md @@ -22,7 +22,7 @@ CCA attestation tokens have two very important properties. The first is that the ## Veraison -The tools and services that you will use in this learning path come from an open-source project called [Veraison](https://github.com/veraison). Veraison (pronounced “ver-ayy-sjon”) is a project that was founded within Arm but has since been donated to the Confidential Computing Consortium (CCC) as an ongoing community project with a growing number of contributors from other organizations. Veraison focuses on the verification aspect of attestation. It provides reusable tools and components that can be used to construct verification services or libraries. +The tools and services that you will use in this learning path come from an open-source project called [Veraison](https://github.com/veraison). Veraison (pronounced “ver-ayy-sjon”) is a project that was founded within Arm but has since been donated to the [Confidential Computing Consortium](https://confidentialcomputing.io/) as an ongoing community project with a growing number of contributors from other organizations. Veraison focuses on the verification aspect of attestation. It provides reusable tools and components that can be used to construct verification services or libraries. Confidential computing is a new and fast-growing industry. There are many stakeholders including hardware manufacturers, firmware vendors, service providers, application developers, end users and regulators. Attestation is an end-to-end process that has the potential to impact all of them. Good alignment and interoperability are essential. The Veraison project is being developed in parallel with several standardization efforts across various industry bodies. Veraison demonstrates the effectiveness of these standards in practice, facilitates their ongoing development within open communities, and makes it possible to build functioning software from them. From cbb5acf163063fa1310dd0bd1c9504f2a855db3a Mon Sep 17 00:00:00 2001 From: pareenaverma Date: Wed, 18 Dec 2024 10:34:19 -0500 Subject: [PATCH 16/17] Update _next-steps.md --- .../cca-veraison/_next-steps.md | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/content/learning-paths/servers-and-cloud-computing/cca-veraison/_next-steps.md b/content/learning-paths/servers-and-cloud-computing/cca-veraison/_next-steps.md index 18da1923d..61a0985cf 100644 --- a/content/learning-paths/servers-and-cloud-computing/cca-veraison/_next-steps.md +++ b/content/learning-paths/servers-and-cloud-computing/cca-veraison/_next-steps.md @@ -1,22 +1,22 @@ --- next_step_guidance: Now that you have gained some hands-on experience with the data formats and workflows associated with attestation for confidential computing, you may wish to explore some additional resources and specifications, which go into greater detail on some of the individual aspects. -recommended_path: /learning-paths/PLACEHOLDER_CATEGORY/PLACEHOLDER_LEARNING_PATH/ +recommended_path: /learning-paths/servers-and-cloud-computing/cca-essentials further_reading: - resource: - title: PLACEHOLDER MANUAL - link: PLACEHOLDER MANUAL LINK + title: RATS architecture (RFC 9334) + link: https://datatracker.ietf.org/doc/rfc9334/ type: documentation - resource: - title: PLACEHOLDER BLOG - link: PLACEHOLDER BLOG LINK - type: blog + title: The Realm Management Monitor Specification + link: https://developer.arm.com/documentation/den0137/latest/ + type: documentation - resource: - title: PLACEHOLDER GENERAL WEBSITE - link: PLACEHOLDER GENERAL WEBSITE LINK - type: website + title: The Attestation Results for Secure Interactions (AR4SI) + link: https://datatracker.ietf.org/doc/draft-ietf-rats-ar4si/ + type: documentation # ================================================================================ From c057577eca8feaa8a81abb8cede040b403b12fc9 Mon Sep 17 00:00:00 2001 From: pareenaverma Date: Wed, 18 Dec 2024 16:24:39 +0000 Subject: [PATCH 17/17] Updated the Veraison LP --- .../cca-veraison/_index.md | 3 -- .../cca-veraison/_next-steps.md | 2 +- .../cca-veraison/_review.md | 38 +++++++++++++++++++ 3 files changed, 39 insertions(+), 4 deletions(-) create mode 100644 content/learning-paths/servers-and-cloud-computing/cca-veraison/_review.md diff --git a/content/learning-paths/servers-and-cloud-computing/cca-veraison/_index.md b/content/learning-paths/servers-and-cloud-computing/cca-veraison/_index.md index e8826dba4..7f8c99028 100644 --- a/content/learning-paths/servers-and-cloud-computing/cca-veraison/_index.md +++ b/content/learning-paths/servers-and-cloud-computing/cca-veraison/_index.md @@ -3,9 +3,6 @@ title: Introduction to CCA Attestation with Veraison minutes_to_complete: 30 -draft: true -cascade: - draft: true who_is_this_for: This learning path is aimed at developers who wish to understand attestation in the context of confidential computing, using Arm’s Confidential Computing Architecture (CCA). It will provide you with some practical, hands-on experience with the data formats and workflows associated with attestation, which will help to provide you with a joined-up understanding of the many separate documents and specifications that exist on this topic. diff --git a/content/learning-paths/servers-and-cloud-computing/cca-veraison/_next-steps.md b/content/learning-paths/servers-and-cloud-computing/cca-veraison/_next-steps.md index 61a0985cf..7956d8c74 100644 --- a/content/learning-paths/servers-and-cloud-computing/cca-veraison/_next-steps.md +++ b/content/learning-paths/servers-and-cloud-computing/cca-veraison/_next-steps.md @@ -1,7 +1,7 @@ --- next_step_guidance: Now that you have gained some hands-on experience with the data formats and workflows associated with attestation for confidential computing, you may wish to explore some additional resources and specifications, which go into greater detail on some of the individual aspects. -recommended_path: /learning-paths/servers-and-cloud-computing/cca-essentials +recommended_path: "/learning-paths/servers-and-cloud-computing/cca-essentials" further_reading: diff --git a/content/learning-paths/servers-and-cloud-computing/cca-veraison/_review.md b/content/learning-paths/servers-and-cloud-computing/cca-veraison/_review.md new file mode 100644 index 000000000..50dc9f18d --- /dev/null +++ b/content/learning-paths/servers-and-cloud-computing/cca-veraison/_review.md @@ -0,0 +1,38 @@ +--- +# ================================================================================ +# Edit +# ================================================================================ + +# Always 3 questions. Should try to test the reader's knowledge, and reinforce the key points you want them to remember. + # question: A one sentence question + # answers: The correct answers (from 2-4 answer options only). Should be surrounded by quotes. + # correct_answer: An integer indicating what answer is correct (index starts from 0) + # explanation: A short (1-3 sentence) explanation of why the correct answer is correct. Can add additional context if desired + + +review: + - questions: + question: > + A secure boundary is sufficient for confidential computing. + answers: + - "True" + - "False" + correct_answer: 2 + explanation: > + A secure boundary is necessary for confidential computing, but it is not sufficient. There must also be a way to establish trust with the target compute environment that the boundary is protecting (the TEE). Trust needs to be built by a process that is both explicit and transparent. This process is known as attestation. + - questions: + question: > + The CCA attestation token is divided at the top level into two sub-tokens. + answers: + - "True" + - "False" + correct_answer: 1 + explanation: > + The CCA attestation token is divided at the top-level into the platform token and the realm token. +# ================================================================================ +# FIXED, DO NOT MODIFY +# ================================================================================ +title: "Review" # Always the same title +weight: 20 # Set to always be larger than the content in this path +layout: "learningpathall" # All files under learning paths have this same wrapper +---