From 838769b3866c268e21b0385c9b9f97936a18cd12 Mon Sep 17 00:00:00 2001 From: qubedmaiska Date: Sun, 12 Oct 2025 18:11:37 -0400 Subject: [PATCH 01/17] Merge remote-tracking branch 'gregoire-mullvad/patch-2' --- user/templates/fedora/fedora.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/user/templates/fedora/fedora.rst b/user/templates/fedora/fedora.rst index 44adc0f3..0015a6d7 100644 --- a/user/templates/fedora/fedora.rst +++ b/user/templates/fedora/fedora.rst @@ -3,7 +3,7 @@ Fedora templates ================ -The Fedora :doc:`template ` is the default template in Qubes OS. The current version is Fedora 41. This page is about the standard (or “full”) Fedora template. For the minimal and Xfce versions, please see the :doc:`Minimal templates ` and :doc:`Xfce templates ` pages. +The Fedora :doc:`template ` is the default template in Qubes OS. The current version is Fedora 42. This page is about the standard (or “full”) Fedora template. For the minimal and Xfce versions, please see the :doc:`Minimal templates ` and :doc:`Xfce templates ` pages. Installing ---------- From d869a4d8f7c29a2839e027dd72a9a34eb3abac33 Mon Sep 17 00:00:00 2001 From: qubedmaiska Date: Mon, 13 Oct 2025 16:53:20 -0400 Subject: [PATCH 02/17] Merge remote-tracking branch 'marmarta/howtowallpaper' --- attachment/doc/howto-screenshot-1.png | Bin 0 -> 45336 bytes attachment/doc/howto-screenshot-2.png | Bin 0 -> 24654 bytes attachment/doc/howto-screenshot-3.png | Bin 0 -> 59621 bytes index.rst | 1 + user/how-to-guides/how-to-set-a-wallpaper.rst | 49 ++++++++++++++++++ 5 files changed, 50 insertions(+) create mode 100644 attachment/doc/howto-screenshot-1.png create mode 100644 attachment/doc/howto-screenshot-2.png create mode 100644 attachment/doc/howto-screenshot-3.png create mode 100644 user/how-to-guides/how-to-set-a-wallpaper.rst diff --git a/attachment/doc/howto-screenshot-1.png b/attachment/doc/howto-screenshot-1.png new file mode 100644 index 0000000000000000000000000000000000000000..538796a66b6f4adecebad5a0767833c3cf885b39 GIT binary patch literal 45336 zcmb^ZbyQVd7e9_3R0KsqL>fdI1OWl*FaVKMkdQ_i>25ITmM)Q$4v8ZzAPoZ2-O}B4 z=k|HO_x{GX_m5kQ;rl-7@tm{QUTe-z&F%YK?&;G_B;)XZmuw$Ddx;G{ZrJ)hDAXO)GqFc6o#I!gX4f?NBhu?awXEVU^__U@PsLw;*1fj(xS5Z&u|WRas_WYGN4cSdZg(^}@S5 zj?tviho{M%5?|k4NZIuexh)iV=+U(w-xZ^g&=ns?O-oz<*5}_34v8kE*T4Td@nELL z|MwI1;xWy?AGVYaV*h?LB(C`Wdr^77&71#TV@*m=_wO~+oKlkiUejRkIpn|hY%50# zc*TZ%{tSQqA-nztekd98o8|soP0CL`J}*Ng{-6E@)BnFd`v3PgDp%cK8(SQ&5_}p& zVQtUUH(fR^id-^Uz#5Zda%-&%h%U8y2CJ*+vKr~%(b!!kBaR2?1JcM z5$hL8UgL@D^Xc)*pUe3*a%yU1@ZC=~gFRDS z_t!d)dEx>Ow-<^%PF)lf6tMB|GAt*muTk**j=5w${N2}id)|6w@P2>YFr&R8rKYX}!cF-isY4`W}f_=qUCoJQ^RvY^>DXFh=2?BPDJs-Vq zyI{-9cU_G-Eb;sG-__#vMTXEZG8TKDd*mpyq@|^yQq$AJqN639ocMUhooFw=PyP{` zuh0}sWwbrtfs%>lcw1^da$$09P44{cl$njqaQM4Pdy;4p7M0tE-*EJOy~`LF7zc-k z)_;FfYdOymp6!*@;1dwMub-OyNUWtZQfhv1eBArP{>}8vObn;NRYtjZot?kkD-$(I zQQ97)Uj4c1Giz&|<5jLLt*t-4Ix)z_H~+9-j(_$b&W)aS|_HgxaQlDS{9B)y7^E5En<@n;~y>c5>*p)BUuep`pN_jR>w= zB0<1D`oSBb#Kgqe+1ZWXPw)!OhB#mA=?zu83p!LJSd9JH9Db9J5t5J)SW)4crZ-gO z$_odxUZ3;6LF+BG5>s)w>A|9Bd|0>?IvueO;Hztt%G7wAw*FC%xbFuCyxHvZ|ju}Q>i61_En6%=Pl$T%FS?pCBb1NwrStVq1_2AAd zx{P-_AZ}#nWaI33-P@L`zqhwH;Y#;6#f-mW6}<4zjcUCx;ESWI;O3A$FuhdkIN{!; zC@*-{I0g z*a)|b3SaWBm;5U$twHJM)BGT#^{He}Z!hz`d+=3LMlGvl83^j?>QJ|C-Fj)i-S^dc z<`*0jOs@eg*Ff1g9^Dc(W+o<`p(2C!czyz}cGlxCv-K9R&TxGd zPTf4y)6?-OEI7n$A8ZvHOb7C0;Y(mhN=v7F|Na?jL{IV)tgx^!Zn=cA&k1GUYY|JmEB4rE|y2^ z%&0;zc}!n&G7#cw^D(;~>gN2*L+qBrMcJs~v%Ql)ss8S59{0!u9ax8khW;HYEte}P z-KvInRiN%3ZYQ0uxQ!JX$rG_@G=CNMSB3Rd&fX0>9V^hi2t}xIY%JmXcW%^e&l77t z-p9T9+M>#N8Z9{Nl@G%iWSd)CX}Gw;!x`nbc6#ND9ah!G-S;(PdCa9$RY{&bduC-3 z`+3ML@1-`Ja_QjP!m4lqv`>TRI61>Uf4&9h5_Wuwe3A&9-L}ZXlB|FiVzVxxQGB=) zM@HvoU7}|<&!!wJ1nBTX-$+F;(!G8AHZ?6xw@?*MgEa%y0zU;VCnx9R=&g)p@#oKP zD5lHk_GKx#ouBS^Vh$S?$3$tl_>Ndq1g56aLBXCHb@%~C@;W)sa}5od47mhsTwKG& zp0v4sQPV$6k?h)Xrlxmaym&F{d4AftOA;^b^Y!aj)hd??$x2Cnh1$ zlO|1!OC=%$RUb;*&e~WU^ppd?qvIZFcI*1N+wSN1 zeg3aF&8kJYn^Bi6)A4D0f4WV_YjXb#fBy$J8(gC=0EHAOZ|18wILJv*&W?a>(fdu2 zalu>ByS@%eAiwqWB@|MIuaj|Sw$8Uj{A>DR5&dZM5grDa=!e$U_o0Pc!on(s!gt$! z=Y>(&9U7Vk?99w9{JDSn6sq4m8}msq$V*EI_-YYV)z_2QVMxos@CmAQi0J8}Jn<+M zm*KVgPuFMC<1Dfw_gG#J8qCpTT{9$=$522Xy1(WSqXpd)U^qASH5TN zvD>FIYSVVlZL^U$Vwk!p%Y3{tM%Z=lvunO)g~QIuP+xhnlMWe=nz38Z{3cQ*9W( zt-tlQW%LH`#GX^1se_U=t7?Il=h=3W+tFf%*=Tv_ZDAJ;C3h85xbP33KJ`GWu~`@0 zY#_Ks&J(a+eH?^r*ISW|Gu{LLA*dvDQBBGxUyimCkPF!LCaG{0U~Eu@#-^l`ez5 z#f`n<3vpeis5BjEUYmJiN|{G`87H{rlU^g*gdDv z3yHQCzIX)|V*=Hud+J*5yGmLvi}ZkX-nHnzhI6;GJP?d^+v$tUH8`pR+MWsBDNnb5 z;;8fNWyJ=1CAKA=*h;#_~TIyj}xb*zU-$K7HsQP`-$7v zaxycSeg#oVKY#u_ZQ?2ZH)m-6@x(W8+H~7Wd`(F~wqAi+?#d{dz`OoYmCJ4x7X@I% zyAhS1EK|FR)?61I_=?E={J%Vs-q>YV=MlUpM{((*mEJ({oF~8a@K}9N@|_5RjbJHWb0K|SHq_0dR6^2_%^rkZ!bzghnLRnGzz;}_8(?#e*XMv zJdl@QI~hZaMs&8D7^pP$QzUEJgG?UjrTX?%f4A(dP)-11QC~G{9c74$W@v7iLIo zZ0p;LSS0*5vzYs=MAB(9H$!6=dOm!xwS9Q~@_kz2HE+oF?{ub@hV7gsgNa&TNkua=Iqein2);BY_Msq5$ngc_~!TjKHKciZu~Kv_ED z`4#8S;4;~r<`uj#k_7Di;H+*A871M9k+mXwl0)|bmr*CHqn{F>(3l4dHGjT5x(KTt zEnvSSK0*-sX5_*BLQYmznHGSh8f9*#ycr!{geR3Lw zva+Z&x?Y`pFF$kDez~7N=wh0Sj>ljbxgXyVv2}} z0IcdgY==gxTA+hbSXhX%TN{lTDmGGlX;=ClT2GE@;a8aofB`2b+g+$m8w3Gpc^n!f zx-2n6w@t9VjD>|9zo?NWqI+tS3kyxa$>Ob7$E)H1^Y&Ca+X8xy7I7E&$7@nkH(D5z zG`f$OX&$V{N+KjV&ryWB!=&5j3OdH<+@wUUmhr~Po43JK2Y)WGQ*CU#y*V;uWFtoo zuedKl{X%7Qt>B4Ed~Kjuh9<-UWzUUOb;`{?+~qxa=gpU9EFfipHY6D&IK%b3X2YXRsR z-avP<_HE_q-UxBS^32SWiE8&Y4Nqu+uVA6P@u=9!*e$Dei2&k35%~;!W*e@I!)o#& zYTRvG76`IWV4%UqWF11+ptT(OjmtxoRPs9)G1#j(z$R(k7U$b{G9%9GKSk=!GKiRJKOjFipTsWPSD6?f) ze0H-su6^_U8*EF3cVnUJJ<;M~8nTGoB1zcNxrlMuF?QcMKn*{k?VcjbS1!u)avv_n z(vX9hCLQ)<-N2`JX>3-XKL%YuL3|kRO#WkAzhC7?wa~JcZ-n5gFRm8RBccJ#|A$h} z_tkvp)`SJB<}0FZpWpqYp-_66fw8f<_f_eoo>2Rm(#ve0=8}J3vzd_3j`a$Mf*@a} z)bc&nyEIcyoVj1gluWAN^Y6+cD~rCs?|kUw5}RGA#V#*jw7r#8i7ZaUKOHE~tKOo? zm_x(LeIY2JU9BKwtinOTiUDW6R_(j_K+sfS;rCz*&mkA6S9=Ps55(`m1^*MM6fmWv zrDG1})pJHpE(TRl)tOJ)9$P06pkC(-O3)dZtJMzSmPfZD-i+sCiL&ie7is} z;pT5ip!jWf@8)Bd>kI{QniqsdujD93g@}$m%`GF^9`n7%P`w$M{e%!7o&HZzLQ4rc zuISfC=KgVA6E;0Oyg6x6Ihhfe#6IQe?rm9SzL1gRkrl~j#zXEn?#x(h*pU@^)J4u^ zC=(+RKyv?Ge)Un7+DOhCk70ZCBSc=BsPT+RLh!B9@L8T_1<3=`mxN-hTO-NL>Tt7E z7DaK0Ztxu3e|K`qruln}c*H&UzU$cqiyw>WcY|lL^Q)&L)h(v{*{dh(u&5f0b7Iyh zp9YeNpC0XI=TvvZ@y;wPJcW~=l^eL#@aq@n>jod2^**s@{L})`xRXDEFeO27I zc`D&?N-%^Lgx}{x@&UT3^}(kF*kCyGE3mIe!ddOR@!O;cgRnxW!9qPOAhvzO5(elW z?x7Q$fr#3tk@ha$3@RPR56v@Ik*5jIuiDsH@llYp4y7$i0m=ye^5xFY`g&hD?LDc_ zKt@TC0et<710rgGcfadJkeQT zGpH}1Tm(>wCW2BmWyPmjVoK;wbdN?Ker862iFz%-LghwT(p+ONp(qCRs z5CXlV$Z7NSe0xm&+39h@GMAR;sr_YKie}nip`Ry*+s>13v0BY%00Gl-aD>2H+#n`y zN(mN0x-4h_wvmW77%aR;0&Dtu>gPuaKC4>Nr%L57PeENQ)N8s)MkWQHhKO6gzdVwO z z>~2y~i&XdHwxp*Dq%kou6oL)`xRe5X`D4Iwfzh46D}p^t3m6dvL~UcL9%Hb=(K4-7 zLk1um8jTj(8`SFzefK}mZxloQL>9nF~Pxjc)~j&wtv!v5VWZC;yA5UJL?SoiJ!lJTf<<=K8z_V?5Ba=xCPo_Jb16mWkatK02dU7uea zTb*6pVHXz{4~>ss(Gb%LnjS?3D(6DN{cA3TV-h=t2xGuw>Q`ihlkVLg!SL6(&a z%>XSu-L#E~i3t>@3&7$Lp%*x{CS{n9WZL&P6NwgOv04 z{rj8m{pgc?T@y44Pd+%?qT>I7{${3Llva0%p2r)sMQ%>M#}mk>r=znPF)xc?c0Ab7 zJ=$4R{KiR4fRA6dGE~g&B1%pD7PPS<{g#^x#LwUK=P+~8)S?$d5Vc$f{k~N_t!QVxA8;JaTGJ;s`LddERM<!JI2so>oGgu-;&dYJDbji ztNPs|%slJ?DetMB-4138_QU@JCu?e=*fd)^6O0@WZTKiUxun&~EHq&OY(03hNVyF8 zM#idK%eJ4Cwdj8>D7cZ`cXfft!*g%Q$Y2Tk+O=7L(U-quW@e7^xVgCjElV#B1T~>R zr|tr%xa{P5vc>>SLEbfZJqpq-i*k-tq{(^NpWpj5UAoUhpZ*ul-+on?pE!#=as zLn}vgPLnsTLoJh$WZss&cm+HM>%T(68W2`R*mOIHt@CeG!QPcDTi z1aav;QkP4OpZ*pqzg73gMCE}3r{%a%qWj*E&HBd=A8wG6wt&9yw?CI0<$1cS{pyDu zvt`XGPh(>v(gDDJ_d}i&;RZAE@I?Op{TvPh zv`|stf3_mfN4GNl{i(-$T-rF0o5zoiLL&x0m3P7|90Vdk0%lLobIxURF%P_Jq@<*T zBb+k=k^jW420~E~^d=BxK!+#p5XxSrO8#w>==lj36au@yzu!Vt3WEMnxLq1kOhLS!KG7+@;Ey*sy<#5EGjNG`ICtchx!^R=LZnC zb&H3hMLk892l5%|=|664SRL)HBG;MlWDK-&EFECntm>r!fBw8AG%yTO{~kj^7{YStk2IWPAIybR9|Wl>SZ8WM&? zW%gz&bNA0(mWNsH(b6bHa6eYSSn!UZ#Kl@%TbGwe4*eZ^kgZqP~c)gQHReJ?xfR$vU+kb6Kt?F zSmRl-C}+kzfpHc}cG5O56z z8)&YwOs@$SE(WAXgVxW?GKoSl(62dxhyfp+9nIPVN~Z(rs@-ybAgpx(sJ2UgzSaNy zh!ewYauez95D~+CuR7a2+yiMAR6bZN!JZ6KaT3Ah>(0CwcoE%S_&m(>$TxX@uKsW$K z?VT!O{BI_pzyVPWZa&&=7EJKdUUf-LHQMUIVJ{cp#>bD!?8grS6o&X+Ah}(Bk5N1% z1ELQ-J-ti}C#Jl-yhI?`oKWD7+T8MT8!&F6V0I9`C=6oJxet$3A!?0YyFjxH4)1_8%%9#0pTqwXM!U@idrk z#UqCCdmfy%|0fHel&y@qbm`LXGD~eJne#a_Cl0<5&gfIpSX43z zznU|Wrk!l=8d_?DPnlgc2D~FfsukSzG}C92h`a_a4L?8W`#P&S8a^oC7U(%5(D9vt zqnk`r3qvh!GUHKs%BS>mU?2)W65`4NFgbv#7z2U?aQJy3=2L4G>+|r-5LPHht;8=R zPu=r|w9JI++r0U{3yR}?fgRA+)@=ehIYE-ou{1p_VZ7FTu} zg)t!^;pn4vJSX_>aFRsNj|OTq0Iv8*zdZb$3w;e#A_}=gA?KknzRId9^m1MWM~n<8 z*emaZoAU|bonTuuqAyAUcmOTR+C#N;$jr*(5)BiR57<5;M}KMg9EVpAIah~E^uR3! zDsyFNXERMzj7(N2D}<^<#IB{0J~}t(A3{t5~m=1}X%* zkCvJFN~bI%XIuvYgn%*<03`scP;z~|iWDRtfZ=*`tr3+QKXJHCdOqajuyS&7@jGwP z$%~%a1@3b(F=al!ubCrCT;V|v_(m2I5P;;S#vCW+;1_23Wa@rf6;wMFn%`Z)U_Rc} z_R-QWyzzHI{cRXz7_Rs67`$opBQ%5Dfa@CC8yb|h!*@Ckj^AjK6SZF0_M@Yt2e1SA z;3L0%`-XTErRM6l!C2>fql56ecz#=8Mqn^E9ZvCqf5)cz!wSGA6#gsN*k2&nAat@( zkGghSC>q)$a*knhgC*^4t9~dUE?(%eYYOJ*qlXVsfUag?(>uNrWx3hgcw}3+tg>Y3 zc}xy>cMe=p$V)LOTxVxzfaf_tyhnr# z*u)QPANE@I!CF9;!(r`?^2?VE2yz3K>I4kV2{?@=Q``ap)kZ$RtjCXaDha~ zsUZ8wEzkr)+cFE4Y=M&jM$br(&3?fXcU@Fe6flW3AH}Hq{+LpA^%J&PNIn2YSR6%j zL4O3+Itk(*G`qu%dc3xk-~Y6xfpjwAZ^B$$#SC%T_t)0ePEOZ79qmbKq(MGU1-6`r z3*Hq-o6jSHLo_TlfBXv#H9IRMh5)IV_e*T+=*Zo&MUn@g*$gYsU1nYH!Uoz7Y6HArQU?cse!g%RDhFp3=wQouVzU+15v9EbZ6|VS1;5~S?QFGAln1HHxPbOe%c2@3Q4#AlXb5wZ^ZGD zjWx*WXa_^>>Tm*+~OmxN7R>7FdQ9wmC8h&Hgw>yHb8IyTq(Wr zN@obyZ~^kUyQnSR`0H1Z+o6qej%rL3#jv1cHD-~I6U7pifs#7hUqA@PxKqcX6D(3q;Z^h&pby}hw6 zUcPpRnmW04IWGX9*CtS~B2a3gkoRW$PkE%tkV~>YO9Y6y(|%sXz_>oTYewOP!RN8{ zvZN7WTB>LpgP3~1^R1|wjZxdK?wnU#3nc(=H-ScMEoJ8`XO4qbffx*DyZN4o25?mv zX!Ro-o1$&||IEkRpjKVHbN8+vFbsi=cx3VaUy58{{lOi`R?dCh{Z)K+VL|cv^I9m} z9pUmKzI8fQ{oTN-kd=ZyXk}|V0|k;1TzLQ)-oQM<6B0T)cqiI{J8wYh?710OV%(46 zw%J4!+1Rison?%YXy>I^Ui zz*ann+6L$l5=#hczDpSA^YY&Rv`zM!vB%H7L?vd1EElAuq&P@rNdhi2b=H~jV_wGM zu_eLnLdjglnmGTC6TY}Ij9)SKNLh}}^KeF3g`&P{f4mK})cE}3q9Rp*MToqX&3asvosSRlb|iZ%Lr>r>;|IL2kv@KZ`8q07vx4XJc;5)r zPl$=3bU0&3MBMn;s}EkMy(S3F`gihY@0OVMM<*QPUC?1KQPg_y!|zo99Iv zFAlGxAbPQmVrNOJuwot4UaYJ-SxOI3;B@HI+q#gH0JYEy4qYw!g_m|#Gw(UzT6$_~ z4FAS=eJ+a^DTpD+1D^1eg_~S)9lxNv0CL2*^M6sN5}{UiPSDcQvj3HLa46m0g+6-# z1b%a8r$L7!BsBC9(9BjL*yz@eC~K;TNJu2*t0)8pT#mI;`uGZ$dud{4dcI(j5F%_u2 z-rm`<^N7a9#-41C;WAjG67@JKvIj2~r0Q!9Yoje7!ybUcx4B!z@ojoEv*9q54DyRf z=O;#BbjDwK1`CaigQEx3Davg7DiZ=T>3UE$=1 z*Q}g;qtsZ=%6J)p#2q0RNkB-5`Ea2#0Wv2%pdVVTy+8FMWMNb9g3Y(FyE|7pVvzzd zO)%P$A1|cCu}6XrNcjj&O2T^x@3FbPtp^evK-&u;VPVr6O)u~n!hL`Ke7s;R3krCW z``)XMNj1?~KC)tW*B!Z#W3JFEH9EG*!bUy)nK$x}0_V0uv&adq_jJ0#c`o{rU3qTn zuo|2|avn1;+ukCmGtfCJfzLtY5yfHr`wl=c#8!kbAL6PrCOW+X?x|6)l;mjAbh$ap-27(KS zTo3gNvI)vl0&Mf9dIX`ZT!?gf*j+H-3+b!d+LZsYfvK0>{xBv0A*~R&hN_M|Cw;Yj zE*HLXf$9DWQ)Y&izmF<-R*!uV+45kYCq51#yI;Yne|bssK@$EZ;TgP)uyZzwX-(G?N8jD`9C>Gz9$9vG_(Ix(!V{nc$9qU`Z){g z7iO`}ME=#6r-o{PI3Bpm(!y<#6&UUI|Ei#!!$Uw6M=nl(CN{B$rQ%HwAJUDDIEoLx zDOIp}o;6)?FjK>NC{vdB=W6cEQUQQ5=6@;ftQQGK_zexX0N3DMS^sq{02Ke<1j4go z>Zbq=lnYz~r!TCN`kSt3H3@EQ0qG)zh=Hv=AAH?L*clMv3D4-^kM#KTPJttKl!FYT z;-V$*#p`bdXe#B*f%#}s=K1)vF;joL6psJNVP~$CNj~<|54}QuzIY40xx~l)5W8X? z$q(e+eS$775O?;abE7l>daT7Xcb%S}>ioLZ~a zTG-CDGF}?2{*?whmvVZk0DM=eE6*@7UC3j2SU;pE8`X3a3D!>FJU*4RGg)f+^`!CS z9vi_i8vk%Sw+f98#d2ZpRq zpVLWKH*9z}WV%qdD;tC5c^A6Vd>KpJI@gGQ!)2!@uet5o4l!%W?`)Dfce@6$yM`;9I!*jo98O`TcT`(qD`KA7*xb4sGuc}8RUICRo zWUlf6gIOU{1>qpu{xeA@u_tl{^A|1yl4NH!Jk8?sIJ2gll9hhO-Z|g==wikGTB^hQ zUz784FSi-YhN3%-oi^vWK{_i@Gh4H_n9MHMI>pd$39{F9r}smmG>gi&SK@6ngz4txnN+Z ztvuJpd+yF#!{~Jes-?@(t$*zA^tDz|B~CY{z3SV$4F~iPh{D8Kc^pNYpvf!e6~VCf zPq`BX^CMk@KU|4KbYr;v_r8u)Rgc~z_}SquJa{%!W)>{!)i@ITIF9msL(+ksqGl!@L0BdN6>&B#)zSS6$rg5zG$CCA-UnVR1LmZE)dUP6<2> zAgP1Y;OD#Pd*3#=8QTPUFFcs!|lG^Ph{DlcV8=eHaipPD*J+Ut(&X zX!vEl%jUHA>4%|$?OD`h`vF^UYEBqVtFMpbE(<8g+lhMm3nN2uAu=oz1l-0&l-C;R zsJLG+j)s2Ugv&=?W_#7A?-n&EJZtOs_nBD!qrNHvJp~{r=e1S zHT(Q65#M>E*CA31@Q@mbP?E)I<0@x1=0M_r>R(<*61$r(7 ziMFNs27vY44SFtSDpevkbQdDzkhub-Bft~%Xjx$=)rTcWN1#4=_q2kDe|N~4*u znv8ykFC`;ud?$OH*Wb*0`1k|xx#cwM18g&)@%Cu`_ePLOX>dgexxYtvU!oN>OLD+`3bLRtQ8~ z#5Y{C1(F!SqOz4Cdg|-CUKItZ>o#N__%Z^8cmF6-K$N+ii&i3Fa=S~E-F6lJ*JyLP z5#_ek!iY#eAidgx3IN)cV|RIl{jvlsgP`MDU-Ex}~a*?Pt_AkIgA1OA5`5FfNW9b2v+Kc*_rA?>)FV{pPF3J>K!dtgUk$ zWx9ks<(*BAG${4D-oW+4ytH8g%l4|=39(Q-u;gGrOlhalzW^}Y?Zs+_Y zGx_O=OYfb*gm@Z3?KSpkQ9>D0kSGkDoSbfG)!<$qF4e7%$F$2D_^`WNrng<7Fg+5Q z_~bVA@7_n#!!abL6}oKi1mpUr&K+VU`PF24OEU^p?|l{saB_L+5tR#YA7&uj#S8IB zIU5dLL0W}6iChCLRCkrDqsYm|6DTwvAsBqPH7B%Ddl77bAmH9${?~!iEd$rSxx3qF zAu3474+0@b{a~J&^yduGk5~>B(F13nL)3GG>mtE9U`ou6lpSfW2}76FOX%ppxU86! zqlUc=!xg_F0JLOWJ^Xo)vVADFD?T?${%Q_A?ipGj&NGj#;_@uy?%0`*7w3gU#^P1x zW8W96Uu8f0Hu=^3vr3eY&mUGxOUqbZ>|_qQc$bdY-?`G1SFcK`*06`Wt}RLJe_GQ| zl+lqddVitpAz7J8dx-0rVdK8&wDwA{iXp+)le)36r(T{ZQe{+xg!YY!Nk$#9jWEmR zpOL``y9s_2yVcsoW%$gB769S1Wl-WKS6It}s{O9+cDMbLiLn}KwJ9iH@ z$pujd8?7%kkH1$(r`W!sA&WI0Z6B@?)!6Lns(b(P4E|t9iuc~{bPtr{7w1@PT9>J;DJ0WFBPTxMDZp6cGIcjieZ6tj<82DFF8zr@!<>0g~J0 z;Bh&DA?AF#JJ2RvSWQ#t*Ssse@Gl#M2{-0z{Y5mIXvbvaMzOr+*0;8MlonrJ%t%~1 za((XPcKu`8c=_Rjbj1udI>r^cyO|%HwJjFJtZ!goE^=?NPJv9Ka;u&tzw#$SiQ#}Y zcZvvdS{AAzk?VEOb60d%v*%eVJi#A_Ww*z=d**0`!zK+^|4X5&{i|;$rPUF7f4sAP{5t3vBL$%(5$qv zvGGN`_m|lSI*#0B)DN}=Ij_a6ssQ)aW<$P%ZI7)?NO(s_f@h+D%n(}A!iJdon>Zb23QZb zuMVt4d6?YEPrinYjWiPCD(!An@!2E&=H}+iEls_sd+N%`HehYcfRaKX>Jbl$NfvHB zyn%0%inp@*DJWR02buB$AkgG>^Wa>)ItXKPW#hx7?Ck82?Td+d1@Iv>DoS2%k2IFY z8yc(E}zqcSoXFSUoy`*8vO2P3fItGD)$cF5 zv{$!rnCc$-mQh7c6XdP=`A7yT{-@W$v?iq7DFh=WtzY0fqtUk#jwenk-HJN(L&M{6 zNU-y@lR^ZN|6I)xm$bTZ=#2h6C{++KSa6G2>B|F{Y9)$dqysm)lkyQ1{X7+5^tXuB z`CMkPznNq-x3#5YmPdn2`#aM_vE9(o>Y>TAEA%|%r8mhjF)=?6n!%ePJ+Qoduy5=J z{x|CfVIg2FqZS<8YXD6(Knz5UKo{(Rm*mAm?bmrnYr!Nj?mxLK!$1I{ShAMt;E;Yw z!G^}Pu3+4U&!2UQBjS%wSKde$Hvad1Fer<}xIi0#y5m!)bLZZ@Ko~-Wm_SzXD{uqI z7Ut(AAS4Zm3t(fAO6G{`SQ)RN@*WEsvuIkgnkQ`pG>&9@3Gk7o03|+b6P(k_T1;(eF zIQ>7}Bt(V7Lght*Dk>_Zry(s%gnYfwiCZf4bS*86i;i7YvxGw%*w{afxiyO_t5PpX zYZ2*EmmJVoV1Op{fCxzui@o`mbXTz1dS+3x&9)_d&8aWTeMtXO?ce!ND!I?)42Z2p zD63$$FDq0PW(*(H#63V}&-;=K3VbTC#`e!w#vGkq8XTQ(?#DcfdB&)7^~Qypwb(c} zZ?T-%jTsn-KYWN?{^PEA!_TWeYk4}aE|JsRNV~*}%`}Je<0=ztxj&P*iQk8ZFYk~@ zVP9#{S1{^a53ZGzVM^z~5Mj?pNAoW@C)y_Ys&MWLU8lWsNnHnEy+hs&7_ES(Ab!~!22h>R305I&kFb#Vn)h7r#jr2 zEM}lZ!M_fm;2}Y&TM75zQBEcBuPZTsg6?$R{phJjK+^xo0_@!F%gutrjZijZyaj>? zmy5k&xA!Hbq4H=cd(?hF6I@_#WWXE@ z&Ms$&G(s?15=3wk=;_pPFstHV3UIzNLA~CQoyI=llNsF3m)&b)t{eFi8vzDC>mNIBM-Us| zqEyNo(Ak(s%z55Fal1BX-BFoOOB1>F|IJ##q%_R&bwZ{UQEH*$1W@pY0qZV+;4TcF zg2xR}it3(HM8Mb37$x18gN)F1_+#+rw{i->+zbMf48rt}VE!!2K8eOgR{<&E3gREd zF$eEuP?=eAlA4U?m<9Rvna=~GOHGB!DBspnSf8{W?8CQ(#S0Mq;$8F#ZS zEQA9x@rEaI;04|}OsdsFNLFY;9Y(;xHgR6BYGoWE|788^4cVv7IJoTQG}$MmaD$ct zxIBO7`vHVTY<-Gg@Y&$?8Nw4lKcz2e=;C$9QX%A!4ree{#OQ&n*&p19x#pHe{e&_=-JsBAp^dSu+ zjK_4tOj~cFC_mQh0QlDBo4?4NA)$6xxCZjuC#R>vSDpcAfO(U-R)}%sKNjB2^wIe7 zzfWr;>R@KJN-S(|Nu8~Q_?TeqB7fq^ku+V+nF6{<{G*(jwzEOtFA^#$c^#cQ5H;JQ zlb`T7zK27^dguQAP{92Vp=xPqN!*5A0$Ec240GE*nJ?%-JqW`LqKnPe+FNXBY!=In7eY>)CAyjOX;ja? z5Wk1Q>96p5qFQLbN9@kufVrSKiiJ+sPoD)Hl;Zq+y@Ox1YF4=_Ge-j9-vaaWk?qkvrKgC_wK!Q>TVa^T3qoWU)yzrO9LflA&U z#~Ta>)E_xHD=TIfE?z`}LBRcJSy|f^OCb$UAz+6X*zlkV2=LD(d*6Ny*eQ_{nbU^> zKxDQRx+#1E^|bwmVr()JhKBRvLr>L2sNc@v9l73v4#)2a?!BW@{vc8^XN;T`Y|#2?62M|g#N#c(9#a?!@FNPjR@ zcdBx^Mk*9iHhzq9ttz^Hp_hx($7Jw#xK(^ha{W`GE`Q1)q0{|tt!EN|{l&l%0SBg* z;~F$(B<2X#qsV%pPjlK+TjcGsbQ|=7@rm>^I7ErPd@bpsq`Bo7g=yatXUJUq!oeOl zDA9egn^^P5r7~i1xP%3{lQ0*K6dK5LM1u-}j6vr&(9%Q^U562uQ2*9LiXwXjiC>Qd zCWbN19u2;G?5Q~RwUXk5Y0AIr{0V&d5~36zNzJs|$V8B-=^#gJNw&((X`|;M?w86& z?E3}QdTz!y;Sy+yet^HYONt*V9r_?rU%obU&%m0H4Ur)?2ZUvJ2Az&r8(5bcdIB-%Udq`D3xAaO$vg_DCGGb zFgP>E69mf#3n=|05O2t)V$5vpM+8IxA)WuW&or&Py!m>eiSjyFIkkBE6GTFvha!=i?+D$VdliGQyw|(>_0z zyz&e694Mx{cVC0?1rrhNis|L$(csyFY^Bmm4gDtGaYV#D0fWGkj-&jxhsRmsjN&@; z@pMN_RaB3jNwoN@512#fv%R`XUXgC-q&`kh1NU*XT~|vWLg=K$3mzMkFnP`klk4kU zeJa|4jazMVdU|>f^rgkb*vKqYn5)k)ZV?fM#Kp}xtFkJ~s4(w+xjgtdr9kc8XZ_Vw zZdZ9UrVhN6@WJ>KWEKSEi$kEFI57V5GHnjZG4_=!)F3E9LU|apu3B9Szrc;QHV4S zZKL0~LIM3B;+p>NGvQJ}EQdk=ywO6)$-&brgxbz-^V@uYhk@7_fBA&%BqL6qbn+^3R}|13pzyR0N}?GNU8hz-8xe9prB?kko@SB5#3o)Rx=& ziVz0AInPfPM3LUQ>VO1qkp;G~;Y2|ga5nZ$-eyA?gvep&<5kyb!s;oAMHC<@K``(q zSN@#Fx(UdM$aAS63Sc^x()=;!m$w;ACxJi*v-FgJN#|flSuc&nTocL{@<=Gy;vWIv zgaHldw?iHYRnpnilvL5=`5u4t14E!*!Qn`AXXjL2O;uw8o_umsEpfpimQJDSRKuk` zs1{vykc9tAlLCG~cK&ranSlH}*eb{)V<72)hD-v+-;pwQSV8?5L=y65pco6~3^!dulLs>9n0_91h7hFi?m+w%$p?LVo(Ho`KMUK~Dso2WTNz{0 zee0+0u(IZiZuV-P!}Nk`ZogDlQ)6Qx3`5%fXljjL7EU-h^wDTFrKdhDfw=j#`VAQ~ zQGP>3aCYA<+>Ik3y}eSuIrD#`?Y-l4MkCjjOO$~EM`1n7JoOHqgfkID8ciLk$yAJ%Rq_|+pv??NMiZ0!HPW%5Ut3u{k7Nc! zPZ8jgsTMk4-tn0e^3~z8QA08F_5|Q$xP)jRNG8S=Cg+_vM%7>A zrcylD<=@WR%Zz(!midfP!e_!yi`FSjvskL_``7XA@}INqN@lEM{P{DFdSfyeuHU&6 zwt{Xryy%ge_IdPsA{^n!zUsbWZ@(9ci-F7$pDxJ9B(dl}KNcwwT4w?XwnO>^J)HW$ z6k)8%hu)A_PX$hngw!V2^+9IjP>Y&Z6q>rB0OP8+O!&93o3RI#*t9wo4}Kn+NMbch zy#e>xeSd$LVjSkj`|1iI4`kk>chqediZFegoEBWhWHnJ5p|ORP7#0@9s%Z2#Dvs@a zQZh|LlDwdOrrfb($3*G)7OS1gYW$?X#ia~*u+A?yKH&AusLS*G9+#r~kDk$6C))7k zkw}@k(wP3~m}?shj43^QGHM?5KUa>p;Ds{?;JM>SDfMuU!nR8q>u;2rM+Pp_gpuPT z9=#)oNZdm&dx(n`H{}=r^`d*54KLRT z(2~G6Xbig>GDKnF1l1u3V&m0`N3F&qFM~97KwHAr@xklsx}4BFE0bO3nM2g5EncCY zLRYK=s1UBSPkbr$O3!BCza@(>CUcl<0$a9h8ALdnUB5B($E25(cAC1FP=nJ?95BY% zZx&poYOqssK5WO(V-tZH9AG)!p|bq?3%yrb)Kr*Z0H<~O%mJ5}0_>Gtibx1Vs*w2Z z>fW|(Us~6E@D|D{S?c^RE^3HObo9%aJbnthaE#0=7gC{tbgT3k=xx81d)L2A~ zZ}{965!1!&3(Cd6$x8?bG8lphFe9VrHOW2=#9TXf?5)sDFy?c6xcEOu^i#)oCiQ2)D zkvy{$hZY5sYV`R(p&y1yklFnJ+zU8k^dRYOTzyiuhhkBq3%&aL(@pyyWRH}j%oK)D zKk^fWOi;mNb@kU+?L*JGO3poyyfU!~zP-yeQzAi=?G~jSbdv@d{;&?tnBEwSe0F++ zH}?8HkoUpZ=&Q|)J&+m=xCM_bfKSV6RONiNg8RIYKy9qraLV2^F4bne<`m<>7x1{48atJ&B(;m5C4k>%X^`5R*UVctllUvbYzKZZ%fyB$tPdsfg!5g zf9#q(7XMYVZD4CJ=YDN%N;kJ

6BEnJUlTmU>OOm7k_SwI+bAVZ}?khp)P;5Y&-* zU_s+&x>M|?Y6$(S6{+uqy?QNZST{%?J`veFIFh2BMBT=^&aHc*rtT{mKexqq(BWvj z&O5&&*^@W!$kvPJozh0LRn7~IP@XfNqmAIEN%(f`nk=JP#;n54n+M-sc|suJtNrRI zSOrcpRtghQGz5|AD3GeMeQ`cnU{kGxh07#mE7$O)#oO(**pv7tnQ|B2UVr~=^AUv` z?`K_{ZhR?ue5zIQ_%So;g0yK%-S;g;QNu}a&A{~Yx@#1wM z_^DfMnHbxZWlu>NnY3%G<>uzbP1+1oRQ7$i64=bc_o4B%?p;l2EdFXXcs4Wm?OO~o z5lPi}ncDC&FqD^%?_&r5`zslWlE*DG78 z1hY4^r4*a??Ry*%YJVG|pL0f{aL7XQzDN7RQY2P6e@}*o6xA9GMk`R zy(9oGDj*L*B;gAW1jU!toEhqLs^OTl~d$>ma^!{l1^W(@nZVL+>qaXrC|HyZ=gt;5%t%vkm7sb69-& zfIb6{y2wne5aAE$=}lKxnoR5 z-mSaRVw)EC*z8^QUJ5kp>*YsnFO`>;5-|wElKcVnQ4-T)`6Thy!&*V23t)mgh%y&s zBz(>J%EXHh-SASz)2C0>>j)L1-QbTF)v#fkC)z*BC`@R`soL7%Y z&pY>SbnHoa^Xr3QH|79?xy?j)iQM~`)- z=bIPcW)fcqXIqlBNu61We@Mt@bPh<){e>JYq>5eJmX!h^t-1N)E5)!fTzz=CfjGn> z`IdYW$iNY{mtR=OxNaQ@p+p`eEcDj_$rBfG`J{g_RW3d{@g8BT!PC%w$CTBb2r)?lOP0g-cq>oL!4C3>5 zK7an~J=g07az;l-CzGUYhY%+{G1g_O^I|KiVyv~UzGo@6`tn-~=h4R^Gd8WOhi&N?V|E{v9aw%bU9dra+F+@0_Z6KT8y=olkmL*g*>6bS2~gmDVYNFHX|@>+!6|2W z{{fyKvo+#UqFJm#o_l&O_nD%O|NUgRX*gJam9cj7$24=k!!-_yTQ)z4ztxfdg+C{D z+d8IBMi!RaIecrJMTC2FzGA~6EGbHVL0T$o;#1=TiU=&oWPj}WjdF3fdksZNe&N7V zhz=4|sP`W`wqkmGz_2>RY#nEl;#_&t88w;M#Cw02a}yKlAubPMQd?KzW48k}d*PEV z<}!i;CWHoQt3Ue2Rz^y7w719FjTlf6cEY;&i9u_f9ur1W6$D z)m)l@{{pn(9|U-z1VIXH@t$4p&P!%p*3H)n6gcqvbQ0Y872ZvO_m|0}`0`Y)A1%vWi`^Cso$#5LOnpWj9O3Yh+9O|Nnpt-K1~ z2Vf1aYcnTaa$usTcWBQn3U+a|{;5!pjahEb9#Rpo{n#~e{)GE@&JF(Rlw1l$9i>yJ_Rms} z+O@cC0KfHJC3(#D2YQ>pg|dXF$3>BC^$~@aT^y+c;uLe&G20coBg<)N-`dgwQ)z{-`4u*bddos~61)JF zY64J$ruy&j>>ya)I!SlmSu9MKi9Aj;%v5K@hyT(7T)p(J6ab8%YOi2eDD&_M=q_E930J5%ZF@H{R15RF-Ow_17lu{I-$NE5joToK_5oZQ=eUpMQd)6L8{iQ5Y^ zrqt1aLR$JX^;_T0{;u9;#lBa~y%$ayThq%-ow{4b?d9dQbG&p8r;S~!*LI_t_?KNj zkO51eG9;|3zceMG_28x{0JZ!CRDdFf^52)8sS$HHqDY)RLNaiTiPIB-!YMPa9s;f* zZbgv0$OUHDu;BG8`HRVk-|hh*D!0ns&gkE| zR&;v`hh^H#gjKoL@&wLK_jA^~-{9=t3BlI)^ODd#Aa>xzr_r3L9$o@Az=`jR_^#C+ zdH&50UlkYmad!hM!%A32q~Bd2Sh@gOjnS6aL!+7obvLDCaV{*C#Nk%H)7`&14d)Qj zJ_TVTAeK{znb)$iI@H?#qeKJA+kxK~uIc)$`3w}kb zB}=@n{Nmq;xV3%x;WAOeCo{a^^46w2A#kGJ%pb)-WxPHwe@i|!jG5i$A`ye)PYqu7C=&!Fel-?cp+3d2N9Qe3qTz`*2R~{pkZ*5I+PFRg(4BuVn5;y5Px)Q z88x*PGFRg9tXi9Jqg_Ly5HYi+d4Rqkeq+U1>&cB2R|Xn2iaoy>_YimF8~3NV%csVD z-#0}tjpc6g=|~$KPq^nCdzt^}={Ky5jKNtC_fK1<+gw`~nUq?Q+!#8`pU1ILtvfB@ z(H}UQ0!jyj(}W;->kCx0Rvpe+$}`0;!uN#^+#taOf?PqNOgzal-2vHNZe5dU zGql%N&eMB-TO`%r?no|X687qTKWx4_;Zh8hhmh}JEXDAXt?Sl3xR^5e;G_x7b5{L0 zQ_&x@R*H3vdA`!JS+VwKZxiWt2Z)0ce}pkUP$CW7v002p`p=dAacG>e-m#j`s>NU; zK)Lkv9i+ODM8^JlByCK!)B_3`o=`W!c5^CW>z`_hlt z&1kBnpeWjeetYC|*MyA(fqvo532pR-$2y=lkOHN6hh|vq_nKO<1}RAH3rA)y%eeYG zI{vm)?Ag1x_Mcyh?*4G=s`XKs#(U4kf9usGdZjY?;1)Ph~}gWEM|g4Kgbs?zPZKJ%_qqYDACBw}99m z1$1EtPhGtrH@7R)>SBU|QZVix+_Pk`OJ@Gj{B+KIUY~84$Sbhspc;uD=y%BFrtH}} zmgu12ra2#72HKYJY)4O=knEinMxN3fvIMN)MmlHTXp+==WgqOvz1_%v3$@$c)pOYt z?T2nk9bn|K`aH~*fRNQE;&Y8NHP?ofFF&KgI=hZ}&4;O+YCibLwQEk7DYbtrS+av?$BWlr4xD!8D4S7tuQy(6 zq>%>`clfdJUP0Pb?x*)2)gIl>K!kmgN}JQ2 z6MrQYB)Ut#{6^kPfM0R>qxH{w(!5N6y|R39V8s0;n`Gt#DVZpqNIkWQi)GcR^)D|T zywd)pF`Mp9`2Wz_h#X%i(V3W-HViuTc(m^uV`Q)JJa?Cc;o_=@*c~33GkNV2KCyGb zv+IJ|bweh~g&RN=OKaM%^DbzfyD@Gzz4wJr541?cC52nc?0y3WB4i>F;8%f;zmQwR z61b?SytUV`R4`wcEIcsGMk8f?Xvq?mHEX^+eHUw(C(F2FI$1(MAXeSsmGQasxBlvn zqyO%0Or9*()Wf4AhTYFiADZC~oB-r#nbx51a494{^MUc>hu4=;c~=F2{aRTPm)>Bu zYrXgVwG3%5{xoj%opbw7pQe0Om)~dGW|c;!484BsiAXhdGtp?J4Nz*tod-J&z#Sm7 ztdS8jpekx?qAps9H`g_lc7WwC!=c_M{Xerra8 zc|&~Q)eXD!rjw)E4LP|tz2oSMPQN|9meDxu%iOy@7WW%<9nmjeAC~RmSopdkxgAzR zALMr@OqI|*yh@uN(Z#sbLnQaJ_^0pYIeK+Jx+Z2v*(VEsZXX=2n!)HT|HY3&ojF)h z@@}?!)2OEEL0A5(4C^ykx%ZTea2qBmTW+2DpGp9Lm_|H}1Vmf^6T8UV74B zi)1;;f$H^st9%#vsh#uJRx>cr#ZH9GI!FucxjEBTh^{;Q{@HXBB^+%i2nI7bAO|L8 zA>g#%Y!|ZZMKGSL1IHiL#e7eOe=3g4W*t5we}gD!OdC-y67?`NRl^@y%>h~4jg*RF zgi5&K!)l;_$YQ60Hy%^G@D8!M)(4t1Fcm zn3;?4|0Q4y%HAM=ke^p2n&ew{L^ps}RjfeKdlOP#uq&aOLAWemkpL_`(M*L%Rj|?* z!2pMj{K2Q0qOY1{Y}ch<%^zH%oa5|72F0K#xX?0(5|T3YS9}SXibWvIzFH=V$f{4E zoeME1%B4+WJJ;D~iz-l-FDbiSTsl>wv$D3&QAVihuiC+5F+7@KF3|rdPK1NxFp_{# z0$QN0xRqwzRe@N3tBw2IAJ_BB~Zd51ZA(r5gU6oP% z8n|jOWwQD_Eu3bf@2+&%W~3o~^%%4dLHEd3|Ky2AbR!wpm8hSjR+1%MHyBSzMICTK zKXQ+>bdF=YCn+ka#Log-M>wf?-y{?fA#n{*_d|_EhVMyA@gmOgA`~`;SvgJiT__gKESJ~d%=0u=Ff_(LO|$=fQNA`=?^RFX4A0=HLs zn`~VVIS!0+g%Fyd84hjxSLL?jb(xw3OX-4zvabl`s+5%Q|ELT%yj=ZP`R9)6r3pKM zN#O+qx#32XO{mMhRaih|L~;uYJqUNzSC<@jvE`t&y)IWxVf-5vnUJx*+L0K;(3bO` zm@9l>_L|9aiH(s0ei6o*gx2JGRLB1svKTHK5vmD;71omo)@yVZx6n@K2s zmsd_{7{NL^PX^z=+HQE0Rk*#`FI-ai_kob@?x$h=@!tj&kwN*E8Eh;h@mY0+yevP* z0v=h$jVwDN5PU3bcC_)U>r$=n_wI13O3wPaT$4!L_Yyli$$V>*}V_j{YKXPY+ME_!(= zX9%qK+fBQ~9^wIHF;98=+B3HKDT}#^?2Bln#X>dFsP-YLQVhNenwZQwQY~MZSo!?T zgSQ*}!Y=N(lqo7v!~xy@SsfbllNQPn8Zxi zS{|m^VUe5T|Gtm9lCGrDeWvZp+e0tUzO6l^bl)X_YTnK(ahxW>u#sve_Tr8sDUR2> zd7_mZY~If?mHUMaMWy7e@f+FiUrVaMmc(PXVq|_hGdG4U51yy;sBAH!{>{070+PoJaS!2NDTI+5UxR zzRKdG_PON!KgUzz^|qKw)Q_I8iK~2loc`Dwp;an=uJ$Un%V;Uy&21Jw`jh74%UMHd znKp@)zAx+~Xc@%4<)lU!WLV<+CY$ByWQH$a}Ar)1%RucSD|pwes_Ejrk0v z-X0d4soJ%2b;Oe9rl%WEi>`iOs7c@au4_EznveaE3)l8hnRWURZTveo2}cY0RZBG= z3)qwMsBkDTiGq1OZ%fqtiLCDpl9m}Ot&YxLt~c(@kY6blKcvA%lYG;-m6h#4I~`S= z8zxfBXWrp<5@KE-e>Hm3uiG-Gax?~-#yW2o***JngZnv^-oG7hnWobpInwWv{_96w zTl4hYFP-)ihjiR{p7E}>9yQO*);@3i+v7Cb#1%GY?Yqm38@;})pQraWzaDX7%CK#@ z=k4v$O~L}Z#OR$1CbExBvK5*EMa-7}rEDl-RIK`pBn zOa`Yasbp5yD{Neq1dvofmpFR1dHAY+7?-(fO!d%)yXWqj4dJ3)%{f=G7*63ES z`(ErhmmOE>=40jB4IQt3AKC6UAI*wyLvh}b>UC4LZ$!{X;RcFS?-9z_sbxBmE_P`T zds2GsYNr-nSR(CR-gT{h-k#$hT&~g-X3xGpJ`nDC&0}%LYDtvZ!fxjFX#UpsYS$_? z+jpZj0wcyh2d9tMy**Cv<)OVfwR?1_Xcos+FaNChIhw+8$JOgOFSnd5S8K@8ywhc8 z*~qZc_f_10zstEDhUvF=@)wD>P5RFqWDS()(xuNkdyVaS^ADeZb`HI!ctZjCl`C#% zxnlu-*!^xuylS^}=#41ng6ViHr62G04YRZu-bgI&JbA_rN6mhn8xyOFn*GEPak}bk zvU6!G>;9t&y*u`W9NIu2Kgj#PRme(8xBaej2i#eK^88C`L0cB0PZLgx=Mi7h*id=@I) z!KE3oa4=O_SUo&@a^^zd*<|wlTxyta$B#QmI|jA0Z!;Y4T3T==*I9MdJLemEW}#Zi z8&)<;Ci-);Duzw|U=c3t;mr4oY04AU*j_6s+bKFy);*K9LoD9==4UCuRu80}Z+%tg zX6Lg)w#KQZxPE4C_qffq?b!Ps4kk-c492;gvd|Ny=&!hG?Q>GLZ1*CWk{9JfVo4!9pF+nXt zHVMPaDMMj%@BK~=4CUR_rZ_+A`l(bxylygK&pSOcd*9Z~JUjurq@9K5+WbNMvhi5A zW`DHMYs=6d*ME%Hcv{?7-om<$a{qb94HYVq<)L=;Ykmw~4P7z8rIf;qOp*;wS_V)h zqQdMtrG!)B$|67g>cbH0Hob2@ZRVU$vOIgXS){h}n0Q*DouzVz{KRd~kjR+1#zD5@ zc43RFvAHXZK32Q(y_#{xv2b@XW+_d05rMcVzEL!+o;gb?>tK-o6YI(PUG=kM2z z{tmp9EObQng~EdMU1=5EPlF?ojz?@!8Wc$l;BfwSY>~V?koWU-WvCD>m9unA3lcU| z|NL>~4`v0?S0(wkV#*zk0tmQ2wt!JDOG}%aIPWw#x^sRoZt7le@1X59{H^=KCp9^6 z{^+KRu@^12L0TG3I)X+vcFHjYTe*~~jW|&!q`eL?BmaF9yimd7sQWjHx&IYY`!|e1 z_EY@)%M1CYP_4mx-J2ZaDgj)ei4p}Zg{6V!!V>SK?zsLJ zMe}tRzpe?)0Nsxy4lSoqCS(_F0gZu^qHIR`Vqa=mWxmv>L9_xY40x{f@1LhZ(D4VY!pA_OY&Qm5 z0L(h8Acr=pxU{qbBA0vtS_-7|kp3s`e9v6iB*qU1A|c%h&F<;shwtm0PEV@iNj{sAc=_JBT`VWpcx<^}Y-y0~^19~L zF>Vj9XQAVDrBRQ1o!B+2Q_psaRNG`Vks%bg(`vp0kfZ{vfLU)lH2$CVfdC`T0zxw= z*8p@zyeaT#noStu0Z9z8Ljwv17)Zul01@AJ|1s7R>9;8`LKIjsv>bvIkOh&#owV~n zjDg93A_Z2oPi%@4ZdMF?LVm)EVb>84W%dzKwA!#3TQ^uPz7+FN{c(jK1V08c{~6-H3=_McWV7#2x+m+Kn4k zBU&)VnT%E<7GWUs0MsSQ-clglgV@)Il3PK6L~=t1KnyjP_XdY+Vnu-Y-3*ot1O*;3 zOb}Ss?60^bDlg$LEr7H(Ryj$AMH2$M*3a6c$nZWSfx)u10=AniKx_cw1Ho0+uHuH~ z4*#PvdB7P^KADI5EHktI^aD7G;Nc6j&i)z#4P-GmDYnssgoNUf5?z=!nWiRtwdOyS zJC7x>Q3Q>og;)(N*E55i2J`aF4mscZi69G=Z=P@4t@FaG(J)A$Ec!AF{T=p&@NN zlT1A{G&I&21%5>J%$We)!+A*RS;4q1)@9zAqR?ab=FLln`k>cSiH!#^g&6$(#E%{K zxB?_+=(W}rm^abdSI3 z#)(A-mp1pVlH#u{SRAHSjcbT&$6CQ~S4%P}HfhAL*;>~PrZIi66 zu3qgzuG&uAkrm{H@SH%Cx)QoFa$j(*Fy8?Jm*;Y`RaaJXDTywef;~@PH!rchv^h0s zzc*VE&+}d5Y6oFsD>M+gD6qfefo=BGCrskDjZdIk$8@7$>1K))^W%%IzFop z)yPpRvnz!$M9EMnGv|i~h737{kij|D%)(-ju1nae{ph(E&6BXZ16Ewc!NEZ;8JU=l zXf!BBK4XVeX`3_IgD0HTbb)Jko#tfTKfrOaXs3*uVYevrKK0zF@VkfRC+~c`OV{4{ zp`*m2XWhhfp4+PG`+l5C=M3JL^zES^U-7D%%J;jN53n^*UIkUQZBjIjY9+JWSOcN zdnK<_3zoTz?Dl!GtI&YACE`hG;&OZD6uES#cb-Ky`v@8%!y`IEd+cODQ2Qy9NqTD6 z74%JI%qKOYS09sYfADL@v~q8kllkruFG1j+ULXk4g<5(+Iye`Zn&yW!1IlsyULT zvZ^>kEmv8n%c|#uLDrNBC!1`=rIJC5t9ec3)y9IiJ?ncGKEpS^QUj{yZ;wv=+N+#3 zl^*&}yrHQBWd)fdrFA(081B<_!mk#j19n%pp68-6?UVVLiklAEFKtIaJeT7@N zWTY1^OUUQicUwD3U1KxsF7DucbM5QJr5Pj1`Up^za1IqU=Kw2%kR?im-kiOAO>6U^ zJv9ay^YRiTOn4a5w(v8gB`us7p8kPJt3L(=AF?|&eY|=X6?d$NY3Kb^7BycEDKf2_ zClHxS_d`OU*LW@8y4LSP@Ht|s!ut!a@#PLXz5W|z%KQt7Pkmqc2TODkE!*n3$d zS0jlW$(Y1QifxmeBanxIR&sxTk%DNoAjhD{&gvV4iwzo>6M?hr2tI@QZP-I*<_3v< zO`n6hgN)CTo}aNs`O~sP3l%2OGvPo;y3O|w)tZhl%cXBeP@lufhX{BIBz8i{ln473 z38nA-t}!i9R9@Z%9rQLnKDz6$a-!Pt&dJH)_Q6IL2NgdiNU6r@xK+-bPv!7gmO!jP1X*yYEJ0!P z-;1G3fljmVUg{xFb*5>4Rx7Z$$Oit!H?ha9hFTAkghx==CQNlU`1}wcxREN#-~X7R z;&u^{BsnKkXGe5M(kuoKEPSbWJ+JWjUK{(dU&ml~Ch~0rj6!{WCbdoV;K3yj7M|O~ zRY9@1di@*pK6bWwlot99f4{0*w$HVDc-gxqvr?W*)eQ1E&jNn`^sbh%ZFO#KQolQ~ z>@dBQds4T?54aRWPu*P0#N-w;kks`U=?!Zz0~D=QvqTCr|Bf9LU=1QZQFTGr*ffb; z0ma3>p~|NkVI-ttK{mXh+#EjU49#s?cIcR(=5%93szX@t+H!~?iTD{ge#lnCh(@-^O(-%t zz@Z>0^wgO%vZO~7x6*Tap$je_}cS372GYFjQU$2@2VT4M*NYPqITDEp;R014Tr?52mT-g@kZu$WTWM>7 zH+z@32`lUM;xj`x{G0lE<(yE-h?jXeR(mndXR%x3B7=w9BrTm?EB>f-s%T5asfBC& z;zp{I^-B31i+Ul}IlC=q1s|P27gYF34o@4>9j(-Hx7x7L4EEVZ{YMRP^&9aJU}!l> zb%MqYa#59*DS9%;%~yJA2h0W0%9qO?YN4*fo(QRzcyff(Xq5^?aUV}_7ZzTJx(`)l zoLbCQH&sW6P{n@uU@-PwB=HM8=X1 zl9Xs5t=l>}4ui$FBeApiciEFg}FjzH$Q(q0mG4%^2hXRTYbG%hMCzI+!_qt#+P;2?QY4r%<T%TflbD^!6`b%SeAZCnGF zzk;6rs*MrXFyCLl8Rpd9v!>q&R4fUFAVVKe^4DB8fP)G5qrB>wS5eBJgKf6XwW6`{ zE(qnf>Gz}7@ighZU28rdM{z!9L_qpY4z$4J6jA|gQ}yT6YzmP$@~BFob@-)Tn1o79 zwp!BV_fK!na$!#f3540Q8V`5L%p~(@<3mYQ=s1gWf>VR4%YU7 zA2=>IEdEweWu9x8@0S)M2EVB<8YI-~|KjZbk0Qce0IrRrQX0h>pWM8Ida90$7*Glu z|LRSA`1d<^bIwoQynnyKq!*jQFWYH)&2q6P#jyuwSvKusz=@Yk;?=%Y-o5X4u5{q} z*^%oez3ZBu(lhvR@-DoO0#2R5-xe{aIt}*f?tK)iX8Q01lS`j{YKE==vzb)@>a+C= zx5RR-|5w?%bEP}@60G>U))s8lpRjjmY3Y}d(NA~dH)9UK9xe)wfg4f5Al2zByV(zi&IRi}qG3ub~2vhE=UqiMI zh-i(GQR+5~vpOE*$VkXH&S*Qp3Y0w}DG0r`nwznMn*CJAXng!0SVdH`9mUb=nzI{j z;Szm*i`=vo^`9{&DfP-$-&fArj@ENrrfQ9c4bH7*uTA=>v$M1P(XQHMNt@b!i`G|t z^Nn;{@94zR(rNHKF)>r2ZQFmXU_xq2(SMZ!5{b-QkNy%HVaVR^_;}3t=$MTcd4-r6 zf&E3?-O6>gaw91tx9{NNjrgK;Cn#cj#Gdl6pL14Fo}5Wdaat1;)2=JPGHBi^&%Il5 zhQ+~pOntRxC`WtehVSAV(->iQZ|UvLtm7WXq(sd1c&TIuwJ}arv`qUUPsiJ9q?kZCC@&=s8B_?bg&On?}mtr0h&-o99Q>R!aCo3x%68LP3GZBklhBw2A3y71eptegXM(M65C3mAup02Bj=S+5+Jt zyS~U1EvKe%h@F8Pid!_3Ifw9Lxf8k?5*LUNRl@DQk2|eTdz5$(Tdk5}(8%zmv-8a@ zF8*4l&d2%I*N&bh;}-v0k@9^ODCGP_84SRL#0Iqha(wu)b+%y{!GIX4v34g3ICp!{$$^at^TWig+Lx30Mgd0_ z>X0#4U6>SZ0Fybh!vS`nYZ#07_AVdlOUR&r`}Xf(1;oMW^qT?2ODodMW8yW?PQsnB zl|=TC;W9}3*@nXi2UOIj$tEM`Q9EBuv>;Oxfwx(HBN@fmvokRaF6nXC-9|&d3yY?0 z`yR)E21n=L@)VcPu@)S5L;i6=R^q*knEvoL<@%q^_73k}I`~pW>vn@9&*;|#`9kWu zaWEP%X--d1`v(VKc=l`h>eO44vn_J7@8Eldq@}sL8>6;J2mqo8&KXrg5o4ko)ql#t z203V`Lk+Ql0;2;l2E5J|cMDY$lENi`1x_MGQ$s)N@#h%nfzt*CuecvgM&G-4Ppy1J zZXls3>fi!ICpBw3R;ivD;$3PMo|?++`qk4TLn5sINB$$J=@plC@{AI#8ugwVHcfX6 zT|VJ9CgtRB1?t#3=Ca7-D|h^+w`v1%L{$1k|JWp z4Jc0eBx zHu3U$BjAT6DePYgqv3R+&a2_l5L*lm4|DC@SsZr|rH57=9^;5o<@R&o-!M_;#f^ZB zw3Z9%3STDW0`xAVT@mrFXWTt>)!=e@6KjuIu0F1^#yM~^;0|<2xf_tGsQhXD$g9f z=GBigX5T#CU%UuSVCGour8^u_EQqAW;LTDpAQItbJpp#N>rH5({j+fp{$;vFNXQ?? zX;MURiIQn3h_QQ3zQSC=KgDqSR*CPGJ9&Ngh*BB$^S5cq7~ie_GIZtW)c#`6nWyjzSPwQI zC_G6GQ+qziqr7%4HS!Rn@tRsqi~f{%U~@Yn3&a-#@cmdewEyHj|^%n#-yiPvD$?5FTTU zOV3g?>r4BrsOOOJBd_~=gbsJy?XDR(y)Z6G{_6rpLuHKCKWA!IZgtY2U- zXwCQ2he+Dg?sRIb%w~5{pO6#};+J?S!{AqUqm20PzWL!r)b=c~82)BVD>rMh-cQ1N zt_p$^%bS5QnMY$n8`R+?E;2nrwiZvuE4}qzO!6C=e&@F%YIhSC*AnjnrDu|GQxtN# zkmiyC(IPN9a$zp({AAd?<)i8`4OjMB}8lkY)HgI1GQujYThrAD!U0v@)|??4yBk? zpEJWWdh_GzqL@8M#O$OE>Dj-4XQYT@h$aZf&uDsydvyW{elQ3|wN05jkFZM5{#Hgo z393d9Tn9lr5dgHnZID(Tt~N#VdjA$eafxb8KP>~PEOD2C5j&->{ux8xkUEA3?Iy9e z0dd7l^NkX=yGTa@UImj<9wPV*spSQLyf9|oFFanjOefTbjlHh(s z8aJm&liA?GNkk6Bj!C1WdI0B1s)sGqIM(%G zh6CXV!YB_?Z}w4;TYu1$x0bs^`jFrA{NSDsDIOiJuCA1D&TYh-5H|z|$Li~tH-hLV zM|{Srk87Bi4x@^pz=TZ#-uN&*gQU}ZWaaYZn)+o zX9&XL@-iMimU}@#DyFnpOi|wy&CH_Pz?1)HKnH~5B|3xcTxBnA;nB`t@#{C4Jo9L6^34=w=4Y1gJ#*ILxB&jW1%h0uONBpSA%5zL3hkbQJocD_a8OG zbrk6&N)Z$B`j0ML*tEM*S~(n`W=O`&Ge=;FcM!x)2K%DmI^IXt;K748+wM64!m>m4 zPf1eQ5u~wY-#(V>PVR+}0vwJzC>};Lx)Vn@mZk87*g*e;#1jd3fzBZ1kXrMe9#Qef&Nsgvq7hHh zLeCty&@*FO{wK`-h0m|OtnB?}U5Ru1>Kj&1r(Df~T1NRNKT*}%G#l*ox9(mkzkZHI zmoC)nG^1_s-Bm&SZJn>Q%7NQ|$$^xG%jU~VU7Cstp`x@aHE(9qAC+F|K0m7b?Xax# zokdXNeS_%*>#KF&$>!Id93e!|-2ZRH!ci(rC+d)ypY&ZgR67>VJ7Ws=ev^;#m4;BP zXt3Y*EaF?V?Nj}nvXF7t*KDnlnR|cQAf--&#ox0i>gYlROeMf_x4trpb?%Z1IOGE> ztwtV74ynNFnYvFH*X?%A!r+CO^BXfIyA7e=-ATmF&6V^ z*zpM6m6`2UB;jcX)3B#{Pp+~|=!@w4VL4L~!`L{j_$BMY)y|ogD9&FonVBKbBUJNj zp2Sex^Qjh_5p?tvc)8CoDsW@0B(5VXOZ^7_w8%G+J#y*x5&u<|MU&bD_6?r0{>!CPhyP0OZ-jS=Z=KV9<^*&E{ zBifphE2@mzXF{on6|_bX$)`U7;zkvsx&4>3R>S+*I|x3+5CD(QvSbq;^4G6-;GnyM zerES>Ut$m6+f>WB%&a=~@QcphE(rt}Itj!OnxQ3}u6{K2Szf<~^M3V}zg){3leND5 z`gOEJB~D#2!}*oUuX_wG0B&eQEQ$@wJQCHlVRu8SN)WQh0j~XZ0#oi+P*}ZavHtWG zVa&c-vpp&{VZTpWWPIe~N(v{t(u+_;E>e2_9&WpJWT!R`>#gaULtDSpop|<@Vt?54 zkCOHE-Y%W20xU5NKjUL#*JL#G{|x8H*hw-$7z}GCtVd*mlL0=DPcH_x6R$iZMd%dX z{>syd!!D4Eku;Q~!zAHSFo!H5@|OR^a4h@xGMLnsQB*v@b!uSRL6`bLCr&`GXbqI> zUSEwewd)Zs2(-r+yaa~r?!Xv5xQ|W*@1=8npS#;-Qa;pWZgQn5#u9tpzO4fiDj+bh zK_GjeTvawiF=dtswcGs`P3K!O7W6m9ZD^j_c+t2FUn;E$t9ONLsN`b1Z>Z@+->+lp zS@wZQH%0H!77%yn&>^oocl3ak%#5Yv6y)XQS(fVUAut87ltOH@HNeLK-7wW+o9D#2 zx!0^78JH`HE)1;6!6!JE5k60f5d>@yMLotV5K0S-3F5r*)x>{XPG;52;m4u8Q~4D! znd7e@ckr<^UzhTa{0_2{-`#si2@mcQh-BKjyH&#{vLy_`3olZ1xyvPg_Ma?SCGI#| z8SOLNLM=1Fb9eS-we-=Z3!QF;pSGd2S#~`oC8bhF%(8VUa$E4QsHE@xCke{GoayiC ziQ@|l_t~F_w)+rQd+)&mcNj18Jm_NtNQJo(2}vafW-*#7qr4 zPl_g9`W~=eT!mu7tu#!+6k-beEmI*`_-?&kA#>0cOQqUt8E<`f#o z*@#lyrQPOyt|C8f_p`KyyVmm)+fP`R{pczW>q60LhzJE7k3`*qatxd91KonQX+T6I zm_W;ARs`aan8c(vJWW{%XaB|>KBZ$miGEUb%=Da)IxTe`{r6etdJ_NGnE42sk$5Ls z^0Jk@Y|wh-Cm(B>n)!;69S=0`&9;vWQh|ZTDi*U^`|N zZh^Q1j|wo~?jI{{Q0kk=yz}@=7{YZfl8MME3r+8uU&-2Lwl1Yu4;z7)*>W&#UoSZ%%)D`|N`LrszpzO9S=H)*S-SP! zFB^5E|DkjN!>|XLbHq%A>w=j_ME3^q5snt>T<9rCbPBE##ZzSRl7Q_hpIID6z)uhh zDolZ>k!XwlcDZWv7uzfq{|yVI^3xE<;2mbcn}7tWd7K&2#0f5Oww`XbaO=OpCDL~4 z@|};pJ~`4=i4X{UxR1MChE|2nk5?~scCdZ1uZ~5lHM@PByr!%K3scD6e_7-sfVLHi=Hf6wWTz27%QtHRVLB4QF>Zr~G$&Ujlyj)h77GMM=MO5goV37BzhFKojAY?qZcH9H23bmD8F&Yw% z69Ras+cxA(9DZqN5fBvA^y>?T6)&n6!INx6i!3AcC%sesuk_CU zQ8aR;P7D9qz6g?6XnsE!Bvhr*hkq>s2MsBrm$EJ_+3btjY!B!($y7erxbi^tU24e2 z2gAH6NHV7c;8uj>iFJztDQXvs6C*~))dUzC;E>{H% zv|v2RUs0yIne*YACCs@7H+5f%n41eQQy`A^QtBqqY6lk27mWORnzs907N=&>YmK^I zl$S+MnhTfpkXi~T{b~Qu(WlBS$6VeC7-c| z_5j-%=D#f=4aI*kyLr+jt*~49m{12QOUPmDGSa1% zNzYB_!YO(oJo(?(GylEr0YZT@Ef#t3*>h8uplgKGU@Mx}AWeHOoS%Tjxdh|}3E zN{@@HDT0)2`74~izmq5*n`G+iU!h-@&8Mf>c$2SM?tA}Q+Ncu&L3QE|ukIvpIN2Gs zSbZN~!ELX_5|%S}B;pPyCR2dhLDhy9P(&o%DYn7P@SjixVa>Xue)sO}$3?|lDxYNV zE4wt(1CSvIslqjA578cKgPtRS5r|=cQd<^@`%on)JPP-m5nF`%7-vMfR=vs|cd!~R zXLQ))*V=jNHz%*5LSRLHQ@)2pw3SPkoUln1b^VNygyT|MUxRBj%f$KI|3(k)_C)-R z6zHQS-vYoG3QqA)=$;TePXX8r+Df5?P}k;@~5 zv{Yhr1k?A{)c-#N1NlSN_(fg~`YBB=L=9`bc?ZU-y`!T_doP#O_C`ur)zfBDc8@o zX}r_?|IuI0z&W?)yzu~Dr*H$bqdao;M&NzJz{3GjfaCAL2FIc8=fydJmqr2;&ed(a zyu3$&$Lj;nBmfR2F+kTsysQP@P{_R&JX#7o8?jjeIJPD!xwXc|x&U~n5wOqK4>~y$ zIKI}pdw2EPTfnPDa19&C=ln;lPC*A?Zk^W-JP}zEnE2kT<6E>aH7zad)^#o5GCx1y zunq7Ygs01Tft`W(z^j-*Hz>^gy`$!*5%45;K48;*U8xgrE#z*?U8Y`P?{tx;UsXId-fFc(`^J|3cv1k`j=y<#ym~ z#S~zJH_=3DxqQYuEz@@^>prb(R|2&qT`U-g4 zXR^^uV7q0ioZb!KN^ie;HYXdI*-xB2nFx$cV2S;t4?HBbgb%osFAg;L$nfpm-RRff zuHOcxU&H!;HB#nzZ@z$*O|U~2L?i$g@B#0;J8(4-Se1V(X#;u<2#Blwzylz7hF?aU bK{NleYY8~<<#2YrW&i?DS3j3^P6{3r0JrMhRC=%5pNfh~YrCf5eptrUPg9(zs3=+m@u##Ok31~l4JD>*ey5~Md1MV8 zZEYy#vA#h^b~ZLYhqjLK>Tv`gl6yOSrF)7lPY?YQ6{V~?^~jMTinRVRW!MW2M_;k^ zFtIS+R=F6aH_I=mBES!%X7}0NW)#!^d+P;o>xl^!BU!l*{()`%qfzy>4!W7LKf=?5 z7FJd=Zg+n1o8{+sc77;Yck%(xN-mzRsFpgEIb5ywqI*}PR@>5$CLjoTKvG0Rgy+Pe z!p>+6yA3W!bA)~3fJYLJJS3cxk)D}qXXB8+&V{@yd3S45)13^#_A_*H??=tTbP#9) zGwSys5ipcTnW9-eO_D|7!vFkDtY}P+I_IA|z*Rmm6jG*thZnfM2v&`u+s~(jW+Q*l z`u3Y7jJ4Fh?sQ)XCw)jJv+?llCLXv^Yj{U~dQ&4R2V;}YDOT82b!5+Nk_rcV5v;n2 z3S8-bX{abGy-<89QhhB@oj}ACy`sQa{r7I&Uw)?F?b?~{E-2v*2>v?^XF6*RxgTgB z_Q)R!U}=bam5r>GjJ`MZ?Co2M>|4PvQoFnGA0Y%_41y7UFHs?L)`s~KcghoelN)t9 zUaqsfJbmoO8~ufvz=U7JNCUgpa!<0_o5{OM$<6KV7Ki1+w9jkYCr_;HtX?G7kQG&0 zN)&wF#3Rv!XBg@ay6#y)I11IjR#!W}_oMW7YK`E6RCOj2*s|MsJ{k2uqd92_X0SRW zJc2`>Z3=RBal%9{VBWNxgi?fZ0v9o7XZPcYN%jtp7cPQ{u58a}N3Pv-@aDCK$Y)Wn z`EHpntM!_GN2=G7_I&2&%idj6V;({yr`Mctg+Un2lgGHu%qfK9zvz&yGBbQV>V3Gc z9gmJq&CmZuTw3~y3t`*a*9Vf3nA_uaz)ZipLNIP za>ly5zj^T0mbfA;DJiLNKh7lm5PC5GselmDczcdB<+!uzvW>;a#I%2Wp#K(;SXHaU z-rA^ls(Etl@LjE|65T8b4)3~Pn&P(ErsRC`WG`DWSbAq_?;ubLYsybllX6k_sfO$% zU#p|2KaE^8zgMFPVnxfmmPJ>=|Q3eEtpNqP>3RQD! zxwW(x@P4SX$2iSZK;tKCR+_u*43K+QZE)b?+;C~lGNxylEKfhQvhH-dG;n4xp!vrH zgK)HRRxGXX) zmFT`nmwS1JYsY+_fkC3>1d=yu@q&h?_ScEyiTUA)R+atbv)M#aVU3zzeI*ApDz^2w9Pe+k`zY39n7!nK3ch(R!=4@L<;5pf8Rl&I z`{|pRynVAJkuuW}bo^*>Nc@{8tsBXuTwLQ&MEC?3&$#WP-6O-VUO8%cu!alOawqtZ zCFZ*v`GeC13SsrS4?D5!F}${fkSwo({if*w+$ae_YQ7zZjPSS)>Qc}xyO~8+WFk4QpT^zDRqoq+QLhB!QY|Pto zt?tBu2c_wcUr3W_)a`5UD>FZ)@6$BuMtEKeiHoDlu;hp+-g~AWfaP_tF0GIGHy@iF_ z<;a?H_S0qkXgxKTqqb+XKMhwmqN)QVXEKw!<6<>V&!>e~HX)D9IKDv6$Oa z409afkzWtVQ`!m}Yc)-YOj}GbN~cxCcr>v4G@TM7BIF%*X9jYhP4PTWdVLFcoi1;E z53g)*`$Eb}O6ct_Q%|H)ITbOs;Yd43bL8YymJ}DiW`uHbirVrLKwYP7 z%=23PR`DjFhq|Ipm!?J&hm8hIt}D#0`^SQubOWe+Xyi9(BPJ77_Nd0j#*cdxG3 z$1~X>+}zyyhHLXloUUt~B~PXs+=)I9zcW;+cDM(JpLf*I?Or(A3kX1%y+!BOjbws1 zJ)CNksBU0yM%>*c)V1X69ecX_S6A?p3~!W@eqQ+@)@O4lT_!KYdLhIDU9EJ`oX7J6ZR--0 zbJ9(HedVpkjxZv;wNo$8QoCc-&9MS0Dp8t#Ki@m^ODhI{Za6KJlP>H{pSUr5bJ9q+ z4cF7_JjTDXKAc8mV!x~9>%l+k?JHVrH$r%_&HKxr{NCP?73T#P26@owzM+=w%BF%_ zUH$n<&j7^9wYgSUtEN>n$-Pa<78a?dM&-dN*OO?uhdF3NuyWveZ({*3b-Hde6}%a4 zVm^;=<5fhhZ5>Oii_JZ+I5PC6M!$2`8c()bn@v}EwRA|^Y=DU|@-W#xaP`fhe43jc z472q9fux%$Tb$!nvw&!bHOKN@=17J^)j*}a&Na~|gePiEspoP>p|SMPl5 z96a<@R4Emmad<`l37Kp8^pvcyZz6-7 z=)k0w2L(4(`Jg>^g~O3^ecN?AH8}g>r&QcV_FCGLlM`iC6}+1M>1lP}RwR&HOrbqo zdNq@$z+{sk`03AmN#u|FA1ExEWu}6}e0KilA)m|O*6u4-i1yzH5dHEq^&ax5cNJM!FY;9j z)%i{N-!72~`-=)=*u+4w7kv2t>j`BY9Pof@m*BjyLIu0$U}VBMUF`XGq&@np;=SxH zM?`P6=k6Tz0A|vh-pQVS)JqD}BdK{1_C3bP$z0FCCo7s}hNoV-<7DR}eGg5gjZIm{ zz!++VtWS8FZS@~Iu$V2(9ww_6v`_T}`eJRem<_%qCMFKb70ny@oobE>xtXp+#lQ%( z2`;VM95X3*V@L4bT&+Fg;NS>yw|&|dS1(^!!f&xmsOW;j4zF&R8^BjnBPvv{?)Djc zz3O&D#ksghz;9<&{m0VOv?ta;qC2B7%#&Yw=5KZPoXDP_(Al1!T9q)H95 zv*Y8F$zmgqocCYqEG%5rI11dxo#NfOxdF(!TBX4RO8_w|w9*}EWozHm)03AfMDMub zuIU~#R^0L4hZ6dvy+LY81Z!x+E?=`U@f_n>iOCL+FE-(4@eIN6sP?Z^66b4!IuK1GkMKYB?=SIND1`HnyFoc|Svd&4iSrvwB9 zj2b21ygaX^ru(?+`06)ipx-$PRGT$Cea4m5pa;PzX0sIuXWmYme{%a;_x1Ma7VkOn zFW)6kNjZ|(gb1Ib3e(d@LlyTbDk_3Vpt0p!oWE;D9eM1Hv=%R^ylIVo^DZ4E4D+8E zVT;Pd&$nMwz)P33WtT)S{Koz1M8l0hq@Q^Q%_31NJ zO8ZEQ9&F!tfn|1UKtmWzjfg*>P9)uhP_;X)n!SdE&k@L!;%h-D`a>Q24OgriSlSLZ zO^Yfz9kF`4x>zyXB#f?JrVKAE=7e-Lw2<70cF5AHBp$TUsJ-q@+cm!m`&hGz%%uD zNly1zKue&Rf&zX%WHwqj7gH2Z%@kbJaG4m?D_J&)8Its-E#g$*ZPqYecB#m-t?SdtTkf2fzW^AZ1U+_Eq~VChpbiPW(eHt3k8$KKFeT1}5({BU2 zt>1K7=Z}R@p>~6BQ&ZCjxXdU&4Gp!b*ZW3ii8k02Xqk2u^0|shOJ{c34lJ&2euKl| zpLTLaHovlv@`i+mQFFt9i3SdvK#qNHh*msa0|@~#8|#w`CX!h!>koR zzWJN#O|Am;54+2<)q|5AArTmL+AQh7`S(X0mUEi=bp&vDhRXm*?}25srB6BX+qXNX zx^qQ{#+#q=_89x=Ha0e`a|5A=8K z%@GH~;RKDlGogYh$r^EE-+~K@ZM!oI0Quab%la2557R-Q31>75V%gDy_amdV z+9$fuKI11^He(EMvP4WAZ)tkWR>u)pTc3MyFD)$|y06#N%|1Smw%C~}TXp;J5ai>z z)9R&9d!CpC!vaZ<<=$rx-$qh#mqzbL269mYiq>oX__6#lfX<@i-ebIIIKv_Oh8+*ch>tn)>&Gs#fn1r9^a`w3wdr7X>cp#6T3EBtpMI5}84HbA zeoEVB*b`$b?B`$(hHG#->+T!qdg)*;5d`w$n`Y6g;kCxHwT?^fxtLAoa<2CpNsLUk zu9p(F=5F!wog=WDx*~43Jx-BOV(ec-PiQdpWOp$oG58%x4Gn2FM{|NhLpjIv^l~&x zsgE~DQM7Lno_hl+o4~R$ynB=Qfuo zJA!%_&ST7-M1Ez42oFf^oXKsnWPt;wAAL1@C9K|oLDP<1a zUdM+@OeOw(CKGqRv zyJlNU=GVw_UqYfs7xC#?mdIQCuLB87TZl%(!wPdrLV?lj6ZF9SiS}S_hXcy`2bcit zgnu7=4Kl&#Pcr{aLp9mn9QMtZKnW`81paV@3ZCPo!%Zmh+0qNNfPmKa*gpY$xF&HZ#UwGK^9vkiZe zZZEmXqEFoPa@R(F()N_^Tg#@L-T|_mv*Gj<@pgcFk@Wy>{zns^$6g5)5 zf8){68_(f$Q|~%6#vk;YCnj3U<*|8eRBJ1xZlNZFoGZG|*H`@TzWJMLD;qmX)`OQ= znzN(F-9#XgMdOH6~{(bR=6O9YI_K~o0CJB=()@NtpB!u z??qwrB1#OG1*5rYc`FD(Z@%Qk$@Z7Vq@qt9$;b)#>Em)6ZU6m*6(9itvW2!i2@lRw z!u?oZlOk!%uhyPO!BcjPsE`G7P&{b3eKPh(i*MNX??zl%j28>8#M?U(Bor%F{LE6W znQod)fxk6D(tTr-%ANJM361a!C2s1Nipy2Vg;)Wl>DssMoucBiMzdM%qxz1HE-w$l z>_^RI2KunnisBb94_;pTVW)}XaaQDO$XUo}dJ@AYosY#DI26zRZ2#`=>|I`xX?y_` z7Q#CtC8gyQw6y-cy^@-iV<#mZrGRGS&&KhGAK5WQGi%+^?)>Z#*7-&x@yIl-iwe35 zg9VX6W0|HLt+=Uu_xwNP)>IE=8DKm(+RzwUKqGIZ0CFS-28Qj|uU;&b#oFWF-`VYs zm!!7fuB?kSa>Op1Q~%{fyy>Bzkd%h{e@|AzUHbuFdSjfrR2E+oBWV^El~0`TSj}J5 zr&?SL&ya!el6!tf_TW@I;OCDuK($&awm&$ruDzPcG>Pm^PivRAA>a)YYf4FN`HUX& zKI1;a`v)b~Xn#)1)~Yv8@Nhep`t@C5sZVUrsJOzHqJLKZ2)o>HD3v=1sw5!UQk!4O z&s~4y^JuX_{o9z$t}JVz0$=tU{NJ41unPQ;WAI|bZ>oI7UsU=tsAu)d-+UA)d z9zAja4R9eUHL6h)6d3)-@0WU+cTLOh8WN!laoVoevZ0t~1{`&vlehBehL;)Hn_Q_& z?joeEapt;V`pK&zvM%ra4wPAQWIC&)2xXymT*~;K7-A_O=d}x7ax?i^$FVc6%Q>Ac z{#3|Qsr8`1#y%h8<>LD3baQ%&x23j3^E+dBtITZZs$ui7;G627Hg?PFP2K7)F;WTT zK3~m9^kHlAcC?{X;bI`dHV;F`7L3vaqdD~_+N9h3VGe93viGbu#UJ$GWZ;HJV0|vg z2rK3y84BQjACj^`FdnSqg*u~T<`+uZ*52-WVZTKf6->a63s5v7PZOC=5xx2r&}$ox zCm2uwKG%<2=qKpU8)T?7^DP1*eeN<~pu9R$J21d8j5m(}M~^;FN)Ehgg5$7NglBm@ z#0u=J%!dU-%*@TnjB1hW`*lhp9Han?9R1)5))#`IUQ*tkuhlUL8DWq6w$GgmaUn2q zDjH_P=<1oSVZ*^3cV35`8PTH*38V6jGPexwG!aap9C=pL6LoAdUSD{3&`#rax_jK{ z(FQ>$D0S<2;|cA-goK+L(L4io zer@_;@T#XI^pVY0fg8q__CE}g_CFDI(>=9Xav1XZ%xO8*Z|Qjjx18X$3|)Y?%MfVZ z7CWJlH3(n{Xlb#jGRb8PXm5oiZOmpsp;=NoH_dHTHC2zs%WX?8i?ugcGo@oc^by_x zt1q>TXHv+{6pQ`u`w;A#V@`y$YZA)bKu`1|Vs4ipfRT%B_V4!g_70|JSnpiew_M~v z1(M&@^W>}ke3&8IwE=B1o7%@n6UBZdH-+xgoIU=Hml?c=))rmXE==vCmeeDcr5*>w z@9I_-=oby1rL`@L&%u#+?yjf0Jtrg?4MvV;VUU$34>(lg;1( zy0@yp{nH8+YOx{PbM>XELXUl3!}Z%oq`S(ecp{v=E@afZlT|(&q!@&1b-&FT*oht5 zXqs8Lv2b;Aa$0uX*yu%# ztDKmO%$g6i)cSY>iDn|HdO$$a+(41~l(eKI8-2wA4>M>R;u911dZRsgh=$fQG7?!i z>k`=Hg{owyyvTz0)GZ26pkSq^x|D(E>FW&rRbv@ErLQ(s;eA(U9p;2Cs@k3dRq&|| z9*?V~3LP`45b1&8#M4u@`MY{=pQ2=mZ5~s3GI)!hYZ1?CCRWwd?DefBJ;xIYwa{1} zD!_;>W5XunZjW1<)wyi9cXDwmc38@^G3R~r62vHo8$288D@Mkk5E9;>b{n#q?#Bwc zy1MHVr8KGqQJ>O86zrS?-&j#YWlPOT@VI#fH^AI{l<>VTnQH&a;awoLP$;#~09ndL zkg|1nPr$_bQFT2lw+o87sla#Qpf0MR9lbI_wew`=`SFl zj2hLsZzljVQh$hb?-y85C(BK~MQ70T)GCBQaogDFs{p;X*RU>xS4jgio z)X%DerEx|W==N;sE?DM?D$PLKWDbKd>2_xfkO%@iHNO*cXUhvrmt!*F7GEq(FPH?Y z>*^(#pkKeVh$N4B)z>qni3ZVHSFE@F%M0*PI)hbj=qH|ftp|y%E%c8GJ6V5>uXto! zdf)lpy=P1+-Jdyq)5g32pM26$@2+J|L=^WZb#Z5+)X%c2)# z3}=Hr=IL?9NM6x%lG_$-*}2$+h*X2YP06rfduJ`}k8FJNMmgFm5cZG?pU{HGg8rft zm5suSyDJj6Yk@am!oeb5Sy?mz0Vub{M6CJ`3)CtzWs>-DxPE^P3&*vx$~_vKVv=-j zl_kCRS&2+~VRMCcc6U9=^880yhjN)4ih#$ZR0BaCn24Z)%o3ks13C+p?B+Tfo6Fa% zoqb(vH=TZJ^sxxr3-ySz*ND&V>@}zmhTG{~Y$hL*-d$g$%G0CqxQ5{HC$?NUYkg|# z3kJp5>UgsJE>up-;skf5)=s2o>~NI#iF3`q-0jF?x2RBoYfKp#nTB}Y+VL~8XW<+0 zJ61nSb>DlEELFmuL?#bNsO(Ca*hHhqEAG9=haznYq3rdVp{f4+CZI4`U7mk>Mna;I zx#Q;M*3B2iD<)w)HYXD%Hytz*21}Y$R>S8`I~Fv0P8jS4ls#K1`d4AXM417R zo=C7aE-X{?AqE8>1%)Tc@z&7!aY+0d_smx0lZeA0@!Mv~gA88TaVpzb3RauBA>(yx zo$@702NAVlqwL3LiX5T^%oi$bKw#!7E-!zdA!~hkV!pkzb661g?OXFLxt6@}1|Fy0 zNX$gm`#z)KY8O1uxvyJS?(W=A+(!3ms^B>+EMw>eX*ESfdy`w@VcW#> zGBq{m+pUg9pw!8?B6<2xc_YedYI=HlUctdwqobqQBPPhW%S3DpXF(17iEpl;r^c%# zB_&52!+vyfnc4;h3PTG4xKBCt%F`z@+WL$N6iOd(jE*vD)wdTjpG|XfSWJj$S2ByV zDdve_F^+7y+22p#>*$|pB*eRI(G3GF;)mona-}e-3d^~EUPPUczCNY2v~=C^s2U~- zPg$za6A@bDb`!BuiNLrap0zX;M)f-H8zH~6u`O$R`-Q;j(wxOrn7kRF7BT`i-x2tX zsdMuw$mw*ruhTqUd1l-qlD6piT+)OCI8xq-1;P7{vco1MQSjK~#HIzR$^M)EAM{ti z7k@Dqb!`-$`2Ql__vxcTvNDYQL+izDWM9GwHXzE`Ox9L5?HS*AM@KpENKzjOPUG7~ z;zr_@skr3#V%)Nd=@9;AJ&vJkYTjPp`>-pfYtt1ZowZ~m&lRw5Eq}O|>2TdXKEC2n z9ZS8!fo5Hz{*XVw)C^h2?SI_x39i!2c@q*yRM1eUl>sVS+0d zliu!uP5dVMZImXc)*S=4_EUg96li3}-UR`~5b~eUXp$ zWs*a(_y!a!i@tM_I#Lfq)1-#KJ3$lIv|L8k%{Tve#)A3#t2|eFiafE00NxR)v_7zVRLIPH9tMwP|7NkJ<08KZ@`3CX zK0}>)K0Oa6IjIUYG=`F!?uWQV2ErhFTQPDu-TUQO5)K;BGto{>M%E|l8R9C;dMf#u zm=c_C<767iEe9RP{W|{k0*)Fr3 zbxd@?q*m&2Z_48)<1MkH=B@3zR;K$NIg;sC&R(C*g<=eC+-y~j8nL;Z9CIEKaK$uH z+=Pa%dVHgnlADilJG{PK=Um3Rz$ENGbIh`0q0jBLM*6)@TL1{|4YD)qemyhUJ~{f@ zzV^$=v&B@oBJLAZy_A{Nj!)5w$02{%Jm-$FljaaYH**Zpg4W`#&+_lrsZ7X zyX(smlP zCX5qtb~8zX(KahnhxfjD7$7F5UgHMjGeW|sW6bS#-?~}&V6l~~tlV=RqhuXoDS&hd z_-v|%%*%{sgKY5ytDK>gjvtD~N{zQTTmzQT>&7E%*0Y>v-gkAxYPXKg^oLpUW_2le+i$u+_`#?w}h?TKtXrl`ENlP4sFHox=cnUOLepAbl|6L$Q z!(l$tev9Sl1w@mKnj`_xJh!E$jVa!H*e>N#^veOr;cQ|jK@;)ob4m*VYq5aonB{W85XBv!pSO;T z_*nAawr0CK*K4RL7EOHyNoT+HN2EY;_~@Ma%5p&$u(fxF15lmqskYHi+L=*{jfRR& zPV#!!t9>XH0i8rR_vRON`)j07dW1#ZFKp~;TKt_I?X2)A$^JrxDu-j-2^AF)%kap^ zuH%>?bMiR$?;keTJ~;eK><^bVgW~x4ibEUo&iUM{eL3$ zia{>m`!t^2e&3LAOTkkgLU^aTH0Zy;`*VvP(2+9$gw|(Nu2zu=P#}Yub}75fLF|LD z@Mz$BnjUCKp1_d$MB9Dywm_BLL_0^Z)a^Ld?XuSP)KgE}WF-GfaJhX0E0Etyta~`_ z*4jJM{vC=V6wtHLQS2;n=6D=_9eL+^O_>jaV)69V+NOp|+Slz&YDRMvQYll4HV*AA zEnc2DWIFwRWZ&cCdjZfM1_ch;Asyo_<^eVfb$z}9wesc3f*8>KS!a-!*;Sgh3SlGIN9hdt9EQ9@nNH-Qo4u$C(2|_ac zcq9p)k=#W41^CqZ-lJZ|-W-iameo}hSB1{4A82SiVh)PW8rV0rjp=acalzT7O4O0P z-%rgaN|avNGVD{2OxIgG6nrfRW`g9z%Hu8;+FoxO#K&t`*`7vN4m?9%VGDGr@27*@ zQYPqK0ch#d(l03x+^i<$R1PQ7TwF@c?W5S`sv1Kn$ZEQH2im3YTW2}g-`x%1V#n*a z4=Ep$WpiG0az=Eb`|FSz!BJr2^YvX_Ghxm6V zz<$a=q$P$Qk-363OPKYrA+8Hl39oP{v%>TW1~r&|{xsfQ?wsNO7q|&C#WUO9zB8CU zO-;@mWvcXQL45+xvJvtWeZ%c<$P7Wq*6nzj`xBaar@!(XCkYx@Xc|@L=Swo*PkPDA z5J+fG)EzC29DgVa0P6n+jo7(^hSwoJBk1~KCP@4F_@ES(o4rGjeo3oDIs7zRn7o%>;jn1%*;DNy)8W1juC$SADwYp;{7g zoTs$c=&bcc@C#g}4U>uopban=6h2I~6GBZWffchRwFPN7!IY$i2L#rOvpW{Ov}D3- z@12g%CDm;0&}1lPCMW+A5%HAAe*3dv3Iy350D8LoxOvV$YFPI7ieQCO5eR6(EreR3lYN*KE$lS$gGR$bLM~`ZHw) z-U`hC|JjV|X^FulHd_wi?=n@O=Jfe<`aTaUsg+9P_v$B^EY%ycDBIZRy}TO6T^crG zyDBzfp^;8(7A$B7#G~o@l69^0l}g1Ps!+Y-oT>!4{laf5VqR<91Zf#OPR?0E_Papg z5;_Oo+!9j+f9fj@!91y~6^1?ncHNjD1CSM;m_hiudOvhzVh$IW=bK~6RU$HFb7EKw zSmg}+0R>8k>eI?J=us*u`T4bOS?A#BbOQ)Dax_wqdC(0y+$}p**}Ja0i?6HKEt7D5 z2Q(dYM#A0$=bm&D8f+>=>p7nd*Z(c5eR0A=M*;KPlK=8P(6DgB!(!N7nNdA%y%dWo zXzk|k88zDfh&{Q+Fa7;q3{*AUb?}5zhjAP+j<7ogP&D2Z7elaI-du%?fzrfL-y&?l9ym*}I z&!FyuSJbaG`wtjE*`&{L1KlpV96HcK8T|f`9W=v+DEx>>EKiveuqvJ66XK0#a;Xdl zl3x9E>u}h?te2*0b0lZPGOD?BkI6Xr*rGn9>9+)vE0$&Yox8V;O zl?TP`F}r$RVnH*${cGXp01H1#ltySUQ-zzZ?#mkwkBo2Ent5XdYoPi1F^}m}@(VC8 zT#h%Nsmub=Zv6}w7d`YxUIZ#h~RH`)!duEOiG5691Cd$_px^4NF#pTAEdA zt>pra*N=S$B0}q)w}ogq{IpoH5qi~GbcyqHQo_zpJcpI1;rrmnQFHp|T28HPFSkyu z91UkO`%v_Pzcmlf%&(fbkv(yX>;ae=x*16k? z+8WAET!=c($ZUydEHq)WZ7h!&&(G8Yd=kL%2e95xr*m}BP<&D3h?JXsDimbTc}qV> z6{rSFXWe`8kBm0{(J$QV9zO7$44RamZz|==1HBt`2?b}hXGR1Hpcl#!PqhjN*^7Uc z>4P8fJp*PIl~ND)ANHfUD))#?O{0o5^~S0H4~E`>H1$p603D{Jyu2kR3}ekpW-xjG zkSc0y>)88#LM!;H!odM$bnM~7j}XIg?^;A;t8J)&e+g_WiIPw%eD01J7$}qSac`r8jMZ~N_X3;n+oWu; zYk4kcg880f;6GDYiw}jBSncCp;E;p>E(?&_tJQuE%p2r>5K^{qm%GJ^c~m@a?n5zb zO~x#Ps+|{PHu}1|DJj<}0pL0t&GyPL047=CeWW{u&-E0#b#07C@(r0&wBgl#_kr5s z<9HmKEe|8UzT`}87W~i ztJ;Z*iD+G1VK5%fHF)objPuj3bQjoeXJ_Zz@K`|`-Me&^;hmkXAwjC<0SWa_u=^v6 zOUi``6qW3!~?C>W<@+`!IT8RpYE-lDFr(tFeu?4lB{rY1W{S(&!3&Z6?H@j zTxat1c&n?c2X-nT3m4IJSnqvCWXRKJti4C3WhOi9ua|LA^Z)aT|DP7ge+LQv?FoEQ zU6Q>crt0+$1^=vvtwMX_R8S?|!lAS|$lXiq@7~CVa=IJCxBY-!m8nN5fAOqKPQAtk zjT4`9^G{)0F}YW^YDTyF7-HEdG^q$jJOiCZbj>C}1v#cr=J&DG3b)0CwYavyEK73> zBI?ADNCu^sEG%eX@sEteBO8e64}8VOUehqpnAj1?z!F5r9W=>q%Kxhq$rJXoU5xmU zqRB*(dv|aZ7vZ109zSTN98fXK%Iq3$c6mK!%i}`%ujB0*qEZ#}jDaT(Xk3{8la~(J z_V@yd#0AwUTN$v4BhQ6+?oN3D4D#=sf2&jN$R4yMromywPAg5TT$Z9abqHBtXf!^g z)?=neW{dNY?J=REVied>WBA8^0g$349TE{RcERbTlwdeosQ>a2T>HbgKeE|p~Bq)Im zz82T`O(c!3Y{xN6+ORD)>B9%{)`79mz0MCX54Jd909<7N1aK)2(Lh51eNw>TwL~Ms zvT}_BmL+0d=P;Z#x8~!mlDZ>7Ig^p>u6?!WdNh{fB&9kxldaH#CZ586{3#aH&Jffx)UB zyJXpo-&eRAMh!PL-jH*16MP2Yx1wOi2H|Po=RfbpAF+;rN4}36Q~hb(NAF-c)tv0% z4mOBgdF&0al0HTzY=oa52TTNXWc4;(gGhN3ot1cyXwWU`USC8vg!2Oyy;w2S`yHJbFpG;XfAj|GkCdzZ=qBjpkzA8|`>VSfZK3 z9^p&CV7{NGl$En{wpH;QEwv)VyQaX~^Y8f4_2$l*xICq5fp4rmk&dx}!5@wdRVMuY z#OBG#XEIv1sHADgXCmbf-zfACt(ESp!3vhvhcFi8XDbvv=3FWi7##nbjn+t5-`)G` zcX!R7DHT-<50|)|<&sl6AOLA{6&8T~g zx3;|TLa^m!cR_<_{S3_~&}auJEy{$**%N?Zx0qhD%!AC~4dogWyq;%QAGI^XfhJ_G zRxSucJfKWgn9Y5mRuGC+l(^(5AlPqz1PH_OOa~)Oe@W~bu6PH2D5eC zLF$^0TF%cH55olzrZDNaX5?yTZ%tlox+dFE{l7CwMBt6>E*kX2@R?G3G&C5Msb)$i zH6i7udWkjJa_f%Nj2<{R2FwAVTD^u{-LEjaglm48iFtiu4j_BXt}) z9IQY6lh?&R#tN~)30tH*e16zKf5KP2)H$R_%;V-A8Hle9W*RV;n~vF{xkmtY*LmoRMExd*J^s+A^P z6NhVuk;Y>c?7@VisBb}m1%6mae*#W5f(s~MhE+!3<9`rGj(p46ZK}FAd|-l@*(LDR zIzo?V$CXuvDji>ikP3WS<*0Go35w1_g#bffs(Wq4xT@N4rh)_nV9V=^lhyIAa0ux1 z3#ASHm61_u-u@d>C9 ziSvo@O^*g)VNJ%8=}r5s^UFcbNXjRso29)K(|mUO>>6ly;9-8 ztv^`;bJp9(WMr>e8jCvGai5VkRf!?+Xbrc$?%#RC$9Guo;9#??cu>Gvxv;RCh$sif zXwt;h4$8N1B4Jc-Bn!12vk)nZr z7MN#Bb>iFVU%nD4S&B}`SF4`h!#_t-$g?f}#l`oUP7Pu=20!qPFDFfX$1Yr%d$F-k zC}+j{E4OVVCBHnE7mr++`#wg~{#h|^<#wtTG%<6JzAVj6r*Fjmt~cSNpX- z=PLHg5)X7O)Z^SNmDg1|5dHqc5v%w1*2CM+hsAT@C7aYeZ6#I0z-Y#m%2Jph#mPWo zePoY-JQE8R@gR=ha6sW!-=yz_?s&`%hiKnfSz80Xp#R%HI)*R^?&6ZlYlOyZ((N6` z8C#@N%-h%3X0;d^mp4)na3!sd{m}ri(5Cr@eb&4BGeQGv7w?Cc(smk*(&LDHVO8B>< zWe1GO^2pU})CPQ}q2^CfxJ2??|C1%o9?1ZW+Hl*W*Es_2bL+g0y{p=(OSm7lUpjgs zQSX;-%P2Tx+kqF`FKv~i)}HnG3tHNTr4!SW8ptXk%)6i0^bZ7*^04ju`^lS=HRkWu zJgxA54qe4!!jPC^VNCz^--do8wb$R?{TVyKKRf-3y0rfyBoCY1@mWGUl1!>+`zWEP+_H?FG6*Y_KM}qg!8&zPbCKK5#HSgo9Oys!?@OTjBj5($8 zgXr}EmTmX$?d30(ccA-e6TIvgz(n3&AsUR&nTiXG4e_q_%;aEc_fKF$%hhn z?mT+@xG6pGRi?xkGt($yiMx6^iP5a&!mWPhqP4wUmm_YfmI%DXyZ)Yiz48TD-l#-p zEwmU~JIrg*f>~R~CGLVTtdvjhJs3>sEiAEa>@(GgSDIr zSS_!A3i>A4-r#<;Gwet1g<4`WV$vQ$C?+WxlvlXDEkt~?g5RFtSeUna=lUY7#8Ut} zt2+V>U$1iN+_^_lI-cv!TS+@M;1;5!Y(2cYRx^oGJYklv(wHdszKttE+U0b+tMjp8 z^@)())Y)d7C4u|NL*3Lg8G*_RQ()5RCh$V7O`L*9`Et|xgB$GkP1<7;u=)3k1!Ps0 zSfXFzkf!g+{}{XBBE|-NQt|$M;vniLET2A6(wv^G2evHeZ=IME^EnV}j0HTzF+A!l z4G8&Wq9|Z$!?W#n+9HCEjxl7?T9tCL_02%9A}>YRDGzLe|Kw%2jA)spk(>o zS-z$mbK8jPL1)M6ZuC6ORf%-oJ~>%_#Vbjij#i<5R6$-{(noeiO8sSPSY_~^8pmQqx2 z-o(GVcfsi#S7|oYUuD~lOGJdBKvU%5F2{8nUjhM8C#Gnua4C!~obQ3bad}*gInmOq zE3BbUpT-lUNAopAUE28{C`Ou^5nap4j(g5S(nLencwDz4*O>NQEco7>#rGpevkzS-p4G7W% z5_-qbdy^KBrWd7&6s1D|QG$dHQWLs>bOA%Cp%*C$y(aJucYOc8e{Z}o@-KU5pR>za zbI!H)itpYrKKx!x+~yK;aq3`0^M$tcSezDr-x7RoL((lnDoFps{$BS$77Gj?^eE_O zAp7WJh-(FDovoOmPtD!L&Q`A)NMK%bCc0*5V(vfE;F2GIQx-AdJU3a%=qZhD|NfF| zO?FMzKF53ew9$4q*65FH*`iRL`Ay2=;G4+F)+;2d@X)Bp$WPNe8E7IMhlBnpA~D%C z$SStY+IlUKi);xlJzvm;_?!D_K~{4aF8y}G9pRM=D#HdJu02ccR0ex4is-V-JLkD| zwYrPF>Pl=Q`fQqho?4suDyJSMv)*X>8tV91<=X9b+sZ_!E}2qT7)UQE=_&;UW+E4u zee6Uokr2Y9MEciGHqPN}=!3PjP3Z@WV|VucWX;0(M9%&VLu2 z?OYLR!tPn=-X9<-#fU$+#r0f$$w^#XRz?+!!|C=9tXcrJDqZKd_}Dw}GN!F4ir=)V zv}Ev^c1`+sUNECnh(gcc3`!4uuYok-*}UFDFF(nig<*3kwAWMak*Pl=-qD=8P)&X%bvENS=oJ=9m2Tu_dWEwTEyy9zgVX(g@q= z`l1rmV82eU-0yhEF0EwgE_g=6mghB_?08i8z5bnZ-SQXLN3e+Y;vF*Hh&y9DQBDvf9nR1fl|d&(9^(i&*oP7>kI(DmUxms_(Fv%QSr3sBkP# z@j5bfqozgQym^zW(ST<}T#Whm?Ab2F#)gaK>}YQ)L)e>4TVH5JbN;ls8(d?>Vu zt1dLo_*@7c<`b(@JvD>IF{rv!gt~TB-JQaWo7Q6m-rZqOg0fRclJ>nkD|@Hzz2N1? zdLy@I2OLVk)%oi=%j+ok8PRvh#>t$uNG?EEPwzyt4P5vcD1p*^X7iBu7C373z@(yM z-WuSLHS0a&bqU$i^4LWV1SEN$#p>YZi>bxemZqk^-jZKmpE(~- zXYPOIs9)y=6UsLEZi zybMwPF&{p3*h^G}u7dZGZ_R)iI3y@Gl`q)ZJ-JR1l-$$TXE%iNy9Pk92c-UA-{rbK zy0pklVg8r`a6o<8L|okUqgiCOEsvKc?_;s&Tzk(K!DDzJ5SSrjcWtVUFxQ8H0yg|f zhV~vXV(RuWeK+vQw2;o5Oi!@=04MPVrKz`*9n9 z7nhRLyX`Ij-CXwKLMQ$25!e3#X#4+uqNt3?&&q2mCz{bglz9?G8K&hk+af7>#Em=G zS(vH(!{C+BrtP0N6Cw2WNCfkC%zx&oTjY3p)oM)q(GS9 zLFbgNv3dSRBiLn!Z`ap%?P(x$W7!uZ|1XK`a4}|4){lT&J1p3`FI-7^Hwn&9E=Keh1y>K+9&H8?k1q8gr z#xqUJN6sSh=!jgKyg_7#MwFHiUyu`+%Rli(}xT27MDlT^sF|)_cZ}BUTQg3D!Qn@Q2 zRp|K;$asG9?b{=@9La2!QAFZ23Kk3-7WqZ{nJ4^L=&+b8$w7FB#u<1PRqO$4pY|4( zsho}GdU<~kz^cNG1Z03xEImL0oza56`u$HX{mrByz%$lZK;MV&)l4&$Y5@P#ybH7kc>{aG1~1sFvX2=#oCyW63E7%s@XUWned^pcYLy1z+|s<$tV0o zb0SzcGh>4t2Je-+$huiZ5Wk8{foizi9@6y_nL1y{raN<@o;}$GxPNlmsGgTPcmU(bb zn%H+&J2pm>PIx8Kt*mQ_JlA}qu3L#S9%eAH6>z>c+)b=^5kEQM0S541VNq%Ld+HYR z!_;zlUG``IS|1%@78STKf1P~2iaZxhc5H1d)z?DoU2M>?sIBll^1So~uxgh+#so1f zlal)aXNlduv9{0k;$BYa#re0a)SzvDTJQH*Jq}6CXKq+OGO2Li;R)IK%OiN<{scDb z&m)2+BD}3TGbl(#MBzfPI8|g3{uGy|g)N)*-q-@5<+#z1lfnAB18Cm2J9;+p;g z=>mvY-Ao8wt_ZXzu`MFg$m!X<<{-1!)#4heh_?GD<5bP{L#cvi|L9J(`{FEyyDx2zfW3H+kePZVV6Ohr0THkf6*XW{cg1@K6K=ho_l)=> zh)$&GRHUqV{e>_b#QvrL=rZ5^A!uPZT-0%iH=v-P@*G8&Kyzcx0{+x_7?r0aC-1JH zd;xAnqXgU!ht0gE93IxoaVYLp+#jdw&ysTPz}yuU zUHdz;fnZ#RK>BHFF9d>x*HUEsdXo7{Olw%(-hWKX4MyPPL)K52#(y{nJpLL30a>*# z#W0EcFZ_JHS6k#^*y41$)KhXAKpjQHnLq7nN2FM+Kj_-fOYUvyFEzgByDDO><;vek z6BDyD?Tdx`fnT^*oS#rC+Hajwlcj4v23{~ls}SPWdH)YP9W>8{b&o0Z*LC07Ha)%h z*DtY>t*zg7m=?UHO-WmP4cz;_lK45x zqPQ8j`w~~)eBL;=N5MmxA^VEfko%`ff?`|2XyMMdBF8`0Takpo?Mj}&JxrSA^?zWo zdh;0U?828b!eYt1Q~qC8PQlZ}>zu*aG9o1LImFKMK8@MBgq#_HJ)8;!Ey5}wNe7))s%vO!enC(7l5T^3 zjxY#hNG{TnafI!<49eTx;3PR+iOo-J^tj$<9MV(z^d;1bWKoOQ9bFj+Ic_@xmZJAX zA7F)&0%9Y*q<8!DXcy?BV`6uG@?}V&5)1)ym(Gyk6wWmS4P*g;Q}z0C%7xI3hAifJzKg4-v!^rE(SE7UZC4}zr>4PB>?q~dskF;{y((2FrS=TOzt zn99Q8&xV_F^TSFTj*2ggEcM$n4>mGdyzhpicaO@(`_n=2C7eR#MDM-+j@VlQfPX}S zOUA^2$^{6A7MIy>)OxI~*>BE5%*^<(&?6pxcVoaj zP_g{UMR~TA&Yx0WqmOt?B+{Ao^@*}lKRQ~UKs3z0-toji+Il|!?C#3@Yu>ahoGTNN zcmE+^Fxr(PGURRk2_6-fudTx@tSmFHxhbC05*$6UD(5|(VHF17$^cA-Yd^zo9IfwJ;HW)lt!V7(GgyC zGRN=QZ8oI<)S`{P75(kHx$zjRTbl0d^gjhx6OKOnL=1Om`xa&DbF zmy~QK0R0y`vF8*@A(bvJjm?8D;YIG zMQaqrKPNc_;T%yHN{{J88o!&7?z~+FhHD#mY6(42x~^mJYJ3Y&diZ0fTL0kb|``c!HwEf`8V%lG(pYyDZ}M3%h2?X(`n^-JBVr7qiEH!{M@<`f9*^ ztDc^w6Wh)-U^ipjGWtv0jmykC7gQYz;YjJvH(u|^H z5XP^}RQrV75#adx%BhB$yR{S}Uj&)CEPDm2xj=FY14f!} zx%imC7~XqE$@B_Ye}f%ec+SILZn;7xw6Rom}3Jb`c_h>LjN5lIL){>;|N!)`2dh#7wws!8( z!cXwf?>Y;{PNehJ*;9+C#Ju~A&58*@draG{9SQoTezDuXMF-iWk}uGT33q&d|J}=d z>2FaxRjdB){q8g!Wc#;W!rqFT2;DvQ8PBPa5i0IZ)kY-J9zj4rE>=SEs&2Y*kMZ?q zpn%Qko2~De;ud4g#5M64$~O@c6CqXhd>c|B*IP4yP)(PB$QN05j)U}pHtW_!<62j) zFE-L_0ftVP{i3!v6KtF234i?AgWprvteZywWn$O@P;QL}!-YAQQ7183h$RmM>j2^uzz6u#zif{pHu3*!GF|I5064_BJb9el7e66m|{y}@- zgXudpyfto&?N%ZAsjfC)zPQL9-f~-R`;l|X@bzxB46~{pe?oO*d{chDQR)+Jx>PB$h*rZ!o4CXSP{uqK5Q3yBSKtt2z zOofz9-FP`9=g%Gv2y|^+Hl}@Aq3iM(HvFnoF52;$k^vljFxiI|TcrkBG{*VgYxbqK zoaT#dCkSWtKnacHQB8-M9r)!2S4>?H%8=Aux*=54Yanx43QD{&U)DTbyrNLJKBN-- zzEl%1VUcx5&YA17TnhpDd*UQ6&3^pD4Se!0XMd;^NIrJGU%kGMs(Y0I+vj88JV~m02iT8LkvPb=#{JfbEuVQ;iQ{@;V z+Pq&os_DgjM~>Mjg5`BxGJpQy0+@eM*`@YyIikKeuB=TPDEnKxtKa@Wa0~Nv_?G*a zzOr%$5OM+O_$Z2EQqE`zt&aeSz_rWbi)-v-G15a@%3PtixTy~*bVswLcEwXvDafzvbOBoBdi?2zlh zXy&2xUz4J5P`-+>s_={La+a`_V70nvQ!N;s^?KOA$-CYcinIl&KHH^Af%CNpGAqJ| z>0%|Qbw(|rO3MW3bIfqPNG@;ezxljkiA9%>?W}z{a1=1G3oq_c5krcUVXRv4SD4O= uWasd1-R*L~&ku#Vj}jAnD({rIGUlwNV1L%UIjCN$7AE!L5-x|} zLn$0{S=L^~$Ff9H%s)?xxus0rMn6^wj_m0BMp(x2IXYk}A|riZ=u^h*?SScsfa@0n zK9C*TtgmBjQe1N)XJ0*a<8=#~Ph3Cr5SX8|I~-j%5S5T9dPs)+$Tr_KDCax%m{G>_C7XE!bnSDeA?%!8sL`G%*eUWHVnx4?#S1mmvr~UV? zl<}rKuiuBo#fiRn@xt8q0U6oj`^?PYd#fXZ4tL>GFZUJwKfN9G|9?;RfB9C?ssmX{ zj4r!NjdfmEOnIVAtcwLwkoC%w+L~XnBBy3xFj(wKHybStfA{VZ9UewqUER*=NbD<% zvh?o_wyG1=?yVgi^!qO7XQ%!_LD}7Lf49g(qBS70Gm)#IS4KeU*|Uo%ipXmT9m1-r zgb5s$pG87RB;T`LOD$M)RJ@Fi9+8rQRqKyKNkvEZV`PK~3kwV7=H_O?_3ZC)nMf-J z1O$kRi%^wGTU+ZNHY;|T4(1RQ75(tk3tdoH*rwqI#|vfU79~x0 zAv-%ZB6hRM=}>{WkG>>ijEtfD?nfvl&oehd4hziM5zCs609@L(m9n94#yEM^M>H83 z8J8|!wmv`I?}aUC-mR~HhR2}RaeSZw|9_O#{`{qOWZ!TltSsiR> z2MIrvde5d^`}zWGONsoe^TRIBd!C*<-6C98lc@a(Pl4yYH|-NkhRx{I%cCBf4j|Ez zDjZz8_&MP&v(6>Oto}uonpv};zk$*pll_RCyufwe;`;ULR16I0_sPkI;7;GE{2)5QRf2ou=Cyf+{U7{Z-@XxwW+w$8Ar8fzL2gcZD=to~X#M zs|j{gMn-0DeWHstud?2@i%$g3tYBoda-$yOWT#ig$=SKP+TC?;Ww;@VT8`6Yhe}4^ zl&!*XeJ(v#HWe{3p^@R;yyUvSHXF!TeV>YIAws{tp+TbmRWx&eU*Gq1 zUzyFBSZlqRnb%bTG>>0v@;QFqD@%4wFcr=96OE>%6%rC!8Lvu!mGScNEsj_5SXfwu zn7;aM_JEHs2~NmrYetNa&FDq{19`55jyb#G?JCjOAUP^caa0zS?o>Z zw5|`QBNp%&Wv*O#cD%p-MgM0E$_)bYWH-+^WWdzM2PKK zTU+Dr=DHoPmY_<@%X_{V_sR}-%IFDrdOEie-8N*pyRoPtE);&IbpGAhq3f;G>=Y4si_gCH2@8IG#LW~brxpFX8ACL*B7W8f8YgD;xdY

    jwv8spUTBoAlFo9Q?V` ztY;nASP%EE1(qVIqeIs5{;^jC`5SX~q6xR{8_v$oqmbbb4i5{=h6`DiNqHRTXce=O zq!<=<3y!KOr{s)VgNueH0RF6)r_s@!Dzdq^H}`$SLU$-%8^vZi5R_n1?yu=_h@?@d z9k9h%SOOB;+z_?k2CO>?zZe-}g2{j_Ug4v0tp8UlFFUv9ZGMs_@9jhLQ;niKkC5+#q6~X(F<;JDD;m85u4%#fKty zd9r*tH`RH2PGQ(B{x%NIwd>b2d$>K17AYyD6Gb&NNZ=HawZRdRxbM6axrhJ=MrP)2 zX8B@nm2uS@b;JzBGETRo#yZ`tW8>sz)Cz5^C@;Un-+!SguC4t5a`P-C`WdKiyMFt|26>r^hNfPRC7SEYthhClQYP0uGlR~=*6-#cE$!`Tu%b~YLdC@I0Wv)Z zwd8AUXSk6+@@LbWGOIYpetDof=M@M4@d_&m6ol)(dV}8!belE4QFW|W&6f;vSd998 z`9ev|t;U^kC%imEbx&pS*GDvOZ*L^;73}+^J}n|h?H0ARW`0#-kuLW|`Vu<2qR8F; zT;tx)A*as(SF~*jnJ_%1H8ogJl9a^EtJ)*9oooLCl|0>Xef)8ch5kDqAH_qynyPB| zV~3N|)97qJwYp4l73RB`P-?s*DP;;h&pnzmHSq$y@#s}2*VZ}*a$dD|bs08?5TlgL z>Y)bPBD~Jai~aY3MNuAQWc3Th?gCr%=1Uc$h8TniC;-S*z~tWeBNzuVK&7tTrZ}zV-6D;Iubvh#Vs`GxObG z;qR6c(q?9Kx=lgU`@a{uQ~d)1bO0Gu?(|5YvNdaxt*4uq4Lk3#TaLHG(ho*hhwIMdC$($kdVk&=e``d<0-=TC?W00=2~+Tm*V3f*hxuqYHS zFYi4fY9+fI-u-b`MmWqDg_rAF!XEJ74Xz0Hxowu*& zMSscWeD>^_sHEf!Br4l2^QbN}c2=!gR1AZ9+rv=aXKHHqV25M*x-|t&q;n`}qk;k- z-^ILxho^YBg((cHO_$yc>?XZQAr5^$K9CSb$~|Y0BZ4kuHSW?6k&z%B#<{^ zTvt!rd%wthDJ{MGdS*t?pyT~z^2nooq?R{SB0%xw%W&NVMd!h`BE8nz%|;j%W1XXA zwijrsEJH#=vCfYt&QUEL9o`XA$vpN;KRyWsB7KSJU~Y8gD?tzZT zWg@@~!rDyJ$EBpjz@yU|Ew$FyfSY;&%Aan7&yC8>CL+lM_6}x&)R(Ekl5tEIKGd56 zCgX+&q$DG|h+<@9YziVkdkvZ3XlL;eCFS(g)Z45qS|le@L}t{R&N`nR&ie-k&rY15 zaX=Y``@gw2VyU?|bF_W5zb*rL2<^(vM|5=U1){b2+6_*VZ>~74mCe&Av@rb7c^`dGlsA*M)-2KGp^4=V?-HY^zOc5WMAwbo1fj%(cUE z(oq$XDqnUs>BwZCHPj+6t7F|~Gwclti@B=s7^@Mb^@FyAFycP^R@lGaI`|+%+0>Xz z$;VS7zHC1Er-{eQMaeh`t|iT1A|U!!_aPw}x2D{PHY~aSjHy+;hTyQ6_$`#l*95;M zUJA}+ek5>%`vOl)`G0E6j~XQN@v*Tp#7%2PB;83Fo2@l0_&FwqG8A=hW0(E@OI&2U zyN{)$%5Jg1$sZS`X24Z3CjC_VK`x%e4Pi<$8~YasfgyV>hvnw8rl-x;a`+q{riEs2 z-V>X0QsoXNJi;E$rWQ{9=<^U4yUfP8^WV19wKw$cK2qn_@Ji@!iy^KM73b0z(f0RK zWByBi$Un;sV1l z;8AWD%0@D|o^#jnQ%)!@xi~0t->9^?!1Th;yFp8Wyfj|GpeUnh8Xn$?QN6!I z71J2|kIi|#WhRtaqqo!D5|mcHp*FQz-~&s(M91t zG=Pnq2yP)klgK&bKFhz|zcStW_@o@OK&e-&w3t!MS7~Z?i~zskX3(A_3iJE)rN`CF zpSaB&hMuhF zNGTwY0woNPdvI)QY_C2GE35PVn4^Da=#~4A9=-eel?reO)RS!0;(*3L{K)8NAqNNc z{ZU&i8UDjZJ`wx41O%;B`{O^iW`DN+{P~cZ`*(&b`ptVSZPB!1qN4XHDSe?Ehy>KE z%a(k+_89&QXsf_^+W>VD4K1EY`(iK=M=p~Ac1FctDogen`ifQw*V$b&_O0y*BQqDw z_0eN$n(wj;J!m`(Y4h)5 zGFA~gG^E_T3t0*e7!e&E9py?V=7%C7kJ#DwBA5e3$I=mkFYWfq-C8ZXlLDgPM5&;9 zLA*PZy8PStm|rLh*W(2E&q{dKB)WK-zP}5eIa+C6(eN9Kc%FNBspCDm&4#FKx{jEP z%>2fm1^}Fm))vr%06y9HR0t5^op%yZp#d8qQoB$U4y!hql5TFiBqSsNS^9jZvzBC`?mX4RZq@TPpLs%81IJzkOV zMb|?DxxETKT%XC2DQrd3Bb4iRET3QILzqH(gdt%HQEyt!(ucxC3O>GWF!Z4Kpsh=X z7yC0H_3KwZAnEd5c1_gOB`hVmEXR2f62S|Le}U6+vi5>S_2HcCtjFOjJ`jWR@&tj6 z&;Fqq{U%%Z&oT6`ntIYDi23fp4Q>?TyK7K%Sh&s{FTO6LTdLIw2;6en*b2oz?Llyxo55$>!}#1s5b;KU{Ehv}!i8`t(-f>iT5o*H@JbLpxj5 zQduSnyNR=WGAi?|h2|^#icfTev9I)I8VKFP4kt9s*ZnCVJeS;^c3$|#D}FsphoDQq zVNc6^V1iTY^qs+;CS@flOU@5I#;a(;*L$ms)z4j?sj}1VVwAF0pBFMilc8icI z9AHM5&6hlT{(N(1M-NDmkon-iKuAGH|1MiHE~TbkUNSA3Df%{lML#TXR3Xv^4-;r1)myPFSEdS|SC_*$*)c4{t@ zrnKc<{H|4Z5$S~HiqUTn{>oNiWj7mo0z}k>y8<4(KV#^p|G)4lRy=}1VQzO&(-2S> zq;1sX>}+Ekv+f5yr$GpRKs>b*6Qo)F;=qP;xgA)Qb-jppZQBA~fXVzfo6k++>ra6C zjbqZTC)dRbFaH@96XVd|bqfLD{{3gtQFJ364;049?U_Ee=$(gw|(OVEV`Ef1zo7v>s4hu@=RKN6*BICgy z&+^zU`tl5CYW<&uq~UKa#?VcL;%YGyIDJUC;;6PPtV_x&Mj+&d7yEo=fUbEog!Fvi z(reFL{*KAcT_f3vc1FtU&ZZs4bOvZLdwZYEA7T)2HM&(&2hQ>o((Wb_VI>kJ+h@cj zug}ZPZIAYLSB=i|o?`+CoQ$3J4wewC)m(Nj2Sk-NF5 zxN5CI1>NJH2H)N?+xZCvVZpS|Ukw|t;n}v9NTD0e=-Zs!CiPqyB=PEUoMS4ipxn2! zb9_Ym@eQ8paYfjB6-ntg!Hy(mS8F@dE?y5@wKFoQg9DJNQ(PM4;ULQ^uEEGTRaf4x zQNyfFc<#3NyG`66H&|Wl@;6g6?USVOZyT)JO|f4j8V}tBNUsO1D7T|?vllbz3O-kp z)MC4vKfHRWpJV%(0BJ}P&D56$d>JacIj$uC3<&UbHzAGcFZ|w(4wAxX^e63-gvu#1 zy+SM8imxv?aeTTkcts_D_`#w)wswcwBAyw&f{5>DJPpznrMU`x?2K&IV+WhLx4I=C z=2phSL{b@ghm*_Sv5m}I?Xe~9{`h(CiNQ-6XK%w+amJ~T$ynwJ&GFGY*x>@72*nho zlX+Vqivh1n!Ox!z9o^Z{U`C@S|+c zv#jz&1^q#=THNDL4=fnaZ_D6rE{w7Tp`%%1ZIZM7syF{=p-(~E$!my3sdL>^ptybh zaD9A~rAtY#fzg?_h7E1PMHsnbrk?l~81}k@1sBUpzT3Emd6Ok1QO+gl!C$zI2DiKA zKcFW(Ig&Y+q5tW*Pe!J&*cW~yQJg1egim*}eIAuPdW`4j6ZFvQRPfzN7(;h1jM+_2L|1J2I+LT5_D z684PgT!`sd>9i`xUOL`ZtcTN{9g57$+Il6jh~}?qvF*09lEN~ikw5}Th=b;GUiha43BoQnilD{cpdh8EvXRU zQcEevhOSbzWtQY6#MD|!V(VRt_lSOacFrx1R1w?Xqly3K$+fN_I3rtLS^Ro(?rF&M zf%=4;+lHlC(SePe_5EPJya$IX8fxbBoDQYrDat;~yUGk!@01eoa11&3Co=AD8O<;I zbj+&d_E6OI0O z+LgQ9mbd6GmeRwC^9YgO!#Zab9I;5&daAu^G&odmFGV*xm`*~3HN(t6QPs{aGar?$ zY*QZR>27`WY59uuofz)UwsZU9SWwk)R9S2p`3NyI27D~|H!=tZB*=L!Yh4>|e7C?_cRH6%R{ zBF>oqbVn|Pn8%@Y7JqDPtZX^Af+=1SIJ?TuHL~S79jy~}{%>>ys!=wdH$iFXPvp=Ay)`2cU zX8ngZAc?%{a@6f9$0mCbrXjrs3L7>}--B*p|1e=Eco9%P-P< zTyRs09&WV;urA`JLVPF2!}FA zEN^U1L%ln2zH2>J7$bq4bp`~yEWy)YqHrh7v-Pv9pfYepM>ZT|c%s)%@Pr2S z)_8o3a^t;GkzSYAOc~?~uwtE8D}i+%ciZkTA-KNhy02pG6Ppm;u10jGK@oG3j%|?oMnFc2zF0L@zN)iB zy_Gt@h;nu`j0u7;qk+iETo(h1kp6EDaZ$lDBNLMp;D|Cj9`}g21CSqgS*AZb+pn1h zT@*)ZptN=W==P+3eMvI5Qqdd0SJ7YPS@9#^`2X1@=6ga}6kt4O+SF?@BbgiQEuiSW z9tq?CLZqc=X(j`i?65YfBG=JR1-}80S4~bt!T^bA#I)aAa}0pR$#P(?880*=H=doS zx3rZM!7iV3PzK9!u~VA-bwQM83LBoMf6+|(`2!DcCA2_#Xm55K^*76oJQUS$Wk{fZ)^3N4`6`y7qo}iUy4VLJtmAI9i(f0?*X=bxV(& zipmcZYHT7RiIMN-v~&qT148G(<-GOCcD{2~#`8!{!53labY*2_OCcF84Cav{g#LpE zZ$RINmKAu6`6S2jk0AE&p6>L{%+C)xl#-FzYZOc6*UZMeQm*mfLuiAonN~f$6YdM3 zuEv2{i3m4f1~CR{!`mJ}cb~oQP2x|W0i~s-$t&l=i!$WC6oRUzn4{|5Z<14RS4c3I zO`)1vPX$a2alFnf(54(5AA@>CfC!zc-;7?4Nj<+|ew`XV{JFW=_4tH@pDAZMl;Gr< z=bWFPZ-(l!I8^Wueh;FJn zJhca%Z-H|SJOL6hbY(_=;y@jST_gc<`J>+D4$JC8AE;veMwRf}0fZxWWCaChO!P`d z;<;=;PnUw?`lG2SrmS8cm=Q!?HLDqVA~dId_k#A0kctlAU4^6TSbxr2bc)n%^x^%9rOHi4}omrcjE+t z;cU#jKW(_ka2uF|P51PmuI`^aoW2A;g(X`ly<% zg@w@}z{ttS-onRBPEVuNf~aNu`Ql3mxhC}ff)Vb`+KrLeg~{?fc2zS-H? zvdziK$+4C5ZZdTMG?H`VM?km&<$bf0XZ=^9z68R0`GH{~w1Ihu& zQoYvvY;1iQj+(e22Q){@@V5dtWs=4hF2J(;m)w5?f)!Y9=D_sSXhe59mfCNUu36)e z-l?yrx3N;x6%iKp1bSr0ac9a@ki8g?8qza<+3=Fo`D%Nk4l43m(6}<|S z<-yUB#=v&yJ+26zwNkIjO5SY6WufO4plLM1qa!8{OhPt4aD2t83?}orIxVKh9?T1z ziveGnWFi398U&Cpqs(lUMPNYHTCUx7m04k4UJd1bEs}h}JRpYVp$FL9c z`lt5?$7D8zY$S{}?ZgcxX# zXPy6)mPN+Ez;Nlx72Abh4|1#ae#;IbE(RbCYTsVQfNcfpBRnxt&43T_CY_(m3phi5 zGa9cf>s?(RDG7xGP~RF;xFg{_SXo(laI)P6p1F4s;8Ozg60G4>SY6A-opsPZ-ZnE~E!K96HBl*U{f&rM-(ua#iBj4#kud*E_{hvyx zZI$c(XD~g$=Z!5Ia&>7jX_aVJqIq=~cwzV~I6FE0f)xa|xu5P1o=lUT-v>^5QS%oo zE2~O{13jx@r`@BQxK$MaI@If`c^XwnS_2~vx>jQVF7HMy8khnQz7qwd`5ahX3=mln zVHSc5$w48G6JXN;qNNQKTjGNK^@)^Uzg|!sI?v9|Mwicnac92E^Q=g2{V75OAbIKf zo!hr%O>o*Iz*MM`p{uE>DV@T<%9;GXFqDME+;&#wA&~f4d|#+@Mp1(W1=hLMCnuvW z&mbT$v1oV!+!IsaGlKBYw95gr1ei*g9afZWY;702Q?H<*V^T$j(Y^W}1j1WbN{S3( z;W6(3>bpze{2t2E(h~IacxGK6-Q*WS>$#tlY04eIg8^qQ@CzhdpdE?$j}{(+bg5FH zbNS=PkJ-uvZ_iGTpI=_DhTw-v!5z}o?3&>UZjHIVt|w^}C)yFw{W7K8FTt0SYga>{ zZQq}%S;G$wPNb~x;7>mTsjzSJ@bC`m%FTOPU?~8LV&5kHF+`&EOG^vjKTbmACN8Y_5UBns{GA|(| zr4QkXVmrL_Pvuta)h^w%=Xv{z(N#cbu?xXbh!$eF3NHEHkxTHD*F!`4-v zpB=+>#(}^G$Kn;-%468HC~>APMt%3Qm4Szn9;v0dkA3PO3TWaO@Z**_{cGqYE(m$DkwFr7ve-LBdxvp2?qrl(tA4?))RCuU@dE-Vp+&VWf zKZH2e*v?CXDgn@qiggXbHe1m&!*yzE>K>mcnSCSa=fCl4GQGau1;GuEi066uQxg*A zkFl{N=_GD!T-;eZK7dDhGcDmzD<{|2L!khHZg7v^ZD^4jYKmpmF5Y_0IX`$#>N`4u zDWu*rLBjkj89zm}4|jvr{m8DFv0Fn!1Bm?3qb~ULsy~2^|DYG*3oZvp{FD?FpZh+C z;j_d`N~Z89L6rdOnU%f$Z1JE5Z9l7>cHS?r4b&HP@&C+LDRKfqBFV!b(a90F(I$iQ zcxSNzWG4yw`-oTd43eW}l>7LXRL8u9EE71{U9o_3f(QrGc<)vWxG38+cB>h*-4X3g0cs#fP7@`ks-!{12OiX`) z_W#*CZv3_iG;eY>^W%>IVTG3d-@M=72;&gNoT^>)p?>G9w7geu>5u6g5{M(e;Cnb? zl5L!Svf4CP9(e#3R_7&^4DBkH-A_t+8uxge^1nZaYHJcvZNSWP#qNVve={5Vou1JO z68a_AUqdfM>oP-!xjvvRn(CVJNMeU`%ka_0egsUNE)iR3JuQ6u_U(LSI!JQ8C6<~N zWwSA|`ZXt85z!!*H1q4!Uw&dmPBQUECmD|&T zV1~H$&+cDm?cqFGGJ4-v!TGW*Y*>#hKbh87lh{is_7&SBNx`&xgy?f=9OF)2ph5is z2oKI>D6TgEQ0YNE2P-I2wkcEGF4n%XtZICNcI88w@9b=>rU6KC=}RMEFhIt*;1xCGKxAOlS2d7jdOyS2t-Mjg&) zSeD;~$P)j#w||?nLF6^dqBl{Y zui^9t5PKN>1!7}`Mk5|*N4d|EWmMJMtuMfue53LPLZLMMR_3K=kdEEYFAuA>5G!s1 z5sh4~aOxeH3NK8qu6BUR;n}^ry{%wlV*^T_&gN7jXquN_*PP5UB0bQ~%5YI1-&nc5 zZhxi%qTmAh13U{i!}3Gg;Ov(ak5AxTp;P_lhd8<*WlzJKf(#ALC3*#=1a|WSxXeya zC$d(F{rpOdXmh4c$$-y7-xi*e5*NU-v>)&Mj9_AQ&> zfOZCik2Ih_(q+phftR)RpCL9ZHueg6Dv99ClKg6G8z54~rE8^O-A0c<9bR)q{$D6Yq%rCWcD9TeqIb%l8TGe>dsR z>?^3LIoIb8hey7m%O?|H<{cN@xtn_j7hiX4%i)t=BNQD3yFe#yO}BIV?p;w(&cRXV z>FIc?kPd!rUdX#}kY9UR#X+l`9^Xz$sX0}{3(pcMrl4(XY>exev#HtbYHK6o;);j( z>0i`K2d^?>BnK?H9qM`FwK?4k5{zL$U?5^Tjf3KadhUa1?IsFN@{3{N;V%u6a6$U^ z*v$t)8D6#cyOK})v{jiEJg8B3U{;$Z4}1E2`_ znI90kzQbls21Q&x?ttWiu^$R^wrRSq79&$PU|B%gKF}K*etmqNWReBlAL9J9nHAS? z`g0iyV{1#xedups4uly99TQh+V0hf(osHe9&*{IHsJHulU%W#wDH;AIdm8WU;PGU* z^V&4~uyTs?9#3oMjWms9f8L^`Jn1r4tw!OdiQoP{Bx|u_d;fYY#>c#+bX~mLm`U9B zWE2$WfM38d2Ol*Hu#|3F!>~;zfjtz zF~3+-gNybAgmZ8<^kpfn2Z$=dcu*XdEd`J&K)!fbnO%otmH_HWWPQ9!BD!Y1`WSBT zANX|2$B(071Vc^H6+RkTSVY$c^K(E+2}jA815ty|X|?4fFlQ#_;z6?lJWX1Aoekvq zaq9teqmde~D*}n%&qeOnT1)Hk)qZ?VeCUvVZBWPRvY9YiR=wrS3s%xkIH6nJHFMi_ zlgXIX)gAi9o>M=r5wd4HrNr>L?uA81H>QU2FL4h3&!)r~I(AxxYDihqlr&%`1(#$z zls^{Ghno*EmP=qA;)pNenU2rFW)iZZ1E=;@v>OKTk4jp+5#A zD3ez0Ynu_OtiQJ_Au@)Ea*cZQ{hSUP5en@}2Rgs0)<;d@2f6G#Yj^^q7M@AMLU;}y z_!4^=YFjxB*$Wfi4fI{)1m055IQyCWYUs`{Ocvgb0WW@YJ>4uoGdkN+CAf58M9i@} zgaV;Bw03g1eF%;3M?HQ6m`-3dXs5ED@b;`h*8SglDm!`sffN!xm$0a)AJF>3j2Y4v zK=6E!#*)GZnJq@IaTvECksj=jvV(ea>6_`}}pY4R?|ae;DnV%c{d8T!+hSE?NLE~3i7aa_B3lY*W7`)C;+^koRG zf}bQ{HTfhSqk;3)xLNMOpdW-&O`nODep!CV&){v@|K?+j0S@v$uu*V4V9)-c8_L%N z9g}nS2`P34@sZ~z1min-wp+8V8{Qdo5 zbYSY!5krZaLdKE<(6Rq=|IKMvIc(uP+}0`&VT{Ij3oHm?_)83g(h!Xc@-BS76?Z z*`WO{mC9A4|JAzsTi<+znyeqOMJUc{l7e}7G{Xk?%9V+l6!2;NDzTi%yxH&oCM;pR z$0SQrP;d!4a>3@?8~uyjT^Bcu;vHLUSm$|VUT&5p--*l!n|kG=xka*`q8Q13xJlzL z2fXR$zdd90WkWHbSxZhIUPt_MTmjV3(9Z*r z(SRsmfbe*wR~}{=rUSJ5UTFT zI=Q}WyE%T0MvA$#xI+Rycclsw_3|NTPT}7508;|}AB;F6w(6jupd~ZF&}qVUH@FAo zw*G{4$5n1yZPGO9adT`|mkvq4{Omu)YEkL7jPWSFWInH8A`JJgq;|voeB~|$*)U%T zRkGw}tj)RC+hKJVy%b27gh8XK|mw+lX zCEC-QJu4ZG`WBU4ZyUKVrdC;2wwQ8lozOeh6z%F;xRJ9tyF7lu$8T7<=41Hw931tn zng@bB7d!}^O8d8Zp;w~sFYFRmPjyGy0M7r?ZHoEpG!PX;Fpcj2YMNI*=lGu^Th`HB z*S;@RFP$WniG%3XOKtDjn!A5S_q~EE-*2y^81`h$(ktA_@N0>Np;qK7)4AweiovO| z%Ar+OtJCw|a=;pivtRQ(&C4n6oO;F??ezguEENn{=j;f@Atu}7tR zRl6C9;q=(2$eS|j13OraQ~pw*ZTYx=WN``FEbn$GL>>UUf8(E9^({8cQ{p<*hEx%n z;9-|-{WAhzdj6Q47QOaEE?nS$wqGvvmAhFFGV+OPElMksqk+#yMp+TRHyD!20RIxe z#3@iT4+R9y3zynjTeaKcn8AY`2I=aMC6)1&p57zK9Th9b*D)~4PWMLQc^oaGf4oed zXyO3o9Whzvm=6dNktw0&pi>||WB9-o`NK<*ZHnMqt^ZRF52Nh(b!8y$CE!W3 zva1V|OEO1pm8t&6DZC=@{z*0(Y_9~+F+$>=hRHFzqiPsn;&xcM`Wob(m?4-$f&R#q zL4|>W!Uwt##77Etf>-nfQRHlFcVM7~CMz#{K4*ztFjw(!=IRMHSLVJXeze!0Qh!Y;f0soJBIvq$UK&V`3ckY>c z0ORQf?%flB)-_bg7$bN z`mA6?7}NiW_fNG6BIb#KGv(3wkI?W48cg8K*DANA!EwC0U=8FC9!MdV0hX~E{ko5i zMWW{K`IyY!_iwaj#RUc;^WgWm?fihQ`t<43-T$35_k~&PXyE)vJv}`U16(a=CVn9y zO})L5po>y`cr(uRUtR!Ed&=#XOSe0DXmMp!%%k-GGjLS9iE#{B1S&Lx0%94SwDdeC z0x$@cZa|JA5VKH{Y#zyXMrE`>3`qcu@Q*hygpLAH16U0(|Ed9rHWT4RUB~ULUB94e zi4a*^pLdN{`HCov9g}*l$BVIq5j_gSxOMS%?bWxJj^%hiq~p3gxk|-$&BR!>7DL4E zUEnXpSFTZ+Q~|*e*A+KW&-{L5UKKZemG&tnP>bzq!RtD!YY!esQtS`c2)quDLp_LB zJFHBmbRTlfs~T`z)rw!w{y8osD|;I$;;;Y|=#}{}(+oQYv)(Xi#|4v`2iz=` z#u);pVAzcF-c8_;mk(ZH8<(-&K5qBvb}(T|_C8`|#Sst? zfWeUIYIXpH;H4gho-1b`MxV>R&|bcBg%vI_5VF&U_q&jp4cOE&sLNyX5OfI9XA(sW zTLp?33fK{tSG<5I6pUHz-VoU@<>h}sWKWaS!QN`a&0b@<;VulcJ3Jj|KT8(6&}qYz zo6@qanpz@{H6oostFzWk68rP=>xMt5+ODp=-$t>brs?4b;BYyZ2uondI+0PltgeCf z*ziTaguZ^dtDp|JE)lEt6%wZp!etn%gx_I&_`BKg+cAq~CQNV-n9v1rbSzcGCLK?z zX)Z1<-s5xW<14hu?Sx#y42rIaDPO0%lYl1N9ze$VJe}oHWnqbliK^=Yn(E0f-G4*B zM#jfC<~|Diy~&{0+qYD7beFW?jsZ;?mzMTOTwMGvIPk%24wGkvoz{NefU1GIvea;0 z?R>gCdhCn?^~`bD+FS2BC_JmnTx{0eU}yuUok3 z>jlz1GxQXINBi_DzWTGFpRU5T8+!p!EF>;|9btk&)Vcft_)bv5Bj3LlS5Ux3!Gstn z6xjpZATvsTi3GWglc#Z^Ur94ZaSmLpdb4fOu(;Y`tRWzx_JnkoVe}7>u0i!k*>UIL z$i$hjq@-jp%nAZ?hYT_G3tNEVJ_O^iiBeZPt0ECLI#yxsStk(VZihCG6)^MQK~OSd_l5?_Rp&IE?32ax-#NsM2`jo0c;q)RD__a7duZO%aP1H zmZ9&)T2;s0ASlhm{rYu|<}hoFkjRrOQPgl95K3ntSN+wh*EwWmF%y%_uNMI93?vK8WxUErDNFz%h?o-25V_+6vGX!MZ zmt>a!AXLloTYP2gP`0ajqCmy55N;nHykB#x) z0SXd2R5UJ0-e7t+JPgO*5vg4*TLLR44DqBFD$a9X-q1>Cw$lW(U0-@3D>&2k!5EQo zc5mq!Hy8AN`PyE&fmb!5G#JZ=e(7-VW0arh$d`X9qg23xZZ*Frx9zQFI&O_P?H-Lp zjzH|g`zNU>V zAT#3NAw|?4lVVw@{i&nCu!*h6pzd zqdU&rk08r8>6X`iJ!UhQ?zrbqi%!!a~Ak6oxkx=qH*rO?dJ!)8fD~n>4$zaN8>|=5h77 zm;SKIQ$a?06-7^SXv0}Q;y?03$OVKeKTFx+w zY%dwaX4N)_Sg+g?HfC;GqenUMxs%?-QyUx?oc-~r-C{QdJ*h+RLl9yV}o_yT3_q}r9;m2a&hmXbF)tNUM+gRCVq(JS#V=>?B2&gHkVgq zHu@V*2FQS}{K)Jw=nzor6^P8KX=!yKxJuO+_RFBKZl;`{H2402sAi-7xrS9EA&-*8 zfkUOT?(^`f;)_o8T-@X|Tjjp((93se?+{z0b zl}_>PQSfKo8s_2w^@x%b%kw?9G2u>1&w1{9Ts*b;FE(a{xz*fh>(D4CGpYU@P|{l6 z8^8S7Ki2c=M-Hhvl0KYHDf$WrI`88%=|%r@Eyd{G>Yv5$#t$&E`CSHsTB19rTg5@m z<#O7%k9@z3NpZR6b!SKe(kZ#sVH+p0&%kK1ObnfP&yhl(8@7!(P4k3Ee_Tc|Nr?7l zJtb8{;af|i!7>gmB2O9Lg_K|V2Xv@_nd8qkZ_$=01P^DbyzW8fjaliO=@_FOpxtpN%+I*a$u46R5Zt)eJ-MvOa zwe8}ILg&M61)(v$x}!Kwhni0EUmsZtD9lQ8V^#OM=eiF)zNF3*6X|;PY(c6QweV|y zfYtx{YweG{A2{#%@;5ruNi1s$=2`_85+Pk9*z{75IeB?2RSTzPXN8=cI1|T~IGOS{ z@lT<^v9V9r;>W4GYP*au=PiYX7hz4W?ENs{5x9D_Y3s0t>3N0R=Ff@e&MK+RdgV0K ze9l)>K8Q+_p1kY98NTN-Klu2kLi9B0;rUl8?)r~6Y8tbt8X32)*ae+k8z(L=`-$sO z=HGLI7N;;Oo+Pwba`BkZ81-zc_01+L~Bn#zXMM%>)ckwYKeF zzH~|Ju8(W@Y1w`jT(NKDxkP6PnUxLlr+O?->RKkY892)!HE%DsfA}RFN_}2rcS44) zTQI!2`0EB^O{ZXp^U2#;uUul0U&Yg3X&66q8eX|Fo+vSql6P^sJ((9bWO}Fc)HqRu zrPX==rHi!M+y0ULO2X=q7tK8R7>5PSqg_9M8pvSs0Z;_f%G)+x6HAXWirb#CVsUt*w4#64`{^9-)*WOPuE|+7>=J&XFzJIR$-q3+Ai_<--ay1J@#Z?^}QF)3|u5vfV@43>e z;O(q&vFGs0{~+x>;IVGs{_(4n?nh5-3*XR0-^E{6CI;66D`rKXGS1lQv_(bdP3B)JoeFe_xx$+DdxMmcXK-xk{KCvnX3m__Gg?QY_c2N zZqelM0AJ>(<80$KH@0J?dCl=IRXjs|7F?Ql%h+2pw{&7_3n?#3yoGC8cUuTo@#O-uuRjWPYr-Gs)O&291AP3s9Zm4Dni1fx|D`P-7?_+#R$`b0a{lg4_i}$@Sr(WbNNmn{N!9 zIb|DBZM>OAJT~K!5{JxA_6lq2uNWIg1qnpyI3axF$%M}PPb~M0% zkM7Eo*Dfh7vm5(v{H){Yrw!;7Lgi&(@^b#XGC3fVx>!lcD|WlnQiwvt{_D6H{u0N@ zo>=ScYcnu$aqONHh$CT(~H z)N+)q5I#Y0DVQM6&aQBn`eq!xYZsLjUn?Jo;LqQ&G?%s3<MR74io)J4vpvXNDDB=x=$yewSWL?VOM7FDK%V%I3$uzTWy~X1cu#X<09VBScWo~3kbV{fHr zBh4ZL={!pevVWLA3JmtbX)Bd(!!T*gToC!wN4Q#a?V*I1UKg=mDU0re^l1>r61U>t2kdU#-UT$uB z0D2VA&l{l$Mta~P9jIg=`3ypzWHSjg7WoDe-_9}`8B^Dt)@_>N0S6|fb_#1wH>L!} zDDt=YMqhBMpE#Rw`RuuKUm!M7fZFr2#wI{7t_)jt;^ukuXbn+vez@A^_Ta%aKZFTI zT>S&<@Ip=b=Bf!ap~wYWn%d~8%Zx@QrKt9b5HQbtFs4NI0&roch=|(CIhppGR3P0p z>*uzeD+h#^Pc&tHQNH#0JMUj!JkMhy|ApWfrw9KHgmSy%*GirD@$nmluBatCkSs-n z8ySD|{TIa341`A(E{|?*{;RFh==DKeju(f!ERcd21GVadG;3kxrw&HD$AqIobA zh!_Q+zILc&WYzu3?y$5p*3y$a4v;8C`XXbDsPv(&ze?QdX+yFMW9rg%EFOgH_*U64 z6n@N2lwO%zD0*K<-XcR;o)u$`CHW3LE+@Q-ymoMLc>s)JD2lpr%S| zg&jUg{_#NviXr)!eZ(xS#D&8Y-wt0O4LgI zI{Cx^Bmi6F-U9~$efO%`zmsH4+5cx<(EOauZ5x%8+l{rHibr_Me&yJ|_>IIKKBEzb zdN()Q+f+zh7Wl!5Q~C6cE~|3|wq-tlp7I%+oig?26}U;iDC1XSh)0pK)4E(ezMl@t z5?W!%vsy|GLaF#`YP4G>Q!?EjbfdRQNkzjVoJ{9aJ4!tkSG9e# z)>{THcconsx}vgIS(*D?bR~LLyAm zDnHN&n7dMbS#KF$c~aN^E7!ZVuZ{E)&%J%~?sI*Sdja>0Rcx9>4J0-5gMo+@#zsa$ z=2@@fHuZvnDYa-97GPAs_Q|6YZC=`g_A)X{iGBnfa-`}kS1qdINknv(++Mzx1P8#D zHv^^6>$HaWvlAKf(`!;5QIWA6nzSn_bTl}Ia=x!2W?n(h&)e>@uo!XcDPJER?-Rq& zQNh9f;Mc9@insb(!`*`>rW5mvisbF=F5aqBJbJVRnW2%R>fjHsJsF>x?K%&8lue@* zlZ5^6H&?l!0fMW_E3xVk6ljcK5kNlO)nz6f8&(nh_^Q6PZ<%wWJR~~}vJaUuyQ%RV z75;yYtZ*;q9_uF+rKVj6OHYd}v)cOM$W|wNS@ZYL|H{@|{q0l8Sl_QDv=bH+m)QD# zNv_+lUKpxNAIPI;W+jrjh7rK4_Wr^#j}gehu=bP#A;OWIA?Ol_gTCbEezxT+>FC;- zGAEX9INm6EvaccKF$_7!gGYW391jz$EFkx&E35eFmbsCknZ=%6E;hw)D-Fw-^cK^a z|E$+nSfh$8O7d+1&_<8ipFYiq%qdndbQEIw1l73~$hz?)QDPGTBo+idP*&rUWNn8) zX&5TBY^PEI1)}-{&15dZx{is7ANu^)iXr`TUqb=|i?KcszlI2cd$GqNWS1z)_iZ>H z)Pvt93pB!JAaU%5D+-FrA8;T@Aa*q3tkmPjj|p392k2`L7gxs}CN1-E4%lemo`3)T zJ?O5CUtJRc%`Ru?tf$z*qaTj1F~-N_2LG>55$@O_*~TA zh3FIV2FBaB!|C1(Q3zpzK~b8fkE+Oevfhh{F$?N(`4yKx0p|zu(f-1t(r<4pt{UJj z5%Tf(Jk(Np&)oRN-q}>6uryDor+Bhe04aVG}QFONUqG^Rah}VSj#Np_NTSV+h4qGI_4+{mWf}Own{q)97n;brQKSlz@2zGb! zR06gw#Pd)JF5qg4#;CKWl~r8VS--hd4Q>(f#Wa8FE*4h5qx#f`;wa5%ujTsGjENN# zRbTgtM|ySBlWm$>#meEy73Bllg?N}`@^4K>G@g=ApSk>vv2wnLHrG6E=@^qG#KpjL zi)a`QoN7})cdk}uAP7Qs#QhRkHOQ~`NOV*$ih_*3%`!+!PP5l>D@-s;%F%+Di4dSb&MXPgjgB3NW zq@X|}8H!l0a9*JA_W=jSxN&1`%lAK+yf^Js6I*8-=tag zf@{m#icfcP&*bt&`aXS8V_9iZRkK`;Ze`F-F@fX1aJ{gPdp~+)Q9Eu8ARS$eIS8MR zHU(1|Fwvn>f^jr``use?tE!nzV%4LnJj-Hw&sd=X`%rT+&eNjA5@ofwg|=;5z%h?8Bi zfR|2ena%cuv%KDoA1l(2i@XTBIVAN|CNsvXqWjHCj%0kI|Om+`G5eXZJmUUDUcs;E_BJ&&=_?_e83L-*YIphm^iD zpVu3E75=sFZPgMjsdp(ymb3sW-VRwM#OD-rme64u1of|?qa%hOrnIJbLq$^kB3o?x z_9bw1K(dC+#&?#Eei7NcbisC=8|NnSrS_xkB*a=xv?j!l^iWQx$xVrFc)9r>S^zsN zRQ&iQV$UUlO|(Z4M=kKs77iYsn3C{sqN1X>2?T7A&R?+v_2$p!OczVnMOmGKF%}jjX5Gqa zbiOJPh4NqGCd?bJ_x}8-v%D`l!f9KwZ5|=yq27q>yKl84rDB@LVvQ?W*UM8A& zk>lb(MyX&*_?yA~BG;6c*2nb8r~@d^t1hfuv2FKNddic;y<0~dmiil3@}P`7ragdtS>REx zi@>8toKl5*-}xwi-~EC;buWFy#t?1&7SPmz@Og!Oy?pF8_#1-0+V<4gZG~>;>a~ z3VA0EKr*3ryWYNw7`~J)6zLm#5^>8(BbUwleZQ{J4QBHm;6MFI zKy%$XQIRLwRMRrGW$Oul`TmjTqPYWc7xs8bj2v*W?O!^cI6jx*i+>YK^T~g+Ids|u ztG)NZuPG_1XsPTg^5cQ@I5BS$kM+>kBMiF!1`_rY#4v@7?egbh2Ra~BfivtaP$}=7 zFR4(F{eHUa&{1V&WxIE!#4>?#0*@a(Y8?`hk@mm;=V*o1<61t=zrEVGE8A78dg$h| zdDr}4yScQFn>N%-%}**4>KkU>K{Qlq7unfMsO9!ii4P~30)sv)TQ#veL{{~j)G1XM z74r+!=$T0U*qeE2o(QjM4MQ$sSpo8rQpN;BG&VBtXU~=&gp7jJ6`(v3b^Z)P4+tK^ zt*xa+9QedfLqWwi({Gch|1T^BOA-9J%d)z!4TH-DIT)hjzZ2vEsY}vuWWvp(S1iI7rw5#=!Mz4tu*wJ@b^Qw+j>tRy-ZysH z3b7Oc5Jd(cpV_wk*}bDh;Z(?dQE5o^XpSY%sdH9CLFiZaj%=9;5gVXW(Z*xdiCc{1 zfD`XAtaFcG*1^f9V8D+KBwqB4c>DcJ^lKnW*!5Ew7SMEa`UdSTZr=mZdF!9#JS$ zTCT4~cgy&ty=_?Oaa8cEQqF-mcv96Mq2QThBmdb-6o&E(o5!d8`hdsb_rJ&6YzdyK zF5}JWZ#!~I=eg_Uv;^P@K>IWbi;9pq(W#m_rTjRN3*k`I+oxxnzz2@kMrXR~n?gtH z-l-fGxB7i4h-obwTeRR-_6j}f*7$arRI|18q_qh_%<2TnPP`|`2P5MUFSQULEXV)r z7D{DpsJn4GkyYm$kuNF|y*j+^RmXbfuAuSv=N8?%U&xttJAU4HeC(y=sjZStO(h%R z-HslAP41!`8cxo=UnHz=dTw64ynjM-Sl552Xo?)~jegC~d=CaHo>siypCJ*fD6M9g zc4cbUIqCLkDov6@Gkh|b{cH1<>2cX(o?RjB1w(6DC7f@z?NU@pH5eb-_O;9_ZRYb% zPZjAftFJXAt%mK?85LPq$~;S#!rCOK88Zrds#Vn0^q@x9v-EP0b9S>=EaWB+Jsb(Q z4Jy0S`*Qs0>sq(d_uLY+{AnR#Ze70WmG9~s+%=5WDErNZ&yiNY(Ndqj)9!)1r zxPPCJR_9!R#H8mk`X*yGIaBW5$TXXlH8zBRnUF46Z9?-BA&7<0b5m4b^-eCXlG!eJ z+AZ*@Ls&>-&*`u6uA^Sfq3iN~?(A|``uNj zhh|9b+_{bDB(TZex_6w9vq=f7u5MB{vu_9kgoLyZBKIAb_99D1z#cQQ<{g%p}Ym zKnLmMU}~b2?%aytn4M6ogE>JF_hGd9JaPDQtBwYh(`BQQ!aIE4WR~_RLOBvkCl6HK zmWdX~#U+5lyYtDOcpVXN+1uMEj*;wLMMXo<4@AdEN}Ex8&s9!B6c9z(&CMZDR=ziF z6vJ}cIJ6j<55I5DigvvX4`zq_5xZeL{@+LIK6&76uZ^^ZQ|zXmxd|{)mlTs6!5WPt zIGqGPqUNIj2>Vo26sev9^AjumGHAK1TpknW6!;&MhYCS;Vt&^|N;5d}%F4*uSAHp&mf{Sh`4H1Uxsf^?l5D4{2!yJNR@4!uqQ!PQPNs%h=e#N3$snn#l)- zu5c^mPjXj>jMUE%Y{e4!Otf^&=H*?TUkuqR0;!K{!Zyv1*L2a!H^5Fsk~I=D-t33f zOgU1eN+cvGsBdodW*Bx+o+tJ~_a0##_&4;GH1w;Go1m4&XvTSskJt zZX21#=CM%3Ok3Es)?)FGwdg2xPqK`g3vBL0>On+MJ$%qeF3M=P9BJogG&)ILKP&P` ztPf19=7=l#W-lQo#`32o8F$Nq3quXDE{LC@kbEe}mvJMn5t-gLjzZtM1}(-h0B3nvF2tEbk^=`#19I=02P#;1)Oh}XxsBBEr#8@K-Es0-;+p3>o0>1I8>MMbj z{|OjzS(V-L%rIE@%cC7&l^Fq~QsdhX_%!!33Ad!9tV%83*laYt5i!_gjUj=M0a$NpWbF^kq|5dT$dt%;&$@#^~ zdMT>=A?{t+<}Y@xo3cbtd>|{oev^CE*34M9M-~19YbGTPjW$k(pVW<49~>I{c)<=1 zDQd&c$k1JtzDYTn^W?g97B8P)zh79$a*>lWQsnCUhijMKQBqO1P?oMSxTh=~Cis<# zF);95&yZlBmo}d5+Uq!BH`*nQsMCBd7Dp|EI&m~jSf;Mm1*|~xj=(^R+Epj^7*Q{amzWddG zq4@fLhcqf2$hlyFHq1jQP(xAqi>i+ZCvRHJ=j7gXbvARSEnOkQ;rzoWUUW6of8r=_ z_rp4ZQ{e%px$m!+ye<;q;yG)@Ce~+xLzR(M7oZj$L$UYuSH@Ymt;jdcnrTvge1Ar; zz3*AgiE>mx)F=(<0|m;#?xz!7IlClJ#6wFaZ!s^O(k7+A65w{!IFwq?-QrxS^=Yw^ zue0UQO#{(8wPki;C6Jep0K95@6Kww^!e&*(JSZv>+|jR(Y5_0+0q8Pk`^;)FbcjG# zo4)0BSkXG!6%wBC`-IdML~zk2I;8M{UOdD>-LP9D3UZ&XQSB%f z^A#?lKXuN(%R5P5U!NFi5mI#dlmz`A*O$_$UOcpUfOn7R5YJ4ihnaaj7KND})y!7R-fBfu2CQ4j)fQllNNyP({w0+H z%NZDULB#-`z)Uo0zJiiUEcap#?G#ejs3k8d8<& z0VILMjnE*0pcJ-gOiNt(+K6_Jh3tE@`NbRA^esh-2uV>jo?AZ|1;_Nm3 zK%bBG60FM?d}6FxsiSJ@|J1^)nnO%U7xkVR^108$OSd+@M=8i`57)$ZjxQ^+fJ96} zh+{_>8&sjEjGvL5CGcu+RJiBr=>m8Ls53NN#6z??L-|s3-Y|b->o-o%OxlmhJ64JN zaXaXv+wB*EJmT0w%1#b19qKq#FQf&A5eZ=e#jtW=GQx!*y$?!KpdBc1@c$k6I>x0dxwPl4vR(Dktl;BBcX~Rl5Dn%;W4245Qd(vDK7k6^f5G|eXo}+NmU`K zfiO=OvGg7V`rNRkiGXb~_Vyp;>M~Dl>N<~TFHDX^G>JYlEuty>5<6c-&;CSpkl2eo ze%*%P$=Ux@iByZyGa5NAtYTU33Uae@-bM7<`&y1~e)ayhh>(L@z8*0XqT)XA`|A-D z@Tp~T*y9lp!qNfgBho2WxMU!+;C(;VZ?zPQ4v_kWhQz@OHBDnEJE0WdGOQ}p+;{im zSoY;al~hw^*~B*R0Du5+9Z19q86IL(xzk32y<+CKHbPR|mMMwO(cZmr&dQEsui=JT zm-ZoBGKUalWH#>N#x4@jH#$o23Twq%bqnal4p1)Ffw~RiZx^3BbH<{!FStI@cyhP{ zH_p0-9YXc&k&@W{=&%Sy0?#ii`JK2M& z77|7VbKi?+PHTJ`qVZMou|KP&?%BP#aw+%PV$N8*8&%e0fxT$~nRYe$?!U@}Vaj1K zK7=`OIcR&1LNNB)2q_nZh}3IvufS?TrCam8kco8{VLk2d>zzQbs(rln*5QWZrAxcf za4h=|BAA~UncRFD5nKEK7$6R3hp;dcv|&hgQ2Su6>ru|kXrv_zi$}oxifw;~Xw=DS z%B*u1bbp+(Yj>fz?CGY{_lG^JCeKfe%}F-wAK5D8kT1(XcEEBfG*6RaVV0M_`(=>o zo+q9i6O&IW_Y}XIE?9Aq)t1Md0?fwU26BCKymZ|*5+`1R5R@F+W z9PFC)5Y%FM%Hh3VBz*&=%|ghhW5%aGks5d-TIr`QE}GCV#_Y&=*onFllrKs1>XLdwj&YVvDr;8~0?G?V z%rUY&fT7ropc?9%sl*h1-~C^Z#Q!C_(L^eeGYn=fXA7JL`nC-u(41gUzI@OSA!NTF z&pqgFDnH^2;ic9B@bY7BTxwTY6Qh`RN4fpT{S_bP(@*4`*wk5Wj~$hRx}&~zZIhuN z9B7%mPa|gjD@fLc6z)_OTmXMHu8csT_X#r`L1tpVzLnen}veT-AIyzesDAkJS;Vs<5k%-(ZcAklU;THLbsfSefXS-aO}v%f32jwib(uY)0c*iOGR8VIe6*Tf5Or% zJDl-sQI$_eHyI|X!`kKJ=STC;ZpZWATO(x(fsAo#J8FUC3(T-$I+APK&2JS9Xs#%Qz{Ea~ro=FIZ?ZmD0Hn-b@W z8H5Ed&w@3(K`qyNene!Hmtelx(SQZaIQVtb#Mx;2^cC0N>1&S+=XbM7prU?Nx!3`V zg}s=c4n^8^Y+yZg0AY?i&mmhXk4JsFP2|s}lXygy5b6Q`ZzXR3d@!l6%E`7k z&Od46EOu`4e1VOVg71$dSv{8(V-uOmKM9ZAY6+>xZHh@b0x@^_0)|%LU9nGPzUvS@ zQ(wnm(m_wd$yO0o8JTz)IjWO;2isfTLQqC6J z^-VnOiIdc`Uh$#6>PS9KS&#i4G8=|7>9)@o9n2{FE4==zK5L5plElDlZxMKC z$8a)6rSrG0_WQXthx1;@1&CaR0bxN7PP2L6?9)*3TbEPxsx2ZqQ#k5xiKxAgx_T4- zz}$uP{*;|>eD#Q;AhJ2o_dXkMp^R=nt6D%=l^YbxIN8fYYlYa1UjkmmX z;VC6WZP&a@>QQ;ycHZ0X9CVdAbjOjevRm{H{6h=SZKlrOrZWEf;HJZ8%TqgK@2v}! zKd&9}N|`n{Y)yof+g*8uW7dy?Dw~?6V&&SmK2kW`T$Z05THE_Ex@_v5yIj1KLzGqD zY?@C(Y@wxl(Mofjn6vYQiy?F2q3PTeYcG=62mAA0_rAIQS%fZnf`V_i!~J?O)HAD_2(wO{|kN zSrI*5_xjM%Ys@ne23{XaB9y`bt`Qs+P@i9()hlT0y?uO?-lk*JHU0{5QJc2&Fd7{Y zpl)}Hv~&sdm+~di-5;~L)~VLN$ggYtx^?Y= zK`_BzfLHG5%Ko{C1xMoR6Ilk?pTc28fSz-+%oG~bq(`sr*fjWcE%ef>_&3PAs4*9aj6y9OM(MJDJD-RLvwtZKd6ehs)BMqaJV0#Sz&pTr#! zR2LaWsCz{$JL$mHwIV^;M#~1~KW>c=Ss?K^bEbjx5*iehF_|8YeG#}Wb~rM~jZ6(s zot5I3HcK0#g$(WOP{|bHDfbpf&p=;_+4a8PzkgrRwULe%IV>QeJ4q5M%3ntWLLe|K z<+B~YYhuSjtNi%M6InoLNJ2=wf7MO{4J{#@L6?#;8ycCQAx%+h#uTCTq%$79koo%? zPiXn=+HB7N)s2UoTw44xr|-^>)XYj}j487DPbU|d5FqbDR<@EIGR|0qr6-^iu#8gpd1>##j)fQ zF#r+Xh*y@VyCE4|^c-j%Ns@yWR7Gr;!0*=aI+81ec#8~#J*wxzCmjY<7>YB|fwO?C zf!x|?4HU+?7bF^OB*NmA8tFfabS!kn_QiZP5byFd)VV6C`mOB#`n`ei9GK9YVAf2X zM2v1$a&AJuYtzKuJ9qCs3J&&6O%=y3+m4>#IfzKo^dQH48Hjoyn2H!?i@*m6#aXyZ z(k@^Q8kkF^`{y(?e$9w(-yWutq6p&%c4wk}!bO9ERl~Q73-l)z2|D-Oo1b)u77UE6 zl1SI^iHeK3nt@U-87h1*A4H}ps&ac-j((R3GvFjkh3U<-eLQrXoEbK`G6;?TvO|7xB-uGL6Q-beK8g7EV5^Ic(h>8glBkpjtFZ(tkf zGNLn0LDFBu0n`1@uzCUAUczm1+XdK1bflMYE-rEwLT12FcR7hc5(o0fD%g@EkDI;f zY%LFD^EAHenMDs|3U133t$c2mHe9%ujFQHL2GAHJ#uL~L=zq~NyWiz=!SNxT<`=&OijB&>*(%v-TGJssOBrvSPR^-Xem+0i@=dW>Cvmp@ip}>`7j`W5_Uq`lV!Uy3ZC`5{>eLWbN=ce} z#k*t2$2QMr7WY}u-`XG{AckRn1odAZykaN2uZWHvICG9>Z9T<&2)#_Ar22CNQ$pt-`<7Iag5DuJ78a>>{iAz5*Z02}n_xIUyF6qeGM0J8@vr)6crr$e7Bc{!?{=blg&aeI*v%`F5ewJT=%kKacM`$kMbwVF3E0g z1!d3fqXhM~zudVY=X;CtDbt(_Z$4c5)DRZZ%ODl4DIN9e;ech2QI7&@JbCKlk0STV`w|D=V z_)M20;rrMtcE434uUq6wQ`l#HU%qhCCfMU_ipu+pvbJ`H$v{!VSNC#*3ZiYkCIyMl zV*(Rqe43k8(jE^#Ne(OGg&yJmm&z9viu!36Gr5+U|GLH|HIw?#!u6I#Dh-28e6^;# z+qWCkiy+3CEFQbT*IZ=!0MiP2{K~6r9qXF8s<==`nySr|557-#GsGsi2{ZB>G zl|L^XK#Ka~kS%$D?Chc8^my{;Z4!JfIFqmUZ44LnQ+*Kd<)Euj#_gp-uP(;#Oc)%= zDXR3?$z~uge|+~|uFwK4PX`TFEmKolTU&wOtI;$FmdImd&bQOJ#YKFaZlu;t@egL` zv~pzIevmtFf9SmMT18&)pU9gn!kQT^UhT8zEav9K6j{)~l}HkB2xEMa55ox*4`v=X{XSkq1;zc9JA@MXA|qB_hJD87XIgoRUZ)%&S0bXDsGc!WPCN7A4Oz?c@`n z$WL~6t8WSS#6K-+5*Q!Kswwi=xgps-_gLI2x|fFG>R%z-jDV_UT(jmgM7(xC z?l6%ho{+W2q(U&)3XwKsV(yM1Y3@o=upQmJbjrcP%ywm6bGeW9gnetb>C1$$+W^%b zJ8=dKcy8Xo-@DqC!SIZR#)-%$Q9tWCO#3gb|BHT^VQC(h5vkzx-9 z(IJcr!J#iE_yDoVf)nQMHAKY%qu$4T!37unsgD|VgEbkV_P1wd4q(uZX6m)<>}(pC z6KhLW2@4As@8n16-&V|ESny>scqLOQq7t`$`qZZptOzUtEq7@R>f4JrpJY5vZ4zSI zB&UDz&y6K#DsSX~su@xgW=ec55|-#NbAx6p504ivRM3M5bQA#Q7$TZ8e_xKz@WKTo z|0|NzRZLd`B(r1x{^5@n@71G-XbPnZcB8*mt=hrK8F4rm>^(_0hx~-*`sdGwH*jkd z;GRXviZL6+x_9Z)r8~V14Gqi!msUez&xZRkA$}H6$qvM`g2b5q*s59ffk^DYr4Z-J zF2&#+gvB9!j4bpGDVETrQ*e)UArAB+@;))jC#-rr=y*IQ8ZZNtw7v%M2&wgw7*mVN z6N23WbVxDM1w^cWF#}$K^Mnt6$_KI>kcb}uYm;+fKM7eTBdjr!iI_Y=ndqXGfLIT5 zGxNsr)6&#uf%}Y#N?v!RD0J^%ah?IE;-i+B9Fp9f9;EF~3RF22f3OW1thXk;Lbe>EZ%o z@PkHEn><^H!%4p4^^sNGBy6ykm3tgfG(-W1oNp2^mImpypq4OVxsYY0hWZCZJ7I$m zOw4I`3IG^1WOJu=8RYO1q)b`ew~=VFZCgds*&r@_CTzwwkTyb}Io&w$6I2l1v;}QP zK5WDO{^~!RHF`5>h`I%#qw0y5l?NPrA*Y3TRxRCL5J!t@)H^tsJ_}ADX5^idJ_%`F z@D0EJJOQ0VHoVQIKb?H){ir($69#b4*!IiO$#R&eYd1)p*0>TmtcW`DlBJySaMUD5 zb)^V+fjA@8F~P{ekMyv14F_mPR;_^6G1>CAQP)SZxTvP4NJldZh6U`?tA!dJ-|%$0@k=s1@voN7;v*o0eLf?E1R@`Hud6 zWvSo~v2Px3DVsfd&S(!k(=~_5v$hmS9qN+J%23jDH-ry{{N^099t|H-#r0xBS<4Q8 z{L7c@#P$to7Aoyd$fW+!7ktE|GG^|QlkipLiN;%`WTL6%MQVH(+hc!=!qU=ci+iW= z046GWM0EQX#V=BwCLY82xq$J$ z%NM~7kvvJ_y~CBp9Vi2W%eMw`ZDbg999l8?=3VjEy3c_2$%imEz_=4xcsb~}ICG^) z#Ej^&rAy-+Cx-kP3kAUf#g`8k`Dfg*<>YPu7Cp=yVg$-rop;!S>LI^`ry>!@kx zS8#QeW6S}h*+J6}qE+hSs(dOhsxldB)OB4;cetcbX-HHu40R$)-Lvoo8arAy22 z?g2;{ne!DLyJiNwx-4MrjT~OpB2clmQCl7Z!axdk zZl-oYs&|ZGg)V@U3qVoKFiU880br1cnE5Fle*vR2y0p)^hoZ-|YN`|ar>n^LU6KNa zF^39WCyrjd%7;~hc%I)@evfFyTnjuXEfxDeMtq3inY3F#JKTXBoRD2>YKq`XUY1o) zOLi6(7RCDcorU%~HFXp1t>vNR>qj^fNlG|UCyyZ09dpqz(__R{YUT!-3>CYKFBjO6 z$Bi$DGI&U4ei)&`bd8dD8T>ROC&O$$=ZkiM10;CmB{(Q~X7TmlqQT zA@*Swy21?o6&`&uUWR0V_o->yb*#r;L$c%{@W_z{6j^e#!SrfqWYCK}&^ObyL^?j5tD$gADL6eMs(d!u}y& zB#+puR|)SPynlbDkbAa9ZwMIENG?-|rC~wP@BXUfLlzqtjf$xNTPr)J!PwZ?(9v?_ z?qC{!L-v%N{PbBAW?ta+v3~V?_Hci`BBZQVgI;s~#k@F*nh$QZS6-XcThEw}(bXrr z6yip44Kd@#8Y`Qf%l-;Cl<^_Se9tXySpPbhO3r_MDRb~hIQKtGaz;VqdB5Wd#)&(45}FQ8;e(nlKMcwGGj z98F2BBV`en`qym#Vsvtzja4Be$@rn5P+h&Ax1^8iEXz?ITUT8D^YhN=JOgb|$ zHOrY@I~{GWyD)9InJsf@)z^l|6!kIiyu5=_<~1L0sEL#3hg^^XTQTf#}|Ls1u2?1hoDUiG9z#yv#7;(R3_ZLU6+Bj5^@<64kqr7 zUgaS1zeKMe7FKvi|48F;#<%`d#Mt!uA}$Gvh_$w#^->tBqdjn3wVJ4&$VTs0B<)7^E?eF)%#=zREC%znj8 zV%@_UX?kgk@L7}o4vaaegsb^0WNx?o#O+nw}}P^`~3sTQeW0 z4YUjINi>1DQ+&G!;s})oBnXQRs;M#K5r&9f=`(Y&%yV~l*N1qTFo>7 z8E6Jmt2bob2q@2LRA~G@dG=WPG=_1(n*A8k3r1Gf6EKCqCiS_fXeD=gw<1DFU>HGB zMROgZq}zlO9jiARfv$qM5u2RGH8HIOI4+iX3LH%Cm%Ws!4G5-?020&{U?Jr@n1D3s zkrOVXvV&;Jpe$Gc`Ucb+gtCTa9qRYJIs2LEP(C~g41D0_#eh@O1{1sv5Uut1J^WiW z*&LwfC2sLc0`FbsoynfIhLzQ^aohp|YBD?sMJw>*z?!O^Wn^R%#u$A%w?vsKGKqLw z$gHqR0O&}q28wsF&}R>+#@)Aj*WXyE)YMd)=N&ivG`8S<6}9Yfy?u-ERM`pnH-29( z&dSKjzIUFr$1y@8DomOMh}FLLS^o=xUSGX56 zr4lY=hfqLO@eySvSbM@?bfPeO$P$w)We&w%$~y+{yn_qTeSiT#qpebX{xTq8TAktI(Z^uzIq1X>zf%FNWHO%$M#uk@YViyhef>iSh_u+<|gp z6f^HI9W|);J{HRxxq5FORuZ@#1#0AhdG+x%2-Eh027M9i6iP7%Vmz0c|EXQOdePXa zJR1PPKn5+focR=w+L0n=)9f1IIsr622w5M1>Wx?;aH|vM5!k@uf5P4@e_-#HGp8RudUP0eD@+#yrp5~~ z$BCV1J@O*}smG9fb3ECA6v$9tXgIq%r+Nttgp?~8h^iou#*GIRm?$E7qV$>RXu;kc zfsqpsM>e#$sO}NaQ3@+b&o!RV&`^@AgoPX$j35XmzloMb=&gb@A4t+_CMMVL@LlKw z5#r*agEeSl^4fFH@$GmO$~z{;ltwD6?6z|AsBzK2^sL8;dGSaIL#yu`j#cb8g_Gy*xM3F8*^$TRn;TN9 z%IfYlnEt6;lz-`KRq0Z^=(UveUs%+h&P+PMnEp_CGwnA{R4--T3zTvWWm4*fBEMl# zyQE9RaIyTRpFDd698@y$rXEWkU&ojtP4@evn1EPeT%7GfqQpb7&U0yIt;6y2s^HinlXY}Gk!bd=;fI+{`31+Bb>_W zgx!Rs`rnm&{|8Vu_u=x%e`o;!YxCS$2e|)Me3x_U&o5_z&ZP=OqZUXoF<$I1Y-yx{ zQ|`Th3Qq`4J2;oW+Zc5|DeKa;lEVlJD;<{#>`47JpbV7!5@7<5HX@rlCE?T}UKWo8 z(~Sp@89gh~!&fR?IKy($`;>atj)1Lz&K1+DWniZSjYbj&0G+Hs1K`&oggY1DjV%^s z%?%^=`+$kV_FWFTctsx&KYgsPRa(i|_L`ihP0$fNXMBJWbc)m>i;EkT7#w71Wbb^^ zX+f$M@EO|p6zj}Rsrea8lu>|sj(eD3S;zZz-hJ>QX#u5mOxM$p@QldgWcRrBhj0sb znYa-=8?x0thuJT`w4`JQ078;W&&y1Ki>4zvbJirv(1@6w3=BF2>rtsAA>pd-*s8Xk zt4e|@j7F>rosHf!KfU+IYfD#Z1uxACrrAhos7&Oi=&uRB*f2l7ecXCLeISFR&lMGM zU=kX*2F^148F9bbyExkP*r1FC;SCE%*+`jG8Kx8QJv%{`X)Is}HB)|T0t@#a#|Rm0 zO96WL8Cf!fVngc~it-JTX;?jf?(=~X0C4LsutVtH(fN?M7kJVy05_zd1R&z*>{sD0 za&vNcArBC1WQeRP1d>inuxL3KW>RnlT6Ty;u*?H4-1GMu2QhsxkGD}F>&Dlr#p)ai z8eZ@1zd(X`7s(X%J1yf(a7mokrd&&%_M@;)Os!T_bP0|Q>W{D~$80wOWMd!TK)fOX zI@iMB4xW>Oz801v?7=xe_$Xx7ArY-1HD3sFV?A(xWRxz{#ShLapI0U$XJN936&8>P zFZ^NvG!R2&HP(m|gg^7Kc#z=)=oiFe=85|Ya(aNT+y?O*k;?`FN#bmjR=PiM2&GFn zO)SW8i;2&K_eN}*Sayhv9u#}@el4rE5d3en&IH&-V|`asKrq5#4XMO@i#)}c@@e7TKAgMbReKlH zL%$FPzp==`xgX0GgX)dNAQ8zj>GM}Msq_T9Y zb8#i*THiH4OKtbP5ZjP+t&_nAj=|Q2tA?SADS5`oN{XtBHrW4+Gc6#`~rr2k$IOxTlx&31Ql?}Vnl?D{XFb9N$k>IUG zo6W)B`(sMs5G0XsE_k9JfbNqB86Q4=d<63s`0oN+fLU$vb2#kkk`R*0cmo?Z>{6v2 zT5_JOx-dGFTB1M?RBRm{8+(mYiB-NT;#5S0lzZ-H$U{4R4WQ>DL!t$>Y(~{Mu#ycA zN38C`GJ=s9_d)9PmL8YxIk{yyR;LeYIM%TI25@1@{CoFU8mc<Oe&m~C+H5T9uYmv{7Ih$ST zf#;+`W-X;8Qm=j77B_D^etkqjO_GmhsvV>-})!5HJ#bpvNa2G8zbM4+`l5n9XAQ1^;YM%q-FS|9XmeQw8(-JS6L(x%3BI>6Nae*sN@Q*~qzpL>|+ z{p0eYj=#1u4M(9|x6egeJ27cnxh;%~t>2Wp=(KdZ%4-5;g?W0iN*z09v?u8BKu%@l znHV)08KDe`Q3*Lu!;vC-n~(eCP=_o?VZN2$aooGjM7<{U)S|)P3Fd~q;vXJ{3_NPU zcUeYd4&UPRo_>33Pm;Lpkejcvs8H#;`k+1onwcb{Z4AP3x|GrsJN__z<9)B^9Zi4M z=B!OkcP{#Zm+x9QJ)g|0dYQb`j)|$Lb*F_puCNm;2=eU9rWDMKi5SOc7}|zEzpQ`H zZKmOm_$jJ5PPvw?<6@}(w9bKs#vyZ?@V21737NN5JDjjKANwup<%|!4M;9+LK zFtpjZtz@1S4C%?t9*NU}nP$zBh*F8EB}ybOFU54rXs^GQP^R!D5amVAow<2>rj-ws z!%YH{W({x6icc!ET-e4iKf!Z?c4DZ4c6w@fe0&#*tm5JmxEmu5kU#%7MizVv$*%#V zj!J3Uh^U)v;?iY3{$E9wmPtICAANw6#leDR7?Aw~ zo;^u23LQNr#z)(>-rMz*SNCRoY-%<0<+Y(g`tQ02S}fT93$J>r%w;2c@-phf%H6Ij zFqrHqITO`Z^6Um?V5MBs9p#ZpoYcvW4?S?N9qzFCpW(t{? zOJbD?wX|+8;BGM6IDyy%e}Irq8~nVI3|+M?%+3Z;M5suq|`+}t=ws2*R2j54TR>wSLq^xe-62BZZotd zq_DZa00Psl!M?_iB1q~3=l;PeZotU(Qr^KqXWuC;DBm}9htogi3nPB z^cUERpa$knWXn#}`)2R}$VhZm^C9FrdgyPM6s4l|76C(lhx>Tch(y?GoKrSY#eDen zTG~zdi&jIA+z@~D6*Bo=f9}NuCNw;_%1CH@OoCbvcwIel{knMnhg+Btb{!nyIAWb5 z4`=#q#=s^LZ2)bM;X4!{%KoP#jOc3apAO)oUAC;IXW)5~qS@L>(ej15mUAypSJn%T zUy=_$MbFN+R`QI;UhTCOGMy}*H0<@{5q116-nHh<6bz$!6=BC%#jT6aX$1bimo{;1 zzAfBW0g)C#K$>)p^xoTjzJr;$b0_)#`S1E&Yu3z4CWN!k-urvsr~XMQ zs;ERAGlT-;(ClDd1HyBZIYgeE1(qsKHHDHzd?NjGHT|k4Pf7gf9U1W}vWCoG#4>FU zy&ulCUgzhnF1k%Lv+1)3mM>qJQn6PzU)A(X)RlpO{diC6X!w7C26U z3PU}%Hvzo)2_TK#CGvWv7M>w7%T7M$c?aydV2WO0St8&sRJiX#ul)4ybB;u0Yfn!x zCYdNnj=#WqqUN6YX1sr0x-}xd>GnOPQaF?B`!LIx|J5uLP*G#B&>&xaAc#Au?=Tt) zGIN6hvSrVlnd&~jg;qAF)MdwHW8+kn+3L4%ex$i(wCmOcV_B9?-{HXWBaIOQd-o-17Rvd2+;&9A+jAhN{M|r> zNGL>Zi-6FZm_t*HE>pus?Szk)o$7!*sj}#v^vuX2d>0=XT zT<=})OUD@Kvcms}$@_}|i++6nt3uH{-{k)in= z>7eL-TU?AjNICDje9KxV`^v0g`QDctOjZ}=I5|@V7WJZ!brT=iB|Kac+ToE?Ny~^$ ztz~zx&A4Zo-x0_Y*Z6Q7=ExIuizdKz%^``x*E_5ad90XiFj^?QBG9ZO(A=Z{Dmgqt zZq5{i>$GR~F^cv;dWn}xN{U($PlB%S3Z(D>=OGbq;W@EMKy#q}?`97dMy6E>baHBa zLlqT@9L}@mNISE*FudNI?d0MYr*uh0?qYh-q_2rfy_L3e&gY|wDU1Q^YpqIN*bICn znjma9I>HOInrZx-jzOYA91>7O`6tc+cLFhubhIUSnWFSt*s3?X1qjhy#BKb6E%!_z z&;dXsh7Yr(-zR^EtWMhv7<_|VYLNF>LnQM$H3yxf5LYmp!AI!+iN zr@3h{ZP7#rx(%i<#if)fB{@Bw&^x z(;5Xh`fVyz3PeFC$sB{C1&VD7P8rgB+LmPvvWB=_P~|PE%>;&?kxkgF_X|Ic9FpdT zHioU9%xif53b$!jQd9c?K&%$+fk0DmHsXpyxz>Rc=1!zJ?*PzLHd5%dy_{%8fF%Up zz!{WZT9X`VjS-1Qt5_h6^#h>&ek7zMRHPCbx_0;< zBKft5BeTF$m&ngTLkao_VVH(p8@A0;n4X{mAvtW&e+&caSGh;}9{;DXY#H{;JV=iS zbr3{*hT{v$pg3@atNBU$1boZhMkAnNEL>}SwmZ*y!*H>IjZMAf(4BWjFoWXOBJGrL z(*(v+=QAp_f}R#QMsM{SaHmqKBRL)%l1~XJ)uw$o99$OpCE-Q^1&LH-0qe}hTVF|J zkw3q#((8M44B0&TrNzp0>mB<8(uSs{6jg!_=xb|<#X71}PqNm$LWzK&>DNGv(`kbC zWRju4dQQ_=odT{B3ua&7s@Eh>_Qeb4?ZLhOiXS21khF@^&K5(jR|>o+sK!8FAO32d zz{>xdHzi1yXg?9wlviJ$S$Ajvp$u@W1huJSO#z!yP#Qfv{{qt}%_0>c1tg4u6dClG zYxBqeaKf+zCr+7I=bytJ3@v}^-mbf&5EQr|tPEoH;5gumcs(?5s-1T1`_WQ)^{v7s zxx0+(wD+`Sz7$w}hW+fCi1~A=JQ~k54ZmiIVSaWL z*Ay3hudNQ`@KT-0qDK#v;wx!7iZ6r~?k;^cZq0!g>S^7a_(A9gstSs?9?_?H4I&r*ht#|No$W?i(1yeHztEHEL# zGa@mgHDc#ATp>Quh+HPJqvK@Ie34C}7ZH&L6re_ITyJqKeE9hBd+eQYYWs+33hHj6 zp`+a*H9&aR>_k%x422LrK&$^BKkO~o zbngH##Jftr`*Q?j&E+h#P(Ll`)$%VU3EilBj3%5aaVGCzw&Pf#+HCt<8Hw!c-<&ji z9W~>&v})z+_xp(DPd;h+L}BV(=Wn$$c<+m^wgKGbn@Wlgbl!{)DyK@6zKb0nnmEk< zWcGaO8Cp@aA*hP$4QcTz#RJl>1WM^v54Bl#js0VJ=kTB{j4e8U0(R?pqxy?R_Np95DKI#oFOBih7 ztRmz90ZeL35XjO6vm>B6i(}LoEzQYaD+C zII4J(qhBBD#>#vv4Xfr({je(DSOH$a`f@3AJ-D&uS3vV-E&8>%W=hY37(f<8xTv?MBAj`<(9FJi@QqH0{w`UD+fPaWJ|G-;E-W(GD%+0V;QtMSW#E06h1Fv((r+7w-J&6`hkP} z9vrOQ^@T*XAi9u3nmqzUOk*xIsn&s10V6l|-~!uUqF{Tc8umdDf(?BmJ9{Y^PXM_0 zIs_rHzH)?!)^S*7cg=k)cVC>VUMIZ?Ot6p`+TTb??a7&Uh`96WI-9V>)^7jfa8!^i zbO;mkuFsdpj*+1aM?xH`%{lCQ`3+`p{zCW%?Ir`>!biaVbbqnWLwo`wL6$I4_&f*= z4@ab3794&qpn!Oq5h3yUx!C=NYl|3U$jjE>?KB5y`p=)J&pB528Hx!Qn~Gp+kHD1Xki^F11Q3vmBO9~$u(srw#`k0R_A2T3faq{Rbh0DONt;fTT4b45^V-y86SBy9*T6A>e_0A16Brr$>|;iWr{4&EkbB0kQJ!_;Q&JPyU4HL5r0Ani-oQ(ZH_D z?U{~5A5v=-n=}0z;6mjzeIWI4eU{dCnu#JmnTg2jp`Zd$^vt$(704o&cb8vRr5SHT zL=NOoC6J`Xf zw;QCFmD9$&dJQCdE;bqTMfdZT>p9NyWBmAIb6X&^*6E*o0Mog`T@r{_p2Zk^J2+hd zR}W&txP#9(h@3(dwWtfq)F|V&3df<*QNjLVEE`a6i_}q-xL{Jofb2#7L*OW!Jm^Kz z|15jIWR@gV#;IKrx*D+ zOCL}m&4m`5%dS$T-4i|qHaRnu(P|V`mc~3dw@GijBP@YGaOyzk(?U2~cmOtnKmFA` zgbP#Va@^RT{a5><&fUyxaI^D4CrBxmp|LSV-rB~7gn(Sd!DTj-N<%#tS)_zzE|Fkz z^sE^L2E&5UXu_)+j=zT$Zx{e8k;D_VApBIT-$GM#Yj&s*lV|iNH~h;!MO@&zE?mF4 zEenz3^uJ2Q1W!!Zfq~pH+c66Ag=K=STn`TdUL!^g1KoAssb1V2TOG$ICJbOcDwx7k zfGrnBk!z1#fBm(&r$_eErKbv8I5_0c)9y3y$+T+xS@llerws=W>@GxjmNu4QzUpI| zXL6tjBwac6CYjMHjvJ2BGnZo?6yrd zCO7ocW<1__SrE?qIUaCA0}`7TWSxGp+%c~RMXF_QXJ^sDb zk#bOZm6er|M}&NV&!7K9tZ_(%A|iQAnBetET0Cg%C{HVdK;RIl#D&7+!`;Zjcp2QL z1Ck}uGBQ92pzAYgFkn7%T2qrvwR@zaG6BBrGb$=7>4vs`z-!s0PzRS@=d_@5W5Dp- zm53rqb-dUClHu=J_BT+g%^;04$FzstVlOv0CmLG-+OiaRoH|EO3yBCBaV^{<5nNcC z+xhs96*P4fUCV(}r-x3<4S2n;nw38jP1|#Lj^V(5lk~87q&<)*xl2jc6inRqAo~kU zO#$dY(AB2thNo4p#6ND5nHu)qiivW5euAnh$|WI@sSzY=Ea;?8Q#{5;%;pC)&p_Wm zW}E{D4uF(@t5 zeWe=QDrt(rOxr{+&-UVez_Et!{B?r7-$1ttTXK4MRlZ`SJ-AGMGGCKSFqq;nV;+>r zL!CMzfO1Vz6LCb63 z;PL&`dDr7FWoFu^i=!S#2mct1YfJt>={t$O2T#KSMv8)EjueXFm5AN8$tXNZQvlBj zhr{4e7~?KaP1ycT$|^8B6j6KlVry9#wY zn}tJvjCdeJ4;=Xzv1Yk7Z$pFJ`AgO>8(t)g+{D&$d(1-IxvwKx|LG;Q78AEQ&heng)k;#boZ2B5oZfu;lz zM;ovNKpK59?(z~qD*WBExPuHJMCsTv>*nT0^cxmM@>aO{-r*mPwavnOOgb$g1%d#? z+{$VfFf6PJRgv=-#HtTUtEID32C7doQh`!_`l$?n8TJf;-&4q@u9N#KYoS6= zT|;H$m546M%tJ4>ftDfk68I*Vl%T}|bCF+Ew2GOT87u>jht_?iLMRn%^1{<#$Ry^_ z0fdmfT7oh{;_z9KUTtXqv!1JzLf~ePe7k2O9F^ubgj`x5XTAQ=-%FW|t%@0*y+IA^ zIHj<+*zQ(q=c@(ZfCR+55KbQ#0ctG}gXn}kYGzgyyaXMF=ismRW;=6SjzPk_du?fh zhWTTkD+21GPsIFw4_WXm8ezHAIHVdf3yN6QJmsmmxwXkdTa=ct&aDQr`09a1V03%X z>{#xh18>boHaqh?1hh@#_-%?FQRyYkY!$VNuQk?c9Faa zl2?R3hL0crV=4Kb-Nd@<<Ep^miQ|Zka!OVg%2eS=1iFAy1A{{PFxp)8RjV)Ya^- zq$5#Kk0spwesM|o^H<$=?&5yRw;HYrxAfI6Rb}>@W;~BBN_w@i#b&L^alszv!>Tv3 zUs@}3@lXooMF(%xWIW?U_|Y^yzrLNjJ=o^6y1Jg;SdH(!51vQpb%(^VPydCU#-WLC zBwT7P;@B-9%%shZSdPtl;gIVv_z{Z^ zyhu3(1(R-vY+4_|)#=cw?)dyE>;S_)_5F z>xf5~(4;xj-8?W?KmfH1Q72MTQfZB$Q;5?9mM{RT8xUu824MDG;84vBVEVkVkP46pP#ROZ-Ww5>(*()Kfg5 z76KuSCk-?oY}PJrZY#Ou0)ImMItf+p z`7K_IPmoVff!L6!{>di?XaqNg2ONK}Ea32|l$W}ZL;|ZhckCdQS5HLEIVqq5e0Fma zR1ir{q}v&E@RIW?)-4x-^acUQhIKTpFQxutkOv+ zmQ_-lDx&o2jd}v5v=wgz@n9d`co5(N!1*>2Z(4D zbIwPkFy6)#0FyCn(D<$t^hzi|8F%sU6#KVYr$adN-+pPC+?Llf$A3P4{5a{#+kYvk zd46U<=muNh&-;KCaf2Jd+{a`Cb{rhcW5UmZ5ZM^3YO;beo<0Ee zEd0FMIaw9+Gt<)*VdvODt;E=RMY^ApX5Bv52Z43^IvM#n(=GdAX5DQxZ}vBkl^pM# z6IlE|vaexe)WfNdkO0=AlVBoXScB^Mi$7&l3x2aN5VvTYEyHD9eFPs73p1V!)(|1wS-WI?x6)QDTh`pt z@($8Jz4w90nSe+EXaV3~fRECUA5mai0cXSTd5>}55*mLZj3f> z)ij)U`B`@^C900UA0Oh?=99GyKzI>?jwtt#7rbHX)(=o5LnTA5AyVWvKpzavM@&o% zOe2=x{`k3V7SuYLnoeOYr(nnu7T)3yxDN$TG6_{^c>tn7ae)Iwn0&IcSf@m0V>e+Z zfp$CnD+zXIAi?eclo+kE@0@&4gLtN*v@pyK$?PQTXr1OL}aA3erKUhe`K`rS0v9N^)2NMdZcjC^20S<+42SD`=84tY6W1tLgq!6X^r z1Y?vK$f|t($j|R&`7>r22Mw&>J7ex{!Vc%=cJht}4|IHRhu>Yx@=I5%oEdprqa7tz zBTwig3DVHlS5dEiIJd#jWAR1vw!g3IvM-*E3;5lqYrLYd5K$)c$ zyD(Vc#C`;mF2EUNFig$FAm3a671l+P>`pI_yC1w>(qA$l z&avZ~3xmsr?c3S{+P=_T+N)wHyi}S`j1rzX}AI!8X6wD_?TB(a$Rlh?KiTp zta?idhcJGS#1-t|z%oII5j6i1m%Kid`PgQcfD+$La#j#+quJ)o;FhNlVvVF1m@xKF zgi0Y&7cXf7OaZqAAib7E-5`j559Hw?s5Zk&k0t!<&6}f}b%9g-boej_hGL?_!(xg- z19$OddPp5)bW5O*0ONWT&jcR9y_kJt6HFoO#LpO>9Vu^vZVEX|q}&4L7WHO~>45J>$9k7^9^gwai1R9YI{$-X)LFnt|)#j%rW zr=#OIoyr_`N0ME#R4vxR#w~d3=f0J9f8AzKmn|`LQ$p5K{#yU4XQgEVeP4stt`aMI zZX)%Nx-d|s)pG{^5ElsJA@5hNh8q@om|z0koj#6P4R0F~@$!9Eo5rj*IX(Tmudhm* zno*q`&SqCMOuz~5=(yw>#xcx~0QumLXugubhfqlD5K-K^coo9S$V7pW3K52~QjDZfOIMVKz#+gP*uY}2$Q5k?OZgb zF1VWLqR19C=vh76A`B()d&ZbG6o$_xiOS2Duhzo~)(*~Gx!@0Q7OVR}_kOg^MidGu zjl}bTMF3uR(0y9$iM3~8^X#KtQM~racT~2f_H0i0n2)Cus13Phqh)-t&da ztu{}t|X1*r*`~m>0U) z41yiEAcKg);WVj(drA$yicp$HolZAqX@Rh1gc-y7g*ykHKJZrxfVqj>0kW6mZX3sB z%V@l)Ayx9Ey~HwyBu&K-%fy5PqOL`$vEc9S`1VO32N2DE*0F3*_`UV1OmA(s$m!`N zZ^m&F5Wt3?RbZd#yfAMO?274Ew+2ZZGLTvALHn!1%bgW}(CCJJBWLCBbO?Z0(T<8qaOCt|??f|U&~P~}T1>ez%} zJxKuKiy`7JK03ZkG7e{r*BP7fD?qWyiKYYS`SFe>!8d$Yc2sQjhhE=gQc#?WD?C?2 z6?+FiN{a~AX6zK?{AR(!L^G3bmPt4A4YTvY7Q4oU*sI{Z8mD@yhm94(miM*4YhrHg zH`m!;+|Rpj?QHNb#tjTpRMJlkq{Xj(^VwH>>9ru<#@F&DQU|HQX^FRjmM1Ph)cD&_ zW|wN4?L>g{3%x{3|Fdzof?VI2W}dGYis)fY6ug1a#Q>CHK~fB~egR^OULm5Y~;bNa1W zv!<<7q-iG(20$2x)DDV@PTINcRy3xMcQNs9CX%PzBF@kwcM&W~$8J zL=yah@#4Gc-G26ZOWDG4t3#RF2kj(J?&P#+`&6Az2kk2USJ0jY0}e@ushMh!X79cG z92qM<2sPVS@^nf{JVOd|5BqQTPCW`Gt3o^LH*;-11`D~tx?)}yy>)JF83jAhmAHte ztbp}Bb-edJZ8-E*XkV^Vx1hY2!)jQevX2Au6L?c2LBZRJ&8Mi;=h+s6oW^X=3kzy) zk1ntX2LQm_#aVH6aV-deUm*^DuYFr&U3Ei4Lp|!_y_f>!N9MR94rSU)?OIZX=&bSI z`h0wS1yKJEemB;<9lOFEI^ZEbjn6{5i*Sr8r(2-PRpdgO8F&5B!u4LmZd+2@a@r_1 zqgi)O^X|{NVh?nmQ1!{^E}iOR0}4TM=?tsiJW+TC6o4S}=$OGYK8s<4!1nM5pjHnj zR|}~!f}^&uwl@8NO>>=biMfcDM$L%i06nlL1J$vgS@;;L(?|FRy8A6xq`>j9BVpn?wD zGuCCIv`4zNZnAKH>{3s${wU8I7*&bj3-4U+Vh~=KD)WT8?wr!KnOg{hoJr6e;7mKR z9Ny^*j7S*RtjJ7$+udJuzg2O|fwRp{v1QHOM`POz?m6hM^|`US8k`)aoAcp43s?}^ zNp4p$FO`V(NcT3W<3o_}Qpi2YC=M?Sf0^N@m&=jqtJEmbNMW^X7+bFnf$Z0>UpqED z`uGtkQr-L(-eD)`H=8o@7Pe9DG+r`$+p%ql9J9sBshK`Y6IZ#||Mt{U+gK#0 zOhiXm`^&?`=g%o_c{)i7%wQGaWN^nIJB*g#Cm0&yP!rOY2C383)D+eZts!?)ta<;w zF04EP`U}5g3#2B^pg>3(``=)qRUBUT@9SVoB&Csv&sId9I%Z84jKlhg>2+!B>sD@e z99>TaTpY(xH9#V|9u%5e(bZNa=Sc=2uDmuTNFf6%p9MOL#8cNzI@Qw%%QC%?yM~uY zQy`oroF4MM5q77%#~!pXe(M%ow@iA;GSvLy|D4~40PHWe9D@qP<}XdTKcF`8~!5aj!5_D zj2YsmLYUe;pi02gWisKh4~v|!?y7_F7?QZ

    liOJ?Y?(Wj>D$6BP^00DC5PLTrFx4O|WbK{^+_kKWs_OG@3z!JHGpht&I@}`ekYMwziaJvSbq5u;vWC&d(*&N44t*KYo;zRs$bk>gB2a=?;n`U!*Q z&1H2DA2)W}SeW93Xb4&zB=$6rxR;S*K{jf3_H)=>3Hj}mIIoT&lze&w>|@SvvM|<& zX&=^%!O};l5@7N^)pO91L>_V~G7VPH6?hV(Hj!!$bcBHJh}^m{Y6(2LL*@X$mSaFb z@p9LP?ia?#c$p#9YFf7jhdNmt>THw}>W}H^QSm89hKBg7LpAzS*+enX;tp_aG%*0E zLe%J3m$Zfs?y!*jR!Nf0nJmtfTQ<*Lq}+XWy~tOxeyVCTmN)2j=Wu2AS(c`%Vk^Av zaP*M_6CaI%VC8Kc9r;L`p%C8}qLxT3+9am~;C&)FgSh-0@NSI1BoV7%^!e!MC^z*Q zLIB!YT99wQJYqE~nO`OZ0TQFmQWNF9oA-Fkn~9 zI#lJWJQ_#kTM_Ob${ud+j4Ky!EXOMa#I}V+!jMyc6SZmbkeNBFw!VItxfga(8Gv}6 z8+Li$edSHk^6Z8?(<^7IiZ-i0da`6j-lDF%j<3Br$+3?Ub3X=y)h z->$9mUZ&mdU`IzsJZ^D!c4dZ@d%zNLeFjtRaw|!>IIDk+3@T>Hr!BE>fKw(>32ovr5o$@d&Qc z>%tA43$DKy&D%)!?AZ}guX(etuF5}bhhi|s@p62X9)_Br@Ghg;9(q2_fj^{;PAoRS z6PqsiB~mQ8P79>Iy0~kN4{o|j`HtU*vNz(5?h;=bbIK7*=06vNUvch17zItIHvI=J z&J-C*x}O0OeL=c5rA3a*zbS!Xp|e;2vxK6>17^AH9eIi2Iuk`_>VJ%20wo$9Cv)=E z-U_M*25D7{E+-&XiavI$VdeJ0%4+tcWYJHpyEg{NZ!w!;Unt8e<|wl{4Rs5{2_W7# z7l+?7;LlzF>?r6-NDu&GHi@C+v`&{;4zJ|OLf&n#W*Yz!BsDFYt+lxK?lt^|iX&Db zI$}T8i%Y7H^~vXO_O_n@(cpXla`SM7*E#7|d+G8v#gin41O^~{=T*OY)N2{peMUcZQt;>W M2|4MQW0!yVFURd6i2wiq literal 0 HcmV?d00001 diff --git a/index.rst b/index.rst index bc0af753..fac38a7b 100644 --- a/index.rst +++ b/index.rst @@ -69,6 +69,7 @@ Core documentation for Qubes users. :caption: How-to guides user/how-to-guides/how-to-organize-your-qubes + user/how-to-guides/how-to-set-a-wallpaper user/how-to-guides/how-to-update user/how-to-guides/how-to-back-up-restore-and-migrate user/how-to-guides/how-to-copy-and-paste-text diff --git a/user/how-to-guides/how-to-set-a-wallpaper.rst b/user/how-to-guides/how-to-set-a-wallpaper.rst new file mode 100644 index 00000000..dbab5f49 --- /dev/null +++ b/user/how-to-guides/how-to-set-a-wallpaper.rst @@ -0,0 +1,49 @@ +=========================================== +How to take screenshots and set a wallpaper +=========================================== + +In Qubes OS, :term:`dom0` is strongly isolated from the outside world. It has no direct internet connection (for updates, a dedicated UpdateProxy is used to avoid interacting with untrusted data) and copying files into it is highly discouraged and not supported by tools such as ``qvm-copy``. + +:term:`dom0` is also where the desktop environment and Qubes OS GUI tools are running (unless you are using the experimental :doc:`sys-gui`, thus, if you take a screenshot or want to set a wallpaper, you will be acting within :term:`dom0`. + + +Taking screenshots +------------------ + +In default Qubes OS installation, you can use the default XFCE screenshot tool (called Screenshot), either running it from the Qubes OS menu or using the :kbd:`PrintScreen` key. + +.. figure:: /attachment/doc/howto-screenshot-1.png + :alt: image of Qubes Menu with the page for Other tools open and the Screenshot tool highlighted + :align: center +| +.. figure:: /attachment/doc/howto-screenshot-2.png + :alt: image of the default XFCE screenshot tool + :align: center + +The file will be saved in :term:`dom0`, so you need to copy it out of :term:`dom0` if you want to use it in any other qube. The easiest way to do it is with the ``qvm-copy-to-vm`` tool in :term:`dom0` terminal: + +.. code:: console + + $ qvm-copy-to-vm qube-name Pictures/screenshot_name.jpg + +Copying files out of :term:`dom0` is generally safe for your system. + +Setting a wallpaper +------------------- + +As mentioned, all desktop environment tools run in :term:`dom0`, and copying files into :term:`dom0` is a big security risk and strongly discouraged. New users often ask: fine, :term:`dom0` needs to be isolated, but how do I then set my own wallpaper in Qubes OS then? The possible solutions are: + +- copy a file into :term:`dom0` in a hacky way (not recommended: this breaks isolation of :term:`dom0` and exposes you to risks from a contaminated graphics file) + +- use screenshots: + - first, display an image you want in **full screen** (you can force full screen by right-clicking on the window title bar, see :doc:`how-to-enter-fullscreen-mode` for more information) + - take a screenshot (as above, :ref:`take a screenshot `) + - use this image as your wallpaper + +To set a wallpaper in the default XFCE desktop environment, you can use the Desktop tool. + +.. figure:: /attachment/doc/howto-screenshot-3.png + :alt: image of Qubes Menu with the page for System Settings tools open and the Desktop application highlighted + :align: center + +Setting an image as wallpaper **within a normal qube** does not influence :term:`dom0` wallpaper (the one you actually see on the screen) in any way. From a205d532f1e5876ec153103c1a702728ecb4e457 Mon Sep 17 00:00:00 2001 From: qubedmaiska Date: Mon, 13 Oct 2025 16:55:32 -0400 Subject: [PATCH 03/17] minor punctuation issue --- user/how-to-guides/how-to-set-a-wallpaper.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/user/how-to-guides/how-to-set-a-wallpaper.rst b/user/how-to-guides/how-to-set-a-wallpaper.rst index dbab5f49..f575f423 100644 --- a/user/how-to-guides/how-to-set-a-wallpaper.rst +++ b/user/how-to-guides/how-to-set-a-wallpaper.rst @@ -4,7 +4,7 @@ How to take screenshots and set a wallpaper In Qubes OS, :term:`dom0` is strongly isolated from the outside world. It has no direct internet connection (for updates, a dedicated UpdateProxy is used to avoid interacting with untrusted data) and copying files into it is highly discouraged and not supported by tools such as ``qvm-copy``. -:term:`dom0` is also where the desktop environment and Qubes OS GUI tools are running (unless you are using the experimental :doc:`sys-gui`, thus, if you take a screenshot or want to set a wallpaper, you will be acting within :term:`dom0`. +:term:`dom0` is also where the desktop environment and Qubes OS GUI tools are running (unless you are using the experimental :doc:`sys-gui`). Thus, if you take a screenshot or want to set a wallpaper, you will be acting within :term:`dom0`. Taking screenshots From 59acb7ffa0777a59c91b70fe7ca7f4c0c1c495de Mon Sep 17 00:00:00 2001 From: qubedmaiska Date: Sun, 19 Oct 2025 19:14:07 -0400 Subject: [PATCH 04/17] merge pr #1540, fixed merge conflicts --- .../general/developing-gui-applications.rst | 2 +- developer/general/how-to-edit-the-website.rst | 4 +- developer/general/package-contributions.rst | 8 +-- developer/general/website-style-guide.rst | 4 +- developer/services/qrexec.rst | 4 +- developer/services/qrexec2.rst | 2 +- introduction/faq.rst | 22 +++--- introduction/issue-tracking.rst | 16 ++--- introduction/privacy.rst | 2 +- introduction/statistics.rst | 2 +- introduction/support.rst | 26 +++---- project-security/security-pack.rst | 2 +- project-security/security.rst | 2 +- project-security/verifying-signatures.rst | 72 +++++++++---------- user/advanced-topics/i3.rst | 2 +- user/advanced-topics/usb-qubes.rst | 14 ++-- .../installation-guide-4.1.rst | 4 +- .../installation-guide.rst | 4 +- .../testing.rst | 2 +- .../upgrade/4_1.rst | 2 +- .../upgrade/4_2.rst | 2 +- .../upgrade/4_3.rst | 2 +- user/hardware/system-requirements.rst | 6 +- .../how-to-back-up-restore-and-migrate.rst | 2 +- user/how-to-guides/how-to-copy-from-dom0.rst | 4 +- .../how-to-guides/how-to-install-software.rst | 4 +- user/how-to-guides/how-to-update.rst | 2 +- .../how-to-use-block-storage-devices.rst | 2 +- user/how-to-guides/how-to-use-usb-devices.rst | 2 + user/security-in-qubes/ctap-proxy.rst | 6 +- user/security-in-qubes/firewall.rst | 2 +- user/security-in-qubes/firewall_4.1.rst | 2 +- user/security-in-qubes/split-gpg.rst | 8 ++- user/templates/debian/debian-upgrade.rst | 4 +- user/templates/debian/debian.rst | 2 +- user/templates/fedora/fedora-upgrade.rst | 2 +- user/templates/fedora/fedora.rst | 2 +- user/templates/templates.rst | 18 ++--- 38 files changed, 137 insertions(+), 131 deletions(-) diff --git a/developer/general/developing-gui-applications.rst b/developer/general/developing-gui-applications.rst index 4eb42d60..00d237aa 100644 --- a/developer/general/developing-gui-applications.rst +++ b/developer/general/developing-gui-applications.rst @@ -63,7 +63,7 @@ If error should be thrown, you need to provide the error code and name, for exam b'2\x00QubesNoSuchPropertyError\x00\x00No such property\x00' -For details of particular calls, you can use `Extending the mock Qubes object <#extending-the-mock-qubes-object>`__. +For details of particular calls, you can use :ref:`developer/general/developing-gui-applications:extending the mock qubes object`. Available mocks --------------- diff --git a/developer/general/how-to-edit-the-website.rst b/developer/general/how-to-edit-the-website.rst index a70e6b1e..37c96862 100644 --- a/developer/general/how-to-edit-the-website.rst +++ b/developer/general/how-to-edit-the-website.rst @@ -24,7 +24,7 @@ hosted on `GitHub `__. A few notes to consider: -- Since Qubes is a security-oriented project, every change will be `reviewed <#security>`__ before it’s accepted. This allows us to maintain quality control and protect our users. +- Since Qubes is a security-oriented project, every change will be :ref:`reviewed ` before it’s accepted. This allows us to maintain quality control and protect our users. - To give your contribution a better chance of being accepted, please follow our :doc:`website style guide `. - We don’t want you to spend time and effort on a contribution that we can’t accept. If your contribution would take a lot of time, please :doc:`file an issue ` for it first so that we can make sure we’re on the same page before significant works begins. - Finally, if you’ve written something that doesn’t belong in `qubesos.github.io `__ but would be beneficial to the Qubes community, please consider adding it to the :doc:`documentation ` or the :ref:`external documentation `. @@ -212,7 +212,7 @@ Once a pull request passes review, the reviewer should add a signed comment stat Questions, problems, and improvements ------------------------------------- -If you have a question about something you read in the website or about how to edit the it, please post it on the `forum `__ or send it to the appropriate :doc:`mailing list `. If you see that something in the website should be fixed or improved, please `contribute <#how-to-submit-a-pull-request>`__ the change yourself. To report an issue with the wesbite, please follow our standard :doc:`issue reporting guidelines `. (If you report an issue with the website, you will likely be asked to submit a pull request for it, unless there is a clear indication in your report that you are not willing or able to do so.) +If you have a question about something you read in the website or about how to edit the it, please post it on the `forum `__ or send it to the appropriate :doc:`mailing list `. If you see that something in the website should be fixed or improved, please :ref:`contribute ` the change yourself. To report an issue with the wesbite, please follow our standard :doc:`issue reporting guidelines `. (If you report an issue with the website, you will likely be asked to submit a pull request for it, unless there is a clear indication in your report that you are not willing or able to do so.) .. |news-section| image:: /attachment/doc/website_news_section.png :alt: Depicts the News section of the Qubes OS website diff --git a/developer/general/package-contributions.rst b/developer/general/package-contributions.rst index 0ea46f52..55ffb9a0 100644 --- a/developer/general/package-contributions.rst +++ b/developer/general/package-contributions.rst @@ -35,7 +35,7 @@ Contribution Procedure Before you start putting serious work into a package, we recommend that you discuss your idea with the Qubes developers and the broader community on the :ref:`qubes-devel mailing list `. Once you have a package that’s ready to become part of Qubes OS, please follow this procedure: -1. Ensure that your package satisfies the `Inclusion Criteria <#inclusion-criteria>`__. +1. Ensure that your package satisfies the :ref:`developer/general/package-contributions:inclusion criteria`. 2. If your code isn’t already on GitHub, create a GitHub repo that contains your code. You can have a look to an example package called `qubes-skeleton `__. @@ -43,7 +43,7 @@ Before you start putting serious work into a package, we recommend that you disc 4. Create an issue in `qubes-issues `__ with the title ``[Contribution] your-package-name``. Include a link to your repo, a brief description of your package, and a brief explanation of why you think it should be included in Qubes. Please note that the Qubes core developers are very busy. If they are under heavy load when you submit your contribution, it may be a very long time before they have time to review your package. If this happens, please do not be discouraged. If you think they may have forgotten about your pending contribution, you may “bump” your request by commenting on your issue, but please do this *very* sparingly (i.e., no more than once a month). We appreciate your understanding! -5. You may be asked followup questions. If we decide to accept your contribution, you will be invited to join the `QubesOS-contrib `__ organization on GitHub as public recognition of your contribution (but without push access; see `Review Procedure <#review-procedure>`__), and `QubesOS-contrib `__ will fork your repo. If we decide not to accept your contribution, we will state the reason and close the issue. +5. You may be asked followup questions. If we decide to accept your contribution, you will be invited to join the `QubesOS-contrib `__ organization on GitHub as public recognition of your contribution (but without push access; see :ref:`developer/general/package-contributions:review procedure`), and `QubesOS-contrib `__ will fork your repo. If we decide not to accept your contribution, we will state the reason and close the issue. @@ -59,7 +59,7 @@ Review Procedure ---------------- -This review procedure covers both original package contributions (see `Contribution Procedure <#contribution-procedure>`__) and all subsequent updates to those packages, including updates from the original package contributor (see `Update Procedure <#update-procedure>`__). All changes will be reviewed by a Qubes Core Reviewer (QCR) and the `Package Maintainer <#package-maintainers>`__ (PM). In all cases, the QCR will be a core Qubes developer. In some cases, the QCR and the PM will be the same person. For example, if someone contributes a package, then disappears, and no suitable replacement has been found, then it is likely that a core Qubes developer will play both the QCR and PM roles for that package, at least until another suitable candidate volunteers to become the PM for that package. +This review procedure covers both original package contributions (see :ref:`developer/general/package-contributions:contribution procedure`) and all subsequent updates to those packages, including updates from the original package contributor (see :ref:`developer/general/package-contributions:update procedure`). All changes will be reviewed by a Qubes Core Reviewer (QCR) and the :ref:`Package Maintainer ` (PM). In all cases, the QCR will be a core Qubes developer. In some cases, the QCR and the PM will be the same person. For example, if someone contributes a package, then disappears, and no suitable replacement has been found, then it is likely that a core Qubes developer will play both the QCR and PM roles for that package, at least until another suitable candidate volunteers to become the PM for that package. The review procedure is as follows: @@ -97,7 +97,7 @@ Package Maintainers If you contribute a package, we assume that you will be the maintainer of that package, unless you tell us otherwise. As the maintainer of the package, it is your privilege and responsibility to: -- `Review <#review-procedure>`__ each pull request made against the package. +- :ref:`Review ` each pull request made against the package. - Decide when the package has reached a new version, and notify the Qubes core developers when this occurs. diff --git a/developer/general/website-style-guide.rst b/developer/general/website-style-guide.rst index 75ed93fc..3e6c923d 100644 --- a/developer/general/website-style-guide.rst +++ b/developer/general/website-style-guide.rst @@ -109,7 +109,7 @@ HTML and CSS ^^^^^^^^^^^^ -Do not write HTML inside Markdown documents (except in rare, unavoidable cases, such as `alerts <#alerts>`__). In particular, never include HTML or CSS for styling, formatting, or white space control. That belongs in the (S)CSS files instead. +Do not write HTML inside Markdown documents (except in rare, unavoidable cases, such as :ref:`developer/general/website-style-guide:alerts`). In particular, never include HTML or CSS for styling, formatting, or white space control. That belongs in the (S)CSS files instead. Headings ^^^^^^^^ @@ -161,7 +161,7 @@ There are two problems with this: -Instead, an example of an appropriate way to stylistically distinguish a portion of text is by using `alerts <#alerts>`__. Consider also that extra styling and visual distinction may not even be necessary. In most cases, traditional writing methods are perfectly sufficient, e.g.,: +Instead, an example of an appropriate way to stylistically distinguish a portion of text is by using :ref:`developer/general/website-style-guide:alerts`. Consider also that extra styling and visual distinction may not even be necessary. In most cases, traditional writing methods are perfectly sufficient, e.g.,: .. code:: markdown diff --git a/developer/services/qrexec.rst b/developer/services/qrexec.rst index fa668893..a744e568 100644 --- a/developer/services/qrexec.rst +++ b/developer/services/qrexec.rst @@ -212,7 +212,7 @@ When calling a service that takes an argument, just add the argument to the serv The script will receive ``ARGUMENT`` as its argument. The argument will also become available as the ``QREXEC_SERVICE_ARGUMENT`` environment variable. This means it is possible to install a different script for a particular service argument. -See `below <#rpc-service-with-argument-file-reader>`__ for an example of an RPC service using an argument. +See :ref:`developer/services/qrexec:rpc service with argument (file reader)` for an example of an RPC service using an argument. Qubes RPC examples ------------------ @@ -278,7 +278,7 @@ RPC service with argument (file reader) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -Here we create an RPC call that reads a specific file from a predefined directory on the target. This example uses an `argument <#service-policies-with-arguments>`__ to the policy. In this example a simplified workflow will be used. The service code is placed directly in the service definition file on the target VM. No separate client script will be needed. +Here we create an RPC call that reads a specific file from a predefined directory on the target. This example uses an :ref:`argument ` to the policy. In this example a simplified workflow will be used. The service code is placed directly in the service definition file on the target VM. No separate client script will be needed. First, on your target VM, create two files in the home directory: ``testfile1`` and ``testfile2``. Have them contain two different “Hello world!” lines. diff --git a/developer/services/qrexec2.rst b/developer/services/qrexec2.rst index 2b62aa7e..f49dfdda 100644 --- a/developer/services/qrexec2.rst +++ b/developer/services/qrexec2.rst @@ -102,7 +102,7 @@ By default, stderr of client and server is logged to respective ``/var/log/qubes Be very careful when coding and adding a new RPC service! Any vulnerability in a RPC server can be fatal to security of the target VM! -If requesting VM-VM (and VM-Dom0) services execution *without cmdline helper*, connect directly to ``/var/run/qubes/qrexec-agent-fdpass`` socket as described `below <#all-the-pieces-together-at-work>`__. +If requesting VM-VM (and VM-Dom0) services execution *without cmdline helper*, connect directly to ``/var/run/qubes/qrexec-agent-fdpass`` socket as described :ref:`below `. Revoking "Yes to All" authorization ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ diff --git a/introduction/faq.rst b/introduction/faq.rst index b916799d..67021932 100644 --- a/introduction/faq.rst +++ b/introduction/faq.rst @@ -25,7 +25,7 @@ The second sense is more complicated. Qubes OS is *mostly* “free as in speech, However, since Qubes OS is a security-focused operating system, it includes some non-free firmware that was not created by the Qubes OS Project (such as CPU microcode), which is necessary in order to protect against known security vulnerabilities. Moreover, the :doc:`architecture ` of Qubes OS as a meta-operating system means that it incorporates other software (including entire operating systems) from various upstream projects, some of which may include non-free software of their own. In order to make the installation process easier for a wide range of users across many different devices, standard Qubes :doc:`templates ` also include some non-free firmware and drivers. -Also see: `Will Qubes seek to get certified under the GNU Free System Distribution Guidelines (GNU FSDG)? <#will-qubes-seek-to-get-certified-under-the-gnu-free-system-distribution-guidelines-gnu-fsdg>`__ +Also see: :ref:`introduction/faq:will qubes seek to get certified under the gnu free system distribution guidelines (gnu fsdg)?` Why is OS security important? ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ @@ -63,7 +63,7 @@ What about privacy in non-Whonix qubes? ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -The main way Qubes OS `provides privacy <#how-does-qubes-os-provide-privacy>`__ is via its `integration with Whonix `__. Qubes OS does not claim to provide special privacy (as opposed to security) properties in non-Whonix qubes. This includes :doc:`disposables `. +The main way Qubes OS :ref:`provides privacy ` is via its `integration with Whonix `__. Qubes OS does not claim to provide special privacy (as opposed to security) properties in non-Whonix qubes. This includes :doc:`disposables `. Privacy is far more difficult than is commonly understood. In addition to the `web browser `__, there is also `VM fingerprinting `__ and `advanced deanonymization attacks `__ that most users have never considered (and this is just to mention a few examples). The `Whonix Project `__ specializes in `protecting against these risks `__. @@ -297,13 +297,13 @@ Instead, Qubes aims to be as free as possible *without sacrificing security*. Al The `four essential freedoms `__ are part of the core of our philosophy, but so is security. Together, they inform our decisions and motivate our actions. Qubes aims to maximize both security and software freedom to the extent that they are compatible in the world today. -Also see `Is Qubes OS free and open-source software? <#is-qubes-os-free-and-open-source-software>`__ and the Qubes OS :doc:`software license `. +Also see :ref:`introduction/faq:is qubes os free and open-source software?` and the Qubes OS :doc:`software license `. Why is the documentation hosted on ReadTheDocs as opposed to the website? ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ The Qubes OS documentation is written in reStructuredText and hosted on `Read The Docs `__. -The infrastructure is largely outside of our control. We don’t consider this a problem, however, since we explicitly `distrust the infrastructure <#what-does-it-mean-to-distrust-the-infrastructure>`__. +The infrastructure is largely outside of our control. We don’t consider this a problem, however, since we explicitly :ref:`distrust the infrastructure `. For this reason, we don’t think that anyone should place undue trust in the live version of this site on the Web. Instead, if you want to obtain your own trustworthy copy of the documentation in a secure way, you should clone our `documentation repo `__, @@ -320,7 +320,7 @@ Should I trust this website? ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -This website is hosted on `GitHub Pages `__ (`why? <#why-do-you-use-github>`__). Therefore, it is largely outside of our control. We don’t consider this a problem, however, since we explicitly `distrust the infrastructure <#what-does-it-mean-to-distrust-the-infrastructure>`__. For this reason, we don’t think that anyone should place undue trust in the live version of this site on the Web. Instead, if you want to obtain your own trustworthy copy of this website in a secure way, you should clone our `website repo `__, :ref:`verify the PGP signatures on the commits and/or tags ` signed by the `doc-signing keys `__ (which indicates that the content has undergone :ref:`review `), then either `render the site on your local machine `__ or simply read the source, the vast majority of which was :ref:`intentionally written in Markdown so as to be readable as plain text for this very reason `. We’ve gone to special effort to set all of this up so that no one has to trust the infrastructure and so that the contents of this website are maximally available and accessible. +This website is hosted on `GitHub Pages `__ (:ref:`why? `). Therefore, it is largely outside of our control. We don’t consider this a problem, however, since we explicitly :ref:`distrust the infrastructure `. For this reason, we don’t think that anyone should place undue trust in the live version of this site on the Web. Instead, if you want to obtain your own trustworthy copy of this website in a secure way, you should clone our `website repo `__, :ref:`verify the PGP signatures on the commits and/or tags ` signed by the `doc-signing keys `__ (which indicates that the content has undergone :ref:`review `), then either `render the site on your local machine `__ or simply read the source, the vast majority of which was :ref:`intentionally written in Markdown so as to be readable as plain text for this very reason `. We’ve gone to special effort to set all of this up so that no one has to trust the infrastructure and so that the contents of this website are maximally available and accessible. What does it mean to "distrust the infrastructure"? @@ -331,7 +331,7 @@ A core tenet of the Qubes philosophy is “distrust the infrastructure,” where Users can never fully control all the infrastructure they rely upon, and they can never fully trust all the entities who do control it. Therefore, we believe the best solution is not to attempt to make the infrastructure trustworthy, but instead to concentrate on solutions that obviate the need to do so. We believe that many attempts to make the infrastructure appear trustworthy actually provide only the illusion of security and are ultimately a disservice to real users. Since we don’t want to encourage or endorse this, we make our distrust of the infrastructure explicit. -Also see: `Should I trust this website? <#should-i-trust-this-website>`__ +Also see: :ref:`introduction/faq:should i trust this website?` Why do you use GitHub? ^^^^^^^^^^^^^^^^^^^^^^ @@ -339,7 +339,7 @@ Why do you use GitHub? Three main reasons: -1. We `distrust the infrastructure <#what-does-it-mean-to-distrust-the-infrastructure>`__ including GitHub (though there are aspects we’re still `working on `__). +1. We :ref:`distrust the infrastructure ` including GitHub (though there are aspects we’re still `working on `__). 2. It’s free (as in beer). We’d have to spend either time or money to implement a solution ourselves or pay someone to do so, and we can’t spare either one right now. @@ -347,13 +347,13 @@ Three main reasons: -Also see: `Should I trust this website? <#should-i-trust-this-website>`__ +Also see: :ref:`introduction/faq:should i trust this website?` Why doesn't this website have security feature X? ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -Although we caution users against `placing undue trust in this website <#should-i-trust-this-website>`__ because we `distrust the infrastructure <#what-does-it-mean-to-distrust-the-infrastructure>`__, we have no objection to enabling website security features when doing so is relatively costless and provides some marginal benefit to website visitors. So, if feature X isn’t enabled, it’s most likely for one of three reasons: +Although we caution users against :ref:`placing undue trust in this website ` because we :ref:`distrust the infrastructure `, we have no objection to enabling website security features when doing so is relatively costless and provides some marginal benefit to website visitors. So, if feature X isn’t enabled, it’s most likely for one of three reasons: 1. Our GitHub Pages platform doesn’t support it. @@ -457,7 +457,7 @@ Why is VT-d/AMD-Vi/AMD IOMMU important? ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -On a system without VT-d/AMD-Vi/AMD IOMMU, there will be no real security benefit to having a separate NetVM, as an attacker could always use a simple `DMA attack <#what-is-a-dma-attack>`__ to go from the NetVM to Dom0. Nonetheless, all of Qubes’ other security mechanisms, such as qube separation, work without VT-d/AMD-Vi/AMD IOMMU. Therefore, a system running Qubes without VT-d/AMD-Vi/AMD IOMMU would still be significantly more secure than one running Windows, Mac, or Linux. +On a system without VT-d/AMD-Vi/AMD IOMMU, there will be no real security benefit to having a separate NetVM, as an attacker could always use a simple :ref:`DMA attack ` to go from the NetVM to Dom0. Nonetheless, all of Qubes’ other security mechanisms, such as qube separation, work without VT-d/AMD-Vi/AMD IOMMU. Therefore, a system running Qubes without VT-d/AMD-Vi/AMD IOMMU would still be significantly more secure than one running Windows, Mac, or Linux. What is a DMA attack? ^^^^^^^^^^^^^^^^^^^^^ @@ -735,7 +735,7 @@ Could you please make my preference the default? It would be great if Qubes were configured just the way we like it by default with all of our favorite programs and settings. Then, we could just install Qubes without having to install any programs in it or adjust any settings. We might even think that if a particular program or setting works so well for *us*, it would work well for *everyone*, so we’d actually be doing everyone a favor! The problem is that Qubes has :doc:`tens of thousands of different users ` with radically different needs and purposes. There is no particular configuration that will be ideal for everyone (despite how much we might feel that our preference would be better for everyone), so the best we can do is to put power in the hands of users to configure their Qubes installations the way they like (subject to security constraints, of course). For this reason, we generally do not grant requests for people’s favorite programs to be installed by default or for some setting that obviously varies by user preference to be changed so that it matches the requester’s preference. -See also: `What is Qubes’ attitude toward changing guest distros? <#what-is-qubes-attitude-toward-changing-guest-distros>`__ +See also: :ref:`introduction/faq:what is qubes' attitude toward changing guest distros?` Software installed in a qube is gone after restarting. Why? ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ diff --git a/introduction/issue-tracking.rst b/introduction/issue-tracking.rst index e5573a71..2ac7e394 100644 --- a/introduction/issue-tracking.rst +++ b/introduction/issue-tracking.rst @@ -35,13 +35,13 @@ I still want to open an issue. Great! Thank you for taking the time and effort to help improve Qubes! To ensure the process is efficient and productive for everyone involved, please follow these steps: -1. Carefully read our issue tracking `guidelines <#guidelines>`__. If your issue would violate any of the guidelines, **stop**. Please do not submit it. +1. Carefully read our issue tracking :ref:`introduction/issue-tracking:guidelines`. If your issue would violate any of the guidelines, **stop**. Please do not submit it. -2. `Search through the existing issues <#search-tips>`__, both open and closed, to see if your issue already exists. If it does, **stop**. :ref:`Do not open a duplicate. ` Instead, comment on the existing issue. +2. :ref:`Search through the existing issues `, both open and closed, to see if your issue already exists. If it does, **stop**. :ref:`Do not open a duplicate. ` Instead, comment on the existing issue. 3. Go `here `__. -4. Select the `type <#types>`__ of issue you want to open. +4. Select the :ref:`type ` of issue you want to open. 5. Enter a descriptive title. @@ -119,7 +119,7 @@ Meta-issues ^^^^^^^^^^^ -A meta-issue is an issue that serves primarily to collect and organize a group of other issues. This group of other issues typically exists in a hierarchy of `sub-issues `__, usually with the meta-issue at the top. (For example, we use meta-issues when we need a way to track work on specific features. We cannot use `projects <#projects>`__ for this, because we already use a project for tracking the work of the Qubes team as a whole, and projects cannot contain milestones or other projects.) +A meta-issue is an issue that serves primarily to collect and organize a group of other issues. This group of other issues typically exists in a hierarchy of `sub-issues `__, usually with the meta-issue at the top. (For example, we use meta-issues when we need a way to track work on specific features. We cannot use :ref:`introduction/issue-tracking:projects` for this, because we already use a project for tracking the work of the Qubes team as a whole, and projects cannot contain milestones or other projects.) Meta-issues should have informative descriptions, not just lists of issues. In particular, each meta-issue should explain its goal, what is in scope, and what the relevant categories and priorities are. @@ -149,7 +149,7 @@ The issue tracker is not a discussion forum The issue tracker is a tool to help the developers be more productive and efficient in their work. It is not a place for discussion. If you wish to discuss something in the issue tracker, please do so on the forum or mailing lists (see :doc:`Help, Support, Mailing Lists, and Forum `). You can simply link to the relevant issue in your discussion post. -This guideline is important for keeping issues focused on *actionable information*, which helps the developers to stay focused on their work. When developers come back to an issue to work on it, we do not want them to have to sift through a large number of unnecessary comments before they can get started. In many cases, an issue that gets “too big” essentially becomes more trouble than it’s worth, and no developer will touch it (also see `every issue must be about a single, actionable thing <#every-issue-must-be-about-a-single-actionable-thing>`__). In these cases, we sometimes have to close the issue and open a new one. This is a waste of energy for everyone involved, so we ask that everyone help to avoid repeating this pattern. +This guideline is important for keeping issues focused on *actionable information*, which helps the developers to stay focused on their work. When developers come back to an issue to work on it, we do not want them to have to sift through a large number of unnecessary comments before they can get started. In many cases, an issue that gets “too big” essentially becomes more trouble than it’s worth, and no developer will touch it (also see :ref:`introduction/issue-tracking:every issue must be about a single, actionable thing`). In these cases, we sometimes have to close the issue and open a new one. This is a waste of energy for everyone involved, so we ask that everyone help to avoid repeating this pattern. Do not submit questions ^^^^^^^^^^^^^^^^^^^^^^^ @@ -171,7 +171,7 @@ Every issue must be about a single, actionable thing If your issue is not actionable, please see :doc:`Help, Support, Mailing Lists, and Forum ` for the appropriate place to post it. If your issue would be about more than one thing, file them as separate issues instead. This means we should generally not try to use a single issue as a “meta” or “epic” issue that exists only to group, contain, or track other issues. Instead, when there is a need to group multiple related issues together, use `projects `__. -This guideline is extremely important for making the issue tracker a useful tool for the developers. When an issue is too big and composite, it becomes intractable and drastically increases the likelihood that nothing will get done. Such issues also tend to encourage an excessive amount of general discussion that is simply not appropriate for a technical issue tracker (see `the issue tracker is not a discussion forum <#the-issue-tracker-is-not-a-discussion-forum>`__). +This guideline is extremely important for making the issue tracker a useful tool for the developers. When an issue is too big and composite, it becomes intractable and drastically increases the likelihood that nothing will get done. Such issues also tend to encourage an excessive amount of general discussion that is simply not appropriate for a technical issue tracker (see :ref:`introduction/issue-tracking:the issue tracker is not a discussion forum`). Every issue must be of a single type ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ @@ -206,7 +206,7 @@ Issues and comments must be written in English ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -If English is not your native language, you may post a machine translation. If you wish, you may also include the original non-English text in a `collapsible section <#use-collapsible-sections-for-long-nonessential-content>`__. +If English is not your native language, you may post a machine translation. If you wish, you may also include the original non-English text in a :ref:`collapsible section `. Use collapsible sections for long, nonessential content ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ @@ -249,7 +249,7 @@ Being closed as ``completed`` means that the issue has been fixed (in the case o Being closed as ``not planned`` means that the issue will *not* be fixed (in the case of bugs) or done (in the case of enhancements and tasks). When an issue is closed as ``not planned``, we add a **resolution** label starting with ``R:`` that specifies the reason for the closure, such as ``R: duplicate`` or ``R: cannot reproduce``. Each of these labels has a description that briefly explains the label. We also leave a comment containing a longer explanation for why the issue is being closed along with general information. -While issues that are closed as ``not planned`` get a more specific resolution label, issues that are closed as ``completed`` do not always get one, since the linked PRs, commits, automated messages, and the ``completed`` reason itself are often sufficient to convey all relevant information. For information about using closure reasons in searches, see `Search tips <#search-tips>`__. +While issues that are closed as ``not planned`` get a more specific resolution label, issues that are closed as ``completed`` do not always get one, since the linked PRs, commits, automated messages, and the ``completed`` reason itself are often sufficient to convey all relevant information. For information about using closure reasons in searches, see :ref:`introduction/issue-tracking:search tips`. Backports ^^^^^^^^^ diff --git a/introduction/privacy.rst b/introduction/privacy.rst index 66a3f241..0e3459b9 100644 --- a/introduction/privacy.rst +++ b/introduction/privacy.rst @@ -54,7 +54,7 @@ Mirrors ------- -There are also other third-party mirrors hosted by volunteers. These are used both for `ISO downloads `__ and `updates <#update-servers-and-repositories>`__. We have no control over what data these mirrors collect or with whom they share it. Please see the privacy policy of each respective mirror operator. +There are also other third-party mirrors hosted by volunteers. These are used both for `ISO downloads `__ and :ref:`updates `. We have no control over what data these mirrors collect or with whom they share it. Please see the privacy policy of each respective mirror operator. Qubes OS -------- diff --git a/introduction/statistics.rst b/introduction/statistics.rst index 867ea855..bafbe11d 100644 --- a/introduction/statistics.rst +++ b/introduction/statistics.rst @@ -28,7 +28,7 @@ How is the userbase estimated? ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -We simply count the number of unique IPv4 addresses that connect to the Qubes update servers each month (except for Tor connections; see `below <#how-are-tor-users-counted>`__). (**Note:** Users who have manually configured their systems to bypass the metalink and connect directly to a mirror are not counted.) +We simply count the number of unique IPv4 addresses that connect to the Qubes update servers each month (except for Tor connections; see :ref:`introduction/statistics:how are tor users counted?`). (**Note:** Users who have manually configured their systems to bypass the metalink and connect directly to a mirror are not counted.) How are Tor users counted? ^^^^^^^^^^^^^^^^^^^^^^^^^^ diff --git a/introduction/support.rst b/introduction/support.rst index 724edc24..79c76dc0 100644 --- a/introduction/support.rst +++ b/introduction/support.rst @@ -3,7 +3,7 @@ Help, support, mailing lists, and forum ======================================= -The Qubes community is here to help! Since Qubes is a security-oriented operating system, we want to make sure you `stay safe <#staying-safe>`__ as you get the support you need, and we want to make sure our community remains a friendly and productive place by ensuring we all follow the :doc:`Code of Conduct ` and `discussion guidelines <#discussion-guidelines>`__. +The Qubes community is here to help! Since Qubes is a security-oriented operating system, we want to make sure you :ref:`stay safe ` as you get the support you need, and we want to make sure our community remains a friendly and productive place by ensuring we all follow the :doc:`/introduction/code-of-conduct` and :ref:`introduction/support:discussion guidelines`. How to get help and support --------------------------- @@ -17,7 +17,7 @@ I have a problem or a question. No worries! Here’s how we recommend proceeding: -1. Check the :doc:`documentation `. There may already be a page about it. Specifically, check out the :ref:`How-To Guides ` and :ref:`Troubleshooting ` sections. +1. Check the :doc:`documentation `. There may already be a page about it. Specifically, check out the :ref:`how-to-guides` and :ref:`troubleshooting` sections. 2. Search the :doc:`FAQ `. Your question might already be answered. @@ -33,37 +33,37 @@ I didn't find a solution or an answer! ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -Sorry to hear that! In that case, we recommend asking for help on the `Qubes Forum `__ or on the `qubes-users mailing list <#qubes-users>`__. Choose the venue you prefer, but please don’t ask on both at the same time! Before you ask, please review our `discussion guidelines <#discussion-guidelines>`__ and StackOverflow’s advice on `how to ask good questions `__. Don’t forget to `stay safe <#staying-safe>`__! +Sorry to hear that! In that case, we recommend asking for help on the `Qubes Forum `__ or on the :ref:`qubes-users mailing list `. Choose the venue you prefer, but please don’t ask on both at the same time! Before you ask, please review our :ref:`introduction/support:discussion guidelines` and StackOverflow’s advice on `how to ask good questions `__. Don’t forget to :ref:`stay safe `! I don't need support, but I think I found a bug. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -We’d be grateful if you reported it (but please make sure no one else has already reported it first)! Please see :doc:`Issue Tracking ` for details. +We’d be grateful if you reported it (but please make sure no one else has already reported it first)! Please see :doc:`/introduction/issue-tracking` for details. I don't need support, but I'd like to request a feature. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -No promises, but we’d be happy to consider it! Please see :doc:`Issue Tracking ` for details. +No promises, but we’d be happy to consider it! Please see :doc:`/introduction/issue-tracking` for details. Where's the best place to discuss Qubes? ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -That would be the `Qubes Forum `__ and the `qubes-users mailing list <#qubes-users>`__. Please have a look at our `discussion guidelines <#discussion-guidelines>`__ before diving in. Enjoy! +That would be the `Qubes Forum `__ and the :ref:`qubes-users mailing list `. Please have a look at our :ref:`introduction/support:discussion guidelines` before diving in. Enjoy! How can I get involved and contribute? ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -Thank you for asking! Please see :doc:`How to Contribute ` for all the ways you can do so. +Thank you for asking! Please see :doc:`/introduction/contributing` for all the ways you can do so. I would like to report a security vulnerability. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -That sounds more like you helping us! Thanks! Please see :ref:`Reporting Security Issues in Qubes OS `. +That sounds more like you helping us! Thanks! Please see :ref:`project-security/security:reporting security issues in qubes os`. Staying safe ------------ @@ -83,7 +83,7 @@ Discussion guidelines --------------------- -Qubes discussions mainly take place on ``qubes-users``, ``qubes-devel``, and our `forum <#forum>`__, all of which are explained below. Most questions should be directed to ``qubes-users`` or the `forum <#forum>`__. **Please do not send questions to individual Qubes developers.** By sending a message to the appropriate mailing list, you are not only giving others a chance to help you, but you may also be helping others by starting a public discussion about a shared problem or interest. +Qubes discussions mainly take place on ``qubes-users``, ``qubes-devel``, and our :ref:`introduction/support:forum`, all of which are explained below. Most questions should be directed to ``qubes-users`` or the :ref:`introduction/support:forum`. **Please do not send questions to individual Qubes developers.** By sending a message to the appropriate mailing list, you are not only giving others a chance to help you, but you may also be helping others by starting a public discussion about a shared problem or interest. These are open venues where people freely come together to discuss Qubes and voluntarily help each other out of mutual interest and good will. They are *not* your personal, paid support service. **No one owes you a reply.** No one here is responsible for solving your problems for you. Nonetheless, there are many things you can do to make it more likely that you will receive a reply. This community is fortunate to have an exceptionally large number of friendly and knowledgeable people who enjoy corresponding on these lists. The vast majority of them will be happy to help you if you follow these simple guidelines. @@ -103,7 +103,7 @@ Help us help you ^^^^^^^^^^^^^^^^ -Tell us what you’ve already tried, and which documentation pages you’ve already read. Put yourself in your readers’ shoes. What essential information would they require in order to be able to help you? Make sure to include that information in your message. A great way to provide your hardware details is by :ref:`generating and submitting a Hardware Compatibility List (HCL) report `, then linking to it in your message. `Ask questions the smart way. `__ +Tell us what you’ve already tried, and which documentation pages you’ve already read. Put yourself in your readers’ shoes. What essential information would they require in order to be able to help you? Make sure to include that information in your message. A great way to provide your hardware details is by :ref:`generating and submitting a Hardware Compatibility List (HCL) new report `, then linking to it in your message. `Ask questions the smart way. `__ Be patient ^^^^^^^^^^ @@ -121,7 +121,7 @@ Report issues and submit changes in the right places ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -The mailing lists and `forum <#forum>`__ are good places to ask questions and discuss things. However, if you’re submitting a more formal report, we’d prefer that you submit it to our :doc:`issue tracker ` so that it doesn’t get overlooked. (However, please remember that :ref:`the issue tracker is not a discussion forum `.) Likewise, if you see that something in the documentation should be changed, don’t simply point it out in a discussion venue. Instead, :doc:`submit the change `. +The mailing lists and :ref:`introduction/support:forum` are good places to ask questions and discuss things. However, if you’re submitting a more formal report, we’d prefer that you submit it to our :doc:`issue tracker ` so that it doesn’t get overlooked. (However, please remember that :ref:`introduction/issue-tracking:the issue tracker is not a discussion forum`.) Likewise, if you see that something in the documentation should be changed, don’t simply point it out in a discussion venue. Instead, :doc:`submit the change `. Moderation ^^^^^^^^^^ @@ -185,7 +185,7 @@ Google Groups ^^^^^^^^^^^^^ -While the mailing lists are implemented as Google Group web forums, a Google account is in no way required, expected, or encouraged. Many discussants (including most members of the Qubes team) treat these lists as conventional `mailing lists `__, interacting with them solely through plain text email with `MUAs `__ like `Thunderbird `__ and `Mutt `__. The Google Groups service is just free infrastructure, and we :ref:`distrust the infrastructure `. This is why, for example, we encourage discussants to use :doc:`Split GPG ` to sign all of their messages to the lists, but we do not endorse the use of these Google Groups as web forums. For that, we have a separate, dedicated `forum <#forum>`__. +While the mailing lists are implemented as Google Group web forums, a Google account is in no way required, expected, or encouraged. Many discussants (including most members of the Qubes team) treat these lists as conventional `mailing lists `__, interacting with them solely through plain text email with `MUAs `__ like `Thunderbird `__ and `Mutt `__. The Google Groups service is just free infrastructure, and we :ref:`distrust the infrastructure `. This is why, for example, we encourage discussants to use :doc:`Split GPG ` to sign all of their messages to the lists, but we do not endorse the use of these Google Groups as web forums. For that, we have a separate, dedicated :ref:`introduction/support:forum`. Mailing lists ------------- @@ -337,7 +337,7 @@ The Qubes OS Project has a presence on the following social media platforms: -Generally speaking, these are not intended to be primary support venues. (Those would be `qubes-users <#qubes-users>`__ and the `forum <#forum>`__.) Rather, these are primarily intended to be a way to more widely disseminate items published on the `news `__ page. If you use one of these platforms, you may find it convenient to follow the Qubes OS Project there as a way of receiving Qubes news. +Generally speaking, these are not intended to be primary support venues. (Those would be :ref:`introduction/support:qubes-users` and the :ref:`introduction/support:forum`.) Rather, these are primarily intended to be a way to more widely disseminate items published on the `news `__ page. If you use one of these platforms, you may find it convenient to follow the Qubes OS Project there as a way of receiving Qubes news. Chat ---- diff --git a/project-security/security-pack.rst b/project-security/security-pack.rst index b187e90c..1b6b5587 100644 --- a/project-security/security-pack.rst +++ b/project-security/security-pack.rst @@ -42,7 +42,7 @@ The following example demonstrates one method of obtaining the qubes-secpack and Checking connectivity... done. -2. Import the included PGP keys. See our `PGP key policies <#pgp-key-policies>`__ for important information about these keys. +2. Import the included PGP keys. See our :ref:`project-security/security-pack:pgp key policies` for important information about these keys. .. code:: console diff --git a/project-security/security.rst b/project-security/security.rst index da93b6ca..c746e903 100644 --- a/project-security/security.rst +++ b/project-security/security.rst @@ -51,7 +51,7 @@ Qubes security team The **Qubes security team (QST)** is the subset of the `core team `__ that is responsible for ensuring the security of Qubes OS and the Qubes OS Project. In particular, the QST is responsible for: -- Responding to `reported security issues <#reporting-security-issues-in-qubes-os>`__ +- Responding to :ref:`reported security issues ` - Evaluating whether `XSAs `__ affect the security of Qubes OS diff --git a/project-security/verifying-signatures.rst b/project-security/verifying-signatures.rst index b03ec0b5..3d266e5c 100644 --- a/project-security/verifying-signatures.rst +++ b/project-security/verifying-signatures.rst @@ -35,7 +35,7 @@ We use `PGP `__ (specifically **Windows:** `Gpg4win `__ (`documentation `__). Use the Windows command line (``cmd.exe``) to enter commands. -Throughout this page, we’ll use GnuPG via the ``gpg2`` command. If that doesn’t work for you, try ``gpg`` instead. If that still doesn’t work, please consult the documentation for your specific program (see links above) and the `troubleshooting FAQ <#troubleshooting-faq>`__ below. +Throughout this page, we’ll use GnuPG via the ``gpg2`` command. If that doesn’t work for you, try ``gpg`` instead. If that still doesn’t work, please consult the documentation for your specific program (see links above) and the :ref:`project-security/verifying-signatures:troubleshooting faq` below. How to import and authenticate the Qubes Master Signing Key ----------------------------------------------------------- @@ -45,7 +45,7 @@ Many important Qubes OS Project assets (e.g., ISOs, RPMs, TGZs, and Git objects) The developer signing keys are set to expire after one year, while the QMSK and RSKs have no expiration date. The QMSK was generated on and is kept only on a dedicated, air-gapped “vault” machine, and the private portion will (hopefully) never leave this isolated machine. -Before we proceed, you must first complete the prerequisite step of `installing OpenPGP software <#openpgp-software>`__. +Before we proceed, you must first complete the prerequisite step of :ref:`installing OpenPGP software `. Once you have appropriate OpenPGP software installed, there are several ways to get the QMSK. @@ -222,7 +222,7 @@ As a final sanity check, make sure the QMSK is in your keyring with the correct -If you don’t see the QMSK here with a trust level of “ultimate,” go back and follow the instructions in this section carefully and consult the `troubleshooting FAQ <#troubleshooting-faq>`__ below. +If you don’t see the QMSK here with a trust level of “ultimate,” go back and follow the instructions in this section carefully and consult the :ref:`project-security/verifying-signatures:troubleshooting faq` below. How to import and authenticate release signing keys --------------------------------------------------- @@ -232,9 +232,9 @@ Every Qubes OS release is signed by a **release signing key (RSK)**, which is, i Before we proceed, you must first complete the following prerequisite steps: -1. `Install OpenPGP software. <#openpgp-software>`__ +1. :ref:`Install OpenPGP software. ` -2. `Import and authenticate the QMSK. <#how-to-import-and-authenticate-the-qubes-master-signing-key>`__ +2. :ref:`Import and authenticate the QMSK. ` @@ -289,7 +289,7 @@ As a final sanity check, make sure the RSK is in your keyring with the correct t uid [ full ] Qubes OS Release X Signing Key -If you don’t see the correct RSK here with a trust level of “full” or higher, go back and follow the instructions in this section carefully, and consult the `troubleshooting FAQ <#troubleshooting-faq>`__ below. +If you don’t see the correct RSK here with a trust level of “full” or higher, go back and follow the instructions in this section carefully, and consult the :ref:`project-security/verifying-signatures:troubleshooting faq` below. How to obtain and authenticate other signing keys ------------------------------------------------- @@ -301,15 +301,15 @@ How to verify the cryptographic hash values of Qubes ISOs --------------------------------------------------------- -There are two ways to verify Qubes ISOs: cryptographic hash values and detached PGP signatures. Both methods are equally secure. Using just one method is sufficient to verify your Qubes ISO. Using both methods is not necessary, but you can do so if you like. One method might be more convenient than another in certain circumstances, so we provide both. This section covers cryptographic hash values. For the other method, see `how to verify detached PGP signatures on Qubes ISOs <#how-to-verify-detached-pgp-signatures-on-qubes-isos>`__. +There are two ways to verify Qubes ISOs: cryptographic hash values and detached PGP signatures. Both methods are equally secure. Using just one method is sufficient to verify your Qubes ISO. Using both methods is not necessary, but you can do so if you like. One method might be more convenient than another in certain circumstances, so we provide both. This section covers cryptographic hash values. For the other method, see :ref:`project-security/verifying-signatures:how to verify detached pgp signatures on qubes isos`. Before we proceed, you must first complete the following prerequisite steps: -1. `Install OpenPGP software. <#openpgp-software>`__ +1. :ref:`Install OpenPGP software. ` -2. `Import and authenticate the Qubes Master Signing Key. <#how-to-import-and-authenticate-the-qubes-master-signing-key>`__ +2. :ref:`Import and authenticate the Qubes Master Signing Key. ` -3. `Import and authenticate your release signing key. <#how-to-import-and-authenticate-release-signing-keys>`__ +3. :ref:`Import and authenticate your release signing key. ` @@ -401,21 +401,21 @@ However, it is possible that an attacker replaced ``Qubes-RX-x86_64.iso`` with a This is just an example, so the output you receive will not look exactly the same. What matters is the line that says ``Good signature from "Qubes OS Release X Signing Key"``. This confirms that the signature on the digest file is good. -If you don’t see a good signature here, go back and follow the instructions in this section carefully, and consult the `troubleshooting FAQ <#troubleshooting-faq>`__ below. +If you don’t see a good signature here, go back and follow the instructions in this section carefully, and consult the :ref:`project-security/verifying-signatures:troubleshooting faq` below. How to verify detached PGP signatures on Qubes ISOs --------------------------------------------------- -There are two ways to verify Qubes ISOs: cryptographic hash values and detached PGP signatures. Both methods are equally secure. Using just one method is sufficient to verify your Qubes ISO. Using both methods is not necessary, but you can do so if you like. One method might be more convenient than another in certain circumstances, so we provide both. This section covers detached PGP signatures. For the other method, see `how to verify the cryptographic hash values of Qubes ISOs <#how-to-verify-the-cryptographic-hash-values-of-qubes-isos>`__. +There are two ways to verify Qubes ISOs: cryptographic hash values and detached PGP signatures. Both methods are equally secure. Using just one method is sufficient to verify your Qubes ISO. Using both methods is not necessary, but you can do so if you like. One method might be more convenient than another in certain circumstances, so we provide both. This section covers detached PGP signatures. For the other method, see :ref:`project-security/verifying-signatures:how to verify the cryptographic hash values of qubes isos`. Before we proceed, you must first complete the following prerequisite steps: -1. `Install OpenPGP software. <#openpgp-software>`__ +1. :ref:`Install OpenPGP software. ` -2. `Import and authenticate the Qubes Master Signing Key. <#how-to-import-and-authenticate-the-qubes-master-signing-key>`__ +2. :ref:`Import and authenticate the Qubes Master Signing Key. ` -3. `Import and authenticate your release signing key. <#how-to-import-and-authenticate-release-signing-keys>`__ +3. :ref:`Import and authenticate your release signing key. ` @@ -435,7 +435,7 @@ Download both the ISO and its signature file. Put both of them in the same direc This is just an example, so the output you receive will not look exactly the same. What matters is the line that says ``Good signature from "Qubes OS Release X Signing Key"``. This confirms that the signature on the ISO is good. -If you don’t see a good signature here, go back and follow the instructions in this section carefully, and consult the `troubleshooting FAQ <#troubleshooting-faq>`__ below. +If you don’t see a good signature here, go back and follow the instructions in this section carefully, and consult the :ref:`project-security/verifying-signatures:troubleshooting faq` below. How to re-verify installation media after writing ------------------------------------------------- @@ -447,7 +447,7 @@ After you have authenticated your Qubes ISO and written it onto your desired med This section will walk through an example of re-verifying the installer on such a device. We begin by assuming that you have just :ref:`written your desired Qubes ISO onto the USB drive `. First, unplug your USB drive and flip the write protect switch so that the data on the drive can no longer be altered. If you have a different computer from the one you used to create the installation medium, consider using that computer. If not, try to at least use a fresh VM (e.g., if it’s a Qubes system). The idea is that the original machine may have been compromised, and using a different one for re-verification forces your hypothetical adversary to compromise an additional machine in order to succeed. -Now, our goal is to perform the same verification steps as we did with the original ISO, except, this time, we’ll be reading the installer data directly from the write-protected USB drive instead of from the original ISO file. First, let’s compute the SHA-256 hash value of the data on the drive. (This assumes you’re already familiar with `how to verify the cryptographic hash values of Qubes ISOs <#how-to-verify-the-cryptographic-hash-values-of-qubes-isos>`__.) In order to do this, we have to know the exact size, in bytes, of the original ISO. There are two ways to get this information: from the ISO itself and from the Qubes website. Here’s an example of the first way: +Now, our goal is to perform the same verification steps as we did with the original ISO, except, this time, we’ll be reading the installer data directly from the write-protected USB drive instead of from the original ISO file. First, let’s compute the SHA-256 hash value of the data on the drive. (This assumes you’re already familiar with :ref:`project-security/verifying-signatures:how to verify the cryptographic hash values of qubes isos`.) In order to do this, we have to know the exact size, in bytes, of the original ISO. There are two ways to get this information: from the ISO itself and from the Qubes website. Here’s an example of the first way: .. code:: console @@ -479,7 +479,7 @@ Therefore, in order to make things a bit more difficult for your hypothetical ad If you wish to compute the values of other hash functions, you can replace ``sha256sum``, e.g., with ``md5sum``, ``sha1sum``, or ``sha512sum``. -In addition to checking hash values, you can also use GnuPG to verify the detached PGP signature directly against the data on the USB drive. (This assumes you’re already familiar with `how to verify detached PGP signatures on Qubes ISOs <#how-to-verify-detached-pgp-signatures-on-qubes-isos>`__.) +In addition to checking hash values, you can also use GnuPG to verify the detached PGP signature directly against the data on the USB drive. (This assumes you’re already familiar with :ref:`project-security/verifying-signatures:how to verify detached pgp signatures on qubes isos`.) .. code:: console @@ -496,7 +496,7 @@ In addition to checking hash values, you can also use GnuPG to verify the detach (Where ``/dev/sdX`` is your USB drive, ```` is the size of the original ISO in bytes, and ``Qubes-RX-x86_64.iso.asc`` is the detached signature file of the original ISO.) -This command reads the exact number of bytes from your USB drive as the size of the original ISO and pipes them into ``gpg``. The usual form of a ``gpg`` verification command is ``gpg --verify ``. Our command is using shell redirection in order to use data from your USB drive as the ````, which is why the ``-`` at the end of the command is required. Remember that you still must have properly imported and trusted the `QMSK <#how-to-import-and-authenticate-the-qubes-master-signing-key>`__ and appropriate `RSK <#how-to-import-and-authenticate-release-signing-keys>`__ in order for this to work. You should receive a ``Good signature`` message for the appropriate RSK, which should be signed by a copy of the QMSK that you previously confirmed to be genuine. +This command reads the exact number of bytes from your USB drive as the size of the original ISO and pipes them into ``gpg``. The usual form of a ``gpg`` verification command is ``gpg --verify ``. Our command is using shell redirection in order to use data from your USB drive as the ````, which is why the ``-`` at the end of the command is required. Remember that you still must have properly imported and trusted the :ref:`QMSK ` and appropriate :ref:`RSK ` in order for this to work. You should receive a ``Good signature`` message for the appropriate RSK, which should be signed by a copy of the QMSK that you previously confirmed to be genuine. How to verify signatures on Git repository tags and commits ----------------------------------------------------------- @@ -504,9 +504,9 @@ How to verify signatures on Git repository tags and commits Before we proceed, you must first complete the following prerequisite steps: -1. `Install OpenPGP software. <#openpgp-software>`__ +1. :ref:`Install OpenPGP software. ` -2. `Import and authenticate the Qubes Master Signing Key. <#how-to-import-and-authenticate-the-qubes-master-signing-key>`__ +2. :ref:`Import and authenticate the Qubes Master Signing Key. ` 3. :doc:`Import and authenticate keys from the Qubes security pack (qubes-secpack). ` Please see our :ref:`PGP key policies ` for important information about these keys. @@ -556,7 +556,7 @@ Why am I getting "Can't check signature: public key not found"? ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -You don’t have the correct `release signing key <#how-to-import-and-authenticate-release-signing-keys>`__. +You don’t have the correct :ref:`release signing key `. Why am I getting "BAD signature from ‘Qubes OS Release X Signing Key'"? ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ @@ -568,7 +568,7 @@ The problem could be one or more of the following: - You’re using the wrong GPG command. Follow the provided examples carefully, or try using ``gpg`` instead of ``gpg2`` (or vice versa). -- The ISO or `detached PGP signature file <#how-to-verify-detached-pgp-signatures-on-qubes-isos>`__ is bad (e.g., incomplete or corrupt download). Try downloading the signature file again from a different source, then try verifying again. If you still get the same result, try downloading the ISO again from a different source, then try verifying again. +- The ISO or :ref:`detached PGP signature file ` is bad (e.g., incomplete or corrupt download). Try downloading the signature file again from a different source, then try verifying again. If you still get the same result, try downloading the ISO again from a different source, then try verifying again. @@ -594,13 +594,13 @@ Why am I getting "can't open ‘Qubes-RX-x86_64.iso.asc' / verify signatures fai ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -The correct `detached PGP signature file <#how-to-verify-detached-pgp-signatures-on-qubes-isos>`__ is not in your working directory. +The correct :ref:`detached PGP signature file ` is not in your working directory. Why am I getting "no valid OpenPGP data found"? ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -Either you don’t have the correct `detached PGP signature file <#how-to-verify-detached-pgp-signatures-on-qubes-isos>`__, or you inverted the arguments to ``gpg2``. (The signature file goes first.) +Either you don’t have the correct :ref:`detached PGP signature file `, or you inverted the arguments to ``gpg2``. (The signature file goes first.) Why am I getting "WARNING: This key is not certified with a trusted signature! There is no indication that the signature belongs to the owner."? ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ @@ -608,11 +608,11 @@ Why am I getting "WARNING: This key is not certified with a trusted signature! T There are several possibilities: -- You don’t have the `Qubes Master Signing Key <#how-to-import-and-authenticate-the-qubes-master-signing-key>`__. +- You don’t have the :ref:`Qubes Master Signing Key `. -- You have not `set the Qubes Master Signing Key’s trust level correctly. <#how-to-import-and-authenticate-the-qubes-master-signing-key>`__ +- You have not :ref:`set the Qubes Master Signing Key’s trust level correctly. ` -- In the case of a key that is not directly signed by the Qubes Master Signing Key, you have not `set that key’s trust level correctly. <#how-to-verify-signatures-on-git-repository-tags-and-commits>`__ +- In the case of a key that is not directly signed by the Qubes Master Signing Key, you have not :ref:`set that key’s trust level correctly. ` @@ -620,7 +620,7 @@ Why am I getting "X signature not checked due to a missing key"? ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -You don’t have the keys that created those signatures in your keyring. For the purpose of verifying a Qubes ISO, you don’t need them as long as you have the `Qubes Master Signing Key <#how-to-import-and-authenticate-the-qubes-master-signing-key>`__ and the `release signing key <#how-to-import-and-authenticate-release-signing-keys>`__ for your Qubes release. +You don’t have the keys that created those signatures in your keyring. For the purpose of verifying a Qubes ISO, you don’t need them as long as you have the :ref:`Qubes Master Signing Key ` and the :ref:`release signing key ` for your Qubes release. Why am I seeing additional signatures on a key with "[User ID not found]" or from a revoked key? ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ @@ -632,21 +632,21 @@ Why am I getting "verify signatures failed: unexpected data"? ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -You’re not verifying against the correct `detached PGP signature file <#how-to-verify-detached-pgp-signatures-on-qubes-isos>`__. +You’re not verifying against the correct :ref:`detached PGP signature file `. Why am I getting "not a detached signature"? ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -You’re not verifying against the correct `detached PGP signature file <#how-to-verify-detached-pgp-signatures-on-qubes-isos>`__. +You’re not verifying against the correct :ref:`detached PGP signature file `. Why am I getting "CRC error; […] no signature found […]"? ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -You’re not verifying against the correct `detached PGP signature file <#how-to-verify-detached-pgp-signatures-on-qubes-isos>`__, or the signature file has been modified. Try downloading it again or from a different source. +You’re not verifying against the correct :ref:`detached PGP signature file `, or the signature file has been modified. Try downloading it again or from a different source. -Do I have to verify both the `detached PGP signature file <#how-to-verify-detached-pgp-signatures-on-qubes-isos>`__ and the `cryptographic hash values <#how-to-verify-the-cryptographic-hash-values-of-qubes-isos>`__? +Do I have to verify both the :ref:`detached PGP signature file ` and the :ref:`cryptographic hash values `? ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ @@ -656,13 +656,13 @@ Why am I getting "no properly formatted X checksum lines found"? ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -You’re not checking the correct `cryptographic hash values <#how-to-verify-the-cryptographic-hash-values-of-qubes-isos>`__. +You’re not checking the correct :ref:`cryptographic hash values `. Why am I getting "WARNING: X lines are improperly formatted"? ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -Read `how to verify the cryptographic hash values of Qubes ISOs <#how-to-verify-the-cryptographic-hash-values-of-qubes-isos>`__ again. +Read :ref:`project-security/verifying-signatures:how to verify the cryptographic hash values of qubes isos` again. Why am I getting "WARNING: 1 listed file could not be read"? ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ @@ -674,4 +674,4 @@ I have another problem that isn't mentioned here. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -Carefully reread this page to be certain that you didn’t skip any steps. In particular, make sure you have the `Qubes Master Signing Key <#how-to-import-and-authenticate-the-qubes-master-signing-key>`__, the `release signing key <#how-to-import-and-authenticate-release-signing-keys>`__ for your Qubes release, *and* the `cryptographic hash values <#how-to-verify-the-cryptographic-hash-values-of-qubes-isos>`__ and/or `detached PGP signature file <#how-to-verify-detached-pgp-signatures-on-qubes-isos>`__, all for the *correct* Qubes OS release. If your question is about GPG, please see the `GnuPG documentation `__. Still have question? Please see :doc:`help, support, mailing lists, and forum ` for places where you can ask! +Carefully reread this page to be certain that you didn’t skip any steps. In particular, make sure you have the :ref:`Qubes Master Signing Key `, the :ref:`release signing key ` for your Qubes release, *and* the :ref:`cryptographic hash values ` and/or :ref:`detached PGP signature file `, all for the *correct* Qubes OS release. If your question is about GPG, please see the `GnuPG documentation `__. Still have question? Please see :doc:`help, support, mailing lists, and forum ` for places where you can ask! diff --git a/user/advanced-topics/i3.rst b/user/advanced-topics/i3.rst index 010dd203..b64d44fb 100644 --- a/user/advanced-topics/i3.rst +++ b/user/advanced-topics/i3.rst @@ -13,7 +13,7 @@ i3 is part of the stable repository (as of Qubes R3.1) and can be installed by u $ sudo qubes-dom0-update i3 i3-settings-qubes -The Qubes-specific configuration (package ``i3-settings-qubes``) can be installed optionally in case you would prefer writing your own configuration (see `customization <#customization>`__ section for scripts and configuration). +The Qubes-specific configuration (package ``i3-settings-qubes``) can be installed optionally in case you would prefer writing your own configuration (see :ref:`user/advanced-topics/i3:customization` section for scripts and configuration). That’s it. After logging out, you can select i3 in the login manager. diff --git a/user/advanced-topics/usb-qubes.rst b/user/advanced-topics/usb-qubes.rst index be975abe..6915677a 100644 --- a/user/advanced-topics/usb-qubes.rst +++ b/user/advanced-topics/usb-qubes.rst @@ -24,7 +24,7 @@ How to create a USB qube for use with a USB keyboard ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -If you’re reading this section, it’s likely because the installer did not allow you to create a USB qube automatically because you’re using a USB keyboard. This section will explain how to create a USB qube that you can use with your USB keyboard. This section assumes that you have only a single USB controller. If you have more than one USB controller, see `how to enable a USB keyboard on a separate USB controller <#qubes-4-1-how-to-enable-a-usb-keyboard-on-a-separate-usb-controller>`__. +If you’re reading this section, it’s likely because the installer did not allow you to create a USB qube automatically because you’re using a USB keyboard. This section will explain how to create a USB qube that you can use with your USB keyboard. This section assumes that you have only a single USB controller. If you have more than one USB controller, see :ref:`how to enable a USB keyboard on a separate USB controller `. First, make sure you have the latest ``qubes-mgmt-salt-dom0-virtual-machines`` package by :ref:`updating dom0 `. Then, enter the following command in dom0: @@ -36,7 +36,7 @@ First, make sure you have the latest ``qubes-mgmt-salt-dom0-virtual-machines`` p This command will take care of all required configuration, including creating a USB qube if not already present. Note, however, that this setup will expose dom0 to USB devices while you are entering your LUKS passphrase. While only input devices (keyboards, mice, etc.) are initialized at this stage, users are advised to physically disconnect other devices from the system during this vulnerable window in order to minimize the risk. -To undo these changes, see `how to remove a USB qube <#how-to-remove-a-usb-qube>`__. +To undo these changes, see :ref:`user/advanced-topics/usb-qubes:how to remove a usb qube`. If you wish to perform only a subset of this configuration (for example, you do not wish to enable the USB keyboard during boot), see the manual instructions below. @@ -72,7 +72,7 @@ You can set up your system so that there’s a confirmation prompt each time the -If you wish to use a USB keyboard to enter your LUKS passphrase, you cannot `hide its USB controller from dom0 <#how-to-hide-usb-controllers-from-dom0>`__. If you’ve already hidden that USB controller from dom0, you must revert the procedure by removing the ``rd.qubes.hide_all_usb`` option and employ an alternative strategy for protecting your system by physically disconnecting other devices during startup. +If you wish to use a USB keyboard to enter your LUKS passphrase, you cannot :ref:`hide its USB controller from dom0 `. If you’ve already hidden that USB controller from dom0, you must revert the procedure by removing the ``rd.qubes.hide_all_usb`` option and employ an alternative strategy for protecting your system by physically disconnecting other devices during startup. **Qubes 4.1 only:** You should also add the ``usbcore.authorized_default=0`` option, which prevents the initialization of non-input devices. (Qubes ships with a USBGuard configuration that allows only input devices when ``usbcore.authorized_default=0`` is set.) @@ -96,7 +96,7 @@ When using a USB keyboard on a system with multiple USB controllers, we recommen 7. Reboot. -8. Proceed with `creating a USB qube <#how-to-create-a-usb-qube>`__ normally. The selected USB controller will remain in dom0. +8. Proceed with :ref:`creating a USB qube ` normally. The selected USB controller will remain in dom0. @@ -142,7 +142,7 @@ How to create a USB qube ------------------------ -If `automatically creating a USB qube for use with a USB keyboard <#how-to-create-a-usb-qube-for-use-with-a-usb-keyboard>`__ does not apply to your situation, then you may be interested in more general methods for creating USB qubes. +If :ref:`automatically creating a USB qube for use with a USB keyboard ` does not apply to your situation, then you may be interested in more general methods for creating USB qubes. You can create a USB qube using the management stack by executing the following command as root in dom0: @@ -176,7 +176,7 @@ How to hide USB controllers from dom0 ------------------------------------- -USB controllers are automatically hidden from dom0 if you opt to create a USB qube during installation. This also occurs automatically if you choose to `create a USB qube <#how-to-create-a-usb-qube>`__ using the ``qubesctl`` method. However, if you create a USB qube manually and do not hide USB controllers from dom0, there will be a brief period of time during the boot process when dom0 will be exposed to your USB controllers (and any attached devices). This is a potential security risk, since even brief exposure to a malicious USB device could result in dom0 being compromised. There are two approaches to this problem: +USB controllers are automatically hidden from dom0 if you opt to create a USB qube during installation. This also occurs automatically if you choose to :ref:`create a USB qube ` using the ``qubesctl`` method. However, if you create a USB qube manually and do not hide USB controllers from dom0, there will be a brief period of time during the boot process when dom0 will be exposed to your USB controllers (and any attached devices). This is a potential security risk, since even brief exposure to a malicious USB device could result in dom0 being compromised. There are two approaches to this problem: 1. Physically disconnect all USB devices whenever you reboot the host. @@ -184,7 +184,7 @@ USB controllers are automatically hidden from dom0 if you opt to create a USB qu -**Warning:** If you use a USB keyboard, hiding your USB controllers from dom0 could lock you out of your system. See `USB keyboards <#usb-keyboards>`__ for more information. +**Warning:** If you use a USB keyboard, hiding your USB controllers from dom0 could lock you out of your system. See :ref:`user/advanced-topics/usb-qubes:usb keyboards` for more information. **Warning:** Using a USB AEM device requires dom0 to have access to the USB controller to which your USB AEM device is attached. If dom0 cannot read your USB AEM device, AEM will hang. diff --git a/user/downloading-installing-upgrading/installation-guide-4.1.rst b/user/downloading-installing-upgrading/installation-guide-4.1.rst index 75584ac5..7eb2855f 100644 --- a/user/downloading-installing-upgrading/installation-guide-4.1.rst +++ b/user/downloading-installing-upgrading/installation-guide-4.1.rst @@ -137,7 +137,7 @@ Prior to the next screen, a compatibility test runs to check whether IOMMU-virtu |Unsupported hardware detected| -Do not panic. It may simply indicate that IOMMU-virtualization hasn’t been activated in the BIOS or UEFI. Return to the `hardware requirements <#hardware-requirements>`__ section to learn how to activate it. If the setting is not configured correctly, it means that your hardware won’t be able to leverage some Qubes security features, such as a strict isolation of the networking and USB hardware. +Do not panic. It may simply indicate that IOMMU-virtualization hasn’t been activated in the BIOS or UEFI. Return to the :ref:`user/downloading-installing-upgrading/installation-guide-4.1:hardware requirements` section to learn how to activate it. If the setting is not configured correctly, it means that your hardware won’t be able to leverage some Qubes security features, such as a strict isolation of the networking and USB hardware. If the test passes, you will reach the installation summary screen. The installer loads Xen right at the beginning. If you can see the installer’s graphical screen, and you pass the compatibility check that runs immediately afterward, Qubes OS is likely to work on your system! @@ -317,7 +317,7 @@ Security ^^^^^^^^ -The Qubes OS Project occasionally issues `Qubes Security Bulletins (QSBs) `__ as part of the :doc:`Qubes Security Pack (qubes-secpack) `. It is important to make sure that you receive all QSBs in a timely manner so that you can take action to keep your system secure. (While `updating <#updating>`__ will handle most security needs, there may be cases in which additional action from you is required.) For this reason, we strongly recommend that every Qubes user subscribe to the :ref:`qubes-announce ` mailing list. +The Qubes OS Project occasionally issues `Qubes Security Bulletins (QSBs) `__ as part of the :doc:`Qubes Security Pack (qubes-secpack) `. It is important to make sure that you receive all QSBs in a timely manner so that you can take action to keep your system secure. (While :ref:`user/downloading-installing-upgrading/installation-guide-4.1:updating` will handle most security needs, there may be cases in which additional action from you is required.) For this reason, we strongly recommend that every Qubes user subscribe to the :ref:`qubes-announce ` mailing list. In addition to QSBs, the Qubes OS Project also publishes `Canaries `__, XSA summaries, template releases and end-of-life notices, and other items of interest to Qubes users. Since these are not essential for all Qubes users to read, they are not sent to :ref:`qubes-announce ` in order to keep the volume on that list low. However, we expect that most users, especially novice users, will find them helpful. If you are interested in these additional items, we encourage you to subscribe to the `Qubes News RSS feed `__ or join one of our other :doc:`venues `, where these news items are also announced. diff --git a/user/downloading-installing-upgrading/installation-guide.rst b/user/downloading-installing-upgrading/installation-guide.rst index 4fff1620..e453c704 100644 --- a/user/downloading-installing-upgrading/installation-guide.rst +++ b/user/downloading-installing-upgrading/installation-guide.rst @@ -141,7 +141,7 @@ Prior to the next screen, a compatibility test runs to check whether IOMMU-virtu |Unsupported hardware detected| -Do not panic. It may simply indicate that IOMMU-virtualization hasn’t been activated in the BIOS or UEFI. Return to the `hardware requirements <#hardware-requirements>`__ section to learn how to activate it. If the setting is not configured correctly, it means that your hardware won’t be able to leverage some Qubes security features, such as a strict isolation of the networking and USB hardware. +Do not panic. It may simply indicate that IOMMU-virtualization hasn’t been activated in the BIOS or UEFI. Return to the :ref:`user/downloading-installing-upgrading/installation-guide:hardware requirements` section to learn how to activate it. If the setting is not configured correctly, it means that your hardware won’t be able to leverage some Qubes security features, such as a strict isolation of the networking and USB hardware. If the test passes, you will reach the installation summary screen. The installer loads Xen right at the beginning. If you can see the installer’s graphical screen, and you pass the compatibility check that runs immediately afterward, Qubes OS is likely to work on your system! @@ -305,7 +305,7 @@ Security ^^^^^^^^ -The Qubes OS Project occasionally issues `Qubes Security Bulletins (QSBs) `__ as part of the :doc:`Qubes Security Pack (qubes-secpack) `. It is important to make sure that you receive all QSBs in a timely manner so that you can take action to keep your system secure. (While `updating <#updating>`__ will handle most security needs, there may be cases in which additional action from you is required.) For this reason, we strongly recommend that every Qubes user subscribe to the :ref:`qubes-announce ` mailing list. +The Qubes OS Project occasionally issues `Qubes Security Bulletins (QSBs) `__ as part of the :doc:`Qubes Security Pack (qubes-secpack) `. It is important to make sure that you receive all QSBs in a timely manner so that you can take action to keep your system secure. (While :ref:`user/downloading-installing-upgrading/installation-guide:updating` will handle most security needs, there may be cases in which additional action from you is required.) For this reason, we strongly recommend that every Qubes user subscribe to the :ref:`qubes-announce ` mailing list. In addition to QSBs, the Qubes OS Project also publishes `Canaries `__, XSA summaries, template releases and end-of-life notices, and other items of interest to Qubes users. Since these are not essential for all Qubes users to read, they are not sent to :ref:`qubes-announce ` in order to keep the volume on that list low. However, we expect that most users, especially novice users, will find them helpful. If you are interested in these additional items, we encourage you to subscribe to the `Qubes News RSS feed `__ or join one of our other :doc:`venues `, where these news items are also announced. diff --git a/user/downloading-installing-upgrading/testing.rst b/user/downloading-installing-upgrading/testing.rst index 61246536..6be34cd1 100644 --- a/user/downloading-installing-upgrading/testing.rst +++ b/user/downloading-installing-upgrading/testing.rst @@ -42,7 +42,7 @@ How to test updates: -Every new update is first uploaded to the ``security-testing`` repository if it is a security update or ``current-testing`` if it is a normal update. The update remains in ``security-testing`` or ``current-testing`` for a minimum of one week. On occasion, an exception is made for a particularly critical security update, which is immediately pushed to the ``current`` stable repository. In general, however, security updates remain in ``security-testing`` for two weeks before migrating to ``current``. Normal updates generally remain in ``current-testing`` until they have been sufficiently tested by the community, which can last weeks or even months, depending on the amount of feedback received (see `Providing feedback <#providing-feedback>`__). +Every new update is first uploaded to the ``security-testing`` repository if it is a security update or ``current-testing`` if it is a normal update. The update remains in ``security-testing`` or ``current-testing`` for a minimum of one week. On occasion, an exception is made for a particularly critical security update, which is immediately pushed to the ``current`` stable repository. In general, however, security updates remain in ``security-testing`` for two weeks before migrating to ``current``. Normal updates generally remain in ``current-testing`` until they have been sufficiently tested by the community, which can last weeks or even months, depending on the amount of feedback received (see :ref:`user/downloading-installing-upgrading/testing:providing feedback`). “Sufficient testing” is, in practice, a fluid term that is up the developers’ judgment. In general, it means either that no negative feedback and at least one piece of positive feedback has been received or that the package has been in ``current-testing`` for long enough, depending on the component and the complexity of the changes. diff --git a/user/downloading-installing-upgrading/upgrade/4_1.rst b/user/downloading-installing-upgrading/upgrade/4_1.rst index 4b5932eb..7f0ec238 100644 --- a/user/downloading-installing-upgrading/upgrade/4_1.rst +++ b/user/downloading-installing-upgrading/upgrade/4_1.rst @@ -31,7 +31,7 @@ In-place upgrade ---------------- -**Warning:** It is not possible to upgrade directly from releases earlier than 4.0. If you’re still on an earlier release, please either perform a `clean installation of 4.1 <#clean-installation>`__ or :doc:`upgrade to 4.0 ` first. +**Warning:** It is not possible to upgrade directly from releases earlier than 4.0. If you’re still on an earlier release, please either perform a :ref:`clean installation of 4.1 ` or :doc:`upgrade to 4.0 ` first. The upgrade may take several hours, and will download several gigabytes of data. diff --git a/user/downloading-installing-upgrading/upgrade/4_2.rst b/user/downloading-installing-upgrading/upgrade/4_2.rst index 6e580b3b..a579f810 100644 --- a/user/downloading-installing-upgrading/upgrade/4_2.rst +++ b/user/downloading-installing-upgrading/upgrade/4_2.rst @@ -50,7 +50,7 @@ In-place upgrade ---------------- -**Warning:** It is not possible to upgrade directly from releases earlier than 4.1. If you’re still on an earlier release, please either perform a `clean installation of 4.2 <#clean-installation>`__ or :doc:`upgrade to 4.1 ` first. +**Warning:** It is not possible to upgrade directly from releases earlier than 4.1. If you’re still on an earlier release, please either perform a :ref:`clean installation of 4.2 ` or :doc:`upgrade to 4.1 ` first. The upgrade may take several hours, and will download several gigabytes of data. diff --git a/user/downloading-installing-upgrading/upgrade/4_3.rst b/user/downloading-installing-upgrading/upgrade/4_3.rst index 2a5f904f..7d9b57fb 100644 --- a/user/downloading-installing-upgrading/upgrade/4_3.rst +++ b/user/downloading-installing-upgrading/upgrade/4_3.rst @@ -48,7 +48,7 @@ In-place upgrade ---------------- -**Warning:** It is not possible to upgrade directly from releases earlier than 4.2. If you’re still on an earlier release, please either perform a `clean installation of 4.3 <#clean-installation>`__ or :doc:`upgrade to 4.2 ` first. +**Warning:** It is not possible to upgrade directly from releases earlier than 4.2. If you’re still on an earlier release, please either perform a :ref:`clean installation of 4.3 ` or :doc:`upgrade to 4.2 ` first. The upgrade may take several hours, and will download several gigabytes of data. diff --git a/user/hardware/system-requirements.rst b/user/hardware/system-requirements.rst index 92d2c2e0..ac5ac3d7 100644 --- a/user/hardware/system-requirements.rst +++ b/user/hardware/system-requirements.rst @@ -5,7 +5,7 @@ System requirements .. warning:: - Notice: The system requirements on this page are *necessary, but not sufficient*, for Qubes compatibility at a minimal or recommended level. In other words, just because a computer satisfies these requirements doesn’t mean that Qubes will successfully install and run on it. We strongly recommend consulting the `resources below <#choosing-hardware>`__ when selecting hardware for Qubes. + Notice: The system requirements on this page are *necessary, but not sufficient*, for Qubes compatibility at a minimal or recommended level. In other words, just because a computer satisfies these requirements doesn’t mean that Qubes will successfully install and run on it. We strongly recommend consulting :ref:`user/hardware/system-requirements:choosing hardware` when selecting hardware for Qubes. Minimum ------- @@ -35,9 +35,9 @@ Recommended - `Intel VT-d `__ - - For security, we recommend processors that are recent enough to still be receiving microcode updates (see `below <#important-notes>`__ for details). + - For security, we recommend processors that are recent enough to still be receiving microcode updates (see :ref:`user/hardware/system-requirements:important notes` for details). - - AMD processors are not recommended due to inconsistent security support on client platforms (see `below <#important-notes>`__ for details). + - AMD processors are not recommended due to inconsistent security support on client platforms (see :ref:`user/hardware/system-requirements:important notes` for details). diff --git a/user/how-to-guides/how-to-back-up-restore-and-migrate.rst b/user/how-to-guides/how-to-back-up-restore-and-migrate.rst index 957445a4..2fed9d0c 100644 --- a/user/how-to-guides/how-to-back-up-restore-and-migrate.rst +++ b/user/how-to-guides/how-to-back-up-restore-and-migrate.rst @@ -60,7 +60,7 @@ Creating a backup 5. When you are ready, click **Next**. Qubes will proceed to create your backup. Once the progress bar has completed, you may click **Finish**. -6. Test restore your backup. Follow the `restore procedure <#restoring-from-a-backup>`__, selecting **Verify backup integrity, do not restore the data**. This step is optional but strongly recommended. A backup is useless if you can’t restore your data from it, and you can’t be sure that your backup is good until you try to restore. +6. Test restore your backup. Follow the :ref:`restore procedure `, selecting **Verify backup integrity, do not restore the data**. This step is optional but strongly recommended. A backup is useless if you can’t restore your data from it, and you can’t be sure that your backup is good until you try to restore. diff --git a/user/how-to-guides/how-to-copy-from-dom0.rst b/user/how-to-guides/how-to-copy-from-dom0.rst index 07726c82..02e91c92 100644 --- a/user/how-to-guides/how-to-copy-from-dom0.rst +++ b/user/how-to-guides/how-to-copy-from-dom0.rst @@ -41,7 +41,7 @@ Use the **Qubes Clipboard** widget: -Alternatively, you can put your text in a file, then `copy it as a file <#copying-files-from-dom0>`__. Or, you can write the data you wish to copy into ``/var/run/qubes/qubes-clipboard.bin``, then ``echo -n dom0 > /var/run/qubes/qubes-clipboard.bin.source``. Then use Ctrl+Shift+V to paste the data to the target qube. +Alternatively, you can put your text in a file, then :ref:`copy it as a file `. Or, you can write the data you wish to copy into ``/var/run/qubes/qubes-clipboard.bin``, then ``echo -n dom0 > /var/run/qubes/qubes-clipboard.bin.source``. Then use Ctrl+Shift+V to paste the data to the target qube. Copying logs from dom0 ^^^^^^^^^^^^^^^^^^^^^^ @@ -65,7 +65,7 @@ Copying *to* dom0 ----------------- -Copying anything into dom0 is not advised, since doing so can compromise the security of your Qubes system. For this reason, there is no simple means of copying anything into dom0, unlike `copying from dom0 <#copying-from-dom0>`__. +Copying anything into dom0 is not advised, since doing so can compromise the security of your Qubes system. For this reason, there is no simple means of copying anything into dom0, unlike :ref:`user/how-to-guides/how-to-copy-from-dom0:copying *from* dom0`. There should normally be few reasons for the user to want to copy anything from domUs to dom0, as dom0 only acts as a “thin trusted terminal”, and no user applications run there. Sometimes, new users feel the urge to copy a desktop wallpaper image into dom0, but that is not necessary. A safer approach is simply to display the image in :doc:`full-screen mode ` in an app qube, then take a screenshot from dom0, which results in exactly the image needed for a wallpaper, created securely and natively in dom0. diff --git a/user/how-to-guides/how-to-install-software.rst b/user/how-to-guides/how-to-install-software.rst index 4b0f3545..fa5d7696 100644 --- a/user/how-to-guides/how-to-install-software.rst +++ b/user/how-to-guides/how-to-install-software.rst @@ -56,7 +56,7 @@ If you are using another installation method fetching remote resources, you migh Using direct networking ^^^^^^^^^^^^^^^^^^^^^^^ -.. Warning:: This method gives your template direct network access, which is `risky <#why-dont-templates-have-normal-network-access>`__. This method is **not** recommended for trusted templates. Moreover, depending on how you install this software, it may not get updated automatically when you :doc:`update Qubes normally `, which means you may have to update it manually yourself. +.. Warning:: This method gives your template direct network access, which is :ref:`risky `. This method is **not** recommended for trusted templates. Moreover, depending on how you install this software, it may not get updated automatically when you :doc:`update Qubes normally `, which means you may have to update it manually yourself. This method assumes that you are trying to follow instructions to install some piece of software in a normal operating system, except *that* operating system is running as a template in Qubes OS. @@ -112,7 +112,7 @@ Please see :doc:`/user/how-to-guides/how-to-update`. Why don't templates have normal network access? ----------------------------------------------- -In order to protect you from performing risky activities in templates, they do not have normal network access by default. Instead, templates use an :ref:`updates-proxy` which allows you to install and update software using the distribution’s package manager over the proxy connection. **The updates proxy is already set up to work automatically out-of-the-box and requires no special action from you.** Most users should simply follow the normal instructions for :ref:`installing-software-from-default-repositories` and :doc:`updating ` software. If your software is not available in the default repositories, see `installing software from other sources <#installing-software-from-other-sources>`__. +In order to protect you from performing risky activities in templates, they do not have normal network access by default. Instead, templates use an :ref:`updates-proxy` which allows you to install and update software using the distribution’s package manager over the proxy connection. **The updates proxy is already set up to work automatically out-of-the-box and requires no special action from you.** Most users should simply follow the normal instructions for :ref:`installing-software-from-default-repositories` and :doc:`updating ` software. If your software is not available in the default repositories, see :ref:`user/how-to-guides/how-to-install-software:installing software from other sources`. Advanced -------- diff --git a/user/how-to-guides/how-to-update.rst b/user/how-to-guides/how-to-update.rst index bbc22324..a09a68f8 100644 --- a/user/how-to-guides/how-to-update.rst +++ b/user/how-to-guides/how-to-update.rst @@ -45,7 +45,7 @@ Installing updates ------------------ -The standard way to install updates is with the **Qubes Update** tool. (However, you can also perform the same action via the `command-line interface <#command-line-interface>`__.) +The standard way to install updates is with the **Qubes Update** tool. (However, you can also perform the same action via the :ref:`user/how-to-guides/how-to-update:command-line interface`.) |Qubes Update| diff --git a/user/how-to-guides/how-to-use-block-storage-devices.rst b/user/how-to-guides/how-to-use-block-storage-devices.rst index 698659f1..f1157af2 100644 --- a/user/how-to-guides/how-to-use-block-storage-devices.rst +++ b/user/how-to-guides/how-to-use-block-storage-devices.rst @@ -42,7 +42,7 @@ Beware that when you attach a whole block device, partitions can be identified b If several different block-devices are attached to a single VM, the last letter of the device node name is advanced through the alphabet, so after ``xvdi`` the next device will be named ``xvdj``, the next ``xvdk``, and so on. -To specify this device node name, you need to use the command line tool and its `frontend-dev-option <#frontend-dev>`__. +To specify this device node name, you need to use the command line tool and its :ref:`frontend-dev-option `. Command Line Tool Guide ----------------------- diff --git a/user/how-to-guides/how-to-use-usb-devices.rst b/user/how-to-guides/how-to-use-usb-devices.rst index d3497913..65534106 100644 --- a/user/how-to-guides/how-to-use-usb-devices.rst +++ b/user/how-to-guides/how-to-use-usb-devices.rst @@ -87,6 +87,8 @@ Creating and using a USB qube If you’ve selected to install a usb-qube during system installation, everything is already set up for you in ``sys-usb``. If you’ve later decided to create a usb-qube, please follow :doc:`this guide `. +.. _installation-of-qubes-usb-proxy: + Installation of ``qubes-usb-proxy`` ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ diff --git a/user/security-in-qubes/ctap-proxy.rst b/user/security-in-qubes/ctap-proxy.rst index 364ef34f..9311d0f3 100644 --- a/user/security-in-qubes/ctap-proxy.rst +++ b/user/security-in-qubes/ctap-proxy.rst @@ -41,7 +41,7 @@ The ``vault`` qube with a dashed line in the bottom portion of the diagram depic One very important assumption of protocol is that the browser verifies every request sent to the authenticator — in particular, that the web application sending an authentication request matches the application that would be authenticated by answering that request (in order to prevent, e.g., a phishing site from sending an authentication request for your bank’s site). With the WebUSB feature in Chrome, however, a malicious website can `bypass `__ this safeguard by connecting directly to the token instead of using the browser’s CTAP API. -The Qubes CTAP Proxy also prevents this class of attacks by implementing an additional verification layer. This verification layer allows you to enforce, for example, that the web browser in your ``twitter`` qube can only access the CTAP key associated with ``https://twitter.com``. This means that if anything in your ``twitter`` qube were compromised — the browser or even the OS itself — it would still not be able to access the CTAP keys on your token for any other websites or services, like your email and bank accounts. This is another significant security advantage over monolithic systems. (For details and instructions, see the `Advanced usage <#advanced-usage-per-qube-key-access>`__ section below.) +The Qubes CTAP Proxy also prevents this class of attacks by implementing an additional verification layer. This verification layer allows you to enforce, for example, that the web browser in your ``twitter`` qube can only access the CTAP key associated with ``https://twitter.com``. This means that if anything in your ``twitter`` qube were compromised — the browser or even the OS itself — it would still not be able to access the CTAP keys on your token for any other websites or services, like your email and bank accounts. This is another significant security advantage over monolithic systems. For details and instructions, see :ref:`per-qube-key-access`. For even more protection, you can combine this with the :doc:`Qubes firewall ` to ensure, for example, that the browser in your ``banking`` qube accesses only one website (your bank’s website). By configuring the Qubes firewall to prevent your ``banking`` qube from accessing any other websites, you reduce the risk of another website compromising the browser in an attempt to bypass CTAP authentication. @@ -78,7 +78,9 @@ In Debian templates: -As usual with software updates, shut down the templates after installation, then restart ``sys-usb`` and all qubes that use the proxy. After that, you may use your CTAP authenticator (but see `Browser support <#template-and-browser-support>`__ below). +As usual with software updates, shut down the templates after installation, then restart ``sys-usb`` and all qubes that use the proxy. After that, you may use your CTAP authenticator (but see :ref:`Browser support ` below). + +.. _per-qube-key-access: Advanced usage: per-qube key access ----------------------------------- diff --git a/user/security-in-qubes/firewall.rst b/user/security-in-qubes/firewall.rst index a632e0d8..e1b77f14 100644 --- a/user/security-in-qubes/firewall.rst +++ b/user/security-in-qubes/firewall.rst @@ -53,7 +53,7 @@ The firewall rules for each qube are saved in an XML file in that qube’s direc Rules are implemented on the netvm. -You can also manually create rules in the qube itself using standard firewalling controls. See `Where to put firewall rules <#where-to-put-firewall-rules>`__. In complex cases, it might be appropriate to load a ruleset using ``nft -f /path/to/ruleset`` called from ``/rw/config/rc.local``, the ruleset file can be populated from the current ruleset using ``nft list ruleset > /path/to/ruleset``, you should add ``flush ruleset`` at the top of the file to remove all existing rules before loading them. if you do this, be aware that ``rc.local`` is called *after* the network is up, so local rules should not be relied upon to block leaks. +You can also manually create rules in the qube itself using standard firewalling controls. See :ref:`user/security-in-qubes/firewall:where to put firewall rules`. In complex cases, it might be appropriate to load a ruleset using ``nft -f /path/to/ruleset`` called from ``/rw/config/rc.local``, the ruleset file can be populated from the current ruleset using ``nft list ruleset > /path/to/ruleset``, you should add ``flush ruleset`` at the top of the file to remove all existing rules before loading them. if you do this, be aware that ``rc.local`` is called *after* the network is up, so local rules should not be relied upon to block leaks. Reconnecting qubes after a NetVM reboot --------------------------------------- diff --git a/user/security-in-qubes/firewall_4.1.rst b/user/security-in-qubes/firewall_4.1.rst index 72283576..46970e8d 100644 --- a/user/security-in-qubes/firewall_4.1.rst +++ b/user/security-in-qubes/firewall_4.1.rst @@ -55,7 +55,7 @@ The firewall rules for each qube are saved in an XML file in that qube’s direc Rules are implemented on the netvm. -You can also manually create rules in the qube itself using standard firewalling controls. See `Where to put firewall rules <#where-to-put-firewall-rules>`__. In complex cases, it might be appropriate to load a ruleset using ``iptables-restore`` called from ``/rw/config/rc.local``. if you do this, be aware that ``rc.local`` is called *after* the network is up, so local rules should not be relied upon to block leaks. +You can also manually create rules in the qube itself using standard firewalling controls. See :ref:`user/security-in-qubes/firewall_4.1:where to put firewall rules`. In complex cases, it might be appropriate to load a ruleset using ``iptables-restore`` called from ``/rw/config/rc.local``. if you do this, be aware that ``rc.local`` is called *after* the network is up, so local rules should not be relied upon to block leaks. Reconnecting qubes after a NetVM reboot --------------------------------------- diff --git a/user/security-in-qubes/split-gpg.rst b/user/security-in-qubes/split-gpg.rst index a304e9d5..3db7d92d 100644 --- a/user/security-in-qubes/split-gpg.rst +++ b/user/security-in-qubes/split-gpg.rst @@ -80,7 +80,7 @@ This is pretty much all that is required. However, you might want to modify the Please note that previously, this parameter was set in ~/.bash_profile. This will no longer work. If you have the parameter set in ~/.bash_profile you *must* update your configuration. -Please be aware of the caveat regarding passphrase-protected keys in the `Current limitations <#current-limitations>`__ section. +Please be aware of the caveat regarding passphrase-protected keys in the :ref:`user/security-in-qubes/split-gpg:current limitations` section. Configuring the client apps to use Split GPG backend ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ @@ -288,6 +288,8 @@ A safe, unspoofable user consent dialog box is displayed. Selecting “Yes to All” will add a line in the corresponding :doc:`RPC Policy ` file. +.. _using-split-gpg-with-subkeys: + Advanced: Using Split GPG with Subkeys -------------------------------------- @@ -388,11 +390,11 @@ Current limitations ------------------- -- Current implementation requires importing of public keys to the vault domain. This opens up an avenue to attack the gpg running in the backend domain via a hypothetical bug in public key importing code. See ticket `#474 `__ for more details and plans how to get around this problem, as well as the section on `using Split GPG with subkeys <#advanced-using-split-gpg-with-subkeys>`__. +- Current implementation requires importing of public keys to the vault domain. This opens up an avenue to attack the gpg running in the backend domain via a hypothetical bug in public key importing code. See ticket `#474 `__ for more details and plans how to get around this problem, as well as the section on :ref:`using-split-gpg-with-subkeys`. - It doesn’t solve the problem of allowing the user to know what is to be signed before the operation gets approved. Perhaps the GPG backend domain could start a disposable and have the to-be-signed document displayed there? To Be Determined. -- The Split GPG client will fail to sign or encrypt if the private key in the GnuPG backend is protected by a passphrase. It will give an ``Inappropriate ioctl for device`` error. Do not set passphrases for the private keys in the GPG backend domain. Doing so won’t provide any extra security anyway, as explained in the introduction and in `using Split GPG with subkeys <#advanced-using-split-gpg-with-subkeys>`__. If you are generating a new key pair, or if you have a private key that already has a passphrase, you can use ``gpg2 --edit-key `` then ``passwd`` to set an empty passphrase. Note that ``pinentry`` might show an error when you try to set an empty passphrase, but it will still make the change. (See `this StackExchange answer `__ for more information.) **Note:** The error shows only if you **do not** have graphical pinentry installed. +- The Split GPG client will fail to sign or encrypt if the private key in the GnuPG backend is protected by a passphrase. It will give an ``Inappropriate ioctl for device`` error. Do not set passphrases for the private keys in the GPG backend domain. Doing so won’t provide any extra security anyway, as explained in the introduction and in :ref:`using-split-gpg-with-subkeys`. If you are generating a new key pair, or if you have a private key that already has a passphrase, you can use ``gpg2 --edit-key `` then ``passwd`` to set an empty passphrase. Note that ``pinentry`` might show an error when you try to set an empty passphrase, but it will still make the change. (See `this StackExchange answer `__ for more information.) **Note:** The error shows only if you **do not** have graphical pinentry installed. .. [1] diff --git a/user/templates/debian/debian-upgrade.rst b/user/templates/debian/debian-upgrade.rst index dc546097..53948b41 100644 --- a/user/templates/debian/debian-upgrade.rst +++ b/user/templates/debian/debian-upgrade.rst @@ -16,7 +16,7 @@ Summary instructions for Debian templates ----------------------------------------- -**Important:** The prompt on each line indicates where each command should be entered: ``dom0``, ``debian-``, or ``debian-``, where ```` is the Debian version number *from* which you are upgrading, and ```` is the Debian version number *to* which you are upgrading. The instructions may differ for certain releases. See `release-specific notes <#release-specific-notes>`__ for any instructions specific to your particular release. +**Important:** The prompt on each line indicates where each command should be entered: ``dom0``, ``debian-``, or ``debian-``, where ```` is the Debian version number *from* which you are upgrading, and ```` is the Debian version number *to* which you are upgrading. The instructions may differ for certain releases. See :ref:`user/templates/debian/debian-upgrade:release-specific notes` for any instructions specific to your particular release. .. code:: console @@ -38,7 +38,7 @@ Detailed instructions for Debian templates These instructions will show you how to upgrade Debian templates. The same general procedure may be used to upgrade any template based on the standard Debian template. -**Important:** The prompt on each line indicates where each command should be entered: ``dom0``, ``debian-``, or ``debian-``, where ```` is the Debian version number *from* which you are upgrading, and ```` is the Debian version number *to* which you are upgrading. The instructions may differ for certain releases. See `release-specific notes <#release-specific-notes>`__ for any instructions specific to your particular release. +**Important:** The prompt on each line indicates where each command should be entered: ``dom0``, ``debian-``, or ``debian-``, where ```` is the Debian version number *from* which you are upgrading, and ```` is the Debian version number *to* which you are upgrading. The instructions may differ for certain releases. See :ref:`user/templates/debian/debian-upgrade:release-specific notes` for any instructions specific to your particular release. 1. Ensure the existing template is not running. diff --git a/user/templates/debian/debian.rst b/user/templates/debian/debian.rst index a344091a..135767da 100644 --- a/user/templates/debian/debian.rst +++ b/user/templates/debian/debian.rst @@ -53,7 +53,7 @@ Upgrading There are two ways to upgrade your template to a new Debian release: -- **Recommended:** `Install a fresh template to replace the existing one. <#installing>`__ **This option may be simpler for less experienced users.** After you install the new template, redo all desired template modifications and :ref:`switch everything that was set to the old template to the new template `. You may want to write down the modifications you make to your templates so that you remember what to redo on each fresh install. In the old Debian template, see ``/var/log/dpkg.log`` and ``/var/log/apt/history.log`` for logs of package manager actions. +- **Recommended:** :ref:`Install a fresh template to replace the existing one. ` **This option may be simpler for less experienced users.** After you install the new template, redo all desired template modifications and :ref:`switch everything that was set to the old template to the new template `. You may want to write down the modifications you make to your templates so that you remember what to redo on each fresh install. In the old Debian template, see ``/var/log/dpkg.log`` and ``/var/log/apt/history.log`` for logs of package manager actions. - **Advanced:** :doc:`Perform an in-place upgrade of an existing Debian template. ` This option will preserve any modifications you’ve made to the template, **but it may be more complicated for less experienced users.** diff --git a/user/templates/fedora/fedora-upgrade.rst b/user/templates/fedora/fedora-upgrade.rst index 0b39ce41..3cbeac17 100644 --- a/user/templates/fedora/fedora-upgrade.rst +++ b/user/templates/fedora/fedora-upgrade.rst @@ -105,7 +105,7 @@ These instructions will show you how to upgrade the standard Fedora template. Th If this attempt is successful, proceed to step 4. - ``dnf`` may error with the text: ``At least X MB more space needed on the / filesystem.`` - In this case, one option is to :doc:`resize the template’s disk image ` before reattempting the upgrade process. (See `Additional Information <#additional-information>`__ below for other options.) + In this case, one option is to :doc:`resize the template’s disk image ` before reattempting the upgrade process. (See :ref:`user/templates/fedora/fedora-upgrade:additional information` below for other options.) diff --git a/user/templates/fedora/fedora.rst b/user/templates/fedora/fedora.rst index 0015a6d7..601f5f0c 100644 --- a/user/templates/fedora/fedora.rst +++ b/user/templates/fedora/fedora.rst @@ -53,7 +53,7 @@ Upgrading There are two ways to upgrade your template to a new Fedora release: -- **Recommended:** `Install a fresh template to replace the existing one. <#installing>`__ **This option may be simpler for less experienced users.** After you install the new template, redo all desired template modifications and :ref:`switch everything that was set to the old template to the new template `. You may want to write down the modifications you make to your templates so that you remember what to redo on each fresh install. To see a log of package manager actions, open a terminal in the old Fedora template and use the ``dnf history`` command. +- **Recommended:** :ref:`Install a fresh template to replace the existing one. ` **This option may be simpler for less experienced users.** After you install the new template, redo all desired template modifications and :ref:`switch everything that was set to the old template to the new template `. You may want to write down the modifications you make to your templates so that you remember what to redo on each fresh install. To see a log of package manager actions, open a terminal in the old Fedora template and use the ``dnf history`` command. - **Advanced:** :doc:`Perform an in-place upgrade of an existing Fedora template. ` This option will preserve any modifications you’ve made to the template, **but it may be more complicated for less experienced users.** diff --git a/user/templates/templates.rst b/user/templates/templates.rst index c709f466..34522a3f 100644 --- a/user/templates/templates.rst +++ b/user/templates/templates.rst @@ -3,7 +3,7 @@ Templates ========= -In :doc:`Getting Started `, we covered the distinction in Qubes OS between where you *install* your software and where you *run* your software. Software that you use in most everyday tasks, is installed within :term:`templates